[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/

["Kenton Groombridge" <concord@gentoo.org>]

commit:     95006bc2eacf58bf5d47246f7e431aa4ea6f64a1
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Sat Sep 24 17:05:00 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Wed Nov  2 14:07:17 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=95006bc2

selinuxutil: allow semanage, setfiles to inherit gluster fds

The Gluster daemon uses a hook which adds a file context for gluster
bricks when they are created via the use of 'semanage fcontex -a'.

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/services/glusterfs.if | 18 ++++++++++++++++++
 policy/modules/system/selinuxutil.te |  9 +++++++++
 2 files changed, 27 insertions(+)

diff --git a/policy/modules/services/glusterfs.if b/policy/modules/services/glusterfs.if
index 328818ad3..5e6af0ecc 100644
--- a/policy/modules/services/glusterfs.if
+++ b/policy/modules/services/glusterfs.if
@@ -66,6 +66,24 @@ interface(`glusterfs_stream_connect_daemon',`
 	allow $1 glusterd_runtime_t:sock_file read_sock_file_perms;
 ')
 
+########################################
+## <summary>
+##	Inherit and use glusterd file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`glusterfs_use_daemon_fds',`
+	gen_require(`
+		type glusterd_t;
+	')
+
+	allow $1 glusterd_t:fd use;
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index d3678246a..14a17175f 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -208,6 +208,11 @@ ifdef(`distro_ubuntu',`
 	')
 ')
 
+optional_policy(`
+	# glusterd calls semanage fcontext
+	glusterfs_use_daemon_fds(load_policy_t)
+')
+
 optional_policy(`
 	portage_dontaudit_use_fds(load_policy_t)
 ')
@@ -693,6 +698,10 @@ optional_policy(`
 	apt_use_fds(setfiles_t)
 ')
 
+optional_policy(`
+	glusterfs_use_daemon_fds(setfiles_t)
+')
+
 optional_policy(`
         # leaked file descriptors
         udev_dontaudit_rw_dgram_sockets(setfiles_t)