fix: selinux denials - dbus send msgs, squid port connect

squid port is needed when host-metering is using a proxy that uses port 3128 via the HTTS_PROXY env var. dbus send message denial was observed after subscription-manager calls. Signed-off-by: Petr Vobornik <[email protected]>
pvoborni · Oct 18, 2023 · 753617c · 753617c
1 parent 0de885a
commit 753617c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/contrib/selinux/host-metering.te b/contrib/selinux/host-metering.te
@@ -47,6 +47,7 @@ corecmd_exec_bin(hostmetering_t)
 corecmd_exec_shell(hostmetering_t)
 
 corenet_tcp_connect_http_port(hostmetering_t)
+corenet_tcp_connect_squid_port(hostmetering_t)
 corenet_tcp_connect_websm_port(hostmetering_t)
 
 dev_list_sysfs(hostmetering_t)
@@ -84,5 +85,5 @@ optional_policy(`
     manage_files_pattern(hostmetering_t, rhsmcertd_config_t, rhsmcertd_config_t)
     rhsmcertd_manage_lib_files(hostmetering_t)
     rhsmcertd_read_log(hostmetering_t)
+    rhsmcertd_dbus_chat(hostmetering_t)
 ')
-