backend/satellite_tools/rhn-db-stats | 5 +++--
selinux/oracle-selinux/oracle.te | 3 +++
2 files changed, 6 insertions(+), 2 deletions(-)
New commits:
commit 6c3453ae93c066a2100f5d5379b8a047d13ed648
Author: Milan Zazrivec <mzazrivec(a)redhat.com>
Date: Tue Jun 2 17:19:56 2009 +0200
allow sqlplus to read shell input redirects
allow shell constructs:
sqlplus $connect << EOS
...
EOS
diff --git a/selinux/oracle-selinux/oracle.te b/selinux/oracle-selinux/oracle.te
index 00148a4..f0c35de 100644
--- a/selinux/oracle-selinux/oracle.te
+++ b/selinux/oracle-selinux/oracle.te
@@ -166,6 +166,9 @@ allow oracle_db_t oracle_tnslsnr_t:fd use;
allow oracle_db_t oracle_tnslsnr_t:fifo_file { rw_file_perms };
allow oracle_db_t oracle_tnslsnr_t:tcp_socket { rw_socket_perms };
+# Allow sqlplus to read shell redirects
+allow oracle_sqlplus_t tmp_t:file { read ioctl getattr };
+
# sqlplus can run sql scripts
oracle_script(oracle_sqlplus_t)
commit 9d1fb8cd12312fe261c64807d2d2ffc81d376ac8
Author: Milan Zazrivec <mzazrivec(a)redhat.com>
Date: Tue Jun 2 16:14:33 2009 +0200
allow rhn-db-stats to write to arbitrary location with running selinux
diff --git a/backend/satellite_tools/rhn-db-stats b/backend/satellite_tools/rhn-db-stats
index 61fdfab..da6165b 100755
--- a/backend/satellite_tools/rhn-db-stats
+++ b/backend/satellite_tools/rhn-db-stats
@@ -8,8 +8,9 @@ fi
CONNECT=$(awk '/default_db/ {split($0,a,"="); print a[2]}'
/etc/rhn/rhn.conf)
[ -n "$2" ] && CONNECT=$2
-sqlplus $CONNECT >& /dev/null << EOS
-spool $1
+# sqlplus ... | cat > ... is here to fool selinux, since oracle_sqlplus_t
+# cannot write just anywhere
+sqlplus $CONNECT << EOS | cat > $1
set echo on
set serverout on
set pagesize 2000 linesize 145
Show replies by date