Back-port PCP SELinux and pmdaopenmetrics fixes for RHEL 8.10

Resolves: RHEL-7501
Resolves: RHEL-7507
This commit is contained in:
Nathan Scott 2023-11-21 14:47:16 +11:00
parent dc26b6fb11
commit 6bc6ca08e8
3 changed files with 24041 additions and 20 deletions

View File

@ -1,6 +1,6 @@
Name: pcp
Version: 5.3.7
Release: 18%{?dist}
Release: 19%{?dist}
Summary: System-level performance monitoring and performance management
License: GPLv2+ and LGPLv2+ and CC-BY
URL: https://pcp.io
@ -25,6 +25,8 @@ Patch14: redhat-bugzilla-2150889-nfsclient-srcport.patch
Patch15: redhat-bugzilla-2219731-hacluster-metrics.patch
Patch16: redhat-bugzilla-2211263-pmcd-conf-rewrite.patch
Patch17: redhat-build-jsonsl.patch
Patch18: redhat-issues-RHEL-7507-pmdaopenmetrics-quoting.patch
Patch19: redhat-issues-RHEL-7501-pmlogger_farm-selinux-policy.patch
# The additional linker flags break out-of-tree PMDAs.
# https://bugzilla.redhat.com/show_bug.cgi?id=2043092
@ -2291,25 +2293,7 @@ updated policy package.
%endif
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
%patch14 -p1
%patch15 -p1
%patch16 -p1
%patch17 -p1
%autosetup -p1
%build
# the buildsubdir macro gets defined in %setup and is apparently only available in the next step (i.e. the %build step)
@ -3381,6 +3365,10 @@ fi
%files zeroconf -f pcp-zeroconf-files.rpm
%changelog
* Tue Nov 21 2023 Nathan Scott <nathans@redhat.com> - 5.3.7-19
- Fix OpenMetrics PMDA mishandling systemd metrics (RHEL-7507)
- Additional pmlogger_farm service SELinux policy (RHEL-7501)
* Wed Jul 05 2023 Nathan Scott <nathans@redhat.com> - 5.3.7-18
- Improve pmproxy handling large HTTP requests (BZ 2159207)
- Fix hacluster metrics with current Pacemaker (BZ 2219731)

View File

@ -0,0 +1,74 @@
diff -Naurp pcp-5.3.7.orig/src/selinux/pcp.fc pcp-5.3.7/src/selinux/pcp.fc
--- pcp-5.3.7.orig/src/selinux/pcp.fc 2023-11-21 13:25:11.689247531 +1100
+++ pcp-5.3.7/src/selinux/pcp.fc 2023-11-21 14:12:48.080744232 +1100
@@ -1,36 +1,32 @@
-/etc/rc\.d/init\.d/pmcd -- gen_context(system_u:object_r:pcp_pmcd_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/pmproxy -- gen_context(system_u:object_r:pcp_pmproxy_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/pmie -- gen_context(system_u:object_r:pcp_pmie_initrc_exec_t,s0)
-
/usr/bin/pmie -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
-/usr/bin/pmcd -- gen_context(system_u:object_r:pcp_pmcd_exec_t,s0)
/usr/bin/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
-/usr/bin/pmproxy -- gen_context(system_u:object_r:pcp_pmproxy_exec_t,s0)
-
/usr/libexec/pcp/bin/pmcd -- gen_context(system_u:object_r:pcp_pmcd_exec_t,s0)
-/usr/libexec/pcp/bin/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
/usr/libexec/pcp/bin/pmproxy -- gen_context(system_u:object_r:pcp_pmproxy_exec_t,s0)
-/usr/libexec/pcp/bin/pmie -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
+
+/usr/libexec/pcp/bin/pmie_check -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
+/usr/libexec/pcp/bin/pmie_daily -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
+/usr/libexec/pcp/bin/pmie_farm -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
+/usr/libexec/pcp/bin/pmlogger_check -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
+/usr/libexec/pcp/bin/pmlogger_daily -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
+/usr/libexec/pcp/bin/pmlogger_farm -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
/usr/libexec/pcp/lib/pmcd -- gen_context(system_u:object_r:pcp_pmcd_initrc_exec_t,s0)
/usr/libexec/pcp/lib/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_initrc_exec_t,s0)
/usr/libexec/pcp/lib/pmproxy -- gen_context(system_u:object_r:pcp_pmproxy_initrc_exec_t,s0)
/usr/libexec/pcp/lib/pmie -- gen_context(system_u:object_r:pcp_pmie_initrc_exec_t,s0)
-/usr/share/pcp/lib/pmie -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
-
-/usr/share/pcp/lib/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
+/usr/share/pcp/lib/pmcd -- gen_context(system_u:object_r:pcp_pmcd_exec_t,s0)
+/usr/share/pcp/lib/pmproxy -- gen_context(system_u:object_r:pcp_pmproxy_exec_t,s0)
+/usr/share/pcp/lib/pmie -- gen_context(system_u:object_r:pcp_pmie_exec_t,s0)
+/usr/share/pcp/lib/pmlogger -- gen_context(system_u:object_r:pcp_pmlogger_exec_t,s0)
/var/lib/pcp(/.*)? gen_context(system_u:object_r:pcp_var_lib_t,s0)
/var/lib/pcp/pmdas/.*/Install -- gen_context(system_u:object_r:pcp_plugin_exec_t,s0)
-/var/lib/pcp/pmdas/.*/Remove -- gen_context(system_u:object_r:pcp_plugin_exec_t,s0)
+/var/lib/pcp/pmdas/.*/Remove -- gen_context(system_u:object_r:pcp_plugin_exec_t,s0)
/var/lib/pcp/pmdas/.*/Upgrade -- gen_context(system_u:object_r:pcp_plugin_exec_t,s0)
/var/log/pcp(/.*)? gen_context(system_u:object_r:pcp_log_t,s0)
/var/run/pcp(/.*)? gen_context(system_u:object_r:pcp_var_run_t,s0)
-/var/run/pmcd\.socket -- gen_context(system_u:object_r:pcp_var_run_t,s0)
-/var/run/pmlogger\.primary\.socket -l gen_context(system_u:object_r:pcp_var_run_t,s0)
diff -Naurp pcp-5.3.7.orig/src/selinux/pcp.te pcp-5.3.7/src/selinux/pcp.te
--- pcp-5.3.7.orig/src/selinux/pcp.te 2023-11-21 13:25:11.690247528 +1100
+++ pcp-5.3.7/src/selinux/pcp.te 2023-11-21 14:13:03.855770809 +1100
@@ -279,6 +279,7 @@ allow pcp_pmlogger_t pcp_pmcd_t:unix_str
allow pcp_pmlogger_t self:unix_dgram_socket create_socket_perms;
allow pcp_pmlogger_t pcp_pmlogger_exec_t:file execute_no_trans;
+allow pcp_pmlogger_t ldconfig_exec_t:file { execute execute_no_trans };
dontaudit pcp_pmlogger_t self:cap_userns { sys_ptrace };
@@ -313,6 +314,10 @@ optional_policy(`
rpm_script_signal(pcp_pmlogger_t)
')
+optional_policy(`
+ userdom_setattr_user_home_content_files(pcp_pmlogger_t)
+')
+
########################################
#
# pcp_plugin local policy

File diff suppressed because it is too large Load Diff