[node-patches] Change in ovirt-node[master]: semodule: avoid NetworkManager AVC in autoinstall

[dougsland at redhat.com]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: semodule: avoid NetworkManager AVC in autoinstall
......................................................................

semodule: avoid NetworkManager AVC in autoinstall

This patch avoid the following AVC:

msg=audit(1438805615.080:40): avc:  denied  { write } for  pid=1140 comm="NetworkManager" name="resolv.conf"
dev="tmpfs" ino=37017 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
type=AVC msg=audit(1438805615.080:39): avc:  denied  { write } for  pid=1140 comm="NetworkManager" name="etc"
dev="tmpfs" ino=32862 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
type=AVC msg=audit(1438805614.597:33): avc:  denied  { read } for  pid=1233 comm="pool" name="resolv.conf" dev="tmpfs"
ino=37017 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file

Change-Id: I38013d5e6072f9d2a320f311601fe04a69a2a48b
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/43/44443/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index 3c7c0c3..474f53d 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -551,7 +551,8 @@
     require {
         type NetworkManager_t;
     }
-    allow NetworkManager_t tmpfs_t:dir { read };
+    allow NetworkManager_t tmpfs_t:dir { read write };
+    allow NetworkManager_t tmpfs_t:file { read write getattr };
 ')
 
 


-- 
To view, visit https://gerrit.ovirt.org/44443
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I38013d5e6072f9d2a320f311601fe04a69a2a48b
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>