selinux/spacewalk-monitoring-selinux/spacewalk-monitoring-selinux.spec | 3 +++ selinux/spacewalk-monitoring-selinux/spacewalk-monitoring.te.fedora17 | 2 ++ 2 files changed, 5 insertions(+)
New commits: commit 634ce874db9f39ee6813a7a27261e92b45ca44be Author: Jan Pazdziora jpazdziora@redhat.com Date: Mon Mar 25 13:16:59 2013 +0100
Startup of monitoring on Fedoras needs few more allows.
Addressing avc: denied { open } for pid=8922 comm="gogo.pl" path="/proc/sys/kernel/ngroups_max" dev="proc" ino=15289 scontext=unconfined_u:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file avc: denied { open } for pid=8827 comm="ack-processor" path="/etc/passwd" dev="dm-1" ino=132215 scontext=unconfined_u:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
diff --git a/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring-selinux.spec b/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring-selinux.spec index 857dcdc..8904f56 100644 --- a/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring-selinux.spec +++ b/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring-selinux.spec @@ -77,6 +77,9 @@ SELinux policy module supporting Spacewalk monitoring. %build # Build SELinux policy modules perl -i -pe 'BEGIN { $VER = join ".", grep /^\d+$/, split /./, "%{version}.%{release}"; } s!@@VERSION@@!$VER!g;' %{modulename}.te +%if 0%{?fedora} >= 17 +cat %{modulename}.te.fedora17 >> %{modulename}.te +%endif for selinuxvariant in %{selinux_variants} do make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile diff --git a/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring.te.fedora17 b/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring.te.fedora17 new file mode 100644 index 0000000..4f22b0d --- /dev/null +++ b/selinux/spacewalk-monitoring-selinux/spacewalk-monitoring.te.fedora17 @@ -0,0 +1,2 @@ +auth_read_passwd(spacewalk_monitoring_t) +kernel_read_kernel_sysctls(spacewalk_monitoring_t)