Skip to content

Commit

Permalink
rgw-loadbalancers: add all rgw_ports to http_port_t type
Browse files Browse the repository at this point in the history
This adds all rgw ports to the http_port_t selinux type so it
allows haproxy to connect to those ports in order to avoid AVC.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1923890

Signed-off-by: Guillaume Abrioux <gabrioux@redhat.com>
  • Loading branch information
guits committed Apr 2, 2021
1 parent 9e7f22a commit 6bbb901
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions roles/ceph-rgw-loadbalancer/tasks/pre_requisite.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,3 +33,18 @@
mode: "0644"
notify:
- restart keepalived

- name: selinux related tasks
when: ansible_facts['os_family'] == 'RedHat'
block:
- name: set_fact rgw_ports
set_fact:
rgw_ports: "{{ rgw_ports | default([]) + [hostvars[item]['rgw_instances']['radosgw_frontend_port']] | unique }}"
with_items: "{{ groups.get(rgw_group_name, []) }}"

- name: add selinux rules
seport:
ports: "{{ rgw_ports }}"
proto: tcp
setype: http_port_t
state: present

0 comments on commit 6bbb901

Please sign in to comment.