Fwd: how to get a policy for openlmi-*

Jan Safranek jsafrane at redhat.com
Thu Jun 27 08:11:03 UTC 2013


On 06/25/2013 04:56 PM, Jan Safranek wrote:
> Alternatively, we can create libpyCmpiLMI_Software.so and
> libpyCmpiLMI_Storage.so as symlinks to libpyCmpiProvider.so. In this
> case, we just need to change our registration files and package the new
> symlinks. Is it acceptable solution?


If there are no objections, I'll add attached README.SELinux to
cmpi-providers-pywbem.rpm and implement suggested adjustments in next
release of openlmi-storage.rpm.

All changes are Fedora downstream only, upstream is not affected.

Jan

-------------- next part --------------
SELinux policy for Python providers
===================================

See README.RedHat.Security in tog-pegasus package for details how Pegasus and
SELinux are supposed to work for 'normal' providers.

Since all python providers share the same CMPI provider module
(libpyCmpiProvider.so) and /usr/sbin/cimprovagt decides which real cimprovagt
to start based on this provider module name, all Python providers should share
the same SELinux policy.

Of course, that's not what we want. To have separate SELinux policy for a Python
provider, implement these adjustments:

1. Create a symlink

/usr/lib{64}/libpyCmpiProvider-<providername>.so -> /usr/lib{64}/libpyCmpiProvider.so

-> now we have separate CMPI provider module name.

2. Ship /usr/libexec/pegasus/pyCmpiProvider-<providername>-cimprovagt, as suggested
by README.RedHat.Security

3. Adjust module name in you provider registration files (*.reg) to use this new
libpyCmpiProvider-<providername>.so

All this can be done during packaging, so RPM installs the files with correct
SELinux labels.


More information about the openlmi-devel mailing list