[node-patches] Change in ovirt-node[master]: semodule: Add rule ro AVC sshd_keygen_t plymouth_exec_t

[dougsland at redhat.com]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: semodule: Add rule ro AVC sshd_keygen_t plymouth_exec_t
......................................................................

semodule: Add rule ro AVC sshd_keygen_t plymouth_exec_t

This patch should resolve the below AVC:

type=AVC msg=audit(1446675487.133:116): avc:  denied  { execute } for  pid=3511 comm="sshd-keygen" name="plymouth" dev="dm-0" ino=8199 scontext=system_u:system_r:sshd_keygen_t:s0 tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file

Change-Id: I3c5e4576953283ecdb8a3f520cf248ffddeba1c8
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/98/48098/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index 4d69ad2..9a28815 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -575,10 +575,12 @@
         type ssh_keygen_t;
         type sshd_keygen_t;
         type tmpfs_t;
+        type plymouth_exec_t;
     }
     allow sshd_keygen_t tmpfs_t:dir { search };
     allow sshd_keygen_t setfiles_t:process { siginh rlimitinh noatsecure };
     allow sshd_keygen_t ssh_keygen_t:process { siginh rlimitinh noatsecure };
+    allow sshd_keygen_t plymouth_exec_t:file execute;
 ')
 
 


-- 
To view, visit https://gerrit.ovirt.org/48098
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I3c5e4576953283ecdb8a3f520cf248ffddeba1c8
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>