[node-patches] Change in ovirt-node[ovirt-3.5]: semodule: update passwd_t

[fabiand at redhat.com]

Hello Douglas Schilling Landgraf,

I'd like you to do a code review.  Please visit

    https://gerrit.ovirt.org/44071

to review the following change.

Change subject: semodule: update passwd_t
......................................................................

semodule: update passwd_t

Avoid AVC:
type=SYSCALL msg=audit(1435006475.936:203): arch=c000003e syscall=2 success=yes exit=5 a0=7fffed2c5f60 a1=c1 a2=180
a3=b items=0 ppid=17023 pid=17026 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=3
comm="chage" exe="/usr/bin/chage" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1435006476.011:204): avc:  denied  { link } for  pid=17026 comm="chage" name="passwd.17026"
dev="tmpfs" ino=121414 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file type=SYSCALL msg=audit(1435006476.011:204):
arch=c000003e syscall=86 success=yes exit=0 a0=7fffed2c5f60
a1=7fffed2c6360 a2=6 a3=0 items=0 ppid=17023 pid=17026 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=tty1 ses=3 comm="chage" exe="/usr/bin/chage"
subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1435006476.027:205): avc:  denied  { getattr } for  pid=17026 comm="chage" path="/etc/passwd.17026"
dev="tmpfs" ino=121414 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file
type=SYSCALL msg=audit(1435006476.027:205): arch=c000003e syscall=4 success=yes exit=0 a0=7fffed2c5f60 a1=7fffed2c5e70
a2=7fffed2c5e70 a3=0 items=0 ppid=17023 pid=17026 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=tty1 ses=3 comm="chage" exe="/usr/bin/chage" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1435006476.041:206): avc:  denied  { remove_name } for  pid=17026 comm="chage" name="passwd.17026"
dev="tmpfs" ino=121414 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
type=AVC msg=audit(1435006476.041:206): avc:  denied  { unlink } for  pid=17026 comm="chage" name="passwd.17026"
dev="tmpfs" ino=121414 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:
tmpfs_t:s0 tclass=file

Change-Id: Ie3c20dc810ce2b355c004f259550472dbb2248af
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/71/44071/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index 6b11d7e..2ead938 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -500,7 +500,8 @@
 }
 allow passwd_t file_t:file { read open getattr };
 allow passwd_t self:capability sys_admin;
-
+allow passwd_t tmpfs_t:dir { remove_name add_name write };
+allow passwd_t tmpfs_t:file { write getattr link create unlink open };
 #============= getty_t ==============
 require {
   type getty_t;


-- 
To view, visit https://gerrit.ovirt.org/44071
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ie3c20dc810ce2b355c004f259550472dbb2248af
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Fabian Deutsch <fabiand at redhat.com>
Gerrit-Reviewer: Fabian Deutsch <fabiand at redhat.com>