Parent

OpenShift::Utils::SELinux

Public Class Methods

chcon(path, label=nil, type=nil, role=nil, user=nil) click to toggle source

Public: Set the context of a single file or directory.

Where a portion of the context is not provided on the command line, it will be determined from the file context database or the file itself.

# File lib/openshift-origin-node/utils/selinux.rb, line 102
def self.chcon(path, label=nil, type=nil, role=nil, user=nil)
  matchpathcon_update
  mode = File.lstat(path).mode & 07777
  old_context = Selinux.lgetfilecon(path)
  context = Selinux.matchpathcon(path, mode)
  if context == -1
    if old_context == -1
      err = "Could not read or determine the file context for #{path}"
      NodeLogger.logger.error(err)
      raise Errno::EINVAL.new(err)
    else
      context = old_context
    end
  end
  context = Selinux.context_new(context[1])
  Selinux.context_range_set(context, label) unless label.nil?
  Selinux.context_type_set(context, type)   unless type.nil?
  Selinux.context_role_set(context, role)   unless role.nil?
  Selinux.context_user_set(context, user)   unless user.nil?
  context = Selinux.context_str(context)
  if context != old_context[1]
    if Selinux.lsetfilecon(path, context) == -1
      err = "Could not set the file context #{context} on #{path}"
      NodeLogger.logger.error(err)
      raise Errno::EINVAL.new(err)
    end
  end
end
clear_mcs_label(*paths) click to toggle source

Public: Clear the SELinux context of any MCS label.

# File lib/openshift-origin-node/utils/selinux.rb, line 167
def self.clear_mcs_label(*paths)
  set_mcs_label(nil, *paths)
end
clear_mcs_label_R(*paths) click to toggle source

Public: Recursively clear the SELinux context of any MCS label.

# File lib/openshift-origin-node/utils/selinux.rb, line 174
def self.clear_mcs_label_R(*paths)
  set_mcs_label_R(nil, *paths)
end
context_from_defaults(label=nil, type=nil, role=nil, user=nil) click to toggle source

Public: Create a context from defaults.

# File lib/openshift-origin-node/utils/selinux.rb, line 181
def self.context_from_defaults(label=nil, type=nil, role=nil, user=nil)
  t_label = (label || @@DEF_RUN_LABEL).to_s
  t_type  = (type  || @@DEF_RUN_TYPE).to_s
  t_role  = (role  || @@DEF_RUN_ROLE).to_s
  t_user  = (user  || @@DEF_RUN_USER).to_s
  "#{t_user}:#{t_role}:#{t_type}:#{t_label}"
end
get_mcs_label(name) click to toggle source

Public: Determine the MCS label for a given index

@param [Integer] The user name or uid @return [String] The SELinux MCS label

# File lib/openshift-origin-node/utils/selinux.rb, line 71
def self.get_mcs_label(name)
  config = OpenShift::Config.new

  group_size= (config.get("SELINUX_MCS_GROUP_SIZE") || @@DEF_MCS_GROUP_SIZE).to_i
  uid_offset= (config.get("SELINUX_MCS_UID_OFFSET") || @@DEF_MCS_UID_OFFSET).to_i

  begin
    uid = Etc.getpwnam(name.to_s).uid
  rescue ArgumentError, TypeError, NoMethodError
    uid = name.to_i
  end

  if uid < uid_offset + group_size - 1
    raise ArgumentError, "Argument must resolve to a UID greater than #{uid_offset + group_size - 1}: #{name}"
  end

  mcs_labels.each do |tuid, label|
    if uid == tuid
      return label
    end
  end
  raise ArgumentError, "Argument resolved to a UID too large for MCS set parameters: #{uid}"
end
getcon() click to toggle source

Public: Get the current context

# File lib/openshift-origin-node/utils/selinux.rb, line 192
def self.getcon
  Selinux.getcon[1]
end
mcs_labels() click to toggle source

Public: Return an enumerator which yields each UID -> MCS label combination.

Provides a more efficient way to iterate through all of the available ones than re-running the combinations each time.

# File lib/openshift-origin-node/utils/selinux.rb, line 44
def self.mcs_labels
  Enumerator.new do |yielder|
    config = OpenShift::Config.new

    set_size  = (config.get("SELINUX_MCS_SET_SIZE")   || @@DEF_MCS_SET_SIZE).to_i
    group_size= (config.get("SELINUX_MCS_GROUP_SIZE") || @@DEF_MCS_GROUP_SIZE).to_i
    uid_offset= (config.get("SELINUX_MCS_UID_OFFSET") || @@DEF_MCS_UID_OFFSET).to_i
    mls_num   = (config.get("SELINUX_MLS_NUM")        || @@DEF_MLS_NUM).to_i

    iuid = uid_offset + group_size - 1

    set_size.times.to_a.combination(group_size) do |c|
      mcs_label = c.sort.map { |i| "c#{i}" }.join(",")
      mls_label = "s#{mls_num}"

      yielder.yield([iuid, "#{mls_label}:#{mcs_label}"])
      iuid +=1
    end

  end
end
set_mcs_label(label, *paths) click to toggle source

Public: Set the SELinux context with provided MCS label on a given set of files.

Acts on the symbolic link itself instead of dereferencing.

Globs must be dereferenced but can be provided as an argument. Ex: set_mcs_label("s0:c1,c2", Dir.glob("/path/to/gear/*"))

# File lib/openshift-origin-node/utils/selinux.rb, line 140
def self.set_mcs_label(label, *paths)
  paths.flatten.each do |path|
    chcon(path, label)
  end
end
set_mcs_label_R(label, *paths) click to toggle source

Public: Recursively set SELinux context with provided MCS label on a given set of files.

Will not dereference symbolic links either as a parameter or as a discovered file.

Globs must be dereferenced but can be provided as an argument. Ex: set_mcs_label_R("s0:c1,c2", Dir.glob("/path/to/gear/*"))

# File lib/openshift-origin-node/utils/selinux.rb, line 156
def self.set_mcs_label_R(label, *paths)
  paths.flatten.each do |path|
    Find.find(path) do |fpath|
      chcon(fpath, label)
    end
  end
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.