Skip to content

Commit 1cff95d

Browse files
committed
Modified several common bundles to be agent bundles to limit access in SELinux policy
This should simplify selinux policy where we want the agent to have broad access but other components like serverd, execd, hub to have more limited access. The paths bundle checks for the existence of many commands and this operation can cause SELinux AVCs. The inventory bundle uses the curl command to see if the host is an AWS instance and if so collects some inventory from a well known API/IP. The cfe_internal_hub_vars needs to determine if php-fpm executable is present. As far as I can tell there isn't a need for the vars/classes defined in paths and inventory in components other than agent so this change should be OK. Ticket: ENT-12954 Changelog: title more common to agent fixes
1 parent 2cb3f4d commit 1cff95d

File tree

3 files changed

+5
-5
lines changed

3 files changed

+5
-5
lines changed

cfe_internal/enterprise/CFE_hub_specific.cf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
##################################################################
1616

1717
@if minimum_version(3.12.0)
18-
bundle common cfe_hub_specific_file_control
18+
bundle agent cfe_hub_specific_file_control
1919
{
2020
vars:
2121
"inputs" slist => { "$(this.promise_dirname)/federation/federation.cf" };
@@ -27,7 +27,7 @@ body file control
2727
}
2828
@endif
2929

30-
bundle common cfe_internal_hub_vars
30+
bundle agent cfe_internal_hub_vars
3131
# @brief Set hub specific variables
3232
{
3333
classes:

inventory/any.cf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
bundle common inventory_any
1+
bundle agent inventory_any
22
# @brief Do inventory for any OS
33
#
44
# This common bundle is for any OS work not handled by specific
@@ -593,7 +593,7 @@ bundle agent cfe_autorun_inventory_cpuinfo
593593
"$(const.t) CPU physical cores: $(cpuinfo_physical_cores)";
594594
}
595595

596-
bundle common cfe_autorun_inventory_aws
596+
bundle agent cfe_autorun_inventory_aws
597597
# @brief inventory AWS EC2 instances
598598
#
599599
# Provides:

lib/paths.cf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Paths bundle (used by other bodies)
22

3-
bundle common paths
3+
bundle agent paths
44
# @brief Defines an array `path` with common paths to standard binaries and
55
# directories as well as classes for defined and existing paths.
66
#

0 commit comments

Comments
 (0)