selinux/spacewalk-selinux/spacewalk-selinux-enable | 3 ++-
selinux/spacewalk-selinux/spacewalk.fc | 2 ++
selinux/spacewalk-selinux/spacewalk.te | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
New commits:
commit c7030d3f79f5ee4a77900b455bcdd79313865129
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Tue May 10 10:28:58 2011 +0200
702274 - restore kickstart files context
diff --git a/selinux/spacewalk-selinux/spacewalk-selinux-enable
b/selinux/spacewalk-selinux/spacewalk-selinux-enable
index 7b529a6..88db671 100644
--- a/selinux/spacewalk-selinux/spacewalk-selinux-enable
+++ b/selinux/spacewalk-selinux/spacewalk-selinux-enable
@@ -43,7 +43,8 @@ for selinuxvariant in mls strict targeted
done
/sbin/restorecon -rvvi /usr/share/rhn/satidmap.pl /usr/sbin/rhn-sat-restart-silent
/var/log/rhn /var/cache/rhn \
- /usr/bin/rhn-sudo-ssl-tool /usr/bin/rhn-sudo-load-ssl-cert /var/www/html/pub
/usr/sbin/tanukiwrapper
+ /usr/bin/rhn-sudo-ssl-tool /usr/bin/rhn-sudo-load-ssl-cert /var/www/html/pub
/usr/sbin/tanukiwrapper \
+ /var/lib/rhn/kickstarts
/usr/sbin/setsebool -P httpd_enable_cgi 1
/usr/sbin/setsebool -P httpd_can_network_connect 1
commit 67aa9aadb05d3875c483fc926aa5e80c4fc5ae55
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Mon May 9 16:28:20 2011 +0200
702274 - fixed context of kickstart configs
diff --git a/selinux/spacewalk-selinux/spacewalk.fc
b/selinux/spacewalk-selinux/spacewalk.fc
index 61c7598..574e07f 100644
--- a/selinux/spacewalk-selinux/spacewalk.fc
+++ b/selinux/spacewalk-selinux/spacewalk.fc
@@ -22,3 +22,5 @@
/var/log/spacewalk/schema-upgrade(/.*)?
gen_context(user_u:object_r:spacewalk_db_install_log_t,s0)
/usr/sbin/tanukiwrapper gen_context(system_u:object_r:java_exec_t,s0)
+
+/var/lib/rhn/kickstarts(/.*)? gen_context(unconfined_u:object_r:spacewalk_data_t,s0)
commit 121140517b765134eeb56caff84fdbb88247ccf3
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Mon May 9 16:22:38 2011 +0200
702274 - allow cobblerd_t to read spacewalk_data_t
diff --git a/selinux/spacewalk-selinux/spacewalk.te
b/selinux/spacewalk-selinux/spacewalk.te
index f62b454..ed1932b 100644
--- a/selinux/spacewalk-selinux/spacewalk.te
+++ b/selinux/spacewalk-selinux/spacewalk.te
@@ -81,6 +81,16 @@ optional_policy(`
allow oracle_sqlplus_t spacewalk_db_install_log_t:file append;
')
+optional_policy(`
+ gen_require(`
+ type cobblerd_t;
+ type httpd_cobbler_content_t;
+ ')
+ read_files_pattern(cobblerd_t, spacewalk_data_t, spacewalk_data_t);
+ allow cobblerd_t spacewalk_data_t:file { getattr link unlink rename };
+ manage_dirs_pattern(cobblerd_t, spacewalk_data_t, spacewalk_data_t);
+')
+
# rpm_dontaudit_search_db(httpd_t) is not available on RHELs
dontaudit httpd_t rpm_var_lib_t:dir list_dir_perms;
dontaudit httpd_t rpm_var_lib_t:file read_file_perms;
Show replies by date