[node-patches] Change in ovirt-node[node-3.0]: Allow netlink_audit_socket read for sblim_sfcbd_t

[fabiand at redhat.com]

Hello Ryan Barry,

I'd like you to do a code review.  Please visit

    http://gerrit.ovirt.org/37377

to review the following change.

Change subject: Allow netlink_audit_socket read for sblim_sfcbd_t
......................................................................

Allow netlink_audit_socket read for sblim_sfcbd_t

Needed for CIM to auth correctly

Change-Id: I025e9b4243ae41d47e1fc25ae69c080a79499afb
Signed-off-by: Ryan Barry <rbarry at redhat.com>
Signed-off-by: Fabian Deutsch <fabiand at fedoraproject.org>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/77/37377/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index a35cd60..4fce32c 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -78,7 +78,7 @@
     }
     allow sblim_sfcbd_t chkpwd_exec_t:file { read execute open execute_no_trans };
     allow sblim_sfcbd_t self:capability { setuid audit_write dac_override };
-    allow sblim_sfcbd_t self:netlink_audit_socket { nlmsg_relay create write };
+    allow sblim_sfcbd_t self:netlink_audit_socket { nlmsg_relay create read write };
     allow sblim_sfcbd_t shadow_t:file { read getattr open };
     allow sblim_sfcbd_t user_tmp_t:sock_file { write unlink };
     allow sblim_sfcbd_t virt_etc_t:file { read open };
@@ -145,6 +145,7 @@
 allow iscsid_t iscsi_var_lib_t:lnk_file { create unlink };
 
 
+<<<<<<< HEAD
 type ovirt_t;
 type ovirt_exec_t;
 init_daemon_domain(ovirt_t, ovirt_exec_t)


-- 
To view, visit http://gerrit.ovirt.org/37377
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I025e9b4243ae41d47e1fc25ae69c080a79499afb
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: node-3.0
Gerrit-Owner: Fabian Deutsch <fabiand at redhat.com>
Gerrit-Reviewer: Ryan Barry <rbarry at redhat.com>