rel-eng/packages/oracle-xe-selinux | 2 +-
selinux/oracle-xe-selinux/oracle-xe-selinux.spec | 9 ++++++++-
selinux/oracle-xe-selinux/oracle-xe.fc | 3 +++
selinux/oracle-xe-selinux/oracle-xe.te | 3 +++
4 files changed, 15 insertions(+), 2 deletions(-)
New commits:
commit 12275e225f6a9086364100fa882303d38e38b6f9
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue Apr 10 14:39:42 2012 +0200
Automatic commit of package [oracle-xe-selinux] release [10.2.0.24-1].
diff --git a/rel-eng/packages/oracle-xe-selinux b/rel-eng/packages/oracle-xe-selinux
index 6c4a872..a24727f 100644
--- a/rel-eng/packages/oracle-xe-selinux
+++ b/rel-eng/packages/oracle-xe-selinux
@@ -1 +1 @@
-10.2.0.23-1 selinux/oracle-xe-selinux/
+10.2.0.24-1 selinux/oracle-xe-selinux/
diff --git a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
index eb2f7da..6a224b5 100644
--- a/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
+++ b/selinux/oracle-xe-selinux/oracle-xe-selinux.spec
@@ -5,7 +5,7 @@
%define modulename oracle-xe
Name: oracle-xe-selinux
-Version: 10.2.0.23
+Version: 10.2.0.24
Release: 1%{?dist}
Summary: SELinux policy module supporting Oracle XE
Group: System Environment/Base
@@ -145,6 +145,13 @@ fi
%attr(0755,root,root) %{_sbindir}/%{name}-enable
%changelog
+* Tue Apr 10 2012 Jan Pazdziora 10.2.0.24-1
+- The rman is more like the database server process.
+- The backup.sh and restore.sh need to run as sqlplus, so that their log files
+ can be used by sqlplus.
+- The backup.sh from Oracle XE 10g seems to want to access urandom.
+- Allow Oracle database to ptrace self.
+
* Wed Nov 30 2011 Michael Mraka <michael.mraka(a)redhat.com> 10.2.0.23-1
- system user uids are < 1000 on Fedora 16
commit 2ca684a5690fe714dcee98f82b1ff2653918098c
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue Apr 10 14:31:13 2012 +0200
The rman is more like the database server process.
Addressing
avc: denied { read } for pid=32408 comm="rman"
name="spfile2init.ora" dev=dm-0 ino=81133643
scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023
tcontext=root:object_r:oracle_db_log_t:s0 tclass=file
during restore.sh.
diff --git a/selinux/oracle-xe-selinux/oracle-xe.fc
b/selinux/oracle-xe-selinux/oracle-xe.fc
index 1a46a00..0d5491d 100644
--- a/selinux/oracle-xe-selinux/oracle-xe.fc
+++ b/selinux/oracle-xe-selinux/oracle-xe.fc
@@ -22,6 +22,7 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/orapwd
gen_context(system_u:object_r:oracle_db_exec_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/sqlplus
gen_context(system_u:object_r:oracle_sqlplus_exec_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/tnslsnr
gen_context(system_u:object_r:oracle_tnslsnr_exec_t,s0)
+/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/rman
gen_context(system_u:object_r:oracle_db_exec_t,s0)
# many jars are not located under lib, jre, or java directories
/usr/lib/oracle/xe/app/oracle/product/(.*/)?.+\.jar
gen_context(system_u:object_r:shlib_t,s0)
commit 21c06b9808b6fca4c7efd3d113fcc2163f4fee03
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue Apr 10 14:22:23 2012 +0200
The backup.sh and restore.sh need to run as sqlplus, so that their log files can be
used by sqlplus.
Addressing
avc: denied { write } for pid=26511 comm="sqlplus"
path="/tmp/rman_normlog26505.log" dev=dm-0 ino=62193725
scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023 tcontext=root:object_r:tmp_t:s0
tclass=file
diff --git a/selinux/oracle-xe-selinux/oracle-xe.fc
b/selinux/oracle-xe-selinux/oracle-xe.fc
index d5d818c..1a46a00 100644
--- a/selinux/oracle-xe-selinux/oracle-xe.fc
+++ b/selinux/oracle-xe-selinux/oracle-xe.fc
@@ -13,6 +13,8 @@
/usr/lib/oracle/xe/app/oracle/product/(.*/)?audit(/.*)?
gen_context(user_u:object_r:oracle_db_log_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config(/.*)? gen_context(user_u:object_r:oracle_db_log_t,s0)
/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/scripts(/.*)?
gen_context(user_u:object_r:oracle_sqlplus_log_t,s0)
+/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/scripts/backup\.sh
gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
+/usr/lib/oracle/xe/app/oracle/product/(.*/)?server/config/scripts/restore\.sh
gen_context(user_u:object_r:oracle_sqlplus_exec_t,s0)
# otherwise these would default to bin_t
/usr/lib/oracle/xe/app/oracle/product/(.*/)?bin/lsnrctl
gen_context(system_u:object_r:oracle_lsnrctl_exec_t,s0)
commit 496b6002344115868f4c587262aa07aee2a86972
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue Apr 10 14:19:08 2012 +0200
The backup.sh from Oracle XE 10g seems to want to access urandom.
Addressing
avc: denied { read } for pid=26280 comm="backup.sh"
name="urandom" dev=tmpfs ino=969
scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023
tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
diff --git a/selinux/oracle-xe-selinux/oracle-xe.te
b/selinux/oracle-xe-selinux/oracle-xe.te
index af31a47..e3c9cbf 100644
--- a/selinux/oracle-xe-selinux/oracle-xe.te
+++ b/selinux/oracle-xe-selinux/oracle-xe.te
@@ -10,6 +10,7 @@ require {
type oracle_db_log_t;
type http_cache_port_t;
type initrc_t;
+ type urandom_device_t;
}
rw_files_pattern(oracle_db_t, oracle_sqlplus_log_t, oracle_sqlplus_log_t)
@@ -36,3 +37,5 @@ term_dontaudit_use_console(oracle_db_t)
term_dontaudit_use_console(oracle_tnslsnr_t)
mcs_ptrace_all(oracle_db_t)
+
+allow oracle_sqlplus_t urandom_device_t:chr_file read;
Show replies by date