Bug 592950
Summary: | Munin scripts in /etc/munin/plugins need individual contexts | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Matt <smoothsailing72> |
Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | low | ||
Version: | 12 | CC: | dwalsh, mgrepl |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2010-06-23 08:09:24 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Matt
2010-05-17 13:02:18 UTC
One possible solution would be # semanage fcontext -a -e /usr/share/munin/plugins /etc/munin/plugins I tried the command, and while the files (scripts) are now good, the links in /etc/munin/plugins are changing to usr_t. I've seen the -e option before, but I can't say I've used it. My guess is it's a layering issue where the /usr/share/munin/plugins contexts get priority over the /etc/munin one (munin_etc_t)? (In reply to comment #0) > Description of problem: > In a default install of munin, it executes scripts located in > /etc/munin/plugins. These are links that point to /usr/share/munin/plugins. In > the current policy these files are labeled as: > > /etc/munin/plugins -> munin_etc_t > /usr/share/munin/plugins -> various (munin_exec_t, munin_system_plugin_t, etc) Matt, yes, we have labeling for default munin plugins located in /usr/share/munin/plugins. We use these labels: munin_disk_plugin_exec_t munin_mail_plugin_exec_t munin_services_plugin_exec_t munin_system_pluing_exec_t Then the policy has a transiton rule like the following: munin_t -> munin_system_pluing_exec_t -> munin_system_plugin_t So if there is a plugin labeled munin_exec_t in /usr/share/munin/plugins and this plugin is default then the plugin needs labeling (I am working on it). And the problem is if you add your custom plugin, you still need to set the selected label for your plugin. Also the default location of plugins is /usr/share/munin/plugins. # rpm -ql munin-node So I still think we should stay with labeling only for /usr/share/munin/plugins. |