local_settings.sh.in

#!/bin/bash

QUIET=1
MODE=0
ROOTDIR=${ROOTDIR:-/}
BINDIR=${BINDIR:-/usr/bin}
SBINDIR=${SBINDIR:-/sbin}
LOCALSTATEDIR=${LOCALSTATEDIR:-/var}
DATADIR=${DATADIR:-/usr/share}
SHAREDSTATEDIR=${SHAREDSTATEDIR:-/var/lib}
LOCALDIR=${LOCALDIR:-$DATADIR/openstack-selinux/master}
MODULES=${MODULES:-@MODULES@}
# libselinux-3.4 introduces a new feature. Let's see if we can use it!
SELINUX_THREAD_VERSION=3.4

# This is for caching the file modes; -A is a bash associative
# array ("dict" or "map" in other languages)
# See bug for bug #1560019 for more information.
declare -A file_modes

# This associative array ("dict", "map", "hash") holds ALL the specific
# location with specific fcontext settings.
declare -A custom_fcontext=(
["$SHAREDSTATEDIR/designate/bind9(/.*)?"]='named_zone_t'
["$SHAREDSTATEDIR/vhost_sockets(/.*)?"]='virt_cache_t'
["$SHAREDSTATEDIR/openstack-dashboard"]='httpd_var_lib_t'
["$LOCALSTATEDIR/log/gnocchi/app.log"]='httpd_log_t'
["$LOCALSTATEDIR/log/aodh/app.log"]='httpd_log_t'
["$LOCALSTATEDIR/log/panko/app.log"]='httpd_log_t'
["$LOCALSTATEDIR/log/zaqar/zaqar.log"]='httpd_log_t'
["$LOCALSTATEDIR/lib/config-data(/.*)?"]='container_file_t'
["$LOCALSTATEDIR/lib/kolla(/.*)?"]='container_file_t'
["$LOCALSTATEDIR/lib/tripleo-config(/.*)?"]='container_file_t'
["$BINDIR/neutron-rootwrap-daemon"]='neutron_exec_t'
["$BINDIR/neutron-vpn-agent"]='neutron_exec_t'
["$LOCALSTATEDIR/cache/swift(/.*)?"]='swift_var_cache_t'
["$BINDIR/swift-object-reconstructor"]='swift_exec_t'
["$BINDIR/swift-object-relinker"]='swift_exec_t'
["${ROOTDIR}httpboot(/.*)?"]='httpd_sys_content_t'
["$SHAREDSTATEDIR/nova/.ssh(/.*)?"]='ssh_home_t'
["${ROOTDIR}tftpboot(/.*)?"]='tftpdir_t'
["$LOCALSTATEDIR/log/pacemaker.log.*"]='cluster_var_log_t'
["$LOCALSTATEDIR/log/pacemaker(/.*)?"]='cluster_var_log_t'
)

# This associative array ("dict", "map", "hash") will holds all the current
# custom fcontext settings
declare -A existing_custom_fcontext

# This associative array ("dict", "map", "hash") will holds all the differences
# we have between existing custom fcontext, and what we really want.
# It will be used in different methods in this script.
declare -A diff_fcontext

# Let's populate the existing_custom_fcontext
for l in $(semanage fcontext -Cln | awk -F '[: ]+' '{print $1";"$6}'); do
	existing_custom_fcontext+=([$(echo $l|cut -d ';' -f1)]=$(echo $l|cut -d ';' -f2))
done

# Let's populate the diff_fcontext
for i in "${!custom_fcontext[@]}"; do
    if [[ ! -v existing_custom_fcontext["$i"] ]]; then
        diff_fcontext+=([$i]=${custom_fcontext[$i]})
    elif [[ ${existing_custom_fcontext["$i"]} != "${custom_fcontext[$i]}" ]]; then
        diff_fcontext+=([$i]=${custom_fcontext[$i]})
    fi
done

do_echo() {
	if [ $QUIET -eq 0 ]; then
		return
	fi
	echo $*
}

# Source : https://stackoverflow.com/questions/4023830/how-to-compare-two-strings-in-dot-separated-version-format-in-bash
vercomp () {
	if [[ $1 == $2 ]]; then
		return 0
	fi
	local IFS=.
	local i ver1=($1) ver2=($2)
	# fill empty fields in ver1 with zeros
	for ((i=${#ver1[@]}; i<${#ver2[@]}; i++)); do
		ver1[i]=0
	done
	for ((i=0; i<${#ver1[@]}; i++)); do
		if [[ -z ${ver2[i]} ]]; then
			# fill empty fields in ver2 with zeros
			ver2[i]=0
		fi
		if ((10#${ver1[i]} > 10#${ver2[i]})); then
			return 1
		fi
		if ((10#${ver1[i]} < 10#${ver2[i]})); then
			return 2
		fi
	done
	return 0
}

function get_clean_name() {
    if [[ "${1}" =~ '(' ]]; then
        echo "$1" | cut -d '(' -f1
    else
        echo $1
    fi
}

relabel_files() {
    local opts=""

    do_echo "Relabeling files..."
    if [ $QUIET -ne 0 ]; then
          opts="-v"
    fi
    current_version=$(/usr/bin/secon --version| grep -oE '[0-9]+(\.[0-9]+)+') # ensure we match 3.3, 3.3.1, 3.3-rc3 and so on
    vercomp $current_version $SELINUX_THREAD_VERSION
    if [ $? -le 1 ]; then # we want '>='
      # "-T 0" will use all available cores.
      opts="${opts} -T 0"
    fi

    # Setfiles is a lot like restorecon, except it takes a policy
    # on-disk instead of looking at the kernel-loaded policy
    # So, it works inside of image builds.
    #
    # At a minimum, we need a line for each entry we have where we are
    # customizing the label using 'semanage' below, but also
    # others, when applicable.
    declare -a f_list
    for i in "${!custom_fcontext[@]}"; do
        f_list=("${f_list[@]}" "$(get_clean_name "$i")")
    done
    $SBINDIR/setfiles $opts -F $ROOTDIR/etc/selinux/targeted/contexts/files/file_contexts \
      $LOCALSTATEDIR/run/swift \
      $LOCALSTATEDIR/swift \
      /srv \
      $LOCALSTATEDIR/run/redis \
      $LOCALSTATEDIR/log \
      ${f_list[@]} 2> /dev/null || :
}


# usage: set_port tcp|udp port# context
set_port()
{
	# There's no add-or-modify, so try a modify, and if that fails,
	# add the new rule.
	#
	# -N prevents reloading
	$SBINDIR/semanage port -N -m -t $3 -p $1 $2 2>&1 | grep -qE 'ValueError: Port.*is not defined'
	# Grep succeeded - meaning this was not defined
	if [ $? -eq 0 ]; then
		# So, we need to add it.
		$SBINDIR/semanage port -N -a -t $3 -p $1 $2 &> /dev/null
	fi
}

# usage: set_file_context a|d (add/delete)
set_file_contexts() {
    case $1 in
        'a')
            for f_context in "${!diff_fcontext[@]}"; do
                eval semanage fcontext -N -${1} -t ${diff_fcontext[$f_context]} \"${f_context}\" &> /dev/null
            done
            ;;
        'd')
            for f_context in "${!custom_fcontext[@]}"; do
                eval semanage fcontext -N -${1} -t ${custom_fcontext[$f_context]} \"${f_context}\" &> /dev/null
            done
            ;;
    esac
}


_cache_file_modes() {
	if ! [ -d '/etc/selinux/targeted/active' ]; then
		return
	fi
	for f in $(find /etc/selinux/targeted/active -maxdepth 1 -type f); do
		file_modes[$f]=$(stat -c %a $f)
	done
}


_restore_file_modes() {
	for k in "${!file_modes[@]}"; do
		chmod ${file_modes[$k]} $k
	done
}


install_policies() {
	# Bug #1560019
	#
	# 'semanage' seems to recreate
	# /etc/selinux/targeted/active/seusers
	# /etc/selinux/targeted/active/user_extra
	# with the wrong mode, breaking 'rpm -Va'
	#
	# Store file modes and explicitly chmod
	# them back when we're done with our setup.
	_cache_file_modes

	do_echo "Setting up ports..."
	#
	# Port rules
	#

	# bz#1118859
	set_port tcp 4444 mysqld_port_t

	# bz#1260202
	set_port tcp 6653 openvswitch_port_t

	# bz#1360434
	set_port tcp 8088 http_port_t

	# bz#1396553
	set_port tcp 8000 http_port_t

	# bz#1498921
	set_port tcp 6639 ovsdb_port_t

	# bz#1499134
	set_port tcp 6641 ovsdb_port_t
	set_port tcp 6642 ovsdb_port_t

	# Create all the file contexts
	do_echo "Add custom fcontext..."
	set_file_contexts "a"

	# Build up a script to pass to semanage
	#
	# Booleans
	# -N -> don't reload policy
	# -m -> modify
	#
	CR=$'\n'
	INPUT="boolean -N -m --on virt_use_fusefs
	boolean -N -m --on glance_api_can_network
	boolean -N -m --on neutron_can_network
	boolean -N -m --on glance_use_fusefs
	boolean -N -m --on haproxy_connect_any
	boolean -N -m --on nis_enabled
	boolean -N -m --on rsync_full_access
	boolean -N -m --on rsync_client
	boolean -N -m --on virt_use_execmem
	boolean -N -m --on virt_use_nfs
	boolean -N -m --on daemons_enable_cluster_mode
	boolean -N -m --on glance_use_execmem
	boolean -N -m --on httpd_execmem
	boolean -N -m --on domain_kernel_load_modules
	boolean -N -m --on httpd_can_network_connect
	boolean -N -m --on swift_can_network
	boolean -N -m --on httpd_use_openstack
	boolean -N -m --on collectd_tcp_network_connect
	boolean -N -m --on domain_can_mmap_files"

	#
	# Append modules to our semanage script
	#
	for x in $MODULES; do
		INPUT="${INPUT}${CR}module -N -a $DATADIR/selinux/packages/$x.pp.bz2"
	done

	#
	# Execute the semanage script:
	# Do most things in one transaction, but don't reload policy
	# in case we're in a chroot environment.
	#
	do_echo "Installing OpenStack extra policies and setting booleans..."
	echo "$INPUT" | $SBINDIR/semanage import -N

	# Unfortunately, we can't load new modules and set
	# booleans defined in those modules in a single transaction,
	# so do a second one to set our new booleans.
	INPUT="boolean -N -m --on os_nova_use_execmem
	boolean -N -m --on os_neutron_use_execmem
	boolean -N -m --on os_swift_use_execmem
	boolean -N -m --on os_keystone_use_execmem
	boolean -N -m --on os_glance_use_sudo
	boolean -N -m --on os_httpd_wsgi
	boolean -N -m --on os_gnocchi_use_nfs
	boolean -N -m --on os_virtlogd_use_nfs
	boolean -N -m --on os_glance_use_nfs
	boolean -N -m --on os_cinder_use_nfs
	boolean -N -m --on os_glance_dac_override
	boolean -N -m --on os_haproxy_dac_override
	boolean -N -m --on os_keepalived_dac_override
	boolean -N -m --on os_openvswitch_dac_override
	boolean -N -m --on os_virtlog_dac_override"
	# Note the last 5 dac_override booleans will be eventually disabled (bugzilla 2000945)

	do_echo "Setting OpenStack booleans..."
	echo "$INPUT" | $SBINDIR/semanage import -N

	relabel_files
	if $SBINDIR/selinuxenabled ; then
		do_echo "Reloading SELinux policies..."
		#
		# Chroot environments (e.g. when building images)
		# won't get here, which is why we do everything else
		# above.
		#
		$SBINDIR/load_policy
	fi

	# Bug #1560019
	_restore_file_modes
}


uninstall_policies() {
	# Bug #1560019
	_cache_file_modes

	# Remove our modules and rebuild policy
	do_echo "Removing OpenStack modules..."
	$SBINDIR/semodule -n -r $MODULES &> /dev/null || :

	# Delete all the file contexts
	do_echo "Removing custom fcontext..."
	set_file_contexts "d"

	relabel_files

	if $SBINDIR/selinuxenabled ; then
		do_echo "Reloading SELinux policies..."
		$SBINDIR/load_policy
	fi

	# Bug #1560019
	_restore_file_modes
}

verify_policies() {
	if ! selinuxenabled; then
		echo "SELinux is disabled"
		exit 0
	fi
	if [ "$(id -u)" != "0" ]; then
		echo "Note: UID is not 0; cannot check SELinux module status"
		exit 0
	fi

	failed_count=0
	INSTALLED_MODULES=$(semodule -l)
	for module in $MODULES; do
		local_failed=1
		for installed_module in $INSTALLED_MODULES; do
			if [ "$module" == "$installed_module" ]; then
				local_failed=0
				break
			fi
		done
		test ${local_failed} -ne 0 && (echo "Missing ${module}!" >&2)
		let "failed_count+=$local_failed"
	done
	if [ ${failed_count} -eq 0 ]; then
		echo "All modules are present."
		exit 0
	else
		echo "Found ${failed_count} missing module(s)." >&2
		exit 1
	fi
}


while getopts m:xqV opt; do
	case $opt in
	m)	# modules
		MODULES="$OPTARG"
		;;
	x)	# uninstall
		MODE=1
		;;
	q)
		QUIET=0
		;;
	V)
		MODE=2
		;;
	esac
done


case $MODE in
	0)
		install_policies
		;;
	1)
		uninstall_policies
		;;
	2)
		verify_policies
		;;
esac
exit $?