This is not a "bug" per se.  sanlock is a new package we intend to add to 6.2, and this is a request to include the relevant selinux policy for it.

Ok, then it should be moved to 6.2.

Created attachment 499641 [details]
sanlock and wdmd files

The attached tarball includes the following files which Dan Walsh originally created for me.  Please include the relevant ones in the policy package. (I'm not sure which of them you need).  I expect we'll need to submit updates to these as we do more sanlock testing with libvirt and vdsm.

sanlock.fc
sanlock.if
sanlock.pp
sanlock.sh*
sanlock.te
wdmd.fc
wdmd.if
wdmd.pp
wdmd.sh*
wdmd.te

I added those to Rawhide.

I am backporting to RHEL6.2.

Fixed in selinux-policy-3.7.19-101.el6

sanlock does use standard random functions, random(), random_r(), initstate_r().
It does not access /dev/urandom or /proc/stat directly.

In the next set of patches I'm changing the pid and socket files to:
/var/run/wdmd.pid
/var/run/wdmd.sock
/var/run/sanlock.pid
/var/run/sanlock.sock

(I'm not sure if this will impact the selinux policies, noting here just in case.)

If you are going to change the location, how about moving them to their own directory.

/var/run/sanlock/
and 

/var/run/wdmd/

They were in those dirs, but in bug 711534 you suggested /var/lock/ instead, and I'm not sure who's supposed to create those dirs and when anyhow... I'm sure I'd get that wrong, too.  So, I'm trying to come up with the simplest thing that will just make all these issues go away.

/var/lock was suggested for lock files.


/var/run/sanlock
/var/run/wdmd 

directories should be for sanclok, wdmd sock and pid files. So we would like to see

/var/run/sanlock/sanlock.pid
/var/run/sanlock/sanlock.sock

/var/run/wdmd/wdmd.pid
/var/run/wdmd/wdmd.sock

OK, I can put them back there (although the pid file is the lock file.)  This does leave the question from bug 711534 about who creates those dirs and when
(if the binary creates them, they don't exist for the init script initially).  How about this:

init.d/wdmd will mkdir -p /var/run/wdmd
init.d/sanlock will mkdir -p /var/run/sanlock

/usr/sbin/wdmd will mkdir("/var/run/wdmd")
/usr/sbin/sanlock will mkdir("/var/run/sanlock")

Will that satisfy everyone?

How about

if [! -d /var/run/wdmd ];then 
          mkdir -p /var/run/wdmd
          [ -x /usr/sbin/restorecon ] && restorecon /var/run/wdmd
fi

...

done, thanks

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html