[node-patches] Change in ovirt-node[master]: SELinux changes for EL7 and CIM

[rbarry at redhat.com]

Ryan Barry has uploaded a new change for review.

Change subject: SELinux changes for EL7 and CIM
......................................................................

SELinux changes for EL7 and CIM

Allow CIM access to libvirt and to read /etc/shadow for auth
checking.

Change-Id: Icb6936202dedd340084dddaf846947acf64119e7
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1120621
Signed-off-by: Ryan Barry <rbarry at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 29 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/42/30242/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index d42a934..ea6acfe 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -118,7 +118,7 @@
 
 #============= sshd_t ==============
 @SEMODULE_WITH_SYSTEMD at allow sshd_net_t initrc_t:process sigchld;
-allow sshd_t var_log_t:file { read open };
+allow sshd_t var_log_t:file { read open write };
 
 
 #============= svirt_t ==============
@@ -225,6 +225,34 @@
     allow systemd_localed_t security_t:file { open read };
 ')
 
+#============= rhsmcertd_t ==============
+optional_policy(`
+    require {
+        type rhsmcertd_t;
+    }
+    allow rhsmcertd_t tmpfs_t:dir search;
+    allow rhsmcertd_t var_log_t:file open;
+')
+
+#============= sblim_sfcbd_t ==============
+optional_policy(`
+    require {
+        type sblim_sfcbd_t;
+        type virt_var_run_t;
+        type virt_etc_t;
+        type virtd_t;
+    }
+    allow sblim_sfcbd_t chkpwd_exec_t:file { read execute open execute_no_trans };
+    allow sblim_sfcbd_t self:capability { setuid audit_write dac_override };
+    allow sblim_sfcbd_t self:netlink_audit_socket { nlmsg_relay create };
+    allow sblim_sfcbd_t shadow_t:file { read getattr open };
+    allow sblim_sfcbd_t user_tmp_t:sock_file { write unlink };
+    allow sblim_sfcbd_t virt_etc_t:file { read open };
+    allow sblim_sfcbd_t virt_var_run_t:dir search;
+    allow sblim_sfcbd_t virt_var_run_t:sock_file write;
+
+    allow sblim_sfcbd_t virtd_t:unix_stream_socket connectto;
+')
 
 #============= irqbalance_t ==============
 optional_policy(`


-- 
To view, visit http://gerrit.ovirt.org/30242
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Icb6936202dedd340084dddaf846947acf64119e7
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Ryan Barry <rbarry at redhat.com>