{"action":"created","comment":{"url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/comments/88241261","pull_request_review_id":8819562,"id":88241261,"diff_hunk":"@@ -69,6 +69,8 @@ kernel_read_network_state(firewalld_t)\n kernel_read_system_state(firewalld_t)\n kernel_rw_net_sysctls(firewalld_t)\n \n+allow firewalld_t modules_object_t:dir { getattr open search read };","path":"firewalld.te","position":4,"original_position":4,"commit_id":"5c1d82951fe0c0e02899de3683ec7f6d093bdb26","original_commit_id":"5c1d82951fe0c0e02899de3683ec7f6d093bdb26","user":{"login":"t-woerner","id":6049493,"avatar_url":"https://avatars.githubusercontent.com/u/6049493?v=3","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"body":"files_list_kernel_modules only allows list_dir_perms, which lacks search:\r\n  define(`read_file_perms',`{ open read_inherited_file_perms }')\r\n  define(`read_inherited_file_perms',`{ getattr read ioctl lock }')","created_at":"2016-11-16T14:02:47Z","updated_at":"2016-11-16T14:02:47Z","html_url":"https://github.com/fedora-selinux/selinux-policy/pull/171#discussion_r88241261","pull_request_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171","_links":{"self":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/comments/88241261"},"html":{"href":"https://github.com/fedora-selinux/selinux-policy/pull/171#discussion_r88241261"},"pull_request":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171"}}},"pull_request":{"url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171","id":93966869,"html_url":"https://github.com/fedora-selinux/selinux-policy/pull/171","diff_url":"https://github.com/fedora-selinux/selinux-policy/pull/171.diff","patch_url":"https://github.com/fedora-selinux/selinux-policy/pull/171.patch","issue_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/171","number":171,"state":"open","locked":false,"title":"Allow firewalld to getattr open search read modules_object_t:dir","user":{"login":"t-woerner","id":6049493,"avatar_url":"https://avatars.githubusercontent.com/u/6049493?v=3","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"body":"This is needed for secure use of netfilter connection tracking helpers.\r\n\r\nThere is no interface in netfilter to get the list of supported netfilter\r\nconnection tracking modules and the helpers they provide. To be able to know\r\nwhich are usable with the active kernel, firewalld needs to be able to list\r\nthe directory \"/lib/modules/$(uname -r)/kernel/net/netfilter/\" and use\r\nmodinfo on the modules that start with \"nf_conntrack_\" to get the helpers.","created_at":"2016-11-16T13:37:42Z","updated_at":"2016-11-16T14:02:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cc9595a539361b73392678eee1c6a9b427101a1c","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171/commits","review_comments_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171/comments","review_comment_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/comments{/number}","comments_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/171/comments","statuses_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/statuses/5c1d82951fe0c0e02899de3683ec7f6d093bdb26","head":{"label":"t-woerner:rawhide-contrib","ref":"rawhide-contrib","sha":"5c1d82951fe0c0e02899de3683ec7f6d093bdb26","user":{"login":"t-woerner","id":6049493,"avatar_url":"https://avatars.githubusercontent.com/u/6049493?v=3","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"repo":{"id":73819850,"name":"selinux-policy","full_name":"t-woerner/selinux-policy","owner":{"login":"t-woerner","id":6049493,"avatar_url":"https://avatars.githubusercontent.com/u/6049493?v=3","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/t-woerner/selinux-policy","description":"selinux-policy for Fedora is a large patch off the mainline","fork":true,"url":"https://api.github.com/repos/t-woerner/selinux-policy","forks_url":"https://api.github.com/repos/t-woerner/selinux-policy/forks","keys_url":"https://api.github.com/repos/t-woerner/selinux-policy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/t-woerner/selinux-policy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/t-woerner/selinux-policy/teams","hooks_url":"https://api.github.com/repos/t-woerner/selinux-policy/hooks","issue_events_url":"https://api.github.com/repos/t-woerner/selinux-policy/issues/events{/number}","events_url":"https://api.github.com/repos/t-woerner/selinux-policy/events","assignees_url":"https://api.github.com/repos/t-woerner/selinux-policy/assignees{/user}","branches_url":"https://api.github.com/repos/t-woerner/selinux-policy/branches{/branch}","tags_url":"https://api.github.com/repos/t-woerner/selinux-policy/tags","blobs_url":"https://api.github.com/repos/t-woerner/selinux-policy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/t-woerner/selinux-policy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/t-woerner/selinux-policy/git/refs{/sha}","trees_url":"https://api.github.com/repos/t-woerner/selinux-policy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/t-woerner/selinux-policy/statuses/{sha}","languages_url":"https://api.github.com/repos/t-woerner/selinux-policy/languages","stargazers_url":"https://api.github.com/repos/t-woerner/selinux-policy/stargazers","contributors_url":"https://api.github.com/repos/t-woerner/selinux-policy/contributors","subscribers_url":"https://api.github.com/repos/t-woerner/selinux-policy/subscribers","subscription_url":"https://api.github.com/repos/t-woerner/selinux-policy/subscription","commits_url":"https://api.github.com/repos/t-woerner/selinux-policy/commits{/sha}","git_commits_url":"https://api.github.com/repos/t-woerner/selinux-policy/git/commits{/sha}","comments_url":"https://api.github.com/repos/t-woerner/selinux-policy/comments{/number}","issue_comment_url":"https://api.github.com/repos/t-woerner/selinux-policy/issues/comments{/number}","contents_url":"https://api.github.com/repos/t-woerner/selinux-policy/contents/{+path}","compare_url":"https://api.github.com/repos/t-woerner/selinux-policy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/t-woerner/selinux-policy/merges","archive_url":"https://api.github.com/repos/t-woerner/selinux-policy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/t-woerner/selinux-policy/downloads","issues_url":"https://api.github.com/repos/t-woerner/selinux-policy/issues{/number}","pulls_url":"https://api.github.com/repos/t-woerner/selinux-policy/pulls{/number}","milestones_url":"https://api.github.com/repos/t-woerner/selinux-policy/milestones{/number}","notifications_url":"https://api.github.com/repos/t-woerner/selinux-policy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/t-woerner/selinux-policy/labels{/name}","releases_url":"https://api.github.com/repos/t-woerner/selinux-policy/releases{/id}","deployments_url":"https://api.github.com/repos/t-woerner/selinux-policy/deployments","created_at":"2016-11-15T14:11:15Z","updated_at":"2016-11-07T09:10:09Z","pushed_at":"2016-11-16T13:36:45Z","git_url":"git://github.com/t-woerner/selinux-policy.git","ssh_url":"git@github.com:t-woerner/selinux-policy.git","clone_url":"https://github.com/t-woerner/selinux-policy.git","svn_url":"https://github.com/t-woerner/selinux-policy","homepage":null,"size":29897,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"fedora-selinux:rawhide-contrib","ref":"rawhide-contrib","sha":"48f14a02c0554a64d97010424072f81105693d21","user":{"login":"fedora-selinux","id":8161548,"avatar_url":"https://avatars.githubusercontent.com/u/8161548?v=3","gravatar_id":"","url":"https://api.github.com/users/fedora-selinux","html_url":"https://github.com/fedora-selinux","followers_url":"https://api.github.com/users/fedora-selinux/followers","following_url":"https://api.github.com/users/fedora-selinux/following{/other_user}","gists_url":"https://api.github.com/users/fedora-selinux/gists{/gist_id}","starred_url":"https://api.github.com/users/fedora-selinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fedora-selinux/subscriptions","organizations_url":"https://api.github.com/users/fedora-selinux/orgs","repos_url":"https://api.github.com/users/fedora-selinux/repos","events_url":"https://api.github.com/users/fedora-selinux/events{/privacy}","received_events_url":"https://api.github.com/users/fedora-selinux/received_events","type":"Organization","site_admin":false},"repo":{"id":21621078,"name":"selinux-policy","full_name":"fedora-selinux/selinux-policy","owner":{"login":"fedora-selinux","id":8161548,"avatar_url":"https://avatars.githubusercontent.com/u/8161548?v=3","gravatar_id":"","url":"https://api.github.com/users/fedora-selinux","html_url":"https://github.com/fedora-selinux","followers_url":"https://api.github.com/users/fedora-selinux/followers","following_url":"https://api.github.com/users/fedora-selinux/following{/other_user}","gists_url":"https://api.github.com/users/fedora-selinux/gists{/gist_id}","starred_url":"https://api.github.com/users/fedora-selinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fedora-selinux/subscriptions","organizations_url":"https://api.github.com/users/fedora-selinux/orgs","repos_url":"https://api.github.com/users/fedora-selinux/repos","events_url":"https://api.github.com/users/fedora-selinux/events{/privacy}","received_events_url":"https://api.github.com/users/fedora-selinux/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/fedora-selinux/selinux-policy","description":"selinux-policy for Fedora is a large patch off the mainline","fork":false,"url":"https://api.github.com/repos/fedora-selinux/selinux-policy","forks_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/forks","keys_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/teams","hooks_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/hooks","issue_events_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/events{/number}","events_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/events","assignees_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/assignees{/user}","branches_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/branches{/branch}","tags_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/tags","blobs_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/git/refs{/sha}","trees_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/statuses/{sha}","languages_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/languages","stargazers_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/stargazers","contributors_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/contributors","subscribers_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/subscribers","subscription_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/subscription","commits_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/commits{/sha}","git_commits_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/git/commits{/sha}","comments_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/comments{/number}","issue_comment_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/comments{/number}","contents_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/contents/{+path}","compare_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/merges","archive_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/downloads","issues_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues{/number}","pulls_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls{/number}","milestones_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/milestones{/number}","notifications_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/labels{/name}","releases_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/releases{/id}","deployments_url":"https://api.github.com/repos/fedora-selinux/selinux-policy/deployments","created_at":"2014-07-08T16:48:35Z","updated_at":"2016-11-07T09:10:09Z","pushed_at":"2016-11-16T13:39:13Z","git_url":"git://github.com/fedora-selinux/selinux-policy.git","ssh_url":"git@github.com:fedora-selinux/selinux-policy.git","clone_url":"https://github.com/fedora-selinux/selinux-policy.git","svn_url":"https://github.com/fedora-selinux/selinux-policy","homepage":null,"size":29897,"stargazers_count":24,"watchers_count":24,"language":null,"has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":37,"mirror_url":null,"open_issues_count":14,"forks":37,"open_issues":14,"watchers":24,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171"},"html":{"href":"https://github.com/fedora-selinux/selinux-policy/pull/171"},"issue":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/171"},"comments":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/issues/171/comments"},"review_comments":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171/comments"},"review_comment":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/pulls/171/commits"},"statuses":{"href":"https://api.github.com/repos/fedora-selinux/selinux-policy/statuses/5c1d82951fe0c0e02899de3683ec7f6d093bdb26"}}}}
{"actor":{"display_login":"t-woerner"}}