Bug 988353 - Need policy for OpenLMI-Networking
Need policy for OpenLMI-Networking
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.0
All Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On: 909886 988330
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-25 07:41 EDT by Radek Novacek
Modified: 2016-11-30 19:31 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 988330
Environment:
Last Closed: 2014-06-13 07:26:58 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Radek Novacek 2013-07-25 07:41:08 EDT
+++ This bug was initially created as a clone of Bug #988330 +++

OpenLMI-Networking provider needs a policy. This is similar request as bz979037 and bz983422 and bz987951.

Network provider manages network devices using NetworkManager via D-Bus.

Audit messages are attached.

Result of `ausearch -m avc -ts 12:16 | audit2allow`, with my comments:

#============= NetworkManager_t ==============
allow NetworkManager_t dhcpc_t:process { siginh noatsecure rlimitinh };
# ^^^ this doesn't seems to be related

#============= firewalld_t ==============
allow firewalld_t iptables_t:process { siginh noatsecure rlimitinh };
# ^^^ this doesn't seems to be related

#============= pegasus_openlmi_networking_t ==============
allow pegasus_openlmi_networking_t passwd_file_t:file { read getattr open };
allow pegasus_openlmi_networking_t pegasus_data_t:dir write;
allow pegasus_openlmi_networking_t proc_net_t:file { read getattr open };
allow pegasus_openlmi_networking_t self:capability { setuid net_admin setgid };
allow pegasus_openlmi_networking_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
allow pegasus_openlmi_networking_t self:udp_socket { create connect getattr };
allow pegasus_openlmi_networking_t sysfs_t:file { read write getattr open };
allow pegasus_openlmi_networking_t sysfs_t:lnk_file read;
allow pegasus_openlmi_networking_t system_dbusd_t:unix_stream_socket connectto;
allow pegasus_openlmi_networking_t system_dbusd_var_run_t:dir search;
allow pegasus_openlmi_networking_t system_dbusd_var_run_t:sock_file write;

#!!!! This avc can be allowed using the boolean 'global_ssp'
allow pegasus_openlmi_networking_t urandom_device_t:chr_file { read open };

#============= pegasus_t ==============
allow pegasus_t chkpwd_t:process { siginh noatsecure rlimitinh };
allow pegasus_t pegasus_openlmi_networking_t:process { siginh noatsecure rlimitinh };


Please check if the permission is reasonable for networking-handling provider. 
What the provider does:
* D-Bus communication with NetworkManager
* reading /proc/net/dev
* reading /sys/class/net/*/flags
* generating UUIDs with libuuid
* communication with pegasus (same for all providers)
Comment 2 Miroslav Grepl 2013-07-26 04:36:58 EDT
Added to Fedora.
Comment 5 Ludek Smid 2014-06-13 07:26:58 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.