[node-patches] Change in ovirt-node[master]: semodule: Add rule for usermod

[dougsland at redhat.com]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: semodule: Add rule for usermod
......................................................................

semodule: Add rule for usermod

Avoid the below error when trying to use: usermod -P <crypted pass> root

type=AVC msg=audit(1434823030.774:2151): avc:  denied  { link } for  pid=24032 comm="usermod" name="passwd.24032"
dev="tmpfs" ino=318504 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
type=SYSCALL msg=audit(1434823030.774:2151): arch=c000003e syscall=86 success=yes exit=0 a0=7fff86841380 a1=7fff86841780
a2=6 a3=0 items=0 ppid=24014 pid=24032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="usermod" exe="/usr/sbin/usermod" subj=system_u:system_r:useradd_t:s0 key=(null)
type=AVC msg=audit(1434823030.774:2152): avc:  denied  { getattr } for  pid=24032 comm="usermod"
path="/etc/passwd.24032" dev="tmpfs" ino=318504 scontext=system_u:system_r:useradd_t:s0
tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
type=SYSCALL msg=audit(1434823030.774:2152): arch=c000003e syscall=4 success=yes exit=0 a0=7fff86841380 a1=7fff86841290
a2=7fff86841290 a3=0 items=0 ppid=24014 pid=24032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="usermod" exe="/usr/sbin/usermod" subj=system_u:system_r:useradd_t:s0 key=(null)
type=AVC msg=audit(1434823030.774:2153): avc:  denied  { remove_name } for  pid=24032 comm="usermod" name="passwd.24032"
dev="tmpfs" ino=318504 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
type=AVC msg=audit(1434823030.774:2153): avc:  denied  { unlink } for  pid=24032 comm="usermod" name="passwd.24032"
dev="tmpfs" ino=318504 scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file

Change-Id: Ib97e606659a5b0ef22e224270bc3ecabd93c1d97
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 8 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/91/42591/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index e667dfa..2a40ece 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -156,6 +156,14 @@
     allow hald_t ovirt_t:dbus send_msg;
 ')
 
+#============= useradd_t ==============
+optional_policy(`
+    require {
+        type useradd_t;
+    }
+    allow useradd_t tmpfs_t:dir { write remove_name add_name };
+    allow useradd_t tmpfs_t:file { write getattr link create unlink open };
+')
 
 #============= initrc_t ==============
 optional_policy(`


-- 
To view, visit https://gerrit.ovirt.org/42591
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib97e606659a5b0ef22e224270bc3ecabd93c1d97
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>