Changes to 'refs/tags/oracle-xe-selinux-10.2.0.25-1'
by Jan Pazdziora
Tag 'oracle-xe-selinux-10.2.0.25-1' created by Jan Pazdziora <jpazdziora(a)redhat.com> at 2012-10-01 15:24 +0000
Tagging package [oracle-xe-selinux] version [10.2.0.25-1] in directory [selinux/oracle-xe-selinux/].
Changes since spacecmd-1.8.15-1:
Jan Pazdziora (2):
Adding file contexts and stuff for oracle-xe-11.2.0-1.0.x86_64.
Automatic commit of package [oracle-xe-selinux] release [10.2.0.25-1].
---
rel-eng/packages/oracle-xe-selinux | 2
selinux/oracle-xe-selinux/oracle-xe-selinux-enable | 22 ++++++--
selinux/oracle-xe-selinux/oracle-xe-selinux.spec | 25 +++++----
selinux/oracle-xe-selinux/oracle-xe.fc | 55 +++++++++++++++++++--
selinux/oracle-xe-selinux/oracle-xe.te | 18 ++++++
5 files changed, 99 insertions(+), 23 deletions(-)
---
11 years, 6 months
rel-eng/packages selinux/oracle-xe-selinux
by Jan Pazdziora
rel-eng/packages/oracle-xe-selinux | 2 +-
selinux/oracle-xe-selinux/oracle-xe-selinux.spec | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 8145faff71c27d30dc6eec89265b6da61f9fa989
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Mon Oct 1 17:24:53 2012 +0200
Automatic commit of package [oracle-xe-selinux] release [10.2.0.25-1].
diff --git a/rel-eng/packages/oracle-xe-selinux b/rel-eng/packages/oracle-xe-selinux
index a24727f..0ab32a9 100644
--- a/rel-eng/packages/oracle-xe-selinux
+++ b/rel-eng/packages/oracle-xe-selinux
@@ -1 +1 @@
-10.2.0.24-1 selinux/oracle-xe-selinux/
+10.2.0.25-1 selinux/oracle-xe-selinux/
diff --git a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
index 23bddac..7a9c4b2 100644
--- a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
+++ b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
@@ -5,7 +5,7 @@
%define modulename oracle-xe
Name: oracle-xe-selinux
-Version: 10.2.0.24
+Version: 10.2.0.25
Release: 1%{?dist}
Summary: SELinux policy module supporting Oracle XE
Group: System Environment/Base
@@ -143,6 +143,10 @@ fi
%attr(0755,root,root) %{_sbindir}/%{name}-enable
%changelog
+* Mon Oct 01 2012 Jan Pazdziora 10.2.0.25-1
+- Adding file contexts and stuff for oracle-xe-11.2.0-1.0.x86_64.
+- %%defattr is not needed since rpm 4.4
+
* Tue Apr 10 2012 Jan Pazdziora 10.2.0.24-1
- The rman is more like the database server process.
- The backup.sh and restore.sh need to run as sqlplus, so that their log files
11 years, 6 months
selinux/oracle-xe-selinux
by Jan Pazdziora
selinux/oracle-xe-selinux/oracle-xe-selinux-enable | 22 ++++++--
selinux/oracle-xe-selinux/oracle-xe-selinux.spec | 19 +++----
selinux/oracle-xe-selinux/oracle-xe.fc | 55 +++++++++++++++++++--
selinux/oracle-xe-selinux/oracle-xe.te | 18 ++++++
4 files changed, 93 insertions(+), 21 deletions(-)
New commits:
commit 8846f3dacbcceaac683d757850b7309745002e2a
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue Sep 25 11:35:35 2012 +0200
Adding file contexts and stuff for oracle-xe-11.2.0-1.0.x86_64.
diff --git a/selinux/oracle-xe-selinux/oracle-xe-selinux-enable b/selinux/oracle-xe-selinux/oracle-xe-selinux-enable
index 18508b1..3586fc1 100644
--- a/selinux/oracle-xe-selinux/oracle-xe-selinux-enable
+++ b/selinux/oracle-xe-selinux/oracle-xe-selinux-enable
@@ -9,17 +9,27 @@ for selinuxvariant in mls strict targeted
done
/usr/sbin/semanage port -a -t oracle_port_t -p tcp 9055 || :
+/usr/sbin/getsebool oracle_11g_support > /dev/null 2>&1 && /usr/sbin/setsebool oracle_11g_support 1
-# Relabel oracle-xe-univ's files
-rpm -ql oracle-xe-univ | xargs -n 100 /sbin/restorecon -Rivv
+# Relabel oracle-xe's files
+rpm -qlf /etc/init.d/oracle-xe | xargs -n 100 /sbin/restorecon -Rivv
# Create the extra directories if they do not exist yet, so that they
# can be restorecon'ed
-mkdir -p %extra_restorecon
-mkdir -p %extra_subdirs
-chown oracle:dba %extra_subdirs
-# Fix up additional directories, not owned by oracle-xe-univ
+EXTRA_SUBDIRS=''
+ORACLE_XE_VERSION=$( rpm -qf --qf '%{version}\n' /etc/init.d/oracle-xe )
+if [ ${ORACLE_XE_VERSION%%.*} == 11 ] ; then
+ EXTRA_SUBDIRS="/u01/app/oracle/admin /u01/app/oracle/admin/XE/adump /u01/app/oracle/diag /u01/app/oracle/diag/tnslsnr /u01/app/oracle/fast_recovery_area/XE /u01/app/oracle/oradata /u01/app/oracle/product/11.2.0/xe/log/$( hostname -s )/client /u01/app/oracle/oradiag_oracle /u01/app/oracle/oradiag_oracle/diag /u01/app/oracle/product/11\.2\.0/xe/config/log"
+elif [ ${ORACLE_XE_VERSION%%.*} == 10 ] ; then
+ EXTRA_SUBDIRS='/usr/lib/oracle/xe/app/oracle/product/10.2.0/server/log /usr/lib/oracle/xe/app/oracle/flash_recovery_area /usr/lib/oracle/xe/app/oracle/admin /usr/lib/oracle/xe/oradata /var/tmp/.oracle'
+fi
+if [ -n "EXTRA_SUBDIRS" ] ; then
+ mkdir -p $EXTRA_SUBDIRS
+ chown oracle:dba $EXTRA_SUBDIRS
+fi
+
+# Fix up additional directories, not owned by oracle-xe-univ/oracle-xe
/sbin/restorecon -Rivv %extra_restorecon
/sbin/ldconfig
diff --git a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
index 3143287..23bddac 100644
--- a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
+++ b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
@@ -29,7 +29,7 @@ Requires: selinux-policy >= %{selinux_policyver}
%endif
Requires(post): /usr/sbin/semodule, /sbin/restorecon, /sbin/ldconfig, /usr/sbin/selinuxenabled
Requires(postun): /usr/sbin/semodule, /sbin/restorecon
-Requires: oracle-xe-univ
+Requires: /etc/init.d/oracle-xe
Requires: oracle-nofcontext-selinux
Requires: oracle-lib-compat
@@ -65,9 +65,8 @@ for selinuxvariant in %{selinux_variants}
%{buildroot}%{_datadir}/selinux/${selinuxvariant}/%{modulename}.pp
done
-%define extra_restorecon /usr/lib/oracle/xe/app/oracle/product/10.2.0/server/log /usr/lib/oracle/xe/oradata /usr/lib/oracle/xe/app /var/tmp/.oracle
-%define extra_subdirs /usr/lib/oracle/xe/app/oracle/flash_recovery_area /usr/lib/oracle/xe/app/oracle/admin /usr/lib/oracle/xe/oradata
-sed -i -e 's!%%extra_restorecon!%extra_restorecon!g' -e 's!%%extra_subdirs!%extra_subdirs!g' %{name}-enable
+%define extra_restorecon /usr/lib/oracle/xe/oradata /usr/lib/oracle/xe/app /var/tmp/.oracle /u01/app/oracle
+sed -i -e 's!%%extra_restorecon!%extra_restorecon!g' %{name}-enable
cd -
# Install SELinux interfaces
@@ -111,9 +110,9 @@ fi
%posttrans
#this may be safely remove when BZ 505066 is fixed
if /usr/sbin/selinuxenabled ; then
- # Relabel oracle-xe-univ's files
- rpm -ql oracle-xe-univ | while read i ; do [ -e $i ] && echo $i ; done | xargs -n 100 /sbin/restorecon -Rivv
- # Fix up additional directories, not owned by oracle-xe-univ
+ # Relabel oracle-xe-univ/oracle-xe's files
+ rpm -qlf /etc/init.d/oracle-xe | while read i ; do [ -e $i ] && echo $i ; done | xargs -n 100 /sbin/restorecon -Rivv
+ # Fix up additional directories, not owned by oracle-xe-univ/oracle-xe
/sbin/restorecon -Rivv %extra_restorecon
fi
@@ -130,10 +129,10 @@ if [ $1 -eq 0 ]; then
/usr/sbin/semanage port -d -t oracle_port_t -p tcp 9000 || :
/usr/sbin/semanage port -d -t oracle_port_t -p tcp 9055 || :
- # Clean up oracle-xe-univ's files
- rpm -ql oracle-xe-univ | while read i ; do [ -e $i ] && echo $i ; done | xargs -n 100 /sbin/restorecon -Rivv
+ # Clean up oracle-xe-univ/oracle-xe's files
+ rpm -qlf /etc/init.d/oracle-xe | while read i ; do [ -e $i ] && echo $i ; done | xargs -n 100 /sbin/restorecon -Rivv
- # Clean up additional directories, not owned by oracle-xe-univ
+ # Clean up additional directories, not owned by oracle-xe-univ/oracle-xe
/sbin/restorecon -Rivv %extra_restorecon
fi
diff --git a/selinux/oracle-xe-selinux/oracle-xe.fc b/selinux/oracle-xe-selinux/oracle-xe.fc
index 0d5491d..5b68c42 100644
--- a/selinux/oracle-xe-selinux/oracle-xe.fc
+++ b/selinux/oracle-xe-selinux/oracle-xe.fc
@@ -7,6 +7,10 @@
/usr/lib/oracle/xe/oradata(/.*)? gen_context(system_u:object_r:oracle_dbfile_t,s0)
/usr/lib/oracle/xe/app/oracle/flash_recovery_area(/.*)? gen_context(system_u:object_r:oracle_dbfile_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/oradata(/.*)? gen_context(system_u:object_r:oracle_dbfile_t,s0)
+/u01/app/oracle/fast_recovery_area/XE(/.*)? gen_context(system_u:object_r:oracle_dbfile_t,s0)
+
# store database specific files under /usr/lib/oracle/xe/app/oracle ...
# treat dump files and audits as log files
/usr/lib/oracle/xe/app/oracle/admin(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
@@ -16,6 +20,14 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/scripts/backup\.sh gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/scripts/restore\.sh gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/product/11\.2\.0/xe/config(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/config/scripts(/.*)? gen_context(user_u:object_r:oracle_sqlplus_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/config/scripts/backup\.sh gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/config/scripts/restore\.sh gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/config/log(/.*)? gen_context(user_u:object_r:oracle_sqlplus_log_t,s0)
+/u01/app/oracle/admin/XE/adump(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+
# otherwise these would default to bin_t
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/lsnrctl gen_context(system_u:object_r:oracle_lsnrctl_exec_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/oracle gen_context(system_u:object_r:oracle_db_exec_t,s0)
@@ -24,9 +36,21 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/tnslsnr gen_context(system_u:object_r:oracle_tnslsnr_exec_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/rman gen_context(system_u:object_r:oracle_db_exec_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/product/11\.2\.0/xe/bin/lsnrctl gen_context(system_u:object_r:oracle_lsnrctl_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/oracle gen_context(system_u:object_r:oracle_db_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/orapwd gen_context(system_u:object_r:oracle_db_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/sqlplus gen_context(system_u:object_r:oracle_sqlplus_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/tnslsnr gen_context(system_u:object_r:oracle_tnslsnr_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/rman gen_context(system_u:object_r:oracle_db_exec_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/bin/oradism gen_context(system_u:object_r:oracle_db_exec_t,s0)
+
# many jars are not located under lib, jre, or java directories
/usr/lib/oracle/xe/app/oracle/product/(.*/)?.+\.jar gen_context(system_u:object_r:shlib_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/product/11\.2\.0/xe/(.*/)?.+\.jar gen_context(system_u:object_r:shlib_t,s0)
+
# otherwise these would default to shlib_t
# for 10gR2
/usr/lib/oracle/xe/app/oracle/product/(.*/)?lib/libclntsh\.so\.10.* gen_context(system_u:object_r:texrel_shlib_t,s0)
@@ -38,11 +62,17 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?lib/libhasgen10\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?lib/libocci\.so\.10\.1 gen_context(system_u:object_r:texrel_shlib_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?lib/libdbcfg10\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
-# no 11gR1 for now
-# /opt/oracle/product/(.*/)?lib/libsqlplus\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
-# /opt/oracle/product/(.*/)?lib/libclntsh\.so\.11.* gen_context(system_u:object_r:texrel_shlib_t,s0)
-# /opt/oracle/product/(.*/)?lib/libnnz11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
-# /opt/oracle/product/(.*/)?lib/libnque11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/product/11\.2\.0/xe/lib/libclntsh\.so\.11.* gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libnnz11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libnque11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libagtsh\.so\.1\.0 gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libsqlplus\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libocrutl11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libhasgen11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libocci\.so\.11\.1 gen_context(system_u:object_r:texrel_shlib_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/lib/libdbcfg11\.so gen_context(system_u:object_r:texrel_shlib_t,s0)
# certain logs are kept under the ORACLE_HOME hierarchy
# the database writes to these locations
@@ -51,13 +81,28 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/log(/.*)? gen_context(user_u:object_r:oracle_sqlplus_log_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?rdbms/audit(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/product/11\.2\.0/xe/dbs(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/log(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/rdbms/audit(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/rdbms/log(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/diag(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
+/u01/app/oracle/oradiag_oracle/diag(/.*)? gen_context(user_u:object_r:oracle_sqlplus_log_t,s0)
+
# the listener writes to these locations
/usr/lib/oracle/xe/app/oracle/product/(.*[0-9]/)?server/log(/.*)? gen_context(user_u:object_r:oracle_tnslsnr_log_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?network/log(/.*)? gen_context(user_u:object_r:oracle_tnslsnr_log_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01/app/oracle/diag/tnslsnr(/.*)? gen_context(user_u:object_r:oracle_tnslsnr_log_t,s0)
+/u01/app/oracle/product/11\.2\.0/xe/log/.*/client(/.*)? gen_context(user_u:object_r:oracle_tnslsnr_log_t,s0)
+
# upon ORA-3136, database writes to network/log/sqlnet.log
/usr/lib/oracle/xe/app/oracle/product/(.*/)?network/log/sqlnet\.log(.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
# otherwise this would be unlabeled
/var/tmp/.oracle(/.*)? gen_context(user_u:object_r:oracle_tmp_t,s0)
+# for oracle-xe-11.2.0-1.0.x86_64
+/u01(/.*)? gen_context(system_u:object_r:lib_t,s0)
+
diff --git a/selinux/oracle-xe-selinux/oracle-xe.te b/selinux/oracle-xe-selinux/oracle-xe.te
index e3c9cbf..9768e25 100644
--- a/selinux/oracle-xe-selinux/oracle-xe.te
+++ b/selinux/oracle-xe-selinux/oracle-xe.te
@@ -11,6 +11,7 @@ require {
type http_cache_port_t;
type initrc_t;
type urandom_device_t;
+ type oracle_lsnrctl_t;
}
rw_files_pattern(oracle_db_t, oracle_sqlplus_log_t, oracle_sqlplus_log_t)
@@ -39,3 +40,20 @@ term_dontaudit_use_console(oracle_tnslsnr_t)
mcs_ptrace_all(oracle_db_t)
allow oracle_sqlplus_t urandom_device_t:chr_file read;
+
+# for oracle-xe-11.2.0-1.0.x86_64
+allow oracle_lsnrctl_t self:netlink_route_socket { bind create getattr nlmsg_read };
+
+corenet_udp_bind_generic_node(oracle_lsnrctl_t)
+
+allow oracle_tnslsnr_t oracle_db_log_t:dir { search getattr setattr };
+allow oracle_tnslsnr_t oracle_db_log_t:file getattr;
+
+corecmd_exec_ls(oracle_db_t)
+corecmd_exec_shell(oracle_db_t)
+corecmd_read_bin_symlinks(oracle_db_t)
+
+fs_manage_tmpfs_dirs(oracle_db_t)
+fs_manage_tmpfs_files(oracle_db_t)
+
+allow oracle_db_t self:process { execstack execmem };
11 years, 6 months