From cd85b729d3fd03e6acd75ec4f0f916aec4bc9247 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Sep 27 2021 13:53:38 +0000 Subject: selinux: Fix file context definition for /var/run There is a file context equivalence rule assigning /run the same contexts as /var/run. Because of it it's necessary to use /var/run instead of /run in file context definitions. See: https://fedoraproject.org/wiki/SELinux/IndependentPolicy#File_contexts_and_equivalency_rules Signed-off-by: Vit Mojzis Reviewed-By: Rob Crittenden Reviewed-By: Francois Cami --- diff --git a/selinux/ipa.fc b/selinux/ipa.fc index 1176f38..f6e3f67 100644 --- a/selinux/ipa.fc +++ b/selinux/ipa.fc @@ -23,7 +23,7 @@ /var/log/ipareplica-conncheck.log.* -- gen_context(system_u:object_r:ipa_log_t,s0) -/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0) +/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0) /usr/libexec/ipa/ipa-custodia -- gen_context(system_u:object_r:ipa_custodia_exec_t,s0) /usr/libexec/ipa/custodia/ipa-custodia-dmldap -- gen_context(system_u:object_r:ipa_custodia_dmldap_exec_t,s0)