[node-patches] Change in ovirt-node[master]: ovirt.te.in: update iptables_t rules

[Code Review]

>From Douglas Schilling Landgraf <dougsland at redhat.com>:

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: ovirt.te.in: update iptables_t rules
......................................................................

ovirt.te.in: update iptables_t rules

Avoid boot AVC:

type=AVC msg=audit(1482319168.924:51): avc:  denied  { read }
for  pid=1998 comm="iptables" name="xtables.lock" dev="tmpfs"
ino=23877 scontext=system_u:system_r:iptables_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_run_t:s0 tclass=file

Change-Id: I9d9b2edb39cf5315c9570ee12b2b276403c970db
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1406673
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/81/69881/1

diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index e9350c3..5f22fe8 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -485,12 +485,14 @@
         type iptables_t;
         type insmod_t;
         type var_lib_t;
+        type var_run_t;
     }
     allow iptables_t tmpfs_t:dir search;
     allow iptables_t insmod_t:process { siginh rlimitinh noatsecure };
     allow iptables_t user_tmpfs_t:file { read open getattr };
     allow iptables_t var_lib_t:dir { write remove_name create add_name };
     allow iptables_t var_lib_t:file { write create unlink open };
+    allow iptables_t var_run_t:file { read open lock };
 ')
 
 #============= init_t ==============


-- 
To view, visit https://gerrit.ovirt.org/69881
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I9d9b2edb39cf5315c9570ee12b2b276403c970db
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>