diff --git a/Makefile b/Makefile index 07fb019..db36e66 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -TARGETS?=openstack-selinux-nova openstack-selinux-neutron openstack-selinux-quantum swift openstack-rsync +TARGETS?=openstack-selinux-nova openstack-selinux-neutron openstack-selinux-quantum openstack-selinux-swift openstack-rsync MODULES?=${TARGETS:=.pp.bz2} SHAREDIR?=/usr/share #INSTALL=?=install @@ -14,7 +14,22 @@ all: ${TARGETS:=.pp.bz2} clean: rm -f *~ *.if *.tc *.pp *.pp.bz2 - rm -rf tmp + rm -rf tmp *.tar.gz + +tarball: .git/config + # + # Downloading tarball. Note: this only works if the + # current HEAD matches a previously-pushed tag. + # + @RELEASE=$$(git tag --points-at=$$(git log -1 | awk '/^commit/ { print $$2 }')) ;\ + if [ -z "$$RELEASE" ]; then \ + echo "Failed. Try 'git tag' first." ;\ + else \ + rm -f openstack-selinux-$$RELEASE.tar.gz ;\ + wget -O openstack-selinux-$$RELEASE.tar.gz \ + https://github.com/redhat-openstack/openstack-selinux/archive/$$RELEASE.tar.gz ;\ + fi + #install: # ${INSTALL} -m 0644 ${TARGETS} \ diff --git a/openstack-selinux-nova.te b/openstack-selinux-nova.te index ad87215..f29c70c 100644 --- a/openstack-selinux-nova.te +++ b/openstack-selinux-nova.te @@ -23,6 +23,10 @@ require { type semanage_t; type nova_var_lib_t; type qemu_t; + type sshd_t; + type nova_var_lib_t; + type sshd_t; + class dir { search getattr }; class capability dac_override; class file { write ioctl read open getattr }; } @@ -33,6 +37,9 @@ require { allow qemu_t nova_var_lib_t:file rw_file_perms; allow qemu_t self:capability dac_override; +allow sshd_t nova_var_lib_t:file read_file_perms; +allow sshd_t nova_var_lib_t:dir { search getattr }; + # Compile with: # make -f /usr/share/selinux/devel/Makefile # Install: diff --git a/swift.fc b/openstack-selinux-swift.fc similarity index 100% rename from swift.fc rename to openstack-selinux-swift.fc diff --git a/swift.te b/openstack-selinux-swift.te similarity index 100% rename from swift.te rename to openstack-selinux-swift.te diff --git a/tests/check_all b/tests/check_all new file mode 100755 index 0000000..d71ab5b --- /dev/null +++ b/tests/check_all @@ -0,0 +1,41 @@ +#!/bin/bash + +TMP=$(mktemp /tmp/openstack-selinux-test.XXXXXX) + +PWD=$(pwd) +cd "$(dirname $0)" + +TEST_FILES=$(/bin/ls -1 bz*) + +passed=0 +failed=0 + +for f in $TEST_FILES; do + echo "CHECKING:" $f + totalAVC=$(grep -s -c "AVC" $f) + count=0 + while read; do + ((count++)) + echo "("$count"/"$totalAVC")" + echo "$REPLY" > $TMP + if audit2why -i $TMP | grep -q 'Missing type'; then + echo Failed on $f with the following AVC: + audit2why -i $TMP + ((failed++)) + else + ((passed++)) + fi + done < $f +done + +cd "$PWD" + +echo Results: $passed passed, $failed failed +echo -n "Overall result: " +if [ $failed -ne 0 ]; then + echo FAIL + exit 1 +fi + +echo PASS +exit 0