diff options
Diffstat (limited to 'xlators/features/selinux')
| -rw-r--r-- | xlators/features/selinux/src/Makefile.am | 3 | ||||
| -rw-r--r-- | xlators/features/selinux/src/selinux-mem-types.h | 7 | ||||
| -rw-r--r-- | xlators/features/selinux/src/selinux-messages.h | 88 | ||||
| -rw-r--r-- | xlators/features/selinux/src/selinux.c | 419 | ||||
| -rw-r--r-- | xlators/features/selinux/src/selinux.h | 4 |
5 files changed, 226 insertions, 295 deletions
diff --git a/xlators/features/selinux/src/Makefile.am b/xlators/features/selinux/src/Makefile.am index 34105d2a45b..4f1e5e149b3 100644 --- a/xlators/features/selinux/src/Makefile.am +++ b/xlators/features/selinux/src/Makefile.am @@ -1,5 +1,6 @@ +if WITH_SERVER xlator_LTLIBRARIES = selinux.la - +endif xlatordir = $(libdir)/glusterfs/$(PACKAGE_VERSION)/xlator/features selinux_la_LDFLAGS = -module $(GF_XLATOR_DEFAULT_LDFLAGS) diff --git a/xlators/features/selinux/src/selinux-mem-types.h b/xlators/features/selinux/src/selinux-mem-types.h index f9f356dd39a..553e59e5a9d 100644 --- a/xlators/features/selinux/src/selinux-mem-types.h +++ b/xlators/features/selinux/src/selinux-mem-types.h @@ -10,11 +10,10 @@ #ifndef __SELINUX_MEM_TYPES_H__ #define __SELINUX_MEM_TYPES_H__ -#include "mem-types.h" +#include <glusterfs/mem-types.h> enum gf_selinux_mem_types_ { - gf_selinux_mt_selinux_priv_t = gf_common_mt_end + 1, - gf_selinux_mt_end + gf_selinux_mt_selinux_priv_t = gf_common_mt_end + 1, + gf_selinux_mt_end }; #endif - diff --git a/xlators/features/selinux/src/selinux-messages.h b/xlators/features/selinux/src/selinux-messages.h index a498dc21471..f49a54f956c 100644 --- a/xlators/features/selinux/src/selinux-messages.h +++ b/xlators/features/selinux/src/selinux-messages.h @@ -11,88 +11,20 @@ #ifndef _SELINUX_MESSAGES_H__ #define _SELINUX_MESSAGES_H__ -#include "glfs-message-id.h" +#include <glusterfs/glfs-message-id.h> -/*! \file selinux-messages.h - * \brief Selinux log-message IDs and their descriptions - */ - -/* NOTE: Rules for message additions - * 1) Each instance of a message is _better_ left with a unique message ID, even - * if the message format is the same. Reasoning is that, if the message - * format needs to change in one instance, the other instances are not - * impacted or the new change does not change the ID of the instance being - * modified. - * 2) Addition of a message, - * - Should increment the GLFS_NUM_MESSAGES - * - Append to the list of messages defined, towards the end - * - Retain macro naming as glfs_msg_X (for readability across developers) - * NOTE: Rules for message format modifications - * 3) Check acorss the code if the message ID macro in question is reused - * anywhere. If reused then then the modifications should ensure correctness - * everywhere, or needs a new message ID as (1) above was not adhered to. If - * not used anywhere, proceed with the required modification. - * NOTE: Rules for message deletion - * 4) Check (3) and if used anywhere else, then cannot be deleted. If not used - * anywhere, then can be deleted, but will leave a hole by design, as - * addition rules specify modification to the end of the list and not filling - * holes. - */ - -#define GLFS_SL_BASE GLFS_MSGID_COMP_SL -#define GLFS_SL_NUM_MESSAGES 5 -#define GLFS_SL_MSGID_END (GLFS_SL_BASE + GLFS_NUM_MESSAGES + 1) -/* Messages with message IDs */ -#define glfs_msg_start_x GLFS_SL_BASE, "Invalid: Start of messages" -/*------------*/ - -#define SL_MSG_INVALID_VOLFILE (GLFS_SL_BASE + 1) - -/*! - * @messageid - * @diagnosis - * @recommendedaction - * - */ - -#define SL_MSG_ENOMEM (GLFS_SL_BASE + 2) - -/*! - * @messageid - * @diagnosis - * @recommendedaction - * - */ - -#define SL_MSG_MEM_ACCT_INIT_FAILED (GLFS_SL_BASE + 3) - -/*! - * @messageid - * @diagnosis - * @recommendedaction +/* To add new message IDs, append new identifiers at the end of the list. * - */ - -#define SL_MSG_SELINUX_GLUSTER_XATTR_MISSING (GLFS_SL_BASE + 4) - -/*! - * @messageid - * @diagnosis - * @recommendedaction + * Never remove a message ID. If it's not used anymore, you can rename it or + * leave it as it is, but not delete it. This is to prevent reutilization of + * IDs by other messages. * + * The component name must match one of the entries defined in + * glfs-message-id.h. */ -#define SL_MSG_SELINUX_XATTR_MISSING (GLFS_SL_BASE + 5) - -/*! - * @messageid - * @diagnosis - * @recommendedaction - * - */ - -/*-----------*/ -#define glfs_msg_end_x GLFS_MSGID_END, "Invalid: End of messages" +GLFS_MSGID(SL, SL_MSG_INVALID_VOLFILE, SL_MSG_ENOMEM, + SL_MSG_MEM_ACCT_INIT_FAILED, SL_MSG_SELINUX_GLUSTER_XATTR_MISSING, + SL_MSG_SELINUX_XATTR_MISSING); #endif /*_SELINUX_MESSAGES_H */ - diff --git a/xlators/features/selinux/src/selinux.c b/xlators/features/selinux/src/selinux.c index 1a4b39f253c..9b1b4b55e1a 100644 --- a/xlators/features/selinux/src/selinux.c +++ b/xlators/features/selinux/src/selinux.c @@ -8,317 +8,316 @@ cases as published by the Free Software Foundation. */ -#include "xlator.h" +#include <glusterfs/xlator.h> #include "selinux.h" #include "selinux-messages.h" #include "selinux-mem-types.h" -#include "compat-errno.h" +#include <glusterfs/compat-errno.h> static int -selinux_fgetxattr_cbk (call_frame_t *frame, void *cookie, xlator_t *this, - int op_ret, int op_errno, dict_t *dict, dict_t *xdata) +selinux_fgetxattr_cbk(call_frame_t *frame, void *cookie, xlator_t *this, + int op_ret, int op_errno, dict_t *dict, dict_t *xdata) { - int ret = 0; - char *name = cookie; - - if (op_errno == 0 && name && (!strcmp(name, SELINUX_GLUSTER_XATTR))) { - ret = dict_rename_key (dict, SELINUX_GLUSTER_XATTR, - SELINUX_XATTR); - if (ret < 0) - gf_msg (this->name, GF_LOG_ERROR, op_errno, - SL_MSG_SELINUX_GLUSTER_XATTR_MISSING, - "getxattr failed for %s", SELINUX_XATTR); - - } - - STACK_UNWIND_STRICT (fgetxattr, frame, op_ret, op_errno, - dict, xdata); - return ret; + int ret = 0; + char *name = cookie; + + if (op_errno == 0 && dict && name && + (!strcmp(name, SELINUX_GLUSTER_XATTR))) { + ret = dict_rename_key(dict, SELINUX_GLUSTER_XATTR, SELINUX_XATTR); + if (ret < 0) + gf_msg(this->name, GF_LOG_ERROR, op_errno, + SL_MSG_SELINUX_GLUSTER_XATTR_MISSING, + "getxattr failed for %s", SELINUX_XATTR); + } + + STACK_UNWIND_STRICT(fgetxattr, frame, op_ret, op_errno, dict, xdata); + return ret; } - static int -selinux_fgetxattr (call_frame_t *frame, xlator_t *this, fd_t *fd, - const char *name, dict_t *xdata) +selinux_fgetxattr(call_frame_t *frame, xlator_t *this, fd_t *fd, + const char *name, dict_t *xdata) { - selinux_priv_t *priv = NULL; - int32_t op_ret = -1; - int32_t op_errno = EINVAL; - char *xattr_name = (char *) name; + selinux_priv_t *priv = NULL; + int32_t op_ret = -1; + int32_t op_errno = EINVAL; + char *xattr_name = (char *)name; - priv = this->private; + priv = this->private; - GF_VALIDATE_OR_GOTO ("selinux", priv, err); + GF_VALIDATE_OR_GOTO("selinux", priv, err); - /* name can be NULL for listxattr calls */ - if (!priv->selinux_enabled || !name) - goto off; + /* name can be NULL for listxattr calls */ + if (!priv->selinux_enabled || !name) + goto off; - if (strcmp (name, SELINUX_XATTR) == 0) - xattr_name = SELINUX_GLUSTER_XATTR; + if (strcmp(name, SELINUX_XATTR) == 0) + xattr_name = SELINUX_GLUSTER_XATTR; off: - STACK_WIND_COOKIE (frame, selinux_fgetxattr_cbk, xattr_name, - FIRST_CHILD(this), - FIRST_CHILD(this)->fops->fgetxattr, fd, xattr_name, - xdata); - return 0; + STACK_WIND_COOKIE(frame, selinux_fgetxattr_cbk, xattr_name, + FIRST_CHILD(this), FIRST_CHILD(this)->fops->fgetxattr, fd, + xattr_name, xdata); + return 0; err: - STACK_UNWIND_STRICT (fgetxattr, frame, op_ret, op_errno, NULL, xdata); + STACK_UNWIND_STRICT(fgetxattr, frame, op_ret, op_errno, NULL, xdata); - return 0; + return 0; } static int -selinux_getxattr_cbk (call_frame_t *frame, void *cookie, xlator_t *this, - int op_ret, int op_errno, dict_t *dict, dict_t *xdata) +selinux_getxattr_cbk(call_frame_t *frame, void *cookie, xlator_t *this, + int op_ret, int op_errno, dict_t *dict, dict_t *xdata) { - int ret = 0; - char *name = cookie; - - if (op_errno == 0 && name && (!strcmp(name, SELINUX_GLUSTER_XATTR))) { - ret = dict_rename_key (dict, SELINUX_GLUSTER_XATTR, - SELINUX_XATTR); - if (ret < 0) - gf_msg (this->name, GF_LOG_ERROR, op_errno, - SL_MSG_SELINUX_GLUSTER_XATTR_MISSING, - "getxattr failed for %s", SELINUX_XATTR); + int ret = 0; + char *name = cookie; - } + if (op_errno == 0 && dict && name && + (!strcmp(name, SELINUX_GLUSTER_XATTR))) { + ret = dict_rename_key(dict, SELINUX_GLUSTER_XATTR, SELINUX_XATTR); + if (ret < 0) + gf_msg(this->name, GF_LOG_ERROR, op_errno, + SL_MSG_SELINUX_GLUSTER_XATTR_MISSING, + "getxattr failed for %s", SELINUX_XATTR); + } - STACK_UNWIND_STRICT (getxattr, frame, op_ret, op_errno, dict, xdata); + STACK_UNWIND_STRICT(getxattr, frame, op_ret, op_errno, dict, xdata); - return 0; + return 0; } - static int -selinux_getxattr (call_frame_t *frame, xlator_t *this, loc_t *loc, - const char *name, dict_t *xdata) +selinux_getxattr(call_frame_t *frame, xlator_t *this, loc_t *loc, + const char *name, dict_t *xdata) { - selinux_priv_t *priv = NULL; - int32_t op_ret = -1; - int32_t op_errno = EINVAL; - char *xattr_name = (char *) name; + selinux_priv_t *priv = NULL; + int32_t op_ret = -1; + int32_t op_errno = EINVAL; + char *xattr_name = (char *)name; - priv = this->private; + priv = this->private; - GF_VALIDATE_OR_GOTO ("selinux", priv, err); + GF_VALIDATE_OR_GOTO("selinux", priv, err); - /* name can be NULL for listxattr calls */ - if (!priv->selinux_enabled || !name) - goto off; + /* name can be NULL for listxattr calls */ + if (!priv->selinux_enabled || !name) + goto off; - if (strcmp (name, SELINUX_XATTR) == 0) - xattr_name = SELINUX_GLUSTER_XATTR; + if (strcmp(name, SELINUX_XATTR) == 0) + xattr_name = SELINUX_GLUSTER_XATTR; off: - STACK_WIND_COOKIE (frame, selinux_getxattr_cbk, xattr_name, - FIRST_CHILD(this), - FIRST_CHILD(this)->fops->getxattr, loc, xattr_name, - xdata); - return 0; + STACK_WIND_COOKIE(frame, selinux_getxattr_cbk, xattr_name, + FIRST_CHILD(this), FIRST_CHILD(this)->fops->getxattr, loc, + xattr_name, xdata); + return 0; err: - STACK_UNWIND_STRICT (getxattr, frame, op_ret, op_errno, NULL, xdata); - return 0; + STACK_UNWIND_STRICT(getxattr, frame, op_ret, op_errno, NULL, xdata); + return 0; } static int -selinux_fsetxattr_cbk (call_frame_t *frame, void *cookie, xlator_t *this, - int op_ret, int op_errno, dict_t *xdata) +selinux_fsetxattr_cbk(call_frame_t *frame, void *cookie, xlator_t *this, + int op_ret, int op_errno, dict_t *xdata) { - STACK_UNWIND_STRICT (fsetxattr, frame, op_ret, op_errno, xdata); - return 0; - + STACK_UNWIND_STRICT(fsetxattr, frame, op_ret, op_errno, xdata); + return 0; } - static int -selinux_fsetxattr (call_frame_t *frame, xlator_t *this, fd_t *fd, dict_t *dict, - int flags, dict_t *xdata) +selinux_fsetxattr(call_frame_t *frame, xlator_t *this, fd_t *fd, dict_t *dict, + int flags, dict_t *xdata) { - selinux_priv_t *priv = NULL; - int32_t op_ret = -1; - int32_t op_errno = EINVAL; - int32_t ret = -1; + selinux_priv_t *priv = NULL; + int32_t op_ret = -1; + int32_t op_errno = EINVAL; + int32_t ret = -1; - priv = this->private; + priv = this->private; - GF_VALIDATE_OR_GOTO ("selinux", priv, err); + GF_VALIDATE_OR_GOTO("selinux", priv, err); - if (!priv->selinux_enabled) - goto off; + if (!priv->selinux_enabled && !dict) + goto off; - ret = dict_rename_key (dict, SELINUX_XATTR, SELINUX_GLUSTER_XATTR); - if (ret < 0 && ret != -ENODATA) - goto err; + ret = dict_rename_key(dict, SELINUX_XATTR, SELINUX_GLUSTER_XATTR); + if (ret < 0 && ret != -ENODATA) + goto err; off: - STACK_WIND (frame, selinux_fsetxattr_cbk, FIRST_CHILD(this), - FIRST_CHILD(this)->fops->fsetxattr, fd, dict, flags, - xdata); - + STACK_WIND(frame, selinux_fsetxattr_cbk, FIRST_CHILD(this), + FIRST_CHILD(this)->fops->fsetxattr, fd, dict, flags, xdata); - return 0; + return 0; err: - STACK_UNWIND_STRICT (fsetxattr, frame, op_ret, op_errno, xdata); - return 0; - + STACK_UNWIND_STRICT(fsetxattr, frame, op_ret, op_errno, xdata); + return 0; } static int -selinux_setxattr_cbk (call_frame_t *frame, void *cookie, xlator_t *this, - int op_ret, int op_errno, dict_t *xdata) +selinux_setxattr_cbk(call_frame_t *frame, void *cookie, xlator_t *this, + int op_ret, int op_errno, dict_t *xdata) { - STACK_UNWIND_STRICT (setxattr, frame, op_ret, op_errno, xdata); - return 0; + STACK_UNWIND_STRICT(setxattr, frame, op_ret, op_errno, xdata); + return 0; } - static int -selinux_setxattr (call_frame_t *frame, xlator_t *this, loc_t *loc, - dict_t *dict, int flags, dict_t *xdata) +selinux_setxattr(call_frame_t *frame, xlator_t *this, loc_t *loc, dict_t *dict, + int flags, dict_t *xdata) { - selinux_priv_t *priv = NULL; - int32_t op_ret = -1; - int32_t op_errno = EINVAL; - int32_t ret = -1; + selinux_priv_t *priv = NULL; + int32_t op_ret = -1; + int32_t op_errno = EINVAL; + int32_t ret = -1; - priv = this->private; + priv = this->private; - GF_VALIDATE_OR_GOTO ("selinux", priv, err); + GF_VALIDATE_OR_GOTO("selinux", priv, err); - if (!priv->selinux_enabled) - goto off; + if (!priv->selinux_enabled && !dict) + goto off; - ret = dict_rename_key (dict, SELINUX_XATTR, SELINUX_GLUSTER_XATTR); - if (ret < 0 && ret != -ENODATA) - goto err; + ret = dict_rename_key(dict, SELINUX_XATTR, SELINUX_GLUSTER_XATTR); + if (ret < 0 && ret != -ENODATA) + goto err; off: - STACK_WIND (frame, selinux_setxattr_cbk, FIRST_CHILD(this), - FIRST_CHILD(this)->fops->setxattr, loc, dict, flags, - xdata); - return 0; + STACK_WIND(frame, selinux_setxattr_cbk, FIRST_CHILD(this), + FIRST_CHILD(this)->fops->setxattr, loc, dict, flags, xdata); + return 0; err: - STACK_UNWIND_STRICT (setxattr, frame, op_ret, op_errno, xdata); - return 0; + STACK_UNWIND_STRICT(setxattr, frame, op_ret, op_errno, xdata); + return 0; } int32_t -mem_acct_init (xlator_t *this) +mem_acct_init(xlator_t *this) { - int ret = -1; + int ret = -1; - GF_VALIDATE_OR_GOTO("selinux", this, out); + GF_VALIDATE_OR_GOTO("selinux", this, out); - ret = xlator_mem_acct_init (this, gf_selinux_mt_end + 1); + ret = xlator_mem_acct_init(this, gf_selinux_mt_end + 1); - if (ret != 0) { - gf_msg (this->name, GF_LOG_ERROR, 0, - SL_MSG_MEM_ACCT_INIT_FAILED, - "Memory accounting init failed"); - return ret; - } -out: + if (ret != 0) { + gf_msg(this->name, GF_LOG_ERROR, 0, SL_MSG_MEM_ACCT_INIT_FAILED, + "Memory accounting init failed"); return ret; + } +out: + return ret; } int32_t -init (xlator_t *this) +init(xlator_t *this) { - int32_t ret = -1; - selinux_priv_t *priv = NULL; - - GF_VALIDATE_OR_GOTO ("selinux", this, out); - - if (!this->children || this->children->next) { - gf_msg (this->name, GF_LOG_WARNING, 0, SL_MSG_INVALID_VOLFILE, - "Error: SELinux (%s) not configured with exactly one " - "child", this->name); - return -1; - } - - if (this->parents == NULL) { - gf_msg (this->name, GF_LOG_WARNING, 0, SL_MSG_INVALID_VOLFILE, - "Dangling volume. Please check the volfile"); - } - - priv = GF_CALLOC (1, sizeof (*priv), gf_selinux_mt_selinux_priv_t); - if (!priv) { - gf_log (this->name, GF_LOG_ERROR, "out of memory"); - ret = ENOMEM; - goto out; - } - - GF_OPTION_INIT ("selinux", priv->selinux_enabled, bool, out); - - this->local_pool = mem_pool_new (selinux_priv_t, 64); - if (!this->local_pool) { - ret = -1; - gf_msg (this->name, GF_LOG_ERROR, ENOMEM, SL_MSG_ENOMEM, - "Failed to create local_t's memory pool"); - goto out; - } - - this->private = (void *)priv; - ret = 0; + int32_t ret = -1; + selinux_priv_t *priv = NULL; + + GF_VALIDATE_OR_GOTO("selinux", this, out); + + if (!this->children || this->children->next) { + gf_msg(this->name, GF_LOG_WARNING, 0, SL_MSG_INVALID_VOLFILE, + "Error: SELinux (%s) not configured with exactly one " + "child", + this->name); + return -1; + } + + if (this->parents == NULL) { + gf_msg(this->name, GF_LOG_WARNING, 0, SL_MSG_INVALID_VOLFILE, + "Dangling volume. Please check the volfile"); + } + + priv = GF_CALLOC(1, sizeof(*priv), gf_selinux_mt_selinux_priv_t); + if (!priv) { + gf_log(this->name, GF_LOG_ERROR, "out of memory"); + goto out; + } + + GF_OPTION_INIT("selinux", priv->selinux_enabled, bool, out); + + this->local_pool = mem_pool_new(selinux_priv_t, 64); + if (!this->local_pool) { + gf_msg(this->name, GF_LOG_ERROR, ENOMEM, SL_MSG_ENOMEM, + "Failed to create local_t's memory pool"); + goto out; + } + + this->private = (void *)priv; + ret = 0; out: - if (ret) { - if (priv) { - GF_FREE (priv); - } - mem_pool_destroy (this->local_pool); - } - return ret; + if (ret) { + GF_FREE(priv); + mem_pool_destroy(this->local_pool); + this->local_pool = NULL; + } + return ret; } int -reconfigure (xlator_t *this, dict_t *options) +reconfigure(xlator_t *this, dict_t *options) { - int32_t ret = -1; - selinux_priv_t *priv = NULL; + int32_t ret = -1; + selinux_priv_t *priv = NULL; - priv = this->private; + priv = this->private; - GF_OPTION_RECONF ("selinux", priv->selinux_enabled, options, - bool, out); + GF_OPTION_RECONF("selinux", priv->selinux_enabled, options, bool, out); - ret = 0; + ret = 0; out: - return ret; - + return ret; } void -fini (xlator_t *this) +fini(xlator_t *this) { - selinux_priv_t *priv = NULL; + selinux_priv_t *priv = NULL; - priv = this->private; - GF_FREE (priv); + priv = this->private; + GF_FREE(priv); - mem_pool_destroy (this->local_pool); + mem_pool_destroy(this->local_pool); + this->local_pool = NULL; - return; + return; } struct xlator_fops fops = { - .getxattr = selinux_getxattr, - .fgetxattr = selinux_fgetxattr, - .setxattr = selinux_setxattr, - .fsetxattr = selinux_fsetxattr, + .getxattr = selinux_getxattr, + .fgetxattr = selinux_fgetxattr, + .setxattr = selinux_setxattr, + .fsetxattr = selinux_fsetxattr, }; -struct xlator_cbks cbks = { -}; +struct xlator_cbks cbks = {}; struct volume_options options[] = { - { .key = { "selinux" }, - .type = GF_OPTION_TYPE_BOOL, - .default_value = "on", - .description = "Enable/disable selinux translator", - }, - { .key = { NULL }, } + { + .key = {"selinux"}, + .type = GF_OPTION_TYPE_BOOL, + .default_value = "on", + .description = "Enable/disable selinux translator", + .op_version = {GD_OP_VERSION_3_11_0}, + .flags = OPT_FLAG_SETTABLE, + .tags = {"security", "linux"}, + }, + { + .key = {NULL}, + }}; + +xlator_api_t xlator_api = { + .init = init, + .fini = fini, + .reconfigure = reconfigure, + .mem_acct_init = mem_acct_init, + .op_version = {1}, /* Present from the initial version */ + .fops = &fops, + .cbks = &cbks, + .options = options, + .identifier = "selinux", + .category = GF_MAINTAINED, }; diff --git a/xlators/features/selinux/src/selinux.h b/xlators/features/selinux/src/selinux.h index 2ff57b5080a..1bbdad3bb36 100644 --- a/xlators/features/selinux/src/selinux.h +++ b/xlators/features/selinux/src/selinux.h @@ -10,13 +10,13 @@ #ifndef __SELINUX_H__ #define __SELINUX_H__ -#include "common-utils.h" +#include <glusterfs/common-utils.h> #define SELINUX_XATTR "security.selinux" #define SELINUX_GLUSTER_XATTR "trusted.glusterfs.selinux" struct selinux_priv { - gf_boolean_t selinux_enabled; + gf_boolean_t selinux_enabled; }; typedef struct selinux_priv selinux_priv_t; |
