diff --git a/policy/modules/services/certmaster.te b/policy/modules/services/certmaster.te index 1573914..6e32117 100644 --- a/policy/modules/services/certmaster.te +++ b/policy/modules/services/certmaster.te @@ -60,6 +60,7 @@ corenet_tcp_bind_generic_node(certmaster_t) corenet_tcp_bind_certmaster_port(certmaster_t) files_search_etc(certmaster_t) +files_read_usr_files(certmaster_t) files_list_var(certmaster_t) files_search_var_lib(certmaster_t) diff --git a/policy/modules/services/corosync.te b/policy/modules/services/corosync.te index 317b025..9d97456 100644 --- a/policy/modules/services/corosync.te +++ b/policy/modules/services/corosync.te @@ -111,6 +111,10 @@ optional_policy(` ') optional_policy(` + lvm_rw_clvmd_tmpfs_files(corosync_t) +') + +optional_policy(` # to communication with RHCS rhcs_rw_cluster_shm(corosync_t) rhcs_rw_cluster_semaphores(corosync_t) diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if index a93e5ca..4ab36ba 100644 --- a/policy/modules/services/dbus.if +++ b/policy/modules/services/dbus.if @@ -442,6 +442,8 @@ interface(`dbus_system_domain',` domtrans_pattern(system_dbusd_t, $2, $1) + fs_search_cgroup_dirs($1) + dbus_system_bus_client($1) dbus_connect_system_bus($1) diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te index a142c36..29a5d0d 100644 --- a/policy/modules/services/rlogin.te +++ b/policy/modules/services/rlogin.te @@ -70,6 +70,7 @@ fs_search_auto_mountpoints(rlogind_t) auth_domtrans_chk_passwd(rlogind_t) auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) +auth_login_pgm_domain(rlogind_t) files_read_etc_files(rlogind_t) files_read_etc_runtime_files(rlogind_t) diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if index 58bc27f..b4f0663 100644 --- a/policy/modules/system/lvm.if +++ b/policy/modules/system/lvm.if @@ -123,3 +123,21 @@ interface(`lvm_domtrans_clvmd',` corecmd_search_bin($1) domtrans_pattern($1, clvmd_exec_t, clvmd_t) ') + +######################################## +## +## Read and write to lvm temporary file system. +## +## +## +## Domain allowed access. +## +## +# +interface(`lvm_rw_clvmd_tmpfs_files',` + gen_require(` + type clvmd_tmpfs_t; + ') + + allow $1 clvmd_tmpfs_t:file rw_file_perms; +') diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te index 4eef596..7eb67d1 100644 --- a/policy/modules/system/lvm.te +++ b/policy/modules/system/lvm.te @@ -12,6 +12,9 @@ init_daemon_domain(clvmd_t, clvmd_exec_t) type clvmd_initrc_exec_t; init_script_file(clvmd_initrc_exec_t) +type clmvd_tmpfs_t; +files_tmpfs_file(clmvd_tmpfs_t) + type clvmd_var_run_t; files_pid_file(clvmd_var_run_t) @@ -56,6 +59,10 @@ allow clvmd_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow clvmd_t self:tcp_socket create_stream_socket_perms; allow clvmd_t self:udp_socket create_socket_perms; +manage_dirs_pattern(clvmd_t, clmvd_tmpfs_t, clmvd_tmpfs_t) +manage_files_pattern(clvmd_t, clmvd_tmpfs_t,clmvd_tmpfs_t) +fs_tmpfs_filetrans(clvmd_t, clmvd_tmpfs_t, { dir file }) + manage_files_pattern(clvmd_t, clvmd_var_run_t, clvmd_var_run_t) files_pid_filetrans(clvmd_t, clvmd_var_run_t, file)