commit: 42804a679a2ca17bb67d9c0cb887202f95d105ee Author: Kenton Groombridge <me <AT> concord <DOT> sh> AuthorDate: Mon Sep 26 21:00:18 2022 +0000 Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org> CommitDate: Wed Nov 2 14:07:20 2022 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=42804a67
glusterfs: add type for glusterd hooks Add a private type for glusterd hooks in order to enforce W^X for them. Signed-off-by: Kenton Groombridge <me <AT> concord.sh> Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org> policy/modules/services/glusterfs.fc | 1 + policy/modules/services/glusterfs.if | 3 ++- policy/modules/services/glusterfs.te | 8 ++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/glusterfs.fc b/policy/modules/services/glusterfs.fc index 158a4a85e..50bd93604 100644 --- a/policy/modules/services/glusterfs.fc +++ b/policy/modules/services/glusterfs.fc @@ -12,6 +12,7 @@ /opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0) /var/lib/gluster.* gen_context(system_u:object_r:glusterd_var_lib_t,s0) +/var/lib/glusterd/hooks(/.*)? gen_context(system_u:object_r:glusterd_hook_t,s0) /var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0) diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if index 5e6af0ecc..ab5c8a4da 100644 --- a/policy/modules/services/glusterfs.if +++ b/policy/modules/services/glusterfs.if @@ -105,7 +105,7 @@ interface(`glusterfs_admin',` gen_require(` type glusterd_t, glusterd_initrc_exec_t, glusterd_log_t; type glusterd_tmp_t, glusterd_conf_t, glusterd_var_lib_t; - type glusterd_runtime_t, glusterd_brick_t; + type glusterd_hook_t, glusterd_runtime_t, glusterd_brick_t; ') glusterfs_run_daemon($1, $2) @@ -128,6 +128,7 @@ interface(`glusterfs_admin',` files_search_var_lib($1) admin_pattern($1, glusterd_var_lib_t) + admin_pattern($1, glusterd_hook_t) files_search_runtime($1) admin_pattern($1, glusterd_runtime_t) diff --git a/policy/modules/services/glusterfs.te b/policy/modules/services/glusterfs.te index 85a55ed5b..c46215be1 100644 --- a/policy/modules/services/glusterfs.te +++ b/policy/modules/services/glusterfs.te @@ -40,6 +40,9 @@ files_type(glusterd_var_lib_t) type glusterd_brick_t; files_type(glusterd_brick_t) +type glusterd_hook_t; +files_type(glusterd_hook_t) + ######################################## # # Local policy @@ -77,6 +80,11 @@ manage_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) manage_lnk_files_pattern(glusterd_t, glusterd_var_lib_t, glusterd_var_lib_t) files_var_lib_filetrans(glusterd_t, glusterd_var_lib_t, dir) +list_dirs_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +read_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +read_lnk_files_pattern(glusterd_t, glusterd_hook_t, glusterd_hook_t) +can_exec(glusterd_t, glusterd_hook_t) + manage_dirs_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t) manage_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t) manage_chr_files_pattern(glusterd_t, glusterd_brick_t, glusterd_brick_t)