[rpms/icecream] epel8: selinux: allow scheduler to perform connection checks

[rpms/icecream] epel8: selinux: allow scheduler to perform connection checks

[Michal Schmidt]

            A new commit has been pushed.

            Repo   : rpms/icecream
            Branch : epel8
            Commit : ee34f12da78bf13f834a27a510d219443b052755
            Author : Michal Schmidt <mschmidt@redhat.com>
            Date   : 2017-08-14T12:29:04+02:00
            Stats  : +3/-0 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/icecream/c/ee34f12da78bf13f834a27a510d219443b052755?branch=epel8

            Log:
            selinux: allow scheduler to perform connection checks

Since icecream commit 0d4b678f7453dca73f1594eeea5ff29764bee8d2
("If scheduler cannot connect remote machine, send no jobs to it (#251)")
the scheduler performs connection checks. It reads resolv.conf and
connects to compile servers. Allow this in the policy.

---
diff --git a/icecream.te b/icecream.te
index 8c277d1..c1d7248 100644
--- a/icecream.te
+++ b/icecream.te
@@ -188,6 +188,7 @@ fs_getattr_all_fs(iceccd_untrusted_t)
 allow icecc_scheduler_t self:tcp_socket create_stream_socket_perms;
 allow icecc_scheduler_t self:udp_socket create_socket_perms;
 allow icecc_scheduler_t self:netlink_route_socket r_netlink_socket_perms;
+allow icecc_scheduler_t iceccd_port_t:tcp_socket { name_connect };
 
 corenet_all_recvfrom_unlabeled(icecc_scheduler_t)
 corenet_all_recvfrom_netlabel(icecc_scheduler_t)
@@ -212,3 +213,5 @@ libs_use_shared_libs(icecc_scheduler_t)
 miscfiles_read_localization(icecc_scheduler_t)
 
 kernel_read_system_state(icecc_scheduler_t)
+
+sysnet_read_config(icecc_scheduler_t)