Fixes #16227: Missing SELinux/systemd context for relayd on shared-fi…

…les folder
Normation · Nov 21, 2019 · 4ff81c0 · 4ff81c0
1 parent e6fe4aa
commit 4ff81c0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/relay/sources/selinux/rudder-relay.fc b/relay/sources/selinux/rudder-relay.fc
@@ -3,5 +3,7 @@
 /opt/rudder/etc/relay(/.*)?              gen_context(system_u:object_r:rudder_relayd_etc_t,s0)
 /var/rudder/inventories(/.*)?            gen_context(system_u:object_r:public_content_rw_t,s0)
 /var/rudder/reports(/.*)?                gen_context(system_u:object_r:public_content_rw_t,s0)
+/var/rudder/shared-files(/.*)?           gen_context(system_u:object_r:public_content_rw_t,s0)
+/var/rudder/configuration-repository/shared-files(/.*)? gen_context(system_u:object_r:public_content_t,s0)
 /var/rudder/lib/ssl/allnodescerts.pem -- gen_context(system_u:object_r:rudder_relayd_var_lib_t,s0)
 /var/rudder/lib/relay/nodeslist.json --  gen_context(system_u:object_r:rudder_relayd_var_lib_t,s0)
diff --git a/relay/sources/systemd/rudder-relayd-hardening b/relay/sources/systemd/rudder-relayd-hardening
@@ -1,3 +1,3 @@
 ProtectSystem=strict
-ReadWritePaths=/var/rudder/reports /var/rudder/inventories
+ReadWritePaths=/var/rudder/reports /var/rudder/inventories /var/rudder/shared-files
 PrivateTmp=True