rpms/policycoreutils
7
0
Fork 0
Code Issues Pull Requests Releases Activity
3f69c2f15b
policycoreutils/policycoreutils-rhat.patch

1832 lines
69 KiB
Diff
Raw Normal View History

- Change to allow sandbox to run on nfs homedirs, add start python script
2010-12-15 21:47:38 +00:00
diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile
Update to upstream
2013-02-08 14:44:20 +00:00
index 3980799..6624804 100644
- Change to allow sandbox to run on nfs homedirs, add start python script
2010-12-15 21:47:38 +00:00
--- a/policycoreutils/Makefile
+++ b/policycoreutils/Makefile
@@ -1,4 +1,4 @@
Update to upstream
2013-02-08 14:44:20 +00:00
-SUBDIRS = sepolicy setfiles semanage load_policy newrole run_init sandbox secon audit2allow audit2why sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui
+SUBDIRS = sepolicy setfiles semanage semanage/default_encoding load_policy newrole run_init sandbox secon audit2allow sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui
- Change to allow sandbox to run on nfs homedirs, add start python script
2010-12-15 21:47:38 +00:00
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/audit2allow/Makefile b/policycoreutils/audit2allow/Makefile
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
index 88635d4..fc290ea 100644
Update to upstream
2013-02-08 14:44:20 +00:00
--- a/policycoreutils/audit2allow/Makefile
+++ b/policycoreutils/audit2allow/Makefile
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
@@ -5,14 +5,19 @@ LIBDIR ?= $(PREFIX)/lib
MANDIR ?= $(PREFIX)/share/man
LOCALEDIR ?= /usr/share/locale
-all: ;
+all: audit2why
+
+audit2why:
+ ln -sf audit2allow audit2why
Update to upstream
2013-02-08 14:44:20 +00:00
install: all
-mkdir -p $(BINDIR)
install -m 755 audit2allow $(BINDIR)
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
+ (cd $(BINDIR); ln -sf audit2allow audit2why)
Update to upstream
2013-02-08 14:44:20 +00:00
install -m 755 sepolgen-ifgen $(BINDIR)
-mkdir -p $(MANDIR)/man1
install -m 644 audit2allow.1 $(MANDIR)/man1/
+ install -m 644 audit2why.1 $(MANDIR)/man1/
clean:
rm -f *~
Fix booleansPage not showing booleans - Fix audit2allow -b
2012-11-13 15:30:48 +00:00
diff --git a/policycoreutils/audit2allow/audit2allow b/policycoreutils/audit2allow/audit2allow
Update to upstream
2013-02-08 14:44:20 +00:00
index 8e0c396..9bd66f5 100644
Fix booleansPage not showing booleans - Fix audit2allow -b
2012-11-13 15:30:48 +00:00
--- a/policycoreutils/audit2allow/audit2allow
+++ b/policycoreutils/audit2allow/audit2allow
Update to upstream
2013-02-08 14:44:20 +00:00
@@ -18,7 +18,7 @@
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
-import sys
+import sys, os
import sepolgen.audit as audit
import sepolgen.policygen as policygen
Fix booleansPage not showing booleans - Fix audit2allow -b
2012-11-13 15:30:48 +00:00
@@ -29,6 +29,8 @@ import sepolgen.defaults as defaults
import sepolgen.module as module
from sepolgen.sepolgeni18n import _
import selinux.audit2why as audit2why
+import locale
+locale.setlocale(locale.LC_ALL, '')
class AuditToPolicy:
VERSION = "%prog .1"
Update to upstream
2013-02-08 14:44:20 +00:00
@@ -80,8 +82,7 @@ class AuditToPolicy:
parser.add_option("--interface-info", dest="interface_info", help="file name of interface information")
parser.add_option("--debug", dest="debug", action="store_true", default=False,
help="leave generated modules for -M")
-
- parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=False,
+ parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=(os.path.basename(sys.argv[0])=="audit2why"),
help="Translates SELinux audit messages into a description of why the access was denied")
options, args = parser.parse_args()
diff --git a/policycoreutils/audit2allow/audit2why.1 b/policycoreutils/audit2allow/audit2why.1
new file mode 100644
index 0000000..a9e8893
--- /dev/null
+++ b/policycoreutils/audit2allow/audit2why.1
@@ -0,0 +1 @@
+.so man1/audit2allow.1
diff --git a/policycoreutils/audit2why/Makefile b/policycoreutils/audit2why/Makefile
deleted file mode 100644
index 63eb8b3..0000000
--- a/policycoreutils/audit2why/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Installation directories.
-PREFIX ?= $(DESTDIR)/usr
-BINDIR ?= $(PREFIX)/bin
-MANDIR ?= $(PREFIX)/share/man
-
-TARGETS=audit2why
-
-all: $(TARGETS)
-
-install: all
- -mkdir -p $(BINDIR)
- install -m 755 $(TARGETS) $(BINDIR)
- -mkdir -p $(MANDIR)/man1
- install -m 644 audit2why.1 $(MANDIR)/man1/
-
-clean:
-
-relabel:
diff --git a/policycoreutils/audit2why/audit2why b/policycoreutils/audit2why/audit2why
deleted file mode 100644
index 21a72aa..0000000
--- a/policycoreutils/audit2why/audit2why
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/bin/sh
-/usr/bin/audit2allow -w $*
diff --git a/policycoreutils/audit2why/audit2why.1 b/policycoreutils/audit2why/audit2why.1
deleted file mode 100644
index a9e8893..0000000
--- a/policycoreutils/audit2why/audit2why.1
+++ /dev/null
@@ -1 +0,0 @@
-.so man1/audit2allow.1
Rebuild to get latest libsepol which fixes the file_name transition problems - Update translations - Fix calls to close fd for restorecond
2012-04-24 01:56:23 +00:00
diff --git a/policycoreutils/gui/Makefile b/policycoreutils/gui/Makefile
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
index b5abbb9..513f2c4 100644
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
--- a/policycoreutils/gui/Makefile
Rebuild to get latest libsepol which fixes the file_name transition problems - Update translations - Fix calls to close fd for restorecond
2012-04-24 01:56:23 +00:00
+++ b/policycoreutils/gui/Makefile
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
@@ -1,7 +1,9 @@
Update to upstream
2013-02-08 14:44:20 +00:00
# Installation directories.
PREFIX ?= ${DESTDIR}/usr
+SYSCONFDIR ?= ${DESTDIR}/etc
BINDIR ?= $(PREFIX)/bin
SHAREDIR ?= $(PREFIX)/share/system-config-selinux
+DATADIR ?= $(PREFIX)/share
TARGETS= \
booleansPage.py \
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
@@ -16,6 +18,7 @@ portsPage.py \
Update to upstream
2013-02-08 14:44:20 +00:00
semanagePage.py \
statusPage.py \
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
system-config-selinux.glade \
Update to upstream
2013-02-08 14:44:20 +00:00
+system-config-selinux.png \
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
usersPage.py
* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 2.0.82-24 - Man page fixes - sandbox fixes Resolves: #595796 - Move seunshare to base package
2010-05-27 21:23:08 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
all: $(TARGETS) system-config-selinux.py polgengui.py
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
@@ -23,11 +26,19 @@ all: $(TARGETS) system-config-selinux.py polgengui.py
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
install: all
Update to upstream
2013-02-08 14:44:20 +00:00
-mkdir -p $(SHAREDIR)
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
-mkdir -p $(BINDIR)
Update to upstream
2013-02-08 14:44:20 +00:00
+ -mkdir -p $(DATADIR)/pixmaps
+ -mkdir -p $(DATADIR)/icons/hicolor/24x24/apps
+ -mkdir -p $(SYSCONFDIR)
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+ -mkdir -p $(DATADIR)/polkit-1/actions/
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
install -m 755 system-config-selinux.py $(SHAREDIR)
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+ install -m 755 system-config-selinux $(BINDIR)
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
install -m 755 polgengui.py $(SHAREDIR)
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
- install -m 755 sepolgen $(BINDIR)
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
install -m 644 $(TARGETS) $(SHAREDIR)
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
-
Update to upstream
2013-02-08 14:44:20 +00:00
+ install -m 644 system-config-selinux.png $(DATADIR)/pixmaps
+ install -m 644 system-config-selinux.png $(DATADIR)/icons/hicolor/24x24/apps
+ install -m 644 system-config-selinux.png $(DATADIR)/system-config-selinux
+ install -m 644 *.desktop $(DATADIR)/system-config-selinux
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+ install -m 644 org.fedoraproject.config.selinux.policy $(DATADIR)/polkit-1/actions/
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
clean:
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
indent:
diff --git a/policycoreutils/gui/org.fedoraproject.config.selinux.policy b/policycoreutils/gui/org.fedoraproject.config.selinux.policy
new file mode 100644
index 0000000..fcfa81d
--- /dev/null
+++ b/policycoreutils/gui/org.fedoraproject.config.selinux.policy
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+
+ <vendor>System Config SELinux</vendor>
+ <vendor_url>http://fedorahosted.org/system-config-selinux</vendor_url>
+
+ <action id="org.fedoraproject.config.selinux.pkexec.run">
+ <description>Run System Config SELinux</description>
+ <message>Authentication is required to run system-config-selinux</message>
+ <icon_name>system-selinux</icon_name>
+ <defaults>
+ <allow_any>no</allow_any>
+ <allow_inactive>no</allow_inactive>
+ <allow_active>auth_admin</allow_active>
+ </defaults>
+ <annotate key="org.freedesktop.policykit.exec.path">/usr/share/system-config-selinux/system-config-selinux.py</annotate>
+ <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
+ </action>
+</policyconfig>
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/gui/selinux-polgengui.desktop b/policycoreutils/gui/selinux-polgengui.desktop
new file mode 100644
index 0000000..0c2f399
--- /dev/null
+++ b/policycoreutils/gui/selinux-polgengui.desktop
@@ -0,0 +1,67 @@
+[Desktop Entry]
+Name=SELinux Policy Generation Tool
+Name[bn_IN]=SELinux Policy নির্মাণের সামগ্রী
+Name[ca]=Eina de generació de polítiques del SELinux
+Name[da]=Regelsætgenereringsværktøj til SELinux
+Name[de]=Tool zur Erstellung von SELinux-Richtlinien
+Name[es]=Generador de Políticas de SELinux
+Name[fi]=SELinux-käytäntöjen generointityökalu
+Name[fr]=Outil de génération de stratégies SELinux
+Name[gu]=SELinux પોલિસી બનાવટ સાધન
+Name[hi]=SELinux पॉलिसी जनन औजार
+Name[it]=Tool di generazione della policy di SELinux
+Name[ja]=SELinux ポリシー生成ツール
+Name[kn]=SELinux ಪಾಲಿಸಿ ಉತ್ಪಾದನಾ ಉಪಕರಣ
+Name[ko]=SELinux 정책 생성 도구
+Name[ml]=SELinux പോളിസി ഉത്പാദന പ്രയോഗം
+Name[mr]=SELinux करार निर्माण साधन
+Name[nl]=SELinux tactiek generatie gereedschap
+Name[or]=SELinux ନୀତି ସୃଷ୍ଟି ଉପକରଣ
+Name[pa]=SELinux ਪਾਲਿਸੀ ਨਿਰਮਾਣ ਜੰਤਰ
+Name[pl]=Narzędzie tworzenia polityki SELinuksa
+Name[pt]=Ferramenta de Geração de Políticas SELinux
+Name[pt_BR]=Ferramenta de criação de políticas do SELinux
+Name[ru]=Средство создания политики SELinux
+Name[sv]=Genereringsverktyg för SELinuxpolicy
+Name[ta]=SELinux பாலிசி உற்பத்தி கருவி
+Name[te]=SELinux నిర్వహణ
+Name[uk]=Утиліта генерації правил SELinux
+Name[zh_CN]=SELinux 策略生成工具
+Name[zh_TW]=SELinux 政策產生工具（SELinux Policy Generation Tool）
+Comment=Generate SELinux policy modules
+Comment[bn_IN]=SELinux নিয়মনীতির মডিউল নির্মাণ করুন
+Comment[ca]=Genera els mòduls de les polítiques de SELinux
+Comment[da]=Generér SELinux-regelsætmodul
+Comment[de]=Tool zur Erstellung von SELinux-Richtlinien
+Comment[es]=Generar módulos de política de SELinux
+Comment[fi]=Generoi SELinuxin käytäntömoduuleja
+Comment[fr]=Génére des modules de stratégie SELinux
+Comment[gu]=SELinux પોલિસી મોડ્યુલોને ઉત્પન્ન કરો
+Comment[hi]=नया पॉलिसी मॉड्यूल उत्पन्न करें
+Comment[it]=Genera moduli della politica di SELinux
+Comment[ja]=新しいポリシーモジュールの作成
+Comment[kn]=SELinux ಪಾಲಿಸಿ ಘಟಕಗಳನ್ನು ಉತ್ಪಾದಿಸು
+Comment[ko]=SELinux 정책 모듈 생성
+Comment[ml]=SELinux യ പോളിസി ഘങ്ങള്‍ തയ്യാറാക്കുക
+Comment[mr]=SELinux करार घटके निर्माण करा
+Comment[nl]=Maak een SELinux tactiek module aan
+Comment[or]=SELinux ନୀତି ଏକକାଂଶ ସୃଷ୍ଟିକରନ୍ତୁ
+Comment[pa]=SELinux ਪਾਲਿਸੀ ਮੈਡਿਊਲ ਬਣਾਓ
+Comment[pl]=Tworzenie nowych modułów polityki SELinuksa
+Comment[pt]=Gerar módulos de políticas SELinux
+Comment[pt_BR]=Gerar módulos de política do SELinux
+Comment[ru]=Генерация модулей политики SELinux
+Comment[sv]=Generera SELinux-policymoduler
+Comment[ta]=SELinux கொள்கை தொகுதியை உருவாக்கவும்
+Comment[te]=SELinux పాలసీ మాడ్యూళ్ళను వుద్భవింపచేయుము
+Comment[uk]=Створення модулів контролю доступу SELinux
+Comment[zh_CN]=生成 SELinux 策略模块
+Comment[zh_TW]=產生 SELinux 政策模組
+StartupNotify=true
+Icon=system-config-selinux
+Exec=/usr/bin/selinux-polgengui
+Type=Application
+Terminal=false
+Categories=System;Security;
+X-Desktop-File-Install-Version=0.2
+Keywords=policy;security;selinux;avc;permission;mac;
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
diff --git a/policycoreutils/gui/sepolgen b/policycoreutils/gui/sepolgen
deleted file mode 100644
index 2f0c1cc..0000000
--- a/policycoreutils/gui/sepolgen
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/bin/sh
-sepolicy generate $*
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
diff --git a/policycoreutils/gui/system-config-selinux b/policycoreutils/gui/system-config-selinux
new file mode 100755
index 0000000..5be5ccd
Update to upstream
2013-02-08 14:44:20 +00:00
--- /dev/null
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+++ b/policycoreutils/gui/system-config-selinux
Update to upstream
2013-02-08 14:44:20 +00:00
@@ -0,0 +1,3 @@
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+#!/bin/sh
+
+exec /usr/bin/pkexec /usr/share/system-config-selinux/system-config-selinux.py
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/gui/system-config-selinux.desktop b/policycoreutils/gui/system-config-selinux.desktop
new file mode 100644
index 0000000..8822ce2
--- /dev/null
+++ b/policycoreutils/gui/system-config-selinux.desktop
@@ -0,0 +1,67 @@
+[Desktop Entry]
+Name=SELinux Management
+Name[bn_IN]=SELinux পরিচালনা
+Name[da]=Håndtering af SELinux
+Name[de]=SELinux-Management
+Name[ca]=Gestió de SELinux
+Name[es]=Administración de SELinux
+Name[fi]=SELinuxin ylläpito
+Name[fr]=Gestion de SELinux
+Name[gu]=SELinux સંચાલન
+Name[hi]=SELinux प्रबंधन
+Name[jp]=SELinux 管理
+Name[it]=Gestione di SELinux
+Name[kn]=SELinux ವ್ಯವಸ್ಥಾಪನೆ
+Name[ko]=SELinux 관리
+Name[ml]=SELinux മാനേജ്മെന്റ്
+Name[mr]=SELinux मॅनेजमेंट
+Name[nl]=SELinux beheer
+Name[or]=SELinux ପରିଚାଳନା
+Name[pa]=SELinux ਮੈਨੇਜਮੈਂਟ
+Name[pl]=Zarządzanie SELinuksem
+Name[pt_BR]=Gerenciamento do SELinux
+Name[pt]=Gestão de SELinux
+Name[ru]=Управление SELinux
+Name[sv]=SELinux-hantering
+Name[ta]=SELinux மேலாண்மை
+Name[te]=SELinux నిర్వహణ
+Name[uk]=Керування SELinux
+Name[zh_CN]=SELinux 管理
+Name[zh_TW]=SELinux 管理
+Comment=Configure SELinux in a graphical setting
+Comment[bn_IN]=গ্রাফিক্যাল পরিবেশে SELinux কনফিগার করুন
+Comment[ca]=Configura SELinuc an mode de preferències gràfiques
+Comment[da]=Konfigurér SELinux i et grafisk miljø
+Comment[de]=SELinux in einer grafischen Einstellung konfigurieren
+Comment[es]=Defina SELinux en una configuración de interfaz gráfica
+Comment[fi]=Tee SELinuxin asetukset graafisesti
+Comment[fr]=Configure SELinux dans un environnement graphique
+Comment[gu]=ગ્રાફિકલ સુયોજનમાં SELinux ને રૂપરેખાંકિત કરો
+Comment[hi]=SELinux को आलेखी सेटिंग में विन्यस्त करें
+Comment[it]=Configura SELinux in una impostazione grafica
+Comment[jp]=グラフィカルな設定画面で SELinux を設定する
+Comment[ko]=SELinux를 그래픽 사용자 인터페이스로 설정
+Comment[kn]=SELinux ಅನ್ನು ಒಂದು ಚಿತ್ರಾತ್ಮಕ ಸಿದ್ದತೆಯಲ್ಲಿ ಸಂರಚಿಸಿ
+Comment[ml]=ഒരു ഗ്രാഫിക്കല്‍ സജ്ജീകരണത്തില്‍ SELinux ക്രമീകരിയ്ക്കുക
+Comment[mr]=ग्राफिकल सेटिंगमध्ये SELinux संरचीत करा
+Comment[nl]=Configureer SELinux in een grafische omgeving
+Comment[or]=SELinux କୁ ଆଲେଖିକ ସଂରଚନାରେ ବିନ୍ୟାସ କରନ୍ତୁ
+Comment[pa]=SELinux ਨੂੰ ਗਰਾਫੀਕਲ ਸੈਟਿੰਗ ਵਿੱਚ ਸੰਰਚਿਤ ਕਰੋ
+Comment[pl]=Konfiguracja SELinuksa w trybie graficznym
+Comment[pt]=Configurar o SELinux num ambiente gráfico
+Comment[pt_BR]=Configure o SELinux em uma configuração gráfica
+Comment[ru]=Настройка SELinux в графическом режиме
+Comment[sv]=Konfigurera SELinux i en grafisk miljö
+Comment[ta]=SELinuxஐ ஒரு வரைகலை அமைவில் கட்டமைக்கவும்
+Comment[te]=SELinuxను గ్రాఫికల్ అమర్పునందు ఆకృతీకరించుము
+Comment[uk]=Засіб для налаштування SELinux з графічним інтерфейсом
+Comment[zh_CN]=在图形设置中配置 SELinux
+Comment[zh_TW]=在圖形話設定中配置 SELinux
+StartupNotify=true
+Icon=system-config-selinux
+Exec=/usr/bin/system-config-selinux
+Type=Application
+Terminal=false
+Categories=System;Security;
+X-Desktop-File-Install-Version=0.2
+Keywords=policy;security;selinux;avc;permission;mac;
diff --git a/policycoreutils/gui/system-config-selinux.png b/policycoreutils/gui/system-config-selinux.png
new file mode 100644
index 0000000..68ffcb7
Binary files /dev/null and b/policycoreutils/gui/system-config-selinux.png differ
diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c
Fix newrole to retain cap_audit_write when compiled with namespace, also do not drop capabilities when run as root.
2013-02-18 19:14:39 +00:00
index 8fbf2d0..3510f12 100644
Update to upstream
2013-02-08 14:44:20 +00:00
--- a/policycoreutils/newrole/newrole.c
+++ b/policycoreutils/newrole/newrole.c
Fix newrole to retain cap_audit_write when compiled with namespace, also do not drop capabilities when run as root.
2013-02-18 19:14:39 +00:00
@@ -576,19 +576,22 @@ static int drop_capabilities(int full)
*/
static int drop_capabilities(int full)
{
+ uid_t uid = getuid();
+ if (!uid) return 0;
+
capng_setpid(getpid());
capng_clear(CAPNG_SELECT_BOTH);
if (capng_lock() < 0)
return -1;
- uid_t uid = getuid();
/* Change uid */
if (setresuid(uid, uid, uid)) {
fprintf(stderr, _("Error changing uid, aborting.\n"));
return -1;
}
if (! full)
- capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, CAP_SYS_ADMIN , CAP_FOWNER , CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, -1);
+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, CAP_SYS_ADMIN , CAP_FOWNER , CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_SETPCAP, CAP_AUDIT_WRITE, -1);
+
return capng_apply(CAPNG_SELECT_BOTH);
}
@@ -680,7 +683,7 @@ static int relabel_tty(const char *ttyn, security_context_t new_context,
Update to upstream
2013-02-08 14:44:20 +00:00
security_context_t * tty_context,
security_context_t * new_tty_context)
{
- int fd;
+ int fd, rc;
int enforcing = security_getenforce();
security_context_t tty_con = NULL;
security_context_t new_tty_con = NULL;
Fix newrole to retain cap_audit_write when compiled with namespace, also do not drop capabilities when run as root.
2013-02-18 19:14:39 +00:00
@@ -699,7 +702,13 @@ static int relabel_tty(const char *ttyn, security_context_t new_context,
Update to upstream
2013-02-08 14:44:20 +00:00
fprintf(stderr, _("Error! Could not open %s.\n"), ttyn);
return fd;
}
- fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ /* this craziness is to make sure we cann't block on open and deadlock */
+ rc = fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ if (rc) {
+ fprintf(stderr, _("Error! Could not clear O_NONBLOCK on %s\n"), ttyn);
+ close(fd);
+ return rc;
+ }
if (fgetfilecon(fd, &tty_con) < 0) {
fprintf(stderr, _("%s! Could not get current context "
Fix newrole to retain cap_audit_write when compiled with namespace, also do not drop capabilities when run as root.
2013-02-18 19:14:39 +00:00
@@ -1010,9 +1019,9 @@ int main(int argc, char *argv[])
Update to upstream
2013-02-08 14:44:20 +00:00
int fd;
pid_t childPid = 0;
char *shell_argv0 = NULL;
+ int rc;
#ifdef USE_PAM
- int rc;
int pam_status; /* pam return code */
pam_handle_t *pam_handle; /* opaque handle used by all PAM functions */
Fix newrole to retain cap_audit_write when compiled with namespace, also do not drop capabilities when run as root.
2013-02-18 19:14:39 +00:00
@@ -1226,15 +1235,23 @@ int main(int argc, char *argv[])
Update to upstream
2013-02-08 14:44:20 +00:00
fd = open(ttyn, O_RDONLY | O_NONBLOCK);
if (fd != 0)
goto err_close_pam;
- fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ rc = fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ if (rc)
+ goto err_close_pam;
+
fd = open(ttyn, O_RDWR | O_NONBLOCK);
if (fd != 1)
goto err_close_pam;
- fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ rc = fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ if (rc)
+ goto err_close_pam;
+
fd = open(ttyn, O_RDWR | O_NONBLOCK);
if (fd != 2)
goto err_close_pam;
- fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ rc = fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+ if (rc)
+ goto err_close_pam;
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
}
/*
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
diff --git a/policycoreutils/newrole/newrole.pamd b/policycoreutils/newrole/newrole.pamd
index d1b435c..de3582f 100644
--- a/policycoreutils/newrole/newrole.pamd
+++ b/policycoreutils/newrole/newrole.pamd
@@ -1,4 +1,6 @@
#%PAM-1.0
+# Uncomment the next line if you do not want to enter your passwd everytime
+# auth sufficient pam_rootok.so
auth include system-auth
account include system-auth
password include system-auth
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile
index a377996..9c1486e 100644
--- a/policycoreutils/po/Makefile
+++ b/policycoreutils/po/Makefile
@@ -81,12 +81,16 @@ POTFILES = \
../sepolicy/sepolicy/templates/var_log.py \
../sepolicy/sepolicy/templates/var_run.py \
../sepolicy/sepolicy/templates/var_spool.py \
+ booleans.py
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
#default:: clean
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
all:: $(MOFILES)
Update to upstream - policycoreutils * restorecond: wrong options should exit with non-zero error code * restorecond: Add -h option to get usage command * resorecond: user: fix fd leak * mcstrans: add -f to run in foreground * semanage: fix man page range and level defaults * semanage: bash completion for modules should include -a,-m, -d * semanage: manpage update for -e * semanage: dontaudit off should work * semanage: locallist option does not take an argument * sepolgen: Make use of setools optional within sepolgen - sepolgen * Make use of setools optional within sepolgen * We need to support files that have a + in them
2012-07-04 11:41:05 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
-$(POTFILE): $(POTFILES)
+booleans.py:
+ sepolicy booleans -a > booleans.py
+
+$(POTFILE): $(POTFILES) booleans.py
$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
rm -f $(NLSPACKAGE).po; \
@@ -95,6 +99,7 @@ $(POTFILE): $(POTFILES)
fi; \
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
update-po: Makefile $(POTFILE) refresh-po
+ @rm -f booleans.py
Rebuild without bogus prebuild 64 bit seunshare app
2012-09-26 14:59:14 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
refresh-po: Makefile
for cat in $(POFILES); do \
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
diff --git a/policycoreutils/po/ja.po b/policycoreutils/po/ja.po
index 72ae12d..649d288 100644
--- a/policycoreutils/po/ja.po
+++ b/policycoreutils/po/ja.po
@@ -9,14 +9,14 @@
# <noriko@fedoraproject.org>, 2012.
# Noriko Mizumoto <noriko@redhat.com>, 2006, 2008, 2009.
# Takuro Nagamoto <tnagamot@redhat.com>, 2006.
-# Tomoyuki KATO <tomo@dream.daynight.jp>, 2012.
+# Tomoyuki KATO <tomo@dream.daynight.jp>, 2012-2013.
msgid ""
msgstr ""
"Project-Id-Version: Policycoreutils\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2013-01-04 12:01-0500\n"
-"PO-Revision-Date: 2013-01-04 17:02+0000\n"
-"Last-Translator: dwalsh <dwalsh@redhat.com>\n"
+"PO-Revision-Date: 2013-02-14 03:32+0000\n"
+"Last-Translator: Tomoyuki KATO <tomo@dream.daynight.jp>\n"
"Language-Team: Japanese <trans-ja@lists.fedoraproject.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
@@ -292,7 +292,7 @@ msgstr "MLS/MCS 範囲"
#: ../semanage/seobject.py:672
msgid "Service"
-msgstr ""
+msgstr "サービス"
#: ../semanage/seobject.py:698 ../semanage/seobject.py:729
#: ../semanage/seobject.py:796 ../semanage/seobject.py:853
@@ -429,7 +429,7 @@ msgstr "タイプが必要です"
#: ../semanage/seobject.py:1814
#, python-format
msgid "Type %s is invalid, must be a port type"
-msgstr ""
+msgstr "形式 %s が無効です、ポート形式である必要があります"
#: ../semanage/seobject.py:1000 ../semanage/seobject.py:1062
#: ../semanage/seobject.py:1117 ../semanage/seobject.py:1123
@@ -551,12 +551,12 @@ msgstr "不明又は欠如したプロトコル"
#: ../semanage/seobject.py:1256
msgid "SELinux node type is required"
-msgstr ""
+msgstr "SELinux ノード形式が必要です"
#: ../semanage/seobject.py:1259 ../semanage/seobject.py:1327
#, python-format
msgid "Type %s is invalid, must be a node type"
-msgstr ""
+msgstr "形式 %s が無効です、ノード形式である必要があります"
#: ../semanage/seobject.py:1263 ../semanage/seobject.py:1331
#: ../semanage/seobject.py:1367 ../semanage/seobject.py:1465
@@ -790,7 +790,7 @@ msgstr "ファイル仕様 %s は、等価規則 '%s %s' と競合します; 代
#: ../semanage/seobject.py:1755
#, python-format
msgid "Type %s is invalid, must be a file or device type"
-msgstr ""
+msgstr "形式 %s が無効です、ファイルまたはデバイス形式である必要があります"
#: ../semanage/seobject.py:1763 ../semanage/seobject.py:1768
#: ../semanage/seobject.py:1824 ../semanage/seobject.py:1906
@@ -2178,11 +2178,11 @@ msgstr "生成された SELinux の man ページの格納先となるパス"
#: ../sepolicy/sepolicy.py:207
msgid "name of the OS for man pages"
-msgstr ""
+msgstr "マニュアルページ向け OS 名称"
#: ../sepolicy/sepolicy.py:209
msgid "Generate HTML man pages structure for selected SELinux man page"
-msgstr ""
+msgstr "選択された SELinux マニュアルページ向けの HTML マニュアルページの構成を生成する"
#: ../sepolicy/sepolicy.py:213
msgid "All domains"
@@ -2230,7 +2230,7 @@ msgstr "SELinux に問い合わせて boolean の詳細を表示する"
#: ../sepolicy/sepolicy.py:280
msgid "get all booleans descriptions"
-msgstr ""
+msgstr "すべてのブーリアンの説明を取得する"
#: ../sepolicy/sepolicy.py:282
msgid "boolean to get description"
@@ -2252,11 +2252,11 @@ msgstr "ターゲットプロセスドメイン"
#: ../sepolicy/sepolicy.py:327
msgid "Command required for this type of policy"
-msgstr ""
+msgstr "この種類のポリシーに対して要求されるコマンド"
#: ../sepolicy/sepolicy.py:347
msgid "List SELinux Policy interfaces"
-msgstr ""
+msgstr "SELinux ポリシー・インターフェースの一覧表示"
#: ../sepolicy/sepolicy.py:362
msgid "Generate SELinux Policy module template"
@@ -2294,7 +2294,7 @@ msgstr "制限を課す実行ファイル"
#: ../sepolicy/sepolicy.py:414 ../sepolicy/sepolicy.py:417
#, python-format
msgid "Generate Policy for %s"
-msgstr ""
+msgstr "%s 向けのポリシーの生成"
#: ../sepolicy/sepolicy.py:422
msgid "commands"
@@ -2306,12 +2306,12 @@ msgstr ""
#: ../sepolicy/sepolicy/__init__.py:48
msgid "No SELinux Policy installed"
-msgstr ""
+msgstr "インストールされている SELinux ポリシーがありません"
#: ../sepolicy/sepolicy/__init__.py:54
#, python-format
msgid "Failed to read %s policy file"
-msgstr ""
+msgstr "%s ポリシーファイルの読み込みに失敗しました"
#: ../sepolicy/sepolicy/__init__.py:127
msgid "unknown"
@@ -2335,15 +2335,15 @@ msgstr ""
#: ../sepolicy/sepolicy/generate.py:180
msgid "Desktop Login User Role"
-msgstr ""
+msgstr "デスクトップログインユーザーロール"
#: ../sepolicy/sepolicy/generate.py:181
msgid "Administrator Login User Role"
-msgstr ""
+msgstr "管理者のログインユーザーロール"
#: ../sepolicy/sepolicy/generate.py:182
msgid "Confined Root Administrator Role"
-msgstr ""
+msgstr "制限された root　管理者ロール"
#: ../sepolicy/sepolicy/generate.py:187
msgid "Valid Types:\n"
@@ -2356,7 +2356,7 @@ msgstr "ポートは数字、又は 1 から %d までの数字の範囲でな
#: ../sepolicy/sepolicy/generate.py:231
msgid "You must enter a valid policy type"
-msgstr ""
+msgstr "有効なポリシー種別を入力する必要があります"
#: ../sepolicy/sepolicy/generate.py:234
#, python-format
@@ -2460,11 +2460,11 @@ msgstr "ユーザーが RADIUS サーバーを使用してログインするこ
#: booleans.py:8
msgid "Allow users to login using a yubikey server"
-msgstr ""
+msgstr "ユーザーが yubikey サーバーを使用してログインすることを許可する"
#: booleans.py:9
msgid "Allow awstats to purge Apache logs"
-msgstr ""
+msgstr "awstats が Apache のログを消去することを許可する"
#: booleans.py:10
msgid ""
@@ -2532,11 +2532,11 @@ msgstr "すべてのデーモンが端末を読み書きすることを許可し
#: booleans.py:25
msgid "Allow dan to manage user files"
-msgstr ""
+msgstr "dan がユーザーファイルを管理することを許可する"
#: booleans.py:26
msgid "Allow dan to read user files"
-msgstr ""
+msgstr "dan がユーザーファイルを読み取ることを許可する"
#: booleans.py:27
msgid "Allow dbadm to manage files in users home directories"
@@ -2603,7 +2603,7 @@ msgstr "隔離ドメインによる ssh の実行を許可します。"
#: booleans.py:42
msgid "Allow all domains to execute in fips_mode"
-msgstr ""
+msgstr "すべてのドメインが fips_mode で実行することを許可する"
#: booleans.py:43
msgid "Allow ftp to read and write files in the user home directories"
@@ -2872,7 +2872,7 @@ msgstr "あらゆるポートへの接続および予約されていないポー
#: booleans.py:103
msgid "Allow confined applications to run with kerberos."
-msgstr ""
+msgstr "制限されたアプリケーションが Kerberos とともに動作することを許可する"
#: booleans.py:104
msgid "Allow syslogd daemon to send mail"
@@ -2880,11 +2880,11 @@ msgstr "syslogd デーモンがメールを送信することを許可します
#: booleans.py:105
msgid "Allow syslogd the ability to read/write terminals"
-msgstr ""
+msgstr "syslogd が端末を読み書きすることを許可する"
#: booleans.py:106
msgid "Allow logging in and using the system from /dev/console."
-msgstr ""
+msgstr "/dev/console からログインしてシステムを使用することを許可する"
#: booleans.py:107
msgid ""
@@ -2947,7 +2947,7 @@ msgstr ""
#: booleans.py:120
msgid "Allow system to run with NIS"
-msgstr ""
+msgstr "システムが NIS を使用することを許可する"
#: booleans.py:121
msgid "Allow confined applications to use nscd shared memory."
@@ -3361,7 +3361,7 @@ msgstr ""
#: booleans.py:211
msgid "Allow varnishd to connect to all ports, not just HTTP."
-msgstr ""
+msgstr "varnishd が HTTP 以外のすべてのポートに接続することを許可する"
#: booleans.py:212
msgid "Ignore vbetool mmap_zero errors."
@@ -3370,20 +3370,20 @@ msgstr "vbetool mmap_zero エラーを無視します。"
#: booleans.py:213
msgid ""
"Allow confined virtual guests to use serial/parallel communication ports"
-msgstr ""
+msgstr "制限された仮想マシンがシリアル/パラレル通信ポートを使用することを許可する"
#: booleans.py:214
msgid ""
"Allow confined virtual guests to use executable memory and executable stack"
-msgstr ""
+msgstr "制限された仮想マシンが実行可能なメモリおよび実行可能なスタックを使用することを許可する"
#: booleans.py:215
msgid "Allow confined virtual guests to read fuse files"
-msgstr ""
+msgstr "制限された仮想マシンが FUSE ファイルを読み込むことを許可する"
#: booleans.py:216
msgid "Allow confined virtual guests to manage nfs files"
-msgstr ""
+msgstr "制限された仮想マシンが NFS ファイルを管理することを許可する"
#: booleans.py:217
msgid "Allow confined virtual guests to interact with rawip sockets"
@@ -3391,15 +3391,15 @@ msgstr ""
#: booleans.py:218
msgid "Allow confined virtual guests to manage cifs files"
-msgstr ""
+msgstr "制限された仮想マシンが CIFS ファイルを管理することを許可する"
#: booleans.py:219
msgid "Allow confined virtual guests to interact with the sanlock"
-msgstr ""
+msgstr "制限された仮想マシンが sanlock と通信することを許可する"
#: booleans.py:220
msgid "Allow confined virtual guests to manage device configuration, (pci)"
-msgstr ""
+msgstr "制限された仮想マシンがデバイス設定 (pci) を管理することを許可する"
#: booleans.py:221
msgid "Allow confined virtual guests to use usb devices"
@@ -3438,11 +3438,11 @@ msgstr "Xen が NFS ファイルを管理することを許可する"
msgid ""
"Allow xend to run blktapctrl/tapdisk. Not required if using dedicated "
"logical volumes for disk images."
-msgstr ""
+msgstr "xend が blktapctrl/tapdisk を実行することを許可する。ディスクイメージ用の専用論理ボリュームを使用していなければ、必要ありません。"
#: booleans.py:230
msgid "Allow xend to run qemu-dm. Not required if using paravirt and no vfb."
-msgstr ""
+msgstr "xend が qemu-dm を実行することを許可する。準仮想化を使用していて、vfb がなければ、必要ありません。"
#: booleans.py:231
msgid ""
@@ -3455,11 +3455,11 @@ msgstr ""
#: booleans.py:233
msgid "Allow xguest users to mount removable media"
-msgstr ""
+msgstr "xguest ユーザーがリムーバブルメディアをマウントすることを許可する"
#: booleans.py:234
msgid "Allow xguest to use blue tooth devices"
-msgstr ""
+msgstr "xguest が Bluetooth デバイスを使用することを許可する"
#: booleans.py:235
msgid "Allows clients to write to the X server shared memory segments."
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/restorecond/Makefile b/policycoreutils/restorecond/Makefile
index 3074542..3b704d8 100644
--- a/policycoreutils/restorecond/Makefile
+++ b/policycoreutils/restorecond/Makefile
@@ -5,6 +5,7 @@ LIBDIR ?= $(PREFIX)/lib
MANDIR = $(PREFIX)/share/man
AUTOSTARTDIR = $(DESTDIR)/etc/xdg/autostart
DBUSSERVICEDIR = $(DESTDIR)/usr/share/dbus-1/services
+SYSTEMDDIR ?= $(DESTDIR)/usr/lib/systemd
autostart_DATA = sealertauto.desktop
INITDIR = $(DESTDIR)/etc/rc.d/init.d
@@ -39,7 +40,8 @@ install: all
install -m 644 restorecond.desktop $(AUTOSTARTDIR)/restorecond.desktop
-mkdir -p $(DBUSSERVICEDIR)
install -m 600 org.selinux.Restorecond.service $(DBUSSERVICEDIR)/org.selinux.Restorecond.service
-
+ -mkdir -p $(SYSTEMDDIR)/system
+ install -m 644 restorecond.service $(SYSTEMDDIR)/system/
relabel: install
/sbin/restorecon $(SBINDIR)/restorecond
diff --git a/policycoreutils/restorecond/restorecond.service b/policycoreutils/restorecond/restorecond.service
new file mode 100644
index 0000000..11f4ffd
--- /dev/null
+++ b/policycoreutils/restorecond/restorecond.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Restorecon maintaining path file context
+After=syslog.target
+ConditionPathExists=/etc/selinux/restorecond.conf
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/restorecond
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/policycoreutils/restorecond/user.c b/policycoreutils/restorecond/user.c
index 00a646f..2c28676 100644
--- a/policycoreutils/restorecond/user.c
+++ b/policycoreutils/restorecond/user.c
@@ -54,6 +54,7 @@ static const char *PATH="/org/selinux/Restorecond";
static const char *INTERFACE="org.selinux.RestorecondIface";
static const char *RULE="type='signal',interface='org.selinux.RestorecondIface'";
+static int local_lock_fd = -1;
static DBusHandlerResult
signal_filter (DBusConnection *connection __attribute__ ((__unused__)), DBusMessage *message, void *user_data)
@@ -201,17 +202,18 @@ static int local_server() {
perror("asprintf");
return -1;
}
- int fd = open(ptr, O_CREAT | O_WRONLY | O_NOFOLLOW | O_CLOEXEC, S_IRUSR | S_IWUSR);
+ local_lock_fd = open(ptr, O_CREAT | O_WRONLY | O_NOFOLLOW | O_CLOEXEC, S_IRUSR | S_IWUSR);
if (debug_mode)
g_warning ("Lock file: %s", ptr);
free(ptr);
- if (fd < 0) {
+ if (local_lock_fd < 0) {
if (debug_mode)
perror("open");
return -1;
}
- if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
+ if (flock(local_lock_fd, LOCK_EX | LOCK_NB) < 0) {
+ close(local_lock_fd);
if (debug_mode)
perror("flock");
return -1;
@@ -226,6 +228,12 @@ static int local_server() {
return 0;
}
+static void end_local_server(void) {
+ if (local_lock_fd >= 0)
+ close(local_lock_fd);
+ local_lock_fd = -1;
+}
+
int server(int master_fd, const char *watch_file) {
GMainLoop *loop;
@@ -253,6 +261,7 @@ int server(int master_fd, const char *watch_file) {
g_main_loop_run (loop);
end:
+ end_local_server();
g_main_loop_unref (loop);
return 0;
}
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
diff --git a/policycoreutils/run_init/run_init.pamd b/policycoreutils/run_init/run_init.pamd
index d1b435c..1c323d2 100644
--- a/policycoreutils/run_init/run_init.pamd
+++ b/policycoreutils/run_init/run_init.pamd
@@ -1,4 +1,6 @@
#%PAM-1.0
+# Uncomment the next line if you do not want to enter your passwd everytime
+#auth sufficient pam_rootok.so
auth include system-auth
account include system-auth
password include system-auth
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
diff --git a/policycoreutils/sandbox/sandbox b/policycoreutils/sandbox/sandbox
index b629006..6631c2d 100644
--- a/policycoreutils/sandbox/sandbox
+++ b/policycoreutils/sandbox/sandbox
@@ -243,7 +243,7 @@ class Sandbox:
copyfile(f, "/tmp", self.__tmpdir)
copyfile(f, "/var/tmp", self.__tmpdir)
- def __setup_sandboxrc(self, wm = "/usr/bin/matchbox-window-manager -use_titlebar no"):
+ def __setup_sandboxrc(self, wm = "/usr/bin/openbox"):
execfile =self.__homedir + "/.sandboxrc"
fd = open(execfile, "w+")
if self.__options.session:
@@ -333,7 +333,7 @@ sandbox [-h] [-c] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile
parser.add_option("-W", "--windowmanager", dest="wm",
type="string",
- default="/usr/bin/matchbox-window-manager -use_titlebar no",
+ default="/usr/bin/openbox",
help=_("alternate window manager"))
parser.add_option("-l", "--level", dest="level",
diff --git a/policycoreutils/sandbox/sandbox.8 b/policycoreutils/sandbox/sandbox.8
index 521afcd..a50eef2 100644
--- a/policycoreutils/sandbox/sandbox.8
+++ b/policycoreutils/sandbox/sandbox.8
@@ -70,7 +70,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
\fB\-W windowmanager\fR
Select alternative window manager to run within
.B sandbox -X.
-Default to /usr/bin/matchbox-window-manager.
+Default to /usr/bin/openbox.
.TP
\fB\-X\fR
Create an X based Sandbox for gui apps, temporary files for
diff --git a/policycoreutils/sandbox/sandboxX.sh b/policycoreutils/sandbox/sandboxX.sh
index 23de6f6..171bb05 100644
--- a/policycoreutils/sandbox/sandboxX.sh
+++ b/policycoreutils/sandbox/sandboxX.sh
@@ -6,6 +6,20 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
[ -z $2 ] && export DPI="96" || export DPI="$2"
trap "exit 0" HUP
+mkdir -p ~/.config/openbox
+cat > ~/.config/openbox/rc.xml << EOF
+<openbox_config xmlns="http://openbox.org/3.4/rc"
+ xmlns:xi="http://www.w3.org/2001/XInclude">
+<applications>
+ <application class="*">
+ <decor>no</decor>
+ <desktop>all</desktop>
+ <maximized>yes</maximized>
+ </application>
+</applications>
+</openbox_config>
+EOF
+
(/usr/bin/Xephyr -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
export DISPLAY=:$D
cat > ~/seremote << __EOF
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/sandbox/seunshare.c b/policycoreutils/sandbox/seunshare.c
index dbd5977..f10df39 100644
--- a/policycoreutils/sandbox/seunshare.c
+++ b/policycoreutils/sandbox/seunshare.c
@@ -962,7 +962,7 @@ int main(int argc, char **argv) {
char *LANG = NULL;
int rc = -1;
- if (unshare(CLONE_NEWNS) < 0) {
+ if (unshare(CLONE_NEWNS | CLONE_NEWIPC) < 0) {
perror(_("Failed to unshare"));
goto childerr;
}
diff --git a/policycoreutils/scripts/Makefile b/policycoreutils/scripts/Makefile
index 201a988..f5d6e9d 100644
--- a/policycoreutils/scripts/Makefile
+++ b/policycoreutils/scripts/Makefile
@@ -9,23 +9,12 @@ LOCALEDIR ?= $(PREFIX)/share/locale
.PHONY: all genhomedircon
all: fixfiles genhomedircon chcat
-genhomedircon:
- @echo "#!/bin/sh" > genhomedircon
- @echo >> genhomedircon
- @if [ -z "${SEMODULE_PATH}" ]; then \
- echo "${USRSBINDIR}/semodule -Bn" >> genhomedircon; \
- else \
- echo "${SEMODULE_PATH}/semodule -Bn" >> genhomedircon; \
- fi
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
-
Update to upstream
2013-02-08 14:44:20 +00:00
install: all
-mkdir -p $(BINDIR)
install -m 755 chcat $(BINDIR)
install -m 755 fixfiles $(SBINDIR)
- install -m 755 genhomedircon $(USRSBINDIR)
-mkdir -p $(MANDIR)/man8
install -m 644 fixfiles.8 $(MANDIR)/man8/
- install -m 644 genhomedircon.8 $(MANDIR)/man8/
install -m 644 chcat.8 $(MANDIR)/man8/
clean:
diff --git a/policycoreutils/scripts/genhomedircon.8 b/policycoreutils/scripts/genhomedircon.8
deleted file mode 100644
index 8ec509c..0000000
--- a/policycoreutils/scripts/genhomedircon.8
+++ /dev/null
@@ -1,24 +0,0 @@
-.TH GENHOMEDIRCON "12" "Sep 2011" "Security Enhanced Linux" "SELinux"
-.SH NAME
-genhomedircon \- generate SELinux file context configuration entries for user home directories
-.SH SYNOPSIS
-.B genhomedircon
-is a script that executes
-.B semodule
-to rebuild the currently active SELinux policy (without reloading it) and to create the
-labels for each user home directory based on directory paths returned by calls to getpwent().
-
-The latter functionality depends on the "usepasswd" parameter being set to "true" (default)
-in /etc/selinux/semanage.conf.
-
-This script is usually executed by
-.B semanage
-although this default behavior can be optionally modified by setting to "true" the
-"disable-genhomedircon" in /etc/selinux/semanage.conf.
-
-.SH AUTHOR
-This manual page was written by
-.I Dan Walsh <dwalsh@redhat.com>
-
-.SH "SEE ALSO"
-semanage.conf(5), semodule(8), semanage(8), getpwent(3), getpwent_r(3)
diff --git a/policycoreutils/semanage/default_encoding/Makefile b/policycoreutils/semanage/default_encoding/Makefile
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
new file mode 100644
Update to upstream
2013-02-08 14:44:20 +00:00
index 0000000..e15a877
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
--- /dev/null
Update to upstream
2013-02-08 14:44:20 +00:00
+++ b/policycoreutils/semanage/default_encoding/Makefile
@@ -0,0 +1,8 @@
+all:
+ LDFLAGS="" python setup.py build
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+install: all
+ LDFLAGS="" python setup.py install --root=$(DESTDIR)/
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+clean:
+ rm -rf build *~
diff --git a/policycoreutils/semanage/default_encoding/default_encoding.c b/policycoreutils/semanage/default_encoding/default_encoding.c
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
new file mode 100644
Update to upstream
2013-02-08 14:44:20 +00:00
index 0000000..023b8f4
Update to upstream * genhomedircon: manual page improvements * setfiles/restorecon minor improvements * run_init: If open_init_pty is not available then just use exec * newrole: do not drop capabilities when newrole is run as * restorecon: only update type by default * scripts: Don't syslog setfiles changes on a fixfiles restore * setfiles: do not syslog if no changes * Disable user restorecond by default * Make restorecon return 0 when a file has changed context * setfiles: Fix process_glob error handling * semanage: allow enable/disable under -m * add .tx to gitignore * translations: commit translations from Fedora community * po: silence build process * gui: Checking in policy to support polgengui and sepolgen. * gui: polgen: search for systemd subpackage when generating policy * gui: for exploring booleans * gui: system-config-selinux gui * Add Makefiles to support new gui code * gui: remove lockdown wizard * return equivalency records in fcontext customized * semanage: option to not load new policy into kernel after * sandbox: manpage update to describe standard types * setsebool: -N should not reload policy on changes * semodule: Add -N qualifier to no reload kernel policy * gui: polgen: sort selinux types of user controls * gui: polgen: follow symlinks and get the real path to * gui: Fix missing error function * setfiles: return errors when bad paths are given * fixfiles: tell restorecon to ignore missing paths * setsebool: error when setting multiple options * semanage: use boolean subs. * sandbox: Make sure Xephyr never listens on tcp ports * sepolgen: return and output constraint violation information * semanage: skip comments while reading external configuration files * restorecond: relabel all mount runtime files in the restorecond example * genhomedircon: dynamically create genhomedircon * Allow returning of bastard matches * sepolgen: return and output constraint violation information * audit2allow: one role/type pair per line
2012-09-15 12:34:36 +00:00
--- /dev/null
Update to upstream
2013-02-08 14:44:20 +00:00
+++ b/policycoreutils/semanage/default_encoding/default_encoding.c
@@ -0,0 +1,57 @@
+/*
+ * Authors:
+ * John Dennis <jdennis@redhat.com>
+ *
+ * Copyright (C) 2009 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+#include <Python.h>
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+PyDoc_STRVAR(setdefaultencoding_doc,
+"setdefaultencoding(encoding='utf-8')\n\
+\n\
+Set the current default string encoding used by the Unicode implementation.\n\
+Defaults to utf-8."
+);
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+static PyObject *
+setdefaultencoding(PyObject *self, PyObject *args, PyObject *kwds)
+{
+ static char *kwlist[] = {"utf-8", NULL};
+ char *encoding;
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+ if (!PyArg_ParseTupleAndKeywords(args, kwds, "s:setdefaultencoding", kwlist, &encoding))
+ return NULL;
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+ if (PyUnicode_SetDefaultEncoding(encoding))
+ return NULL;
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+ Py_RETURN_NONE;
+}
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+static PyMethodDef methods[] = {
+ {"setdefaultencoding", (PyCFunction)setdefaultencoding, METH_VARARGS|METH_KEYWORDS, setdefaultencoding_doc},
+ {NULL, NULL} /* sentinel */
+};
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+
+
Update to upstream
2013-02-08 14:44:20 +00:00
+PyMODINIT_FUNC
+initdefault_encoding_utf8(void)
+{
+ PyUnicode_SetDefaultEncoding("utf-8");
+ Py_InitModule3("default_encoding_utf8", methods, "Forces the default encoding to utf-8");
+}
diff --git a/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py b/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
new file mode 100644
Update to upstream
2013-02-08 14:44:20 +00:00
index 0000000..ccb6b8b
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
--- /dev/null
Update to upstream
2013-02-08 14:44:20 +00:00
+++ b/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py
@@ -0,0 +1,17 @@
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# Copyright (C) 2006,2007,2008, 2009 Red Hat, Inc.
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/semanage/default_encoding/setup.py b/policycoreutils/semanage/default_encoding/setup.py
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
new file mode 100644
Update to upstream
2013-02-08 14:44:20 +00:00
index 0000000..e2befdb
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
--- /dev/null
Update to upstream
2013-02-08 14:44:20 +00:00
+++ b/policycoreutils/semanage/default_encoding/setup.py
@@ -0,0 +1,38 @@
+# Authors:
+# John Dennis <jdennis@redhat.com>
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# Copyright (C) 2009 Red Hat
Add Miroslav Grepl patch to generate html man pages - Update Translations - Add option to sandbox to shred files before deleting
2012-10-25 17:58:08 +00:00
+# see file 'COPYING' for use and warranty information
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation.
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
+#
Update to upstream
2013-02-08 14:44:20 +00:00
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Update translations - Fix sepolicy booleans to handle autogenerated booleans descriptions - Cleanups of sepolicy manpage - Fix crash on git_shell man page generation
2013-01-04 22:14:27 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+from distutils.core import setup, Extension
Update translations - Fix sepolicy booleans to handle autogenerated booleans descriptions - Cleanups of sepolicy manpage - Fix crash on git_shell man page generation
2013-01-04 22:14:27 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+default_encoding_utf8 = Extension('policycoreutils.default_encoding_utf8', ['default_encoding.c'])
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+setup(name = 'policycoreutils-default-encoding',
+ version = '0.1',
+ description = 'Forces the default encoding in Python to be utf-8',
+ long_description = 'Forces the default encoding in Python to be utf-8',
+ author = 'John Dennis',
+ author_email = 'jdennis@redhat.com',
+ maintainer = 'John Dennis',
+ maintainer_email = 'jdennis@redhat.com',
+ license = 'GPLv3+',
+ platforms = 'posix',
+ url = '',
+ download_url = '',
+ ext_modules = [default_encoding_utf8],
+ packages=["policycoreutils"],
- Fix newrole hanlding of pcap
2011-01-21 20:11:31 +00:00
+)
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/semanage/semanage b/policycoreutils/semanage/semanage
index 6e33c85..49e4709 100644
--- a/policycoreutils/semanage/semanage
+++ b/policycoreutils/semanage/semanage
@@ -20,6 +20,7 @@
# 02111-1307 USA
#
#
+import policycoreutils.default_encoding_utf8
import sys, getopt, re
import seobject
import selinux
@@ -32,7 +33,7 @@ gettext.textdomain(PROGNAME)
try:
gettext.install(PROGNAME,
localedir="/usr/share/locale",
- unicode=False,
+ unicode=True,
codeset = 'utf-8')
except IOError:
import __builtin__
diff --git a/policycoreutils/semanage/seobject.py b/policycoreutils/semanage/seobject.py
index 85bc37f..02b1acd 100644
--- a/policycoreutils/semanage/seobject.py
+++ b/policycoreutils/semanage/seobject.py
@@ -32,11 +32,10 @@ from IPy import IP
import gettext
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
gettext.textdomain(PROGNAME)
-try:
- gettext.install(PROGNAME, localedir = "/usr/share/locale", unicode = 1)
-except IOError:
- import __builtin__
- __builtin__.__dict__['_'] = unicode
* Fri Oct 30 2009 Dan Walsh <dwalsh@redhat.com> 2.0.74-14 - Allow semanage -i and semanage -o to generate customization files. - semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration
2009-10-30 21:01:42 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+import gettext
+translation=gettext.translation(PROGNAME, localedir = "/usr/share/locale", fallback=True)
+_=translation.ugettext
On full relabels we will now show a estimated percent complete rather then just *s.
2012-02-03 17:14:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
import syslog
userapps is generating sandbox code in polgengui
2012-07-19 17:21:49 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
@@ -461,7 +460,9 @@ class loginRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if exists:
- raise ValueError(_("Login mapping for %s is already defined") % name)
+ semanage_seuser_key_free(k)
+ return self.__modify(name, sename, serange)
userapps is generating sandbox code in polgengui
2012-07-19 17:21:49 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
if name[0] == '%':
try:
grp.getgrnam(name[1:])
@@ -731,7 +732,8 @@ class seluserRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if exists:
- raise ValueError(_("SELinux user %s is already defined") % name)
+ semanage_user_key_free(k)
+ return self.__modify(name, roles, selevel, serange, prefix)
On full relabels we will now show a estimated percent complete rather then just *s.
2012-02-03 17:14:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
(rc, u) = semanage_user_create(self.sh)
if rc < 0:
@@ -1274,7 +1276,8 @@ class nodeRecords(semanageRecords):
On full relabels we will now show a estimated percent complete rather then just *s.
2012-02-03 17:14:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
(rc, exists) = semanage_node_exists(self.sh, k)
if exists:
- raise ValueError(_("Addr %s already defined") % addr)
+ semanage_node_key_free(k)
+ return self.__modify(addr, mask, self.protocol[proto], serange, ctype)
userapps is generating sandbox code in polgengui
2012-07-19 17:21:49 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
(rc, node) = semanage_node_create(self.sh)
if rc < 0:
@@ -1475,7 +1478,8 @@ class interfaceRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if exists:
- raise ValueError(_("Interface %s already defined") % interface)
+ semanage_iface_key_free(k)
+ return self.__modify(interface, serange, ctype)
Only report restorecon warning for missing default label, if not running recusively - Update translations
2012-11-07 15:49:52 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
(rc, iface) = semanage_iface_create(self.sh)
if rc < 0:
@@ -1777,7 +1781,8 @@ class fcontextRecords(semanageRecords):
raise ValueError(_("Could not check if file context for %s is defined") % target)
Only report restorecon warning for missing default label, if not running recusively - Update translations
2012-11-07 15:49:52 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
if exists:
- raise ValueError(_("File context for %s already defined") % target)
+ semanage_fcontext_key_free(k)
+ return self.__modify(target, type, ftype, serange, seuser)
userapps is generating sandbox code in polgengui
2012-07-19 17:21:49 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
(rc, fcontext) = semanage_fcontext_create(self.sh)
if rc < 0:
diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
index 4c5243a..036c418 100644
Update to upstream
2013-02-08 14:44:20 +00:00
--- a/policycoreutils/semodule/Makefile
+++ b/policycoreutils/semodule/Makefile
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
@@ -11,7 +11,7 @@ LDLIBS = -lsepol -lselinux -lsemanage -L$(LIBDIR)
SEMODULE_OBJS = semodule.o
.PHONY: all semodule_path
-all: semodule semodule_path
+all: semodule semodule_path genhomedircon
semodule_path:
@echo -n $(SBINDIR) > ../scripts/semodule_path
@@ -19,11 +19,16 @@ semodule_path:
semodule: $(SEMODULE_OBJS)
$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
+genhomedircon:
+ ln -sf semodule genhomedircon
+
Update to upstream
2013-02-08 14:44:20 +00:00
install: all
-mkdir -p $(SBINDIR)
install -m 755 semodule $(SBINDIR)
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
+ (cd $(SBINDIR); ln -sf semodule genhomedircon)
Update to upstream
2013-02-08 14:44:20 +00:00
test -d $(MANDIR)/man8 || install -m 755 -d $(MANDIR)/man8
install -m 644 semodule.8 $(MANDIR)/man8/
+ install -m 644 genhomedircon.8 $(MANDIR)/man8/
Update to upstream 2.1.4 2011-08-17 * run_init: clarification of the usage in the * semanage: fix usage header around booleans * semanage: remove useless empty lines * semanage: update man page with new examples * semanage: update usage text * semanage: introduce file context equivalencies * semanage: enable and disable modules * semanage: output all local modifications * semanage: introduce extraction of local configuration * semanage: cleanup error on invalid operation * semanage: handle being called with no arguments * semanage: return sooner to save CPU time * semanage: surround getopt with try/except * semanage: use define/raise instead of lots of * semanage: some options are only valid for * semanage: introduce better deleteall support * semanage: do not allow spaces in file * semanage: distinguish between builtin and local permissive * semanage: centralized ip node handling * setfiles: make the restore function exclude() non-static * setfiles: use glob to handle ~ and * fixfiles: do not hard code types * fixfiles: stop trying to be smart about * fixfiles: use new kernel seclabel option * fixfiles: pipe everything to cat before sending * fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs * semodule: support for alternative root paths
2011-08-18 11:23:59 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
relabel:
On full relabels we will now show a estimated percent complete rather then just *s.
2012-02-03 17:14:36 +00:00
Update to upstream
2013-02-08 14:44:20 +00:00
diff --git a/policycoreutils/semodule/genhomedircon.8 b/policycoreutils/semodule/genhomedircon.8
new file mode 100644
index 0000000..8ec509c
--- /dev/null
+++ b/policycoreutils/semodule/genhomedircon.8
@@ -0,0 +1,24 @@
+.TH GENHOMEDIRCON "12" "Sep 2011" "Security Enhanced Linux" "SELinux"
+.SH NAME
+genhomedircon \- generate SELinux file context configuration entries for user home directories
+.SH SYNOPSIS
+.B genhomedircon
+is a script that executes
+.B semodule
+to rebuild the currently active SELinux policy (without reloading it) and to create the
+labels for each user home directory based on directory paths returned by calls to getpwent().
On full relabels we will now show a estimated percent complete rather then just *s.
2012-02-03 17:14:36 +00:00
+
Update to upstream
2013-02-08 14:44:20 +00:00
+The latter functionality depends on the "usepasswd" parameter being set to "true" (default)
+in /etc/selinux/semanage.conf.
+
+This script is usually executed by
+.B semanage
+although this default behavior can be optionally modified by setting to "true" the
+"disable-genhomedircon" in /etc/selinux/semanage.conf.
+
+.SH AUTHOR
+This manual page was written by
+.I Dan Walsh <dwalsh@redhat.com>
+
+.SH "SEE ALSO"
+semanage.conf(5), semodule(8), semanage(8), getpwent(3), getpwent_r(3)
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
index 17b4fa5..6947b37 100644
--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
@@ -19,6 +19,7 @@
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
+#include <libgen.h>
#include <semanage/modules.h>
@@ -284,8 +285,12 @@ int main(int argc, char *argv[])
int i, commit = 0;
int result;
int status = EXIT_FAILURE;
-
+ char *genhomedirconargv[] = { "genhomedircon", "-B", "-n" };
create_signal_handlers();
+ if (strcmp(basename(argv[0]), "genhomedircon") == 0) {
+ argc = 3;
+ argv=genhomedirconargv;
+ }
parse_command_line(argc, argv);
if (build)
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
diff --git a/policycoreutils/sepolicy/Makefile b/policycoreutils/sepolicy/Makefile
index 11b534f..eb86eae 100644
--- a/policycoreutils/sepolicy/Makefile
+++ b/policycoreutils/sepolicy/Makefile
@@ -22,10 +22,14 @@ clean:
$(PYTHON) setup.py clean
-rm -rf build *~ \#* *pyc .#*
+sepolgen:
+ ln -sf sepolicy sepolgen
+
install:
$(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
[ -d $(BINDIR) ] || mkdir -p $(BINDIR)
install -m 755 sepolicy.py $(BINDIR)/sepolicy
+ (cd $(BINDIR); ln -sf sepolicy sepolgen)
-mkdir -p $(MANDIR)/man8
install -m 644 *.8 $(MANDIR)/man8
-mkdir -p $(BASHCOMPLETIONDIR)
diff --git a/policycoreutils/sepolicy/sepolgen.8 b/policycoreutils/sepolicy/sepolgen.8
new file mode 100644
index 0000000..3ecf3eb
--- /dev/null
+++ b/policycoreutils/sepolicy/sepolgen.8
@@ -0,0 +1 @@
+.so man8/sepolicy-generate.8
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
diff --git a/policycoreutils/sepolicy/sepolicy-bash-completion.sh b/policycoreutils/sepolicy/sepolicy-bash-completion.sh
index 82fea52..29f9428 100644
--- a/policycoreutils/sepolicy/sepolicy-bash-completion.sh
+++ b/policycoreutils/sepolicy/sepolicy-bash-completion.sh
@@ -81,7 +81,7 @@ _sepolicy () {
[communicate]='-h --help -s --source -t --target -c --class -S --sourceaccess -T --targetaccess'
[generate]='-a --admin --admin_user --application --cgi --confined_admin --customize -d --domain --dbus --desktop_user -h --help --inetd --init -n --name --newtype -p --path --sandbox -T --test --term_user -u --user -w --writepath --x_user'
[interface]='-h --help -a --list_admin" -u --list_user -l --list'
- [manpage]='-h --help -p --path -a -all -o --os -d --domain -w --web'
+ [manpage]='-h --help -p --path -a -all -o --os -d --domain -w --web -r --root'
[network]='-h --help -d --domain -l --list -p --port -t --type '
[transition]='-h --help -s --source -t --target'
)
@@ -156,6 +156,10 @@ _sepolicy () {
if [ "$prev" = "-d" -o "$prev" = "--domain" ]; then
COMPREPLY=( $(compgen -W "$( __get_all_domains ) " -- "$cur") )
return 0
+ elif test "$prev" = "-r" || test "$prev" = "--root" ; then
+ COMPREPLY=( $( compgen -d -- "$cur") )
+ compopt -o filenames
+ return 0
elif [ "$prev" = "-o" -o "$prev" = "--os" ]; then
return 0
elif test "$prev" = "-p" || test "$prev" = "--path" ; then
diff --git a/policycoreutils/sepolicy/sepolicy-manpage.8 b/policycoreutils/sepolicy/sepolicy-manpage.8
index b6abdf5..c05c943 100644
--- a/policycoreutils/sepolicy/sepolicy-manpage.8
+++ b/policycoreutils/sepolicy/sepolicy-manpage.8
@@ -5,7 +5,7 @@ sepolicy-manpage \- Generate a man page based on the installed SELinux Policy
.SH "SYNOPSIS"
.br
-.B sepolicy manpage [\-w] [\-h] [\-p PATH ] [\-a | \-d ]
+.B sepolicy manpage [\-w] [\-h] [\-p PATH ] [\-r ROOTDIR ] [\-a | \-d ]
.SH "DESCRIPTION"
Use sepolicy manpage to generate manpages based on SELinux Policy.
@@ -24,6 +24,9 @@ Display help message
.I \-p, \-\-path
Specify the directory to store the created man pages. (Default to /tmp)
.TP
+.I \-r, \-\-root
+Specify alternate root directory to generate man pages from. (Default to /)
+.TP
.I \-w, \-\-web
Generate an additional HTML man pages for the specified domain(s).
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
diff --git a/policycoreutils/sepolicy/sepolicy.py b/policycoreutils/sepolicy/sepolicy.py
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
index b25d3b2..7a15d88 100755
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
--- a/policycoreutils/sepolicy/sepolicy.py
+++ b/policycoreutils/sepolicy/sepolicy.py
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
@@ -22,6 +22,8 @@
#
#
import os, sys
+import selinux
+import sepolicy
from sepolicy import get_os_version
import argparse
import gettext
@@ -198,44 +200,44 @@ def network(args):
_print_net(d, net, "name_bind")
def manpage(args):
- from sepolicy.manpage import ManPage, HTMLManPages, manpage_domains, manpage_roles, gen_domains
+ from sepolicy.manpage import ManPage, HTMLManPages, manpage_domains, manpage_roles, gen_domains, get_all_domains
path = args.path
- if args.policy:
- for f in ( "policy.xml", "file_context", "file_context.homedirs"):
- if not os.path.exists(path + f):
- raise ValueError("manpage creation with alternate policy requires the %s file exist" % (path + f))
-
+ if not args.policy and args.root != "/":
+ sepolicy.policy(sepolicy.get_installed_policy(args.root))
+
if args.all:
test_domains = gen_domains()
else:
test_domains = args.domain
for domain in test_domains:
- m = ManPage(domain, path, args.web)
+ m = ManPage(domain, path, args.root, args.web)
print m.get_man_page_path()
if args.web:
HTMLManPages(manpage_roles, manpage_domains, path, args.os)
def gen_manpage_args(parser):
- man = parser.add_parser("manpage",
- help=_('Generate SELinux man pages'))
-
- man.add_argument("-p", "--path", dest="path", default="/tmp",
- help=_("path in which the generated SELinux man pages will be stored"))
- man.add_argument("-o", "--os", dest="os", default=get_os_version(),
- help=_("name of the OS for man pages"))
- man.add_argument("-w", "--web", dest="web", default=False, action="store_true",
- help=_("Generate HTML man pages structure for selected SELinux man page"))
- group = man.add_mutually_exclusive_group(required=True)
- group.add_argument("-a", "--all", dest="all", default=False,
- action="store_true",
- help=_("All domains"))
- group.add_argument("-d", "--domain", nargs="+",
- action=CheckDomain,
- help=_("Domain name(s) of man pages to be created"))
- man.set_defaults(func=manpage)
+ man = parser.add_parser("manpage",
+ help=_('Generate SELinux man pages'))
+
+ man.add_argument("-p", "--path", dest="path", default="/tmp",
+ help=_("path in which the generated SELinux man pages will be stored"))
+ man.add_argument("-o", "--os", dest="os", default=get_os_version(),
+ help=_("name of the OS for man pages"))
+ man.add_argument("-w", "--web", dest="web", default=False, action="store_true",
+ help=_("Generate HTML man pages structure for selected SELinux man page"))
+ man.add_argument("-r", "--root", dest="root", default="/",
+ help=_("Alternate root directory, defaults to /"))
+ group = man.add_mutually_exclusive_group(required=True)
+ group.add_argument("-a", "--all", dest="all", default=False,
+ action="store_true",
+ help=_("All domains"))
+ group.add_argument("-d", "--domain", nargs="+",
+ action=CheckDomain,
+ help=_("Domain name(s) of man pages to be created"))
+ man.set_defaults(func=manpage)
def gen_network_args(parser):
net = parser.add_parser("network",
@@ -283,7 +285,6 @@ def gen_communicate_args(parser):
comm.set_defaults(func=communicate)
def booleans(args):
- import selinux
from sepolicy import boolean_desc
if args.all:
rc, args.booleans = selinux.security_get_boolean_names()
@@ -461,7 +462,10 @@ if __name__ == '__main__':
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
gen_transition_args(subparsers)
try:
- args = parser.parse_args()
+ if os.path.basename(sys.argv[0]) == "sepolgen":
+ args = parser.parse_args([ "generate" ] + sys.argv[1:])
+ else:
+ args = parser.parse_args()
args.func(args)
sys.exit(0)
except ValueError,e:
diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
index 5e7415c..b9cb9cc 100644
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
--- a/policycoreutils/sepolicy/sepolicy/__init__.py
+++ b/policycoreutils/sepolicy/sepolicy/__init__.py
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
@@ -37,9 +37,30 @@ CLASS = 'class'
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
TRANSITION = 'transition'
ROLE_ALLOW = 'role_allow'
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
-def __get_installed_policy():
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
+def info(setype, name=None):
+ dict_list = _policy.info(setype, name)
+ return dict_list
+
+def search(types, info = {} ):
+ valid_types = [ALLOW, AUDITALLOW, NEVERALLOW, DONTAUDIT, TRANSITION, ROLE_ALLOW]
+ for type in types:
+ if type not in valid_types:
+ raise ValueError("Type has to be in %s" % valid_types)
+ info[type] = True
+
+ perms = []
+ if PERMS in info:
+ perms = info[PERMS]
+ info[PERMS] = ",".join(info[PERMS])
+
+ dict_list = _policy.search(info)
+ if dict_list and len(perms) != 0:
+ dict_list = filter(lambda x: _dict_has_perms(x, perms), dict_list)
+ return dict_list
+
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
+def get_installed_policy(root = "/"):
try:
- path = selinux.selinux_binary_policy_path()
+ path = root + selinux.selinux_binary_policy_path()
policies = glob.glob ("%s.*" % path )
policies.sort()
return policies[-1]
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
@@ -71,6 +92,7 @@ def get_all_role_allows():
return role_allows
def get_all_entrypoint_domains():
+ import re
all_domains = []
types=get_all_types()
types.sort()
@@ -85,7 +107,7 @@ all_domains = None
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
def get_all_domains():
global all_domains
if not all_domains:
- all_domains = info(ATTRIBUTE,"domain")[0]["types"]
+ all_domains = info(ATTRIBUTE,"domain")[0]["types"]
return all_domains
roles = None
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
@@ -139,49 +161,43 @@ def get_all_attributes():
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
return all_attributes
def policy(policy_file):
+ global all_domains
+ global all_attributes
+ global bools
+ global all_types
+ global role_allows
+ global users
+ global roles
+ global file_types
+ global port_types
+ all_domains = None
+ all_attributes = None
+ bools = None
+ all_types = None
+ role_allows = None
+ users = None
+ roles = None
+ file_types = None
+ port_types = None
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
try:
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
_policy.policy(policy_file)
except:
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
raise ValueError(_("Failed to read %s policy file") % policy_file)
-policy_file = selinux.selinux_current_policy_path()
-if not policy_file:
- policy_file = __get_installed_policy()
-
try:
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
+ policy_file = get_installed_policy()
Revert some changes which are causing the wrong policy version file to be created - Switch sandbox to start using openbox rather then matchpbox - Make sepolgen a symlink to sepolicy - update translations
2013-02-14 13:28:08 +00:00
policy(policy_file)
except ValueError, e:
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
if selinux.is_selinux_enabled() == 1:
raise e
-def search(types, info = {} ):
- valid_types = [ALLOW, AUDITALLOW, NEVERALLOW, DONTAUDIT, TRANSITION, ROLE_ALLOW]
- for type in types:
- if type not in valid_types:
- raise ValueError("Type has to be in %s" % valid_types)
- info[type] = True
-
- perms = []
- if PERMS in info:
- perms = info[PERMS]
- info[PERMS] = ",".join(info[PERMS])
-
- dict_list = _policy.search(info)
- if dict_list and len(perms) != 0:
- dict_list = filter(lambda x: _dict_has_perms(x, perms), dict_list)
- return dict_list
-
def _dict_has_perms(dict, perms):
for perm in perms:
if perm not in dict[PERMS]:
return False
return True
-def info(setype, name=None):
- dict_list = _policy.info(setype, name)
- return dict_list
-
booleans_dict = None
def gen_bool_dict(path="/usr/share/selinux/devel/policy.xml"):
global booleans_dict
Sepolixy should not throw an exception on an SELinux disabled machine - Switch from using console app to using pkexec, so we will work better with policykit. - Add missing import to fix system-config-selinux startup - Add comment to pamd files about pam_rootok.so - Fix sepolicy generate to not comment out the first line
2013-02-21 17:26:12 +00:00
diff --git a/policycoreutils/sepolicy/sepolicy/generate.py b/policycoreutils/sepolicy/sepolicy/generate.py
index 26f8390..19f6056 100644
--- a/policycoreutils/sepolicy/sepolicy/generate.py
+++ b/policycoreutils/sepolicy/sepolicy/generate.py
@@ -1037,7 +1037,8 @@ allow %s_t %s_t:%s_socket name_%s;
########################################
#
# %s local policy
-#""" % self.name
+#
+""" % self.name
newte += self.generate_capabilities()
newte += self.generate_process()
newte += self.generate_network_types()
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
diff --git a/policycoreutils/sepolicy/sepolicy/manpage.py b/policycoreutils/sepolicy/sepolicy/manpage.py
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
index 25062da..da17c48 100755
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
--- a/policycoreutils/sepolicy/sepolicy/manpage.py
+++ b/policycoreutils/sepolicy/sepolicy/manpage.py
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
@@ -24,11 +24,12 @@
#
__all__ = [ 'ManPage', 'HTMLManPages', 'manpage_domains', 'manpage_roles', 'gen_domains' ]
+from sepolicy import network
import string
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
import argparse
import selinux
import sepolicy
-from sepolicy import network, gen_bool_dict, get_all_file_types, get_all_domains, get_all_roles, get_all_users, get_all_port_types, get_all_bools, get_all_attributes, get_all_role_allows
+from sepolicy import *
import commands
import sys, os, re, time
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
@@ -416,40 +417,33 @@ class ManPage:
"""
Generate a Manpage on an SELinux domain in the specified path
"""
- all_attributes = get_all_attributes()
- all_domains = get_all_domains()
- all_bools = get_all_bools()
- all_port_types = get_all_port_types()
- all_roles = get_all_roles()
- all_users = get_all_users_info()[0]
- all_users_range = get_all_users_info()[1]
- all_file_types = get_all_file_types()
- types = _gen_types()
modules_dict = None
- domains = gen_domains()
- role_allows = get_all_role_allows()
enabled_str = ["Disabled", "Enabled"]
- def __init__(self, domainname, path = "/tmp", html = False):
+ def __init__(self, domainname, path = "/tmp", root="/", html = False):
self.html = html
+ self.root = root
self.portrecs = network.portrecs
-
- fcpath = path + "/file_contexts"
- if os.path.exists(fcpath):
- self.fcpath = fcpath
- else:
- self.fcpath = selinux.selinux_file_context_path()
+ self.domains = gen_domains()
+ self.all_domains = get_all_domains()
+ self.all_attributes = get_all_attributes()
+ self.all_bools = get_all_bools()
+ self.all_port_types = get_all_port_types()
+ self.all_roles = get_all_roles()
+ self.all_users = get_all_users_info()[0]
+ self.all_users_range = get_all_users_info()[1]
+ self.all_file_types = get_all_file_types()
+ self.role_allows = get_all_role_allows()
+ self.types = _gen_types()
+
+ self.fcpath = self.root + selinux.selinux_file_context_path()
self.fcdict = _gen_fcdict(self.fcpath)
if not os.path.exists(path):
os.makedirs(path)
- self.path = path
- xmlpath = path + "/policy.xml"
- if os.path.exists(xmlpath):
- self.xmlpath = xmlpath
- else:
- self.xmlpath = "/usr/share/selinux/devel/policy.xml"
+ self.path = path
+ self.xmlpath = self.root + "/usr/share/selinux/devel/policy.xml"
self.booleans_dict = gen_bool_dict(self.xmlpath)
if domainname.endswith("_t"):
@@ -947,13 +941,14 @@ semanage fcontext -a -t public_content_t "/var/%(domainname)s(/.*)?"
Fix man page generation and public_content description
2013-02-14 15:13:51 +00:00
.B restorecon -F -R -v /var/%(domainname)s
.pp
.TP
-Allow %(domainname)s servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the file type. This also requires the allow_%(domainname)sd_anon_write boolean to be set.
+Allow %(domainname)s servers to read and write /var/%(domainname)s/incoming by adding the public_content_rw_t type to the directory and by restoring the file type. You also need to turn on the %(domainname)s_anon_write boolean.
.PP
.B
semanage fcontext -a -t public_content_rw_t "/var/%(domainname)s/incoming(/.*)?"
.br
.B restorecon -F -R -v /var/%(domainname)s/incoming
-
+.br
+.B setsebool -P %(domainname)s_anon_write 1
""" % {'domainname':self.domainname})
for b in self.anon_list:
desc = self.booleans_dict[b][2][0].lower() + self.booleans_dict[b][2][1:]
Add --root/-r flag to sepolicy manpage, - This allows us to generate man pages on the fly in the selinux-policy build
2013-02-20 15:48:51 +00:00
@@ -1230,6 +1225,7 @@ The SELinux user %s_u is not able to terminal login.
""" % self.domainname)
def _network(self):
+ from sepolicy import network
self.fd.write("""
.SH NETWORK
""")
Fix empty system-config-selinux.png
2013-02-12 21:16:02 +00:00
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
index 80b6d6e..07c5ee2 100644
--- a/policycoreutils/setfiles/restorecon.8
+++ b/policycoreutils/setfiles/restorecon.8
@@ -4,10 +4,10 @@ restorecon \- restore file(s) default SELinux security contexts.
.SH "SYNOPSIS"
.B restorecon
-.I [\-o outfilename] [\-R] [\-n] [\-p] [\-v] [\-e directory] pathname...
+.I [\-R] [\-n] [\-p] [\-v] [\-e directory] pathname...
.P
.B restorecon
-.I \-f infilename [\-o outfilename] [\-e directory] [\-R] [\-n] [\-p] [\-v] [\-F]
+.I \-f infilename [\-e directory] [\-R] [\-n] [\-p] [\-v] [\-F]
.SH "DESCRIPTION"
This manual page describes the
@@ -49,7 +49,7 @@ ignore files that do not exist.
don't change any file labels (passive check).
.TP
.B \-o outfilename
-save list of files with incorrect context in outfilename.
+Deprecated, SELinux policy will probably block this access. Use shell redirection to save list of files with incorrect context in filename.
.TP
.B \-p
show progress by printing * every STAR_COUNT files. (If you relabel the entire OS, this will show you the percentage complete.)
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index 89d2a49..12bca43 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -4,7 +4,7 @@ setfiles \- set SELinux file security contexts.
.SH "SYNOPSIS"
.B setfiles
-.I [\-c policy] [\-d] [\-l] [\-n] [\-e directory] [\-o filename] [\-q] [\-s] [\-v] [\-W] [\-F] spec_file pathname...
+.I [\-c policy] [\-d] [\-l] [\-n] [\-e directory] [\-q] [\-s] [\-v] [\-W] [\-F] spec_file pathname...
.SH "DESCRIPTION"
This manual page describes the
.BR setfiles
@@ -57,7 +57,7 @@ log changes in file labels to syslog.
don't change any file labels (passive check).
.TP
.B \-o filename
-save list of files with incorrect context in filename.
+Deprecated, SELinux policy will probably block this access. Use shell redirection to save list of files with incorrect context in filename.
.TP
.B \-p
show progress by printing * every STAR_COUNT files. (If you relabel the entire OS, this will show you the percentage complete.)
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index b11e49f..d3f02ae 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -45,14 +45,14 @@ void usage(const char *const name)
{
if (iamrestorecon) {
fprintf(stderr,
- "usage: %s [-iFnprRv0] [-e excludedir] [-o filename] pathname...\n"
- "usage: %s [-iFnprRv0] [-e excludedir] [-o filename] -f filename\n",
+ "usage: %s [-iFnprRv0] [-e excludedir] pathname...\n"
+ "usage: %s [-iFnprRv0] [-e excludedir] -f filename\n",
name, name);
} else {
fprintf(stderr,
- "usage: %s [-dilnpqvFW] [-e excludedir] [-o filename] [-r alt_root_path] spec_file pathname...\n"
- "usage: %s [-dilnpqvFW] [-e excludedir] [-o filename] [-r alt_root_path] spec_file -f filename\n"
- "usage: %s -s [-dilnpqvFW] [-o filename] spec_file\n"
+ "usage: %s [-dilnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n"
+ "usage: %s [-dilnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n"
+ "usage: %s -s [-dilnpqvFW] spec_file\n"
"usage: %s -c policyfile spec_file\n",
name, name, name, name);
}
Reference in New Issue Copy Permalink