Changeset: 7bf9aee9e5b4 for MonetDB
URL: https://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=7bf9aee9e5b4
Modified Files:
buildtools/selinux/monetdb.te
Branch: Apr2019
Log Message:
Allow monetdbd to do a few more things (like killing mserver5).
diffs (36 lines):
diff --git a/buildtools/selinux/monetdb.te b/buildtools/selinux/monetdb.te
--- a/buildtools/selinux/monetdb.te
+++ b/buildtools/selinux/monetdb.te
@@ -1,4 +1,4 @@
-policy_module(monetdb, 0.4)
+policy_module(monetdb, 0.5)
# The above line declares that this file is a SELinux policy file. Its
# name is monetdb, so the file should be saved as monetdb.te
@@ -13,7 +13,7 @@ require {
class fifo_file { getattr read write };
class file { entrypoint execute getattr manage_file_perms map open read
};
class netlink_selinux_socket create_socket_perms;
- class process { rlimitinh siginh signal transition };
+ class process { rlimitinh siginh signal sigterm sigkill transition };
class tcp_socket create_stream_socket_perms;
class udp_socket create_stream_socket_perms;
class unix_dgram_socket create_socket_perms;
@@ -39,6 +39,9 @@ allow monetdbd_t mserver5_exec_t:file {
allow mserver5_t mserver5_exec_t:file { entrypoint read execute };
type_transition monetdbd_t mserver5_exec_t:process mserver5_t;
+# monetdbd must be allowed to kill the server it started
+allow monetdbd_t mserver5_t:process { sigterm sigkill };
+
# declare a type for the systemd unit file (monetdbd.service)
type monetdbd_unit_file_t;
systemd_unit_file(monetdbd_unit_file_t)
@@ -120,6 +123,7 @@ manage_sock_files_pattern(mserver5_t, ms
allow mserver5_t monetdbd_t:fifo_file { read write getattr };
allow mserver5_t monetdbd_t:unix_stream_socket { read write getopt shutdown };
allow mserver5_t var_t:dir { read };
+allow monetdbd_t var_t:dir { read };
gen_tunable(mserver5_can_read_home, false)
tunable_policy(`mserver5_can_read_home', `
userdom_search_user_home_dirs(mserver5_t)
_______________________________________________
checkin-list mailing list
[email protected]
https://www.monetdb.org/mailman/listinfo/checkin-list
