diff options
| author | Brian Foster <bfoster@redhat.com> | 2014-01-02 14:03:18 -0500 |
|---|---|---|
| committer | Kaleb KEITHLEY <kkeithle@redhat.com> | 2017-05-01 09:30:01 +0000 |
| commit | 859669759f7fa0f2114add13660ce3bf16c77f30 (patch) | |
| tree | af766c9376eebb0a37fe8c298f9016403b386907 /extras/hook-scripts/delete | |
| parent | c6dd1e68dfe60e747e318a9e28a067e24576fdb6 (diff) | |
extras/hook-scripts: SELinux brick file context management scripts
The SELinux policy for gluster defines the glusterd_brick_t type to
support server side SELinux (e.g., server side labels). Add
convenience hook scripts that users/packagers can install to ensure
that new bricks are labeled correctly.
The volume create hook script adds a new SELinux file context for
each brick path and runs a restorecon to label the brick. The
volume delete hook removes the per-brick SELinux file context.
Change-Id: I5f102db5382d813c4d822ff74e873a7a669b41db
BUG: 1047975
Signed-off-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Niels de Vos <ndevos@redhat.com>
Signed-off-by: Jiffin Tony Thottan <jthottan@redhat.com>
Reviewed-on: https://review.gluster.org/6630
Smoke: Gluster Build System <jenkins@build.gluster.org>
NetBSD-regression: NetBSD Build System <jenkins@build.gluster.org>
CentOS-regression: Gluster Build System <jenkins@build.gluster.org>
Reviewed-by: Kaleb KEITHLEY <kkeithle@redhat.com>
Diffstat (limited to 'extras/hook-scripts/delete')
| -rw-r--r-- | extras/hook-scripts/delete/Makefile.am | 1 | ||||
| -rw-r--r-- | extras/hook-scripts/delete/pre/Makefile.am | 6 | ||||
| -rwxr-xr-x | extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh | 62 |
3 files changed, 69 insertions, 0 deletions
diff --git a/extras/hook-scripts/delete/Makefile.am b/extras/hook-scripts/delete/Makefile.am new file mode 100644 index 00000000000..c98a05d9205 --- /dev/null +++ b/extras/hook-scripts/delete/Makefile.am @@ -0,0 +1 @@ +SUBDIRS = pre diff --git a/extras/hook-scripts/delete/pre/Makefile.am b/extras/hook-scripts/delete/pre/Makefile.am new file mode 100644 index 00000000000..bf0eabe255c --- /dev/null +++ b/extras/hook-scripts/delete/pre/Makefile.am @@ -0,0 +1,6 @@ +EXTRA_DIST = S10selinux-del-fcontext.sh + +scriptsdir = $(GLUSTERD_WORKDIR)/hooks/1/delete/pre/ +if USE_SELINUX +scripts_SCRIPTS = S10selinux-del-fcontext.sh +endif diff --git a/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh b/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh new file mode 100755 index 00000000000..2c83331d5cd --- /dev/null +++ b/extras/hook-scripts/delete/pre/S10selinux-del-fcontext.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# +# Install to hooks/<HOOKS_VER>/delete/pre +# +# Delete the file context associated with the brick path on volume deletion. The +# associated file context was added during volume creation. +# +# We do not explicitly relabel the brick, as this could be time consuming and +# unnecessary. +# +### + +PROGNAME="Sselinux" +OPTSPEC="volname:" +VOL= +CONFIGFILE= +LOGFILEBASE= +PIDDIR= + +function parse_args () { + ARGS=$(getopt -l $OPTSPEC -name $PROGNAME $@) + eval set -- "$ARGS" + + while true; do + case $1 in + --volname) + shift + VOL=$1 + ;; + *) + shift + break + ;; + esac + shift + done +} + +function delete_brick_fcontext() +{ + volname=$1 + + # grab the path for each local brick + brickdirs=$(grep '^path=' /var/lib/glusterd/vols/${volname}/bricks/* | cut -d= -f 2) + + for b in $brickdirs + do + # remove the file context associated with the brick path + semanage fcontext --delete $b\(/.*\)? + done +} + +SELINUX_STATE=$(which getenforce && getenforce) +[ "${SELINUX_STATE}" = 'Disabled' ] && exit 0 + +parse_args $@ +[ -z "$VOL" ] && exit 1 + +delete_brick_fcontext $VOL + +# failure to delete the fcontext is not fatal +exit 0 |