Requirements for OpenShift Data Foundation on SELinux

To use OpenShift Data Foundation, you must create an SELinux policy module and install it on all of the nodes that are hosting Db2 Warehouse.

1. Use the oc debug command to access a worker node where the instance is installed:

   oc debug node/<worker_node_name>

   To change to the host filesystem as root, use the following command:

   chroot /host

2. Add the following code to the db2u-cephfs.te file and save the file to your desired location:

   module db2u-cephfs 1.0;
   require {
   type cephfs_t;
   type container_t;
   class fifo_file { create open read unlink write ioctl getattr setattr };
   }
   #============= container_t ==============
   allow container_t cephfs_t:fifo_file { create open read unlink write ioctl getattr setattr };

3. Transform the db2u-cephfs.te file into the db2u-cephfs.mod module file:

   # checkmodule -M -m -o db2u-cephfs.mod db2u-cephfs.te

4. Compile the module file db2u-cephfs.mod into the policy package file db2u-cephfs.pp:

   # semodule_package -o db2u-cephfs.pp -m db2u-cephfs.mod

5. Install the policy package:

   # semodule -i db2u-cephfs.pp

6. To confirm that the package was installed, you can run the following command:

   semodule -l

   The SE Linux module db2u-cephfs should be shown.