Commit cc6a10bd authored by Guillaume Abrioux's avatar Guillaume Abrioux
Browse files

rgw-loadbalancers: add all rgw_ports to http_port_t type

This adds all rgw ports to the http_port_t selinux type so it
allows haproxy to connect to those ports in order to avoid AVC.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1923890

Signed-off-by: default avatarGuillaume Abrioux <gabrioux@redhat.com>
(cherry picked from commit 6bbb9019)
parent ef99ac62
......@@ -33,3 +33,18 @@
mode: "0644"
notify:
- restart keepalived
- name: selinux related tasks
when: ansible_facts['os_family'] == 'RedHat'
block:
- name: set_fact rgw_ports
set_fact:
rgw_ports: "{{ rgw_ports | default([]) + [hostvars[item]['rgw_instances']['radosgw_frontend_port']] | unique }}"
with_items: "{{ groups.get(rgw_group_name, []) }}"
- name: add selinux rules
seport:
ports: "{{ rgw_ports }}"
proto: tcp
setype: http_port_t
state: present
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment