From 4ae483600f77cea2449cb63d8298ad8763904068 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 20 May 2010 11:54:41 -0400 Subject: Move the dogtag SELinux rules loading into the spec file I couldn't put the dogtag rules into the spec file until we required dogtag as a component. If it wasn't pre-loaded them the rules loading would fail because types would be missing. --- selinux/ipa_dogtag/ipa_dogtag.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'selinux/ipa_dogtag') diff --git a/selinux/ipa_dogtag/ipa_dogtag.te b/selinux/ipa_dogtag/ipa_dogtag.te index 937d9a248..3750e4d10 100644 --- a/selinux/ipa_dogtag/ipa_dogtag.te +++ b/selinux/ipa_dogtag/ipa_dogtag.te @@ -1,4 +1,4 @@ -module ipa_dogtag 1.3; +module ipa_dogtag 1.4; require { type httpd_t; @@ -15,6 +15,7 @@ require { class file rename; class lnk_file create; class lnk_file rename; + class lnk_file unlink; } # Let dogtag write to cert_t directories @@ -30,6 +31,7 @@ allow pki_ca_t cert_t:file rename; # Let dogtag manage cert_t symbolic links allow pki_ca_t cert_t:lnk_file create; allow pki_ca_t cert_t:lnk_file rename; +allow pki_ca_t cert_t:lnk_file unlink; # Let apache read the CRLs allow httpd_t pki_ca_var_lib_t:dir { search getattr }; -- cgit