From be5142fc6f44d6cbe6f21179d113ec714334ce72 Mon Sep 17 00:00:00 2001
From: Miroslav Grepl <mgrepl@redhat.com>
Date: Thu, 16 Sep 2010 13:44:53 +0200
Subject: [PATCH] Fixes for cluster policy

---
 policy/modules/services/corosync.if | 19 +++++++++++++++++++
 policy/modules/services/corosync.te |  1 +
 policy/modules/services/rhcs.fc     |  1 +
 policy/modules/services/rhcs.if     | 19 +++++++++++++++++++
 policy/modules/services/rhcs.te     | 12 ++++++++++++
 5 files changed, 52 insertions(+)

diff --git a/policy/modules/services/corosync.if b/policy/modules/services/corosync.if
index 5220c9d5..05f7296b 100644
--- a/policy/modules/services/corosync.if
+++ b/policy/modules/services/corosync.if
@@ -18,6 +18,25 @@ interface(`corosync_domtrans',`
 	domtrans_pattern($1, corosync_exec_t, corosync_t)
 ')
 
+######################################
+## <summary>
+##      Execute corosync in the caller domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##      Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`corosync_exec',`
+        gen_require(`
+                type corosync_exec_t;
+        ')
+
+        corecmd_search_bin($1)
+        can_exec($1, corosync_exec_t)
+')
+
 #######################################
 ## <summary>
 ##	Allow the specified domain to read corosync's log files.
diff --git a/policy/modules/services/corosync.te b/policy/modules/services/corosync.te
index fdb0dcb0..ed9dd2f9 100644
--- a/policy/modules/services/corosync.te
+++ b/policy/modules/services/corosync.te
@@ -117,6 +117,7 @@ optional_policy(`
 	rhcs_rw_cluster_shm(corosync_t)
 	rhcs_rw_cluster_semaphores(corosync_t)
 	rhcs_stream_connect_cluster(corosync_t)
+	rhcs_read_cluster_lib_files(corosync_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/services/rhcs.fc b/policy/modules/services/rhcs.fc
index b19961ee..a8676c7a 100644
--- a/policy/modules/services/rhcs.fc
+++ b/policy/modules/services/rhcs.fc
@@ -10,6 +10,7 @@
 
 /var/lib/qdiskd(/.*)?				gen_context(system_u:object_r:qdiskd_var_lib_t,s0)
 
+/var/log/cluster/.*\.*log			<<none>>
 /var/log/cluster/dlm_controld\.log.*	--	gen_context(system_u:object_r:dlm_controld_var_log_t,s0)
 /var/log/cluster/fenced\.log.*		--	gen_context(system_u:object_r:fenced_var_log_t,s0)
 /var/log/cluster/gfs_controld\.log.*	--	gen_context(system_u:object_r:gfs_controld_var_log_t,s0)
diff --git a/policy/modules/services/rhcs.if b/policy/modules/services/rhcs.if
index 69283013..d8b97c2b 100644
--- a/policy/modules/services/rhcs.if
+++ b/policy/modules/services/rhcs.if
@@ -434,3 +434,22 @@ interface(`rhcs_read_qdiskd_tmpfs_files',`
 
 	allow $1 qdiskd_tmpfs_t:file read_file_perms;
 ')
+
+######################################
+## <summary>
+##      Allow domain to read cluster lib files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`rhcs_read_cluster_lib_files',`
+    gen_require(`
+        type cluster_var_lib_t;
+    ')
+
+    files_search_var_lib($1)
+    read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t)
+')
diff --git a/policy/modules/services/rhcs.te b/policy/modules/services/rhcs.te
index 68f2b99d..1ebc84d9 100644
--- a/policy/modules/services/rhcs.te
+++ b/policy/modules/services/rhcs.te
@@ -35,6 +35,10 @@ rhcs_domain_template(qdiskd)
 type qdiskd_var_lib_t;
 files_type(qdiskd_var_lib_t)
 
+# type for cluster lib files
+type cluster_var_lib_t;
+files_type(cluster_var_lib_t)
+
 #####################################
 #
 # dlm_controld local policy
@@ -105,6 +109,11 @@ tunable_policy(`fenced_can_network_connect',`
 	corenet_tcp_connect_all_ports(fenced_t)
 ')
 
+# needed by fence_scsi
+optional_policy(`
+       corosync_exec(fenced_t)
+')
+
 optional_policy(`
 	ccs_read_config(fenced_t)
 ')
@@ -223,6 +232,9 @@ allow cluster_domain self:fifo_file rw_fifo_file_perms;
 allow cluster_domain self:unix_stream_socket create_stream_socket_perms;
 allow cluster_domain self:unix_dgram_socket create_socket_perms;
 
+manage_files_pattern(cluster_domain, cluster_var_lib_t, cluster_var_lib_t)
+manage_dirs_pattern(cluster_domain, cluster_var_lib_t, cluster_var_lib_t)
+
 logging_send_syslog_msg(cluster_domain)
 
 miscfiles_read_localization(cluster_domain)