resource-agents: Fix nfs mount contexts

Resolves: rhbz#635828

Signed-off-by Lon Hohberger <[email protected]>

Tested-by Corey Marthaler <[email protected]>

---
 rgmanager/src/resources/nfsserver.sh |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

rgmanager/src/resources/nfsserver.sh +3 -0

index 17f472d..bb2632e 100644
@@ -222,6 +222,9 @@ create_tree()
 	[ -f "$fp/xtab" ] || touch "$fp/xtab"
 	[ -f "$fp/rmtab" ] || touch "$fp/rmtab"
 
+	chcon -R system_u:object_r:var_lib_nfs_t:s0 "$fp"
+	chcon -R system_u:object_r:var_lib_nfs_t:s0 "$fp/*"
+
         #
         # Generate a random state file.  If this ends up being what a client
         # already has in its list, that's bad, but the chances of this

Signature · 1 line

1.7.3.4

Resolves: rhbz#635828

Signed-off-by Lon Hohberger <[email protected]>

Tested-by Corey Marthaler <[email protected]>

---
 rgmanager/src/resources/nfsserver.sh |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

rgmanager/src/resources/nfsserver.sh +3 -0

index 17f472d..bb2632e 100644
@@ -222,6 +222,9 @@ create_tree()
 	[ -f "$fp/xtab" ] || touch "$fp/xtab"
 	[ -f "$fp/rmtab" ] || touch "$fp/rmtab"
 
+	chcon -R system_u:object_r:var_lib_nfs_t:s0 "$fp"
+	chcon -R system_u:object_r:var_lib_nfs_t:s0 "$fp/*"
+
         #
         # Generate a random state file.  If this ends up being what a client
         # already has in its list, that's bad, but the chances of this

Hi Lon,

2 small bits here..

in nfsserver.sh, we also call restorecon.

IMHO execution of selinux tools should be conditional to selinux being enabled and tools available.

To make this a generic upstream patch, we can do (at the beginning of the agent):

selinuxon=""
[ -n "$(which selinuxenabled)" ] && selinuxenabled && selinuxon=1

this is mostly paranoia and to cache the result for later use. invoking selinuxenabled is cheap.

.....

[ -n "$selinuxon" ] && [ -n "$(which restorecon)" ] && restorecon...

.....

[ -n "$selinuxon" ] && [ -n "$(which chcon)" ] && chcon -R....

chcon -R works recursively, so one invocation should be sufficient.

The main motivator behind this approach is to guarantee that we don't need resource-agents to Requires those tools at packaging level and enforce them on a system.