2009-05-05 18:51:52 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/audit2allow policycoreutils-2.0.62/audit2allow/audit2allow
|
|
|
|
--- nsapolicycoreutils/audit2allow/audit2allow 2009-01-13 08:45:35.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/audit2allow/audit2allow 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -126,6 +126,7 @@
|
|
|
|
elif self.__options.audit:
|
|
|
|
try:
|
|
|
|
messages = audit.get_audit_msgs()
|
|
|
|
+ messages += audit.get_log_msgs()
|
|
|
|
except OSError, e:
|
|
|
|
sys.stderr.write('could not run ausearch - "%s"\n' % str(e))
|
|
|
|
sys.exit(1)
|
2009-02-23 16:34:14 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.62/Makefile
|
2009-01-04 19:46:52 +00:00
|
|
|
--- nsapolicycoreutils/Makefile 2008-08-28 09:34:24.000000000 -0400
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/Makefile 2009-05-04 13:40:26.000000000 -0400
|
2009-01-04 19:46:52 +00:00
|
|
|
@@ -1,4 +1,4 @@
|
|
|
|
-SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
|
|
|
|
+SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
|
|
|
|
|
|
|
|
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/Makefile policycoreutils-2.0.62/restorecond/Makefile
|
|
|
|
--- nsapolicycoreutils/restorecond/Makefile 2009-02-18 16:44:47.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/Makefile 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -2,16 +2,21 @@
|
|
|
|
PREFIX ?= ${DESTDIR}/usr
|
|
|
|
SBINDIR ?= $(PREFIX)/sbin
|
|
|
|
MANDIR = $(PREFIX)/share/man
|
|
|
|
+AUTOSTARTDIR = $(DESTDIR)/etc/xdg/autostart
|
|
|
|
+DBUSSERVICEDIR = $(DESTDIR)/usr/share/dbus-1/services
|
|
|
|
+
|
|
|
|
+autostart_DATA = sealertauto.desktop
|
|
|
|
INITDIR = $(DESTDIR)/etc/rc.d/init.d
|
|
|
|
SELINUXDIR = $(DESTDIR)/etc/selinux
|
|
|
|
|
|
|
|
CFLAGS ?= -g -Werror -Wall -W
|
|
|
|
-override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
|
|
|
|
-LDLIBS += -lselinux -L$(PREFIX)/lib
|
|
|
|
+override CFLAGS += -I$(PREFIX)/include -I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0/include -D_FILE_OFFSET_BITS=64 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include
|
|
|
|
+
|
|
|
|
+LDLIBS += -lselinux -ldbus-glib-1 -lglib-2.0 -L$(PREFIX)/lib
|
|
|
|
|
|
|
|
all: restorecond
|
|
|
|
|
|
|
|
-restorecond: restorecond.o utmpwatcher.o stringslist.o
|
|
|
|
+restorecond: restorecond.o stringslist.o user.o
|
|
|
|
$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
|
|
|
|
|
|
|
|
install: all
|
|
|
|
@@ -22,7 +27,12 @@
|
|
|
|
-mkdir -p $(INITDIR)
|
|
|
|
install -m 755 restorecond.init $(INITDIR)/restorecond
|
|
|
|
-mkdir -p $(SELINUXDIR)
|
|
|
|
- install -m 600 restorecond.conf $(SELINUXDIR)/restorecond.conf
|
|
|
|
+ install -m 644 restorecond.conf $(SELINUXDIR)/restorecond.conf
|
|
|
|
+ install -m 644 restorecond_user.conf $(SELINUXDIR)/restorecond_user.conf
|
|
|
|
+ -mkdir -p $(AUTOSTARTDIR)
|
|
|
|
+ install -m 600 restorecond.desktop $(AUTOSTARTDIR)/restorecond.desktop
|
|
|
|
+ -mkdir -p $(DBUSSERVICEDIR)
|
|
|
|
+ install -m 600 org.selinux.Restorecond.service $(DBUSSERVICEDIR)/org.selinux.Restorecond.service
|
|
|
|
|
|
|
|
relabel: install
|
|
|
|
/sbin/restorecon $(SBINDIR)/restorecond
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/org.selinux.Restorecond.service policycoreutils-2.0.62/restorecond/org.selinux.Restorecond.service
|
|
|
|
--- nsapolicycoreutils/restorecond/org.selinux.Restorecond.service 1969-12-31 19:00:00.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/org.selinux.Restorecond.service 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -0,0 +1,3 @@
|
|
|
|
+[D-BUS Service]
|
|
|
|
+Name=org.selinux.Restorecond
|
|
|
|
+Exec=/usr/sbin/restorecond -u
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.62/restorecond/restorecond.c
|
|
|
|
--- nsapolicycoreutils/restorecond/restorecond.c 2009-02-18 16:44:47.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/restorecond.c 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -54,25 +54,31 @@
|
|
|
|
#include <syslog.h>
|
|
|
|
#include <limits.h>
|
|
|
|
#include <fcntl.h>
|
|
|
|
+#include <pwd.h>
|
|
|
|
+#include <glob.h>
|
|
|
|
|
|
|
|
#include "restorecond.h"
|
|
|
|
#include "stringslist.h"
|
|
|
|
-#include "utmpwatcher.h"
|
|
|
|
|
|
|
|
+extern int start(void);
|
|
|
|
+extern int server(int);
|
|
|
|
extern char *dirname(char *path);
|
|
|
|
static int master_fd = -1;
|
|
|
|
static int master_wd = -1;
|
|
|
|
static int terminate = 0;
|
|
|
|
|
|
|
|
+static char *server_watch_file = "/etc/selinux/restorecond.conf";
|
|
|
|
+static char *user_watch_file = "/etc/selinux/restorecond_user.conf";
|
|
|
|
+static char *watch_file;
|
|
|
|
+
|
|
|
|
#include <selinux/selinux.h>
|
|
|
|
-#include <utmp.h>
|
|
|
|
|
|
|
|
/* size of the event structure, not counting name */
|
|
|
|
#define EVENT_SIZE (sizeof (struct inotify_event))
|
|
|
|
/* reasonable guess as to size of 1024 events */
|
|
|
|
#define BUF_LEN (1024 * (EVENT_SIZE + 16))
|
|
|
|
|
|
|
|
-static int debug_mode = 0;
|
|
|
|
+int debug_mode = 0;
|
|
|
|
static int verbose_mode = 0;
|
|
|
|
|
|
|
|
static void restore(const char *filename, int exact);
|
|
|
|
@@ -104,7 +110,7 @@
|
|
|
|
see if it is one that we are watching.
|
|
|
|
*/
|
|
|
|
|
|
|
|
-static int watch_list_find(int wd, const char *file)
|
|
|
|
+int watch_list_find(int wd, const char *file)
|
|
|
|
{
|
|
|
|
struct watchList *ptr = NULL;
|
|
|
|
ptr = firstDir;
|
|
|
|
@@ -135,7 +141,7 @@
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
-static void watch_list_free(int fd)
|
|
|
|
+void watch_list_free(int fd)
|
|
|
|
{
|
|
|
|
struct watchList *ptr = NULL;
|
|
|
|
struct watchList *prev = NULL;
|
|
|
|
@@ -152,6 +158,12 @@
|
|
|
|
firstDir = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
+static void done(void) {
|
|
|
|
+ watch_list_free(master_fd);
|
|
|
|
+ close(master_fd);
|
|
|
|
+ matchpathcon_fini();
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
/*
|
|
|
|
Set the file context to the default file context for this system.
|
|
|
|
Same as restorecon.
|
|
|
|
@@ -241,6 +253,8 @@
|
|
|
|
{
|
|
|
|
char *line_buf = NULL;
|
|
|
|
size_t len = 0;
|
|
|
|
+ uid_t uid = getuid();
|
|
|
|
+ struct passwd *pwd = getpwuid(uid);
|
|
|
|
|
|
|
|
while (getline(&line_buf, &len, cfg) > 0) {
|
|
|
|
char *buffer = line_buf;
|
|
|
|
@@ -252,8 +266,12 @@
|
|
|
|
if (l <= 0)
|
|
|
|
continue;
|
|
|
|
buffer[l] = 0;
|
|
|
|
- if (buffer[0] == '~')
|
|
|
|
- utmpwatcher_add(fd, &buffer[1]);
|
|
|
|
+ if (buffer[0] == '~') {
|
|
|
|
+ char *ptr=NULL;
|
|
|
|
+ asprintf(&ptr, "%s%s", pwd->pw_dir, &buffer[1]);
|
|
|
|
+ watch_list_add(fd, ptr);
|
|
|
|
+ free(ptr);
|
|
|
|
+ }
|
|
|
|
else {
|
|
|
|
watch_list_add(fd, buffer);
|
|
|
|
}
|
|
|
|
@@ -267,9 +285,8 @@
|
|
|
|
homedirs.
|
|
|
|
*/
|
|
|
|
|
|
|
|
-static void read_config(int fd)
|
|
|
|
+static void read_config(int fd, const char *watch_file_path)
|
|
|
|
{
|
|
|
|
- char *watch_file_path = "/etc/selinux/restorecond.conf";
|
|
|
|
|
|
|
|
FILE *cfg = NULL;
|
|
|
|
if (debug_mode)
|
|
|
|
@@ -278,8 +295,10 @@
|
|
|
|
watch_list_free(fd);
|
|
|
|
|
|
|
|
cfg = fopen(watch_file_path, "r");
|
|
|
|
- if (!cfg)
|
|
|
|
- exitApp("Error reading config file.");
|
|
|
|
+ if (!cfg){
|
|
|
|
+ perror(watch_file_path);
|
|
|
|
+ exitApp("Error reading config file");
|
|
|
|
+ }
|
|
|
|
process_config(fd, cfg);
|
|
|
|
fclose(cfg);
|
|
|
|
|
|
|
|
@@ -316,21 +335,10 @@
|
|
|
|
event->wd, event->mask,
|
|
|
|
event->cookie, event->len);
|
|
|
|
if (event->wd == master_wd)
|
|
|
|
- read_config(fd);
|
|
|
|
+ read_config(fd, watch_file);
|
|
|
|
else {
|
|
|
|
- switch (utmpwatcher_handle(fd, event->wd)) {
|
|
|
|
- case -1: /* Message was not for utmpwatcher */
|
|
|
|
- if (event->len)
|
|
|
|
- watch_list_find(event->wd, event->name);
|
|
|
|
- break;
|
|
|
|
-
|
|
|
|
- case 1: /* utmp has changed need to reload */
|
|
|
|
- read_config(fd);
|
|
|
|
- break;
|
|
|
|
-
|
|
|
|
- default: /* No users logged in or out */
|
|
|
|
- break;
|
|
|
|
- }
|
|
|
|
+ if (event->len)
|
|
|
|
+ watch_list_find(event->wd, event->name);
|
|
|
|
}
|
|
|
|
|
|
|
|
i += EVENT_SIZE + event->len;
|
|
|
|
@@ -374,7 +382,7 @@
|
|
|
|
|
|
|
|
static void usage(char *program)
|
|
|
|
{
|
|
|
|
- printf("%s [-d] [-v] \n", program);
|
|
|
|
+ printf("%s [-d] [-s] [-f restorecond_file ] [-v] \n", program);
|
|
|
|
exit(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
@@ -393,7 +401,9 @@
|
|
|
|
void watch_list_add(int fd, const char *path)
|
|
|
|
{
|
|
|
|
struct watchList *ptr = NULL;
|
|
|
|
+ size_t i = 0;
|
|
|
|
struct watchList *prev = NULL;
|
|
|
|
+ glob_t globbuf;
|
|
|
|
char *x = strdup(path);
|
|
|
|
if (!x)
|
|
|
|
exitApp("Out of Memory");
|
|
|
|
@@ -401,7 +411,15 @@
|
|
|
|
char *file = basename(path);
|
|
|
|
ptr = firstDir;
|
|
|
|
|
|
|
|
- restore(path, 1);
|
|
|
|
+ globbuf.gl_offs = 1;
|
|
|
|
+ if (glob(path,
|
|
|
|
+ GLOB_TILDE,
|
|
|
|
+ NULL,
|
|
|
|
+ &globbuf) >= 0) {
|
|
|
|
+ for (i=0; i < globbuf.gl_pathc; i++)
|
|
|
|
+ restore(globbuf.gl_pathv[i], 1);
|
|
|
|
+ globfree(&globbuf);
|
|
|
|
+ }
|
|
|
|
|
|
|
|
while (ptr != NULL) {
|
|
|
|
if (strcmp(dir, ptr->dir) == 0) {
|
|
|
|
@@ -445,14 +463,8 @@
|
|
|
|
{
|
|
|
|
int opt;
|
|
|
|
struct sigaction sa;
|
|
|
|
+ int run_as_user = 0;
|
|
|
|
|
|
|
|
-#ifndef DEBUG
|
|
|
|
- /* Make sure we are root */
|
|
|
|
- if (getuid() != 0) {
|
|
|
|
- fprintf(stderr, "You must be root to run this program.\n");
|
|
|
|
- return 1;
|
|
|
|
- }
|
|
|
|
-#endif
|
|
|
|
/* Make sure we are root */
|
|
|
|
if (is_selinux_enabled() != 1) {
|
|
|
|
fprintf(stderr, "Daemon requires SELinux be enabled to run.\n");
|
|
|
|
@@ -471,11 +483,18 @@
|
|
|
|
if (master_fd < 0)
|
|
|
|
exitApp("inotify_init");
|
|
|
|
|
|
|
|
- while ((opt = getopt(argc, argv, "dv")) > 0) {
|
|
|
|
+ atexit( done );
|
|
|
|
+ while ((opt = getopt(argc, argv, "uf:dv")) > 0) {
|
|
|
|
switch (opt) {
|
|
|
|
case 'd':
|
|
|
|
debug_mode = 1;
|
|
|
|
break;
|
|
|
|
+ case 'f':
|
|
|
|
+ watch_file = optarg;
|
|
|
|
+ break;
|
|
|
|
+ case 'u':
|
|
|
|
+ run_as_user = 1;
|
|
|
|
+ break;
|
|
|
|
case 'v':
|
|
|
|
verbose_mode = 1;
|
|
|
|
break;
|
|
|
|
@@ -483,7 +502,18 @@
|
|
|
|
usage(argv[0]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
- read_config(master_fd);
|
|
|
|
+
|
|
|
|
+ if (getuid() != 0) {
|
|
|
|
+ watch_file = user_watch_file;
|
|
|
|
+ read_config(master_fd, watch_file);
|
|
|
|
+ if (run_as_user)
|
|
|
|
+ return server(master_fd);
|
|
|
|
+ else
|
|
|
|
+ return start();
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ watch_file = server_watch_file;
|
|
|
|
+ read_config(master_fd, watch_file);
|
|
|
|
|
|
|
|
if (!debug_mode)
|
|
|
|
daemon(0, 0);
|
|
|
|
@@ -496,9 +526,10 @@
|
|
|
|
watch_list_free(master_fd);
|
|
|
|
close(master_fd);
|
|
|
|
matchpathcon_fini();
|
|
|
|
- utmpwatcher_free();
|
|
|
|
if (pidfile)
|
|
|
|
unlink(pidfile);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
+
|
|
|
|
+
|
2009-02-23 16:34:14 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.62/restorecond/restorecond.conf
|
|
|
|
--- nsapolicycoreutils/restorecond/restorecond.conf 2009-02-18 16:44:47.000000000 -0500
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/restorecond/restorecond.conf 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -4,4 +4,5 @@
|
|
|
|
/etc/mtab
|
2009-02-23 16:34:14 +00:00
|
|
|
/var/run/utmp
|
|
|
|
/var/log/wtmp
|
2009-05-05 18:51:52 +00:00
|
|
|
-~/*
|
|
|
|
+/root/*
|
2009-02-23 16:34:14 +00:00
|
|
|
+/root/.ssh/*
|
2009-05-05 18:51:52 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.desktop policycoreutils-2.0.62/restorecond/restorecond.desktop
|
|
|
|
--- nsapolicycoreutils/restorecond/restorecond.desktop 1969-12-31 19:00:00.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/restorecond.desktop 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -0,0 +1,7 @@
|
|
|
|
+[Desktop Entry]
|
|
|
|
+Name=File Context maintainer
|
|
|
|
+Exec=/usr/sbin/restorecond
|
|
|
|
+Comment=Fix file context in owned by the user
|
|
|
|
+Encoding=UTF-8
|
|
|
|
+Type=Application
|
|
|
|
+StartupNotify=false
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond_user.conf policycoreutils-2.0.62/restorecond/restorecond_user.conf
|
|
|
|
--- nsapolicycoreutils/restorecond/restorecond_user.conf 1969-12-31 19:00:00.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/restorecond_user.conf 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -0,0 +1,2 @@
|
|
|
|
+~/*
|
|
|
|
+~/public_html/*
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/user.c policycoreutils-2.0.62/restorecond/user.c
|
|
|
|
--- nsapolicycoreutils/restorecond/user.c 1969-12-31 19:00:00.000000000 -0500
|
|
|
|
+++ policycoreutils-2.0.62/restorecond/user.c 2009-05-04 13:40:26.000000000 -0400
|
|
|
|
@@ -0,0 +1,223 @@
|
|
|
|
+/*
|
|
|
|
+ * restorecond
|
|
|
|
+ *
|
|
|
|
+ * Copyright (C) 2006-2009 Red Hat
|
|
|
|
+ * see file 'COPYING' for use and warranty information
|
|
|
|
+ *
|
|
|
|
+ * This program is free software; you can redistribute it and/or
|
|
|
|
+ * modify it under the terms of the GNU General Public License as
|
|
|
|
+ * published by the Free Software Foundation; either version 2 of
|
|
|
|
+ * the License, or (at your option) any later version.
|
|
|
|
+ *
|
|
|
|
+ * This program is distributed in the hope that it will be useful,
|
|
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
+ * GNU General Public License for more details.
|
|
|
|
+.*
|
|
|
|
+ * You should have received a copy of the GNU General Public License
|
|
|
|
+ * along with this program; if not, write to the Free Software
|
|
|
|
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
|
|
|
|
+ * 02111-1307 USA
|
|
|
|
+ *
|
|
|
|
+ * Authors:
|
|
|
|
+ * Dan Walsh <dwalsh@redhat.com>
|
|
|
|
+ *
|
|
|
|
+*/
|
|
|
|
+
|
|
|
|
+/*
|
|
|
|
+ * PURPOSE:
|
|
|
|
+ * This daemon program watches for the creation of files listed in a config file
|
|
|
|
+ * and makes sure that there security context matches the systems defaults
|
|
|
|
+ *
|
|
|
|
+ * USAGE:
|
|
|
|
+ * restorecond [-d] [-v]
|
|
|
|
+ *
|
|
|
|
+ * -d Run in debug mode
|
|
|
|
+ * -v Run in verbose mode (Report missing files)
|
|
|
|
+ *
|
|
|
|
+ * EXAMPLE USAGE:
|
|
|
|
+ * restorecond
|
|
|
|
+ *
|
|
|
|
+ */
|
|
|
|
+
|
|
|
|
+#define _GNU_SOURCE
|
|
|
|
+#include <sys/inotify.h>
|
|
|
|
+#include <errno.h>
|
|
|
|
+#include <stdio.h>
|
|
|
|
+#include <stdlib.h>
|
|
|
|
+#include <signal.h>
|
|
|
|
+#include <string.h>
|
|
|
|
+#include <unistd.h>
|
|
|
|
+#include <ctype.h>
|
|
|
|
+#include <sys/types.h>
|
|
|
|
+#include <sys/stat.h>
|
|
|
|
+#include <syslog.h>
|
|
|
|
+#include <limits.h>
|
|
|
|
+#include <fcntl.h>
|
|
|
|
+
|
|
|
|
+#include "restorecond.h"
|
|
|
|
+#include "stringslist.h"
|
|
|
|
+#include <glib.h>
|
|
|
|
+#include <dbus/dbus.h>
|
|
|
|
+#include <dbus/dbus-glib.h>
|
|
|
|
+#include <dbus/dbus-glib-lowlevel.h>
|
2009-02-23 16:34:14 +00:00
|
|
|
+
|
2009-05-05 18:51:52 +00:00
|
|
|
+extern int watch_list_find(int wd, const char *file);
|
|
|
|
+extern void watch_list_free(int fd);
|
|
|
|
+extern int debug_mode;
|
2009-02-23 16:34:14 +00:00
|
|
|
+
|
2009-05-05 18:51:52 +00:00
|
|
|
+static DBusHandlerResult signal_filter (DBusConnection *connection, DBusMessage *message, void *user_data);
|
|
|
|
+
|
|
|
|
+static const char *PATH="/org/selinux/Restorecond";
|
|
|
|
+//static const char *BUSNAME="org.selinux.Restorecond";
|
|
|
|
+static const char *INTERFACE="org.selinux.RestorecondIface";
|
|
|
|
+static const char *RULE="type='signal',interface='org.selinux.RestorecondIface'";
|
|
|
|
+
|
|
|
|
+#include <selinux/selinux.h>
|
|
|
|
+
|
|
|
|
+/* size of the event structure, not counting name */
|
|
|
|
+#define EVENT_SIZE (sizeof (struct inotify_event))
|
|
|
|
+/* reasonable guess as to size of 1024 events */
|
|
|
|
+#define BUF_LEN (1024 * (EVENT_SIZE + 16))
|
|
|
|
+
|
|
|
|
+static gboolean
|
|
|
|
+io_channel_callback
|
|
|
|
+ (GIOChannel *source,
|
|
|
|
+ GIOCondition condition,
|
|
|
|
+ gpointer data __attribute__((__unused__)))
|
|
|
|
+{
|
|
|
|
+
|
|
|
|
+ char buffer[BUF_LEN+1];
|
|
|
|
+ gsize bytes_read;
|
|
|
|
+ unsigned int i = 0;
|
|
|
|
+
|
|
|
|
+ if (condition & G_IO_IN) {
|
|
|
|
+ /* Data is available. */
|
|
|
|
+ g_io_channel_read
|
|
|
|
+ (source, buffer,
|
|
|
|
+ sizeof (buffer),
|
|
|
|
+ &bytes_read);
|
|
|
|
+
|
|
|
|
+ while (i < bytes_read) {
|
|
|
|
+ struct inotify_event *event;
|
|
|
|
+ event = (struct inotify_event *)&buffer[i];
|
|
|
|
+ if (debug_mode)
|
|
|
|
+ printf("wd=%d mask=%u cookie=%u len=%u\n",
|
|
|
|
+ event->wd, event->mask,
|
|
|
|
+ event->cookie, event->len);
|
|
|
|
+ if (event->len)
|
|
|
|
+ watch_list_find(event->wd, event->name);
|
|
|
|
+
|
|
|
|
+ i += EVENT_SIZE + event->len;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* An error happened while reading
|
|
|
|
+ the file. */
|
|
|
|
+
|
|
|
|
+ if (condition & G_IO_NVAL)
|
|
|
|
+ return FALSE;
|
|
|
|
+
|
|
|
|
+ /* We have reached the end of the
|
|
|
|
+ file. */
|
|
|
|
+
|
|
|
|
+ if (condition & G_IO_HUP) {
|
|
|
|
+ g_io_channel_close (source);
|
|
|
|
+ return FALSE;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ /* Returning TRUE will make sure
|
|
|
|
+ the callback remains associated
|
|
|
|
+ to the channel. */
|
|
|
|
+
|
|
|
|
+ return TRUE;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+static DBusHandlerResult
|
|
|
|
+signal_filter (DBusConnection *connection __attribute__ ((__unused__)), DBusMessage *message, void *user_data)
|
|
|
|
+{
|
|
|
|
+ /* User data is the event loop we are running in */
|
|
|
|
+ GMainLoop *loop = user_data;
|
|
|
|
+
|
|
|
|
+ /* A signal from the bus saying we are about to be disconnected */
|
|
|
|
+ if (dbus_message_is_signal
|
|
|
|
+ (message, INTERFACE, "Stop")) {
|
|
|
|
+
|
|
|
|
+ /* Tell the main loop to quit */
|
|
|
|
+ g_main_loop_quit (loop);
|
|
|
|
+ /* We have handled this message, don't pass it on */
|
|
|
|
+ return DBUS_HANDLER_RESULT_HANDLED;
|
|
|
|
+ }
|
|
|
|
+ /* A Ping signal on the com.burtonini.dbus.Signal interface */
|
|
|
|
+ else if (dbus_message_is_signal (message, INTERFACE, "Start")) {
|
|
|
|
+ DBusError error;
|
|
|
|
+ dbus_error_init (&error);
|
|
|
|
+ g_print("Start received\n");
|
|
|
|
+ return DBUS_HANDLER_RESULT_HANDLED;
|
|
|
|
+ }
|
|
|
|
+ return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+int start() {
|
|
|
|
+ DBusConnection *bus;
|
|
|
|
+ DBusError error;
|
|
|
|
+ DBusMessage *message;
|
|
|
|
+
|
|
|
|
+ /* Get a connection to the session bus */
|
|
|
|
+ dbus_error_init (&error);
|
|
|
|
+ bus = dbus_bus_get (DBUS_BUS_SESSION, &error);
|
|
|
|
+ if (!bus) {
|
|
|
|
+ g_warning ("Failed to connect to the D-BUS daemon: %s", error.message);
|
|
|
|
+ dbus_error_free (&error);
|
|
|
|
+ return 1;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+ /* Create a new signal "Start" on the interface,
|
|
|
|
+ * from the object */
|
|
|
|
+ message = dbus_message_new_signal (PATH,
|
|
|
|
+ INTERFACE, "Start");
|
|
|
|
+ /* Send the signal */
|
|
|
|
+ dbus_connection_send (bus, message, NULL);
|
|
|
|
+ /* Free the signal now we have finished with it */
|
|
|
|
+ dbus_message_unref (message);
|
|
|
|
+ return 0;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+int server(int master_fd) {
|
|
|
|
+ GMainLoop *loop;
|
|
|
|
+ DBusConnection *bus;
|
|
|
|
+ DBusError error;
|
|
|
|
+
|
|
|
|
+ loop = g_main_loop_new (NULL, FALSE);
|
|
|
|
+
|
|
|
|
+ dbus_error_init (&error);
|
|
|
|
+ if(getuid() == 0) {
|
|
|
|
+ bus = dbus_bus_get (DBUS_BUS_SYSTEM, &error);
|
|
|
|
+ } else {
|
|
|
|
+ bus = dbus_bus_get (DBUS_BUS_SESSION, &error);
|
|
|
|
+ }
|
|
|
|
+ if (!bus) {
|
|
|
|
+ g_warning ("Failed to connect to the D-BUS daemon: %s", error.message);
|
|
|
|
+ dbus_error_free (&error);
|
|
|
|
+ return 1;
|
|
|
|
+ }
|
|
|
|
+ dbus_connection_setup_with_g_main (bus, NULL);
|
|
|
|
+
|
|
|
|
+ /* listening to messages from all objects as no path is specified */
|
|
|
|
+ dbus_bus_add_match (bus, RULE, &error); // see signals from the given interfacey
|
|
|
|
+ dbus_connection_add_filter (bus, signal_filter, loop, NULL);
|
|
|
|
+
|
|
|
|
+ set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
|
|
|
|
+
|
|
|
|
+ GIOChannel *c = g_io_channel_unix_new(master_fd);
|
|
|
|
+
|
|
|
|
+ g_io_add_watch_full( c,
|
|
|
|
+ G_PRIORITY_HIGH,
|
|
|
|
+ G_IO_IN|G_IO_ERR|G_IO_HUP,
|
|
|
|
+ io_channel_callback, NULL, NULL);
|
|
|
|
+
|
|
|
|
+ g_main_loop_run (loop);
|
|
|
|
+ return 0;
|
|
|
|
+}
|
2009-04-11 12:22:23 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.62/scripts/chcat
|
|
|
|
--- nsapolicycoreutils/scripts/chcat 2009-01-13 08:45:35.000000000 -0500
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/scripts/chcat 2009-05-04 13:40:26.000000000 -0400
|
2009-04-11 12:22:23 +00:00
|
|
|
@@ -281,14 +281,14 @@
|
|
|
|
def expandCats(cats):
|
|
|
|
newcats = []
|
|
|
|
for c in cats:
|
|
|
|
- if c.find(".") != -1:
|
|
|
|
- c = c.split(".")
|
|
|
|
- for i in range(int(c[0][1:]), int(c[1][1:]) + 1):
|
|
|
|
- x = ("c%d" % i)
|
|
|
|
- if x not in newcats:
|
|
|
|
- newcats.append("c%d" % i)
|
|
|
|
- else:
|
|
|
|
- for i in c.split(","):
|
|
|
|
+ for i in c.split(","):
|
|
|
|
+ if i.find(".") != -1:
|
|
|
|
+ j = i.split(".")
|
|
|
|
+ for k in range(int(j[0][1:]), int(j[1][1:]) + 1):
|
|
|
|
+ x = ("c%d" % k)
|
|
|
|
+ if x not in newcats:
|
|
|
|
+ newcats.append(x)
|
|
|
|
+ else:
|
|
|
|
if i not in newcats:
|
|
|
|
newcats.append(i)
|
|
|
|
if len(newcats) > 25:
|
2009-02-23 16:34:14 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.62/scripts/fixfiles
|
|
|
|
--- nsapolicycoreutils/scripts/fixfiles 2009-02-18 16:44:47.000000000 -0500
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/scripts/fixfiles 2009-05-05 10:47:08.000000000 -0400
|
|
|
|
@@ -89,7 +89,7 @@
|
|
|
|
fi; \
|
|
|
|
done | \
|
|
|
|
while read pattern ; do sh -c "find $pattern \
|
|
|
|
- ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o \
|
|
|
|
+ ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune -o \
|
|
|
|
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
|
|
|
|
done 2> /dev/null | \
|
|
|
|
${RESTORECON} $* -0 -f -
|
|
|
|
@@ -122,14 +122,14 @@
|
2009-02-23 16:34:14 +00:00
|
|
|
fi
|
|
|
|
if [ ! -z "$RPMFILES" ]; then
|
|
|
|
for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
|
|
|
|
- rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1 >> $LOGFILE
|
|
|
|
+ rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f - 2>&1 >> $LOGFILE
|
|
|
|
done
|
|
|
|
exit $?
|
|
|
|
fi
|
2009-05-05 18:51:52 +00:00
|
|
|
if [ ! -z "$FILEPATH" ]; then
|
|
|
|
if [ -x /usr/bin/find ]; then
|
|
|
|
/usr/bin/find "$FILEPATH" \
|
|
|
|
- ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o -print0 | \
|
|
|
|
+ ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o fstype btrfs \) -prune -o -print0 | \
|
|
|
|
${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
|
|
|
|
else
|
|
|
|
${RESTORECON} ${OUTFILES} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
|
2009-03-12 13:30:38 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.62/semanage/semanage
|
|
|
|
--- nsapolicycoreutils/semanage/semanage 2009-02-18 16:44:47.000000000 -0500
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/semanage/semanage 2009-05-04 13:40:26.000000000 -0400
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -44,16 +44,17 @@
|
|
|
|
text = _("""
|
|
|
|
semanage [ -S store ] -i [ input_file | - ]
|
|
|
|
|
|
|
|
-semanage {boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n]
|
|
|
|
+semanage {module,boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n]
|
|
|
|
semanage login -{a|d|m} [-sr] login_name | %groupname
|
|
|
|
semanage user -{a|d|m} [-LrRP] selinux_name
|
2009-04-09 02:05:21 +00:00
|
|
|
semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range
|
|
|
|
semanage interface -{a|d|m} [-tr] interface_spec
|
|
|
|
semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] addr
|
|
|
|
-semanage fcontext -{a|d|m} [-frst] file_spec
|
|
|
|
+semanage fcontext -{a|d|m} [-frst] [-e path ] file_spec
|
|
|
|
semanage translation -{a|d|m} [-T] level
|
|
|
|
semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
|
2009-04-16 18:53:29 +00:00
|
|
|
-semanage permissive -{d|a} type
|
|
|
|
+semanage permissive -{a|d} type
|
|
|
|
+semanage module -{a|d|} module
|
|
|
|
|
|
|
|
Primary Options:
|
|
|
|
|
|
|
|
@@ -68,6 +69,7 @@
|
|
|
|
-h, --help Display this message
|
|
|
|
-n, --noheading Do not print heading when listing OBJECTS
|
|
|
|
-S, --store Select and alternate SELinux store to manage
|
|
|
|
+ --dontaudit Turn on or off dontaudit rules
|
|
|
|
|
|
|
|
Object-specific Options (see above):
|
|
|
|
|
|
|
|
@@ -84,6 +86,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
-F, --file Treat target as an input file for command, change multiple settings
|
|
|
|
-p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6)
|
|
|
|
-M, --mask Netmask
|
|
|
|
+ -e, --equil Make target equil to this paths labeling
|
|
|
|
-P, --prefix Prefix for home directory labeling
|
|
|
|
-L, --level Default SELinux Level (MLS/MCS Systems only)
|
|
|
|
-R, --roles SELinux Roles (ex: "sysadm_r staff_r")
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -115,11 +118,14 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
valid_option["node"] = []
|
|
|
|
valid_option["node"] += valid_everyone + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol']
|
|
|
|
valid_option["fcontext"] = []
|
|
|
|
- valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
|
|
|
|
+ valid_option["fcontext"] += valid_everyone + [ '-e', '--equil', '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
|
|
|
|
valid_option["translation"] = []
|
|
|
|
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
|
|
|
|
valid_option["boolean"] = []
|
2009-04-16 18:53:29 +00:00
|
|
|
valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0", "-F", "--file"]
|
|
|
|
+ valid_option["module"] = []
|
|
|
|
+ valid_option["module"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '--dontaudit']
|
|
|
|
+
|
|
|
|
valid_option["permissive"] = []
|
|
|
|
valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ]
|
|
|
|
return valid_option
|
|
|
|
@@ -192,7 +198,10 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
locallist = False
|
|
|
|
use_file = False
|
|
|
|
store = ""
|
|
|
|
+ equil=""
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
+ dontaudit = ""
|
|
|
|
+
|
2009-04-09 02:05:21 +00:00
|
|
|
object = argv[0]
|
|
|
|
option_dict=get_options()
|
2009-04-16 18:53:29 +00:00
|
|
|
if object not in option_dict.keys():
|
|
|
|
@@ -201,10 +210,12 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
args = argv[1:]
|
|
|
|
|
|
|
|
gopts, cmds = getopt.getopt(args,
|
|
|
|
- '01adf:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:',
|
|
|
|
+ '01ade:f:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:',
|
|
|
|
['add',
|
|
|
|
'delete',
|
|
|
|
'deleteall',
|
2009-04-16 18:53:29 +00:00
|
|
|
+ 'dontaudit=',
|
2009-04-09 02:05:21 +00:00
|
|
|
+ 'equil=',
|
|
|
|
'ftype=',
|
|
|
|
'file',
|
|
|
|
'help',
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -241,16 +252,24 @@
|
|
|
|
if modify or add:
|
|
|
|
raise ValueError(_("%s bad option") % o)
|
|
|
|
delete = True
|
|
|
|
+
|
|
|
|
if o == "-D" or o == "--deleteall":
|
|
|
|
if modify:
|
|
|
|
raise ValueError(_("%s bad option") % o)
|
|
|
|
deleteall = True
|
|
|
|
+
|
2009-04-09 02:05:21 +00:00
|
|
|
if o == "-f" or o == "--ftype":
|
2009-04-16 18:53:29 +00:00
|
|
|
- ftype=a
|
|
|
|
+ ftype = a
|
2009-04-09 02:05:21 +00:00
|
|
|
+
|
2009-04-16 18:53:29 +00:00
|
|
|
+ if o == "-e" or o == "--equil":
|
|
|
|
+ equil = a
|
|
|
|
|
2009-04-09 02:05:21 +00:00
|
|
|
if o == "-F" or o == "--file":
|
|
|
|
use_file = True
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
+ if o == "--dontaudit":
|
2009-05-05 18:51:52 +00:00
|
|
|
+ dontaudit = not int(a)
|
2009-04-16 18:53:29 +00:00
|
|
|
+
|
|
|
|
if o == "-h" or o == "--help":
|
|
|
|
raise ValueError(_("%s bad option") % o)
|
|
|
|
|
|
|
|
@@ -323,6 +342,9 @@
|
|
|
|
|
|
|
|
if object == "boolean":
|
|
|
|
OBJECT = seobject.booleanRecords(store)
|
|
|
|
+
|
|
|
|
+ if object == "module":
|
|
|
|
+ OBJECT = seobject.moduleRecords(store)
|
|
|
|
|
|
|
|
if object == "translation":
|
|
|
|
OBJECT = seobject.setransRecords()
|
|
|
|
@@ -341,6 +363,13 @@
|
|
|
|
OBJECT.deleteall()
|
|
|
|
return
|
|
|
|
|
|
|
|
+ if dontaudit != "":
|
|
|
|
+ if object == "module":
|
|
|
|
+ OBJECT.dontaudit(dontaudit)
|
|
|
|
+ else:
|
|
|
|
+ raise ValueError(_("%s bad option") % o)
|
|
|
|
+ return
|
|
|
|
+
|
|
|
|
if len(cmds) != 1:
|
|
|
|
raise ValueError(_("%s bad option") % o)
|
|
|
|
|
|
|
|
@@ -362,11 +391,17 @@
|
|
|
|
if object == "interface":
|
|
|
|
OBJECT.add(target, serange, setype)
|
|
|
|
|
|
|
|
+ if object == "module":
|
|
|
|
+ OBJECT.add(target)
|
|
|
|
+
|
|
|
|
if object == "node":
|
2009-04-09 02:05:21 +00:00
|
|
|
OBJECT.add(target, mask, proto, serange, setype)
|
|
|
|
|
|
|
|
if object == "fcontext":
|
|
|
|
- OBJECT.add(target, setype, ftype, serange, seuser)
|
|
|
|
+ if equil == "":
|
|
|
|
+ OBJECT.add(target, setype, ftype, serange, seuser)
|
|
|
|
+ else:
|
|
|
|
+ OBJECT.add_equil(target, equil)
|
|
|
|
if object == "permissive":
|
|
|
|
OBJECT.add(target)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -386,6 +421,9 @@
|
|
|
|
rlist = roles.split()
|
|
|
|
OBJECT.modify(target, rlist, selevel, serange, prefix)
|
|
|
|
|
|
|
|
+ if object == "module":
|
|
|
|
+ OBJECT.modify(target)
|
|
|
|
+
|
|
|
|
if object == "port":
|
|
|
|
OBJECT.modify(target, proto, serange, setype)
|
|
|
|
|
|
|
|
@@ -396,7 +434,10 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
OBJECT.modify(target, mask, proto, serange, setype)
|
|
|
|
|
|
|
|
if object == "fcontext":
|
|
|
|
- OBJECT.modify(target, setype, ftype, serange, seuser)
|
|
|
|
+ if equil == "":
|
|
|
|
+ OBJECT.modify(target, setype, ftype, serange, seuser)
|
|
|
|
+ else:
|
|
|
|
+ OBJECT.modify_equil(target, equil)
|
|
|
|
|
|
|
|
return
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -405,7 +446,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
OBJECT.delete(target, proto)
|
|
|
|
|
|
|
|
elif object == "fcontext":
|
|
|
|
- OBJECT.delete(target, ftype)
|
|
|
|
+ OBJECT.delete(target, ftype)
|
|
|
|
|
|
|
|
elif object == "node":
|
|
|
|
OBJECT.delete(target, mask, proto)
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -464,10 +505,10 @@
|
2009-03-12 13:30:38 +00:00
|
|
|
else:
|
|
|
|
fd = open(input, 'r')
|
|
|
|
trans = seobject.semanageRecords(store)
|
|
|
|
- trans.begin()
|
|
|
|
+ trans.start()
|
|
|
|
for l in fd.readlines():
|
|
|
|
process_args(mkargv(l))
|
|
|
|
- trans.commit()
|
|
|
|
+ trans.finish()
|
|
|
|
else:
|
|
|
|
process_args(sys.argv[1:])
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-2.0.62/semanage/semanage.8
|
|
|
|
--- nsapolicycoreutils/semanage/semanage.8 2008-08-28 09:34:24.000000000 -0400
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/semanage/semanage.8 2009-05-04 13:40:26.000000000 -0400
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -21,6 +21,8 @@
|
|
|
|
.br
|
|
|
|
.B semanage permissive \-{a|d} type
|
|
|
|
.br
|
|
|
|
+.B semanage module \-{a|d} policy_package
|
|
|
|
+.br
|
|
|
|
.B semanage translation \-{a|d|m} [\-T] level
|
|
|
|
.P
|
|
|
|
|
2009-03-12 13:30:38 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.62/semanage/seobject.py
|
|
|
|
--- nsapolicycoreutils/semanage/seobject.py 2008-11-14 17:10:15.000000000 -0500
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/semanage/seobject.py 2009-05-05 14:45:58.000000000 -0400
|
|
|
|
@@ -1,5 +1,5 @@
|
|
|
|
#! /usr/bin/python -E
|
|
|
|
-# Copyright (C) 2005, 2006, 2007, 2008 Red Hat
|
|
|
|
+# Copyright (C) 2005, 2006, 2007, 2008, 2009 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
|
|
|
# semanage is a tool for managing SELinux configuration files
|
2009-04-11 12:22:23 +00:00
|
|
|
@@ -21,16 +21,16 @@
|
|
|
|
#
|
|
|
|
#
|
2009-04-09 02:05:21 +00:00
|
|
|
|
2009-04-11 12:22:23 +00:00
|
|
|
-import pwd, grp, string, selinux, tempfile, os, re, sys
|
|
|
|
+import pwd, grp, string, selinux, tempfile, os, re, sys, stat
|
2009-04-09 02:05:21 +00:00
|
|
|
from semanage import *;
|
|
|
|
-PROGNAME="policycoreutils"
|
|
|
|
+PROGNAME = "policycoreutils"
|
|
|
|
import sepolgen.module as module
|
|
|
|
|
|
|
|
import gettext
|
|
|
|
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
|
|
|
|
gettext.textdomain(PROGNAME)
|
|
|
|
try:
|
|
|
|
- gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
|
|
|
|
+ gettext.install(PROGNAME, localedir = "/usr/share/locale", unicode = 1)
|
|
|
|
except IOError:
|
|
|
|
import __builtin__
|
|
|
|
__builtin__.__dict__['_'] = unicode
|
|
|
|
@@ -96,7 +96,7 @@
|
|
|
|
self.audit_fd = audit.audit_open()
|
|
|
|
|
|
|
|
def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""):
|
|
|
|
- audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0],str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success);
|
|
|
|
+ audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0], str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success);
|
|
|
|
except:
|
|
|
|
class logger:
|
|
|
|
def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""):
|
|
|
|
@@ -104,7 +104,7 @@
|
|
|
|
message = "Successful: "
|
|
|
|
else:
|
|
|
|
message = "Failed: "
|
|
|
|
- message += " %s name=%s" % (msg,name)
|
|
|
|
+ message += " %s name=%s" % (msg, name)
|
|
|
|
if sename != "":
|
|
|
|
message += " sename=" + sename
|
|
|
|
if old_sename != "":
|
|
|
|
@@ -123,9 +123,9 @@
|
|
|
|
|
|
|
|
import xml.etree.ElementTree
|
|
|
|
|
|
|
|
-booleans_dict={}
|
|
|
|
+booleans_dict = {}
|
|
|
|
try:
|
|
|
|
- tree=xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
|
|
|
|
+ tree = xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
|
|
|
|
for l in tree.findall("layer"):
|
|
|
|
for m in l.findall("module"):
|
|
|
|
for b in m.findall("tunable"):
|
|
|
|
@@ -160,12 +160,12 @@
|
|
|
|
cat_range = category + "(\." + category +")?"
|
|
|
|
categories = cat_range + "(\," + cat_range + ")*"
|
|
|
|
reg = sensitivity + "(-" + sensitivity + ")?" + "(:" + categories + ")?"
|
|
|
|
- return re.search("^" + reg +"$",raw)
|
|
|
|
+ return re.search("^" + reg +"$", raw)
|
|
|
|
|
|
|
|
def translate(raw, prepend = 1):
|
|
|
|
- filler="a:b:c:"
|
|
|
|
+ filler = "a:b:c:"
|
|
|
|
if prepend == 1:
|
|
|
|
- context = "%s%s" % (filler,raw)
|
|
|
|
+ context = "%s%s" % (filler, raw)
|
|
|
|
else:
|
|
|
|
context = raw
|
|
|
|
(rc, trans) = selinux.selinux_raw_to_trans_context(context)
|
|
|
|
@@ -179,9 +179,9 @@
|
|
|
|
return trans
|
|
|
|
|
|
|
|
def untranslate(trans, prepend = 1):
|
|
|
|
- filler="a:b:c:"
|
|
|
|
+ filler = "a:b:c:"
|
|
|
|
if prepend == 1:
|
|
|
|
- context = "%s%s" % (filler,trans)
|
|
|
|
+ context = "%s%s" % (filler, trans)
|
|
|
|
else:
|
|
|
|
context = trans
|
|
|
|
|
|
|
|
@@ -234,7 +234,7 @@
|
|
|
|
rec += "%s=%s\n" % (k, self.ddict[k])
|
|
|
|
return rec
|
|
|
|
|
|
|
|
- def list(self,heading = 1, locallist = 0):
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
print "\n%-25s %s\n" % (_("Level"), _("Translation"))
|
|
|
|
keys = self.ddict.keys()
|
2009-04-11 12:22:23 +00:00
|
|
|
@@ -273,6 +273,7 @@
|
|
|
|
(fd, newfilename) = tempfile.mkstemp('', self.filename)
|
|
|
|
os.write(fd, self.out())
|
|
|
|
os.close(fd)
|
|
|
|
+ os.chmod(newfilename, os.stat(self.filename)[stat.ST_MODE])
|
|
|
|
os.rename(newfilename, self.filename)
|
|
|
|
os.system("/sbin/service mcstrans reload > /dev/null")
|
|
|
|
|
|
|
|
@@ -281,15 +282,20 @@
|
2009-03-12 13:30:38 +00:00
|
|
|
global handle
|
|
|
|
|
|
|
|
if handle != None:
|
|
|
|
- self.transaction = True
|
|
|
|
self.sh = handle
|
|
|
|
else:
|
2009-04-09 02:05:21 +00:00
|
|
|
- self.sh=get_handle(store)
|
2009-03-12 13:30:38 +00:00
|
|
|
- self.transaction = False
|
2009-04-09 02:05:21 +00:00
|
|
|
+ self.sh = get_handle(store)
|
2009-03-12 13:30:38 +00:00
|
|
|
+ self.transaction = False
|
|
|
|
|
|
|
|
def deleteall(self):
|
|
|
|
raise ValueError(_("Not yet implemented"))
|
|
|
|
|
|
|
|
+ def start(self):
|
|
|
|
+ if self.transaction:
|
|
|
|
+ raise ValueError(_("Semanage transaction already in progress"))
|
|
|
|
+ self.begin()
|
|
|
|
+ self.transaction = True
|
|
|
|
+
|
|
|
|
def begin(self):
|
|
|
|
if self.transaction:
|
|
|
|
return
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -303,6 +309,55 @@
|
2009-03-12 13:30:38 +00:00
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not commit semanage transaction"))
|
|
|
|
|
|
|
|
+ def finish(self):
|
|
|
|
+ if not self.transaction:
|
|
|
|
+ raise ValueError(_("Semanage transaction not in progress"))
|
|
|
|
+ self.transaction = False
|
|
|
|
+ self.commit()
|
|
|
|
+
|
2009-04-16 18:53:29 +00:00
|
|
|
+class moduleRecords(semanageRecords):
|
|
|
|
+ def __init__(self, store):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
+
|
|
|
|
+ def get_all(self):
|
|
|
|
+ l = []
|
|
|
|
+ (rc, mlist, number) = semanage_module_list(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list SELinux modules"))
|
|
|
|
+
|
|
|
|
+ for i in range(number):
|
|
|
|
+ mod = semanage_module_list_nth(mlist, i)
|
|
|
|
+ name = semanage_module_get_name(mod)
|
|
|
|
+ l.append(name)
|
|
|
|
+ return l
|
|
|
|
+
|
|
|
|
+ def dontaudit(self, dontaudit = 0):
|
|
|
|
+ self.begin()
|
2009-05-05 18:51:52 +00:00
|
|
|
+ rc = semanage_set_disable_dontaudit(self.sh, dontaudit)
|
2009-04-16 18:53:29 +00:00
|
|
|
+ self.commit()
|
|
|
|
+ rc = semanage_reload_policy(self.sh)
|
|
|
|
+
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
+ if heading:
|
|
|
|
+ print "\n%-25s\n" % (_("Modules"))
|
|
|
|
+ for t in self.get_all():
|
|
|
|
+ print t
|
|
|
|
+
|
|
|
|
+ def add(self, modules):
|
|
|
|
+ import glob
|
|
|
|
+ for m in modules.split():
|
|
|
|
+ rc = semanage_module_install_file(self.sh, m);
|
|
|
|
+ if rc >= 0:
|
|
|
|
+ self.commit()
|
|
|
|
+
|
|
|
|
+ def delete(self, modules):
|
|
|
|
+ for m in modules.split():
|
|
|
|
+ rc = semanage_module_remove(self.sh, m)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not remove module %s (remove failed)") % name)
|
|
|
|
+
|
|
|
|
+ self.commit()
|
|
|
|
+
|
2009-03-12 13:30:38 +00:00
|
|
|
class permissiveRecords(semanageRecords):
|
|
|
|
def __init__(self, store):
|
|
|
|
semanageRecords.__init__(self, store)
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -320,7 +375,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
l.append(name.split("permissive_")[1])
|
|
|
|
return l
|
|
|
|
|
|
|
|
- def list(self,heading = 1, locallist = 0):
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
print "\n%-25s\n" % (_("Permissive Types"))
|
|
|
|
for t in self.get_all():
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -328,6 +383,7 @@
|
2009-03-31 12:56:45 +00:00
|
|
|
|
|
|
|
|
|
|
|
def add(self, type):
|
|
|
|
+ import glob
|
|
|
|
name = "permissive_%s" % type
|
|
|
|
dirname = "/var/lib/selinux"
|
|
|
|
os.chdir(dirname)
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -341,7 +397,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
|
|
|
|
permissive %s;
|
|
|
|
""" % (name, type, type)
|
|
|
|
- fd = open(filename,'w')
|
|
|
|
+ fd = open(filename, 'w')
|
|
|
|
fd.write(modtxt)
|
|
|
|
fd.close()
|
|
|
|
mc = module.ModuleCompiler()
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -351,16 +407,19 @@
|
2009-03-31 12:56:45 +00:00
|
|
|
fd.close()
|
|
|
|
|
|
|
|
rc = semanage_module_install(self.sh, data, len(data));
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name)
|
|
|
|
-
|
|
|
|
- self.commit()
|
|
|
|
+ if rc >= 0:
|
|
|
|
+ self.commit()
|
|
|
|
|
2009-04-09 02:05:21 +00:00
|
|
|
- for root, dirs, files in os.walk("tmp", topdown=False):
|
|
|
|
+ for root, dirs, files in os.walk("tmp", topdown = False):
|
2009-03-31 12:56:45 +00:00
|
|
|
for name in files:
|
|
|
|
os.remove(os.path.join(root, name))
|
|
|
|
for name in dirs:
|
|
|
|
os.rmdir(os.path.join(root, name))
|
|
|
|
+ os.removedirs("tmp")
|
|
|
|
+ for i in glob.glob("permissive_%s.*" % type):
|
|
|
|
+ os.remove(i)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name)
|
|
|
|
|
|
|
|
def delete(self, name):
|
|
|
|
for n in name.split():
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -390,11 +449,11 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if sename == "":
|
|
|
|
sename = "user_u"
|
|
|
|
|
|
|
|
- (rc,k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
|
|
|
if exists:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -410,7 +469,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
except:
|
|
|
|
raise ValueError(_("Linux User %s does not exist") % name)
|
|
|
|
|
|
|
|
- (rc,u) = semanage_seuser_create(self.sh)
|
|
|
|
+ (rc, u) = semanage_seuser_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create login mapping for %s") % name)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -450,17 +509,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if sename == "" and serange == "":
|
|
|
|
raise ValueError(_("Requires seuser or serange"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Login mapping for %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,u) = semanage_seuser_query(self.sh, k)
|
|
|
|
+ (rc, u) = semanage_seuser_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query seuser for %s") % name)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -483,7 +542,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
semanage_seuser_key_free(k)
|
|
|
|
semanage_seuser_free(u)
|
|
|
|
|
|
|
|
- mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
|
|
|
|
+ mylog.log(1, "modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
|
|
|
|
|
|
|
|
def modify(self, name, sename = "", serange = ""):
|
|
|
|
try:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -492,21 +551,21 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
self.commit()
|
|
|
|
|
|
|
|
except ValueError, error:
|
|
|
|
- mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", "");
|
|
|
|
+ mylog.log(0, "modify selinux user mapping", name, sename, "", serange, "", "", "");
|
|
|
|
raise error
|
|
|
|
|
|
|
|
def __delete(self, name):
|
|
|
|
- (rc,k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Login mapping for %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_seuser_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_seuser_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
|
|
|
if not exists:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -525,10 +584,10 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
self.commit()
|
|
|
|
|
|
|
|
except ValueError, error:
|
|
|
|
- mylog.log(0,"delete SELinux user mapping", name);
|
|
|
|
+ mylog.log(0, "delete SELinux user mapping", name);
|
|
|
|
raise error
|
|
|
|
|
|
|
|
- mylog.log(1,"delete SELinux user mapping", name);
|
|
|
|
+ mylog.log(1, "delete SELinux user mapping", name);
|
|
|
|
|
|
|
|
def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -578,17 +637,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if len(roles) < 1:
|
|
|
|
raise ValueError(_("You must add at least one role for %s") % name)
|
|
|
|
|
|
|
|
- (rc,k) = semanage_user_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_user_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_user_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_user_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
|
|
|
if exists:
|
|
|
|
raise ValueError(_("SELinux user %s is already defined") % name)
|
|
|
|
|
|
|
|
- (rc,u) = semanage_user_create(self.sh)
|
|
|
|
+ (rc, u) = semanage_user_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create SELinux user for %s") % name)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -612,7 +671,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
rc = semanage_user_set_prefix(self.sh, u, prefix)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
|
|
|
|
- (rc,key) = semanage_user_key_extract(self.sh,u)
|
|
|
|
+ (rc, key) = semanage_user_key_extract(self.sh,u)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not extract key for %s") % name)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -645,17 +704,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
else:
|
|
|
|
raise ValueError(_("Requires prefix or roles"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_user_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_user_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_user_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_user_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("SELinux user %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,u) = semanage_user_query(self.sh, k)
|
|
|
|
+ (rc, u) = semanage_user_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query user for %s") % name)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -703,17 +762,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
raise error
|
|
|
|
|
|
|
|
def __delete(self, name):
|
|
|
|
- (rc,k) = semanage_user_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_user_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_user_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_user_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("SELinux user %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_user_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_user_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
|
|
|
if not exists:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -795,7 +854,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
low = int(ports[0])
|
|
|
|
high = int(ports[1])
|
|
|
|
|
|
|
|
- (rc,k) = semanage_port_key_create(self.sh, low, high, proto_d)
|
|
|
|
+ (rc, k) = semanage_port_key_create(self.sh, low, high, proto_d)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s/%s") % (proto, port))
|
|
|
|
return ( k, proto_d, low, high )
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -812,13 +871,13 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
|
|
|
|
( k, proto_d, low, high ) = self.__genkey(port, proto)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_port_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_port_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
|
|
|
if exists:
|
|
|
|
raise ValueError(_("Port %s/%s already defined") % (proto, port))
|
|
|
|
|
|
|
|
- (rc,p) = semanage_port_create(self.sh)
|
|
|
|
+ (rc, p) = semanage_port_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create port for %s/%s") % (proto, port))
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -871,13 +930,13 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
|
|
|
|
( k, proto_d, low, high ) = self.__genkey(port, proto)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_port_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_port_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Port %s/%s is not defined") % (proto,port))
|
|
|
|
|
|
|
|
- (rc,p) = semanage_port_query(self.sh, k)
|
|
|
|
+ (rc, p) = semanage_port_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query port %s/%s") % (proto, port))
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -926,13 +985,13 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
|
|
|
|
def __delete(self, port, proto):
|
|
|
|
( k, proto_d, low, high ) = self.__genkey(port, proto)
|
|
|
|
- (rc,exists) = semanage_port_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_port_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Port %s/%s is not defined") % (proto, port))
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_port_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_port_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
|
|
|
if not exists:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1038,17 +1097,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if ctype == "":
|
|
|
|
raise ValueError(_("SELinux Type is required"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % addr)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if addr %s is defined") % addr)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_node_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_node_exists(self.sh, k)
|
|
|
|
if exists:
|
|
|
|
raise ValueError(_("Addr %s already defined") % addr)
|
|
|
|
|
|
|
|
- (rc,node) = semanage_node_create(self.sh)
|
|
|
|
+ (rc, node) = semanage_node_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create addr for %s") % addr)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1113,17 +1172,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if serange == "" and setype == "":
|
|
|
|
raise ValueError(_("Requires setype or serange"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % addr)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_node_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_node_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if addr %s is defined") % addr)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Addr %s is not defined") % addr)
|
|
|
|
|
|
|
|
- (rc,node) = semanage_node_query(self.sh, k)
|
|
|
|
+ (rc, node) = semanage_node_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query addr %s") % addr)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1160,17 +1219,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
else:
|
|
|
|
raise ValueError(_("Unknown or missing protocol"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % addr)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_node_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_node_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if addr %s is defined") % addr)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Addr %s is not defined") % addr)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_node_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_node_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if addr %s is defined") % addr)
|
|
|
|
if not exists:
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1240,17 +1299,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if ctype == "":
|
|
|
|
raise ValueError(_("SELinux Type is required"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % interface)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if interface %s is defined") % interface)
|
|
|
|
if exists:
|
|
|
|
raise ValueError(_("Interface %s already defined") % interface)
|
|
|
|
|
|
|
|
- (rc,iface) = semanage_iface_create(self.sh)
|
|
|
|
+ (rc, iface) = semanage_iface_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create interface for %s") % interface)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1301,17 +1360,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if serange == "" and setype == "":
|
|
|
|
raise ValueError(_("Requires setype or serange"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % interface)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if interface %s is defined") % interface)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Interface %s is not defined") % interface)
|
|
|
|
|
|
|
|
- (rc,iface) = semanage_iface_query(self.sh, k)
|
|
|
|
+ (rc, iface) = semanage_iface_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query interface %s") % interface)
|
|
|
|
|
2009-04-16 18:53:29 +00:00
|
|
|
@@ -1335,17 +1394,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
self.commit()
|
|
|
|
|
|
|
|
def __delete(self, interface):
|
|
|
|
- (rc,k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % interface)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_iface_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if interface %s is defined") % interface)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Interface %s is not defined") % interface)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_iface_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_iface_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if interface %s is defined") % interface)
|
|
|
|
if not exists:
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1393,6 +1452,48 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
class fcontextRecords(semanageRecords):
|
|
|
|
def __init__(self, store = ""):
|
|
|
|
semanageRecords.__init__(self, store)
|
|
|
|
+ self.equiv = {}
|
|
|
|
+ self.equil_ind = False
|
2009-04-11 12:22:23 +00:00
|
|
|
+ try:
|
|
|
|
+ fd = open(selinux.selinux_file_context_subs_path(), "r")
|
|
|
|
+ for i in fd.readlines():
|
|
|
|
+ src, dst = i.split()
|
|
|
|
+ self.equiv[src] = dst
|
|
|
|
+ fd.close()
|
|
|
|
+ except IOError:
|
|
|
|
+ pass
|
2009-04-09 02:05:21 +00:00
|
|
|
+
|
|
|
|
+ def commit(self):
|
|
|
|
+ if self.equil_ind:
|
2009-04-11 12:22:23 +00:00
|
|
|
+ subs_file = selinux.selinux_file_context_subs_path()
|
|
|
|
+ tmpfile = "%s.tmp" % subs_file
|
2009-04-09 02:05:21 +00:00
|
|
|
+ fd = open(tmpfile, "w")
|
|
|
|
+ for src in self.equiv.keys():
|
|
|
|
+ fd.write("%s %s\n" % (src, self.equiv[src]))
|
|
|
|
+ fd.close()
|
2009-05-05 18:51:52 +00:00
|
|
|
+ try:
|
|
|
|
+ os.chmod(tmpfile, os.stat(subs_file)[stat.ST_MODE])
|
|
|
|
+ except:
|
|
|
|
+ pass
|
2009-04-11 12:22:23 +00:00
|
|
|
+ os.rename(tmpfile,subs_file)
|
2009-04-09 02:05:21 +00:00
|
|
|
+ self.equil_ind = False
|
|
|
|
+ semanageRecords.commit(self)
|
|
|
|
+
|
|
|
|
+ def add_equil(self, src, dst):
|
|
|
|
+ self.begin()
|
|
|
|
+ if src in self.equiv.keys():
|
|
|
|
+ raise ValueError(_("Equivalence class for %s already exists") % src)
|
|
|
|
+ self.equiv[src] = dst
|
|
|
|
+ self.equil_ind = True
|
|
|
|
+ self.commit()
|
|
|
|
+
|
|
|
|
+ def modify_equil(self, src, dst):
|
|
|
|
+ self.begin()
|
|
|
|
+ if src not in self.equiv.keys():
|
|
|
|
+ raise ValueError(_("Equivalence class for %s does not exists") % src)
|
|
|
|
+ self.equiv[src] = dst
|
|
|
|
+ self.equil_ind = True
|
|
|
|
+ self.commit()
|
|
|
|
|
|
|
|
def createcon(self, target, seuser = "system_u"):
|
|
|
|
(rc, con) = semanage_context_create(self.sh)
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1429,23 +1530,23 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if type == "":
|
|
|
|
raise ValueError(_("SELinux Type is required"))
|
|
|
|
|
|
|
|
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create key for %s") % target)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
|
|
|
|
|
|
|
if not exists:
|
|
|
|
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
|
|
|
|
|
|
|
if exists:
|
|
|
|
raise ValueError(_("File context for %s already defined") % target)
|
|
|
|
|
|
|
|
- (rc,fcontext) = semanage_fcontext_create(self.sh)
|
|
|
|
+ (rc, fcontext) = semanage_fcontext_create(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create file context for %s") % target)
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1486,21 +1587,21 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
raise ValueError(_("Requires setype, serange or seuser"))
|
|
|
|
self.validate(target)
|
|
|
|
|
|
|
|
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % target)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
|
|
|
if not exists:
|
|
|
|
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("File context for %s is not defined") % target)
|
|
|
|
|
|
|
|
- (rc,fcontext) = semanage_fcontext_query_local(self.sh, k)
|
|
|
|
+ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
- (rc,fcontext) = semanage_fcontext_query(self.sh, k)
|
|
|
|
+ (rc, fcontext) = semanage_fcontext_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query file context for %s") % target)
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1550,7 +1651,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
target = semanage_fcontext_get_expr(fcontext)
|
|
|
|
ftype = semanage_fcontext_get_type(fcontext)
|
|
|
|
ftype_str = semanage_fcontext_get_type_str(ftype)
|
|
|
|
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str])
|
|
|
|
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str])
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % target)
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1558,19 +1659,26 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not delete the file context %s") % target)
|
|
|
|
semanage_fcontext_key_free(k)
|
|
|
|
-
|
|
|
|
+
|
|
|
|
+ self.equiv = {}
|
|
|
|
+ self.equil_ind = True
|
|
|
|
self.commit()
|
|
|
|
|
|
|
|
def __delete(self, target, ftype):
|
|
|
|
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
+ if target in self.equiv.keys():
|
|
|
|
+ self.equiv.pop(target)
|
|
|
|
+ self.equil_ind = True
|
|
|
|
+ return
|
|
|
|
+
|
|
|
|
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % target)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
|
|
|
if not exists:
|
|
|
|
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
|
|
|
if exists:
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1617,11 +1725,11 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
return ddict
|
|
|
|
|
|
|
|
def list(self, heading = 1, locallist = 0 ):
|
|
|
|
- if heading:
|
|
|
|
- print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
|
|
|
|
fcon_dict = self.get_all(locallist)
|
|
|
|
keys = fcon_dict.keys()
|
|
|
|
keys.sort()
|
|
|
|
+ if len(keys) > 0 and heading:
|
|
|
|
+ print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
|
|
|
|
for k in keys:
|
|
|
|
if fcon_dict[k]:
|
|
|
|
if is_mls_enabled:
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1630,11 +1738,17 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
print "%-50s %-18s %s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1],fcon_dict[k][2])
|
|
|
|
else:
|
|
|
|
print "%-50s %-18s <<None>>" % (k[0], k[1])
|
|
|
|
+ if len(self.equiv.keys()) > 0:
|
|
|
|
+ if heading:
|
|
|
|
+ print _("\nSELinux fcontext Equivalence \n")
|
|
|
|
+
|
|
|
|
+ for src in self.equiv.keys():
|
|
|
|
+ print "%s == %s" % (src, self.equiv[src])
|
|
|
|
|
|
|
|
class booleanRecords(semanageRecords):
|
|
|
|
def __init__(self, store = ""):
|
|
|
|
semanageRecords.__init__(self, store)
|
|
|
|
- self.dict={}
|
|
|
|
+ self.dict = {}
|
|
|
|
self.dict["TRUE"] = 1
|
|
|
|
self.dict["FALSE"] = 0
|
|
|
|
self.dict["ON"] = 1
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1643,16 +1757,16 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
self.dict["0"] = 0
|
|
|
|
|
|
|
|
def __mod(self, name, value):
|
|
|
|
- (rc,k) = semanage_bool_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_bool_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
- (rc,exists) = semanage_bool_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_bool_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if boolean %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Boolean %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,b) = semanage_bool_query(self.sh, k)
|
|
|
|
+ (rc, b) = semanage_bool_query(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query file context %s") % name)
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1670,7 +1784,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
semanage_bool_key_free(k)
|
|
|
|
semanage_bool_free(b)
|
|
|
|
|
|
|
|
- def modify(self, name, value=None, use_file=False):
|
|
|
|
+ def modify(self, name, value = None, use_file = False):
|
|
|
|
|
|
|
|
self.begin()
|
|
|
|
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1694,16 +1808,16 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
|
|
|
|
def __delete(self, name):
|
|
|
|
|
|
|
|
- (rc,k) = semanage_bool_key_create(self.sh, name)
|
|
|
|
+ (rc, k) = semanage_bool_key_create(self.sh, name)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
- (rc,exists) = semanage_bool_exists(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_bool_exists(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if boolean %s is defined") % name)
|
|
|
|
if not exists:
|
|
|
|
raise ValueError(_("Boolean %s is not defined") % name)
|
|
|
|
|
|
|
|
- (rc,exists) = semanage_bool_exists_local(self.sh, k)
|
|
|
|
+ (rc, exists) = semanage_bool_exists_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not check if boolean %s is defined") % name)
|
|
|
|
if not exists:
|
2009-05-05 18:51:52 +00:00
|
|
|
@@ -1762,7 +1876,7 @@
|
2009-04-09 02:05:21 +00:00
|
|
|
return _("unknown")
|
|
|
|
|
|
|
|
def list(self, heading = True, locallist = False, use_file = False):
|
|
|
|
- on_off = (_("off"),_("on"))
|
|
|
|
+ on_off = (_("off"), _("on"))
|
|
|
|
if use_file:
|
|
|
|
ddict = self.get_all(locallist)
|
|
|
|
keys = ddict.keys()
|
2009-04-14 13:40:09 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setfiles/setfiles.c policycoreutils-2.0.62/setfiles/setfiles.c
|
|
|
|
--- nsapolicycoreutils/setfiles/setfiles.c 2008-08-28 09:34:24.000000000 -0400
|
2009-05-05 18:51:52 +00:00
|
|
|
+++ policycoreutils-2.0.62/setfiles/setfiles.c 2009-05-04 13:40:26.000000000 -0400
|
2009-04-14 13:40:09 +00:00
|
|
|
@@ -29,6 +29,8 @@
|
|
|
|
static int mass_relabel;
|
|
|
|
static int mass_relabel_errs;
|
|
|
|
|
|
|
|
+#define STAR_COUNT 1000
|
|
|
|
+
|
|
|
|
static FILE *outfile = NULL;
|
|
|
|
static int force = 0;
|
|
|
|
#define STAT_BLOCK_SIZE 1
|
|
|
|
@@ -444,11 +446,11 @@
|
|
|
|
|
|
|
|
if (progress) {
|
|
|
|
count++;
|
|
|
|
- if (count % 80000 == 0) {
|
|
|
|
+ if (count % (80 * STAR_COUNT) == 0) {
|
|
|
|
fprintf(stdout, "\n");
|
|
|
|
fflush(stdout);
|
|
|
|
}
|
|
|
|
- if (count % 1000 == 0) {
|
|
|
|
+ if (count % STAR_COUNT == 0) {
|
|
|
|
fprintf(stdout, "*");
|
|
|
|
fflush(stdout);
|
|
|
|
}
|
|
|
|
@@ -1017,7 +1019,7 @@
|
|
|
|
free(excludeArray[i].directory);
|
|
|
|
}
|
|
|
|
|
|
|
|
- if (progress)
|
|
|
|
+ if (progress && count >= STAR_COUNT)
|
|
|
|
printf("\n");
|
|
|
|
exit(errors);
|
|
|
|
}
|