selinux: Allow ceph to setsched

In several places, such as common/numa.cc we call sched_setaffinity which requires this permission. Fixes: https://tracker.ceph.com/issues/44196 Signed-off-by: Brad Hubbard <[email protected]>
senax · Feb 19, 2020 · 43103e0 · 43103e0
1 parent 138f407
commit 43103e0
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/selinux/ceph.te b/selinux/ceph.te
@@ -142,6 +142,7 @@ allow ceph_t configfs_t:lnk_file { create getattr read unlink };
 allow ceph_t random_device_t:chr_file getattr;
 allow ceph_t urandom_device_t:chr_file getattr;
 allow ceph_t self:process setpgid;
+allow ceph_t self:process setsched;
 allow ceph_t var_run_t:dir { write create add_name };
 allow ceph_t var_run_t:file { read write create open getattr };
 allow ceph_t init_var_run_t:file getattr;