Changeset: 6b83b51c2f30 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=6b83b51c2f30
Modified Files:
MonetDB.spec
buildtools/selinux/monetdb.te
Branch: Aug2018
Log Message:
Add a tunable parameter, mserver5_can_read_home, to allow reading home dirs.
This is the second part of the fix for bug 6680.
diffs (42 lines):
diff --git a/MonetDB.spec b/MonetDB.spec
--- a/MonetDB.spec
+++ b/MonetDB.spec
@@ -856,7 +856,10 @@ automatic index management, extensibilit
accelerators. It also has an SQL frontend.
This package contains the SELinux policy for running MonetDB under
-control of systemd.
+control of systemd. There is one tunable parameter, mserver5_can_read_home,
+which can be set using "setsebool -P mserver5_can_read_home=true" to allow
+an mserver5 process started by monetdbd under the control of systemd to
+read files in users' home directories.
%post selinux
for selinuxvariant in %{selinux_variants}
diff --git a/buildtools/selinux/monetdb.te b/buildtools/selinux/monetdb.te
--- a/buildtools/selinux/monetdb.te
+++ b/buildtools/selinux/monetdb.te
@@ -1,4 +1,4 @@
-policy_module(monetdb, 0.3)
+policy_module(monetdb, 0.4)
# The above line declares that this file is a SELinux policy file. Its
# name is monetdb, so the file should be saved as monetdb.te
@@ -7,6 +7,7 @@ require {
type proc_net_t;
type tmp_t;
type var_t;
+ type user_home_t;
class dir { read };
class fd { use };
class fifo_file { getattr read write };
@@ -119,4 +120,9 @@ manage_sock_files_pattern(mserver5_t, ms
allow mserver5_t monetdbd_t:fifo_file { read write getattr };
allow mserver5_t monetdbd_t:unix_stream_socket { read write getopt shutdown };
allow mserver5_t var_t:dir { read };
+gen_tunable(mserver5_can_read_home, false)
+tunable_policy(`mserver5_can_read_home', `
+ userdom_search_user_home_dirs(mserver5_t)
+ allow mserver5_t user_home_t:file read_file_perms;
+')
allow monetdbd_t mserver5_t:unix_stream_socket { connectto };
_______________________________________________
checkin-list mailing list
[email protected]
https://www.monetdb.org/mailman/listinfo/checkin-list
