Hello Douglas Schilling Landgraf,
I'd like you to do a code review. Please visit
https://gerrit.ovirt.org/48372
to review the following change.
Change subject: semodule: Add rule ro AVC sshd_keygen_t plymouth_exec_t
......................................................................
semodule: Add rule ro AVC sshd_keygen_t plymouth_exec_t
This patch should resolve the below AVC:
type=AVC msg=audit(1446675487.133:116): avc: denied { execute } for pid=3511
comm="sshd-keygen" name="plymouth" dev="dm-0" ino=8199
scontext=system_u:system_r:sshd_keygen_t:s0
tcontext=system_u:object_r:plymouth_exec_t:s0 tclass=file
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1248372
Change-Id: I3c5e4576953283ecdb8a3f520cf248ffddeba1c8
Signed-off-by: Douglas Schilling Landgraf <[email protected]>
---
M semodule/ovirt.te.in
1 file changed, 2 insertions(+), 0 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/ovirt-node refs/changes/72/48372/1
diff --git a/semodule/ovirt.te.in b/semodule/ovirt.te.in
index c56fb54..7aca437 100644
--- a/semodule/ovirt.te.in
+++ b/semodule/ovirt.te.in
@@ -557,10 +557,12 @@
type ssh_keygen_t;
type sshd_keygen_t;
type tmpfs_t;
+ type plymouth_exec_t;
}
allow sshd_keygen_t tmpfs_t:dir { search };
allow sshd_keygen_t setfiles_t:process { siginh rlimitinh noatsecure };
allow sshd_keygen_t ssh_keygen_t:process { siginh rlimitinh noatsecure };
+ allow sshd_keygen_t plymouth_exec_t:file execute;
')
--
To view, visit https://gerrit.ovirt.org/48372
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3c5e4576953283ecdb8a3f520cf248ffddeba1c8
Gerrit-PatchSet: 1
Gerrit-Project: ovirt-node
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Fabian Deutsch <[email protected]>
Gerrit-Reviewer: Douglas Schilling Landgraf <[email protected]>
Gerrit-Reviewer: Fabian Deutsch <[email protected]>
_______________________________________________
node-patches mailing list
[email protected]
http://lists.ovirt.org/mailman/listinfo/node-patches
