Attachment 700895 Details for Bug 913738 – iscsid policy patch

[patch] iscsid policy patch

iscsid-policy-updates-test.patch (text/plain), 3.26 KB, created by Chris Leech on 2013-02-21 22:44:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Leech

Created: 2013-02-21 22:44:40 UTC

Size: 3.26 KB

patch

obsolete

>From 7395a8f6c0f8c8ac7a22beb7bb65bcf92d1f1564 Mon Sep 17 00:00:00 2001
>From: Chris Leech <cleech@redhat.com>
>Date: Thu, 21 Feb 2013 12:06:20 -0800
>Subject: [PATCH] iscsid policy updates test
>
>---
> iscsi.fc | 8 +++-----
> iscsi.if | 6 +++---
> iscsi.te | 7 +++----
> 3 files changed, 9 insertions(+), 12 deletions(-)
>
>diff --git a/iscsi.fc b/iscsi.fc
>index 08b7560..9d1930b 100644
>--- a/iscsi.fc
>+++ b/iscsi.fc
>@@ -1,19 +1,17 @@
>-/etc/rc\.d/init\.d/((iscsi)|(iscsid))	--	gen_context(system_u:object_r:iscsi_initrc_exec_t,s0)
>-
> /sbin/iscsid	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
>-/sbin/brcm_iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
> /sbin/iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
> 
> /usr/sbin/iscsid	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
>-/usr/sbin/brcm_iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
> /usr/sbin/iscsiuio	--	gen_context(system_u:object_r:iscsid_exec_t,s0)
> 
> /var/lib/iscsi(/.*)?	gen_context(system_u:object_r:iscsi_var_lib_t,s0)
> 
> /var/lock/iscsi(/.*)?	gen_context(system_u:object_r:iscsi_lock_t,s0)
> 
>-/var/log/brcm-iscsi\.log.*	--	gen_context(system_u:object_r:iscsi_log_t,s0)
> /var/log/iscsiuio\.log.*	--	gen_context(system_u:object_r:iscsi_log_t,s0)
> 
> /var/run/iscsid\.pid	--	gen_context(system_u:object_r:iscsi_var_run_t,s0)
> /var/run/iscsiuio\.pid	--	gen_context(system_u:object_r:iscsi_var_run_t,s0)
>+
>+/usr/lib/systemd/system/((iscsi)|(iscsid)|(iscsiuio))\.service	--	gen_context(system_u:object_r:iscsi_unit_file_t,s0)
>+/usr/lib/systemd/system/((iscsid)|(iscsiuio))\.socket	--	gen_context(system_u:object_r:iscsi_unit_file_t,s0)
>diff --git a/iscsi.if b/iscsi.if
>index 1a35420..5531d7d 100644
>--- a/iscsi.if
>+++ b/iscsi.if
>@@ -99,15 +99,15 @@ interface(`iscsi_admin',`
> 	gen_require(`
> 		type iscsid_t, iscsi_lock_t, iscsi_log_t;
> 		type iscsi_var_lib_t, iscsi_var_run_t, iscsi_tmp_t;
>-		type iscsi_initrc_exec_t;
>+		type iscsi_unit_file_t;
> 	')
> 
> 	allow $1 iscsid_t:process { ptrace signal_perms };
> 	ps_process_pattern($1, iscsid_t)
> 
>-	init_labeled_script_domtrans($1, iscsi_initrc_exec_t)
>+	init_labeled_script_domtrans($1, iscsi_unit_file_t)
> 	domain_system_change_exemption($1)
>-	role_transition $2 iscsi_initrc_exec_t system_r;
>+	role_transition $2 iscsi_unit_file_t system_r;
> 	allow $2 system_r;
> 
> 	logging_search_logs($1)
>diff --git a/iscsi.te b/iscsi.te
>index 3dba77f..74153ec 100644
>--- a/iscsi.te
>+++ b/iscsi.te
>@@ -9,8 +9,8 @@ type iscsid_t;
> type iscsid_exec_t;
> init_daemon_domain(iscsid_t, iscsid_exec_t)
> 
>-type iscsi_initrc_exec_t;
>-init_script_file(iscsi_initrc_exec_t)
>+type iscsi_unit_file_t;
>+systemd_unit_file(iscsi_unit_file_t)
> 
> type iscsi_lock_t;
> files_lock_file(iscsi_lock_t)
>@@ -63,6 +63,7 @@ files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
> 
> can_exec(iscsid_t, iscsid_exec_t)
> 
>+kernel_request_load_module(iscsid_t)
> kernel_read_network_state(iscsid_t)
> kernel_read_system_state(iscsid_t)
> kernel_setsched(iscsid_t)
>@@ -87,10 +88,8 @@ corenet_sendrecv_winshadow_client_packets(iscsid_t)
> corenet_tcp_connect_winshadow_port(iscsid_t)
> corenet_tcp_sendrecv_winshadow_port(iscsid_t)
> 
>-dev_read_raw_memory(iscsid_t)
> dev_rw_sysfs(iscsid_t)
> dev_rw_userio_dev(iscsid_t)
>-dev_write_raw_memory(iscsid_t)
> 
> domain_use_interactive_fds(iscsid_t)
> domain_dontaudit_read_all_domains_state(iscsid_t)
>-- 
>1.7.11.7
>

Actions: View | Diff

Attachments on bug 913738: 700895