pcp updates: selinux policy package/subrpm

Hi,

Changes committed to git://git.pcp.io/lberk/pcp.git selinux

Lukas Berk (13):
      Initial selinux policy package and scafholding
      Update type enforcement file
      Fix typo in configure and configure.ac
      Add selinux policy package testcase
      Rework pcp module to pcpupstream module
      Add selinux README file for additional info
      selinux: update pcp.spec.in installation mechanism
      Selinux: Add pmdalio type enforcement requirements
      rpm build: tweak post{un} selinux scriptlet sections
      Update pmdaproc ttyname to iterate through /dev
      selinux: update type enforcement file context permissions
      Updated type enforcement file with further QA caught denials
      selinux: Add policy for qa/455 and pmdarsyslog

 build/rpm/GNUmakefile          |    2 
 build/rpm/fedora.spec          |   43 ++++++
 build/rpm/pcp.spec.in          |   53 +++++++
 configure                      |   33 ++++
 configure.ac                   |   24 +++
 qa/917                         |   47 ++++++
 qa/917.out                     |   77 ++++++++++
 qa/group                       |    1 
 src/GNUmakefile                |    1 
 src/include/builddefs.in       |    2 
 src/pmdas/linux_proc/getinfo.c |   32 ++--
 src/selinux/GNUmakefile        |   41 +++++
 src/selinux/README             |  123 +++++++++++++++++
 src/selinux/pcp.if             |  288 ++++++++++++++++++++---------------------
 src/selinux/pcp.te             |  114 ++++++++--------
 src/selinux/pcpupstream.if     |    1 
 src/selinux/pcpupstream.te     |  123 ++++++++++++++++-
 17 files changed, 774 insertions(+), 231 deletions(-)

Details ...

commit 9877b10a00c1f4dd08ad3b1112f35ddffad00b12
Author: Lukas Berk <[email protected]>
Date:   Tue Feb 7 12:05:11 2017 -0500

    selinux: Add policy for qa/455 and pmdarsyslog

commit c539f1f9a6fe330aefd852b376ef0cd4fc8056ed
Author: Lukas Berk <[email protected]>
Date:   Tue Feb 7 11:43:41 2017 -0500

    Updated type enforcement file with further QA caught denials
    
    pmdasummary and pmdalivrt tests fail without these policies

commit 538ed20c0f9515335feb953c899742b8dafc8d1a
Author: Lukas Berk <[email protected]>
Date:   Thu Feb 2 11:36:54 2017 -0500

    selinux: update type enforcement file context permissions
    
    When checking a variety of metrics, such as filesys.used we were
    getting denials.  Updating the .te file accordingly

commit e7563075231684d3bd27c62ddf2c8106832c3561
Author: Lukas Berk <[email protected]>
Date:   Thu Feb 2 11:33:24 2017 -0500

    Update pmdaproc ttyname to iterate through /dev
    
    Iterating through /proc/$PID/fd's to look for various tty's was
    causing a variety of selinux denials.  To the extent that it was
    inappropriate to include that number of dontaudit lines in the type
    enforcement file.
    
    Instead, we now iterate through /dev/ and check if a device matches
    the particular pid of interest.  Similar to the approach ps takes.

commit 19ebddeca7f4a2290801710ec372fadc99d9172b
Author: Lukas Berk <[email protected]>
Date:   Thu Feb 2 11:29:28 2017 -0500

    rpm build: tweak post{un} selinux scriptlet sections
    
    properly uninstall the selinux module when we're uninstalling the
    subrpm package

commit 7bc87c4089abc6e928d37cc88cd633096ccbf224
Author: Lukas Berk <[email protected]>
Date:   Tue Jan 24 14:16:01 2017 -0500

    Selinux: Add pmdalio type enforcement requirements

commit 4270a200d98ec2541a519e8b89621edf839cc964
Author: Lukas Berk <[email protected]>
Date:   Mon Jan 23 21:13:06 2017 -0500

    selinux: update pcp.spec.in installation mechanism
    
    update the configure variable to install the selinux related files to
    a /var/lib/pcp/selinux directory, then un/install with semodule in
    post/postun scriptlets

commit 9e946445082d115be2d333dce4df0bc60955d0f8
Author: Lukas Berk <[email protected]>
Date:   Fri Jan 20 16:16:40 2017 -0500

    Add selinux README file for additional info

commit 0a44cf8d50a53958c41079f88ce3eec7bcff820c
Author: Lukas Berk <[email protected]>
Date:   Fri Jan 20 16:08:42 2017 -0500

    Rework pcp module to pcpupstream module
    
    Naming conflicts makes installing a 'pcp' module difficult.  Change to
    'pcpupstream' for now.
    
    Add several new interfaces and rules to the Type Enforcement team.

commit 4a7d866bc75a2aff193439a62f076cd5f5a91d0b
Author: Lukas Berk <[email protected]>
Date:   Fri Jan 20 15:49:46 2017 -0500

    Add selinux policy package testcase
    
    Begin the testcase to pull apart and check a policy package

commit df2016ff4ae8d415d1aaaa5633dba70a2ccd2ef2
Author: Lukas Berk <[email protected]>
Date:   Fri Jan 20 15:42:06 2017 -0500

    Fix typo in configure and configure.ac

commit 494c5da5ff448283145ddf7d1813a0bf90a60ab4
Author: Lukas Berk <[email protected]>
Date:   Mon Jan 16 18:01:39 2017 -0500

    Update type enforcement file

commit 8d606053d0ba76e94345b13a7c7f4c041cd86193
Author: Lukas Berk <[email protected]>
Date:   Mon Jan 16 10:26:43 2017 -0500

    Initial selinux policy package and scafholding
    
    build/rpm/ - rpm build rpm and package
    configure{,.ac} - check for selinux existance
    src/selinux/pcp.fc - file contexts
    src/selinux/pcp.if - interfaces
    src/selinux/pcp.te - type enforcement

-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#15081): https://groups.io/g/pcp/message/15081
View All Messages In Topic (1): https://groups.io/g/pcp/topic/4346270
Mute This Topic: https://groups.io/mt/4346270?uid=174580
New Topic: https://groups.io/g/pcp/post
-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580
Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]
Terms of Service: https://groups.io/static/tos
Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-