diff options
| author |   Kenton Groombridge <me@concord.sh> | 2022-09-26 17:00:18 -0400 |
|---|---|---|
| committer |   Kenton Groombridge <concord@gentoo.org> | 2022-11-02 10:07:20 -0400 |
| commit | 42804a679a2ca17bb67d9c0cb887202f95d105ee (patch) | |
| tree | b0677e7db3e0afe7a89d94a89480925bdddf9ce0 | |
| parent | glusterfs, selinuxutil: make modifying fcontexts a tunable (diff) | |
| download | hardened-refpolicy-42804a679a2ca17bb67d9c0cb887202f95d105ee.tar.gz hardened-refpolicy-42804a679a2ca17bb67d9c0cb887202f95d105ee.tar.bz2 hardened-refpolicy-42804a679a2ca17bb67d9c0cb887202f95d105ee.zip | |
glusterfs: add type for glusterd hooks
Add a private type for glusterd hooks in order to enforce W^X for them.
Signed-off-by: Kenton Groombridge <me@concord.sh>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
| -rw-r--r-- | policy/modules/services/glusterfs.fc | 1 | ||||
| -rw-r--r-- | policy/modules/services/glusterfs.if | 3 | ||||
| -rw-r--r-- | policy/modules/services/glusterfs.te | 8 |
3 files changed, 11 insertions, 1 deletions
diff --git a/policy/modules/services/glusterfs.fc b/policy/modules/services/glusterfs.fc index 158a4a85e..50bd93604 100644 --- a/policy/modules/services/glusterfs.fc +++ b/policy/modules/services/glusterfs.fc @@ -12,6 +12,7 @@ /opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0) /var/lib/gluster.* gen_context(system_u:object_r:glusterd_var_lib_t,s0) +/var/lib/glusterd/hooks(/.*)? gen_context(system_u:object_r:glusterd_hook_t,s0) /var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0) diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if index 5e6af0ecc..ab5c8a4da 100644 --- a/policy/modules/services/glusterfs.if +++ b/policy/modules/services/glusterfs.if @@ -105,7 +105,7 @@ interface(`glusterfs_admin',` gen_require(` type glusterd_t, glusterd_initrc_exec_t, glusterd_log_t; type glusterd_tmp_t, glusterd_conf_t, glusterd_var_lib_t; - type glusterd_runtime_t, glusterd_brick_t; + type glusterd_hook_t, glusterd_runtime_t, glusterd_brick_t; ') glusterfs_run_daemon($1, $2) @@ -128,6 +128,7 @@ interface(`glusterfs_admin',` files_search_var_lib($1) admin_pattern($1, glusterd_var_lib_t) + admin_pattern($1, glusterd_hook_t) files_search_runtime($1) admin_pattern($1, glusterd_runtime_t) diff --git a/policy/modules/services/glusterfs.te b/policy/modules/services/glusterfs.te index 85a55ed5b..c46215be1 100644 --- a/policy/modules/services/glusterfs.te +++ b/policy/modules/services/glusterfs.te @@ -40,6 +40,9 @@ files_type(glusterd_var_lib_t) type glusterd_brick_t; files_type(glusterd_brick_t) +type glusterd_hook_t; +files_type(glusterd_hook_t) + ######################################## # # Local policy @@ -77,6 +80,11 @@ manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) manage_lnk_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, dir) +list_dirs_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +read_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +read_lnk_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +can_exec(glusterd_t, glusterd_hook_t) + manage_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t) manage_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t) manage_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t) |