From 859669759f7fa0f2114add13660ce3bf16c77f30 Mon Sep 17 00:00:00 2001 From: Brian Foster Date: Thu, 2 Jan 2014 14:03:18 -0500 Subject: extras/hook-scripts: SELinux brick file context management scripts The SELinux policy for gluster defines the glusterd_brick_t type to support server side SELinux (e.g., server side labels). Add convenience hook scripts that users/packagers can install to ensure that new bricks are labeled correctly. The volume create hook script adds a new SELinux file context for each brick path and runs a restorecon to label the brick. The volume delete hook removes the per-brick SELinux file context. Change-Id: I5f102db5382d813c4d822ff74e873a7a669b41db BUG: 1047975 Signed-off-by: Brian Foster Signed-off-by: Niels de Vos Signed-off-by: Jiffin Tony Thottan Reviewed-on: https://review.gluster.org/6630 Smoke: Gluster Build System NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Kaleb KEITHLEY --- extras/hook-scripts/Makefile.am | 2 +- extras/hook-scripts/create/Makefile.am | 1 + extras/hook-scripts/create/post/Makefile.am | 6 +++ .../create/post/S10selinux-label-brick.sh | 61 +++++++++++++++++++++ extras/hook-scripts/delete/Makefile.am | 1 + extras/hook-scripts/delete/pre/Makefile.am | 6 +++ .../delete/pre/S10selinux-del-fcontext.sh | 62 ++++++++++++++++++++++ 7 files changed, 138 insertions(+), 1 deletion(-) create mode 100644 extras/hook-scripts/create/Makefile.am create mode 100644 extras/hook-scripts/create/post/Makefile.am create mode 100755 extras/hook-scripts/create/post/S10selinux-label-brick.sh create mode 100644 extras/hook-scripts/delete/Makefile.am create mode 100644 extras/hook-scripts/delete/pre/Makefile.am create mode 100755 extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh (limited to 'extras') diff --git a/extras/hook-scripts/Makefile.am b/extras/hook-scripts/Makefile.am index 771b37e3fd..26059d7dbb 100644 --- a/extras/hook-scripts/Makefile.am +++ b/extras/hook-scripts/Makefile.am @@ -1,5 +1,5 @@ EXTRA_DIST = S40ufo-stop.py S56glusterd-geo-rep-create-post.sh -SUBDIRS = add-brick set start stop reset +SUBDIRS = add-brick create delete set start stop reset scriptsdir = $(GLUSTERD_WORKDIR)/hooks/1/gsync-create/post/ if USE_GEOREP diff --git a/extras/hook-scripts/create/Makefile.am b/extras/hook-scripts/create/Makefile.am new file mode 100644 index 0000000000..b083a9145d --- /dev/null +++ b/extras/hook-scripts/create/Makefile.am @@ -0,0 +1 @@ +SUBDIRS = post diff --git a/extras/hook-scripts/create/post/Makefile.am b/extras/hook-scripts/create/post/Makefile.am new file mode 100644 index 0000000000..adbce78d24 --- /dev/null +++ b/extras/hook-scripts/create/post/Makefile.am @@ -0,0 +1,6 @@ +EXTRA_DIST = S10selinux-label-brick.sh + +scriptsdir = $(GLUSTERD_WORKDIR)/hooks/1/create/post/ +if USE_SELINUX +scripts_SCRIPTS = S10selinux-label-brick.sh +endif diff --git a/extras/hook-scripts/create/post/S10selinux-label-brick.sh b/extras/hook-scripts/create/post/S10selinux-label-brick.sh new file mode 100755 index 0000000000..d69a938123 --- /dev/null +++ b/extras/hook-scripts/create/post/S10selinux-label-brick.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# +# Install to hooks//create/post +# +# Add an SELinux file context for each brick using the glusterd_brick_t type. +# This ensures that the brick is relabeled correctly on an SELinux restart or +# restore. Subsequently, run a restore on the brick path to set the selinux +# labels. +# +### + +PROGNAME="Sselinux" +OPTSPEC="volname:" +VOL= + +function parse_args () { + ARGS=$(getopt -l $OPTSPEC -name $PROGNAME $@) + eval set -- "$ARGS" + + while true; do + case $1 in + --volname) + shift + VOL=$1 + ;; + *) + shift + break + ;; + esac + shift + done +} + +function set_brick_labels() +{ + volname=$1 + + # grab the path for each local brick + brickdirs=$(grep '^path=' /var/lib/glusterd/vols/${volname}/bricks/* | cut -d= -f 2) + + for b in $brickdirs + do + # Add a file context for each brick path and associate with the + # glusterd_brick_t SELinux type. + semanage fcontext --add -t glusterd_brick_t -r s0 $b(/.*)? + + # Set the labels on the new brick path. + restorecon -R $b + done +} + +SELINUX_STATE=$(which getenforce && getenforce) +[ "${SELINUX_STATE}" = 'Disabled' ] && exit 0 + +parse_args $@ +[ -z "$VOL" ] && exit 1 + +set_brick_labels $VOL + +exit 0 diff --git a/extras/hook-scripts/delete/Makefile.am b/extras/hook-scripts/delete/Makefile.am new file mode 100644 index 0000000000..c98a05d920 --- /dev/null +++ b/extras/hook-scripts/delete/Makefile.am @@ -0,0 +1 @@ +SUBDIRS = pre diff --git a/extras/hook-scripts/delete/pre/Makefile.am b/extras/hook-scripts/delete/pre/Makefile.am new file mode 100644 index 0000000000..bf0eabe255 --- /dev/null +++ b/extras/hook-scripts/delete/pre/Makefile.am @@ -0,0 +1,6 @@ +EXTRA_DIST = S10selinux-del-fcontext.sh + +scriptsdir = $(GLUSTERD_WORKDIR)/hooks/1/delete/pre/ +if USE_SELINUX +scripts_SCRIPTS = S10selinux-del-fcontext.sh +endif diff --git a/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh b/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh new file mode 100755 index 0000000000..2c83331d5c --- /dev/null +++ b/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# +# Install to hooks//delete/pre +# +# Delete the file context associated with the brick path on volume deletion. The +# associated file context was added during volume creation. +# +# We do not explicitly relabel the brick, as this could be time consuming and +# unnecessary. +# +### + +PROGNAME="Sselinux" +OPTSPEC="volname:" +VOL= +CONFIGFILE= +LOGFILEBASE= +PIDDIR= + +function parse_args () { + ARGS=$(getopt -l $OPTSPEC -name $PROGNAME $@) + eval set -- "$ARGS" + + while true; do + case $1 in + --volname) + shift + VOL=$1 + ;; + *) + shift + break + ;; + esac + shift + done +} + +function delete_brick_fcontext() +{ + volname=$1 + + # grab the path for each local brick + brickdirs=$(grep '^path=' /var/lib/glusterd/vols/${volname}/bricks/* | cut -d= -f 2) + + for b in $brickdirs + do + # remove the file context associated with the brick path + semanage fcontext --delete $b\(/.*\)? + done +} + +SELINUX_STATE=$(which getenforce && getenforce) +[ "${SELINUX_STATE}" = 'Disabled' ] && exit 0 + +parse_args $@ +[ -z "$VOL" ] && exit 1 + +delete_brick_fcontext $VOL + +# failure to delete the fcontext is not fatal +exit 0 -- cgit