Skip to contentSkip to conversation

Now implement libcgroup policy.

PATCH New Dominick Grift 1 participant 1 message Apr 28, 2010

lore
Share & tools
lore

Dominick Grift

author
#0 lore raw

PATCH 2/4 Now implement libcgroup policy.

This is a set of scripts that automate cgroup management.

Signed-off-by Dominick Grift <[email protected]>

---
:100644 100644 5a34915... 3b65a38... M policy/modules/kernel/filesystem.if
:000000 100644 0000000... dd006ff... A policy/modules/services/cgroup.fc
:000000 100644 0000000... abcab97... A policy/modules/services/cgroup.if
:000000 100644 0000000... 67facee... A policy/modules/services/cgroup.te

 policy/modules/kernel/filesystem.if |   19 +++++
 policy/modules/services/cgroup.fc   |   11 +++
 policy/modules/services/cgroup.if   |  126 +++++++++++++++++++++++++++++++++++
 policy/modules/services/cgroup.te   |  111 ++++++++++++++++++++++++++++++
 4 files changed, 267 insertions(+), 0 deletions(-)
policy/modules/kernel/filesystem.if +19 -0
index 5a34915..3b65a38 100644
@@ -633,6 +633,25 @@ interface(`fs_getattr_cgroupfs', `
 
 ########################################
 ## <summary>
+##	Delete dirs on cgroup
+##	file systems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_delete_cgroupfs_dirs', `
+	gen_require(`
+		type cgroupfs_t;
+	')
+
+	delete_dirs_pattern($1, cgroupfs_t, cgroupfs_t)
+')
+
+########################################
+## <summary>
 ##	list dirs on cgroup
 ##	file systems.
 ## </summary>
policy/modules/services/cgroup.fc new file +11 -0
new file mode 100644
index 0000000..dd006ff
@@ -0,0 +1,11 @@
+/cgroup(/.*)?					gen_context(system_u:object_r:cgroup_t,s0)
+
+/etc/rc\.d/init\.d/cgconfig	--	gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/cgred	--	gen_context(system_u:object_r:cgred_initrc_exec_t,s0)
+
+/sbin/cgclear				--	gen_context(system_u:object_r:cgclear_exec_t,s0)
+/sbin/cgconfigparser		--	gen_context(system_u:object_r:cgconfigparser_exec_t,s0)
+/sbin/cgrulesengd			--	gen_context(system_u:object_r:cgred_exec_t,s0)
+
+/var/run/cgred.*				gen_context(system_u:object_r:cgred_var_run_t,s0)
+
policy/modules/services/cgroup.if new file +126 -0

126 lines not on this page · raw message

policy/modules/services/cgroup.te new file +111 -0

111 lines not on this page · raw message

Signature · 9 lines
1.7.0.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100428/736f358a/attachment.bin