[node-patches] Change in ovirt-node[master]: ovirt.te: Add snmp selinux for unlabeled_t:file

[dougsland at redhat.com]

Douglas Schilling Landgraf has submitted this change and it was merged.

Change subject: ovirt.te: Add snmp selinux for unlabeled_t:file
......................................................................


ovirt.te: Add snmp selinux for unlabeled_t:file

Should cover the following denied entries: type=AVC
msg=audit(1462981993.743:376): avc: denied { getattr }
for pid=18064 comm="snmpd" path="/var/lib/net-snmp/snmpd.conf"
 dev="dm-8" ino=126 scontext=system_u:system_r:snmpd_t:s0
tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file type=SYSCALL
msg=audit(1462981993.743:376): arch=c000003e syscall=4 success=yes exit=0
a0=7ffddad8e600 a1=7ffddad8e570 a2=7ffddad8e570 a3=5 items=0 ppid=1 pid=18064
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="snmpd" exe="/usr/sbin/snmpd"
subj=system_u:system_r:snmpd_t:s0 key=(null) type=AVC msg=audit
(1462981993.743:377): avc: denied { rename } for pid=18064 comm="snmpd"
name="snmpd.conf" dev="dm-8" ino=126 scontext=system_u:system_r:snmpd_t:s0
tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file type=SYSCALL
msg=audit(1462981993.743:377): arch=c000003e syscall=82 success=yes exit=0
a0=7ffddad8e600 a1=7ffddad8e800 a2=ffffffffffffff80 a3=0 items=0 ppid=1
pid=18064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="snmpd" exe="/usr/sbin/snmpd"
subj=system_u:system_r:snmpd_t:s0 key=(null) type=AVC msg=audit
(1462981993.744:378): avc: denied { unlink } for pid=18064 comm="snmpd"
name="snmpd.0.conf" dev="dm-8" ino=126 scontext=system_u:system_r:snmpd_t:s0
tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file type=SYSCALL
msg=audit(1462981993.744:378): arch=c000003e syscall=87 success=yes exit=0
a0=7ffddad8f010 a1=7ffddad8ef80 a2=7ffddad8ef80 a3=0 items=0 ppid=1 pid=18064
 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="snmpd" exe="/usr/sbin/snmpd"
subj=system_u:system_r:snmpd_t:s0 key=(null) type=SERVICE_STOP
msg=audit(1462981993.750:379): pid=1 uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:init_t:s0 msg='unit=snmpd comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1462981993.997:380): avc: denied { read } for
pid=18116 comm="snmpd" name="0" dev="dm-8" ino=129
scontext=system_u:system_r:snmpd_t:s0 tcontext=unconfined_u:object_r:
unlabeled_t:s0 tclass=file type=AVC msg=audit(1462981993.997:380): avc:
denied { open } for pid=18116 comm="snmpd" path="/var/lib/net-snmp/
mib_indexes/0" dev="dm-8" ino=129 scontext=system_u:system_r:snmpd_t:s0
tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=file

Change-Id: I91689638f1bf4b345b8b4ca64807b908375b58eb
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1283519
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 1 insertion(+), 0 deletions(-)

Approvals:
  Douglas Schilling Landgraf: Verified; Looks good to me, approved; Passed CI tests
  Fabian Deutsch: Looks good to me, approved



-- 
To view, visit https://gerrit.ovirt.org/57359
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I91689638f1bf4b345b8b4ca64807b908375b58eb
Gerrit-PatchSet: 3
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Fabian Deutsch <fabiand at redhat.com>
Gerrit-Reviewer: Ryan Barry <rbarry at redhat.com>
Gerrit-Reviewer: gerrit-hooks <automation at ovirt.org>