[node-patches] Change in ovirt-node[master]: ovirt.te: add sanlock nfs avc

[dougsland at redhat.com]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: ovirt.te: add sanlock nfs avc
......................................................................

ovirt.te: add sanlock nfs avc

This patch adds:
  allow sanlock_t nfs_t:dir search;
  allow sanlock_t nfs_t:file open;

Change-Id: I1f24af8c501626de6c59f5d31f8ca9c93b9671bd
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 3 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/46/33946/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index c6f86e1..184c22a 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -27,6 +27,7 @@
     type logrotate_t;
     type mount_t;
     type net_conf_t;
+    type nfs_t;
     type policykit_t;
     type sanlock_t;
     type setfiles_t;
@@ -116,6 +117,8 @@
 allow sanlock_t tmpfs_t:dir search;
 allow sanlock_t auditd_log_t:dir search;
 allow sanlock_t auditd_log_t:file { read getattr open append };
+allow sanlock_t nfs_t:dir search;
+allow sanlock_t nfs_t:file open;
 
 
 #============= systemd_localed_t ==============
@@ -262,7 +265,6 @@
 
 #============= ping_t ==============
 require {
-    type nfs_t;
     type ping_t;
 }
 allow ping_t nfs_t:file read;


-- 
To view, visit http://gerrit.ovirt.org/33946
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I1f24af8c501626de6c59f5d31f8ca9c93b9671bd
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>