diff --git a/local_settings.sh b/local_settings.sh index db52ce0..75fb310 100755 --- a/local_settings.sh +++ b/local_settings.sh @@ -23,6 +23,7 @@ relabel_files() do_echo "Relabeling files..." $SBINDIR/restorecon -Rv $BINDIR/swift* \ $LOCALSTATEDIR/run/swift \ + $SHAREDSTATEDIR/nova/.ssh \ /srv \ $BINDIR/neutron* \ $LOCALSTATEDIR/run/redis \ diff --git a/os-nova.te b/os-nova.te index 62777dc..4ed0eba 100644 --- a/os-nova.te +++ b/os-nova.te @@ -7,7 +7,6 @@ gen_require(` type nova_scheduler_t; type nova_console_t; type nova_cert_t; - type sshd_t; type sssd_var_lib_t; type cert_t; type nova_log_t; @@ -59,9 +58,6 @@ allow nova_network_t self:capability2 block_suspend; # Bugzilla 1083566 allow nova_network_t initrc_var_run_t:file read; -# Bugzilla 1113723 -allow sshd_t nova_var_lib_t:file { getattr read open }; - # Bugzilla 1135510 allow nova_api_t sssd_var_lib_t:sock_file write; allow nova_scheduler_t cert_t:file { read getattr open }; diff --git a/tests/bz1113723 b/tests/bz1113723 deleted file mode 100644 index 5b0417d..0000000 --- a/tests/bz1113723 +++ /dev/null @@ -1 +0,0 @@ -type=AVC msg=audit(1403806776.581:13347): avc: denied { read } for pid=17182 comm="sshd" name="authorized_keys" dev="sda5" ino=25167914 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file