summaryrefslogtreecommitdiffstats
path: root/selinux (follow)
Commit message (Collapse)AuthorAgeFilesLines
* selinux: prepare for anon inode controls enablementOndrej Mosnacek2022-08-291-0/+3
| | | | | | | | | | | | | | | | | | | | | | We plan to start labeling anon inodes (userfaultfd and io_uring file descriptors) properly in selinux-policy, which means that domains using these will need new rules. See: https://github.com/fedora-selinux/selinux-policy/pull/1351 Since ceph may optionally use io_uring, this patch adds the necessary interface call to its policy to avoid a regression. As the new interface call is put under a conditional, the policy package will be buildable against selinux-policy with or without the above PR merged, but it will need to be rebuilt against the updated selinux-policy to actually pick up the new rules. I tested this on a minimal ceph cluster with 'bdev_ioring = true' added to ceph.conf. I got io_uring denials without this patch + with selinux-policy with PR#1351 and no denials with ceph rebuilt with this patch. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
* selinux: add amqp and soundd types to ceph.teThomas Serlin2020-07-101-0/+2
| | | | Signed-off-by: Thomas Serlin <tserlin@redhat.com>
* selinux: allow ceph_t amqp_port_t:tcp_socketkalebskeithley2020-07-081-0/+2
| | | | | | | | | | | allow ceph_t amqp_port_t:tcp_socket name_connect; allow ceph_t soundd_port_t:tcp_socket name_connect; Required for running RabbitMQ (soundd_port_t) for running RabbitMQ on port 8000 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1854083 Signed-off-by: Kaleb S. KEITHLEY <kkeithle@redhat.com>
* selinux: Fix ceph-iscsi etc accessMike Christie2020-04-221-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the selinux errors like this for /etc/target ----------------------------------- Additional Information: Source Context system_u:system_r:ceph_t:s0 Target Context system_u:object_r:targetd_etc_rw_t:s0 Target Objects target [ dir ] Source rbd-target-api Source Path rbd-target-api Port <Unknown> Host ans8 Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.3-20.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name ans8 Platform Linux ans8 4.18.0-147.el8.x86_64 #1 SMP Thu Sep 26 15:52:44 UTC 2019 x86_64 x86_64 Alert Count 1 First Seen 2020-01-08 18:39:48 EST Last Seen 2020-01-08 18:39:48 EST Local ID 9a13ee18-eaf2-4f2a-872f-2809ee4928f6 Raw Audit Messages type=AVC msg=audit(1578526788.148:69): avc: denied { search } for pid=995 comm="rbd-target-api" name="target" dev="sda1" ino=52198 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=1 Hash: rbd-target-api,ceph_t,targetd_etc_rw_t,dir,search which are a result of the rtslib library the ceph-iscsi daemons use accessing /etc/target to read/write a file which stores meta data the target uses. Signed-off-by: Mike Christie <mchristi@redhat.com>
* selinux: Fix ceph-iscsi configfs accessMike Christie2020-04-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the the following selinux error when using ceph-iscsi's rbd-target-api daemon (rbd-target-gw has the same issue). They are a result of the a python library, rtslib, which the daemons use. Additional Information: Source Context system_u:system_r:ceph_t:s0 Target Context system_u:object_r:configfs_t:s0 Target Objects /sys/kernel/config/target/iscsi/iqn.2003-01.com.re dhat:ceph-iscsi/tpgt_1/attrib/authentication [ file ] Source rbd-target-api Source Path /usr/libexec/platform-python3.6 Port <Unknown> Host ans8 Source RPM Packages platform-python-3.6.8-15.1.el8.x86_64 Target RPM Packages Policy RPM selinux-policy-3.14.3-20.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name ans8 Platform Linux ans8 4.18.0-147.el8.x86_64 #1 SMP Thu Sep 26 15:52:44 UTC 2019 x86_64 x86_64 Alert Count 1 First Seen 2020-01-08 18:39:47 EST Last Seen 2020-01-08 18:39:47 EST Local ID 6f8c3415-7a50-4dc8-b3d2-2621e1d00ca3 Raw Audit Messages type=AVC msg=audit(1578526787.577:68): avc: denied { ioctl } for pid=995 comm="rbd-target-api" path="/sys/kernel/config/target/iscsi/iqn.2003-01.com.redhat:ceph-iscsi/tpgt_1/attrib/authentication" dev="configfs" ino=25703 ioctlcmd=0x5401 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(1578526787.577:68): arch=x86_64 syscall=ioctl success=no exit=ENOTTY a0=34 a1=5401 a2=7ffd4f8f1f60 a3=3052cd2d95839b96 items=0 ppid=1 pid=995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rbd-target-api exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:ceph_t:s0 key=(null) Hash: rbd-target-api,ceph_t,configfs_t,file,ioctl Signed-off-by: Mike Christie <mchristi@redhat.com>
* selinux: add "type http_cache_port_t" in require sectionKefu Chai2020-04-101-0/+1
| | | | | | | | this addresses the regression introduced by 611a2a7ce1713cf92797b19d8a9a93a7dfc68fa5 Fixes: https://tracker.ceph.com/issues/45022 Signed-off-by: Kefu Chai <kchai@redhat.com>
* Update ceph.tekalebskeithley2020-04-091-0/+1
| | | | Fixes: https://tracker.ceph.com/issues/45022 Signed-off-by: Kaleb S. KEITHLEY <kkeithle@redhat.com>
* selinux: Allow ceph to setschedBrad Hubbard2020-02-191-0/+1
| | | | | | | | | In several places, such as common/numa.cc we call sched_setaffinity which requires this permission. Fixes: https://tracker.ceph.com/issues/44196 Signed-off-by: Brad Hubbard <bhubbard@redhat.com>
* selinux: Allow ceph to read udev dbBoris Ranto2019-07-161-0/+2
| | | | | | | We are using libudev and reading the udev db files because of that. We need to allow ceph to access these files in the SELinux policy. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Update the policy for RHEL8Boris Ranto2019-06-051-1/+11
| | | | | | | | We hit a couple more SELinux denials when running ceph on RHEL8. The dac_read_search change is related to a kernel change where it checks dac_read_search before dac_override, now. Signed-off-by: Boris Ranto <branto@redhat.com>
* igw: Add selinux support for ceph iscsiMike Christie2018-11-052-3/+25
| | | | | | | | | | | | | | | | | | This adds selinux support for the ceph iscsi daemons under the ceph github: ceph-iscsi-config - rbd-target-gw ceph-iscsi-cli - rbd-target-api We use tcmu-runner, but that will go into the core policy to avoid conflicts with gluster and distro bases. This requires the patches: https://github.com/ceph/ceph-iscsi-config/pull/90 https://github.com/ceph/ceph-iscsi-cli/pull/134 Signed-off-by: Mike Christie <mchristi@redhat.com>
* ceph-fuse: add to selinux profilePatrick Donnelly2018-09-201-0/+1
| | | | | | Fixes: http://tracker.ceph.com/issues/36103 Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
* selinux: Allow ceph to block suspendBoris Ranto2018-05-141-0/+2
| | | | | | | Ceph is now trying to block suspend in certain cases, we need to update the policy accordingly. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow ceph to execute ldconfigBoris Ranto2018-05-141-0/+1
| | | | | | | | | | The ceph-volume testing showed that the ceph daemons can run ldconfig in a corner case when they are forbidden access to some files. This patch allows ceph to execute ldconfig in Enforcing mode. Fixes: https://tracker.ceph.com/issues/22302 Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow getattr on lnk sysfs filesBoris Ranto2017-09-211-1/+1
| | | | | | | | This showed up during downstream testing for luminous. We are doing getattr on the sysfs lnk files and the current policy does not allow this. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow nvme devicesBoris Ranto2017-08-141-1/+5
| | | | | | | | This commit allows nvme devices which use a different label than standard block devices. Fixes: http://tracker.ceph.com/issues/19200 Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow read on var_run_tBoris Ranto2017-06-061-1/+1
| | | | | Fixes: http://tracker.ceph.com/issues/16674 Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: clip the ceph context to ceph-mgr alsoKefu Chai2017-06-021-0/+1
| | | | Signed-off-by: Kefu Chai <kchai@redhat.com>
* selinux: Allow ceph daemons to read net statsBoris Ranto2017-03-131-0/+1
| | | | | | Fixes: http://tracker.ceph.com/issues/19254 Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow ceph to manage tmp filesBoris Ranto2016-09-291-0/+1
| | | | | | | | | | Two new denials showed up in testing that relate to ceph trying to manage (rename and unlink) tmp files. This commit allows ceph to manage the files. Fixes: http://tracker.ceph.com/issues/17436 Signed-off-by: Boris Ranto <branto@redhat.com>
* remove autotoolsSage Weil2016-09-072-23/+0
| | | | Signed-off-by: Sage Weil <sage@redhat.com>
* selinux: allow read /proc/<pid>/cmdlineKefu Chai2016-07-191-0/+2
| | | | | | | we read /proc/<pid>/cmdline to figure out who is terminating us. Fixes: http://tracker.ceph.com/issues/16675 Signed-off-by: Kefu Chai <kchai@redhat.com>
* selinux: allow chown for self and setattr for /var/run/cephBoris Ranto2016-06-131-2/+2
| | | | | | Fixes: http://tracker.ceph.com/issues/16126 Signed-off-by: Boris Ranto <branto@redhat.com>
* cmake: enable selinux supportKefu Chai2016-05-161-0/+11
| | | | Signed-off-by: Kefu Chai <kchai@redhat.com>
* automake: use :: rule for adding targetKefu Chai2016-05-031-2/+2
| | | | Signed-off-by: Kefu Chai <kchai@redhat.com>
* selinux: Allow to manage locksBoris Ranto2016-03-081-0/+1
| | | | | | | | | We currently create the ceph lock by an unconfined process (ceph-disk). Unconfined processes inherit the context from the parrent directory. This allows ceph daemons to access the files with context inherrited from the parent directory (/var/lock | /run/lock). Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: allow dac_override capabilityBoris Ranto2016-03-081-1/+1
| | | | | Fixes: #14870 Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow log files to be located in /var/log/radosgwBoris Ranto2016-02-112-1/+2
| | | | | | | | | | | | | | | | We do suggest users to put their logs in /var/log/radosgw in the documentation at times. We should also label that directory with ceph_var_log_t so that ceph daemons can also write there. The commit also updates the man page for this policy. This man page is automatically generated by * sepolicy manpage -p . -d ceph_t and have not been reloaded in a while. Hence, it contains few more changes than the new radosgw directory. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Fix man page locationBoris Ranto2015-10-061-370/+0
| | | | | | | | | | The SELinux man page was previously located in two places and the man page that was supposed to be updated when rgw selinux changes were proposed did not get updated properly. Fixing this by moving selinux/ceph_selinux.8 to man/ceph_selinux.8. Also, populate EXTRA_DIST with ceph_selinux.8. Signed-off-by: Boris Ranto <branto@redhat.com>
* radosgw: log to /var/log/ceph instead of /var/log/radosgwSage Weil2015-09-162-5/+2
| | | | | | This is simpler. Signed-off-by: Sage Weil <sage@redhat.com>
* selinux: Update policy for radosgwBoris Ranto2015-09-113-13/+61
| | | | | | | The current SELinux policy does not cover radosgw daemon. This patch introduces the SELinux support for radosgw daemon (civetweb only). Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Add .gitignore fileBoris Ranto2015-08-051-0/+3
| | | | | | | The gitbuilders release script needs this. Otherwise, the ceph-release build will fail because there were some untracked files. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Update the SELinux policy rulesBoris Ranto2015-08-051-0/+29
| | | | | | | Few new denials were found while testing the policy. Updating the policy rules to refelct that. Signed-off-by: Boris Ranto <branto@redhat.com>
* SELinux Makefile can't work in parallelBoris Ranto2015-08-051-1/+1
| | | | | | | | We need to force single-core compilation of SELinux policy files in the sub-make target as SELinux Makefile does not work properly when run in parallel mode. Signed-off-by: Boris Ranto <branto@redhat.com>
* selinux: Allow setuid and setgid to ceph-mon and ceph-osdBoris Ranto2015-08-051-0/+1
| | | | Signed-off-by: Boris Ranto <branto@redhat.com>
* Update selinux policy (after local test).Milan Broz2015-08-052-18/+15
| | | | | | Changes enerated with ceph-test package. Signed-off-by: Milan Broz <mbroz@redhat.com>
* Add initial SELinux supportBoris Ranto2015-08-055-0/+709
This patch modifies the build system and spec file to provide a support for SELinux enforcing in an opt-in matter via ceph-selinux package. Signed-off-by: Boris Ranto <branto@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 20:34:47 +0100