Hide Forgot
Description of problem: Include bits to support sanlock and wdmd; used by libvirt and vdsm. (The policy for them isn't finalized yet.) Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
This is not a "bug" per se. sanlock is a new package we intend to add to 6.2, and this is a request to include the relevant selinux policy for it.
Ok, then it should be moved to 6.2.
Created attachment 499641 [details] sanlock and wdmd files The attached tarball includes the following files which Dan Walsh originally created for me. Please include the relevant ones in the policy package. (I'm not sure which of them you need). I expect we'll need to submit updates to these as we do more sanlock testing with libvirt and vdsm. sanlock.fc sanlock.if sanlock.pp sanlock.sh* sanlock.te wdmd.fc wdmd.if wdmd.pp wdmd.sh* wdmd.te
I added those to Rawhide.
I am backporting to RHEL6.2.
Fixed in selinux-policy-3.7.19-101.el6
sanlock does use standard random functions, random(), random_r(), initstate_r(). It does not access /dev/urandom or /proc/stat directly.
In the next set of patches I'm changing the pid and socket files to: /var/run/wdmd.pid /var/run/wdmd.sock /var/run/sanlock.pid /var/run/sanlock.sock (I'm not sure if this will impact the selinux policies, noting here just in case.)
If you are going to change the location, how about moving them to their own directory. /var/run/sanlock/ and /var/run/wdmd/
They were in those dirs, but in bug 711534 you suggested /var/lock/ instead, and I'm not sure who's supposed to create those dirs and when anyhow... I'm sure I'd get that wrong, too. So, I'm trying to come up with the simplest thing that will just make all these issues go away.
/var/lock was suggested for lock files. /var/run/sanlock /var/run/wdmd directories should be for sanclok, wdmd sock and pid files. So we would like to see /var/run/sanlock/sanlock.pid /var/run/sanlock/sanlock.sock /var/run/wdmd/wdmd.pid /var/run/wdmd/wdmd.sock
OK, I can put them back there (although the pid file is the lock file.) This does leave the question from bug 711534 about who creates those dirs and when (if the binary creates them, they don't exist for the init script initially). How about this: init.d/wdmd will mkdir -p /var/run/wdmd init.d/sanlock will mkdir -p /var/run/sanlock /usr/sbin/wdmd will mkdir("/var/run/wdmd") /usr/sbin/sanlock will mkdir("/var/run/sanlock") Will that satisfy everyone?
How about if [! -d /var/run/wdmd ];then mkdir -p /var/run/wdmd [ -x /usr/sbin/restorecon ] && restorecon /var/run/wdmd fi ...
done, thanks
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html