| Summary: | include sanlock | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | David Teigland <teigland> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.1 | CC: | dwalsh, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-106.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-12-06 09:46:11 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
|
Description
David Teigland
2011-03-29 15:05:17 UTC
This is not a "bug" per se. sanlock is a new package we intend to add to 6.2, and this is a request to include the relevant selinux policy for it. Ok, then it should be moved to 6.2. Created attachment 499641 [details]
sanlock and wdmd files
The attached tarball includes the following files which Dan Walsh originally created for me. Please include the relevant ones in the policy package. (I'm not sure which of them you need). I expect we'll need to submit updates to these as we do more sanlock testing with libvirt and vdsm.
sanlock.fc
sanlock.if
sanlock.pp
sanlock.sh*
sanlock.te
wdmd.fc
wdmd.if
wdmd.pp
wdmd.sh*
wdmd.te
I added those to Rawhide. I am backporting to RHEL6.2. Fixed in selinux-policy-3.7.19-101.el6 sanlock does use standard random functions, random(), random_r(), initstate_r(). It does not access /dev/urandom or /proc/stat directly. In the next set of patches I'm changing the pid and socket files to: /var/run/wdmd.pid /var/run/wdmd.sock /var/run/sanlock.pid /var/run/sanlock.sock (I'm not sure if this will impact the selinux policies, noting here just in case.) If you are going to change the location, how about moving them to their own directory. /var/run/sanlock/ and /var/run/wdmd/ They were in those dirs, but in bug 711534 you suggested /var/lock/ instead, and I'm not sure who's supposed to create those dirs and when anyhow... I'm sure I'd get that wrong, too. So, I'm trying to come up with the simplest thing that will just make all these issues go away. /var/lock was suggested for lock files. /var/run/sanlock /var/run/wdmd directories should be for sanclok, wdmd sock and pid files. So we would like to see /var/run/sanlock/sanlock.pid /var/run/sanlock/sanlock.sock /var/run/wdmd/wdmd.pid /var/run/wdmd/wdmd.sock OK, I can put them back there (although the pid file is the lock file.) This does leave the question from bug 711534 about who creates those dirs and when (if the binary creates them, they don't exist for the init script initially). How about this: init.d/wdmd will mkdir -p /var/run/wdmd init.d/sanlock will mkdir -p /var/run/sanlock /usr/sbin/wdmd will mkdir("/var/run/wdmd") /usr/sbin/sanlock will mkdir("/var/run/sanlock") Will that satisfy everyone? How about
if [! -d /var/run/wdmd ];then
mkdir -p /var/run/wdmd
[ -x /usr/sbin/restorecon ] && restorecon /var/run/wdmd
fi
...
done, thanks Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |