local_settings.sh.in

#!/bin/bash

QUIET=1
MODE=0
ROOTDIR=${ROOTDIR:-/}
BINDIR=${BINDIR:-/usr/bin}
SBINDIR=${SBINDIR:-/sbin}
LOCALSTATEDIR=${LOCALSTATEDIR:-/var}
DATADIR=${DATADIR:-/usr/share}
SHAREDSTATEDIR=${SHAREDSTATEDIR:-/var/lib}
LOCALDIR=${LOCALDIR:-$DATADIR/openstack-selinux/master}
MODULES=${MODULES:-@MODULES@}

# This is for caching the file modes; -A is a bash associative
# array ("dict" or "map" in other languages)
# See bug for bug #1560019 for more information.
declare -A file_modes

do_echo() {
	if [ $QUIET -eq 0 ]; then
		return
	fi
	echo $*
}


relabel_files()
{
	local opts=""

	do_echo "Relabeling files..."
	if [ $QUIET -ne 0 ]; then
		opts="-v"
	fi

	# Setfiles is a lot like restorecon, except it takes a policy
	# on-disk instead of looking at the kernel-loaded policy
	# So, it works inside of image builds.
	#
	# At a minimum, we need a line for each entry we have where we are
	# custominzing the label using 'semanage' below, but also
	# others, when applicable.
	$SBINDIR/setfiles $opts -F $ROOTDIR/etc/selinux/targeted/contexts/files/file_contexts \
		$BINDIR/swift* \
		$LOCALSTATEDIR/run/swift \
		$LOCALSTATEDIR/swift \
		$SHAREDSTATEDIR/nova/.ssh \
		$SHAREDSTATEDIR/designate/bind9 \
		$SHAREDSTATEDIR/vhost_sockets \
		/srv \
		$BINDIR/neutron* \
		$BINDIR/swift-object-* \
		${ROOTDIR}httpboot \
		${ROOTDIR}tftpboot \
		$LOCALSTATEDIR/run/redis \
		$LOCALSTATEDIR/log \
	2> /dev/null || :
}


# usage: set_port tcp|udp port# context
set_port()
{
	# There's no add-or-modify, so try a modify, and if that fails,
	# add the new rule.
	#
	# -N prevents reloading
	$SBINDIR/semanage port -N -m -t $3 -p $1 $2 2>&1 | grep -qE 'ValueError: Port.*is not defined'
	# Grep succeeded - meaning this was not defined
	if [ $? -eq 0 ]; then
		# So, we need to add it.
		$SBINDIR/semanage port -N -a -t $3 -p $1 $2 &> /dev/null
	fi
}

# usage: set_file_context a|d (add/delete)
set_file_contexts()
{
	INPUT="fcontext -N -$1 -t named_zone_t \"$SHAREDSTATEDIR/designate/bind9(/.*)?\"
	fcontext -N -$1 -t virt_cache_t \"$SHAREDSTATEDIR/vhost_sockets(/.*)?\"
	fcontext -N -$1 -t httpd_var_lib_t $SHAREDSTATEDIR/openstack-dashboard
	fcontext -N -$1 -t mongod_var_lib_t \"$SHAREDSTATEDIR/mongodb(/.*)?\"
	fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/gnocchi/app.log
	fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/aodh/app.log
	fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/ceilometer/app.log
	fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/panko/app.log
	fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/zaqar/zaqar.log
	fcontext -N -$1 -t container_file_t \"$LOCALSTATEDIR/log/containers(/.*)?\"
	fcontext -N -$1 -t container_file_t \"$LOCALSTATEDIR/lib/config-data(/.*)?\"
	fcontext -N -$1 -t container_file_t \"$LOCALSTATEDIR/lib/tripleo-config(/.*)?\"
	fcontext -N -$1 -t neutron_exec_t $BINDIR/neutron-rootwrap-daemon
	fcontext -N -$1 -t neutron_exec_t $BINDIR/neutron-vpn-agent
	fcontext -N -$1 -t swift_var_cache_t \"$LOCALSTATEDIR/cache/swift(/.*)\"
	fcontext -N -$1 -t swift_exec_t $BINDIR/swift-object-reconstructor
	fcontext -N -$1 -t swift_exec_t $BINDIR/swift-object-relinker
	fcontext -N -$1 -t httpd_sys_content_t \"${ROOTDIR}httpboot(/.*)?\"
	fcontext -N -$1 -t ssh_home_t \"$SHAREDSTATEDIR/nova/.ssh(/.*)?\"
	fcontext -N -$1 -t tftpdir_t \"${ROOTDIR}tftpboot(/.*)?\"
	fcontext -N -$1 -t cluster_var_log_t \"$LOCALSTATEDIR/log/pacemaker\.log.*\"
	fcontext -N -$1 -t cluster_var_log_t \"$LOCALSTATEDIR/log/pacemaker(/.*)?\""

	# Load these one by one so upgrades work properly.
	# TODO (future): Make upgrades (only) do one by one;
	#                install/remove can do batches to save time.
	while read; do
		eval semanage $REPLY &> /dev/null
	done < <(echo "$INPUT")

	# TODO (future): install/remove can do this to save time
	# echo "$INPUT" | $SBINDIR/semanage import -N
}


_cache_file_modes() {
	if ! [ -d '/etc/selinux/targeted/active' ]; then
		return
	fi
	for f in $(find /etc/selinux/targeted/active -maxdepth 1 -type f); do
		file_modes[$f]=$(stat -c %a $f)
	done
}


_restore_file_modes() {
	for k in "${!file_modes[@]}"; do
		chmod ${file_modes[$k]} $k
	done
}


install_policies() {
	# Bug #1560019
	#
	# 'semanage' seems to recreate
	# /etc/selinux/targeted/active/seusers
	# /etc/selinux/targeted/active/user_extra
	# with the wrong mode, breaking 'rpm -Va'
	#
	# Store file modes and explicitly chmod
	# them back when we're done with our setup.
	_cache_file_modes

	do_echo "Setting up ports..."
	#
	# Port rules
	#

	# bz#1118859
	set_port tcp 4444 mysqld_port_t

	# bz#1260202
	set_port tcp 6653 openvswitch_port_t

	# bz#1360434
	set_port tcp 8088 http_port_t

	# bz#1396553
	set_port tcp 8000 http_port_t

	# bz#1498921
	set_port tcp 6639 ovsdb_port_t

	# bz#1499134
	set_port tcp 6641 ovsdb_port_t
	set_port tcp 6642 ovsdb_port_t

	# Create all the file contexts
	set_file_contexts "a"

	# Build up a script to pass to semanage
	#
	# Booleans
	# -N -> don't reload policy
	# -m -> modify
	#
	CR=$'\n'
	INPUT="boolean -N -m --on virt_use_fusefs
	boolean -N -m --on glance_api_can_network
	boolean -N -m --on neutron_can_network
	boolean -N -m --on glance_use_fusefs
	boolean -N -m --on haproxy_connect_any
	boolean -N -m --on nis_enabled
	boolean -N -m --on rsync_full_access
	boolean -N -m --on rsync_client
	boolean -N -m --on virt_use_execmem
	boolean -N -m --on virt_use_nfs
	boolean -N -m --on daemons_enable_cluster_mode
	boolean -N -m --on glance_use_execmem
	boolean -N -m --on httpd_execmem
	boolean -N -m --on domain_kernel_load_modules
	boolean -N -m --on httpd_can_network_connect
	boolean -N -m --on swift_can_network
	boolean -N -m --on httpd_use_openstack
	boolean -N -m --on collectd_tcp_network_connect
	boolean -N -m --on domain_can_mmap_files"

	#
	# Append modules to our semanage script
	#
	for x in $MODULES; do
		INPUT="${INPUT}${CR}module -N -a $DATADIR/selinux/packages/$x.pp.bz2"
	done

	#
	# Execute the semanage script:
	# Do most things in one transaction, but don't reload policy
	# in case we're in a chroot environment.
	#
	do_echo "Installing OpenStack extra policies and setting booleans..."
	echo "$INPUT" | $SBINDIR/semanage import -N

	# Unfortunately, we can't load new modules and set
	# booleans defined in those modules in a single transaction,
	# so do a second one to set our new booleans.
	INPUT="boolean -N -m --on os_nova_use_execmem
	boolean -N -m --on os_neutron_use_execmem
	boolean -N -m --on os_swift_use_execmem
	boolean -N -m --on os_keystone_use_execmem
	boolean -N -m --on os_glance_use_sudo
	boolean -N -m --on os_httpd_wsgi
	boolean -N -m --on os_gnocchi_use_nfs
	boolean -N -m --on os_virtlogd_use_nfs
	boolean -N -m --on os_glance_use_nfs
	boolean -N -m --on os_cinder_use_nfs"

	do_echo "Setting OpenStack booleans..."
	echo "$INPUT" | $SBINDIR/semanage import -N

	relabel_files
	if $SBINDIR/selinuxenabled ; then
		do_echo "Reloading SELinux policies..."
		#
		# Chroot environments (e.g. when building images)
		# won't get here, which is why we do everything else
		# above.
		#
		$SBINDIR/load_policy
	fi

	# Bug #1560019
	_restore_file_modes
}


uninstall_policies() {
	# Bug #1560019
	_cache_file_modes

	# Remove our modules and rebuild policy
	do_echo "Removing OpenStack modules..."
	$SBINDIR/semodule -n -r $MODULES &> /dev/null || :

	# Delete all the file contexts
	set_file_contexts "d"

	relabel_files

	if $SBINDIR/selinuxenabled ; then
		do_echo "Reloading SELinux policies..."
		$SBINDIR/load_policy
	fi

	# Bug #1560019
	_restore_file_modes
}


while getopts m:xq opt; do
	case $opt in
	m)	# modules
		MODULES="$OPTARG"
		;;
	x)	# uninstall
		MODE=1
		;;
	q)
		QUIET=0
		;;
	esac
done


case $MODE in
	0)
		install_policies
		;;
	1)
		uninstall_policies
		;;
esac
exit $?