Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow various services read and write z90crypt device #2121

Merged
merged 1 commit into from
May 16, 2024

Conversation

zpytela
Copy link
Contributor

@zpytela zpytela commented May 14, 2024

This permission is required on s390x systems with the Crypto Express adapter card. The z90crypt device driver acts as the interface to the PCI cryptography hardware and performs asynchronous encryption operations (RSA) as used during the SSL handshake.

In this commit, services executing the following executables were allowed the access:

  • /usr/bin/ssh-keygen
  • /usr/bin/systemctl
  • /usr/sbin/sm-notify
  • /usr/lib/systemd/systemd-executor
  • /usr/lib/systemd/systemd-hostnamed
  • /usr/lib/systemd/systemd-random-seed
  • /usr/lib/systemd/systemd-update-utmp
  • /usr/lib/systemd/systemd-user-sessions
  • /usr/lib/systemd/systemd-user-runtime-dir

Resolves: RHEL-33361

Copy link

Cockpit tests failed for commit cb18b42. @martinpitt, @jelly, @mvollmer please check.

This permission is required on s390x systems with the Crypto Express
adapter card. The z90crypt device driver acts as the interface to the
PCI cryptography hardware and performs asynchronous encryption
operations (RSA) as used during the SSL handshake.

In this commit, services executing the following executables were
allowed the access:
- /usr/bin/ssh-keygen
- /usr/bin/systemctl
- /usr/sbin/sm-notify
- /usr/lib/systemd/systemd-executor
- /usr/lib/systemd/systemd-hostnamed
- /usr/lib/systemd/systemd-random-seed
- /usr/lib/systemd/systemd-update-utmp
- /usr/lib/systemd/systemd-user-sessions
- /usr/lib/systemd/systemd-user-runtime-dir

and systemd generators.

Resolves: RHEL-33361
Copy link

Cockpit tests failed for commit fce3681. @martinpitt, @jelly, @mvollmer please check.

@zpytela zpytela merged commit 01507d2 into fedora-selinux:rawhide May 16, 2024
3 of 4 checks passed
@zpytela zpytela deleted the z90crypt branch May 16, 2024 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant