Bug 1012526

Summary:	Allow 389-ds-base to create subdir of /dev/shm
Product:	Red Hat Enterprise Linux 6	Reporter:	Rich Megginson <rmeggins>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED CURRENTRELEASE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.5	CC:	dwalsh, ksrot, mmalik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1012528 (view as bug list)		Environment:
Last Closed:	2013-10-30 09:43:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1012528

Description Rich Megginson 2013-09-26 15:13:11 UTC

Description of problem:

The 389-ds-base (dirsrv) needs to create and use a subdirectory of /dev/shm e.g. /dev/shm/slapd-hostname

We are able to workaround the problem by creating a policy module like this:

policy_module(dirsrv_tmpfs,1.0.0)
type dirsrv_t;
type tmpfs_t;
allow dirsrv_t tmpfs_t:dir create;

semanage -i dirsrv_tmpfs.pp

but it would be better if this were part of the base OS policy

Version-Release number of selected component (if applicable):
RHEL 6.4/6.5

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Miroslav Grepl 2013-09-26 15:18:19 UTC

We need to add additional rules for dirsrv_tmpfs_t.

Comment 2 Miroslav Grepl 2013-09-26 15:19:05 UTC

Added to Fedora.

commit 585bdff20eebd268561d577650642a89bc16f150
Author: Miroslav Grepl <mgrepl>
Date:   Thu Sep 26 17:18:13 2013 +0200

    Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label

Comment 3 Milos Malik 2013-09-27 07:17:45 UTC

Hi Rich, are you willing to test the scenario once the new selinux-policy packages become available?

Comment 4 Rich Megginson 2013-09-27 13:28:18 UTC

(In reply to Milos Malik from comment #3)
> Hi Rich, are you willing to test the scenario once the new selinux-policy
> packages become available?

Yes.

Comment 6 Miroslav Grepl 2013-10-30 09:43:29 UTC

More fixes have been added during RHEL6.5 cycle related to dirsrv and this bug should be fixed. If no, please re-open the bug and it will be addressed in RHEL6.6.