selinux/spacewalk-selinux/spacewalk-selinux-enable | 3 ++- selinux/spacewalk-selinux/spacewalk.fc | 2 ++ selinux/spacewalk-selinux/spacewalk.te | 10 ++++++++++ 3 files changed, 14 insertions(+), 1 deletion(-)
New commits: commit c7030d3f79f5ee4a77900b455bcdd79313865129 Author: Michael Mraka michael.mraka@redhat.com Date: Tue May 10 10:28:58 2011 +0200
702274 - restore kickstart files context
diff --git a/selinux/spacewalk-selinux/spacewalk-selinux-enable b/selinux/spacewalk-selinux/spacewalk-selinux-enable index 7b529a6..88db671 100644 --- a/selinux/spacewalk-selinux/spacewalk-selinux-enable +++ b/selinux/spacewalk-selinux/spacewalk-selinux-enable @@ -43,7 +43,8 @@ for selinuxvariant in mls strict targeted done
/sbin/restorecon -rvvi /usr/share/rhn/satidmap.pl /usr/sbin/rhn-sat-restart-silent /var/log/rhn /var/cache/rhn \ - /usr/bin/rhn-sudo-ssl-tool /usr/bin/rhn-sudo-load-ssl-cert /var/www/html/pub /usr/sbin/tanukiwrapper + /usr/bin/rhn-sudo-ssl-tool /usr/bin/rhn-sudo-load-ssl-cert /var/www/html/pub /usr/sbin/tanukiwrapper \ + /var/lib/rhn/kickstarts
/usr/sbin/setsebool -P httpd_enable_cgi 1 /usr/sbin/setsebool -P httpd_can_network_connect 1
commit 67aa9aadb05d3875c483fc926aa5e80c4fc5ae55 Author: Michael Mraka michael.mraka@redhat.com Date: Mon May 9 16:28:20 2011 +0200
702274 - fixed context of kickstart configs
diff --git a/selinux/spacewalk-selinux/spacewalk.fc b/selinux/spacewalk-selinux/spacewalk.fc index 61c7598..574e07f 100644 --- a/selinux/spacewalk-selinux/spacewalk.fc +++ b/selinux/spacewalk-selinux/spacewalk.fc @@ -22,3 +22,5 @@ /var/log/spacewalk/schema-upgrade(/.*)? gen_context(user_u:object_r:spacewalk_db_install_log_t,s0)
/usr/sbin/tanukiwrapper gen_context(system_u:object_r:java_exec_t,s0) + +/var/lib/rhn/kickstarts(/.*)? gen_context(unconfined_u:object_r:spacewalk_data_t,s0)
commit 121140517b765134eeb56caff84fdbb88247ccf3 Author: Michael Mraka michael.mraka@redhat.com Date: Mon May 9 16:22:38 2011 +0200
702274 - allow cobblerd_t to read spacewalk_data_t
diff --git a/selinux/spacewalk-selinux/spacewalk.te b/selinux/spacewalk-selinux/spacewalk.te index f62b454..ed1932b 100644 --- a/selinux/spacewalk-selinux/spacewalk.te +++ b/selinux/spacewalk-selinux/spacewalk.te @@ -81,6 +81,16 @@ optional_policy(` allow oracle_sqlplus_t spacewalk_db_install_log_t:file append; ')
+optional_policy(` + gen_require(` + type cobblerd_t; + type httpd_cobbler_content_t; + ') + read_files_pattern(cobblerd_t, spacewalk_data_t, spacewalk_data_t); + allow cobblerd_t spacewalk_data_t:file { getattr link unlink rename }; + manage_dirs_pattern(cobblerd_t, spacewalk_data_t, spacewalk_data_t); +') + # rpm_dontaudit_search_db(httpd_t) is not available on RHELs dontaudit httpd_t rpm_var_lib_t:dir list_dir_perms; dontaudit httpd_t rpm_var_lib_t:file read_file_perms;
spacewalk-commits@lists.fedorahosted.org