usr.share.openqa.script.worker

# Last Modified: Thu Oct 11 20:03:23 2018
#include <tunables/global>

# ------------------------------------------------------------------
#
#    Copyright (C) 2015 SUSE Linux GmbH
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------


/usr/share/openqa/script/worker {
  #include <abstractions/X>
  #include <abstractions/authentication>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>
  #include <abstractions/perl>
  #include <abstractions/python>

  capability sys_ptrace,

  network netbeui raw,

  /bin/bash rix,
  /bin/pkill rix,
  /dev/ r,
  /dev/bus/usb/ r,
  /dev/hugepages/** rwk,
  /dev/kvm rw,
  /dev/net/tun rw,
  /dev/ptmx rw,
  /dev/pts/* rw,
  /dev/tty rw,
  /etc/libnl/classid r,
  /etc/openqa/client.conf r,
  /etc/openqa/workers.ini r,
  /etc/qemu/* r,
  /etc/udev/udev.conf r,
  /etc/vde2/vdecmd r,
  /proc/*/auxv r,
  /proc/*/cmdline r,
  /proc/*/mountinfo r,
  /proc/*/net/psched r,
  /proc/*/stat r,
  /proc/*/status r,
  /proc/[0-9]*/cgroup r,
  /proc/filesystems r,
  /proc/meminfo r,
  /proc/sys/vm/overcommit_memory r,
  /run/nscd/group r,
  /run/openqa/vde.ctl/* rw,
  /run/udev/queue.bin r,
  /sys/**/ r,
  /sys/bus/ r,
  /sys/bus/usb/devices/ r,
  /sys/class/ r,
  /sys/devices/system/cpu/** r,
  /sys/devices/system/node/** r,
  /sys/firmware/devicetree/base/ r,
  /sys/fs/cgroup/systemd/openqa.slice/** rw,
  /tmp/* rwk,
  /usr/bin/Xvnc rCx,
  /usr/bin/cat rix,
  /usr/bin/chattr rix,
  /usr/bin/cksum rix,
  /usr/bin/cp rix,
  /usr/bin/date rix,
  /usr/bin/dirname rix,
  /usr/bin/eatmydata rix,
  /usr/bin/env rix,
  /usr/bin/find rix,
  /usr/bin/flock rix,
  /usr/bin/git rix,
  /usr/bin/gzip rix,
  /usr/bin/head rix,
  /usr/bin/icewm-default rix,
  /usr/bin/ionice rix,
  /usr/bin/ipmitool rix,
  /usr/bin/isotovideo rix,
  /usr/bin/lscpu rCx,
  /usr/bin/mkdir rix,
  /usr/bin/nice rix,
  /usr/bin/optipng rix,
  /usr/bin/pwd rix,
  /usr/bin/python3.* ix,
  /usr/bin/qemu-img rix,
  /usr/bin/qemu-kvm rix,
  /usr/bin/qemu-system-* rix,
  /usr/bin/rm rix,
  /usr/bin/rsync rix,
  /usr/bin/sha1sum rix,
  /usr/bin/slirpvde rix,
  /usr/bin/snd2png rix,
  /usr/bin/ssh-keygen rix,
  /usr/bin/tail rix,
  /usr/bin/tee rix,
  /usr/bin/uname rix,
  /usr/bin/unixcmd rix,
  /usr/bin/x3270 cx,
  /usr/bin/xterm-console rix,
  /usr/lib*/qemu/block-curl.so rix,
  /usr/lib*/qemu/block-iscsi.so mr,
  /usr/lib*/qemu/block-rbd.so mr,
  /usr/lib*/qemu/block-ssh.so mr,
  /usr/lib/git/git rix,
  /usr/lib/git/git-remote-http rix,
  /usr/lib/os-autoinst/videoencoder rix,
  /usr/lib/utempter/utempter rix,
  /usr/sbin/ipmiconsole rix,
  /usr/share/openqa/lib/** r,
  /usr/share/openqa/lib/DBIx/Class/Timestamps.pm r,
  /usr/share/openqa/lib/OpenQA/** r,
  /usr/share/openqa/script/worker r,
  /usr/share/git-core/templates/* r,
  /usr/share/qemu/* rk,
  /usr/share/qemu/keymaps/* r,
  /var/lib/openqa/cache/ r,
  /var/lib/openqa/cache/** rwk,
  /var/lib/openqa/pool/ r,
  /var/lib/openqa/pool/*/ r,
  /var/lib/openqa/pool/*/** rwk,
  /var/lib/openqa/share/* r,
  /var/lib/openqa/share/factory/hdd/ r,
  /var/lib/openqa/share/factory/hdd/* r,
  /var/lib/openqa/share/factory/hdd/fixed/* r,
  /var/lib/openqa/share/factory/iso/* rk,
  /var/lib/openqa/share/factory/iso/fixed/* r,
  /var/lib/openqa/share/factory/other/* r,
  /var/lib/openqa/share/tests/** r,
  owner /sys/**/ rw,


  profile /usr/bin/Xvnc {
    #include <abstractions/X>
    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/fonts>
    #include <abstractions/nameservice>

    /bin/bash rix,
    /proc/*/cmdline r,
    /tmp/* rwlk,
    /usr/bin/Xvnc mr,
    /usr/bin/xkbcomp rix,
    /var/lib/openqa/pool/*/autoinst-log.txt w,

  }

  profile /usr/bin/lscpu {
    #include <abstractions/base>

    /proc/** r,
    /sys/devices/** r,
    /usr/bin/lscpu mr,

  }

  profile /usr/bin/x3270 {
    #include <abstractions/X>
    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/freedesktop.org>
    #include <abstractions/nameservice>
    #include <abstractions/openssl>

    /bin/bash rix,
    /dev/ptmx rw,
    /etc/ssh/ssh_config r,
    /etc/x3270/ibm_hosts r,
    /proc/*/fd/ r,
    /proc/filesystems r,
    /proc/meminfo r,
    /usr/bin/head rix,
    /usr/bin/icewm rix,
    /usr/bin/ssh rix,
    /usr/bin/x3270 mr,
    /usr/bin/xterm-console rix,
    /var/lib/openqa/pool/*/known_hosts w,
    /var/lib/openqa/pool/1/x3scr.*.txt w,
    /var/lib/openqa/pool/1/x3trc.* w,

  }
}