Bug 989473 - Need policy for OpenLMI-PowerManagement
Need policy for OpenLMI-PowerManagement
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.0
All Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On: 989472
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-29 06:38 EDT by Radek Novacek
Modified: 2016-11-30 19:31 EST (History)
5 users (show)

See Also:
Fixed In Version: selinux-policy-3.12.1-68.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 989472
Environment:
Last Closed: 2014-06-13 05:46:35 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Radek Novacek 2013-07-29 06:38:27 EDT
+++ This bug was initially created as a clone of Bug #989472 +++

OpenLMI-PowerManagement provider needs a policy. This is similar request as bz979037 and bz983422 and bz987951.

PowerManagement provider uses D-Bus to talk to the upower D-Bus service.

Audit messages are attached.

Result of `ausearch -m avc -ts 12:16 | audit2allow`:
#============= pegasus_openlmi_powermanagement_t ==============
allow pegasus_openlmi_powermanagement_t passwd_file_t:file { read getattr open };
allow pegasus_openlmi_powermanagement_t pegasus_data_t:dir write;
allow pegasus_openlmi_powermanagement_t self:capability { setuid setgid };
allow pegasus_openlmi_powermanagement_t self:netlink_route_socket { bind create getattr nlmsg_read };
allow pegasus_openlmi_powermanagement_t self:udp_socket { create connect getattr };
allow pegasus_openlmi_powermanagement_t system_dbusd_t:unix_stream_socket connectto;
allow pegasus_openlmi_powermanagement_t system_dbusd_var_run_t:dir search;
allow pegasus_openlmi_powermanagement_t system_dbusd_var_run_t:sock_file write;
Comment 2 Miroslav Grepl 2013-07-29 08:29:13 EDT
Should be probably covered by 

pegasus_openlmi_system_t

I am just thinking how to do it. We have

pegasus_openlmi_domain_template(account)
pegasus_openlmi_domain_template(logicalfile)
pegasus_openlmi_domain_template(networking)
pegasus_openlmi_domain_template(service)
pegasus_openlmi_domain_template(storage)
pegasus_openlmi_domain_template(system)
pegasus_openlmi_domain_template(unconfined)


I think I should merge "networking" to "system" and "service" should be probably "admin". We can not add a new type for each provider.
Comment 3 Miroslav Grepl 2013-07-30 08:51:57 EDT
Ok, I added fixes to F19, will back port.
Comment 6 Ludek Smid 2014-06-13 05:46:35 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.