/
local_settings.sh.in
277 lines (234 loc) · 6.81 KB
/
local_settings.sh.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
#!/bin/bash
QUIET=1
MODE=0
ROOTDIR=${ROOTDIR:-/}
BINDIR=${BINDIR:-/usr/bin}
SBINDIR=${SBINDIR:-/sbin}
LOCALSTATEDIR=${LOCALSTATEDIR:-/var}
DATADIR=${DATADIR:-/usr/share}
SHAREDSTATEDIR=${SHAREDSTATEDIR:-/var/lib}
LOCALDIR=${LOCALDIR:-$DATADIR/openstack-selinux/master}
MODULES=${MODULES:-@MODULES@}
# This is for caching the file modes; -A is a bash associative
# array ("dict" or "map" in other languages)
# See bug for bug #1560019 for more information.
declare -A file_modes
do_echo() {
if [ $QUIET -eq 0 ]; then
return
fi
echo $*
}
relabel_files()
{
local opts=""
do_echo "Relabeling files..."
if [ $QUIET -ne 0 ]; then
opts="-v"
fi
# Setfiles is a lot like restorecon, except it takes a policy
# on-disk instead of looking at the kernel-loaded policy
# So, it works inside of image builds.
#
# At a minimum, we need a line for each entry we have where we are
# custominzing the label using 'semanage' below, but also
# others, when applicable.
$SBINDIR/setfiles $opts -F $ROOTDIR/etc/selinux/targeted/contexts/files/file_contexts \
$BINDIR/swift* \
$LOCALSTATEDIR/run/swift \
$LOCALSTATEDIR/swift \
$SHAREDSTATEDIR/nova/.ssh \
$SHAREDSTATEDIR/designate/bind9 \
$SHAREDSTATEDIR/vhost_sockets \
/srv \
$BINDIR/neutron* \
$BINDIR/swift-object-* \
${ROOTDIR}httpboot \
${ROOTDIR}tftpboot \
$LOCALSTATEDIR/run/redis \
$LOCALSTATEDIR/log \
2> /dev/null || :
}
# usage: set_port tcp|udp port# context
set_port()
{
# There's no add-or-modify, so try a modify, and if that fails,
# add the new rule.
#
# -N prevents reloading
$SBINDIR/semanage port -N -m -t $3 -p $1 $2 2>&1 | grep -qE 'ValueError: Port.*is not defined'
# Grep succeeded - meaning this was not defined
if [ $? -eq 0 ]; then
# So, we need to add it.
$SBINDIR/semanage port -N -a -t $3 -p $1 $2 &> /dev/null
fi
}
# usage: set_file_context a|d (add/delete)
set_file_contexts()
{
INPUT="fcontext -N -$1 -t named_zone_t \"$SHAREDSTATEDIR/designate/bind9(/.*)?\"
fcontext -N -$1 -t virt_cache_t \"$SHAREDSTATEDIR/vhost_sockets(/.*)?\"
fcontext -N -$1 -t httpd_var_lib_t $SHAREDSTATEDIR/openstack-dashboard
fcontext -N -$1 -t mongod_var_lib_t \"$SHAREDSTATEDIR/mongodb(/.*)?\"
fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/gnocchi/app.log
fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/aodh/app.log
fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/ceilometer/app.log
fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/panko/app.log
fcontext -N -$1 -t httpd_log_t $LOCALSTATEDIR/log/zaqar/zaqar.log
fcontext -N -$1 -t neutron_exec_t $BINDIR/neutron-rootwrap-daemon
fcontext -N -$1 -t neutron_exec_t $BINDIR/neutron-vpn-agent
fcontext -N -$1 -t swift_var_cache_t \"$LOCALSTATEDIR/cache/swift(/.*)\"
fcontext -N -$1 -t swift_exec_t $BINDIR/swift-object-reconstructor
fcontext -N -$1 -t swift_exec_t $BINDIR/swift-object-relinker
fcontext -N -$1 -t httpd_sys_content_t \"${ROOTDIR}httpboot(/.*)?\"
fcontext -N -$1 -t ssh_home_t \"$SHAREDSTATEDIR/nova/.ssh(/.*)?\"
fcontext -N -$1 -t tftpdir_t \"${ROOTDIR}tftpboot(/.*)?\""
echo "$INPUT" | $SBINDIR/semanage import -N
}
_cache_file_modes() {
if ! [ -d '/etc/selinux/targeted/active' ]; then
return
fi
for f in $(find /etc/selinux/targeted/active -maxdepth 1 -type f); do
file_modes[$f]=$(stat -c %a $f)
done
}
_restore_file_modes() {
for k in "${!file_modes[@]}"; do
chmod ${file_modes[$k]} $k
done
}
install_policies() {
# Bug #1560019
#
# 'semanage' seems to recreate
# /etc/selinux/targeted/active/seusers
# /etc/selinux/targeted/active/user_extra
# with the wrong mode, breaking 'rpm -Va'
#
# Store file modes and explicitly chmod
# them back when we're done with our setup.
_cache_file_modes
do_echo "Setting up ports..."
#
# Port rules
#
# bz#1118859
set_port tcp 4444 mysqld_port_t
# bz#1260202
set_port tcp 6653 openvswitch_port_t
# bz#1360434
set_port tcp 8088 http_port_t
# bz#1396553
set_port tcp 8000 http_port_t
# bz#1498921
set_port tcp 6639 ovsdb_port_t
# bz#1499134
set_port tcp 6641 ovsdb_port_t
set_port tcp 6642 ovsdb_port_t
# Create all the file contexts
set_file_contexts "a"
# Build up a script to pass to semanage
#
# Booleans
# -N -> don't reload policy
# -m -> modify
#
CR=$'\n'
INPUT="boolean -N -m --on virt_use_fusefs
boolean -N -m --on glance_api_can_network
boolean -N -m --on neutron_can_network
boolean -N -m --on glance_use_fusefs
boolean -N -m --on haproxy_connect_any
boolean -N -m --on nis_enabled
boolean -N -m --on rsync_full_access
boolean -N -m --on rsync_client
boolean -N -m --on virt_use_execmem
boolean -N -m --on virt_use_nfs
boolean -N -m --on daemons_enable_cluster_mode
boolean -N -m --on glance_use_execmem
boolean -N -m --on httpd_execmem
boolean -N -m --on domain_kernel_load_modules
boolean -N -m --on httpd_can_network_connect
boolean -N -m --on swift_can_network
boolean -N -m --on httpd_use_openstack
boolean -N -m --on collectd_tcp_network_connect"
#
# Append modules to our semanage script
#
for x in $MODULES; do
INPUT="${INPUT}${CR}module -N -a $DATADIR/selinux/packages/$x.pp.bz2"
done
#
# Execute the semanage script:
# Do most things in one transaction, but don't reload policy
# in case we're in a chroot environment.
#
do_echo "Installing OpenStack extra policies and setting booleans..."
echo "$INPUT" | $SBINDIR/semanage import -N
# Unfortunately, we can't load new modules and set
# booleans defined in those modules in a single transaction,
# so do a second one to set our new booleans.
INPUT="boolean -N -m --on os_nova_use_execmem
boolean -N -m --on os_neutron_use_execmem
boolean -N -m --on os_swift_use_execmem
boolean -N -m --on os_keystone_use_execmem
boolean -N -m --on os_glance_use_sudo
boolean -N -m --on os_httpd_wsgi
boolean -N -m --on os_gnocchi_use_nfs
boolean -N -m --on os_virtlogd_use_nfs
boolean -N -m --on os_glance_use_nfs
boolean -N -m --on os_cinder_use_nfs"
do_echo "Setting OpenStack booleans..."
echo "$INPUT" | $SBINDIR/semanage import -N
relabel_files
if $SBINDIR/selinuxenabled ; then
do_echo "Reloading SELinux policies..."
#
# Chroot environments (e.g. when building images)
# won't get here, which is why we do everything else
# above.
#
$SBINDIR/load_policy
fi
# Bug #1560019
_restore_file_modes
}
uninstall_policies() {
# Bug #1560019
_cache_file_modes
# Remove our modules and rebuild policy
do_echo "Removing OpenStack modules..."
$SBINDIR/semodule -n -r $MODULES &> /dev/null || :
# Delete all the file contexts
set_file_contexts "d"
relabel_files
if $SBINDIR/selinuxenabled ; then
do_echo "Reloading SELinux policies..."
$SBINDIR/load_policy
fi
# Bug #1560019
_restore_file_modes
}
while getopts m:xq opt; do
case $opt in
m) # modules
MODULES="$OPTARG"
;;
x) # uninstall
MODE=1
;;
q)
QUIET=0
;;
esac
done
case $MODE in
0)
install_policies
;;
1)
uninstall_policies
;;
esac
exit $?