(Optional) Policies for podman based deployments
On RHEL version 8.x systems, after deploying NetBackup Snapshot Manager, to reduce the selinux logs getting logged to /var/log/messages folder, user can add and apply the following policies:
(allow container_t container_runtime_t (unix_stream_socket (connectto))) (allow container_t unlabeled_t (dir (add_name create read remove_name setattr write ))) (allow container_t unlabeled_t (file (append create ioctl open read setattr link unlink write rename))) (allow container_t unlabeled_t (lnk_file (create))) (allow container_t default_t (dir ( add_name remove_name write create setattr))) (allow container_t default_t (file ( create open read append rename unlink write ioctl lock link))) (allow container_t default_t (lnk_file (create))) (allow container_t lvm_var_run_t (file (lock open read write))) (allow container_t container_var_lib_t( file ( ioctl open read ))) (allow container_t var_run_t (sock_file (write))) (allow container_t autofs_device_t (chr_file (getattr))) (allow container_t clock_device_t (chr_file (getattr))) (allow container_t cpu_device_t (chr_file (getattr))) (allow container_t event_device_t (chr_file (getattr))) (allow container_t fixed_disk_device_t (chr_file (getattr))) (allow container_t framebuf_device_t (chr_file (getattr))) (allow container_t hypervkvp_device_t (chr_file (getattr))) (allow container_t kmsg_device_t (chr_file (getattr))) (allow container_t loop_control_device_t (chr_file (getattr))) (allow container_t lvm_control_t (chr_file (getattr))) (allow container_t memory_device_t (chr_file (getattr))) (allow container_t netcontrol_device_t (chr_file (getattr))) (allow container_t nvram_device_t (chr_file (getattr))) (allow container_t ptmx_t (chr_file (getattr))) (allow container_t scsi_generic_device_t (chr_file (getattr))) (allow container_t tun_tap_device_t (chr_file (getattr))) (allow container_t uhid_device_t (chr_file (getattr))) (allow container_t vfio_device_t (chr_file (getattr))) (allow container_t vhost_device_t (chr_file (getattr))) (allow container_t fixed_disk_device_t (blk_file (getattr))) (allow container_t fs_t (filesystem (associate))) (allow container_t self (dir (create remove_name))) (allow container_t self(file (link rename unlink)))
To add and load the policy
- Create a
/tmp/VRTSflexsnap.cilfile and copy the above policies to/tmp/VRTSflexsnap.cilfile. - Execute the following commands to load the policies:
sudo semodule -i /tmp/VRTSflexsnap.cil
sudo semanage fcontext -a -t container_file_t \"/cloudpoint(/.*)?\"\n"
sudo restorecon -Rv /cloudpoint{}