rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Jul 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-263

Browse Source 
- Add new boolean gluster_use_execmem
This commit is contained in:
Lukas Vrabec 2017-07-11 18:01:45 +02:00
parent 37cf7d764b
commit ab9bb05673
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

15
policy-rawhide-contrib.patch
View File

@ -33050,10 +33050,10 @@ index 0000000..4501460
+ +
diff --git a/glusterd.te b/glusterd.te diff --git a/glusterd.te b/glusterd.te
new file mode 100644 new file mode 100644
index 0000000..d474c09 index 0000000..cbcaf9a
--- /dev/null --- /dev/null
+++ b/glusterd.te +++ b/glusterd.te
@@ -0,0 +1,313 @@ @@ -0,0 +1,324 @@
+policy_module(glusterd, 1.1.3) +policy_module(glusterd, 1.1.3)
+ +
+## <desc> +## <desc>
@ -33079,6 +33079,13 @@ index 0000000..d474c09
+## </desc> +## </desc>
+gen_tunable(gluster_export_all_rw, true) +gen_tunable(gluster_export_all_rw, true)
+ +
+## <desc>
+## <p>
+## Allow glusterd_t domain to use executable memory
+## </p>
+## </desc>
+gen_tunable(gluster_use_execmem, false)
+
+######################################## +########################################
+# +#
+# Declarations +# Declarations
@ -33289,6 +33296,10 @@ index 0000000..d474c09
+ files_getattr_all_sockets(glusterd_t) + files_getattr_all_sockets(glusterd_t)
+') +')
+ +
+tunable_policy(`gluster_use_execmem',`
+ allow glusterd_t self:process { execmem };
+')
+
+optional_policy(` +optional_policy(`
+ ctdbd_domtrans(glusterd_t) + ctdbd_domtrans(glusterd_t)
+ ctdbd_signal(glusterd_t) + ctdbd_signal(glusterd_t)

5
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 262%{?dist} Release: 263%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -690,6 +690,9 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Jul 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-263
- Add new boolean gluster_use_execmem
* Mon Jul 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-262 * Mon Jul 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-262
- Allow cluster_t and glusterd_t domains to dbus chat with ganesha service - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
- Allow iptables to read container runtime files - Allow iptables to read container runtime files