selinux/spacewalk-selinux/spacewalk.te | 1 +
1 file changed, 1 insertion(+)
New commits:
commit 4cb9591e373ebe9e1f72f598f654163eb67de73c
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Mon Jan 24 20:59:17 2011 +0100
Adding explicit append allow for sqlplus.
Now that spacewalk-schema-upgrade opens the logfile and then passes
it to spacewalk-sql (and thus to sqlplus), sqlplus is appending to
spacewalk_db_install_log_t, it's no longer
spacewalk_sqlplus_spool_log_t in this situation.
Addressing
avc: denied { append } for pid=31334 comm="sqlplus"
path="/var/log/spacewalk/schema-upgrade/20110124-143949-to-spacewalk-schema-1.3.log"
dev=dm-0 ino=104955979 scontext=root:system_r:oracle_sqlplus_t:s0-s0:c0.c1023
tcontext=root:object_r:spacewalk_db_install_log_t:s0 tclass=file
diff --git a/selinux/spacewalk-selinux/spacewalk.te
b/selinux/spacewalk-selinux/spacewalk.te
index 5ef5605..8f56c6c 100644
--- a/selinux/spacewalk-selinux/spacewalk.te
+++ b/selinux/spacewalk-selinux/spacewalk.te
@@ -77,4 +77,5 @@ optional_policy(`
read_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t,
spacewalk_db_install_log_t);
create_files_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t,
spacewalk_sqlplus_spool_log_t);
filetrans_pattern(oracle_sqlplus_t, spacewalk_db_install_log_t,
spacewalk_sqlplus_spool_log_t, file)
+ allow oracle_sqlplus_t spacewalk_db_install_log_t:file append;
')
Show replies by date