From 6fc6359b101c0b3752a7bf4ce25371a089e9153b Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 10 Jul 2017 09:27:35 +0200 Subject: [PATCH] * Mon Jul 10 2017 Lukas Vrabec - 3.13.1-262 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service - Allow iptables to read container runtime files --- container-selinux.tgz | Bin 6831 -> 6890 bytes policy-rawhide-base.patch | 15 ++++++++----- policy-rawhide-contrib.patch | 40 +++++++++++++++++++---------------- selinux-policy.spec | 6 +++++- 4 files changed, 37 insertions(+), 24 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 30bcc9dfc4b55308fd9e8cc73451c2869189ce75..400e55dad28d65baf73e3a5ff315779d95b4981c 100644 GIT binary patch delta 6644 zcmV`~K~lH{ZN@`{wO`>-X31-oJkT&FeRBui-0r zeX0tnpF`7zbr5`$-PPeHiL7*E&;La~tLM*yADcs-hxOy1|FKVkvPz0qO?jxJBnYc2 zOQWz&%OZ%xKnap!2j7=JUJ14pfcSlSrNJL(e|<=zLz^h*X%V!0^@q63;UAa8dZq9N zKUQHK=0OpE=EO9+dDiJqW@qEANvyXv?6j!=g#CQ6|tULWO^?(xOf3Z5Soz zzscIH>qF6|d9sG`2m-91woq^U)n1(GNqe!v0v7B_j;wU) zPJ6<7&A)5UCUxzZt!uRc>M~0V@PC7!C3qM`Nz;s>B2pAqSEIuRz9)^GuJ^?w(ci51 zv0&);I^AFwe0y!iK!{V!RS?pXov1kAr-)k4N9Syd!h$HBv+T$T^|vI9NxoHG;@}Hl zr2_GPm)qeKTWAJ(404OGp{i@D-mFnwf!1Pe9MN9KiuCW)jf(uTbQ8o-&8RKwG-)Ob z-qQ$@k29#2k09^D8c91rQu)ERZ%i~Fpq&B7hkvfCq|O^)+@@L5h=Msa4f2IogQq5H znxmgn&=#E``Ib-@eQ{IQesMvQa=;c+b!Lfw+d4+i2%J4Os}70v8D!q} z%bk&XNIgrN7RRiW7 znvI9RT@vTk?KQXQ8)nAOxXMpknzXGT^vnP-z{>4v5=qJ;$wP$Y}zD` z+H9(?PJebN(w4;Ebri#n`KCe?#Cj`5@;b>%+?ax-QW#J4B;X&x%)514GVlr%%YBSB zVK@fgi&B#h_!Y>JA-yjnT)aX7U%>dEg8MVNC}|ppMI7AMscAErCpoNKUw%^GgN*W7 z-d;mbNE+yeJYd*D_7kM33o{5yG->vyWz{}TUBUwm-zv^v;&H{Hfx*^3l6u6s&=;zh zA)098l8AC0W5i)+5Yov3Au+>))HvTJP zzyud2gF?&Fh$JtAXY$!4@IAYjjT4vA?R=01xYvUk;jeShz|>c9UPY7r1U(H^2I{U+ zN0z7kZ*W?7lSc(k0?^Zwmjxw%U)+9XwLyCWYdt%P%(%g|M2=ZD(fyjt+DKdWL4MF$ zZKpmmZwNKc55mhH^o|c_SijDJ_xE3Z>gv!u<3_bQjh0SZ|Hh@h*DQ?cN#gTEI>>KiC<6XXcEj8$g7-eS}SV4bljjbXSBKo3O#B zn`sUiD2!GoGoh%M`((p~pd4RV=foI4_eg5|C}j@-))~kxta-`5^J3@CH#iB$xs`D; z?wu2UHdG4(C!28iud6bDOQS~`;le4%y?`OifK~(>Tqw^+oQ5x!cJ{8rL%ZjJo&%3B zJ$zyTu~gqFVe7=u(-umTj|@jwkOn^=7o%hDsAEHwPo&p{6ui6RsOV$`;n;IlgR#xz z{B&&|YW;MxdpHZK>;Nj(+ZggPf^|&aXVWK)p*Qt|DsnJx%0m%U|2jF;Q5-tWC128ENJy(RYG%_rJ6R&-iulI>PlDL zxz{ROrXQnYhj?8{tT&WuF{fKUhPwk3Kg%%oA*V4sR;iBm*nwn>pVaE&hhz*V?2z=w z63GoEqkN1=_|#E4QO@zt96J279eTv&$0(euZa$5UMyC-&#B}%CoyQsPn07 zB`E8@;UP&x89;Q7L>KZW^bDi=%V}4)Zo_()w1OtjnlFM?Nn2F^*s1F0i2o=3&5JQB2^YAO~gZN zDjr;uV2BD-C%E4ypa*L;oFpXkSon#_o1109KYscpsLHyPF*p_1lMEdj(;kX&qqbFU z&A?oL8EnI>NiMW1@ftC!o*yHso_;7j=Yik5x;#{W!8vzJU2rY!Q44OAF@UZfww(+# zHw|&2A*%v(pwsZ~Qww99BJ$!e$w56crG0KF$#ub*tNP}!`F#zBTeL@&-YI<(oMb|E z?#Uq?8m8*mYv)?qR;nSPE@IqnFfBHmS{F6jg!e_vejD_P>NFhEd-aRcEq9@`OL0*2 z<3!GXdryaBOuDoCRaC;9_+1GUm)Q$$3{mRCiLfPcfK28B{fK<9_dD15hq%IZ-$(9F z8dyE~-_&%Y+uwM!(Z>|W9SkuOK}zR3mkDi9L4HJ{N8X%kOpe)~R|5@zKgphfKQzQ1 zs}mUyOb6KPAX%crpLYChV;fa8;D)2hJW9=f=OY@b?i}lb4_$TEGIY{mQOYq!zm(oV znK+M-Kb{*AhVUXrvya_{c(QQK_VIkkG6drh8+|Mpg~)`Em(XS8UO68y8Uzii>Oj2o z+sz97&_&YH-{(3DuBGWVPPXU2CA8+P!Mw+<$a5YMjtfA1%rXRfz1P930Cx>c`ulW$ zw}+LNHsJk|Gq&$vtYF;6sAW#JggT1`^hcNl%pQYB%tvNg_?sl#eu%;<+@x9BJ_a9y zXkXqJ!EFi#&=&rMH!Pc^P2(WHEy_5+uAu`w`qw5cWc)q-P={dCB<&U;alu<-@D-(h z`gAi^3$S9ufqk81U>|3AU_Zhn_Q?N#ghHc34MV3L=jj`qBh=d%!;;3y(8)-%phSaU zl$xI{V(heX(8vxiy_uD3qn^BZv!mlu`1a($AbJ*ntp?JMG3`61y)P5g=?}q$|Mp}v z1$^+L)gL|4+NfFp-m2rl5<6Cac#tW=bf3fN4@j zDOBELMp5IAXz>xOpmNeB`V7=pmKL|`TYf?DklbN-z!5bQh|m#n8tybG@pKlXt5$Le z#Q{JX8a9bZoknX=;6^j+LbBk%oyY?6pUOfb6NYo0M0YHx3%A+hHJigjRr92m0-HcD zH~emvmA1vwyz*uquHQGAeyx9h#Ij&!;qaFWfhaFVECA`Fk$AukCNuiT7x!&l=G{V1 z2~YAe1~Xx0OolL0JrN2#+~%2Xksk{-%(E~XaWv%F6WI_0EueX&U3+4~pqnBvvHdki z!p-SVHzI=qi_c$99iVn^2w$S|mw~=ZZ!*6-r z_3Li0es9X+5*|KtHQ=MsWjFKzd>TemJP-a7$1J8W4{wuRz|TI3ZiD->zP$vpe=n%U5 z#I5sFmND7jo>GR-Dxxuw;jAnlH||3$SLs{TzF!KPOHOySN{kQ_}VZb3x!$7v3287Qr9%gyc z#_qk;GyEbgjBkvQ(trNMqYd~`ML+1k*p@C5ffzBG9=FDSEk@Lv_46$VJ;`{qHw&|( zpl>s|N?jx^x+i?e>89yp6SbM8DuVbPk-bPkY)!OJV!y)iyxSs#E>e0;@$g~Prgt!( zVoUj)KE`Km+qo{*5h*0Pp#aHD((0%9IcWbjoJnHiLkyG&bh*< zW*_AXb{<}T&^d(A!L%_)k6iSrnthUG9&~<=r6W!ad*^wAE#1ywnpu_>EVS^^-o9-s z&msg%ROWe=B@b&FljFR-(@kFq8kzjgcxRua&NxaQI~irm9Zhwv?pOr5gO`FpiF1b*Vyd!c(jBW@n-95rd6{Cs#mi+kB@@q)Y<}ZA||!vVP?q^KL|9E+c^J4l8j*vG#^ueb9;K9z?FNZD}opjG>jjB(+mB3@6{p0PFB?4hNFEH0bH&1g4` z27D~5Br0SWQprBaU^2SQ@6{?!?$kYq#S^6vf#C44-R9;3O6qo4Y%Q}zk{mpLXtFz6 zbKAOfR1IH=fVFZ`WMx@-LHQMll>?KacDewB%+e-}DH>~Zi_W(yM=*@;&<7kod+-61 zJd>NmB~RSO{0)p}ya2AdklKf?fd43tE;W1YO}PE`+WMRGjP2u9&xC8cpLme@N}%cA zo_7r?opi(%0xG-VkvFck$c@&2`hjgc{fNoQvWOpsmaP2&ren5oKzjOO2rVtjHr+nD zT{da4Pf#PrN{G@(i)1aAcSDWH^WLxQRdQzq$I7{{J}vYBo9bd$rGXQ1B?=i zd2uMvfQ&-w1p9#-T41nK?>36icMbe#->%a=X6Ct~0VA(3+gt%1OWm%2V>{K4Rx>J%X zC{vX&Qf`&dW?Zg#h7##4xJ#i^$&b2am#8~c3con&pb8cQFhepHl+LrLC4NARuk0w^6#dUSn?He^w>vu&GyUPuM&6lP1075C$_ z-1i5$QMa8)*cgiq2+vdsJUX=|KDk&uSCgX@FBUmv|I8jD4$$TPU-z_&+3711m&s(y zljsy305tmswqz`UbC|FwT}iF*1AbRDLD2npk{Q>b zvY*+@hk9|TZsbn0^z|3%&5JQrE?%|ODQ}xz6ZO=Uq$BWrRz7SsLm7L)$4Htoo(pqE z#w?X{Vty!ThFjp22n3l6?M6-SVzn#8`!z-`WQ@Ng#Pw|SZpK3J&f63VmEpQracmLp zI~G3ZhlQ!e{V6P#ZtzZ~n@WebDnN|L&QDlB7{UCa z1||7;K$#?+sqk7|+dU6{VhIbgN0zoCWpBuVMH|d%RK}P1Cc(g9yUHy5UHvY2;tG~i zQ!SSL!WIX#J;^$|(QiL!89G@Wd;&D&J?>o;;+G|Vye<{ZxiaC}Un~YRn&ffV2yt=4 zv|#X}^aX=u(loCzW|r%qp8znp=})P&{=+b(gp;V}vL{EqcJ?F*M{JGWZ!}T#jee^K z0UP6b`Ppw#vXf0M=`-`%@eo#-eUKln_I#Rx(m05D+$y`jBb^$0$b%y?!4a6@3dqpZ zll3ltLux=}i$0l}NE}`pE@ykQ?B@%6`YD^^DrsUgTD)0#I1N*8l zz}ud58;@}InA4gk>Q*8gWkzl#yQV8iL~jQmj?#upjz?MuPo$x^bQ*O*{K%q}1Ae%F zMy)bl+-PF^X58*}@i_jmoG*6-y|6I-wA~n1rk#XamHY|LwSCXCC!AxCo?m;MTl<|? z`-+6mQ&469x9)x2YGAbOI-alGh?%4|e#Orl6INPKM~$Z? zI=E#s&NFhu$HSnVQmEgZ9xu_5?)H>_3(|H_5E+3<8y`P$JMWw?2Rt;c1Ro&$wSLuVYWVe z;5x1T(2X*l!n%14!}IFU)K^)$L6v{SaIP-DJA3uY8%^x%_*+#F)db4EmVpL;gRH|_ z3NU+!ULo9)Z3oP&1*-_pqGc+GXp-u`|M%*DzGIH(Wqaopx=fpPu^Mw!{@$6TVT`AGmB4xgvT!{O*W3T1V57c$vla1TTB1?s{#s6GOy zC#prT0P2d>`d3WU=?yC4Q%sPOszLP2?|#J$^8P|(x#-7%Mea|3WdBN2+RtTxF>qz- zICA0fw5<~dfd}IC5s)2bC&y)msnRcDTjuH1nPhCZ0?M=aEGbqy`Y|GZmhiYLEhAe* zy5c*?WNLqzyZ)ABzY8elJZ~00Zq^ZI9eGlFrxZUm@55JQLV6_Bc*(p6nhL$pUvD z4hVJ^xDS`Rj#^T8E2Fna>Up_=_qShF@kJCxQj}Wl_<(7^o|#tFL$XK~i^XCoDvLHu zi=@6xw_ly;^A~J1;j6dr;J5c* z1#eGPA@y@;+OQ6Sud=&3+$52eZtVI0)6eSV%ixFRkmq6j_~(D@lc21U;!RT?>L>}q zs>;$RY}2v`A~8^cq}ajF%O9=;+X_JZKE2Z5kF&o%B+;Qw6!f$R+P(TkT;}l0C9z&9 zyulAuSciFkP=tB%rx%Rs#h(Wy{6r6eFw4sOBo5j#XzQ?OQf!n7^omg7_f=Z7NxcoD zt_`uIeBd6wPR3`n^s!*acr-n=ugL6mu1X^u_E$5?iwnbqIosxEQx z1+Y?of%wbqaEdK7gFFVgMc7c)HC1ocsIEY3u{MrquVY2}cj`t(ep$K+VyI@+mUWsm z69(^T1j)x4RLe(@cVUgBogk_F;OloLnvc-VfaAlj>nf@91{k+#mNcSZPECV+;nmU)BkiRV>cQg%ibb={5V=9<{}C49PG3mAj5(H5)lR0{IQ%i%O<;^on3HNC zNn;OwNv43(kEqm6(~S;wc~a^B2pSW&4V&LU-VN^AlRpC)f9=OW-6375=)tN^@30)C z{EQu{A@f?Su@(k=bZ}8qU=xL!m>1CWCE)SJ53BJCDfA8Vnx69gRKmYqr zU&zWqR!o(~f78|t*alk^4nQ>%3}ON@e!2LzuSx2=Mcldz`Ti{X?#HH0@~F+G`Y-fn zhazoB{9Q*e?3f!`q9E2=DU#PoR-&;El1gDb(UX9G1T*i}ZOOnZP%QT`)`a00_M=Ko zKH`r+jtsdY9pT~?3itxX{}kMx(QQN1I4t7ezD`XBe|DbauyXzJllmTHl+W^j8G1s} zKtJRG!xpliAWdDEL7+*qKP{{Faq1EtX!urf1`}PlhXw{)`$*~$=R#koVuompa-JmT077DqC#Ao^h$;zFBRapxy6#Fty^fAB}MZV~Y!xPKWh$OFr z7xLL9@V&U0jT4vA?R=01xYvUk;kR?pz|>c9-b9lj1w9Q-2I{U+N0z7kZ*b&wlWPS| z0wBnfy9FhGf4Ke3YJ>I$)_Qhijd6o(iKek^qWd+OwUM^$gZ!Yi+D?6B-Vkb>AB9gi z=pCuduzsBb@9#hV*wvx=l1E<^d5=J(MY{}s`1)no*Rl_+S$7f5AB`@zYRRT^zaJ{5~TW03FRe* zp0-e$d}N5Of;9O0xVQy#M;#l!c_O_oq~P5hM@4KZ2*;kY8jNiw=P%dhq1I0~yN9!& z$_}7ny^SF+BUs1ueKvi<7|KF{!}+`F&J8tpnSP9p9pZH* zvEERs#hh;axYiC#d@VzJhn&WcL8Us{V+WEkrcA4gACfV|szcHrOC&dxjPfxe;ZsL{ zm4=}Ziq$yqlIpPx7P0qZ0W_h@hmKnHPq1x9tC?3lXj53l*RE2BYlqFB<3cfSy5oCwr{!9<380@tU%`Q(E_!XXiL8#(nd~5N@D9`RDmCmQGm7uKqhKD2(WdPAR z5?#oz&@+tcFQ;AIx((}H(h8b9Yu2DQcH9}QJ&YP0`{S#4WL@(IC=u1m=9L zhE9ZJ3JRYnc`mao_{Wbw2US_OGTx-(I)R~MW7IOi^ZmS&2MWkQldSouTH_4;3N~OE>8}*c{f$hUOSf_U#W|x zs<8PQX;Q45S{F6jaP~#az8mz4>L44^d-aRc1$CjcOWBO~VkccrKOR+L_XN(oa_8UT;ZnfBX?ePR!{ynHQngqHoEcqn8LNs z5Hk^wbFOol&;}Lc#{qhj$+^blnEiP*&;a>2n&L+r6Sk@0YFfXxm~B|7|R$46T8 zsG+ilMahgT=xA^dWS;7_b$IYHzEw-MLc33y9;Mz zp^5F|`H*D@#-kJZSTf>{2_Y|`%gB{*K43Hm8dlYTcQLI7g_rF^1rblc7V6WE>2xns!c(62u)V6am<`;xyc8P~zzy4!@AW1rdjcQVq55bFxN;mjiIKz?)ufPH@`JyaS0D!xEkQ>qTArUtZy%Y?BB{N*&ed&5gqOzfxNsUZ+sElC&501 zKf+*tlb`^CrpylL!3D1W=u_sS& zU;MtW(rdD7(3VMmq`*h6TpTTQU;JYP@81T0?wB}bA>xMhDa)8_a8D`2XBE+y$Z%Gc zj~n+PmaFuw>T;htO<3DhvtnLz3QN#R(zhg)16VCz>~G$7_N^d?4|CVxCu06NAR!mf(GnZUaz^M*9&v1 z5$Op$ZKT4%6vj8kNaab;}VL9 z)k}BLKI?Hg>8Dn1MwNDa7>-s+k4EhR{6tvaE9YEcRI`ur1v?Kf=o~`mVA_~}qem|K zRLwrgG7maG$I=m}hQ0GV!Io}kFwHDW3l>`VXm8)Pm1hxxB`Wj0%94jQjmdG|-sz^V z1dU97XS}mdQfC|`kDZLN<&LI0S9dIe+(NIAM_n+clep7yJ?(&3vnF$m7RFC9{fPN( z*3dSOmBt<#ynvPC@xKow%WU9()x1MNei+SfZR;*{Au;Jwbh)#QoRax{Mk?JQaXGd|+c5 zm-iNEp1oDv%`#IF5k5ayTEq#;%FS<6NAz55Bl(FbJBF?c*p0b09Z0RC#MXWjtFUXg@C_h@fZ}nEP+mET5fa(r{ujh0?7P*N`BkY4+XaRU_9cGhoK}VML}`}eLNt=5XZZ^ z3n6|o#a0HmVlj8!^q}M?M{sHoiF9luon!Gcb_Z$GSceC3zDF|Z1ubs1_m<3YpT>?k zNbb@K)N-*cM;su3zaNsOU6W0xUobV$^Y*NBm?dD$xLq)U*zI635c~Ld==D}!$fxo! z0Vx}f9<*v7k})p4RK)Aa+B3FBn?1C&ki})QxEbxH(SVO-P(+0cLn_%P8B9i(`Mp}j z$(_0fv3Q~sA`l!Nw%goXKuO&Wi>+n0NRopGO?F3XZd;dsj;dk$f2@_0A}hk{C5Y5G1YFjkr{Rp4Es-$IO z!}BhM;F6Xde&IaC>Nr@(bp<(OWn>beuv2;L>P|_npiEW9NV!!)n{m0~8A_zH;4Xzu zB|qwxU83$(DSYFogGT6Rphn5Ue4O53jl-=c&g2qS*e2GQvVb{>Xayf@PG`(h-5jR; zE0@53n=s#mn#iNnTa-lV)jdQxP3pulE_M>vSe>mx;2C#F7+d&nD_;rKRfK)-Xs40f zQ5z$@yQPAKh7aR#5{i-LK}rG~ue90ChZqXEp2xB237H*oUuaB&l#M=2{irAthmyR9 zj^JD6Wk))i^yvB&ZO9mCXWKTtkP6l*%$BePrt_d;eVZC7=+2>fpK5Lno0o#yd6v}DuEqmzIX6*@%sGb2p&IfynbZ2m8n_0LrD zHm#F;uoL3ZhQ6{275C$_-1i5$QMa8)*cgil&r}LLI<+P~xmdkalg|_{H6>-b%pM{R z(B-*b_q2=I=_?YK$;84Yjbw5;%it#7Orh44YTJeiF@RnP@hpkcV}h8JGMbY!6(fIS zd7>9{jvfw}ESs*hsLMYn?3x+b3RJd!s8HxI<@CaQgN!C8I>My7#uP`CRPUI}tgcLb zgI6vXXUm`%nJITFzY^Nb5ga3&-t*HP3tA8U49R@WlisgHK28l0?l4-_cwrp5+7ix- zFdn+wmsHMWU!|42#5S9Q$UDPBVk&qo#MU+7;qm5+fHf#$SlxdNz7DVFK$PZV0K21Ss9K<|smEGTwP7OWe!4a9@2+VK=WN7NidY6BpHC!uV4eH0- z4%09i()J2TjQYCK$Jf2*QZIjK+(`Nx7qy6HRH#k2rUqe)=pboecYn(gza_aTrfyhF ztVB%S@KGy6i$&d2UD}5EY;r%fYQ$8HKHtH_YRBWR+I~EjApouQyMoB)itDNcoiF>| z+iLx9^R)ii9oq?69ov5icaTiA9iekx@oN3EHk#(=%)GA0C6yf}MxIirF@$$gknH^I zt~0W_9-GZ|xh$?r1uYNNm&mTIsxgsen=)>LeZa%E59~*UQQh`T+jwrX$3)gVJGTo5xX&#OgsLzD)|!}X8RsuPdL0DJ+$^XtoA#k_7w@Ar!I@fC!z8f@09$` zV^|aP)~naSuiXo&)o5tj9XwyT5i?0`{9d0oCakoejv7z%b8xk0oM+@(kB1dIrBJ_% zJYJ$9-R&tCqV<1j45##ab=x8zS)0r4$=+?|e*fFMx8GiW7`*@O?eqKJKFj9{Es?8V zF4-Gh=uLAfidC|N5V+|Ne$Ko|o;N zH|R2L+Qn+jQTcmkmWD0LyD~fE$(!k-P+sEJK{q7iIxUwPRj0r!qcmO$uTcS)nMHl= zv3M6LB`h}yI%vMh;Xmi8EakOh96f1;QauOda`CTc-dK^y$xj04aQHku9u7z6Q7Egc zyO7BagL{7%k}psfzCra7Ks`|{f(1}ltk%C^qE2s65uaj$lvE9(Uw-ooW{~$6BFjZT z4lHti`Xl>Sn$mtQ1B`(yQ^%1DkEd;&I0!rtuaAK2FgrOeGfb6!3EMJHr_Ll}!xd1T z#b-&e+R={@v4qD}X&Kof(iPuKCR6*%-2F!>VW)ql;+Q8;SOVFsw~kg@X81+5m%WH( zl$gL@SeFUd#Z{UHe7t4@(`crh(nZF|dLo!4m@}0Pc&u{2Tvlm3$s`+rL#H9&HOt_= z;g>X)5g}i_n4Q~91swz~DS8Zm6`O5>2B23bsX)7VI6{;B(N3A?&-3T`^Za@KJb#`) W&z}(I&-3R*pZ^0s6Kh@o$N&KP+W @@ -33306,6 +33306,7 @@ index 0000000..ce9dd75 + +optional_policy(` + ganesha_systemctl(glusterd_t) ++ ganesha_dbus_chat(glusterd_t) +') + +optional_policy(` @@ -88942,7 +88943,7 @@ index c8bdea2..beb2872 100644 + allow $1 haproxy_unit_file_t:service {status start}; ') diff --git a/rhcs.te b/rhcs.te -index 6cf79c4..5279416 100644 +index 6cf79c4..5e106cf 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false) @@ -88981,7 +88982,7 @@ index 6cf79c4..5279416 100644 attribute cluster_domain; attribute cluster_log; attribute cluster_pid; -@@ -44,34 +73,288 @@ type foghorn_initrc_exec_t; +@@ -44,34 +73,291 @@ type foghorn_initrc_exec_t; init_script_file(foghorn_initrc_exec_t) rhcs_domain_template(gfs_controld) @@ -89180,6 +89181,9 @@ index 6cf79c4..5279416 100644 + fstools_domtrans(cluster_t) +') + ++optional_policy(` ++ ganesha_dbus_chat(cluster_t) ++') + +optional_policy(` + hostname_exec(cluster_t) @@ -89274,7 +89278,7 @@ index 6cf79c4..5279416 100644 ') ##################################### -@@ -79,13 +362,14 @@ optional_policy(` +@@ -79,13 +365,14 @@ optional_policy(` # dlm_controld local policy # @@ -89291,7 +89295,7 @@ index 6cf79c4..5279416 100644 kernel_rw_net_sysctls(dlm_controld_t) corecmd_exec_bin(dlm_controld_t) -@@ -98,16 +382,30 @@ fs_manage_configfs_dirs(dlm_controld_t) +@@ -98,16 +385,30 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) @@ -89325,7 +89329,7 @@ index 6cf79c4..5279416 100644 manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t) files_lock_filetrans(fenced_t, fenced_lock_t, file) -@@ -118,9 +416,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) +@@ -118,9 +419,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -89337,7 +89341,7 @@ index 6cf79c4..5279416 100644 corecmd_exec_bin(fenced_t) corecmd_exec_shell(fenced_t) -@@ -140,6 +437,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) +@@ -140,6 +440,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) corenet_sendrecv_zented_server_packets(fenced_t) corenet_tcp_bind_zented_port(fenced_t) @@ -89346,7 +89350,7 @@ index 6cf79c4..5279416 100644 corenet_tcp_sendrecv_zented_port(fenced_t) corenet_sendrecv_http_client_packets(fenced_t) -@@ -148,9 +447,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) +@@ -148,9 +450,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) @@ -89358,7 +89362,7 @@ index 6cf79c4..5279416 100644 storage_raw_read_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t) -@@ -160,7 +458,7 @@ term_getattr_pty_fs(fenced_t) +@@ -160,7 +461,7 @@ term_getattr_pty_fs(fenced_t) term_use_generic_ptys(fenced_t) term_use_ptmx(fenced_t) @@ -89367,7 +89371,7 @@ index 6cf79c4..5279416 100644 tunable_policy(`fenced_can_network_connect',` corenet_sendrecv_all_client_packets(fenced_t) -@@ -182,7 +480,8 @@ optional_policy(` +@@ -182,7 +483,8 @@ optional_policy(` ') optional_policy(` @@ -89377,7 +89381,7 @@ index 6cf79c4..5279416 100644 ') optional_policy(` -@@ -190,12 +489,17 @@ optional_policy(` +@@ -190,12 +492,17 @@ optional_policy(` ') optional_policy(` @@ -89396,7 +89400,7 @@ index 6cf79c4..5279416 100644 ') optional_policy(` -@@ -203,6 +507,21 @@ optional_policy(` +@@ -203,6 +510,21 @@ optional_policy(` snmp_manage_var_lib_dirs(fenced_t) ') @@ -89418,7 +89422,7 @@ index 6cf79c4..5279416 100644 ####################################### # # foghorn local policy -@@ -221,16 +540,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) +@@ -221,16 +543,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t) @@ -89443,7 +89447,7 @@ index 6cf79c4..5279416 100644 snmp_stream_connect(foghorn_t) ') -@@ -247,16 +572,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ +@@ -247,16 +575,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -89465,7 +89469,7 @@ index 6cf79c4..5279416 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +604,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +607,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -89525,7 +89529,7 @@ index 6cf79c4..5279416 100644 ###################################### # # qdiskd local policy -@@ -292,7 +668,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) +@@ -292,7 +671,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file }) @@ -89533,7 +89537,7 @@ index 6cf79c4..5279416 100644 kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -@@ -321,6 +696,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +699,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 2d9d0d17..f7fedd95 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 261%{?dist} +Release: 262%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -690,6 +690,10 @@ exit 0 %endif %changelog +* Mon Jul 10 2017 Lukas Vrabec - 3.13.1-262 +- Allow cluster_t and glusterd_t domains to dbus chat with ganesha service +- Allow iptables to read container runtime files + * Fri Jun 23 2017 Lukas Vrabec - 3.13.1-261 - Allow boinc_t nsswitch - Dontaudit firewalld to write to lib_t dirs