policycoreutils/0001-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch

69 lines
2.7 KiB
Diff
Raw Normal View History

diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py
index f7f05cb..6b94239 100644
--- a/policycoreutils/sepolicy/sepolicy/__init__.py
+++ b/policycoreutils/sepolicy/sepolicy/__init__.py
@@ -98,6 +98,21 @@ def get_conditionals_format_text(cond):
def get_types_from_attribute(attribute):
return info(ATTRIBUTE,attribute)[0]["types"]
+def get_attributes_from_type(setype):
+ return info(TYPE,setype)[0]["attributes"]
+
+def file_type_is_executable(setype):
+ if "exec_type" in get_attributes_from_type(setype):
+ return True
+ else:
+ return False
+
+def file_type_is_entrypoint(setype):
+ if "entry_type" in get_attributes_from_type(setype):
+ return True
+ else:
+ return False
+
file_type_str = {}
file_type_str["a"] = _("all files")
file_type_str["f"] = _("regular file")
diff --git a/policycoreutils/sepolicy/sepolicy/manpage.py b/policycoreutils/sepolicy/sepolicy/manpage.py
index 9af0794..8daca56 100755
--- a/policycoreutils/sepolicy/sepolicy/manpage.py
+++ b/policycoreutils/sepolicy/sepolicy/manpage.py
@@ -679,10 +679,13 @@ Default Defined Ports:""")
def _file_context(self):
flist=[]
+ flist_non_exec=[]
mpaths=[]
for f in self.all_file_types:
if f.startswith(self.domainname):
flist.append(f)
+ if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
+ flist_non_exec.append(f)
if f in self.fcdict:
mpaths = mpaths + self.fcdict[f]["regex"]
if len(mpaths) == 0:
@@ -734,19 +737,20 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
.PP
""" % {'domainname':self.domainname, 'equiv': e, 'alt': e.split('/')[-1] })
- self.fd.write(r"""
+ if flist_non_exec:
+ self.fd.write(r"""
.PP
.B STANDARD FILE CONTEXT
SELinux defines the file context types for the %(domainname)s, if you wanted to
store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk.
-.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
.br
.B restorecon -R -v /srv/my%(domainname)s_content
Note: SELinux often uses regular expressions to specify labels that match multiple files.
-""" % {'domainname':self.domainname, "type":flist[0] })
+""" % {'domainname':self.domainname, "type":flist_non_exec[-1] })
self.fd.write(r"""
.I The following file types are defined for %(domainname)s: