[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Kenton Groombridge]

commit:     44a2c3d605250b5c60034683bbcf5eaed59981d5
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Sat Sep 24 05:32:41 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Wed Nov  2 14:07:14 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=44a2c3d6

glusterfs: add type for gluster bricks

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/services/glusterfs.if |  6 +++++-
 policy/modules/services/glusterfs.te | 10 ++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if
index b2b485ede..328818ad3 100644
--- a/policy/modules/services/glusterfs.if
+++ b/policy/modules/services/glusterfs.if
@@ -87,7 +87,7 @@ interface(`glusterfs_admin',`
 	gen_require(`
 		type glusterd_t, glusterd_initrc_exec_t, glusterd_log_t;
 		type glusterd_tmp_t, glusterd_conf_t, glusterd_var_lib_t;
-		type glusterd_runtime_t;
+		type glusterd_runtime_t, glusterd_brick_t;
 	')
 
 	glusterfs_run_daemon($1, $2)
@@ -113,4 +113,8 @@ interface(`glusterfs_admin',`
 
 	files_search_runtime($1)
 	admin_pattern($1, glusterd_runtime_t)
+
+	# searching var for /srv
+	files_search_var($1)
+	admin_pattern($1, glusterd_brick_t)
 ')

diff --git a/policy/modules/services/glusterfs.te b/policy/modules/services/glusterfs.te
index 2d94845d9..690aa828a 100644
--- a/policy/modules/services/glusterfs.te
+++ b/policy/modules/services/glusterfs.te
@@ -27,6 +27,9 @@ files_tmp_file(glusterd_tmp_t)
 type glusterd_var_lib_t;
 files_type(glusterd_var_lib_t)
 
+type glusterd_brick_t;
+files_type(glusterd_brick_t)
+
 ########################################
 #
 # Local policy
@@ -64,6 +67,13 @@ manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
 manage_lnk_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t)
 files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, dir)
 
+manage_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_fifo_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_lnk_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+manage_sock_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)
+
 can_exec(glusterd_t, glusterd_exec_t)
 
 corenet_all_recvfrom_netlabel(glusterd_t)