diff --git a/container-selinux.tgz b/container-selinux.tgz index 36ff640..332beee 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-f26-contrib.patch b/policy-f26-contrib.patch index 6573d37..f3a49f8 100644 --- a/policy-f26-contrib.patch +++ b/policy-f26-contrib.patch @@ -33050,10 +33050,10 @@ index 0000000..4501460 + diff --git a/glusterd.te b/glusterd.te new file mode 100644 -index 0000000..d474c09 +index 0000000..cbcaf9a --- /dev/null +++ b/glusterd.te -@@ -0,0 +1,313 @@ +@@ -0,0 +1,324 @@ +policy_module(glusterd, 1.1.3) + +## @@ -33079,6 +33079,13 @@ index 0000000..d474c09 +## +gen_tunable(gluster_export_all_rw, true) + ++## ++##

++## Allow glusterd_t domain to use executable memory ++##

++##
++gen_tunable(gluster_use_execmem, false) ++ +######################################## +# +# Declarations @@ -33289,6 +33296,10 @@ index 0000000..d474c09 + files_getattr_all_sockets(glusterd_t) +') + ++tunable_policy(`gluster_use_execmem',` ++ allow glusterd_t self:process { execmem }; ++') ++ +optional_policy(` + ctdbd_domtrans(glusterd_t) + ctdbd_signal(glusterd_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 813880f..b41d49e 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 260%{?dist} +Release: 260.1%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -690,6 +690,9 @@ exit 0 %endif %changelog +* Tue Jul 11 2017 Lukas Vrabec - 3.13.1-260.1 +- Add new boolean gluster_use_execmem + * Mon Jul 10 2017 Lukas Vrabec - 3.13.1-260 - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service - Allow iptables to read container runtime files