Bug 486624

Summary:	Add /var/lib/rt3/data/RT-Shredder directory to RPM
Product:	[Fedora] Fedora	Reporter:	Ralf Corsepius <rc040203>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	10	CC:	dwalsh, jkubin, mgrepl, mmahut, rc040203, xavier
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	485513	Environment:
Last Closed:	2009-11-18 11:28:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	485513
Bug Blocks:

Description Ralf Corsepius 2009-02-20 18:17:14 UTC

Could somebody of you please look into the selinux issues mentioned in this PR?

There isn't much I can do about it from inside of the rt3 package. TIA.


+++ This bug was initially created as a clone of Bug #485513 +++

Description of problem:

RT 3.8 now has included within it the RT-Shredder extension. In order to operate it needs the following directory:

/var/lib/rt3/data/RT-Shredder (owner = apache, context = httpd_sys_script_rw_t)

Instead of httpd_sys_script_rw_t maybe you create a new type for RT files under /var/lib/rt3. Say for instance "httpd_rt_script_rw_t".

Then have this policy:

   allow httpd_t httpd_rt_script_rw_t : file { ioctl read write create getattr setattr lock append unlink link rename };

Comment 1 Daniel Walsh 2009-02-23 16:47:00 UTC

Miroslav just add httpd_var_lib_t to this directory.  

httpd_var_lib_t is managable by httpd_t but not by scripts running as httpd_sys_script_t

Writing a separate domain would not add security.

Comment 2 Miroslav Grepl 2009-02-27 09:50:37 UTC

Fixed in selinux-policy-3.5.13-47.fc10

Comment 3 Bug Zapper 2009-11-18 11:10:37 UTC

This message is a reminder that Fedora 10 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 10.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '10'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 10's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 10 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping