From c6391433b67f7ab4eab7f85e080aec11019acf2c Mon Sep 17 00:00:00 2001
From: Anoop C S <anoopcs@redhat.com>
Date: Thu, 6 Jun 2019 18:33:19 +0530
Subject: extras/hooks: Add SELinux label on new bricks during add-brick

Backport of:
> Change-Id: Ifd8ae5eeb91b968cc1a9a9b5d15844c5233d56db
> fixes: bz#1717953
> Signed-off-by: Anoop C S <anoopcs@redhat.com>

Change-Id: Ifd8ae5eeb91b968cc1a9a9b5d15844c5233d56db
fixes: bz#1718227
Signed-off-by: Anoop C S <anoopcs@redhat.com>
(cherry picked from commit 582f91fcad42b6b7da653d2a587d196a7a1e0204)
---
 .../add-brick/post/S10selinux-label-brick.sh       | 100 +++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100755 extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh

(limited to 'extras')

diff --git a/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh b/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh
new file mode 100755
index 00000000000..4a17c993a77
--- /dev/null
+++ b/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+#
+# Install to hooks/<HOOKS_VER>/add-brick/post
+#
+# Add an SELinux file context for each brick using the glusterd_brick_t type.
+# This ensures that the brick is relabeled correctly on an SELinux restart or
+# restore. Subsequently, run a restore on the brick path to set the selinux
+# labels.
+#
+###
+
+PROGNAME="Sselinux"
+OPTSPEC="volname:,version:,gd-workdir:,volume-op:"
+VOL=
+
+parse_args () {
+  ARGS=$(getopt -o '' -l ${OPTSPEC} -n ${PROGNAME} -- "$@")
+  eval set -- "${ARGS}"
+
+  while true; do
+    case ${1} in
+      --volname)
+        shift
+        VOL=${1}
+        ;;
+      --gd-workdir)
+          shift
+          GLUSTERD_WORKDIR=$1
+          ;;
+      --version)
+          shift
+          ;;
+      --volume-op)
+          shift
+          ;;
+      *)
+          shift
+          break
+          ;;
+    esac
+    shift
+  done
+}
+
+set_brick_labels()
+{
+  local volname="${1}"
+  local fctx
+  local list=()
+
+  fctx="$(semanage fcontext --list -C)"
+
+  # wait for new brick path to be updated under
+  # ${GLUSTERD_WORKDIR}/vols/${volname}/bricks/
+  sleep 5
+
+  # grab the path for each local brick
+  brickpath="${GLUSTERD_WORKDIR}/vols/${volname}/bricks/"
+  brickdirs=$(
+    find "${brickpath}" -type f -exec grep '^path=' {} \; | \
+    cut -d= -f 2 | \
+    sort -u
+  )
+
+  # create a list of bricks for which custom SELinux
+  # label doesn't exist
+  for b in ${brickdirs}; do
+    pattern="${b}(/.*)?"
+    echo "${fctx}" | grep "^${pattern}\s" >/dev/null
+    if [[ $? -ne 0 ]]; then
+      list+=("${pattern}")
+    fi
+  done
+
+  # Add a file context for each brick path in the list and associate with the
+  # glusterd_brick_t SELinux type.
+  for p in ${list[@]}
+  do
+    semanage fcontext --add -t glusterd_brick_t -r s0 "${p}"
+  done
+
+  # Set the labels for which SELinux label was added above
+  for b in ${brickdirs}
+  do
+    echo "${list[@]}" | grep "${b}" >/dev/null
+    if [[ $? -eq 0 ]]; then
+      restorecon -R "${b}"
+    fi
+  done
+}
+
+SELINUX_STATE=$(which getenforce && getenforce)
+[ "${SELINUX_STATE}" = 'Disabled' ] && exit 0
+
+parse_args "$@"
+[ -z "${VOL}" ] && exit 1
+
+set_brick_labels "${VOL}"
+
+exit 0
-- 
cgit