2014-06-25 15:24:23 +02:00
|
|
|
#include <tunables/global>
|
|
|
|
|
|
|
|
/usr/sbin/haproxy {
|
|
|
|
#include <abstractions/base>
|
|
|
|
#include <abstractions/nameservice>
|
|
|
|
capability net_bind_service,
|
|
|
|
capability setgid,
|
|
|
|
capability setuid,
|
|
|
|
capability kill,
|
|
|
|
capability sys_resource,
|
|
|
|
capability sys_chroot,
|
|
|
|
|
|
|
|
# those are needed for the stats socket creation
|
|
|
|
capability chown,
|
|
|
|
capability fowner,
|
|
|
|
capability fsetid,
|
|
|
|
|
2017-11-27 16:03:06 +01:00
|
|
|
network inet tcp,
|
|
|
|
network inet6 tcp,
|
2014-06-25 15:24:23 +02:00
|
|
|
|
|
|
|
/etc/haproxy/* r,
|
|
|
|
|
2017-11-27 16:03:06 +01:00
|
|
|
/usr/sbin/haproxy rmix,
|
|
|
|
|
2014-06-25 15:24:23 +02:00
|
|
|
/var/lib/haproxy/stats rwl,
|
|
|
|
/var/lib/haproxy/stats.*.bak rwl,
|
|
|
|
/var/lib/haproxy/stats.*.tmp rwl,
|
|
|
|
/{,var/}run/haproxy.pid rw,
|
2019-06-18 14:09:30 +02:00
|
|
|
/{,var/}run/haproxy-master.sock* rwlk,
|
2014-06-25 15:24:23 +02:00
|
|
|
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
|
|
#include <local/usr.sbin.haproxy>
|
|
|
|
}
|