[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Kenton Groombridge]

commit:     42804a679a2ca17bb67d9c0cb887202f95d105ee
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Mon Sep 26 21:00:18 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Wed Nov  2 14:07:20 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=42804a67

glusterfs: add type for glusterd hooks

Add a private type for glusterd hooks in order to enforce W^X for them.

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/services/glusterfs.fc | 1 +
 policy/modules/services/glusterfs.if | 3 ++-
 policy/modules/services/glusterfs.te | 8 ++++++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/policy/modules/services/glusterfs.fc b/policy/modules/services/glusterfs.fc
index 158a4a85e..50bd93604 100644
--- a/policy/modules/services/glusterfs.fc
+++ b/policy/modules/services/glusterfs.fc
@@ -12,6 +12,7 @@
 /opt/glusterfs/[^/]+/sbin/glusterfsd	--	gen_context(system_u:object_r:glusterd_exec_t,s0)
 
 /var/lib/gluster.*		gen_context(system_u:object_r:glusterd_var_lib_t,s0)
+/var/lib/glusterd/hooks(/.*)?		gen_context(system_u:object_r:glusterd_hook_t,s0)
 
 /var/log/glusterfs(/.*)?		gen_context(system_u:object_r:glusterd_log_t,s0)
 

diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if
index 5e6af0ecc..ab5c8a4da 100644
--- a/policy/modules/services/glusterfs.if
+++ b/policy/modules/services/glusterfs.if
@@ -105,7 +105,7 @@ interface(`glusterfs_admin',`
 	gen_require(`
 		type glusterd_t, glusterd_initrc_exec_t, glusterd_log_t;
 		type glusterd_tmp_t, glusterd_conf_t, glusterd_var_lib_t;
-		type glusterd_runtime_t, glusterd_brick_t;
+		type glusterd_hook_t, glusterd_runtime_t, glusterd_brick_t;
 	')
 
 	glusterfs_run_daemon($1, $2)
@@ -128,6 +128,7 @@ interface(`glusterfs_admin',`
 
 	files_search_var_lib($1)
 	admin_pattern($1, glusterd_var_lib_t)
+	admin_pattern($1, glusterd_hook_t)
 
 	files_search_runtime($1)
 	admin_pattern($1, glusterd_runtime_t)

diff --git a/policy/modules/services/glusterfs.te b/policy/modules/services/glusterfs.te
index 85a55ed5b..c46215be1 100644
--- a/policy/modules/services/glusterfs.te
+++ b/policy/modules/services/glusterfs.te
@@ -40,6 +40,9 @@ files_type(glusterd_var_lib_t)
 type glusterd_brick_t;
 files_type(glusterd_brick_t)
 
+type glusterd_hook_t;
+files_type(glusterd_hook_t)
+
 ########################################
 #
 # Local policy
@@ -77,6 +80,11 @@ manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
 manage_lnk_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
 files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, dir)
 
+list_dirs_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t)
+read_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t)
+read_lnk_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t)
+can_exec(glusterd_t, glusterd_hook_t)
+
 manage_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
 manage_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
 manage_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)