Skip to content
This repository was archived by the owner on Apr 24, 2026. It is now read-only.

Commit 686e609

Browse files
5umm3r155umm3r15
committed
Fix policy style
Fixed policy according to the Reference Policy Style Guideline https://github.com/SELinuxProject/refpolicy/wiki/StyleGuide Alphabetically sorted rules and permissios. Macros: fstools_domtrans, mount_domtrans, systemd_config_systemd_services, systemd_signal_passwd_agent, moved to optional policy blocks. Removed duplicated macros. Removed whitespaces. Added '\' before .py in fc file. Added local policy for ssh_keygen to optional policy block
1 parent 06254ee commit 686e609

3 files changed

Lines changed: 124 additions & 130 deletions

File tree

‎glusterd.fc‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,20 @@
66
/usr/sbin/glusterd -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0)
77
/usr/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
88

9-
/usr/sbin/glustereventsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
10-
/usr/sbin/gluster-eventsapi -- gen_context(system_u:object_r:glusterd_exec_t,s0)
9+
/usr/sbin/glustereventsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
10+
/usr/sbin/gluster-eventsapi -- gen_context(system_u:object_r:glusterd_exec_t,s0)
1111

12-
13-
/usr/libexec/glusterfs/peer_eventsapi.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
14-
/usr/libexec/glusterfs/events/glustereventsd.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
15-
/usr/libexec/glusterfs/gfevents/glustereventsd.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
12+
/usr/libexec/glusterfs/peer_eventsapi\.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
13+
/usr/libexec/glusterfs/events/glustereventsd\.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
14+
/usr/libexec/glusterfs/gfevents/glustereventsd\.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
1615

1716
/opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
1817

1918
/var/lib/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_lib_t,s0)
2019

2120
/var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0)
2221

23-
/var/run/gluster(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
24-
/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
22+
/var/run/gluster(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
23+
/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
2524
/var/run/glusterd.* -- gen_context(system_u:object_r:glusterd_var_run_t,s0)
2625
/var/run/glusterd.* -s gen_context(system_u:object_r:glusterd_var_run_t,s0)

‎glusterd.if‎

Lines changed: 63 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,10 @@ interface(`glusterd_append_log',`
9090
## </param>
9191
#
9292
interface(`glusterd_filetrans_named_pid',`
93-
gen_require(`
94-
type glusterd_var_run_t;
95-
')
96-
files_pid_filetrans($1, glusterd_var_run_t , sock_file, "glusterd.socket")
93+
gen_require(`
94+
type glusterd_var_run_t;
95+
')
96+
files_pid_filetrans($1, glusterd_var_run_t , sock_file, "glusterd.socket")
9797
')
9898

9999
########################################
@@ -139,118 +139,118 @@ interface(`glusterd_manage_log',`
139139

140140
######################################
141141
## <summary>
142-
## Allow the specified domain to execute gluster's lib files.
142+
## Allow the specified domain to execute gluster's lib files.
143143
## </summary>
144144
## <param name="domain">
145-
## <summary>
146-
## Domain allowed access.
147-
## </summary>
145+
## <summary>
146+
## Domain allowed access.
147+
## </summary>
148148
## </param>
149149
#
150150
interface(`gluster_execute_lib',`
151-
gen_require(`
152-
type glusterd_var_lib_t;
153-
')
151+
gen_require(`
152+
type glusterd_var_lib_t;
153+
')
154154

155-
files_list_var_lib($1)
156-
allow $1 glusterd_var_lib_t:dir search_dir_perms;
157-
can_exec($1, glusterd_var_lib_t)
155+
files_list_var_lib($1)
156+
allow $1 glusterd_var_lib_t:dir search_dir_perms;
157+
can_exec($1, glusterd_var_lib_t)
158158
')
159159

160160
######################################
161161
## <summary>
162-
## Read glusterd's config files.
162+
## Read glusterd's config files.
163163
## </summary>
164164
## <param name="domain">
165-
## <summary>
166-
## Domain allowed access.
167-
## </summary>
165+
## <summary>
166+
## Domain allowed access.
167+
## </summary>
168168
## </param>
169169
#
170170
interface(`glusterd_read_conf',`
171-
gen_require(`
172-
type glusterd_conf_t;
173-
')
171+
gen_require(`
172+
type glusterd_conf_t;
173+
')
174174

175-
files_search_etc($1)
176-
read_files_pattern($1, glusterd_conf_t, glusterd_conf_t)
175+
files_search_etc($1)
176+
read_files_pattern($1, glusterd_conf_t, glusterd_conf_t)
177177
')
178178

179179
######################################
180180
## <summary>
181-
## Dontaudit Read /var/lib/glusterd files.
181+
## Dontaudit Read /var/lib/glusterd files.
182182
## </summary>
183183
## <param name="domain">
184-
## <summary>
185-
## Domain allowed access.
186-
## </summary>
184+
## <summary>
185+
## Domain allowed access.
186+
## </summary>
187187
## </param>
188188
#
189189
interface(`glusterd_dontaudit_read_lib_dirs',`
190-
gen_require(`
191-
type glusterd_var_lib_t;
192-
')
190+
gen_require(`
191+
type glusterd_var_lib_t;
192+
')
193193

194-
dontaudit $1 glusterd_var_lib_t:dir list_dir_perms;
194+
dontaudit $1 glusterd_var_lib_t:dir list_dir_perms;
195195
')
196196

197197
######################################
198198
## <summary>
199-
## Read and write /var/lib/glusterd files.
199+
## Read and write /var/lib/glusterd files.
200200
## </summary>
201201
## <param name="domain">
202-
## <summary>
203-
## Domain allowed access.
204-
## </summary>
202+
## <summary>
203+
## Domain allowed access.
204+
## </summary>
205205
## </param>
206206
#
207207
interface(`glusterd_rw_lib',`
208-
gen_require(`
209-
type glusterd_var_lib_t;
210-
')
208+
gen_require(`
209+
type glusterd_var_lib_t;
210+
')
211211

212-
files_search_var_lib($1)
213-
rw_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
212+
files_search_var_lib($1)
213+
rw_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
214214
')
215215

216216
######################################
217217
## <summary>
218-
## Read /var/lib/glusterd files.
218+
## Read /var/lib/glusterd files.
219219
## </summary>
220220
## <param name="domain">
221-
## <summary>
222-
## Domain allowed access.
223-
## </summary>
221+
## <summary>
222+
## Domain allowed access.
223+
## </summary>
224224
## </param>
225225
#
226226
interface(`glusterd_read_lib_files',`
227-
gen_require(`
228-
type glusterd_var_lib_t;
229-
')
227+
gen_require(`
228+
type glusterd_var_lib_t;
229+
')
230230

231-
files_search_var_lib($1)
231+
files_search_var_lib($1)
232232
allow $1 glusterd_var_lib_t:dir search_dir_perms;
233-
read_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
233+
read_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
234234
')
235235

236236
######################################
237237
## <summary>
238-
## Read and write /var/lib/glusterd files.
238+
## Read and write /var/lib/glusterd files.
239239
## </summary>
240240
## <param name="domain">
241-
## <summary>
242-
## Domain allowed access.
243-
## </summary>
241+
## <summary>
242+
## Domain allowed access.
243+
## </summary>
244244
## </param>
245245
#
246246
interface(`glusterd_manage_lib_files',`
247-
gen_require(`
248-
type glusterd_var_lib_t;
249-
')
247+
gen_require(`
248+
type glusterd_var_lib_t;
249+
')
250250

251-
files_search_var_lib($1)
251+
files_search_var_lib($1)
252252
allow $1 glusterd_var_lib_t:dir search_dir_perms;
253-
manage_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
253+
manage_files_pattern($1, glusterd_var_lib_t, glusterd_var_lib_t)
254254
')
255255

256256
######################################
@@ -282,9 +282,9 @@ interface(`glusterd_admin',`
282282
allow $1 glusterd_t:process { signal_perms };
283283
ps_process_pattern($1, glusterd_t)
284284

285-
tunable_policy(`deny_ptrace',`',`
286-
allow $1 glusterd_t:process ptrace;
287-
')
285+
tunable_policy(`deny_ptrace',`',`
286+
allow $1 glusterd_t:process ptrace;
287+
')
288288

289289
glusterd_initrc_domtrans($1)
290290
domain_system_change_exemption($1)
@@ -321,8 +321,8 @@ interface(`glusterd_admin',`
321321
#
322322
ifndef(`rsync_rw_unix_stream_sockets',`
323323
interface(`rsync_rw_unix_stream_sockets',`
324-
gen_require(`
325-
type rsync_t;
324+
gen_require(`
325+
type rsync_t;
326326
')
327327

328328
allow $1 rsync_t:unix_stream_socket rw_socket_perms;

0 commit comments

Comments
 (0)