- Update to upstream
Add enable/disable patch support from Dan Walsh. Add usepasswd flag to semanage.conf to disable genhomedircon using passwd from Dan Walsh. regenerate swig wrappers
This commit is contained in:
parent
4e0d31fc07
commit
0b6b0c93f2
@ -116,3 +116,5 @@ libsemanage-2.0.40.tgz
|
||||
libsemanage-2.0.41.tgz
|
||||
libsemanage-2.0.42.tgz
|
||||
libsemanage-2.0.43.tgz
|
||||
libsemanage-2.0.44.tgz
|
||||
libsemanage-2.0.45.tgz
|
||||
|
@ -1,204 +1,6 @@
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/include/semanage/modules.h libsemanage-2.0.43/include/semanage/modules.h
|
||||
--- nsalibsemanage/include/semanage/modules.h 2009-01-13 08:45:35.000000000 -0500
|
||||
+++ libsemanage-2.0.43/include/semanage/modules.h 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -40,10 +40,12 @@
|
||||
char *module_data, size_t data_len);
|
||||
int semanage_module_install_base_file(semanage_handle_t *,
|
||||
const char *module_name);
|
||||
+int semanage_module_enable(semanage_handle_t *, char *module_name);
|
||||
+int semanage_module_disable(semanage_handle_t *, char *module_name);
|
||||
int semanage_module_remove(semanage_handle_t *, char *module_name);
|
||||
|
||||
/* semanage_module_info is for getting information on installed
|
||||
- modules, only name and version at this time */
|
||||
+ modules, only name and version, and enabled/disabled flag at this time */
|
||||
typedef struct semanage_module_info semanage_module_info_t;
|
||||
|
||||
int semanage_module_list(semanage_handle_t *,
|
||||
@@ -53,5 +55,6 @@
|
||||
int n);
|
||||
const char *semanage_module_get_name(semanage_module_info_t *);
|
||||
const char *semanage_module_get_version(semanage_module_info_t *);
|
||||
+int semanage_module_get_enabled(semanage_module_info_t *);
|
||||
|
||||
#endif
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/direct_api.c libsemanage-2.0.43/src/direct_api.c
|
||||
--- nsalibsemanage/src/direct_api.c 2009-09-17 08:59:43.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/direct_api.c 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -66,6 +66,8 @@
|
||||
static int semanage_direct_install_base(semanage_handle_t * sh, char *base_data,
|
||||
size_t data_len);
|
||||
static int semanage_direct_install_base_file(semanage_handle_t * sh, const char *module_name);
|
||||
+static int semanage_direct_enable(semanage_handle_t * sh, char *module_name);
|
||||
+static int semanage_direct_disable(semanage_handle_t * sh, char *module_name);
|
||||
static int semanage_direct_remove(semanage_handle_t * sh, char *module_name);
|
||||
static int semanage_direct_list(semanage_handle_t * sh,
|
||||
semanage_module_info_t ** modinfo,
|
||||
@@ -83,6 +85,8 @@
|
||||
.upgrade_file = semanage_direct_upgrade_file,
|
||||
.install_base = semanage_direct_install_base,
|
||||
.install_base_file = semanage_direct_install_base_file,
|
||||
+ .enable = semanage_direct_enable,
|
||||
+ .disable = semanage_direct_disable,
|
||||
.remove = semanage_direct_remove,
|
||||
.list = semanage_direct_list
|
||||
};
|
||||
@@ -348,10 +352,17 @@
|
||||
semanage_path(SEMANAGE_TMP, SEMANAGE_MODULES)) == NULL) {
|
||||
return -1;
|
||||
}
|
||||
- if (asprintf(filename, "%s/%s.pp", module_path, *module_name) == -1) {
|
||||
+ if (asprintf(filename, "%s/%s.pp%s", module_path, *module_name, DISABLESTR) == -1) {
|
||||
ERR(sh, "Out of memory!");
|
||||
return -1;
|
||||
}
|
||||
+
|
||||
+ if (access(*filename, F_OK) == -1) {
|
||||
+ char *ptr = *filename;
|
||||
+ int len = strlen(ptr) - strlen(DISABLESTR);
|
||||
+ if (len > 0) ptr[len]='\0';
|
||||
+ }
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1273,6 +1284,107 @@
|
||||
return retval;
|
||||
}
|
||||
|
||||
+/* Enables a module from the sandbox. Returns 0 on success, -1 if out
|
||||
+ * of memory, -2 if module not found or could not be enabled. */
|
||||
+static int semanage_direct_enable(semanage_handle_t * sh, char *module_name)
|
||||
+{
|
||||
+ int i, retval = -1;
|
||||
+ char **module_filenames = NULL;
|
||||
+ int num_mod_files;
|
||||
+ size_t name_len = strlen(module_name);
|
||||
+ if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) ==
|
||||
+ -1) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+ for (i = 0; i < num_mod_files; i++) {
|
||||
+ char *base = strrchr(module_filenames[i], '/');
|
||||
+ if (base == NULL) {
|
||||
+ ERR(sh, "Could not read module names.");
|
||||
+ retval = -2;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ base++;
|
||||
+ if (memcmp(module_name, base, name_len) == 0 &&
|
||||
+ strcmp(base + name_len + 3, DISABLESTR) == 0) {
|
||||
+ int len = strlen(module_filenames[i]) - strlen(DISABLESTR);
|
||||
+ char *enabled_name = calloc(1, len+1);
|
||||
+ if (!enabled_name) {
|
||||
+ ERR(sh, "Could not allocate memory");
|
||||
+ retval = -1;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ strncpy(enabled_name, module_filenames[i],len);
|
||||
+
|
||||
+ if (rename(module_filenames[i], enabled_name) == -1) {
|
||||
+ ERR(sh, "Could not enable module file %s.",
|
||||
+ enabled_name);
|
||||
+ retval = -2;
|
||||
+ }
|
||||
+ retval = 0;
|
||||
+ free(enabled_name);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ }
|
||||
+ ERR(sh, "Module %s was not found.", module_name);
|
||||
+ retval = -2; /* module not found */
|
||||
+ cleanup:
|
||||
+ for (i = 0; module_filenames != NULL && i < num_mod_files; i++) {
|
||||
+ free(module_filenames[i]);
|
||||
+ }
|
||||
+ free(module_filenames);
|
||||
+ return retval;
|
||||
+}
|
||||
+
|
||||
+/* Enables a module from the sandbox. Returns 0 on success, -1 if out
|
||||
+ * of memory, -2 if module not found or could not be enabled. */
|
||||
+static int semanage_direct_disable(semanage_handle_t * sh, char *module_name)
|
||||
+{
|
||||
+ int i, retval = -1;
|
||||
+ char **module_filenames = NULL;
|
||||
+ int num_mod_files;
|
||||
+ size_t name_len = strlen(module_name);
|
||||
+ if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) ==
|
||||
+ -1) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+ for (i = 0; i < num_mod_files; i++) {
|
||||
+ char *base = strrchr(module_filenames[i], '/');
|
||||
+ if (base == NULL) {
|
||||
+ ERR(sh, "Could not read module names.");
|
||||
+ retval = -2;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ base++;
|
||||
+ if (memcmp(module_name, base, name_len) == 0 &&
|
||||
+ strcmp(base + name_len, ".pp") == 0) {
|
||||
+ char disabled_name[PATH_MAX];
|
||||
+ if (snprintf(disabled_name, PATH_MAX, "%s%s",
|
||||
+ module_filenames[i], DISABLESTR) == PATH_MAX) {
|
||||
+ ERR(sh, "Could not disable module file %s.",
|
||||
+ module_filenames[i]);
|
||||
+ retval = -2;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ if (rename(module_filenames[i], disabled_name) == -1) {
|
||||
+ ERR(sh, "Could not disable module file %s.",
|
||||
+ module_filenames[i]);
|
||||
+ retval = -2;
|
||||
+ }
|
||||
+ retval = 0;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+ }
|
||||
+ ERR(sh, "Module %s was not found.", module_name);
|
||||
+ retval = -2; /* module not found */
|
||||
+ cleanup:
|
||||
+ for (i = 0; module_filenames != NULL && i < num_mod_files; i++) {
|
||||
+ free(module_filenames[i]);
|
||||
+ }
|
||||
+ free(module_filenames);
|
||||
+ return retval;
|
||||
+}
|
||||
+
|
||||
/* Removes a module from the sandbox. Returns 0 on success, -1 if out
|
||||
* of memory, -2 if module not found or could not be removed. */
|
||||
static int semanage_direct_remove(semanage_handle_t * sh, char *module_name)
|
||||
@@ -1293,8 +1405,7 @@
|
||||
goto cleanup;
|
||||
}
|
||||
base++;
|
||||
- if (memcmp(module_name, base, name_len) == 0 &&
|
||||
- strcmp(base + name_len, ".pp") == 0) {
|
||||
+ if (memcmp(module_name, base, name_len) == 0) {
|
||||
if (unlink(module_filenames[i]) == -1) {
|
||||
ERR(sh, "Could not remove module file %s.",
|
||||
module_filenames[i]);
|
||||
@@ -1369,6 +1480,7 @@
|
||||
}
|
||||
ssize_t size;
|
||||
char *data = NULL;
|
||||
+ int enabled = semanage_module_enabled(module_filenames[i]);
|
||||
|
||||
if ((size = bunzip(sh, fp, &data)) > 0) {
|
||||
fclose(fp);
|
||||
@@ -1393,6 +1505,7 @@
|
||||
if (type == SEPOL_POLICY_MOD) {
|
||||
(*modinfo)[*num_modules].name = name;
|
||||
(*modinfo)[*num_modules].version = version;
|
||||
+ (*modinfo)[*num_modules].enabled = enabled;
|
||||
(*num_modules)++;
|
||||
} else {
|
||||
/* file was not a module, so don't report it */
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.43/src/genhomedircon.c
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.44/src/genhomedircon.c
|
||||
--- nsalibsemanage/src/genhomedircon.c 2009-09-17 08:59:43.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/genhomedircon.c 2009-12-16 16:07:43.000000000 -0500
|
||||
+++ libsemanage-2.0.44/src/genhomedircon.c 2010-02-24 14:57:23.000000000 -0500
|
||||
@@ -310,6 +310,10 @@
|
||||
}
|
||||
if (strcmp(pwbuf->pw_dir, "/") == 0)
|
||||
@ -220,252 +22,3 @@ diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libseman
|
||||
if (push_user_entry(&head, name, seuname,
|
||||
prefix, pwent->pw_dir) != STATUS_SUCCESS) {
|
||||
*errors = STATUS_ERR;
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/libsemanage.map libsemanage-2.0.43/src/libsemanage.map
|
||||
--- nsalibsemanage/src/libsemanage.map 2009-10-29 15:21:39.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/libsemanage.map 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -6,10 +6,13 @@
|
||||
semanage_module_install; semanage_module_install_file;
|
||||
semanage_module_upgrade; semanage_module_upgrade_file;
|
||||
semanage_module_install_base; semanage_module_install_base_file;
|
||||
+ semanage_module_enable;
|
||||
+ semanage_module_disable;
|
||||
semanage_module_remove;
|
||||
semanage_module_list; semanage_module_info_datum_destroy;
|
||||
semanage_module_list_nth; semanage_module_get_name;
|
||||
semanage_module_get_version; semanage_select_store;
|
||||
+ semanage_module_get_enabled;
|
||||
semanage_reload_policy; semanage_set_reload; semanage_set_rebuild;
|
||||
semanage_user_*; semanage_bool_*; semanage_seuser_*;
|
||||
semanage_iface_*; semanage_port_*; semanage_context_*;
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/Makefile libsemanage-2.0.43/src/Makefile
|
||||
--- nsalibsemanage/src/Makefile 2009-12-01 15:46:50.000000000 -0500
|
||||
+++ libsemanage-2.0.43/src/Makefile 2009-12-16 16:07:47.000000000 -0500
|
||||
@@ -47,7 +47,7 @@
|
||||
LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo
|
||||
CFLAGS ?= -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter
|
||||
|
||||
-override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE
|
||||
+override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -fPIC
|
||||
|
||||
SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./
|
||||
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/module_internal.h libsemanage-2.0.43/src/module_internal.h
|
||||
--- nsalibsemanage/src/module_internal.h 2008-08-28 09:34:24.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/module_internal.h 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -6,6 +6,7 @@
|
||||
|
||||
hidden_proto(semanage_module_get_name)
|
||||
hidden_proto(semanage_module_get_version)
|
||||
+ hidden_proto(semanage_module_get_enabled)
|
||||
hidden_proto(semanage_module_info_datum_destroy)
|
||||
hidden_proto(semanage_module_list_nth)
|
||||
#endif
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/modules.c libsemanage-2.0.43/src/modules.c
|
||||
--- nsalibsemanage/src/modules.c 2009-09-17 08:59:43.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/modules.c 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -154,6 +154,40 @@
|
||||
return sh->funcs->install_base_file(sh, module_name);
|
||||
}
|
||||
|
||||
+int semanage_module_enable(semanage_handle_t * sh, char *module_name)
|
||||
+{
|
||||
+ if (sh->funcs->enable == NULL) {
|
||||
+ ERR(sh, "No enable function defined for this connection type.");
|
||||
+ return -1;
|
||||
+ } else if (!sh->is_connected) {
|
||||
+ ERR(sh, "Not connected.");
|
||||
+ return -1;
|
||||
+ } else if (!sh->is_in_transaction) {
|
||||
+ if (semanage_begin_transaction(sh) < 0) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+ sh->modules_modified = 1;
|
||||
+ return sh->funcs->enable(sh, module_name);
|
||||
+}
|
||||
+
|
||||
+int semanage_module_disable(semanage_handle_t * sh, char *module_name)
|
||||
+{
|
||||
+ if (sh->funcs->disable == NULL) {
|
||||
+ ERR(sh, "No disable function defined for this connection type.");
|
||||
+ return -1;
|
||||
+ } else if (!sh->is_connected) {
|
||||
+ ERR(sh, "Not connected.");
|
||||
+ return -1;
|
||||
+ } else if (!sh->is_in_transaction) {
|
||||
+ if (semanage_begin_transaction(sh) < 0) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+ sh->modules_modified = 1;
|
||||
+ return sh->funcs->disable(sh, module_name);
|
||||
+}
|
||||
+
|
||||
int semanage_module_remove(semanage_handle_t * sh, char *module_name)
|
||||
{
|
||||
if (sh->funcs->remove == NULL) {
|
||||
@@ -209,6 +243,13 @@
|
||||
|
||||
hidden_def(semanage_module_get_name)
|
||||
|
||||
+int semanage_module_get_enabled(semanage_module_info_t * modinfo)
|
||||
+{
|
||||
+ return modinfo->enabled;
|
||||
+}
|
||||
+
|
||||
+hidden_def(semanage_module_get_enabled)
|
||||
+
|
||||
const char *semanage_module_get_version(semanage_module_info_t * modinfo)
|
||||
{
|
||||
return modinfo->version;
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/modules.h libsemanage-2.0.43/src/modules.h
|
||||
--- nsalibsemanage/src/modules.h 2008-08-28 09:34:24.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/modules.h 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -26,6 +26,7 @@
|
||||
struct semanage_module_info {
|
||||
char *name; /* Key */
|
||||
char *version;
|
||||
+ int enabled;
|
||||
};
|
||||
|
||||
#endif
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/policy.h libsemanage-2.0.43/src/policy.h
|
||||
--- nsalibsemanage/src/policy.h 2009-01-13 08:45:35.000000000 -0500
|
||||
+++ libsemanage-2.0.43/src/policy.h 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -58,6 +58,12 @@
|
||||
/* Upgrade a policy module */
|
||||
int (*upgrade_file) (struct semanage_handle *, const char *);
|
||||
|
||||
+ /* Enable a policy module */
|
||||
+ int (*enable) (struct semanage_handle *, char *);
|
||||
+
|
||||
+ /* Disable a policy module */
|
||||
+ int (*disable) (struct semanage_handle *, char *);
|
||||
+
|
||||
/* Remove a policy module */
|
||||
int (*remove) (struct semanage_handle *, char *);
|
||||
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.43/src/semanage.conf
|
||||
--- nsalibsemanage/src/semanage.conf 2008-08-28 09:34:24.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/semanage.conf 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -35,4 +35,4 @@
|
||||
# given in <sepol/policydb.h>. Change this setting if a different
|
||||
# version is necessary.
|
||||
#policy-version = 19
|
||||
-
|
||||
+expand-check=0
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.c libsemanage-2.0.43/src/semanage_store.c
|
||||
--- nsalibsemanage/src/semanage_store.c 2009-10-29 15:21:39.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/semanage_store.c 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -57,6 +57,8 @@
|
||||
|
||||
#include "debug.h"
|
||||
|
||||
+const char *DISABLESTR=".disabled";
|
||||
+
|
||||
#define SEMANAGE_CONF_FILE "semanage.conf"
|
||||
/* relative path names to enum semanage_paths to special files and
|
||||
* directories for the module store */
|
||||
@@ -433,6 +435,21 @@
|
||||
return 1;
|
||||
}
|
||||
|
||||
+int semanage_module_enabled(const char *file) {
|
||||
+ int len = strlen(file) - strlen(DISABLESTR);
|
||||
+ return (len < 0 || strcmp(&file[len], DISABLESTR) != 0);
|
||||
+}
|
||||
+
|
||||
+static int semanage_modulename_select(const struct dirent *d)
|
||||
+{
|
||||
+ if (d->d_name[0] == '.'
|
||||
+ && (d->d_name[1] == '\0'
|
||||
+ || (d->d_name[1] == '.' && d->d_name[2] == '\0')))
|
||||
+ return 0;
|
||||
+
|
||||
+ return semanage_module_enabled(d->d_name);
|
||||
+}
|
||||
+
|
||||
/* Copies a file from src to dst. If dst already exists then
|
||||
* overwrite it. Returns 0 on success, -1 on error. */
|
||||
static int semanage_copy_file(const char *src, const char *dst, mode_t mode)
|
||||
@@ -599,15 +616,8 @@
|
||||
return -1;
|
||||
}
|
||||
|
||||
-/* Scans the modules directory for the current semanage handler. This
|
||||
- * might be the active directory or sandbox, depending upon if the
|
||||
- * handler has a transaction lock. Allocates and fills in *filenames
|
||||
- * with an array of module filenames; length of array is stored in
|
||||
- * *len. The caller is responsible for free()ing *filenames and its
|
||||
- * individual elements. Upon success returns 0, -1 on error.
|
||||
- */
|
||||
-int semanage_get_modules_names(semanage_handle_t * sh, char ***filenames,
|
||||
- int *len)
|
||||
+static int semanage_get_modules_names_filter(semanage_handle_t * sh, char ***filenames,
|
||||
+ int *len, int (*filter)(const struct dirent *))
|
||||
{
|
||||
const char *modules_path;
|
||||
struct dirent **namelist = NULL;
|
||||
@@ -622,7 +632,7 @@
|
||||
*filenames = NULL;
|
||||
*len = 0;
|
||||
if ((num_files = scandir(modules_path, &namelist,
|
||||
- semanage_filename_select, alphasort)) == -1) {
|
||||
+ filter, alphasort)) == -1) {
|
||||
ERR(sh, "Error while scanning directory %s.", modules_path);
|
||||
goto cleanup;
|
||||
}
|
||||
@@ -663,6 +673,34 @@
|
||||
return retval;
|
||||
}
|
||||
|
||||
+/* Scans the modules directory for the current semanage handler. This
|
||||
+ * might be the active directory or sandbox, depending upon if the
|
||||
+ * handler has a transaction lock. Allocates and fills in *filenames
|
||||
+ * with an array of module filenames; length of array is stored in
|
||||
+ * *len. The caller is responsible for free()ing *filenames and its
|
||||
+ * individual elements. Upon success returns 0, -1 on error.
|
||||
+ */
|
||||
+int semanage_get_modules_names(semanage_handle_t * sh, char ***filenames,
|
||||
+ int *len)
|
||||
+{
|
||||
+ return semanage_get_modules_names_filter(sh, filenames,
|
||||
+ len, semanage_filename_select);
|
||||
+}
|
||||
+
|
||||
+/* Scans the modules directory for the current semanage handler. This
|
||||
+ * might be the active directory or sandbox, depending upon if the
|
||||
+ * handler has a transaction lock. Allocates and fills in *filenames
|
||||
+ * with an array of module filenames; length of array is stored in
|
||||
+ * *len. The caller is responsible for free()ing *filenames and its
|
||||
+ * individual elements. Upon success returns 0, -1 on error.
|
||||
+ */
|
||||
+int semanage_get_active_modules_names(semanage_handle_t * sh, char ***filenames,
|
||||
+ int *len)
|
||||
+{
|
||||
+ return semanage_get_modules_names_filter(sh, filenames,
|
||||
+ len, semanage_modulename_select);
|
||||
+}
|
||||
+
|
||||
/******************* routines that run external programs *******************/
|
||||
|
||||
/* Appends a single character to a string. Returns a pointer to the
|
||||
@@ -1589,7 +1627,7 @@
|
||||
}
|
||||
|
||||
/* get list of modules and load them */
|
||||
- if (semanage_get_modules_names(sh, &module_filenames, &num_modules) ==
|
||||
+ if (semanage_get_active_modules_names(sh, &module_filenames, &num_modules) ==
|
||||
-1 || semanage_load_module(sh, base_filename, base) == -1) {
|
||||
goto cleanup;
|
||||
}
|
||||
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.h libsemanage-2.0.43/src/semanage_store.h
|
||||
--- nsalibsemanage/src/semanage_store.h 2009-07-07 15:32:32.000000000 -0400
|
||||
+++ libsemanage-2.0.43/src/semanage_store.h 2009-12-16 16:07:43.000000000 -0500
|
||||
@@ -128,4 +128,6 @@
|
||||
size_t buf_len,
|
||||
char **sorted_buf, size_t * sorted_buf_len);
|
||||
|
||||
+extern const char *DISABLESTR;
|
||||
+
|
||||
#endif
|
||||
|
@ -2,13 +2,14 @@
|
||||
%define libselinuxver 2.0.0-1
|
||||
Summary: SELinux binary policy manipulation library
|
||||
Name: libsemanage
|
||||
Version: 2.0.43
|
||||
Release: 4%{?dist}
|
||||
Version: 2.0.45
|
||||
Release: 1%{?dist}
|
||||
License: LGPLv2+
|
||||
Group: System Environment/Libraries
|
||||
Source: http://www.nsa.gov/selinux/archives/libsemanage-%{version}.tgz
|
||||
Patch: libsemanage-rhat.patch
|
||||
URL: http://www.selinuxproject.org
|
||||
Source1: semanage.conf
|
||||
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||
BuildRequires: libselinux-devel >= %{libselinuxver} swig ustr-devel
|
||||
@ -68,13 +69,13 @@ make clean
|
||||
make CFLAGS="%{optflags}" swigify
|
||||
make CFLAGS="%{optflags}" LIBDIR="%{_libdir}" SHLIBDIR="%{_lib}" all pywrap
|
||||
|
||||
|
||||
%install
|
||||
rm -rf ${RPM_BUILD_ROOT}
|
||||
mkdir -p ${RPM_BUILD_ROOT}/%{_lib}
|
||||
mkdir -p ${RPM_BUILD_ROOT}/%{_libdir}
|
||||
mkdir -p ${RPM_BUILD_ROOT}%{_includedir}
|
||||
make DESTDIR="${RPM_BUILD_ROOT}" LIBDIR="${RPM_BUILD_ROOT}%{_libdir}" SHLIBDIR="${RPM_BUILD_ROOT}/%{_lib}" install install-pywrap
|
||||
cp %{SOURCE1} ${RPM_BUILD_ROOT}/etc/selinux/semanage.conf
|
||||
ln -sf /%{_lib}/libsemanage.so.1 ${RPM_BUILD_ROOT}/%{_libdir}/libsemanage.so
|
||||
|
||||
%clean
|
||||
@ -106,6 +107,22 @@ rm -rf ${RPM_BUILD_ROOT}
|
||||
%{_libdir}/python*/site-packages/*
|
||||
|
||||
%changelog
|
||||
* Mon Mar 8 2010 Dan Walsh <dwalsh@redhat.com> - 2.0.45-1
|
||||
- Update to upstream
|
||||
* Add enable/disable patch support from Dan Walsh.
|
||||
* Add usepasswd flag to semanage.conf to disable genhomedircon using
|
||||
passwd from Dan Walsh.
|
||||
* regenerate swig wrappers
|
||||
|
||||
* Thu Feb 25 2010 Dan Walsh <dwalsh@redhat.com> - 2.0.44-2
|
||||
- Allow disable of usepasswd
|
||||
|
||||
* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> - 2.0.44-1
|
||||
- Update to upstream
|
||||
* Replace usage of fmemopen() with sepol_policy_file_set_mem() since
|
||||
glibc < 2.9 does not support binary mode ('b') for fmemopen'd
|
||||
streams.
|
||||
|
||||
* Thu Jan 28 2010 Dan Walsh <dwalsh@redhat.com> - 2.0.43-4
|
||||
- Cleanup spec file
|
||||
|
||||
|
48
semanage.conf
Normal file
48
semanage.conf
Normal file
@ -0,0 +1,48 @@
|
||||
# Authors: Jason Tang <jtang@tresys.com>
|
||||
#
|
||||
# Copyright (C) 2004-2005 Tresys Technology, LLC
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public
|
||||
# License along with this library; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
#
|
||||
# Specify how libsemanage will interact with a SELinux policy manager.
|
||||
# The four options are:
|
||||
#
|
||||
# "source" - libsemanage manipulates a source SELinux policy
|
||||
# "direct" - libsemanage will write directly to a module store.
|
||||
# /foo/bar - Write by way of a policy management server, whose
|
||||
# named socket is at /foo/bar. The path must begin
|
||||
# with a '/'.
|
||||
# foo.com:4242 - Establish a TCP connection to a remote policy
|
||||
# management server at foo.com. If there is a colon
|
||||
# then the remainder is interpreted as a port number;
|
||||
# otherwise default to port 4242.
|
||||
module-store = direct
|
||||
|
||||
# When generating the final linked and expanded policy, by default
|
||||
# semanage will set the policy version to POLICYDB_VERSION_MAX, as
|
||||
# given in <sepol/policydb.h>. Change this setting if a different
|
||||
# version is necessary.
|
||||
#policy-version = 19
|
||||
|
||||
# expand-check check neverallow rules when executing all semanage commands.
|
||||
# Large penalty in time if you turn this on.
|
||||
expand-check=0
|
||||
|
||||
# usepasswd check tells semanage to scan all pass word records for home directories
|
||||
# and setup the labeling correctly. If this is turned off, SELinux will label /home
|
||||
# correctly only. You will need to use semanage fcontext command.
|
||||
# For example, if you had home dirs in /althome directory you would have to execute
|
||||
# semanage fcontext -a -e /home /althome
|
||||
usepasswd=False
|
Loading…
Reference in New Issue
Block a user