selinux-policy/selinux-policy — pull request #6 by wtogami (2014-11-13 00:32:49+00:00)
Title: Couchdb policy fixes

```
type=AVC msg=audit(1415836839.090:584): avc: denied { execmem } for pid=18668 comm="couchjs" scontext=system_u:system_r:couchdb_t:s0 tcontext=system_u:system_r:couchdb_t:s0 tclass=process permissive=0
```

The first commit creates a separate context to execute couchjs in isolation which allows execmem. This was copied from the Tresys refpolicy-contrib.

```
type=AVC msg=audit(1415836773.817:579): avc: denied { search } for pid=16934 comm="df" name="nfs" dev="dm-1" ino=4458965 scontext=system_u:system_r:couchdb_t:s0 tcontext=system_u:object_r:var_lib_nfs_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1415836773.817:580): avc: denied { getattr } for pid=16934 comm="df" path="/home/warren" dev="dm-3" ino=2 scontext=system_u:system_r:couchdb_t:s0 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1415836773.817:581): avc: denied { getattr } for pid=16934 comm="df" path="/home/warren" dev="dm-3" ino=2 scontext=system_u:system_r:couchdb_t:s0 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0
```

The second commit allows couchdb (via diskup) to monitor the status of the disks.