selinux/spacewalk-selinux/spacewalk.te | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
New commits:
commit a5e6c7e0b47215263ed2ab471d21b4e2c958bce7
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Wed Dec 29 18:32:28 2010 +0100
Create sqlplus spool files with different type than the directories, to allow write.
Addressing
avc: denied { write } for pid=2078 comm="sqlplus" name="20101229-115741-begin.log" dev=dm-0 ino=1842632 scontext=unconfined_u:unconfined_r:oracle_sqlplus_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:spacewalk_db_install_log_t:s0 tclass=file
Sadly, sqlplus does not use O_APPEND even if spool filename append
is used. So we have to allow the write but we do not want sqlplus
to overwrite all other logs.
And on Fedora 13, append_files_pattern no longer gives plain write.
diff --git a/selinux/spacewalk-selinux/spacewalk.te b/selinux/spacewalk-selinux/spacewalk.te
index bc40b45..5ef5605 100644
--- a/selinux/spacewalk-selinux/spacewalk.te
+++ b/selinux/spacewalk-selinux/spacewalk.te
@@ -64,14 +64,17 @@ tunable_policy(`spacewalk_nfs_mountpoint',`
')
type spacewalk_db_install_log_t;
-logging_log_file(spacewalk_db_install_log_t);
+files_type(spacewalk_db_install_log_t);
optional_policy(`
+ type spacewalk_sqlplus_spool_log_t;
+ logging_log_file(spacewalk_sqlplus_spool_log_t);
gen_require(`
type oracle_port_t;
type oracle_sqlplus_t;
')
allow httpd_t oracle_port_t:tcp_socket name_connect;
- append_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_db_install_log_t);
+ rw_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_sqlplus_spool_log_t);
read_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_db_install_log_t);
- create_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_db_install_log_t);
+ create_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_sqlplus_spool_log_t);
+ filetrans_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t, spacewalk_sqlplus_spool_log_t, file)
')