Skip to content

Commit 2ce147d

Browse files
fix(NODE-1498): allow read access to more hardware info for node_exporter (#2121)
Give prometheus `node_exporter` more read access to device info: * Allow reading udev state data from /run/udev/data * Allow reading /proc/pressure * Allow reading under mount points with mnt_t (NODE-1498)
1 parent b545f6b commit 2ce147d

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

ic-os/components/selinux/node_exporter/node_exporter.te

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,3 +115,12 @@ require {
115115
type user_runtime_root_t;
116116
}
117117
allow node_exporter_t user_runtime_root_t:dir { search };
118+
119+
# Allow reading udev state data from /run/udev/data
120+
udev_read_runtime_files(node_exporter_t)
121+
122+
# Allow reading /proc/pressure
123+
kernel_read_psi(node_exporter_t)
124+
125+
# Allow reading under mount points with mnt_t
126+
files_list_mnt(node_exporter_t)

0 commit comments

Comments
 (0)