From a3fa7b60f487f8c21d30c17179057e20da181f91 Mon Sep 17 00:00:00 2001
From: Zack Cerza <zack@cerza.org>
Date: Wed, 2 Jul 2025 14:26:18 -0600
Subject: [PATCH] Update ceph_devstack.te

Signed-off-by: Zack Cerza <zack@cerza.org>
---
 ceph_devstack/ceph_devstack.pp | Bin 13272 -> 13741 bytes
 ceph_devstack/ceph_devstack.te |   8 ++++++++
 2 files changed, 8 insertions(+)

diff --git a/ceph_devstack/ceph_devstack.pp b/ceph_devstack/ceph_devstack.pp
index ca7654a49005ff85a97ac8a3a97746306069b721..978a9398060941450c05cb0f974c92e4a7995c41 100644
GIT binary patch
delta 290
zcmcbSzBXH^|9{O-Mg|53CLk68;%eEALSGq`L0k|9fux-5__WNNRCXX6B$k_Bnpcva
zH(8o#8LtA655gQEJXwK7dh<)BSVmR>kT8fVT2h)9Uy@i5pORXZnVcG5!Vi?;1j$TJ
zWBI_!3*^azctUBV#i?*bAnja0VVTY4tP_|R)h1uyaGrdgTV}F8r^n{?93OZl9~O3I
zbeNpaoiO<@uL2{}<O9NPj154(!eke5fywJdof-d6p2#FKnP04jk$G|fhw|qAVoMnr
n6(*-jeBcHd4|UgM0V&bRp^_UoKrR8f0W7dVl4Uce)Okq&I8{t{

delta 179
zcmZ3ReIs3{|9{O-Mg|53CLk68;$_ksg}yS1fP_F81d?*H<I^&8QYULME#s8~3V<*N
z2v0U-mfrk>DVC9yAIRkda%CqkXL+~z5bH)JM&-#1IGrb3^T<q|&FQgOn)3tC<Sk4x
zlQ%H2Oy=k0nVc-H&S*b*0a%0wD9ST=zj(>yeh!|=>p3Mrcyqo)FC(Me<iC<1Ci6;f
K*nCU+vLpbTRx)4!

diff --git a/ceph_devstack/ceph_devstack.te b/ceph_devstack/ceph_devstack.te
index ec5deda7c..41a984f76 100644
--- a/ceph_devstack/ceph_devstack.te
+++ b/ceph_devstack/ceph_devstack.te
@@ -28,6 +28,7 @@ require {
 
 	type fixed_disk_device_t;
 	class blk_file setattr;
+	class blk_file mounton;
 
 	type fs_t;
 
@@ -68,6 +69,10 @@ require {
 
 	class bpf prog_load;
 	class bpf map_create;
+
+	type fuse_device_t;
+
+	type tun_tap_device_t;
 }
 
 #============= container_init_t ==============
@@ -106,3 +111,6 @@ allow container_init_t system_map_t:file mounton;
 allow container_init_t mtrr_device_t:file mounton;
 allow container_init_t self:bpf prog_load;
 allow container_init_t self:bpf map_create;
+allow container_init_t fuse_device_t:chr_file mounton;
+allow container_init_t fixed_disk_device_t:blk_file mounton;
+allow container_init_t tun_tap_device_t:chr_file mounton;