Bug 913738 - changes to iscsi-initiator-utils in rawhide require selinux-policy update
Summary: changes to iscsi-initiator-utils in rawhide require selinux-policy update
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-21 22:44 UTC by Chris Leech
Modified: 2013-02-22 10:07 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-22 10:07:15 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
iscsid policy patch (3.26 KB, patch)
2013-02-21 22:44 UTC, Chris Leech
no flags Details | Diff

Description Chris Leech 2013-02-21 22:44:40 UTC
Created attachment 700895 [details]
iscsid policy patch

Description of problem:

iscsi-initiator-utils in rawhide needs policy changes for kernel module loading and conversion from sysv init to systemd.  Startup now assumes that iscsid can load needed kernel modules on demand, instead of loading all iscsi related modules from the init script.

I'm attaching a patch that's working for me, but I'm pretty sure the initrc -> systemd stuff might not be completely right.  Also, the old brcm_iscsiuio binary is gone and with it any access to /dev/mem so I think we can drop that.

Version-Release number of selected component (if applicable):
3.12.1-14

How reproducible:
always

Comment 1 Chris Leech 2013-02-22 06:04:24 UTC
Two more things:

#904042 seems to be related to iscsid needing access to /dev/urandom when using CHAP.

I switched the rawhide build of iscsid to use libkmod instead of modprobe, so there is no more use of execv.  I thought that might be covered by can_exec, but I'm not sure.

Comment 2 Daniel Walsh 2013-02-22 10:07:15 UTC
I applied your patch to Rawhide and added 
dev_read_urand(iscsid_t)

as well as fixed up the _admin interface.


Note You need to log in before you can comment on or make changes to this bug.