>From 25aa37e28bd1f25e4eee5e309e404096aacba1d9 Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Thu, 29 Aug 2013 14:19:08 -0700
Subject: [PATCH] Resolves #999055 - AVC denials during ipa server and replica installs

---
 base/selinux/src/pki.if               |    1 +
 base/selinux/src/pki.te               |    2 +-
 patches/pki-core-9.0.3-bz999055.patch |   35 +++++++++++++++++++++++++++++++++
 specs/pki-core.spec                   |   12 ++++++++--
 4 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 patches/pki-core-9.0.3-bz999055.patch

diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if
index 737eb220a324219c24c2a1439ae2d6e4185d0c0f..de11ee0b45e9a725c3ff7514be10ac7e3b0c71dc 100644
--- a/base/selinux/src/pki.if
+++ b/base/selinux/src/pki.if
@@ -158,6 +158,7 @@ template(`pki_ca_template',`
         corecmd_search_bin($1_t)
 
 	dev_list_sysfs($1_t)
+        dev_read_sysfs($1_t)
 	dev_read_rand($1_t)
 	dev_read_urand($1_t)
 
diff --git a/base/selinux/src/pki.te b/base/selinux/src/pki.te
index 846057b3aa93f0c20344f26c4baf9bb8b1919775..c52bc808e89fd4b03ac1d7d67e99380a36243727 100644
--- a/base/selinux/src/pki.te
+++ b/base/selinux/src/pki.te
@@ -1,4 +1,4 @@
-policy_module(pki,6.4.1)
+policy_module(pki,6.4.3)
 
 attribute pki_ca_config;
 attribute pki_ca_executable;
diff --git a/patches/pki-core-9.0.3-bz999055.patch b/patches/pki-core-9.0.3-bz999055.patch
new file mode 100644
index 0000000000000000000000000000000000000000..c415a284680a04275a3d83750eea7a896b184210
--- /dev/null
+++ b/patches/pki-core-9.0.3-bz999055.patch
@@ -0,0 +1,35 @@
+From 1bc7cec7097c381aa6ad6110bef8235edb3b0ee1 Mon Sep 17 00:00:00 2001
+From: Ade Lee <alee@redhat.com>
+Date: Thu, 29 Aug 2013 14:19:08 -0700
+Subject: [PATCH] Resolves #999055 - AVC denials during ipa server and replica installs
+
+---
+ base/selinux/src/pki.if |    1 +
+ base/selinux/src/pki.te |    2 +-
+ 2 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if
+index 737eb220a324219c24c2a1439ae2d6e4185d0c0f..de11ee0b45e9a725c3ff7514be10ac7e3b0c71dc 100644
+--- a/base/selinux/src/pki.if
++++ b/base/selinux/src/pki.if
+@@ -158,6 +158,7 @@ template(`pki_ca_template',`
+         corecmd_search_bin($1_t)
+ 
+ 	dev_list_sysfs($1_t)
++        dev_read_sysfs($1_t)
+ 	dev_read_rand($1_t)
+ 	dev_read_urand($1_t)
+ 
+diff --git a/base/selinux/src/pki.te b/base/selinux/src/pki.te
+index 846057b3aa93f0c20344f26c4baf9bb8b1919775..0dd0bba0c5213dda55fe157983d8e091f717db13 100644
+--- a/base/selinux/src/pki.te
++++ b/base/selinux/src/pki.te
+@@ -1,4 +1,4 @@
+-policy_module(pki,6.4.2)
++policy_module(pki,6.4.3)
+ 
+ attribute pki_ca_config;
+ attribute pki_ca_executable;
+-- 
+1.7.1
+
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 51ab6918a2424bc07d776f7fd567e2112dfc1f5b..cec176945522eea9d8c9f6c84480a9c5756eeda7 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -1,6 +1,6 @@
 Name:             pki-core
 Version:          9.0.3
-Release:          31%{?dist}
+Release:          32%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -68,6 +68,7 @@ Patch33:          %{name}-%{version}-bz885790.patch
 Patch34:          %{name}-%{version}-bz891985.patch
 Patch35:          %{name}-%{version}-bz902474.patch
 Patch36:          %{name}-%{version}-bz895702.patch
+Patch37:          %{name}-%{version}-bz999055.patch
 
 
 %if 0%{?rhel}
@@ -88,7 +89,7 @@ fi;
 FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
 selinuxenabled; \
 if [ $? == 0  -a "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT}.%{name} ]; then \
-     fixfiles -C ${FILE_CONTEXT}.%{name} restore; \
+     fixfiles -C ${FILE_CONTEXT}.%{name} restore > /dev/null 2>&1; \
      rm -f ${FILE_CONTEXT}.%name; \
 fi;
 
@@ -452,6 +453,7 @@ This package is a part of the PKI Core used by the Certificate System.
 %patch34 -p1 -b .p34
 %patch35 -p1 -b .p35
 %patch36 -p1 -b .p36
+%patch37 -p1 -b .p37
 
 %clean
 %{__rm} -rf %{buildroot}
@@ -530,7 +532,7 @@ fi
 %post -n pki-ca
 # This adds the proper /etc/rc*.d links for the script
 /sbin/chkconfig --add pki-cad || :
-/sbin/restorecon -Fr %{_localstatedir}/run/pki/ca || :
+/sbin/restorecon -Fr %{_localstatedir}/run/pki/ca >/dev/null 2>&1 || :
 %fix_tomcat_log ca
 
 %preun -n pki-ca
@@ -687,6 +689,10 @@ fi
 
 
 %changelog
+* Thu Aug 29 2013 Ade Lee <alee@redhat.com> 9.0.3-32
+- Resolves #999055 - AVC denials during ipa server and replica installs
+- Resolves #998715 - Package Sanity Test Failures
+
 * Fri Aug 9 2013 Ade Lee <alee@redhat.com> 9.0.3-31
 - Resolves #887305 - /var/run/pki/ca has wrong selinux context
 - Resolves #895702 - pki-cad restart avc denial
-- 
1.7.1

