[node-patches] Change in ovirt-node[master]: semodule: Avoid AVC for replacing hostname

[dougsland at redhat.com]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: semodule: Avoid AVC for replacing hostname
......................................................................

semodule: Avoid AVC for replacing hostname

type=AVC msg=audit(1447891832.084:276): avc:  denied  { open } for  pid=15948 comm="systemd-hostnam" path="/etc/hostname" dev="tmpfs" ino=94978 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

Change-Id: Ia2782dc47f19310c4a43a580b2075a7fb7a15658
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1270736
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/04/48804/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index 9a28815..48c2851 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -39,6 +39,7 @@
     type unconfined_t;
     type unlabeled_t;
     type user_tmpfs_t;
+    type user_tmp_t;
     type var_log_t;
     type var_lib_t;
     type virt_cache_t;
@@ -148,6 +149,7 @@
 @SEMODULE_WITH_SYSTEMD at allow systemd_hostnamed_t tmpfs_t:dir { write remove_name search add_name };
 @SEMODULE_WITH_SYSTEMD at allow systemd_hostnamed_t tmpfs_t:file { unlink };
 @SEMODULE_WITH_SYSTEMD at allow systemd_hostnamed_t ovirt_t:dbus send_msg;
+ at SEMODULE_WITH_SYSTEMD@allow systemd_hostnamed_t user_tmp_t:file { unlink open };
 
 #============= hald_t ==============
 optional_policy(`


-- 
To view, visit https://gerrit.ovirt.org/48804
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia2782dc47f19310c4a43a580b2075a7fb7a15658
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>