nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

glusterfs: add tunable to allow managing unlabeled files

Browse Source 
If gluster ever experiences data corruption on its underlying bricks, a
situation may arise where the corrupted files have bad or missing
xattrs and are therefore presented as unlabeled to SELinux. Gluster will
then be unable to repair these files until the access is allowed or the
user manually relabels these files.

Signed-off-by: Kenton Groombridge <concord@gentoo.org>
This commit is contained in:
Kenton Groombridge 2023-12-17 23:04:53 -05:00
parent d7d41288b1
commit 43d529e90e
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
policy/modules/services/glusterfs.te
View File

@ -1,5 +1,16 @@
policy_module(glusterfs)
## <desc>
## <p>
## Allow the gluster daemon to manage unlabeled
## objects. This could happen if the underlying
## gluster brick experiences data corruption
## and you want to allow gluster to handle
## files with corrupted or missing xattrs.
## </p>
## </desc>
gen_tunable(glusterfs_manage_unlabeled, false)
## <desc>
## <p>
## Allow the gluster daemon to automatically
@ -152,6 +163,14 @@ userdom_dontaudit_search_user_runtime_root(glusterd_t)
xdg_dontaudit_search_data_dirs(glusterd_t)
tunable_policy(`glusterfs_manage_unlabeled',`
kernel_manage_unlabeled_dirs(glusterd_t)
kernel_manage_unlabeled_files(glusterd_t)
kernel_manage_unlabeled_symlinks(glusterd_t)
kernel_manage_unlabeled_blk_files(glusterd_t)
kernel_manage_unlabeled_chr_files(glusterd_t)
')
tunable_policy(`glusterfs_modify_policy',`
# needed by relabeling hooks when adding bricks
seutil_domtrans_semanage(glusterd_t)