{"push_id":1027677409,"size":8,"distinct_size":8,"ref":"refs/heads/ndvm-policy-fixes","head":"d4c1b33495edf2c740fa93f4e64d6263e364be2c","before":"08abc778e4697ff27d7e4adfcae41ac5c839d6c5","commits":[{"sha":"793fbe7dcec55fb4e35189ac52238e29cb2db1e3","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Enable modemmanager policy module.\n\nThe modemmanager policy module was disabled in modules.conf,\nleading to denials when it is invoked by dbusd in the ndvm.\n\nResolves the following denials:\n\navc:  denied  { read } for  pid=786 comm=\"modem-manager\" name=\"+pci:0000:00:19.0\" dev=\"tmpfs\" ino=9260 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1\n\navc:  denied  { open } for  pid=786 comm=\"modem-manager\" path=\"/var/run/udev/data/+pci:0000:00:19.0\" dev=\"tmpfs\" ino=9260 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1\n\navc:  denied  { getattr } for  pid=786 comm=\"modem-manager\" path=\"/var/run/udev/data/+pci:0000:00:19.0\" dev=\"tmpfs\" ino=9260 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/793fbe7dcec55fb4e35189ac52238e29cb2db1e3"},{"sha":"d97e6ece21d311a265f9cdcd4126e03472c08c10","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Fix the pathname for dbus-daemon-launch-helper.\n\nThe pathname has changed for dbus-daemon-launch-helper, so we need\nto update it to ensure proper labeling.\n\nResolves the following denial:\n\navc:  denied  { execute_no_trans } for  pid=786 comm=\"dbus-daemon\" path=\"/usr/lib/dbus/dbus-daemon-launch-helper\" dev=\"xvda1\" ino=4506 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/d97e6ece21d311a265f9cdcd4126e03472c08c10"},{"sha":"8e38456c626dcabe17aaa8094da055c4b946da3c","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Policy fixes for NetworkManager.\n\nThe pathname has changed for nm-dispatcher.action, so we need to\nupdate it to ensure proper labeling.\n\nResolves the following denials:\n avc:  denied  { execute_no_trans } for  pid=959 comm=\"dbus-daemon-lau\" path=\"/usr/lib/networkmanager/nm-dispatcher.action\" dev=\"xvda1\" ino=5238 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=1\n\navc:  denied  { getattr } for  pid=959 comm=\"nm-dispatcher.a\" path=\"/etc/NetworkManager/dispatcher.d\" dev=\"tmpfs\" ino=10349 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_etc_t:s0 tclass=dir permissive=1\n\navc:  denied  { read } for  pid=959 comm=\"nm-dispatcher.a\" name=\"dispatcher.d\" dev=\"tmpfs\" ino=10349 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_etc_t:s0 tclass=dir permissive=1\n\navc:  denied  { open } for  pid=959 comm=\"nm-dispatcher.a\" path=\"/etc/NetworkManager/dispatcher.d\" dev=\"tmpfs\" ino=10349 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:NetworkManager_etc_t:s0 tclass=dir permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/8e38456c626dcabe17aaa8094da055c4b946da3c"},{"sha":"f2bc23f7b0293a7c959e217ddc28f32898eeefc1","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Label /var/run/ifstate.\n\nThe busybox defconfig specifies:\nCONFIG_IFUPDOWN_IFSTATE_PATH=\"/var/run/ifstate\"\n\nUpdate SELinux policy to label this directory the same way it\nwould label /etc/network/ifstate.\n\nResolves the following denials:\navc:  denied  { read } for  pid=805 comm=\"ifup\" name=\"ifstate\" dev=\"tmpfs\" ino=9460 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=1\n\navc:  denied  { open } for  pid=805 comm=\"ifup\" path=\"/var/run/ifstate\" dev=\"tmpfs\" ino=9460 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=1\n\navc:  denied  { getattr } for  pid=805 comm=\"ifup\" path=\"/var/run/ifstate\" dev=\"tmpfs\" ino=9460 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/f2bc23f7b0293a7c959e217ddc28f32898eeefc1"},{"sha":"00f3fc4252952fd4d6818b63b3fd2c786e0af973","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Allow mount to stat /dev/xvda1.\n\nmount is trying to stat /dev/xvda1, apparently using\nthe early devtmpfs node before udev has relabeled it to\na more specific type.  Allow it.\n\nResolves the following denial:\navc:  denied  { getattr } for  pid=90 comm=\"mount\" path=\"/dev/xvda1\" dev=\"devtmpfs\" ino=8206 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=blk_file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/00f3fc4252952fd4d6818b63b3fd2c786e0af973"},{"sha":"b4063341c49dc687e4588837c6e486de6e5324d8","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Address ifconfig and dhclient denials.\n\nifconfig needs permissions to load kernel modules.  It also\ntriggers denials on an early devtmpfs /dev/console instance\nbefore udev relabel which we can suppress through dontaudit\nrather than allowing.\n\ndhclient needs permission to execute\n/usr/lib/networkmanager/nm-dhcp-client.action.\n\nResolves the following denials:\n\navc:  denied  { read write } for  pid=87 comm=\"ifconfig\" path=\"/dev/console\" dev=\"devtmpfs\" ino=8008 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1\n\navc:  denied  { sys_module } for  pid=465 comm=\"ifconfig\" capability=16  scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=capability permissive=1\n\navc:  denied  { execute_no_trans } for  pid=844 comm=\"dhclient\" path=\"/usr/lib/networkmanager/nm-dhcp-client.action\" dev=\"xvda1\" ino=5239 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/b4063341c49dc687e4588837c6e486de6e5324d8"},{"sha":"0c5ef28786b5f6bfafbce1482ef71a66965420e3","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Allow udev to write to xenfs.\n\nudev invokes xenstore-write and therefore requires write\npermissions to xenfs.\n\nResolves the following denials:\n avc:  denied  { getattr } for  pid=817 comm=\"xenstore-write\" path=\"/proc/xen/xenbus\" dev=\"xenfs\" ino=2 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1\n\navc:  denied  { read write } for  pid=817 comm=\"xenstore-write\" name=\"xenbus\" dev=\"xenfs\" ino=2 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1\n\navc:  denied  { open } for  pid=817 comm=\"xenstore-write\" path=\"/proc/xen/xenbus\" dev=\"xenfs\" ino=2 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xenfs_t:s0 tclass=file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/0c5ef28786b5f6bfafbce1482ef71a66965420e3"},{"sha":"d4c1b33495edf2c740fa93f4e64d6263e364be2c","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Allow db-ls-dom0 to use a pipe created by network-slave.\n\nResolves the following denials:\navc:  denied  { use } for  pid=614 comm=\"db-ls-dom0\" path=\"pipe:[10015]\" dev=\"pipefs\" ino=10015 scontext=system_u:system_r:db_cmd_t:s0 tcontext=system_u:system_r:network_slave_t:s0 tclass=fd permissive=1\n\navc:  denied  { read } for  pid=614 comm=\"db-ls-dom0\" path=\"pipe:[10015]\" dev=\"pipefs\" ino=10015 scontext=system_u:system_r:db_cmd_t:s0 tcontext=system_u:system_r:network_slave_t:s0 tclass=fifo_file permissive=1\n\navc:  denied  { write } for  pid=614 comm=\"db-ls-dom0\" path=\"pipe:[10017]\" dev=\"pipefs\" ino=10017 scontext=system_u:system_r:db_cmd_t:s0 tcontext=system_u:system_r:network_slave_t:s0 tclass=fifo_file permissive=1\n\navc:  denied  { ioctl } for  pid=614 comm=\"db-ls-dom0\" path=\"pipe:[10015]\" dev=\"pipefs\" ino=10015 ioctlcmd=5401 scontext=system_u:system_r:db_cmd_t:s0 tcontext=system_u:system_r:network_slave_t:s0 tclass=fifo_file permissive=1\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/stephensmalley/xenclient-oe/commits/d4c1b33495edf2c740fa93f4e64d6263e364be2c"}]}