Bug 754646

Description of problem:
Sanlock should be allowed search access on the  directory by default.

Version-Release number of selected component (if applicable):
sanlock-1.8-2.el6
selinux-policy-3.7.19-126.el6
libvirt-lock-sanlock-0.9.4-23.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. following this link:
http://fedoraproject.org/wiki/Features/VirtLockManager  (see 'Dual host testing' section)

2. and enable the following selinux booleans:
virt_use_nfs --> on
virt_use_sanlock --> on

  
Actual results:
"AVC" error in /var/log/audit/audit.log.

Expected results:
allow sanlock search access.

Additional Information:
Source Context                unconfined_u:system_r:sanlock_t:s0-s0:c0.c1023
Target Context                system_u:object_r:nfs_t:s0
Target Objects                 [ dir ]
Source                        sanlock
Source Path                   /usr/sbin/sanlock
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           sanlock-1.8-2.el6
Target RPM Packages
Policy RPM                    selinux-policy-3.7.19-126.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 2.6.32-220.el6.x86_64
                              #1 SMP Wed Nov 9 08:03:13 EST 2011 x86_64 x86_64
Alert Count                   6
First Seen                    Thu 17 Nov 2011 03:16:29 PM CST
Last Seen                     Thu 17 Nov 2011 03:39:34 PM CST
Local ID                      6573384f-1045-476a-9bb6-d024af5182f6

Raw Audit Messages
type=AVC msg=audit(1321515574.664:90425): avc:  denied  { search } for  pid=22546 comm="sanlock" name="" dev=0:1e ino=1703968 scontext=unconfined_u:system_r:sanlock_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir


type=AVC msg=audit(1321515574.664:90425): avc:  denied  { open } for  pid=22546 comm="sanlock" name="acd114944f033ea5cbcb8956d389469e" dev=0:1e ino=1705403 scontext=unconfined_u:system_r:sanlock_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=file


type=SYSCALL msg=audit(1321515574.664:90425): arch=x86_64 syscall=open success=yes exit=ENOEXEC a0=7fc0ec000af8 a1=105002 a2=0 a3=0 items=0 ppid=1 pid=22546 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=168 comm=sanlock exe=/usr/sbin/sanlock subj=unconfined_u:system_r:sanlock_t:s0-s0:c0.c1023 key=(null)

Hash: sanlock,sanlock_t,nfs_t,dir,search

audit2allow

#============= sanlock_t ==============
#!!!! This avc is allowed in the current policy

allow sanlock_t nfs_t:dir search;
#!!!! This avc is allowed in the current policy

allow sanlock_t nfs_t:file open;

audit2allow -R

#============= sanlock_t ==============
#!!!! This avc is allowed in the current policy

allow sanlock_t nfs_t:dir search;
#!!!! This avc is allowed in the current policy

allow sanlock_t nfs_t:file open;