diff --git a/elements/selinux-policy-updates/install.d/10-install-policy b/elements/selinux-policy-updates/install.d/10-install-policy new file mode 100755 index 000000000..7afa7d7d3 --- /dev/null +++ b/elements/selinux-policy-updates/install.d/10-install-policy @@ -0,0 +1,8 @@ +#!/bin/bash + +set -eux + +mkdir -p /opt/stack/selinux-policy + +cp $(dirname $0)/../*.pp /opt/stack/selinux-policy +cp $(dirname $0)/../*.te /opt/stack/selinux-policy diff --git a/elements/selinux-policy-updates/install.d/10-neutron-ip-selinux b/elements/selinux-policy-updates/install.d/10-neutron-ip-selinux deleted file mode 100755 index 8f7e50541..000000000 --- a/elements/selinux-policy-updates/install.d/10-neutron-ip-selinux +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash - -set -eux - -mkdir -p /opt/stack/selinux-policy - -# Adds policy that corrects the following AVC when neutron-dhcp-agent tries to -# start: -# type=AVC msg=audit(1405364263.636:55476): avc: denied { mounton } for pid=2967 comm="ip" path="/" dev="dm-0" ino=2 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir -# and: -# type=AVC msg=audit(1405003967.738:15767): avc: denied { mounton } for pid=5944 comm="ip" path="/run/netns" dev="tmpfs" ino=110627 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:ifconfig_var_run_t:s0 tclass=dir -cp $(dirname $0)/../neutron_ip.pp /opt/stack/selinux-policy -cp $(dirname $0)/../neutron_ip.te /opt/stack/selinux-policy -cp $(dirname $0)/../neutron_ip_tmpfs.pp /opt/stack/selinux-policy -cp $(dirname $0)/../neutron_ip_tmpfs.te /opt/stack/selinux-policy diff --git a/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-apply-custom-policy b/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-apply-custom-policy new file mode 100755 index 000000000..8735fb34d --- /dev/null +++ b/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-apply-custom-policy @@ -0,0 +1,5 @@ +#!/bin/bash + +set -eux + +semodule -i /opt/stack/selinux-policy/*.pp diff --git a/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-neutron-ip-selinux b/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-neutron-ip-selinux deleted file mode 100755 index 55b6340b9..000000000 --- a/elements/selinux-policy-updates/os-refresh-config/pre-configure.d/98-neutron-ip-selinux +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -set -eux - -semodule -i /opt/stack/selinux-policy/neutron_ip.pp -semodule -i /opt/stack/selinux-policy/neutron_ip_tmpfs.pp