1 |
commit: 95006bc2eacf58bf5d47246f7e431aa4ea6f64a1 |
2 |
Author: Kenton Groombridge <me <AT> concord <DOT> sh> |
3 |
AuthorDate: Sat Sep 24 17:05:00 2022 +0000 |
4 |
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Nov 2 14:07:17 2022 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=95006bc2 |
7 |
|
8 |
selinuxutil: allow semanage, setfiles to inherit gluster fds |
9 |
|
10 |
The Gluster daemon uses a hook which adds a file context for gluster |
11 |
bricks when they are created via the use of 'semanage fcontex -a'. |
12 |
|
13 |
Signed-off-by: Kenton Groombridge <me <AT> concord.sh> |
14 |
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org> |
15 |
|
16 |
policy/modules/services/glusterfs.if | 18 ++++++++++++++++++ |
17 |
policy/modules/system/selinuxutil.te | 9 +++++++++ |
18 |
2 files changed, 27 insertions(+) |
19 |
|
20 |
diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if |
21 |
index 328818ad3..5e6af0ecc 100644 |
22 |
--- a/policy/modules/services/glusterfs.if |
23 |
+++ b/policy/modules/services/glusterfs.if |
24 |
@@ -66,6 +66,24 @@ interface(`glusterfs_stream_connect_daemon',` |
25 |
allow $1 glusterd_runtime_t:sock_file read_sock_file_perms; |
26 |
') |
27 |
|
28 |
+######################################## |
29 |
+## <summary> |
30 |
+## Inherit and use glusterd file descriptors. |
31 |
+## </summary> |
32 |
+## <param name="domain"> |
33 |
+## <summary> |
34 |
+## Domain allowed access. |
35 |
+## </summary> |
36 |
+## </param> |
37 |
+# |
38 |
+interface(`glusterfs_use_daemon_fds',` |
39 |
+ gen_require(` |
40 |
+ type glusterd_t; |
41 |
+ ') |
42 |
+ |
43 |
+ allow $1 glusterd_t:fd use; |
44 |
+') |
45 |
+ |
46 |
######################################## |
47 |
## <summary> |
48 |
## All of the rules required to |
49 |
|
50 |
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te |
51 |
index d3678246a..14a17175f 100644 |
52 |
--- a/policy/modules/system/selinuxutil.te |
53 |
+++ b/policy/modules/system/selinuxutil.te |
54 |
@@ -208,6 +208,11 @@ ifdef(`distro_ubuntu',` |
55 |
') |
56 |
') |
57 |
|
58 |
+optional_policy(` |
59 |
+ # glusterd calls semanage fcontext |
60 |
+ glusterfs_use_daemon_fds(load_policy_t) |
61 |
+') |
62 |
+ |
63 |
optional_policy(` |
64 |
portage_dontaudit_use_fds(load_policy_t) |
65 |
') |
66 |
@@ -693,6 +698,10 @@ optional_policy(` |
67 |
apt_use_fds(setfiles_t) |
68 |
') |
69 |
|
70 |
+optional_policy(` |
71 |
+ glusterfs_use_daemon_fds(setfiles_t) |
72 |
+') |
73 |
+ |
74 |
optional_policy(` |
75 |
# leaked file descriptors |
76 |
udev_dontaudit_rw_dgram_sockets(setfiles_t) |