|
 |
ca3909 |
From dcf3f74fa7e812dfe89667bd6219f70a8457f755 Mon Sep 17 00:00:00 2001
|
|
|
ca3909 |
From: Anoop C S <anoopcs@redhat.com>
|
|
|
ca3909 |
Date: Thu, 6 Jun 2019 18:33:19 +0530
|
|
|
ca3909 |
Subject: [PATCH 324/335] extras/hooks: Add SELinux label on new bricks during
|
|
|
ca3909 |
add-brick
|
|
|
ca3909 |
|
|
|
ca3909 |
Backport of https://review.gluster.org/c/glusterfs/+/22834
|
|
|
ca3909 |
|
|
|
ca3909 |
Change-Id: Ifd8ae5eeb91b968cc1a9a9b5d15844c5233d56db
|
|
|
ca3909 |
BUG: 1686800
|
|
|
ca3909 |
Signed-off-by: Anoop C S <anoopcs@redhat.com>
|
|
|
ca3909 |
Reviewed-on: https://code.engineering.redhat.com/gerrit/185855
|
|
|
ca3909 |
Tested-by: RHGS Build Bot <nigelb@redhat.com>
|
|
|
ca3909 |
Reviewed-by: Sunil Kumar Heggodu Gopala Acharya <sheggodu@redhat.com>
|
|
|
ca3909 |
---
|
|
|
ca3909 |
.../add-brick/post/S10selinux-label-brick.sh | 100 +++++++++++++++++++++
|
|
|
ca3909 |
1 file changed, 100 insertions(+)
|
|
|
ca3909 |
create mode 100755 extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh
|
|
|
ca3909 |
|
|
|
ca3909 |
diff --git a/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh b/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh
|
|
|
ca3909 |
new file mode 100755
|
|
|
ca3909 |
index 0000000..4a17c99
|
|
|
ca3909 |
--- /dev/null
|
|
|
ca3909 |
+++ b/extras/hook-scripts/add-brick/post/S10selinux-label-brick.sh
|
|
|
ca3909 |
@@ -0,0 +1,100 @@
|
|
|
ca3909 |
+#!/bin/bash
|
|
|
ca3909 |
+#
|
|
|
ca3909 |
+# Install to hooks/<HOOKS_VER>/add-brick/post
|
|
|
ca3909 |
+#
|
|
|
ca3909 |
+# Add an SELinux file context for each brick using the glusterd_brick_t type.
|
|
|
ca3909 |
+# This ensures that the brick is relabeled correctly on an SELinux restart or
|
|
|
ca3909 |
+# restore. Subsequently, run a restore on the brick path to set the selinux
|
|
|
ca3909 |
+# labels.
|
|
|
ca3909 |
+#
|
|
|
ca3909 |
+###
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+PROGNAME="Sselinux"
|
|
|
ca3909 |
+OPTSPEC="volname:,version:,gd-workdir:,volume-op:"
|
|
|
ca3909 |
+VOL=
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+parse_args () {
|
|
|
ca3909 |
+ ARGS=$(getopt -o '' -l ${OPTSPEC} -n ${PROGNAME} -- "$@")
|
|
|
ca3909 |
+ eval set -- "${ARGS}"
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ while true; do
|
|
|
ca3909 |
+ case ${1} in
|
|
|
ca3909 |
+ --volname)
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ VOL=${1}
|
|
|
ca3909 |
+ ;;
|
|
|
ca3909 |
+ --gd-workdir)
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ GLUSTERD_WORKDIR=$1
|
|
|
ca3909 |
+ ;;
|
|
|
ca3909 |
+ --version)
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ ;;
|
|
|
ca3909 |
+ --volume-op)
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ ;;
|
|
|
ca3909 |
+ *)
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ break
|
|
|
ca3909 |
+ ;;
|
|
|
ca3909 |
+ esac
|
|
|
ca3909 |
+ shift
|
|
|
ca3909 |
+ done
|
|
|
ca3909 |
+}
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+set_brick_labels()
|
|
|
ca3909 |
+{
|
|
|
ca3909 |
+ local volname="${1}"
|
|
|
ca3909 |
+ local fctx
|
|
|
ca3909 |
+ local list=()
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ fctx="$(semanage fcontext --list -C)"
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ # wait for new brick path to be updated under
|
|
|
ca3909 |
+ # ${GLUSTERD_WORKDIR}/vols/${volname}/bricks/
|
|
|
ca3909 |
+ sleep 5
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ # grab the path for each local brick
|
|
|
ca3909 |
+ brickpath="${GLUSTERD_WORKDIR}/vols/${volname}/bricks/"
|
|
|
ca3909 |
+ brickdirs=$(
|
|
|
ca3909 |
+ find "${brickpath}" -type f -exec grep '^path=' {} \; | \
|
|
|
ca3909 |
+ cut -d= -f 2 | \
|
|
|
ca3909 |
+ sort -u
|
|
|
ca3909 |
+ )
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ # create a list of bricks for which custom SELinux
|
|
|
ca3909 |
+ # label doesn't exist
|
|
|
ca3909 |
+ for b in ${brickdirs}; do
|
|
|
ca3909 |
+ pattern="${b}(/.*)?"
|
|
|
ca3909 |
+ echo "${fctx}" | grep "^${pattern}\s" >/dev/null
|
|
|
ca3909 |
+ if [[ $? -ne 0 ]]; then
|
|
|
ca3909 |
+ list+=("${pattern}")
|
|
|
ca3909 |
+ fi
|
|
|
ca3909 |
+ done
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ # Add a file context for each brick path in the list and associate with the
|
|
|
ca3909 |
+ # glusterd_brick_t SELinux type.
|
|
|
ca3909 |
+ for p in ${list[@]}
|
|
|
ca3909 |
+ do
|
|
|
ca3909 |
+ semanage fcontext --add -t glusterd_brick_t -r s0 "${p}"
|
|
|
ca3909 |
+ done
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+ # Set the labels for which SELinux label was added above
|
|
|
ca3909 |
+ for b in ${brickdirs}
|
|
|
ca3909 |
+ do
|
|
|
ca3909 |
+ echo "${list[@]}" | grep "${b}" >/dev/null
|
|
|
ca3909 |
+ if [[ $? -eq 0 ]]; then
|
|
|
ca3909 |
+ restorecon -R "${b}"
|
|
|
ca3909 |
+ fi
|
|
|
ca3909 |
+ done
|
|
|
ca3909 |
+}
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+SELINUX_STATE=$(which getenforce && getenforce)
|
|
|
ca3909 |
+[ "${SELINUX_STATE}" = 'Disabled' ] && exit 0
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+parse_args "$@"
|
|
|
ca3909 |
+[ -z "${VOL}" ] && exit 1
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+set_brick_labels "${VOL}"
|
|
|
ca3909 |
+
|
|
|
ca3909 |
+exit 0
|
|
|
ca3909 |
--
|
|
|
ca3909 |
1.8.3.1
|
|
|
ca3909 |
|