selinux/spacewalk-selinux/spacewalk.te | 5 +++++
1 file changed, 5 insertions(+)
New commits:
commit 6ff276c80bc1ebf8f3def613a300885e9f88b9ba
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Thu Mar 3 10:05:31 2011 +0100
Apache should not be able to read the rpm database.
When processing rhnpush requests on the server side, we read rpm
file headers by creating (readonly) rpm transaction. On RHEL 6 it
tries to read /var/lib/rpm/Packages. But it does not need it to
just parse the file header, and we do not want to allow httpd_t
to have access to (for example) list of installed packages and
their versions.
Addressing
avc: denied { search } for pid=10689 comm="httpd" name="rpm"
dev=dm-0 ino=1179651 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
avc: denied { getattr } for pid=10689 comm="httpd"
path="/var/lib/rpm" dev=dm-0 ino=1179651
scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0
tclass=dir
avc: denied { open } for pid=10689 comm="httpd" name="Packages"
dev=dm-0 ino=1179656 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
diff --git a/selinux/spacewalk-selinux/spacewalk.te
b/selinux/spacewalk-selinux/spacewalk.te
index 8f56c6c..f62b454 100644
--- a/selinux/spacewalk-selinux/spacewalk.te
+++ b/selinux/spacewalk-selinux/spacewalk.te
@@ -17,6 +17,7 @@ require {
type initrc_t;
type system_mail_t;
type nfs_t;
+ type rpm_var_lib_t;
}
type spacewalk_install_log_t;
@@ -79,3 +80,7 @@ optional_policy(`
filetrans_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t,
spacewalk_sqlplus_spool_log_t, file)
allow oracle_sqlplus_t spacewalk_db_install_log_t:file append;
')
+
+# rpm_dontaudit_search_db(httpd_t) is not available on RHELs
+dontaudit httpd_t rpm_var_lib_t:dir list_dir_perms;
+dontaudit httpd_t rpm_var_lib_t:file read_file_perms;
Show replies by date