diff --git a/policycoreutils-rhat.patch b/policycoreutils-rhat.patch index c0be572..a76bfeb 100644 --- a/policycoreutils-rhat.patch +++ b/policycoreutils-rhat.patch @@ -123,7 +123,7 @@ index 8e0c396..9f5185d 100644 if __name__ == "__main__": app = AuditToPolicy() diff --git a/policycoreutils/audit2allow/audit2allow.1 b/policycoreutils/audit2allow/audit2allow.1 -index a854a45..0155f98 100644 +index a854a45..2929b68 100644 --- a/policycoreutils/audit2allow/audit2allow.1 +++ b/policycoreutils/audit2allow/audit2allow.1 @@ -29,7 +29,7 @@ @@ -182,13 +182,27 @@ index a854a45..0155f98 100644 $ cat local.te policy_module(local, 1.0) -@@ -157,32 +157,32 @@ files_read_etc_files(myapp_t) +@@ -155,34 +155,49 @@ files_read_etc_files(myapp_t) - # SELinux provides a policy devel environment under /usr/share/selinux/devel + .B Building module policy using Makefile + +-# SELinux provides a policy devel environment under /usr/share/selinux/devel ++# SELinux provides a policy devel environment under ++# /usr/share/selinux/devel including all of the shipped ++# interface files. # You can create a te file and compile it by executing -$ make -f /usr/share/selinux/devel/Makefile -$ semodule -i local.pp ++ +$ make -f /usr/share/selinux/devel/Makefile local.pp ++ ++ ++# This make command will compile a local.te file in the current ++# directory. If you did not specify a "pp" file, the make file ++# will compile all "te" files in the current directory. After ++# you compile your te file into a "pp" file, you need to install ++# it using the semodule command. ++ +$ semodule \-i local.pp .B Building module policy manually @@ -196,9 +210,11 @@ index a854a45..0155f98 100644 # Compile the module -$ checkmodule -M -m -o local.mod local.te +$ checkmodule \-M \-m \-o local.mod local.te ++ # Create the package -$ semodule_package -o local.pp -m local.mod +$ semodule_package \-o local.pp \-m local.mod ++ # Load the module into the kernel -$ semodule -i local.pp +$ semodule \-i local.pp @@ -208,6 +224,7 @@ index a854a45..0155f98 100644 -Generating type enforcment file: local.te -Compiling policy: checkmodule -M -m -o local.mod local.te -Building package: semodule_package -o local.pp -m local.mod ++ +$ cat /var/log/audit/audit.log | audit2allow \-M local +Generating type enforcement file: local.te +Compiling policy: checkmodule \-M \-m \-o local.mod local.te @@ -220,9 +237,10 @@ index a854a45..0155f98 100644 -semodule -i local.pp +semodule \-i local.pp ++ ++.B Using audit2allow to generate monolithic (non\-module) policy -.B Using audit2allow to generate monolithic (non-module) policy -+.B Using audit2allow to generate monolithic (non\-module) policy $ cd /etc/selinux/$SELINUXTYPE/src/policy $ cat /var/log/audit/audit.log | audit2allow >> domains/misc/local.te $ cat domains/misc/local.te @@ -509367,7 +509385,7 @@ index 7c6d75a..d095a25 100644 .TP \fB\-d\fR diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 6901e4d..5acb111 100755 +index 6901e4d..9cfe355 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -3,7 +3,7 @@ @@ -509453,7 +509471,15 @@ index 6901e4d..5acb111 100755 done exclude="$exclude `exclude_dirs_from_relabelling`" echo "$exclude" -@@ -133,7 +133,7 @@ FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO" +@@ -115,7 +115,6 @@ exclude_dirs() { + # + fullFlag=0 + BOOTTIME="" +-FORCEFLAG="" + VERBOSE="-p" + FORCEFLAG="" + DIRS="" +@@ -133,7 +132,7 @@ FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO" SELINUXTYPE="targeted" if [ -e /etc/selinux/config ]; then . /etc/selinux/config @@ -509462,7 +509488,14 @@ index 6901e4d..5acb111 100755 else FC=/etc/security/selinux/file_contexts fi -@@ -158,7 +158,7 @@ newer() { +@@ -152,13 +151,13 @@ fi + newer() { + DATE=$1 + for m in `echo $FILESYSTEMSRW`; do +- find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${VERBOSE} -i -0 -f - ++ find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${FORCEFLAG} ${VERBOSE} -i -0 -f - + done; + } # @@ -509471,7 +509504,7 @@ index 6901e4d..5acb111 100755 # run restorecon on all files affected by the differences. # diff_filecontext() { -@@ -172,30 +172,31 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then +@@ -172,30 +171,31 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then grep '^[<>]'|cut -c3-| grep ^/ | \ egrep -v '(^/home|^/root|^/tmp|^/dev)' |\ sed -r -e 's,[[:blank:]].*,,g' \ @@ -509515,7 +509548,7 @@ index 6901e4d..5acb111 100755 # LogReadOnly() { if [ ! -z "$FILESYSTEMSRO" ]; then -@@ -209,7 +210,7 @@ rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' ' +@@ -209,7 +209,7 @@ rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' ' [ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr } @@ -509524,7 +509557,7 @@ index 6901e4d..5acb111 100755 # restore # if called with -n will only check file context # -@@ -241,8 +242,8 @@ then +@@ -241,8 +241,8 @@ then TEMPFCFILE=`mktemp ${FC}.XXXXXXXXXX` test -z "$TEMPFCFILE" && exit /bin/cp -p ${FC} ${TEMPFCFILE} &>/dev/null || exit @@ -509535,7 +509568,7 @@ index 6901e4d..5acb111 100755 do p="${p%/}" p1="${p}(/.*)? -- <>" -@@ -253,7 +254,7 @@ FC=$TEMPFCFILE +@@ -253,7 +253,7 @@ FC=$TEMPFCFILE fi if [ -n "${FILESYSTEMSRW}" ]; then echo "Relabeling `echo ${FILESYSTEMSRW}`" @@ -509544,7 +509577,16 @@ index 6901e4d..5acb111 100755 else echo >&2 "fixfiles: No suitable file systems found" fi -@@ -278,7 +279,7 @@ fullrelabel() { +@@ -265,7 +265,7 @@ find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -typ + find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /tmp {} \; + find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/tmp {} \; + find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/run {} \; +-[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /lib {} \; ++[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /lib {} \; + exit $? + } + +@@ -278,7 +278,7 @@ fullrelabel() { relabel() { if [ ! -z "$RPMFILES" ]; then @@ -509553,7 +509595,7 @@ index 6901e4d..5acb111 100755 fi if [ $fullFlag == 1 ]; then -@@ -286,13 +287,13 @@ relabel() { +@@ -286,13 +286,13 @@ relabel() { fi echo -n " @@ -509571,18 +509613,35 @@ index 6901e4d..5acb111 100755 fullrelabel else restore -@@ -322,8 +323,8 @@ case "$1" in +@@ -322,14 +322,14 @@ case "$1" in esac } usage() { - echo $""" -Usage: $0 [-F] [-l logfile ] { check | restore| [-f] relabel | verify } [[dir/file] ... ] + echo $""" -+Usage: $0 [-F] [-l logfile ] { check | restore| [-f] relabel | verify } [[dir/file] ... ] ++Usage: $0 [-v] [-F] [-N time ] [-l logfile ] { check | restore| [-f] relabel | verify } [[dir/file] ... ] or - Usage: $0 [-F] -R rpmpackage[,rpmpackage...] [-l logfile ] { check | restore | verify } +-Usage: $0 [-F] -R rpmpackage[,rpmpackage...] [-l logfile ] { check | restore | verify } ++Usage: $0 [-v] [-F] -R rpmpackage[,rpmpackage...] [-l logfile ] { check | restore | verify } or -@@ -351,13 +352,13 @@ while getopts "N:BC:FfR:l:v" i; do +-Usage: $0 [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify } ++Usage: $0 [-v] [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify } + or +-Usage: $0 onboot ++Usage: $0 [-F] [-B] onboot + """ + } + +@@ -343,7 +343,6 @@ while getopts "N:BC:FfR:l:v" i; do + case "$i" in + B) + BOOTTIME=`/bin/who -b | awk '{print $3}'` +- echo $BOOTTIME + ;; + f) + fullFlag=1 +@@ -351,13 +350,13 @@ while getopts "N:BC:FfR:l:v" i; do v) VERBOSE="-v" ;; @@ -509599,7 +509658,7 @@ index 6901e4d..5acb111 100755 PREFC=$OPTARG ;; F) -@@ -397,11 +398,11 @@ else +@@ -397,11 +396,11 @@ else if [ -z "$1" ]; then process $command else @@ -509615,15 +509674,15 @@ index 6901e4d..5acb111 100755 fi exit $? diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8 -index 9ab7334..0086417 100644 +index 9ab7334..b622c51 100644 --- a/policycoreutils/scripts/fixfiles.8 +++ b/policycoreutils/scripts/fixfiles.8 -@@ -5,13 +5,13 @@ fixfiles \- fix file SELinux security contexts. +@@ -5,15 +5,15 @@ fixfiles \- fix file SELinux security contexts. .SH "SYNOPSIS" .B fixfiles -.I [-v] [-F] [-l logfile ] { check | restore|[-f] relabel | verify } [[dir/file] ... ] -+.I [\-v] [\-F] [\-l logfile ] { check | restore|[\-f] relabel | verify } [[dir/file] ... ] ++.I [\-v] [\-F] [-B] [ -N time ] [\-l logfile ] { check | restore|[\-f] relabel | verify } [[dir/file] ... ] .B fixfiles -.I [-v] [-F] [ -R rpmpackagename[,rpmpackagename...] ] [-l logfile ] { check | restore | verify } @@ -509631,11 +509690,14 @@ index 9ab7334..0086417 100644 .B fixfiles -.I [-v] [ -C PREVIOUS_FILECONTEXT ] [-l logfile ] { check | restore | verify } -+.I [\-v] [ \-C PREVIOUS_FILECONTEXT ] [\-l logfile ] { check | restore | verify } ++.I [\-v] [\-F] \-C PREVIOUS_FILECONTEXT [\-l logfile ] { check | restore | verify } - .B fixfiles +-.B fixfiles ++.B fixfiles [-F] [-B] .I onboot -@@ -28,35 +28,35 @@ It can also be run at any time to relabel when adding support for + + .SH "DESCRIPTION" +@@ -28,35 +28,43 @@ It can also be run at any time to relabel when adding support for new policy, or just check whether the file contexts are all as you expect. By default it will relabel all mounted ext2, ext3, xfs and jfs file systems as long as they do not have a security context mount @@ -509651,6 +509713,9 @@ index 9ab7334..0086417 100644 .SH "OPTIONS" .TP -.B -l logfile ++.B \-B ++If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today. ++.TP +.B \-l logfile Save the output to the specified logfile .TP @@ -509675,6 +509740,11 @@ index 9ab7334..0086417 100644 Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files. .TP ++.B \-N time ++Only act on files created after the specified date. Date must be specified in ++"YYYY-MM-DD HH:MM" format. Date field will be passed to find --newermt command. ++ ++.TP .B -v -Modify verbosity from progess to verbose. (Run restorecon with -v instead of -p) +Modify verbosity from progress to verbose. (Run restorecon with -v instead of -p) @@ -509902,7 +509972,7 @@ index 0000000..e2befdb + packages=["policycoreutils"], +) diff --git a/policycoreutils/semanage/semanage b/policycoreutils/semanage/semanage -index 6e33c85..faaed5b 100644 +index 6e33c85..2c1c855 100644 --- a/policycoreutils/semanage/semanage +++ b/policycoreutils/semanage/semanage @@ -1,5 +1,7 @@ @@ -510258,7 +510328,7 @@ index 6e33c85..faaed5b 100644 + label. This is used with fcontext. Requires source and target + path arguments. The context labeling for the target subtree is + made equivalent to that defined for the source.''')) -+ fcontextParser.add_argument('-f', '--ftype', default="", choices=["all files","--","-d","-c","-b","-s","-l","-p"], help=_(ftype_help)) ++ fcontextParser.add_argument('-f', '--ftype', default="", choices=["a","f","d","c","b","s","l","p"], help=_(ftype_help)) + parser_add_seuser(fcontextParser, "fcontext") + parser_add_type(fcontextParser, "fcontext") + parser_add_range(fcontextParser, "fcontext") @@ -511508,7 +511578,7 @@ index 0000000..1b20c82 +This man page was written by Daniel Walsh diff --git a/policycoreutils/semanage/semanage-fcontext.8 b/policycoreutils/semanage/semanage-fcontext.8 new file mode 100644 -index 0000000..5e40f44 +index 0000000..ba2355a --- /dev/null +++ b/policycoreutils/semanage/semanage-fcontext.8 @@ -0,0 +1,87 @@ @@ -511563,8 +511633,8 @@ index 0000000..5e40f44 +.I \-e EQUAL, \-\-equal EQUAL +Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target path arguments. The context labeling for the target subtree is made equivalent to that defined for the source. +.TP -+.I \-f [{\-\-,\-d,\-c,\-b,\-s,\-l,\-p}], \-\-ftype [{\-\-,\-d,\-c,\-b,\-s,\-l,\-p}] -+File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use \-d to match only directories or \-\- to match only regular files. The following file type options can be passed: \-\- (regular file),\-d (directory),\-c (character device), \-b (block device),\-s (socket),\-l (symbolic link),\-p (named pipe). If you do not specify a file type, the file type will default to "all files". ++.I \-f [{a,f,d,c,b,s,l,p}], \-\-ftype [{a,f,d,c,b,s,l,p}] ++File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use 'd' to match only directories or 'f' to match only regular files. The following file type options can be passed: f (regular file),d (directory),c (character device), b (block device),s (socket),l (symbolic link),p (named pipe). If you do not specify a file type, the file type will default to "all files". + +.TP +.I \-s SEUSER, \-\-seuser SEUSER @@ -512379,10 +512449,10 @@ index 28a9022..90b142e 100644 +usage: semanage [-h] + diff --git a/policycoreutils/semanage/seobject.py b/policycoreutils/semanage/seobject.py -index 85bc37f..e67602a 100644 +index 85bc37f..5c9e83b 100644 --- a/policycoreutils/semanage/seobject.py +++ b/policycoreutils/semanage/seobject.py -@@ -32,11 +32,10 @@ from IPy import IP +@@ -32,30 +32,29 @@ from IPy import IP import gettext gettext.bindtextdomain(PROGNAME, "/usr/share/locale") gettext.textdomain(PROGNAME) @@ -512398,6 +512468,33 @@ index 85bc37f..e67602a 100644 import syslog + file_types = {} +-file_types[""] = SEMANAGE_FCONTEXT_ALL; ++file_types["a"] = SEMANAGE_FCONTEXT_ALL; + file_types["all files"] = SEMANAGE_FCONTEXT_ALL; +-file_types["--"] = SEMANAGE_FCONTEXT_REG; ++file_types["f"] = SEMANAGE_FCONTEXT_REG; + file_types["regular file"] = SEMANAGE_FCONTEXT_REG; +-file_types["-d"] = SEMANAGE_FCONTEXT_DIR; ++file_types["d"] = SEMANAGE_FCONTEXT_DIR; + file_types["directory"] = SEMANAGE_FCONTEXT_DIR; +-file_types["-c"] = SEMANAGE_FCONTEXT_CHAR; ++file_types["c"] = SEMANAGE_FCONTEXT_CHAR; + file_types["character device"] = SEMANAGE_FCONTEXT_CHAR; +-file_types["-b"] = SEMANAGE_FCONTEXT_BLOCK; ++file_types["b"] = SEMANAGE_FCONTEXT_BLOCK; + file_types["block device"] = SEMANAGE_FCONTEXT_BLOCK; +-file_types["-s"] = SEMANAGE_FCONTEXT_SOCK; ++file_types["s"] = SEMANAGE_FCONTEXT_SOCK; + file_types["socket"] = SEMANAGE_FCONTEXT_SOCK; +-file_types["-l"] = SEMANAGE_FCONTEXT_LINK; ++file_types["l"] = SEMANAGE_FCONTEXT_LINK; + file_types["symbolic link"] = SEMANAGE_FCONTEXT_LINK; +-file_types["-p"] = SEMANAGE_FCONTEXT_PIPE; ++file_types["p"] = SEMANAGE_FCONTEXT_PIPE; + file_types["named pipe"] = SEMANAGE_FCONTEXT_PIPE; + + try: @@ -89,7 +88,7 @@ except: self.log_list=[] @@ -512921,7 +513018,7 @@ index 378eac2..3186c86 100644 +tmp +*.bak diff --git a/policycoreutils/sepolicy/Makefile b/policycoreutils/sepolicy/Makefile -index 11b534f..028bcf8 100644 +index 11b534f..a17eb72 100644 --- a/policycoreutils/sepolicy/Makefile +++ b/policycoreutils/sepolicy/Makefile @@ -7,11 +7,11 @@ SBINDIR ?= $(PREFIX)/sbin @@ -512960,11 +513057,11 @@ index 11b534f..028bcf8 100644 - install -m 644 $(BASHCOMPLETIONS) $(BASHCOMPLETIONDIR) + install -m 644 $(BASHCOMPLETIONS) $(BASHCOMPLETIONDIR)/sepolicy + -mkdir -p $(DESTDIR)/etc/dbus-1/system.d/ -+ install -m 644 org.fedoraproject.selinux.conf $(DESTDIR)/etc/dbus-1/system.d/ -+ -mkdir -p $(DESTDIR)/usr/share/dbus-1/system -+ install -m 644 org.fedoraproject.selinux.service $(DESTDIR)/usr/share/dbus-1/system ++ install -m 644 org.selinux.conf $(DESTDIR)/etc/dbus-1/system.d/ ++ -mkdir -p $(DESTDIR)/usr/share/dbus-1/system-services ++ install -m 644 org.selinux.service $(DESTDIR)/usr/share/dbus-1/system-services + -mkdir -p $(DESTDIR)/usr/share/polkit-1/actions/ -+ install -m 644 org.fedoraproject.selinux.policy $(DESTDIR)/usr/share/polkit-1/actions/ ++ install -m 644 org.selinux.policy $(DESTDIR)/usr/share/polkit-1/actions/ + -mkdir -p $(DESTDIR)/usr/share/system-config-selinux + install -m 755 selinux_server.py $(DESTDIR)/usr/share/system-config-selinux diff --git a/policycoreutils/sepolicy/info.c b/policycoreutils/sepolicy/info.c @@ -513066,11 +513163,11 @@ index 65458e6..cd1026a 100644 if (py_insert_string(dict, "protocol", proto_str)) goto err; -diff --git a/policycoreutils/sepolicy/org.fedoraproject.selinux.conf b/policycoreutils/sepolicy/org.fedoraproject.selinux.conf +diff --git a/policycoreutils/sepolicy/org.selinux.conf b/policycoreutils/sepolicy/org.selinux.conf new file mode 100644 -index 0000000..58eec32 +index 0000000..a350978 --- /dev/null -+++ b/policycoreutils/sepolicy/org.fedoraproject.selinux.conf ++++ b/policycoreutils/sepolicy/org.selinux.conf @@ -0,0 +1,23 @@ + + @@ -513081,26 +513178,26 @@ index 0000000..58eec32 + + + -+ ++ + + + + -+ ++ + + -+ + + + -diff --git a/policycoreutils/sepolicy/org.fedoraproject.selinux.policy b/policycoreutils/sepolicy/org.fedoraproject.selinux.policy +diff --git a/policycoreutils/sepolicy/org.selinux.policy b/policycoreutils/sepolicy/org.selinux.policy new file mode 100644 -index 0000000..e4046a0 +index 0000000..0a6500f --- /dev/null -+++ b/policycoreutils/sepolicy/org.fedoraproject.selinux.policy -@@ -0,0 +1,37 @@ ++++ b/policycoreutils/sepolicy/org.selinux.policy +@@ -0,0 +1,71 @@ + +Red Hat Inc. + http://www.redhat.com + -+ ++ + SELinux write access + System policy prevents restorecon access to SELinux + @@ -513119,7 +513216,7 @@ index 0000000..e4046a0 + auth_admin_keep + + -+ ++ + SELinux write access + System policy prevents setenforce access to SELinux + @@ -513128,7 +513225,7 @@ index 0000000..e4046a0 + auth_admin_keep + + -+ ++ + SELinux write access + System policy prevents semanage access to SELinux + @@ -513137,15 +513234,49 @@ index 0000000..e4046a0 + auth_admin_keep + + ++ ++ SELinux write access ++ System policy prevents customized access to SELinux ++ ++ auth_admin_keep ++ auth_admin_keep ++ auth_admin_keep ++ ++ ++ ++ SELinux write access ++ System policy prevents relabel_on_boot access to SELinux ++ ++ yes ++ ++ ++ ++ SELinux write access ++ System policy prevents change_default_policy access to SELinux ++ ++ auth_admin_keep ++ auth_admin_keep ++ auth_admin_keep ++ ++ ++ ++ SELinux write access ++ System policy prevents change_policy_type access to SELinux ++ ++ auth_admin_keep ++ auth_admin_keep ++ auth_admin_keep ++ ++ + -diff --git a/policycoreutils/sepolicy/org.fedoraproject.selinux.service b/policycoreutils/sepolicy/org.fedoraproject.selinux.service +diff --git a/policycoreutils/sepolicy/org.selinux.service b/policycoreutils/sepolicy/org.selinux.service new file mode 100644 -index 0000000..e69d673 +index 0000000..3dd9545 --- /dev/null -+++ b/policycoreutils/sepolicy/org.fedoraproject.selinux.service ++++ b/policycoreutils/sepolicy/org.selinux.service @@ -0,0 +1,4 @@ +[D-BUS Service] -+Name=org.fedoraproject.selinux ++Name=org.selinux +Exec=/usr/share/system-config-selinux/selinux_server.py +User=root diff --git a/policycoreutils/sepolicy/policy.c b/policycoreutils/sepolicy/policy.c @@ -513171,10 +513302,10 @@ index 4eca22d..2a9e1c7 100644 init_info(m); diff --git a/policycoreutils/sepolicy/selinux_server.py b/policycoreutils/sepolicy/selinux_server.py new file mode 100644 -index 0000000..1206664 +index 0000000..2870634 --- /dev/null +++ b/policycoreutils/sepolicy/selinux_server.py -@@ -0,0 +1,69 @@ +@@ -0,0 +1,65 @@ +#!/usr/bin/python + +import dbus @@ -513188,7 +513319,7 @@ index 0000000..1206664 +from subprocess import Popen, PIPE, STDOUT + +class selinux_server(slip.dbus.service.Object): -+ default_polkit_auth_required = "org.fedoraproject.selinux.semanage" ++ default_polkit_auth_required = "org.selinux.semanage" + def __init__ (self, *p, **k): + super(selinux_server, self).__init__(*p, **k) + @@ -513196,12 +513327,10 @@ index 0000000..1206664 + # The semanage method runs a transaction on a series of semanage commands, + # these commnds can take the output of customized + # -+ @dbus.service.method("org.fedoraproject.selinux", in_signature='s') ++ @dbus.service.method("org.selinux", in_signature='s') + def semanage(self, buf): -+ fd = open("/run/selinux.input", "w") -+ fd.write(buf) -+ fd.close() -+ p = Popen(["/usr/sbin/semanage", "-i", "/run/selinux.input"],stdout=PIPE, stderr=PIPE) ++ p = Popen(["/usr/sbin/semanage", "import"],stdout=PIPE, stderr=PIPE, stdin=PIPE) ++ p.stdin.write(buf) + output = p.communicate() + if p.returncode and p.returncode != 0: + raise OSError("Failed update SELinux configuration: %s", output) @@ -513211,28 +513340,26 @@ index 0000000..1206664 + # on the server. This output can be used with the semanage method on + # another server to make the two systems have duplicate policy. + # -+ @dbus.service.method("org.fedoraproject.selinux", in_signature='', out_signature='s') ++ @dbus.service.method("org.selinux", in_signature='', out_signature='s') + def customized(self): -+ p = Popen(["/usr/sbin/semanage", "-o", "/run/selinux.output"],stdout=PIPE, stderr=PIPE) ++ p = Popen(["/usr/sbin/semanage", "export"],stdout=PIPE, stderr=PIPE) ++ buf = p.stdout.read() + output = p.communicate() + if p.returncode and p.returncode != 0: + raise OSError("Failed update SELinux configuration: %s", output) -+ fd = open("/run/selinux.output", "r") -+ buf = fd.read() -+ fd.close() + return buf + + # + # The restorecon method modifies any file path to the default system label + # -+ @dbus.service.method("org.fedoraproject.selinux", in_signature='s') ++ @dbus.service.method("org.selinux", in_signature='s') + def restorecon(self, path): -+ selinux.restorecon(str(path)) ++ selinux.restorecon(str(path), recursive=1) + + # + # The setenforce method turns off the current enforcement of SELinux + # -+ @dbus.service.method("org.fedoraproject.selinux", in_signature='i') ++ @dbus.service.method("org.selinux", in_signature='i') + def setenforce(self, value): + selinux.security_setenforce(value) + @@ -513240,8 +513367,8 @@ index 0000000..1206664 + mainloop = gobject.MainLoop() + dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) + system_bus = dbus.SystemBus() -+ name = dbus.service.BusName("org.fedoraproject.selinux", system_bus) -+ object = selinux_server(system_bus, "/org/fedoraproject/selinux/object") ++ name = dbus.service.BusName("org.selinux", system_bus) ++ object = selinux_server(system_bus, "/org/selinux/object") + slip.dbus.service.set_mainloop(mainloop) + mainloop.run() diff --git a/policycoreutils/sepolicy/sepolgen.8 b/policycoreutils/sepolicy/sepolgen.8 @@ -513546,6 +513673,88 @@ index b6abdf5..c05c943 100644 .I \-w, \-\-web Generate an additional HTML man pages for the specified domain(s). +diff --git a/policycoreutils/sepolicy/sepolicy-network.8 b/policycoreutils/sepolicy/sepolicy-network.8 +index 4ba92cc..dcddec7 100644 +--- a/policycoreutils/sepolicy/sepolicy-network.8 ++++ b/policycoreutils/sepolicy/sepolicy-network.8 +@@ -5,13 +5,16 @@ sepolicy-network \- Examine the SELinux Policy and generate a network report + .SH "SYNOPSIS" + + .br +-.B sepolicy network [\-h] (\-l | \-p PORT [PORT ...] | \-t TYPE [TYPE ...] | \-d DOMAIN [DOMAIN ...]) ++.B sepolicy network [\-h] (\-l | \-a application [application ...] | \-p PORT [PORT ...] | \-t TYPE [TYPE ...] | \-d DOMAIN [DOMAIN ...]) + + .SH "DESCRIPTION" + Use sepolicy network to examine SELinux Policy and generate network reports. + + .SH "OPTIONS" + .TP ++.I \-a, \-\-application ++Generate a report listing the ports to which the specified init application is allowed to connect and or bind. ++.TP + .I \-d, \-\-domain + Generate a report listing the ports to which the specified domain is allowed to connect and or bind. + .TP +@@ -27,6 +30,59 @@ Generate a report listing the port numbers associate with the specified SELinux + .I \-p, \-\-port + Generate a report listing the SELinux port types associate with the specified port number. + ++.SH "EXAMPLES" ++ ++.B sepolicy network -p 22 ++.br ++22: tcp ssh_port_t 22 ++.br ++22: udp reserved_port_t 1-511 ++.br ++22: tcp reserved_port_t 1-511 ++ ++.B sepolicy network -a /usr/sbin/sshd ++.br ++sshd_t: tcp name_connect ++.br ++ 111 (portmap_port_t) ++.br ++ 53 (dns_port_t) ++.br ++ 88, 750, 4444 (kerberos_port_t) ++.br ++ 9080 (ocsp_port_t) ++.br ++ 9180, 9701, 9443-9447 (pki_ca_port_t) ++.br ++ 32768-61000 (ephemeral_port_t) ++.br ++ all ports < 1024 (reserved_port_type) ++.br ++ all ports with out defined types (port_t) ++.br ++sshd_t: tcp name_bind ++.br ++ 22 (ssh_port_t) ++.br ++ 5900-5983, 5985-5999 (vnc_port_t) ++.br ++ 6000-6020 (xserver_port_t) ++.br ++ 32768-61000 (ephemeral_port_t) ++.br ++ all ports > 500 and < 1024 (rpc_port_type) ++.br ++ all ports with out defined types (port_t) ++.br ++sshd_t: udp name_bind ++.br ++ 32768-61000 (ephemeral_port_t) ++.br ++ all ports > 500 and < 1024 (rpc_port_type) ++.br ++ all ports with out defined types (port_t) ++ ++ + .SH "AUTHOR" + This man page was written by Daniel Walsh + diff --git a/policycoreutils/sepolicy/sepolicy.8 b/policycoreutils/sepolicy/sepolicy.8 index 0748ca9..6348287 100644 --- a/policycoreutils/sepolicy/sepolicy.8 @@ -513568,7 +513777,7 @@ index 0748ca9..6348287 100644 -selinux(8), sepolicy-booleans(8), sepolicy-communicate(8), sepolicy-generate(8), sepolicy-interface(8), sepolicy-network(8), sepolicy-manpage(8), sepolicy-transition(8) +selinux(8), sepolicy-booleans(8), sepolicy-communicate(8), sepolicy-generate(8),sepolicy-gui(8), sepolicy-interface(8), sepolicy-network(8), sepolicy-manpage(8), sepolicy-transition(8) diff --git a/policycoreutils/sepolicy/sepolicy.py b/policycoreutils/sepolicy/sepolicy.py -index b25d3b2..0dc3b9b 100755 +index b25d3b2..9afb149 100755 --- a/policycoreutils/sepolicy/sepolicy.py +++ b/policycoreutils/sepolicy/sepolicy.py @@ -22,6 +22,8 @@ @@ -513648,7 +513857,7 @@ index b25d3b2..0dc3b9b 100755 newval = getattr(namespace, self.dest) if not newval: newval = [] -@@ -140,27 +165,76 @@ class CheckPolicyType(argparse.Action): +@@ -140,102 +165,168 @@ class CheckPolicyType(argparse.Action): class CheckUser(argparse.Action): def __call__(self, parser, namespace, value, option_string=None): @@ -513729,13 +513938,73 @@ index b25d3b2..0dc3b9b 100755 def network(args): - from sepolicy.network import portrecsbynum, portrecs, get_network_connect + portrecs, portrecsbynum = sepolicy.gen_port_dict() ++ all_ports = [] if args.list_ports: - all_ports = [] +- all_ports = [] for i in portrecs: -@@ -197,45 +271,58 @@ def network(args): - for net in ("tcp", "udp"): - _print_net(d, net, "name_bind") + if i[0] not in all_ports: + all_ports.append(i[0]) + all_ports.sort() + print "\n".join(all_ports) +- if args.port: +- for port in args.port: +- found = False +- for i in portrecsbynum: +- if i[0] <= port and port <= i[1]: +- if i[0] == i[1]: +- range = i[0] +- else: +- range = "%s-%s" % (i[0], i[1]) +- found = True +- print "%d: %s %s %s" % (port, i[2], portrecsbynum[i][0], range) +- if not found: +- if port < 500: +- print "Undefined reserved port type" ++ for port in args.port: ++ found = False ++ for i in portrecsbynum: ++ if i[0] <= port and port <= i[1]: ++ if i[0] == i[1]: ++ range = i[0] + else: +- print "Undefined port type" +- if args.type: +- for t in args.type: +- if (t,'tcp') in portrecs.keys(): +- print "%s: tcp: %s" % (t, ",".join(portrecs[t,'tcp'])) +- if (t,'udp') in portrecs.keys(): +- print "%s: udp: %s" % (t, ",".join(portrecs[t,'udp'])) +- if args.domain: +- for d in args.domain: +- _print_net(d, "tcp", "name_connect") +- for net in ("tcp", "udp"): +- _print_net(d, net, "name_bind") ++ range = "%s-%s" % (i[0], i[1]) ++ found = True ++ print "%d: %s %s %s" % (port, i[2], portrecsbynum[i][0], range) ++ if not found: ++ if port < 500: ++ print "Undefined reserved port type" ++ else: ++ print "Undefined port type" ++ ++ for t in args.type: ++ if (t,'tcp') in portrecs.keys(): ++ print "%s: tcp: %s" % (t, ",".join(portrecs[t,'tcp'])) ++ if (t,'udp') in portrecs.keys(): ++ print "%s: udp: %s" % (t, ",".join(portrecs[t,'udp'])) ++ ++ for a in args.applications: ++ d = sepolicy.get_init_transtype(a) ++ if d: ++ args.domain.append(d) ++ ++ for d in args.domain: ++ _print_net(d, "tcp", "name_connect") ++ for net in ("tcp", "udp"): ++ _print_net(d, net, "name_bind") ++ +def gui_run(args): + try: + import sepolicy.gui @@ -513748,7 +514017,7 @@ index b25d3b2..0dc3b9b 100755 + gui = parser.add_parser("gui", + help=_('Graphical User Interface for SELinux Policy')) + gui.set_defaults(func=gui_run) -+ + def manpage(args): from sepolicy.manpage import ManPage, HTMLManPages, manpage_domains, manpage_roles, gen_domains @@ -513814,7 +514083,29 @@ index b25d3b2..0dc3b9b 100755 def gen_network_args(parser): net = parser.add_parser("network", -@@ -283,7 +370,6 @@ def gen_communicate_args(parser): +@@ -245,15 +336,18 @@ def gen_network_args(parser): + group.add_argument("-l", "--list", dest="list_ports", + action="store_true", + help=_("list all SELinux port types")) +- group.add_argument("-p", "--port", dest="port", default=None, ++ group.add_argument("-p", "--port", dest="port", default=[], + action=CheckPort, nargs="+", type=int, + help=_("show SELinux type related to the port")) +- group.add_argument("-t", "--type", dest="type", default=None, ++ group.add_argument("-t", "--type", dest="type", default=[], + action=CheckPortType,nargs="+", + help=_("Show ports defined for this SELinux type")) +- group.add_argument("-d", "--domain", dest="domain", default=None, ++ group.add_argument("-d", "--domain", dest="domain", default=[], + action=CheckDomain, nargs="+", + help=_("show ports to which this domain can bind and/or connect")) ++ group.add_argument("-a", "--application", dest="applications", default=[], ++ nargs="+", ++ help=_("show ports to which this application can bind and/or connect")) + net.set_defaults(func=network) + + def communicate(args): +@@ -283,7 +377,6 @@ def gen_communicate_args(parser): comm.set_defaults(func=communicate) def booleans(args): @@ -513822,7 +514113,7 @@ index b25d3b2..0dc3b9b 100755 from sepolicy import boolean_desc if args.all: rc, args.booleans = selinux.security_get_boolean_names() -@@ -300,6 +386,7 @@ def gen_booleans_args(parser): +@@ -300,6 +393,7 @@ def gen_booleans_args(parser): action="store_true", help=_("get all booleans descriptions")) group.add_argument("-b", "--boolean", dest="booleans", nargs="+", @@ -513830,7 +514121,7 @@ index b25d3b2..0dc3b9b 100755 help=_("boolean to get description")) bools.set_defaults(func=booleans) -@@ -319,22 +406,49 @@ def gen_transition_args(parser): +@@ -319,22 +413,49 @@ def gen_transition_args(parser): help=_("target process domain")) trans.set_defaults(func=transition) @@ -513889,7 +514180,7 @@ index b25d3b2..0dc3b9b 100755 if not args.command: raise ValueError(_("Command required for this type of policy")) cmd = os.path.realpath(args.command) -@@ -346,8 +460,22 @@ def generate(args): +@@ -346,8 +467,22 @@ def generate(args): mypolicy.set_program(cmd) if args.types: @@ -513912,7 +514203,7 @@ index b25d3b2..0dc3b9b 100755 for p in args.writepaths: if os.path.isdir(p): mypolicy.add_dir(p) -@@ -355,6 +483,7 @@ def generate(args): +@@ -355,6 +490,7 @@ def generate(args): mypolicy.add_file(p) mypolicy.set_transition_users(args.user) @@ -513920,7 +514211,7 @@ index b25d3b2..0dc3b9b 100755 mypolicy.set_admin_domains(args.admin_domain) mypolicy.set_existing_domains(args.domain) -@@ -366,20 +495,34 @@ def generate(args): +@@ -366,20 +502,34 @@ def generate(args): def gen_interface_args(parser): itf = parser.add_parser("interface", help=_('List SELinux Policy interfaces')) @@ -513958,7 +514249,7 @@ index b25d3b2..0dc3b9b 100755 help=_('Generate SELinux Policy module template')) pol.add_argument("-d", "--domain", dest="domain", default=[], action=CheckDomain, nargs="*", -@@ -387,9 +530,12 @@ def gen_generate_args(parser): +@@ -387,9 +537,12 @@ def gen_generate_args(parser): pol.add_argument("-u", "--user", dest="user", default=[], action=CheckUser, help=_("Enter SELinux user(s) which will transition to this domain")) @@ -513972,7 +514263,7 @@ index b25d3b2..0dc3b9b 100755 pol.add_argument("-n", "--name", dest="name", default=None, help=_("name of policy to generate")) -@@ -397,53 +543,57 @@ def gen_generate_args(parser): +@@ -397,53 +550,57 @@ def gen_generate_args(parser): help=argparse.SUPPRESS) pol.add_argument("-t", "--type", dest="types", default=[], nargs="*", action=CheckType, @@ -514056,7 +514347,7 @@ index b25d3b2..0dc3b9b 100755 pol.set_defaults(func=generate) if __name__ == '__main__': -@@ -455,17 +605,25 @@ if __name__ == '__main__': +@@ -455,17 +612,25 @@ if __name__ == '__main__': gen_booleans_args(subparsers) gen_communicate_args(subparsers) gen_generate_args(subparsers) @@ -514084,7 +514375,7 @@ index b25d3b2..0dc3b9b 100755 sys.exit(0) + diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py -index 5e7415c..7734ba0 100644 +index 5e7415c..74d2220 100644 --- a/policycoreutils/sepolicy/sepolicy/__init__.py +++ b/policycoreutils/sepolicy/sepolicy/__init__.py @@ -1,12 +1,15 @@ @@ -514104,7 +514395,7 @@ index 5e7415c..7734ba0 100644 gettext.bindtextdomain(PROGNAME, "/usr/share/locale") gettext.textdomain(PROGNAME) try: -@@ -37,16 +40,295 @@ CLASS = 'class' +@@ -37,16 +40,308 @@ CLASS = 'class' TRANSITION = 'transition' ROLE_ALLOW = 'role_allow' @@ -514133,6 +514424,26 @@ index 5e7415c..7734ba0 100644 +def get_types_from_attribute(attribute): + return info(ATTRIBUTE,attribute)[0]["types"] + ++file_type_str = {} ++file_type_str["a"] = _("all files") ++file_type_str["f"] = _("regular file") ++file_type_str["d"] = _("directory") ++file_type_str["c"] = _("character device") ++file_type_str["b"] = _("block device") ++file_type_str["s"] = _("socket file") ++file_type_str["l"] = _("symbolic link") ++file_type_str["p"] = _("named pipe") ++ ++trans_file_type_str = {} ++trans_file_type_str[""] = "a" ++trans_file_type_str["--"] = "f" ++trans_file_type_str["-d"] = "d" ++trans_file_type_str["-c"] = "c" ++trans_file_type_str["-b"] = "b" ++trans_file_type_str["-s"] = "s" ++trans_file_type_str["-l"] = "l" ++trans_file_type_str["-p"] = "p" ++ +def get_file_types(setype): + flist=[] + mpaths={} @@ -514162,9 +514473,9 @@ index 5e7415c..7734ba0 100644 + for i in permlist: + if i['target'] in attributes: + continue -+ if i['target'] not in file_types: -+ continue + if i['target'].endswith("_t"): ++ if i['target'] not in file_types: ++ continue + if i['target'] not in all_writes: + if i['target'] != setype: + all_writes.append(i['target']) @@ -514231,16 +514542,6 @@ index 5e7415c..7734ba0 100644 + pass + return None + -+file_type_str = {} -+file_type_str[""] = _("all files") -+file_type_str["--"] = _("regular file") -+file_type_str["-d"] = _("directory") -+file_type_str["-c"] = _("character device") -+file_type_str["-b"] = _("block device") -+file_type_str["-s"] = _("socket file") -+file_type_str["-l"] = _("symbolic link") -+file_type_str["-p"] = _("named pipe") -+ +fcdict=None +def get_fcdict(fc_path = selinux.selinux_file_context_path()): + global fcdict @@ -514252,14 +514553,17 @@ index 5e7415c..7734ba0 100644 + fd = open(fc_path+".homedirs", "r") + fc += fd.readlines() + fd.close() ++ fd = open(fc_path+".local", "r") ++ fc += fd.readlines() ++ fd.close() + fcdict = {} + for i in fc: + rec = i.split() + try: + if len(rec) > 2: -+ ftype = rec[1] ++ ftype = trans_file_type_str[rec[1]] + else: -+ ftype = "" ++ ftype = "a" + + t = rec[-1].split(":")[2] + if t in fcdict: @@ -514403,7 +514707,7 @@ index 5e7415c..7734ba0 100644 all_types = None def get_all_types(): global all_types -@@ -54,23 +336,31 @@ def get_all_types(): +@@ -54,23 +349,31 @@ def get_all_types(): all_types = map(lambda x: x['name'], info(TYPE)) return all_types @@ -514448,7 +514752,7 @@ index 5e7415c..7734ba0 100644 all_domains = [] types=get_all_types() types.sort() -@@ -81,18 +371,61 @@ def get_all_entrypoint_domains(): +@@ -81,18 +384,61 @@ def get_all_entrypoint_domains(): all_domains.append(m[0]) return all_domains @@ -514517,7 +514821,7 @@ index 5e7415c..7734ba0 100644 roles = map(lambda x: x['name'], info(ROLE)) roles.remove("object_r") roles.sort() -@@ -104,115 +437,259 @@ def get_all_users(): +@@ -104,115 +450,259 @@ def get_all_users(): if users: return users users = map(lambda x: x['name'], info(USER)) @@ -514849,7 +515153,7 @@ index 5e7415c..7734ba0 100644 def boolean_category(boolean): booleans_dict = gen_bool_dict() -@@ -233,18 +710,18 @@ def get_os_version(): +@@ -233,18 +723,54 @@ def get_os_version(): os_version = "" pkg_name = "selinux-policy" try: @@ -514876,6 +515180,42 @@ index 5e7415c..7734ba0 100644 + os_version = "" return os_version ++ ++def reinit(): ++ global all_attributes ++ global all_domains ++ global all_types ++ global booleans ++ global booleans_dict ++ global bools ++ global fcdict ++ global file_types ++ global methods ++ global methods ++ global portrecs ++ global portrecsbynum ++ global port_types ++ global role_allows ++ global roles ++ global users ++ global user_types ++ all_attributes = None ++ all_domains = None ++ all_types = None ++ booleans = None ++ booleans_dict = None ++ bools = None ++ fcdict = None ++ file_types = None ++ methods = None ++ methods = None ++ portrecs = None ++ portrecsbynum = None ++ port_types = None ++ role_allows = None ++ roles = None ++ users = None ++ user_types = None diff --git a/policycoreutils/sepolicy/sepolicy/communicate.py b/policycoreutils/sepolicy/sepolicy/communicate.py index a179d95..9b9a09a 100755 --- a/policycoreutils/sepolicy/sepolicy/communicate.py @@ -515168,10 +515508,10 @@ index 26f8390..ba959ae 100644 return out diff --git a/policycoreutils/sepolicy/sepolicy/gui.py b/policycoreutils/sepolicy/sepolicy/gui.py new file mode 100644 -index 0000000..112596d +index 0000000..cbdf9aa --- /dev/null +++ b/policycoreutils/sepolicy/sepolicy/gui.py -@@ -0,0 +1,2351 @@ +@@ -0,0 +1,2526 @@ +#!/usr/bin/python -Es +# +# Copyright (C) 2013 Red Hat @@ -515198,17 +515538,19 @@ index 0000000..112596d +# +# + -+import os, sys ++from sepolicy.sedbus import SELinuxDBus ++import sys +import gobject +import sepolicy +import selinux +import pygtk +import sepolicy.network +import sepolicy.manpage -+from sepolicy.sedbus import SELinuxDBus +import dbus +import time ++import os +import gettext ++import unicodedata + +PROGNAME="policycoreutils" +gettext.bindtextdomain(PROGNAME, "/usr/share/locale") @@ -515222,6 +515564,10 @@ index 0000000..112596d + import __builtin__ + __builtin__.__dict__['_'] = unicode + ++reverse_file_type_str = {} ++for f in sepolicy.file_type_str: ++ reverse_file_type_str[sepolicy.file_type_str[f]] = f ++ +enabled=[_("No"), _("Yes")] +action=[_("Disable"), _("Enable")] +def compare(a, b): @@ -515247,12 +515593,13 @@ index 0000000..112596d + OUTBOUND = 0 + INBOUND = 1 + -+ def __init__( self ): ++ def __init__( self, applicaton=None): + + self.dbus = SELinuxDBus() ++ self.customized = self.dbus.customized() + self.filter_txt = "" + self.builder = gtk.Builder() # BUILDER OBJ -+ #glade_file = "/home/rhallisey/Desktop/sepolicy.glade" # The gui is now placed in the obj ++ #glade_file = "/home/rhallisey/Desktop/sepolicy.glade" + glade_file = distutils.sysconfig.get_python_lib(plat_specific = True) + "/sepolicy/sepolicy.glade" + self.builder.add_from_file(glade_file) + self.outer_notebook = self.builder.get_object("outer_notebook") # The notebook obj @@ -515263,10 +515610,13 @@ index 0000000..112596d + self.applications_button_selection = self.builder.get_object("applications_selection_button") + self.revert_button = self.builder.get_object("Revert_button") + self.application = None ++ self.file_dialog = self.builder.get_object("add_path_dialog") + self.busy_cursor = gtk.gdk.Cursor(gtk.gdk.WATCH) + self.ready_cursor = gtk.gdk.Cursor(gtk.gdk.LEFT_PTR) + self.current_popup = None + self.import_export = None ++ self.clear_entry = True ++ self.confirmation_dialog_close = self.builder.get_object("confirmation_dialog_close") + + # Data store dictionaries + self.booldict = {} @@ -515274,6 +515624,7 @@ index 0000000..112596d + self.filedict = {} + self.all_list = [] + self.installed_list = [] ++ self.previously_modified = {} + # Data store dictionaries + + # Error check *************************************** @@ -515316,10 +515667,12 @@ index 0000000..112596d + self.systems_box = self.builder.get_object("Systems_box") + self.relabel_button = self.builder.get_object("Relabel_button") + self.relabel_button.set_active(os.path.exists('/.autorelabel')) ++ self.advanced_system = self.builder.get_object("advanced_system") ++ self.outer_notebook_frame = self.builder.get_object("outer_notebook_frame") ++ self.system_policy_label = self.builder.get_object("system_policy_type_label") + # System Items ************************************** + + # Browse Items ************************************** -+ self.file_dialog = self.builder.get_object("add_path_dialog") + self.select_button_browse = self.builder.get_object("select_button_browse") + self.cancel_button_browse = self.builder.get_object("cancel_button_browse") + # Browse Items ************************************** @@ -515487,8 +515840,8 @@ index 0000000..112596d + self.boolean_tree_data_set = self.builder.get_object("boolean_liststore") # Contains the tree with process type + desc (child of filter_data_set) + self.boolean_model = self.builder.get_object("boolean_treemodelfilter") # Get_model() attaches the list to the boolean model + self.boolean_tree_data_set.set_sort_column_id(2, gtk.SORT_ASCENDING) -+ self.booleans_more_detail_window = self.builder.get_object("booleans_popup_window") -+ self.booleans_more_detail_treeview = self.builder.get_object("more_detail_treeview") ++ self.booleans_more_detail_window = self.builder.get_object("booleans_more_detail_window") ++ self.booleans_more_detail_treeview = self.builder.get_object("booleans_more_detail_treeview") + self.booleans_more_detail_tree_data_set = self.builder.get_object("booleans_more_detail_liststore") + self.booleans_radio_button = self.builder.get_object("Booleans_button") + self.booleans_button_tooltip_txt = self.booleans_radio_button.get_tooltip_text() @@ -515558,6 +515911,15 @@ index 0000000..112596d + self.status_bar.push(self.context_id, _("System Status: Disabled")) + else: + self.set_enforce_text(status) ++ fd = open('/etc/selinux/config', 'r') ++ for l in fd.readlines(): ++ if l.startswith('SELINUXTYPE='): ++ l = l.split("SELINUXTYPE=")[1] ++ fd.close() ++ if l == 'disabled': ++ self.system_interface(self.app_system_button) ++ self.enforcing_button.set_sensitive(False) ++ self.permissive_button.set_sensitive(False) + # status bar ***************************************** + + # filters ********************************************* @@ -515617,6 +515979,7 @@ index 0000000..112596d + for domain in sepolicy_domains: + self.combo_box_initialize(domain, None) # After the user selects a path in the drop down menu call get_init_entrypoint_target(entrypoint) to get the transtype which will give you the application + self.advanced_search_initialize(domain) ++ self.all_list.append(domain) + self.percentage = float(float(self.loading)/float(self.list_length)) + self.progress_bar.set_fraction(self.percentage) + self.progress_bar.set_pulse_step(self.percentage) @@ -515626,12 +515989,12 @@ index 0000000..112596d + if entrypoint: + path = sepolicy.find_entrypoint_path(entrypoint) + if path: -+ self.combo_box_initialize(path, None) # Adds all files entrypoint paths that exists on disc into the combobox -+ self.advanced_search_initialize(path) -+ self.installed_list.append(path) ++ self.combo_box_initialize(path, None) # Adds all files entrypoint paths that exists on disc into the combobox ++ self.advanced_search_initialize(path) ++ self.installed_list.append(path) + + self.loading += 1 -+ ++# self.customized = self.dbus.customized() + dic = { + "on_combo_button_clicked" : self.open_combo_menu, + "on_SELinux_window_configure_event" : self.hide_combo_menu, @@ -515648,7 +516011,7 @@ index 0000000..112596d + "on_Application_file_types_treeview_configure_event" : self.resize_wrap, + "on_save_delete_files_clicked" : self.delete_items_from_list_files, + "on_save_delete_network_clicked" : self.delete_network_from_list_files, -+ "on_more_types_files_button_press_event" : self.show_more_types_files, ++ + "on_moreTypes_treeview_files_row_activated" : self.populate_type_combo, + "on_retry_button_files_clicked" : self.invalid_entry_retry, + "on_make_path_recursive_toggled" : self.recursive_path, @@ -515657,6 +516020,7 @@ index 0000000..112596d + "on_select_type_files_clicked" : self.select_type_more, + "on_select_button_browse_clicked" : self.on_browse_select, + "on_Enforcing_button_toggled" : self.set_enforce, ++ "on_confirmation_close" : self.confirmation_close, + + "on_app/system_button_clicked" : self.system_interface, + "on_main_advanced_label_button_press_event": self.advanced_label_main, @@ -515701,7 +516065,9 @@ index 0000000..112596d + "on_Permissive_button_default_toggled" : self.change_default_mode, + "on_Disabled_button_default_toggled" : self.change_default_mode, + "on_Relabel_button_toggled" : self.relabel_on_reboot, ++ "on_advanced_system_button_press_event" : self.reveal_advanced_system, + ++ "on_files_type_combobox_changed" : self.show_more_types, + "on_treemodelfilter_row_changed" : self.filter_the_data, # When a row is changed in the tree model filter + "on_Booleans_button_toggled" : self.booleans_tab_change, + "on_Files_button_toggled" : self.files_tab_change, @@ -515711,12 +516077,12 @@ index 0000000..112596d + "on_more_detail_toggled" : self.display_more_detail, + "on_booleans_popup_window_delete_event" : self.closewindow, + "gtk_widget_hide": self.closewindow, -+ "gtk_main_quit": self.quit ++ "gtk_main_quit": self.closewindow + } + + self.loading_gui.hide() + self.builder.connect_signals(dic) -+ self.window.show() # Show the gui to the screen ++ self.window.show() # Show the gui to the screen + gtk.main() + + def idle_func(self): @@ -515810,6 +516176,7 @@ index 0000000..112596d + return False + + def network_initialize(self, application): ++ sepolicy.reinit() + netd = sepolicy.network.get_network_connect(application, "tcp", "name_connect") + for k in netd.keys(): + for t,ports in netd[k]: @@ -515890,7 +516257,9 @@ index 0000000..112596d + self.writable_files_treestore.clear() + self.application_files_treestore.clear() + application = self.combobox_menu.get_active_text() -+ self.completion_entry.set_text(application) # Setting the text will cause the on_completion_test_changed signal to trigger calling completion_entry_selected ++ self.completion_entry.set_text(application) ++ self.idle_func() ++ # Setting the text will cause the on_completion_test_changed signal to trigger calling completion_entry_selected + + def combo_box_initialize(self, val, desc): + if val == None: @@ -515945,7 +516314,6 @@ index 0000000..112596d + return False + + def completion_entry_selected(self, *args): -+ self.wait_mouse() + self.show_mislabeled_files_only.set_visible(False) + self.mislabeled_files_label.set_visible(False) + self.warning_files.set_visible(False) @@ -515984,6 +516352,7 @@ index 0000000..112596d + except IndexError: + pass + ++ self.wait_mouse() + if application != "": + self.executable_files_tab.set_tooltip_text(_("File path used to enter the '%s' domain." % application)) + self.writable_files_tab.set_tooltip_text(_("Files to which the '%s' domain can write." % application)) @@ -516018,24 +516387,46 @@ index 0000000..112596d + self.transitions_radio_button.set_tooltip_text(self.transitions_radio_button_tooltip_txt) + + try: ++ if self.set_application_label: ++ self.applications_button_selection.set_label(self.application) + self.bool_initialize(application) ++ self.idle_func() ++ self.executable_files_initialize(application) ++ self.idle_func() ++ self.network_initialize(application) ++ self.idle_func() ++ self.writable_files_initialize(application) ++ self.idle_func() ++ self.transitions_into_x_initialize(application) ++ self.idle_func() ++ self.transitions_from_x_initialize(application) ++ self.idle_func() ++ self.application_file_types_initialize(application) ++ self.idle_func() ++ self.transitions_files_initialize(application) ++ self.idle_func() + except ValueError: -+ return ++ pass + except TypeError: -+ return -+ -+ self.executable_files_initialize(application) -+ self.network_initialize(application) -+ self.writable_files_initialize(application) -+ self.transitions_into_x_initialize(application) -+ self.transitions_from_x_initialize(application) -+ self.application_file_types_initialize(application) -+ self.transitions_files_initialize(application) -+ if self.set_application_label: -+ self.applications_button_selection.set_label(self.application) ++ pass ++ self.previously_modified_initialize() + self.ready_mouse() + ++ def previously_modified_initialize(self): ++ items = "" ++ ctr = 0 ++ for char in self.customized: ++ if char == '\n': ++ try: ++ #items = items.split()[1] ++ self.organize_dict(items.split('\n')[1]) ++ except IndexError: ++ self.organize_dict(items) ++ items = "" ++ items += char ++ + def executable_files_initialize(self, application): #KeyError with abrt_watch_log_t ++ sepolicy.reinit() + self.entrypoints = sepolicy.get_entrypoints(application) + for exe in self.entrypoints.keys(): # From entry_point = 0 to the number of keys in the dic + if len(self.entrypoints[exe]): @@ -516096,6 +516487,7 @@ index 0000000..112596d + self.set_mislabeled(self.executable_files_treestore, path, iter, niter) + + def writable_files_initialize(self, application): ++ sepolicy.reinit() + self.writable_files = sepolicy.get_writable_files(application) # Traversing the dictionary data struct + for write in self.writable_files.keys(): + if len(self.writable_files[write]): @@ -516143,6 +516535,7 @@ index 0000000..112596d + return "%s" % f + + def application_file_types_initialize(self, application): ++ sepolicy.reinit() + self.file_types = sepolicy.get_file_types(application) + for app in self.file_types.keys(): + if len(self.file_types[app]): @@ -516184,8 +516577,9 @@ index 0000000..112596d + def bool_initialize(self, application): + for blist in sepolicy.get_bools(application): + for b, active in blist: -+ if b in self.booldict: # Apply recent changes to the tree -+ active = self.booldict[b] ++ if b in self.booldict: ++ # Apply recent changes to the tree ++ active = self.booldict[b]['active'] + desc = sepolicy.boolean_desc(b) + self.boolean_initial_data_insert(b, desc , active) + @@ -516246,9 +516640,9 @@ index 0000000..112596d + self.transitions_from_x_treestore.set_value(iter, 0, enabled[active[0][1]]) # active[0][1] is either T or F (enabled is all the way at the top) + markup = '%s' + if active[0][1]: -+ self.transitions_from_x_treestore.set_value(niter, 2, (_("To disable this transitions, go to the " + markup % _("Boolean section.")))) ++ self.transitions_from_x_treestore.set_value(niter, 2, (_("To disable this transition, go to the " + markup % _("Boolean section.")))) + else: -+ self.transitions_from_x_treestore.set_value(niter, 2, (_("To enable this transitions, go to the " + markup % _("Boolean section.")))) ++ self.transitions_from_x_treestore.set_value(niter, 2, (_("To enable this transition, go to the " + markup % _("Boolean section.")))) + + self.transitions_from_x_treestore.set_value(niter, 1, active[0][0]) # active[0][0] is the Bool Name + self.transitions_from_x_treestore.set_value(niter, 5, True) @@ -516269,6 +516663,8 @@ index 0000000..112596d + self.transitions_file_liststore.set_value(iter, 0, directory) + self.transitions_file_liststore.set_value(iter, 1, tclass) + self.transitions_file_liststore.set_value(iter, 2, dest) ++ if name == None: ++ name = '*' + self.transitions_file_liststore.set_value(iter, 3, name) + + def booleans_tab_change(self, *args): @@ -516284,7 +516680,11 @@ index 0000000..112596d + self.outer_notebook.set_current_page(3) + + def return_to_booleans_clicked(self, model, path): ++ #event = gtk.gdk.Event(gtk.gdk.on_Transitions_button_toggled) ++ #event.window = entry.get_window() # the gtk.gdk.Window of the widget ++ #event.send_event = True # this means you sent the event explicitly + self.booleans_tab_change() ++ + path = self.transitions_from_x_treemodelsort.convert_path_to_child_path(path) + it = self.transitions_from_x_filter_data_set.get_iter(path) + it = self.transitions_from_x_filter_data_set.convert_iter_to_child_iter(it) @@ -516397,27 +516797,30 @@ index 0000000..112596d + if tclass != None: + self.check_if_type_is_in_combo(self.files_type_combolist, tclass) + self.files_type_combobox.set_active(self.map_selected_items_into_combobox(self.files_type_combolist, tclass)) -+ self.filedict[(self.application, ipage, operation)][(path, type)] = {"type": tclass, "mls": mls, "changed": True} ++ self.filedict[(self.application, ipage, operation)][(path, type)] = {"type": tclass, "mls": mls, "changed": True, "old": False} + -+ def check_if_type_is_in_combo(self, combolist, type): -+ if type not in combolist: -+ iter = combolist.append() -+ combolist.set_value(iter, 0, type) -+ return True ++ def check_if_type_is_in_combo(self, combolist, ftype): ++ match = False ++ ctr = 0 ++ for i in combolist: ++ if ftype == i[0]: ++ match = True ++ ctr += 1 ++ if not match: ++ #'More...' is last item in the list = (ctr-1) ++ niter = combolist.get_iter(ctr-1) ++ iter = combolist.insert_before(niter) ++ combolist.set_value(iter, 0, ftype) ++ #return True + + def populate_type_combo(self, tree, loc, *args): + iter = self.more_types_files_liststore.get_iter(loc) + ftype = self.more_types_files_liststore.get_value(iter, 0) -+ iter = self.files_type_combolist.append() -+ self.files_type_combolist.set_value(iter, 0, ftype) ++ self.check_if_type_is_in_combo(self.files_type_combolist, ftype) + self.files_type_combobox.set_active(self.map_selected_items_into_combobox(self.files_type_combolist, ftype)) + self.popup_window_files.show() + self.moreTypes_window_files.hide() + -+ def show_more_types_files(self, *args): -+ self.popup_window_files.hide() -+ self.moreTypes_window_files.show() -+ + def strip_domain(self, domain): + if domain == None: + return @@ -516448,6 +516851,10 @@ index 0000000..112596d + + self.more_types_files_liststore.clear() + try: ++ for files in sepolicy.file_type_str: ++ iter = self.files_class_combolist.append() ++ self.files_class_combolist.set_value(iter, 0, sepolicy.file_type_str[files]) ++ + if ipage == self.EXE_PAGE and self.entrypoints != None: + for exe in self.entrypoints.keys(): + if exe.startswith(compare): @@ -516474,16 +516881,14 @@ index 0000000..112596d + self.files_type_combolist.set_value(iter, 0, app) + iter = self.more_types_files_liststore.append() + self.more_types_files_liststore.set_value(iter, 0, app) -+ -+ for files in sepolicy.file_type_str: -+ iter = self.files_class_combolist.append() -+ self.files_class_combolist.set_value(iter, 0, sepolicy.file_type_str[files]) -+ self.files_class_combobox.set_active(0) ++ self.files_class_combobox.set_active(0) + except AttributeError: ++ print "error" + pass + self.files_type_combobox.set_active(0) + self.files_mls_combobox.set_active(0) -+ ++ iter = self.files_type_combolist.append() ++ self.files_type_combolist.set_value(iter, 0, 'More..') + def add_button_network_clicked(self, *args): + if self.application != None: + self.popup_network_label.set_text((_("Add Network Port for %s. Ports will be created when update is applied."))% self.application) @@ -516501,7 +516906,7 @@ index 0000000..112596d + mls = 1 + self.modify_mode=True + ipage = self.inner_notebook_network.get_current_page() -+ if (self.application, ipage, operation) not in self.filedict: ++ if (self.application, ipage, operation) not in self.portdict: + self.portdict[(self.application, ipage, operation)] = {} + if ipage == self.OUTBOUND: + row = self.out_network_treeview.get_selection() @@ -516543,7 +516948,7 @@ index 0000000..112596d + elif protocol == "udp": + self.network_udp_button.set_active(True) + -+ self.portdict[(self.application, ipage, operation)][(port, protocol)] = {"type": type, "mls": mls, "changed": True} ++ self.portdict[(self.application, ipage, operation)][(port, protocol)] = {"type": type, "mls": mls, "changed": True, "old": False} + + def map_selected_items_into_combobox(self, combolist, match): + ctr = 0 @@ -516595,14 +517000,20 @@ index 0000000..112596d + #self.portdict[self.application] = [] + + def bools_show_modified_only(self, checkbutton): -+ self.boolean_tree_data_set.clear() ++ append_list = [] + if checkbutton.get_active() == True: + for bools in self.booldict: ++ for row in self.boolean_tree_data_set: ++ if row[2] == bools: ++ append_list.append(bools) ++ self.boolean_tree_data_set.clear() ++ for i in append_list: + iter = self.boolean_tree_data_set.append() -+ self.boolean_tree_data_set.set_value(iter, 0, self.booldict[bools]) -+ self.boolean_tree_data_set.set_value(iter, 1, sepolicy.boolean_desc(bools)) -+ self.boolean_tree_data_set.set_value(iter, 2, bools) ++ self.boolean_tree_data_set.set_value(iter, 0, self.booldict[i]['active']) ++ self.boolean_tree_data_set.set_value(iter, 1, sepolicy.boolean_desc(i)) ++ self.boolean_tree_data_set.set_value(iter, 2, i) + elif self.application != None: ++ self.boolean_tree_data_set.clear() + self.bool_initialize(self.application) + + def files_show_modified_only(self, checkbutton): @@ -516762,8 +517173,14 @@ index 0000000..112596d + return True + return False + ++ def show_more_types(self, *args): ++ if self.files_type_combobox.get_active_text() == 'More..': ++ self.popup_window_files.hide() ++ self.moreTypes_window_files.show() ++ + def update_to_files(self, *args): -+ self.files_add = True # Insert Function will be used in the future ++ self.files_add = True ++ # Insert Function will be used in the future + insert_txt = self.files_path_entry.get_text() + if self.error_check_files(insert_txt): + return @@ -516800,8 +517217,9 @@ index 0000000..112596d + self.application_files_treestore.set_value(iter, 2, tclass) + if operation == "Modify": + self.application_files_treestore.remove(self.delete_old_item) -+ self.filedict[(self.application, ipage, operation)][(insert_txt, tclass)] = {"type": type, "mls": mls, "changed": False} ++ self.filedict[(self.application, ipage, operation)][(insert_txt, tclass)] = {"type": type, "mls": mls, "changed": False, "old": False} + self.files_add = False ++ self.recursive_path_toggle.set_active(False) + self.popup_window_files.hide() + self.window.set_sensitive(True) + @@ -516839,7 +517257,7 @@ index 0000000..112596d + self.in_network_tree_data_set.set_value(iter, 2, port_type) + if operation == "Modify": + self.in_network_tree_data_set.remove(self.delete_old_item) -+ self.portdict[(self.application, ipage, operation)][(ports, protocol)] = {"type": port_type, "mls": mls, "changed": False} ++ self.portdict[(self.application, ipage, operation)][(ports, protocol)] = {"type": port_type, "mls": mls, "changed": False, "old": False} + self.network_add = False + self.popup_window_network.hide() + self.window.set_sensitive(True) @@ -516976,30 +517394,32 @@ index 0000000..112596d + def populate_booldict(self, model, iter): + name = model.get_value(iter, 2) + enabled = model.get_value(iter, 0) -+ if self.booldict.has_key(name): ++ if self.booldict.has_key(name) and not self.booldict[name]['old']: + self.booldict.pop(name) + else: -+ self.booldict[name] = enabled ++ self.booldict[name]['active'] = enabled ++ self.booldict[name]['old'] = False ++ + def update_gui(self, *args): + self.update_or_revert = "update" + self.update_treestore.clear() + networktabs=[("Outbound"), ("Inbound")] + filetabs=[("Executable Files"), ("Writable Files"), ("Application File Type")] ++ for bools in self.booldict: ++ if not self.booldict[bools]['old']: ++ iter = self.update_treestore.append(None) ++ self.update_treestore.set_value(iter, 0, True) ++ self.update_treestore.set_value(iter, 1, sepolicy.boolean_desc(bools)) ++ niter = self.update_treestore.append(iter) ++ self.update_treestore.set_value(niter, 1, (_("SELinux name: %s"))% bools) ++ self.update_treestore.set_value(iter, 4, True) ++ self.update_treestore.set_value(niter, 4, False) ++ self.update_treestore.set_value(iter, 2, "Booleans") ++ self.update_treestore.set_value(iter, 3, action[self.booldict[bools]['active']]) + -+ for bool in self.booldict: -+ desc = sepolicy.boolean_desc(bool) -+ iter = self.update_treestore.append(None) -+ self.update_treestore.set_value(iter, 0, True) -+ self.update_treestore.set_value(iter, 1, desc) -+ niter = self.update_treestore.append(iter) -+ self.update_treestore.set_value(niter, 1, (_("SELinux name: %s"))% bool) -+ self.update_treestore.set_value(iter, 4, True) -+ self.update_treestore.set_value(niter, 4, False) -+ self.update_treestore.set_value(iter, 2, "Booleans") -+ self.update_treestore.set_value(iter, 3, action[self.booldict[bool]]) + for app, ipage, operation in self.filedict: + for path, tclass in self.filedict[app, ipage, operation]: -+ if self.filedict[(app, ipage, operation)][(path, tclass)]["changed"] == False: ++ if not self.filedict[(app, ipage, operation)][(path, tclass)]["changed"] and not self.filedict[(app, ipage, operation)][(path, tclass)]["old"]: + iter = self.update_treestore.append(None) + self.update_treestore.set_value(iter, 0, True) + self.update_treestore.set_value(iter, 2, filetabs[ipage]) @@ -517024,7 +517444,7 @@ index 0000000..112596d + + for app, ipage, operation in self.portdict: + for ports, protocol in self.portdict[app, ipage, operation]: -+ if self.portdict[(app, ipage, operation)][(ports, protocol)]["changed"] == False: ++ if not self.portdict[(app, ipage, operation)][(ports, protocol)]["changed"] and not self.portdict[app, ipage, operation][ports, protocol]["old"]: + iter = self.update_treestore.append(None) + self.update_treestore.set_value(iter, 0, True) + self.update_treestore.set_value(iter, 2, networktabs[ipage]) @@ -517049,8 +517469,8 @@ index 0000000..112596d + self.update_window.show() + self.window.set_sensitive(False) + -+ def system_interface(self, *args): -+ if self.app_system_button.get_label() == "System": ++ def system_interface(self, button, *args): ++ if button.get_label() == "System": + self.applications_button_selection.set_label("System") + self.app_system_button.set_label("Applications") + self.main_selection_window.hide() @@ -517062,11 +517482,11 @@ index 0000000..112596d + self.systems_box.set_visible(True) + self.system_button.set_visible(True) + #self.window.set_resizable(False) -+ resize = self.window.get_default_size() -+ self.window.resize(resize[0], resize[1]) ++ #resize = self.window.get_default_size() ++ #self.window.resize(resize[0], resize[1]) + self.idle_func() + -+ elif self.app_system_button.get_label() == "Applications": ++ elif button.get_label() == "Applications": + self.applications_button_selection.set_label("Applications") + self.app_system_button.set_label("System") + self.main_selection_window.hide() @@ -517181,6 +517601,7 @@ index 0000000..112596d + except dbus.exceptions.DBusException, e: + print e + self.completion_entry_selected() ++ self.customized = self.dbus.customized() + self.ready_mouse() + + def ipage_value_lookup(self, lookup): @@ -517208,20 +517629,20 @@ index 0000000..112596d + try: + self.bool_revert = self.get_attributes_update(self.update_treestore[ctr, 0][1]) + fclass_or_protocol = self.get_attributes_update(self.update_treestore[ctr,1][1]) -+ type = self.get_attributes_update(self.update_treestore[ctr,2][1]) ++ ftype = self.get_attributes_update(self.update_treestore[ctr,2][1]) + except IndexError: + pass + popbools = [] + if ipage == "Booleans": + for bools in self.booldict: + if bools == self.bool_revert: -+ self.update_buffer += "boolean -m -%d %s\n" % (self.booldict[bools], bools) ++ self.update_buffer += "boolean -m -%d %s\n" % (self.booldict[bools]['active'], bools) + popbools.append(self.bool_revert) + for pop in popbools: + self.booldict.pop(pop) + elif self.update_treestore[ctr][2] == "Inbound" or self.update_treestore[ctr][2] == "Outbound": + for ports in self.portdict: -+ if self.portdict[self.application, ipage, operation][path_or_port, fclass_or_protocol]["type"] == type: ++ if self.portdict[self.application, ipage, operation][path_or_port, fclass_or_protocol]["type"] == ftype: + porttype = self.portdict[self.application, ipage, operation][(path_or_port, fclass_or_protocol)]["type"] + buf_operation = self.translate_operation(operation) + self.update_buffer += "port -%s -t %s -p %s %s\n" % (buf_operation, porttype, fclass_or_protocol, path_or_port) @@ -517229,12 +517650,13 @@ index 0000000..112596d + break + else: + for files in self.filedict: -+ if self.filedict[self.application, ipage, operation][path_or_port, fclass_or_protocol]["type"] == type: ++ if self.filedict[self.application, ipage, operation][path_or_port, fclass_or_protocol]["type"] == ftype: ++ ++ + buf_operation = self.translate_operation(operation) -+ self.update_buffer += "fcontext -%s -t -'%s' %s\n" % (buf_operation, type, path_or_port) ++ self.update_buffer += "fcontext -%s -f %s -t %s %s\n" % (buf_operation, reverse_file_type_str[fclass_or_protocol], ftype, path_or_port) ++ print (self.update_buffer) + self.filedict[self.application, ipage, operation].pop((path_or_port, fclass_or_protocol)) -+ if operation == "Modify": -+ self.filedict[self.application, ipage, operation].pop((path_or_port, fclass_or_protocol)) + break + + ctr += 1 @@ -517245,6 +517667,16 @@ index 0000000..112596d + self.window.set_sensitive(True) + self.window.show() + ++ def reveal_advanced_system(self, label, *args): ++ if label.get_text() == "Advanced >>": ++ label.set_text("Advanced <<") ++ self.system_policy_label.set_visible(True) ++ self.system_policy_type_combobox.set_visible(True) ++ elif label.get_text() == "Advanced <<": ++ label.set_text("Advanced >>") ++ self.system_policy_label.set_visible(False) ++ self.system_policy_type_combobox.set_visible(False) ++ + def reveal_advanced(self, label, *args): + if label.get_text() == "Advanced >>": + self.mls_label_files.set_visible(True) @@ -517260,7 +517692,6 @@ index 0000000..112596d + label.set_text("Advanced >>") + + def advanced_search_initialize(self, domain): -+ self.all_list.append(domain) + iter = self.advanced_search_liststore.append() + try: + if domain[0] == '/': @@ -517305,6 +517736,8 @@ index 0000000..112596d + self.idle_func() + + elif label == "Installed": ++ if self.installed_list == []: ++ return + for items in self.installed_list: + self.advanced_search_initialize(items) + self.idle_func() @@ -517381,6 +517814,7 @@ index 0000000..112596d + self.dbus.change_policy_type(self.system_policy_type_combobox.get_active_text()) + + def change_default_mode(self, button): ++ self.enabled_changed(button) + if button.get_active(): + self.dbus.change_default_policy(button.get_label().lower()) + @@ -517388,12 +517822,14 @@ index 0000000..112596d + self.file_dialog.set_action(gtk.FILE_CHOOSER_ACTION_OPEN) + self.file_dialog.set_title("Import Configuration") + self.file_dialog.show() ++ #self.file_dialog.set_uri('/tmp') + self.import_export = 'Import' + + def export_config_show(self, *args): + self.file_dialog.set_action(gtk.FILE_CHOOSER_ACTION_SAVE) + self.file_dialog.set_title("Export Configuration") + self.file_dialog.show() ++ #self.file_dialog.set_filter('/tmp') + self.import_export = 'Export' + + def import_or_export(self, button, *args): @@ -517434,14 +517870,55 @@ index 0000000..112596d + pass + self.ready_mouse() + ++ def init_dictionary(self, dic, app, ipage, operation, p, q, ftype, mls, changed, old): ++ if (app, ipage, operation) not in dic: ++ dic[app, ipage, operation] = {} ++ if (p, q) not in dic[app, ipage, operation]: ++ dic[app, ipage, operation][p, q] = {'type': ftype, 'mls': mls, 'changed': changed, 'old': old} ++ def convert_unicode(self, unicodedata): ++ return unicodedata.encode('ascii') ++ def organize_dict(self, d): ++ if d.startswith('boolean') and d != 'boolean -D': ++ boolname = self.convert_unicode(d.split()[3]) ++ value = d.split()[2] ++ self.booldict[boolname] = {'active': self.translate_bool(value), 'old': True} ++ ++ elif d.startswith('port') and d != 'port -D': ++ port = self.convert_unicode(d.split()[-1]) ++ protocol = self.convert_unicode(d.split()[5]) ++ ptype = self.convert_unicode(d.split()[3]) ++ for ipage in [0,1]: ++ self.init_dictionary(self.portdict, self.application, ipage, 'Add', port, protocol, ptype, 0, False, True) ++ self.portdict[self.application, ipage, 'Add'][port, protocol] = {'type': ptype, 'mls': 0, 'changed': False, 'old': True} ++ ++ elif d.startswith('fcontext') and d != 'fcontext -D': ++ path = self.convert_unicode(d.split()[-1]).strip("'") ++ label = self.convert_unicode(d.split()[6]) ++ fclass = self.convert_unicode(d.split()[3]) ++ if fclass == "'all": ++ fclass = "all files" ++ for ipage in [0,2]: ++ self.init_dictionary(self.filedict, self.application, ipage, 'Add', path, fclass, label, 0, False, True) ++ self.filedict[self.application, ipage, 'Add'][path, fclass] = {'type': label, 'mls': 0, 'changed': False, 'old': True} ++ ++ def translate_bool(self, b): ++ b = b.split('-')[1] ++ if b == '0': ++ return False ++ if b == '1': ++ return True ++ + def relabel_on_reboot(self, widget, *args): + self.dbus.relabel_on_boot(widget.get_active()) + + def closewindow(self, window, *args): + window.hide() ++ self.recursive_path_toggle.set_active(False) + self.window.set_sensitive(True) + if self.moreTypes_window_files == window: + self.popup_window_files.show() ++ if self.files_type_combobox.get_active_text() == 'More...': ++ self.files_type_combobox.set_active(0) + if self.error_check_window == window: + self.window.set_sensitive(False) + if self.files_add: @@ -517479,6 +517956,7 @@ index 0000000..112596d + def close_add_files_popup(self, *args): + self.popup_window_files.hide() + self.window.set_sensitive(True) ++ self.recursive_path_toggle.set_active(False) + def close_update_popup(self,*args): + self.update_window.hide() + self.window.set_sensitive(True) @@ -517491,6 +517969,43 @@ index 0000000..112596d + self.window.window.set_cursor(self.ready_cursor) + self.idle_func() + ++ def verify(self, message, title="" ): ++ dlg = gtk.MessageDialog(None, 0, gtk.MESSAGE_INFO, ++ gtk.BUTTONS_YES_NO, ++ message) ++ dlg.set_title(title) ++ dlg.set_position(gtk.WIN_POS_MOUSE) ++ dlg.show_all() ++ rc = dlg.run() ++ dlg.destroy() ++ return rc ++ ++ def enabled_changed(self, radio): ++ disabled = None ++ enabled = None ++ if not radio.get_active(): ++ disabled = radio.get_label() ++ else: ++ enabled = radio.get_label() ++ ++ if enabled == 'Disabled' and disabled != 'Disabled' : ++ if self.verify(_("Changing to SELinux disabled requires a reboot. It is not recommended. If you later decide to turn SELinux back on, the system will be required to relabel. If you just want to see if SELinux is causing a problem on your system, you can go to permissive mode which will only log errors and not enforce SELinux policy. Permissive mode does not require a reboot Do you wish to continue?")) == gtk.RESPONSE_NO: ++ self.relabel_button.set_active(False) ++ self.relabel_on_reboot(self.relabel_button) ++ self.relabel_button.set_sensitive(True) ++ ++ elif enabled != 'Disabled' and disabled == 'Disabled': ++ if self.verify(_("Changing to SELinux enabled will cause a relabel of the entire file system on the next boot. Relabeling takes a long time depending on the size of the file system. Do you wish to continue?")) == gtk.RESPONSE_NO: ++ self.relabel_button.set_active(True) ++ self.relabel_on_reboot(self.relabel_button) ++ self.relabel_button.set_sensitive(False) ++ ++ def confirmation_close(self, button, *args): ++ if len(self.update_treestore) > 0: ++ if self.verify(_("You have not pushed your update.\n Are you sure you want to quit?"), _("Loss of data Dialog")) == gtk.RESPONSE_NO: ++ return True ++ self.quit(self.window) ++ + def quit(self, widget): + sys.exit(0) + @@ -518294,7 +518809,7 @@ index 66efe26..970f4c8 100755 return d diff --git a/policycoreutils/sepolicy/sepolicy/sedbus.py b/policycoreutils/sepolicy/sepolicy/sedbus.py new file mode 100644 -index 0000000..07d5a98 +index 0000000..0a30450 --- /dev/null +++ b/policycoreutils/sepolicy/sepolicy/sedbus.py @@ -0,0 +1,41 @@ @@ -518310,26 +518825,26 @@ index 0000000..07d5a98 +class SELinuxDBus (object): + def __init__ (self): + self.bus = dbus.SystemBus() -+ self.dbus_object = self.bus.get_object("org.fedoraproject.selinux", "/org/fedoraproject/selinux/object") ++ self.dbus_object = self.bus.get_object("org.selinux", "/org/selinux/object") + + @polkit.enable_proxy + def semanage (self, buf): -+ ret = self.dbus_object.semanage(buf, dbus_interface = "org.fedoraproject.selinux") ++ ret = self.dbus_object.semanage(buf, dbus_interface = "org.selinux") + return ret + + @polkit.enable_proxy + def restorecon (self, path): -+ ret = self.dbus_object.restorecon(path, dbus_interface = "org.fedoraproject.selinux") ++ ret = self.dbus_object.restorecon(path, dbus_interface = "org.selinux") + return ret + + @polkit.enable_proxy + def setenforce (self, value): -+ ret = self.dbus_object.setenforce(value, dbus_interface = "org.fedoraproject.selinux") ++ ret = self.dbus_object.setenforce(value, dbus_interface = "org.selinux") + return ret + + @polkit.enable_proxy + def customized (self): -+ ret = self.dbus_object.customized(dbus_interface = "org.fedoraproject.selinux") ++ ret = self.dbus_object.customized(dbus_interface = "org.selinux") + return ret + +if __name__ == "__main__": @@ -518341,11 +518856,12 @@ index 0000000..07d5a98 + print e diff --git a/policycoreutils/sepolicy/sepolicy/sepolicy.glade b/policycoreutils/sepolicy/sepolicy/sepolicy.glade new file mode 100644 -index 0000000..da6318f +index 0000000..3ea562c --- /dev/null +++ b/policycoreutils/sepolicy/sepolicy/sepolicy.glade -@@ -0,0 +1,3814 @@ +@@ -0,0 +1,3904 @@ + ++ + + + @@ -518406,21 +518922,6 @@ index 0000000..da6318f + True + False + -+ -+ Cancel -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 0 -+ -+ -+ + + OK + True @@ -518435,6 +518936,21 @@ index 0000000..da6318f + 0 + + ++ ++ ++ Cancel ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 1 ++ ++ + + + False @@ -518465,12 +518981,11 @@ index 0000000..da6318f + True + ● + Select domain -+ True + gtk-find + False + False -+ + ++ + + + False @@ -518525,2032 +519040,6 @@ index 0000000..da6318f + + + -+ -+ False -+ SELinux Policy Manager -+ center-always -+ 650 -+ 420 -+ -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ 0 -+ -+ -+ True -+ False -+ -+ -+ Applications -+ 240 -+ True -+ False -+ True -+ none -+ False -+ 0 -+ bottom -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ ↓ -+ True -+ False -+ True -+ none -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ Booleans -+ True -+ True -+ False -+ Display boolean information that can be used to modify the policy for the 'selected domain'. -+ 0.5 -+ True -+ False -+ Files_button -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ Files -+ True -+ True -+ False -+ Display file type information that can be used by the 'selected domain'. -+ 0.5 -+ False -+ Booleans_button -+ -+ -+ -+ False -+ True -+ 2 -+ -+ -+ -+ -+ Network -+ True -+ True -+ False -+ Display network ports to which the 'selected domain' can connect or listen to. -+ 0.5 -+ False -+ Booleans_button -+ -+ -+ -+ False -+ True -+ 3 -+ -+ -+ -+ -+ Transitions -+ True -+ True -+ False -+ Display applications that can transition into or out of the 'selected domain'. -+ 0.5 -+ False -+ Booleans_button -+ -+ -+ -+ False -+ True -+ 4 -+ -+ -+ -+ -+ System -+ True -+ False -+ 0.5 -+ True -+ False -+ -+ -+ False -+ True -+ 5 -+ -+ -+ -+ -+ False -+ False -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ 465 -+ True -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Filter -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ 170 -+ True -+ True -+ ● -+ 25 -+ none -+ True -+ gtk-find -+ False -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ Show Modified Only -+ True -+ True -+ False -+ 0.5 -+ True -+ -+ -+ -+ False -+ False -+ 1 -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ If-Then-Else rules written in policy that can -+allow alternative access control. -+ boolean_treemodelsort -+ 0 -+ -+ -+ fixed -+ Enabled -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 240 -+ Description -+ True -+ 1 -+ -+ -+ word -+ 360 -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ fixed -+ 40 -+ 40 -+ 2 -+ -+ -+ Italic 8 -+ #00004e4e9999 -+ More.. -+ -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ -+ fixed -+ Name -+ True -+ True -+ True -+ True -+ 3 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 2 -+ -+ -+ -+ -+ -+ -+ True -+ False -+ Booleans -+ -+ -+ False -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ 2 -+ 3 -+ -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Filter -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ 170 -+ True -+ True -+ ● -+ 25 -+ none -+ True -+ gtk-find -+ False -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ -+ -+ Show Modified Only -+ True -+ True -+ False -+ 0.5 -+ True -+ -+ -+ -+ 1 -+ 2 -+ GTK_FILL -+ -+ -+ -+ -+ -+ Show mislabeled files only -+ True -+ False -+ 0.5 -+ True -+ -+ -+ -+ 1 -+ 2 -+ 1 -+ 2 -+ GTK_FILL -+ -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Delete -+ True -+ False -+ True -+ True -+ -+ -+ -+ False -+ True -+ end -+ 0 -+ -+ -+ -+ -+ Modify -+ True -+ True -+ True -+ -+ -+ -+ False -+ True -+ end -+ 1 -+ -+ -+ -+ -+ Add -+ True -+ False -+ True -+ True -+ -+ -+ -+ False -+ True -+ end -+ 2 -+ -+ -+ -+ -+ 2 -+ 3 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ False -+ gtk-dialog-warning -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ False -+ Mislabeled files exist -+ -+ -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ 1 -+ 2 -+ -+ -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ File path used to enter the above selected process domain. -+ executable_files_treemodelsort -+ 0 -+ -+ -+ -+ True -+ fixed -+ 355 -+ File Path -+ True -+ True -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ 70 -+ 70 -+ -+ -+ #00004e4e9999 -+ Fix Label -+ single -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 175 -+ SELinux File Label -+ True -+ True -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 75 -+ Class -+ True -+ True -+ 2 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ False -+ File path used to enter the 'selected domain'. -+ Executable Files -+ -+ -+ False -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ Files to which the above selected process domain can write. -+ writable_files_treemodelsort -+ 0 -+ -+ -+ -+ True -+ fixed -+ 377 -+ File Path -+ True -+ True -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ 70 -+ 70 -+ -+ -+ #00004e4e9999 -+ Fix Label -+ single -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 163 -+ SELinux File Label -+ True -+ True -+ True -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 92 -+ Class -+ True -+ True -+ True -+ 2 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ True -+ False -+ Files to which the 'selected domain' can write. -+ Writable Files -+ -+ -+ 1 -+ False -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ File Types defined for the selected domain -+ application_filetypes_treemodelsort -+ 0 -+ -+ -+ -+ True -+ fixed -+ 215 -+ File Path -+ True -+ True -+ True -+ 0 -+ -+ -+ 0 -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ 70 -+ 70 -+ -+ -+ #00004e4e9999 -+ Fix Label -+ single -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 315 -+ Description -+ True -+ True -+ True -+ 1 -+ -+ -+ word-char -+ 305 -+ -+ -+ 1 -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ 75 -+ Class -+ True -+ True -+ True -+ 2 -+ -+ -+ 0 -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ True -+ False -+ File Types defined for the 'selected domain'. -+ Application File Types -+ -+ -+ 2 -+ False -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ True -+ False -+ Files -+ -+ -+ 1 -+ False -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Filter -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ 170 -+ True -+ True -+ ● -+ 25 -+ none -+ True -+ gtk-find -+ False -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ Delete -+ True -+ False -+ True -+ True -+ Delete an existing item -+ -+ -+ -+ False -+ True -+ end -+ 1 -+ -+ -+ -+ -+ Modify -+ True -+ True -+ True -+ Modify an existing item -+ -+ -+ -+ False -+ True -+ end -+ 2 -+ -+ -+ -+ -+ Add -+ True -+ False -+ True -+ True -+ Add a new item -+ -+ -+ -+ False -+ True -+ end -+ 3 -+ -+ -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ Show Modified Only -+ True -+ True -+ False -+ 0.5 -+ True -+ -+ -+ -+ False -+ False -+ 1 -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ Network Ports to which the selected domain is allowed to connect. -+ out_network_treemodelsort -+ 0 -+ True -+ -+ -+ -+ True -+ fixed -+ Port -+ True -+ True -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ Protocol -+ True -+ True -+ True -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ SELinux Port Type -+ True -+ True -+ True -+ True -+ 3 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ False -+ Network Ports to which the 'selected domain' is allowed to connect. -+ Outbound -+ -+ -+ False -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ True -+ Network Ports to which the selected domain is allowed to listen. -+ in_network_treemodelsort -+ 0 -+ True -+ -+ -+ -+ True -+ fixed -+ Port -+ True -+ True -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ Protocol -+ True -+ True -+ True -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ fixed -+ SELinux Port Type -+ True -+ True -+ True -+ 3 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ True -+ False -+ Network Ports to which the 'selected domain' is allowed to listen. -+ Inbound -+ -+ -+ 1 -+ False -+ -+ -+ -+ -+ True -+ True -+ 2 -+ -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ True -+ False -+ Network -+ -+ -+ 2 -+ False -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Filter -+ -+ -+ False -+ False -+ 0 -+ -+ -+ -+ -+ 170 -+ True -+ True -+ ● -+ 25 -+ none -+ True -+ gtk-find -+ False -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 0 -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ Executables which will transition to a different domain, when the 'selected domain' executes them. -+ transitions_from_x_treemodelsort -+ -+ -+ True -+ Enabled -+ True -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ True -+ Executable File Type -+ True -+ True -+ True -+ 1 -+ -+ -+ -+ 2 -+ 2 -+ -+ -+ -+ -+ 0 -+ -+ -+ -+ 5 -+ -+ -+ -+ -+ -+ -+ True -+ Transtype -+ True -+ True -+ True -+ 2 -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ False -+ Executables which will transition to a different domain, when the 'selected domain' executes them. -+ 1 -+ 1 -+ Applicaton Transitions From 'select domain' -+ -+ -+ 1 -+ False -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ Executables which will transition to the 'selected domain', when executing a selected domains entrypoint. -+ transitions_into_x_treemodelsort -+ -+ -+ True -+ Enabled -+ True -+ True -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ True -+ Calling Process Domain -+ True -+ True -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ True -+ Executable File -+ True -+ True -+ True -+ 1 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ True -+ False -+ Executables which will transition to the 'selected domain', when executing a selected domains entrypoint. -+ Application Transitions Into 'select domain' -+ -+ -+ 1 -+ False -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ File_transitions_treemodel_sort -+ -+ -+ Directory Type -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ Class -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ Destination Type -+ 2 -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ File Name -+ 3 -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ True -+ False -+ File Transitions From 'select domain' -+ -+ -+ 2 -+ False -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ True -+ False -+ Transitions -+ -+ -+ 3 -+ False -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ 465 -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Select the system mode when the system first boots up. -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Systems Default Mode: -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Enforcing -+ True -+ True -+ False -+ 0.5 -+ True -+ True -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ Permissive -+ True -+ True -+ False -+ 0.5 -+ True -+ Enforcing_button_default -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ Disabled -+ True -+ True -+ False -+ 0.5 -+ True -+ Enforcing_button_default -+ -+ -+ -+ True -+ True -+ 2 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Select the system mode for the current session. -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Current Mode: -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Enforcing -+ True -+ True -+ False -+ 0.5 -+ True -+ True -+ Permissive_button -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ Permissive -+ True -+ True -+ False -+ 0.5 -+ True -+ Enforcing_button -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Select the system default policy type. -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ System Policy Type: -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ system_policy_type_liststore -+ -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 2 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ -+ -+ Import -+ 65 -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 0 -+ -+ -+ -+ -+ True -+ False -+ Import system settings from another machine. -+ -+ -+ False -+ False -+ 10 -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 60 -+ 0 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Export system settings to a file. -+ -+ -+ False -+ False -+ 10 -+ 0 -+ -+ -+ -+ -+ Export -+ 65 -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 60 -+ 1 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Relabel all files back to system defaults on reboot. -+ -+ -+ False -+ False -+ 10 -+ 0 -+ -+ -+ -+ -+ Relabel -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 60 -+ 2 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Revert -+ True -+ True -+ True -+ Reset to system default -+ -+ -+ -+ False -+ True -+ end -+ 0 -+ -+ -+ -+ -+ Update -+ True -+ True -+ True -+ Save your changes -+ -+ -+ -+ False -+ True -+ end -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 2 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ True -+ False -+ 2 -+ -+ -+ False -+ False -+ 1 -+ -+ -+ -+ -+ + + + @@ -520569,145 +519058,21 @@ index 0000000..da6318f + False + 5 + GtkFileChooserDialog -+ dialog ++ True ++ normal + save -+ -+ -+ advanced_treemodel_filter -+ -+ -+ False -+ center-on-parent -+ 600 -+ 620 -+ SELinux_window -+ -+ -+ -+ True ++ ++ + False -+ -+ -+ True ++ ++ + False -+ -+ -+ 210 -+ True -+ True -+ ● -+ True -+ gtk-find -+ False -+ -+ -+ -+ False -+ True -+ 10 -+ 0 -+ -+ -+ -+ -+ All -+ True -+ True -+ False -+ 0.5 -+ True -+ True -+ Installed_advanced_button -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ Installed -+ True -+ True -+ False -+ 0.5 -+ True -+ All_advanced_button -+ -+ -+ -+ True -+ True -+ 2 -+ -+ + + + False + True -+ 0 -+ -+ -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ advanced_treemodel_sort -+ -+ -+ -+ Applications -+ True -+ 0 -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ Process Types -+ True -+ 1 -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ Select -+ True -+ True -+ True -+ -+ -+ -+ False -+ False + end -+ 2 ++ 0 + + + @@ -520716,6 +519081,9 @@ index 0000000..da6318f + + Advanced_search_liststore + ++ ++ advanced_treemodel_filter ++ + + + @@ -520777,6 +519145,74 @@ index 0000000..da6318f + + + ++ ++ False ++ popup ++ True ++ center-on-parent ++ 440 ++ 250 ++ SELinux_window ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ All previous changes will be lost. Save you changes to keep them. ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ OK ++ True ++ True ++ True ++ ++ ++ ++ False ++ True ++ end ++ 0 ++ ++ ++ ++ ++ Cancel ++ True ++ True ++ True ++ ++ ++ ++ False ++ True ++ end ++ 1 ++ ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ + + + @@ -520801,292 +519237,6 @@ index 0000000..da6318f + + + -+ -+ executable_files_treestore -+ -+ -+ executable_files_treemodelfilter -+ -+ -+ -+ -+ -+ -+ -+ -+ False -+ Delete Modified File Labeling -+ True -+ center-on-parent -+ 450 -+ 320 -+ SELinux_window -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Select file labeling to delete. File labeling will be deleted when update is applied. -+ True -+ -+ -+ False -+ False -+ 0 -+ -+ -+ -+ -+ True -+ True -+ delete_files_liststore -+ -+ -+ 20 -+ Select -+ True -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ 275 -+ File Path -+ True -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ 75 -+ SELinux File Label -+ True -+ True -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ 25 -+ Class -+ True -+ True -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Cancel -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 0 -+ -+ -+ -+ -+ delete -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 2 -+ -+ -+ -+ -+ -+ -+ False -+ Delete Modified Ports -+ True -+ center-on-parent -+ 450 -+ 320 -+ SELinux_window -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ False -+ Select ports to delete. Ports will be deleted when update is applied. -+ True -+ -+ -+ False -+ False -+ 0 -+ -+ -+ -+ -+ True -+ True -+ delete_network_liststore -+ False -+ 0 -+ -+ -+ 20 -+ Select -+ True -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ 275 -+ Port -+ True -+ -+ -+ -+ 1 -+ -+ -+ -+ -+ -+ -+ 75 -+ Protocol -+ True -+ True -+ -+ -+ -+ 2 -+ -+ -+ -+ -+ -+ -+ 25 -+ SELinux Port Type -+ True -+ True -+ -+ -+ -+ 3 -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ -+ -+ -+ True -+ False -+ -+ -+ Cancel -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 0 -+ -+ -+ -+ -+ Delete -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ end -+ 1 -+ -+ -+ -+ -+ False -+ True -+ 2 -+ -+ -+ -+ -+ + + + @@ -521186,6 +519336,18 @@ index 0000000..da6318f + + + ++ ++ executable_files_treestore ++ ++ ++ executable_files_treemodelfilter ++ ++ ++ ++ ++ ++ ++ + + + @@ -521244,66 +519406,6 @@ index 0000000..da6318f + + + -+ -+ False -+ More Types -+ True -+ center-on-parent -+ 440 -+ 250 -+ SELinux_window -+ -+ -+ -+ True -+ False -+ -+ -+ True -+ True -+ -+ -+ True -+ True -+ more_types_file_liststore -+ -+ -+ -+ Types -+ -+ -+ -+ 0 -+ -+ -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 0 -+ -+ -+ -+ -+ Select -+ True -+ True -+ True -+ -+ -+ -+ False -+ False -+ 1 -+ -+ -+ -+ -+ + + + @@ -521361,7 +519463,10 @@ index 0000000..da6318f + + True + False ++ 0 ++ 10 + <operation> File Labeling for <selected domain>. File labels will be created when update is applied. ++ fill + True + + @@ -521390,12 +519495,12 @@ index 0000000..da6318f + True + False + -+ -+ Cancel ++ ++ Save to update + True + True + True -+ ++ + + + False @@ -521405,12 +519510,12 @@ index 0000000..da6318f + + + -+ -+ Save changes ++ ++ Cancel + True + True + True -+ ++ + + + False @@ -521618,7 +519723,6 @@ index 0000000..da6318f + True + True + ● -+ True + False + False + @@ -521639,6 +519743,7 @@ index 0000000..da6318f + True + False + files_type_combo_store ++ + + + @@ -521652,23 +519757,6 @@ index 0000000..da6318f + 0 + + -+ -+ -+ True -+ False -+ More.. -+ True -+ -+ -+ -+ -+ -+ -+ True -+ True -+ 1 -+ -+ + + + 1 @@ -521702,7 +519790,10 @@ index 0000000..da6318f + + True + False ++ 0 ++ 10 + <operation> Network Port for <selected domain>. Ports will be created when update is applied. ++ fill + True + + @@ -521740,7 +519831,6 @@ index 0000000..da6318f + True + True + ● -+ True + False + False + @@ -521853,12 +519943,12 @@ index 0000000..da6318f + True + False + -+ -+ Cancel ++ ++ Save to update + True + True + True -+ ++ + + + False @@ -521868,12 +519958,12 @@ index 0000000..da6318f + + + -+ -+ Save to update ++ ++ Cancel + True + True + True -+ ++ + + + False @@ -521989,6 +520079,2540 @@ index 0000000..da6318f + + transitions_into_x_treemodelfilter + ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ writable_files_treestore ++ ++ ++ writable_files_treemodelfilter ++ ++ ++ False ++ SELinux Policy Manager ++ center-always ++ 650 ++ 420 ++ ++ ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ 0 ++ ++ ++ True ++ False ++ ++ ++ Applications ++ 240 ++ True ++ False ++ True ++ none ++ False ++ 0 ++ bottom ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ ↓ ++ True ++ False ++ True ++ none ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ Booleans ++ True ++ True ++ False ++ Display boolean information that can be used to modify the policy for the 'selected domain'. ++ 0.5 ++ True ++ False ++ Files_button ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ Files ++ True ++ True ++ False ++ Display file type information that can be used by the 'selected domain'. ++ 0.5 ++ False ++ Booleans_button ++ ++ ++ ++ False ++ True ++ 2 ++ ++ ++ ++ ++ Network ++ True ++ True ++ False ++ Display network ports to which the 'selected domain' can connect or listen to. ++ 0.5 ++ False ++ Booleans_button ++ ++ ++ ++ False ++ True ++ 3 ++ ++ ++ ++ ++ Transitions ++ True ++ True ++ False ++ Display applications that can transition into or out of the 'selected domain'. ++ 0.5 ++ False ++ Booleans_button ++ ++ ++ ++ False ++ True ++ 4 ++ ++ ++ ++ ++ System ++ True ++ False ++ 0.5 ++ True ++ False ++ ++ ++ False ++ True ++ 5 ++ ++ ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ 465 ++ True ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ Filter ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ 170 ++ True ++ True ++ ● ++ 25 ++ none ++ gtk-find ++ False ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ Show Modified Only ++ True ++ True ++ False ++ 0.5 ++ True ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ If-Then-Else rules written in policy that can ++allow alternative access control. ++ boolean_treemodelsort ++ 0 ++ ++ ++ ++ ++ ++ autosize ++ Enabled ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 240 ++ Description ++ True ++ 1 ++ ++ ++ word ++ 360 ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ fixed ++ 40 ++ 40 ++ 2 ++ ++ ++ Italic 8 ++ #00004e4e9999 ++ More.. ++ ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ ++ fixed ++ Name ++ True ++ True ++ True ++ True ++ 3 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ True ++ 2 ++ ++ ++ ++ ++ ++ ++ True ++ False ++ Booleans ++ ++ ++ False ++ ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ 2 ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ False ++ gtk-dialog-warning ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ False ++ Mislabeled files exist ++ ++ ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ Show mislabeled files only ++ True ++ False ++ 0 ++ True ++ ++ ++ ++ False ++ False ++ 1 ++ ++ ++ ++ ++ 1 ++ 2 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ Filter ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ 170 ++ True ++ True ++ ● ++ 25 ++ none ++ gtk-find ++ False ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ Show Modified Only ++ True ++ True ++ False ++ 0 ++ True ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ executable_files_treemodelsort ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 355 ++ File Path ++ True ++ True ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ 70 ++ 70 ++ ++ ++ #00004e4e9999 ++ Fix Label ++ single ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 175 ++ SELinux File Type ++ True ++ True ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 75 ++ Class ++ True ++ True ++ 2 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ False ++ File path used to enter the 'selected domain'. ++ Executable Files ++ ++ ++ False ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ writable_files_treemodelsort ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 377 ++ File Path ++ True ++ True ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ 70 ++ 70 ++ ++ ++ #00004e4e9999 ++ Fix Label ++ single ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 163 ++ SELinux File Type ++ True ++ True ++ True ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 92 ++ Class ++ True ++ True ++ True ++ 2 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ True ++ False ++ Files to which the 'selected domain' can write. ++ Writable Files ++ ++ ++ 1 ++ False ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ application_filetypes_treemodelsort ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 215 ++ File Path ++ True ++ True ++ True ++ 0 ++ ++ ++ 0 ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ 70 ++ 70 ++ ++ ++ #00004e4e9999 ++ Fix Label ++ single ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 315 ++ Description ++ True ++ True ++ True ++ 1 ++ ++ ++ word-char ++ 305 ++ ++ ++ 1 ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ 75 ++ Class ++ True ++ True ++ True ++ 2 ++ ++ ++ 0 ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ True ++ False ++ File Types defined for the 'selected domain'. ++ Application File Types ++ ++ ++ 2 ++ False ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ True ++ False ++ 0 ++ ++ ++ Delete ++ True ++ False ++ True ++ True ++ ++ ++ ++ False ++ True ++ end ++ 0 ++ ++ ++ ++ ++ Modify ++ True ++ True ++ True ++ ++ ++ ++ False ++ True ++ end ++ 1 ++ ++ ++ ++ ++ Add ++ True ++ False ++ True ++ True ++ ++ ++ ++ False ++ True ++ end ++ 2 ++ ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ True ++ False ++ Files ++ ++ ++ 1 ++ False ++ ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ Filter ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ 170 ++ True ++ True ++ ● ++ 25 ++ none ++ gtk-find ++ False ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ Show Modified Only ++ True ++ True ++ False ++ 0.5 ++ True ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ out_network_treemodelsort ++ 0 ++ True ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ Port ++ True ++ True ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ Protocol ++ True ++ True ++ True ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ SELinux Port Type ++ True ++ True ++ True ++ True ++ 3 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ False ++ Network Ports to which the 'selected domain' is allowed to connect. ++ Outbound ++ ++ ++ False ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ True ++ in_network_treemodelsort ++ 0 ++ True ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ Port ++ True ++ True ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ Protocol ++ True ++ True ++ True ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ fixed ++ SELinux Port Type ++ True ++ True ++ True ++ 3 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ True ++ False ++ Network Ports to which the 'selected domain' is allowed to listen. ++ Inbound ++ ++ ++ 1 ++ False ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Delete ++ True ++ False ++ True ++ True ++ Delete an existing item ++ ++ ++ ++ False ++ True ++ end ++ 0 ++ ++ ++ ++ ++ Modify ++ True ++ True ++ True ++ Modify an existing item ++ ++ ++ ++ False ++ True ++ end ++ 1 ++ ++ ++ ++ ++ Add ++ True ++ False ++ True ++ True ++ Add a new item ++ ++ ++ ++ False ++ True ++ end ++ 2 ++ ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ True ++ False ++ Network ++ ++ ++ 2 ++ False ++ ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ Filter ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ 170 ++ True ++ True ++ ● ++ 25 ++ none ++ gtk-find ++ False ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ transitions_from_x_treemodelsort ++ ++ ++ ++ ++ ++ True ++ autosize ++ Boolean ++Enabled ++ True ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ Executable File Path ++ True ++ True ++ True ++ 1 ++ ++ ++ ++ 2 ++ 2 ++ ++ ++ ++ ++ 0 ++ ++ ++ ++ 5 ++ ++ ++ ++ ++ ++ ++ True ++ SELinux Application Type ++ True ++ True ++ True ++ 2 ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ False ++ Executables which will transition to a different domain, when the 'selected domain' executes them. ++ 1 ++ 1 ++ Applicaton Transitions From 'select domain' ++ ++ ++ 1 ++ False ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ transitions_into_x_treemodelsort ++ ++ ++ ++ ++ ++ True ++ Boolean ++Enabled ++ True ++ True ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ True ++ Calling Process Domain ++ True ++ True ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ True ++ Executable File ++ True ++ True ++ True ++ 1 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ True ++ False ++ Executables which will transition to the 'selected domain', when executing a selected domains entrypoint. ++ Application Transitions Into 'select domain' ++ ++ ++ 1 ++ False ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ File_transitions_treemodel_sort ++ ++ ++ ++ ++ ++ SELinux Directory Type ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ Destination Class ++ descending ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ SELinux Destination Type ++ 2 ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ File Name ++ 3 ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ True ++ False ++ File Transitions From 'select domain' ++ ++ ++ 2 ++ False ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ True ++ False ++ Transitions ++ ++ ++ 3 ++ False ++ ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ False ++ ++ ++ True ++ False ++ 0 ++ out ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ 0.05000000074505806 ++ Select the system mode when the system first boots up ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Enforcing ++ True ++ True ++ False ++ 50 ++ 0 ++ 0.50999999046325684 ++ True ++ True ++ ++ ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ Permissive ++ True ++ True ++ False ++ 0 ++ True ++ Enforcing_button_default ++ ++ ++ ++ False ++ False ++ 1 ++ ++ ++ ++ ++ Disabled ++ True ++ True ++ False ++ 0 ++ True ++ Enforcing_button_default ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ True ++ False ++ 0.05000000074505806 ++ Select the system mode for the current session ++ ++ ++ 2 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Enforcing ++ True ++ True ++ False ++ 100 ++ 0 ++ True ++ True ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ Permissive ++ True ++ True ++ False ++ 0 ++ True ++ Enforcing_button ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ True ++ True ++ 0.019999999552965164 ++ Advanced >> ++ True ++ end ++ ++ ++ ++ ++ ++ ++ 4 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ False ++ 5 ++ 0 ++ System Policy Type: ++ 15 ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ 200 ++ False ++ 10 ++ system_policy_type_liststore ++ ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ 5 ++ ++ ++ ++ ++ ++ ++ True ++ False ++ <b>System Mode</b> ++ True ++ ++ ++ ++ ++ False ++ True ++ 10 ++ 0 ++ ++ ++ ++ ++ True ++ False ++ 0 ++ out ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ Import system settings from another machine ++ ++ ++ ++ ++ ++ ++ ++ Import ++ 65 ++ True ++ True ++ True ++ ++ ++ ++ 1 ++ ++ 10 ++ ++ ++ ++ ++ True ++ False ++ Export system settings to a file ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ Export ++ 65 ++ True ++ True ++ True ++ ++ ++ ++ 1 ++ 1 ++ ++ 10 ++ ++ ++ ++ ++ True ++ False ++ Relabel all files back to system defaults on reboot ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ Relabel ++ True ++ True ++ True ++ ++ ++ ++ 1 ++ 3 ++ ++ 10 ++ ++ ++ ++ ++ ++ ++ True ++ False ++ <b>System Configuration</b> ++ True ++ ++ ++ ++ ++ False ++ True ++ 1 ++ ++ ++ ++ ++ True ++ True ++ 2 ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Revert ++ True ++ True ++ True ++ Reset to system default ++ ++ ++ ++ False ++ True ++ end ++ 0 ++ ++ ++ ++ ++ Update ++ True ++ True ++ True ++ Save your changes ++ ++ ++ ++ False ++ True ++ end ++ 1 ++ ++ ++ ++ ++ False ++ False ++ 2 ++ ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ True ++ False ++ 2 ++ ++ ++ False ++ False ++ 1 ++ ++ ++ ++ ++ ++ ++ False ++ center-on-parent ++ 600 ++ 620 ++ SELinux_window ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ ++ ++ 210 ++ True ++ True ++ ● ++ gtk-find ++ False ++ ++ ++ ++ False ++ True ++ 10 ++ 0 ++ ++ ++ ++ ++ All ++ True ++ True ++ False ++ 0.5 ++ True ++ True ++ Installed_advanced_button ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ Installed ++ True ++ True ++ False ++ 0.5 ++ True ++ All_advanced_button ++ ++ ++ ++ True ++ True ++ 2 ++ ++ ++ ++ ++ False ++ True ++ 0 ++ ++ ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ advanced_treemodel_sort ++ ++ ++ ++ ++ ++ ++ Applications ++ True ++ 0 ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ Process Types ++ True ++ 1 ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ Select ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 2 ++ ++ ++ ++ ++ ++ ++ False ++ More Details ++ center-on-parent ++ 650 ++ 420 ++ SELinux_window ++ ++ ++ ++ True ++ True ++ in ++ ++ ++ True ++ True ++ booleans_more_detail_liststore ++ ++ ++ ++ ++ ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ False ++ Delete Modified File Labeling ++ True ++ center-on-parent ++ 450 ++ 320 ++ SELinux_window ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ 0 ++ 10 ++ Select file labeling to delete. File labeling will be deleted when update is applied. ++ fill ++ True ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ True ++ True ++ delete_files_liststore ++ ++ ++ ++ ++ ++ 20 ++ Select ++ True ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ 275 ++ File Path ++ True ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ 75 ++ SELinux File Label ++ True ++ True ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ 25 ++ Class ++ True ++ True ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Delete ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 0 ++ ++ ++ ++ ++ Cancel ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 1 ++ ++ ++ ++ ++ False ++ True ++ 2 ++ ++ ++ ++ ++ ++ ++ False ++ Delete Modified Ports ++ True ++ center-on-parent ++ 450 ++ 320 ++ SELinux_window ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ False ++ 0 ++ 10 ++ Select ports to delete. Ports will be deleted when update is applied. ++ fill ++ True ++ ++ ++ False ++ False ++ 0 ++ ++ ++ ++ ++ True ++ True ++ delete_network_liststore ++ False ++ 0 ++ ++ ++ ++ ++ ++ 20 ++ Select ++ True ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ 275 ++ Port ++ True ++ ++ ++ ++ 1 ++ ++ ++ ++ ++ ++ ++ 75 ++ Protocol ++ True ++ True ++ ++ ++ ++ 2 ++ ++ ++ ++ ++ ++ ++ 25 ++ SELinux Port Type ++ True ++ True ++ ++ ++ ++ 3 ++ ++ ++ ++ ++ ++ ++ True ++ True ++ 1 ++ ++ ++ ++ ++ True ++ False ++ ++ ++ Delete ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 0 ++ ++ ++ ++ ++ Cancel ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ end ++ 1 ++ ++ ++ ++ ++ False ++ True ++ 2 ++ ++ ++ ++ ++ ++ ++ False ++ More Types ++ True ++ center-on-parent ++ 440 ++ 250 ++ SELinux_window ++ ++ ++ ++ True ++ False ++ ++ ++ True ++ True ++ ++ ++ True ++ True ++ more_types_file_liststore ++ ++ ++ ++ ++ ++ ++ Types ++ ++ ++ ++ 0 ++ ++ ++ ++ ++ ++ ++ ++ ++ True ++ True ++ 0 ++ ++ ++ ++ ++ Select ++ True ++ True ++ True ++ ++ ++ ++ False ++ False ++ 1 ++ ++ ++ ++ ++ + + False + True @@ -522006,7 +522630,9 @@ index 0000000..da6318f + True + False + 0 ++ 10 + Review the updates you have made before committing them to the system. To reset an item, uncheck the checkbox. All items checked will be updated in the system when you select update. ++ fill + True + + @@ -522026,6 +522652,9 @@ index 0000000..da6318f + True + Update_treestore + 0 ++ ++ ++ + + + 20 @@ -522095,12 +522724,12 @@ index 0000000..da6318f + True + False + -+ -+ Cancel ++ ++ Apply + True + True + True -+ ++ + + + False @@ -522110,12 +522739,12 @@ index 0000000..da6318f + + + -+ -+ Apply ++ ++ Cancel + True + True + True -+ ++ + + + False @@ -522134,30 +522763,6 @@ index 0000000..da6318f + + + -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ writable_files_treestore -+ -+ -+ writable_files_treemodelfilter -+ + diff --git a/policycoreutils/sepolicy/sepolicy/templates/network.py b/policycoreutils/sepolicy/sepolicy/templates/network.py index 4499440..43feee4 100644 diff --git a/policycoreutils.spec b/policycoreutils.spec index a9e93f4..4033201 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -7,7 +7,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 2.1.14 -Release: 74%{?dist} +Release: 75%{?dist} License: GPLv2 Group: System Environment/Base # Based on git repository with tag 20101221 @@ -334,6 +334,10 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed Aug 7 2013 Dan Walsh - 2.1.14-75 +- Update sepolicy gui code, cleanups and add file transition tab +- Fix semanage fcontext -a --ftype code to work. + * Wed Aug 7 2013 Dan Walsh - 2.1.14-74 - If policy is not installed get_bools should not crash