* Thu Aug 23 2007 Dan Walsh <dwalsh@redhat.com> 2.0.25-1
- Update semodule man page * Fix genhomedircon searching for USER from Todd Miller * Install run_init with mode 0755 from Dan Walsh. * Fix chcat from Dan Walsh. * Fix fixfiles pattern expansion and error reporting from Dan Walsh. * Optimize genhomedircon to compile regexes once from Dan Walsh. * Fix semanage gettext call from Dan Walsh.
This commit is contained in:
Daniel J Walsh
parent
4bf679be9e
commit
32455f343f
@ -155,3 +155,4 @@ policycoreutils-2.0.20.tgz
|
|||||||
policycoreutils-2.0.21.tgz
|
policycoreutils-2.0.21.tgz
|
||||||
policycoreutils-2.0.22.tgz
|
policycoreutils-2.0.22.tgz
|
||||||
policycoreutils-2.0.23.tgz
|
policycoreutils-2.0.23.tgz
|
||||||
|
policycoreutils-2.0.25.tgz
|
||||||
|
|||||||
@ -36,68 +36,151 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po
|
|||||||
}
|
}
|
||||||
free(scontext);
|
free(scontext);
|
||||||
close(fd);
|
close(fd);
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/run_init/Makefile policycoreutils-2.0.23/run_init/Makefile
|
|
||||||
--- nsapolicycoreutils/run_init/Makefile 2007-07-16 14:20:41.000000000 -0400
|
|
||||||
+++ policycoreutils-2.0.23/run_init/Makefile 2007-08-22 16:29:22.000000000 -0400
|
|
||||||
@@ -34,8 +34,8 @@
|
|
||||||
install: all
|
|
||||||
test -d $(SBINDIR) || install -m 755 -d $(SBINDIR)
|
|
||||||
test -d $(MANDIR)/man1 || install -m 755 -d $(MANDIR)/man1
|
|
||||||
- install -m 555 run_init $(SBINDIR)
|
|
||||||
- install -m 555 open_init_pty $(SBINDIR)
|
|
||||||
+ install -m 755 run_init $(SBINDIR)
|
|
||||||
+ install -m 755 open_init_pty $(SBINDIR)
|
|
||||||
install -m 644 run_init.8 $(MANDIR)/man8/
|
|
||||||
install -m 644 open_init_pty.8 $(MANDIR)/man8/
|
|
||||||
ifeq (${PAMH}, /usr/include/security/pam_appl.h)
|
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.23/scripts/chcat
|
|
||||||
--- nsapolicycoreutils/scripts/chcat 2007-07-16 14:20:41.000000000 -0400
|
|
||||||
+++ policycoreutils-2.0.23/scripts/chcat 2007-08-22 16:29:22.000000000 -0400
|
|
||||||
@@ -77,7 +77,7 @@
|
|
||||||
|
|
||||||
if len(cats) > 0:
|
|
||||||
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
|
|
||||||
- else
|
|
||||||
+ else:
|
|
||||||
new_serange = "%s-%s" % (serange[0], top[0])
|
|
||||||
|
|
||||||
if add_ind:
|
|
||||||
@@ -155,7 +155,7 @@
|
|
||||||
|
|
||||||
if len(cats) > 0:
|
|
||||||
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
|
|
||||||
- else
|
|
||||||
+ else:
|
|
||||||
new_serange = "%s-%s" % (serange[0], top[0])
|
|
||||||
|
|
||||||
if add_ind:
|
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.23/scripts/fixfiles
|
|
||||||
--- nsapolicycoreutils/scripts/fixfiles 2007-07-16 14:20:41.000000000 -0400
|
|
||||||
+++ policycoreutils-2.0.23/scripts/fixfiles 2007-08-22 16:29:22.000000000 -0400
|
|
||||||
@@ -88,7 +88,7 @@
|
|
||||||
esac; \
|
|
||||||
fi; \
|
|
||||||
done | \
|
|
||||||
- while read pattern ; do find $pattern \
|
|
||||||
+ while read pattern ; do sh -c "find $pattern" \
|
|
||||||
! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \
|
|
||||||
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \
|
|
||||||
done 2> /dev/null | \
|
|
||||||
@@ -108,6 +108,7 @@
|
|
||||||
|
|
||||||
rpmlist() {
|
|
||||||
rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
|
|
||||||
+[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.23/scripts/genhomedircon
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.23/scripts/genhomedircon
|
||||||
--- nsapolicycoreutils/scripts/genhomedircon 2007-07-16 14:20:41.000000000 -0400
|
--- nsapolicycoreutils/scripts/genhomedircon 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ policycoreutils-2.0.23/scripts/genhomedircon 2007-08-23 10:08:04.000000000 -0400
|
+++ policycoreutils-2.0.23/scripts/genhomedircon 2007-08-23 10:08:04.000000000 -0400
|
||||||
@@ -139,7 +139,22 @@
|
@@ -0,0 +1,404 @@
|
||||||
self.default_user = "user_u"
|
+#! /usr/bin/python -E
|
||||||
self.default_prefix = "user"
|
+# Copyright (C) 2004 Tresys Technology, LLC
|
||||||
self.users = self.getUsers()
|
+# see file 'COPYING' for use and warranty information
|
||||||
|
+#
|
||||||
|
+# genhomedircon - this script is used to generate file context
|
||||||
|
+# configuration entries for user home directories based on their
|
||||||
|
+# default prefixes and is run when building the policy. Specifically, we
|
||||||
|
+# replace HOME_ROOT, HOME_DIR, and ROLE macros in .fc files with
|
||||||
|
+# generic and user-specific values.
|
||||||
|
+#
|
||||||
|
+# Based off original script by Dan Walsh, <dwalsh@redhat.com>
|
||||||
|
+#
|
||||||
|
+# ASSUMPTIONS:
|
||||||
|
+#
|
||||||
|
+# The file CONTEXTDIR/files/homedir_template exists. This file is used to
|
||||||
|
+# set up the home directory context for each real user.
|
||||||
|
+#
|
||||||
|
+# If a user is not listed in CONTEXTDIR/seusers, he will default to user_u, prefix user
|
||||||
|
+#
|
||||||
|
+# "Real" users (as opposed to system users) are those whose UID is greater than
|
||||||
|
+# or equal STARTING_UID (usually 500) and whose login is not a member of
|
||||||
|
+# EXCLUDE_LOGINS. Users who are explicitly defined in CONTEXTDIR/seusers
|
||||||
|
+# are always "real" (including root, in the default configuration).
|
||||||
|
+#
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+import sys, os, pwd, string, getopt, re
|
||||||
|
+from semanage import *;
|
||||||
|
+import selinux
|
||||||
|
+import gettext
|
||||||
|
+gettext.install('policycoreutils')
|
||||||
|
+
|
||||||
|
+def grep(file, var):
|
||||||
|
+ ret = ""
|
||||||
|
+ fd = open(file, 'r')
|
||||||
|
+
|
||||||
|
+ for i in fd.readlines():
|
||||||
|
+ if re.search(var, i, 0) != None:
|
||||||
|
+ ret = i
|
||||||
|
+ break
|
||||||
|
+ fd.close()
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+def findval(file, var, delim = ""):
|
||||||
|
+ val = ""
|
||||||
|
+ try:
|
||||||
|
+ fd = open(file, 'r')
|
||||||
|
+ for i in fd.readlines():
|
||||||
|
+ if i.startswith(var) == 1:
|
||||||
|
+ if delim == "":
|
||||||
|
+ val = i.split()[1]
|
||||||
|
+ else:
|
||||||
|
+ val = i.split(delim)[1]
|
||||||
|
+ val = val.split("#")[0]
|
||||||
|
+ val = val.strip()
|
||||||
|
+ fd.close()
|
||||||
|
+ except:
|
||||||
|
+ val = ""
|
||||||
|
+ return val
|
||||||
|
+
|
||||||
|
+def getStartingUID():
|
||||||
|
+ starting_uid = sys.maxint
|
||||||
|
+ uid_min = findval("/etc/login.defs", "UID_MIN")
|
||||||
|
+ if uid_min != "":
|
||||||
|
+ uid_min = uid_min.split("#")[0]
|
||||||
|
+ uid_min = uid_min.strip()
|
||||||
|
+ if int(uid_min) < starting_uid:
|
||||||
|
+ starting_uid = int(uid_min)
|
||||||
|
+
|
||||||
|
+ uid_min = findval("/etc/libuser.conf", "LU_UIDNUMBER", "=")
|
||||||
|
+ if uid_min != "":
|
||||||
|
+ uid_min = uid_min.split("#")[0]
|
||||||
|
+ uid_min = uid_min.strip()
|
||||||
|
+ if int(uid_min) < starting_uid:
|
||||||
|
+ starting_uid = int(uid_min)
|
||||||
|
+
|
||||||
|
+ if starting_uid == sys.maxint:
|
||||||
|
+ starting_uid = 500
|
||||||
|
+ return starting_uid
|
||||||
|
+
|
||||||
|
+def getDefaultHomeDir():
|
||||||
|
+ ret = []
|
||||||
|
+ homedir = findval("/etc/default/useradd", "HOME", "=")
|
||||||
|
+ if homedir != "" and not homedir in ret:
|
||||||
|
+ ret.append(homedir)
|
||||||
|
+
|
||||||
|
+ homedir = findval("/etc/libuser.conf", "LU_HOMEDIRECTORY", "=")
|
||||||
|
+ if homedir != "" and not homedir in ret:
|
||||||
|
+ ret.append(homedir)
|
||||||
|
+
|
||||||
|
+ if ret == []:
|
||||||
|
+ ret.append("/home")
|
||||||
|
+
|
||||||
|
+ # Add /export/home if it exists
|
||||||
|
+ # Some customers use this for automounted homedirs
|
||||||
|
+ if os.path.exists("/export/home"):
|
||||||
|
+ ret.append("/export/home")
|
||||||
|
+
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+def getSELinuxType(directory):
|
||||||
|
+ val = findval(directory+"/config", "SELINUXTYPE", "=")
|
||||||
|
+ if val != "":
|
||||||
|
+ return val
|
||||||
|
+ return "targeted"
|
||||||
|
+
|
||||||
|
+def usage(rc=0, error = ""):
|
||||||
|
+ if error != "":
|
||||||
|
+ sys.stderr.write("%s\n" % error)
|
||||||
|
+ rc = 1
|
||||||
|
+ sys.stderr.write("Usage: %s [ -d selinuxdir ] [-n | --nopasswd] [-t selinuxtype ]\n" % sys.argv[0])
|
||||||
|
+ sys.stderr.flush()
|
||||||
|
+ sys.exit(rc)
|
||||||
|
+
|
||||||
|
+def warning(warning = ""):
|
||||||
|
+ sys.stderr.write("%s\n" % warning)
|
||||||
|
+ sys.stderr.flush()
|
||||||
|
+
|
||||||
|
+def errorExit(error):
|
||||||
|
+ sys.stderr.write("%s exiting for: " % sys.argv[0])
|
||||||
|
+ sys.stderr.write("%s\n" % error)
|
||||||
|
+ sys.stderr.flush()
|
||||||
|
+ sys.exit(1)
|
||||||
|
+
|
||||||
|
+class selinuxConfig:
|
||||||
|
+ def __init__(self, selinuxdir = "/etc/selinux", type = "targeted", usepwd = 1):
|
||||||
|
+ self.semanageHandle = semanage_handle_create()
|
||||||
|
+ self.semanaged = semanage_is_managed(self.semanageHandle)
|
||||||
|
+ if self.semanaged:
|
||||||
|
+ rc = semanage_connect(self.semanageHandle)
|
||||||
|
+ if rc:
|
||||||
|
+ errorExit("Unable to connect to semanage")
|
||||||
|
+ (status, self.ulist) = semanage_user_list(self.semanageHandle)
|
||||||
|
+ self.type = type
|
||||||
|
+ self.selinuxdir = selinuxdir +"/"
|
||||||
|
+ self.contextdir = "/contexts"
|
||||||
|
+ self.filecontextdir = self.contextdir+"/files"
|
||||||
|
+ self.usepwd = usepwd
|
||||||
|
+ self.default_user = "user_u"
|
||||||
|
+ self.default_prefix = "user"
|
||||||
|
+ self.users = self.getUsers()
|
||||||
+ fd = open(self.getFileContextFile())
|
+ fd = open(self.getFileContextFile())
|
||||||
+ self.fclines=[]
|
+ self.fclines=[]
|
||||||
+ for i in fd.readlines():
|
+ for i in fd.readlines():
|
||||||
@ -111,59 +194,365 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po
|
|||||||
+ self.fclines.append(re.compile(regex))
|
+ self.fclines.append(re.compile(regex))
|
||||||
+ except:
|
+ except:
|
||||||
+ continue
|
+ continue
|
||||||
|
+
|
||||||
+ fd.close()
|
+ fd.close()
|
||||||
+
|
+
|
||||||
def getFileContextDir(self):
|
+ def getFileContextDir(self):
|
||||||
return self.selinuxdir+self.type+self.filecontextdir
|
+ return self.selinuxdir+self.type+self.filecontextdir
|
||||||
|
+
|
||||||
@@ -272,7 +287,7 @@
|
+ def getFileContextFile(self):
|
||||||
ret = ""
|
+ return self.getFileContextDir()+"/file_contexts"
|
||||||
fd = open(self.getHomeDirTemplate(), 'r')
|
+
|
||||||
for i in fd.readlines():
|
+ def getContextDir(self):
|
||||||
- if i.find("USER") == 1:
|
+ return self.selinuxdir+self.type+self.contextdir
|
||||||
|
+
|
||||||
|
+ def getHomeDirTemplate(self):
|
||||||
|
+ return self.getFileContextDir()+"/homedir_template"
|
||||||
|
+
|
||||||
|
+ def getHomeRootContext(self, homedir):
|
||||||
|
+ ret = ""
|
||||||
|
+ fd = open(self.getHomeDirTemplate(), 'r')
|
||||||
|
+
|
||||||
|
+ for i in fd.readlines():
|
||||||
|
+ if i.find("HOME_ROOT") == 0:
|
||||||
|
+ i = i.replace("HOME_ROOT", homedir)
|
||||||
|
+ ret += i
|
||||||
|
+ fd.close()
|
||||||
|
+ if ret == "":
|
||||||
|
+ errorExit("No Home Root Context Found")
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+ def heading(self):
|
||||||
|
+ ret = "\n#\n#\n# User-specific file contexts, generated via %s\n" % sys.argv[0]
|
||||||
|
+ if self.semanaged:
|
||||||
|
+ ret += "# use semanage command to manage system users in order to change the file_context\n#\n#\n"
|
||||||
|
+ else:
|
||||||
|
+ ret += "# edit %s to change file_context\n#\n#\n" % (self.selinuxdir+self.type+"/seusers")
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+ def get_default_prefix(self, name):
|
||||||
|
+ for user in self.ulist:
|
||||||
|
+ if semanage_user_get_name(user) == name:
|
||||||
|
+ return semanage_user_get_prefix(user)
|
||||||
|
+ return name
|
||||||
|
+
|
||||||
|
+ def get_old_prefix(self, user):
|
||||||
|
+ rc = grep(self.selinuxdir+self.type+"/users/system.users", "^user %s" % user)
|
||||||
|
+ if rc == "":
|
||||||
|
+ rc = grep(self.selinuxdir+self.type+"/users/local.users", "^user %s" % user)
|
||||||
|
+ if rc != "":
|
||||||
|
+ user = rc.split()
|
||||||
|
+ prefix = user[3]
|
||||||
|
+ if prefix == "{":
|
||||||
|
+ prefix = user[4]
|
||||||
|
+ if len(prefix) > 2 and (prefix[-2:] == "_r" or prefix[-2:] == "_u"):
|
||||||
|
+ prefix = prefix[:-2]
|
||||||
|
+ return prefix
|
||||||
|
+
|
||||||
|
+ def adduser(self, udict, user, seuser, prefix):
|
||||||
|
+ if seuser == self.default_user or user == "__default__" or user == "system_u":
|
||||||
|
+ return
|
||||||
|
+ # !!! chooses first prefix in the list to use in the file context !!!
|
||||||
|
+ try:
|
||||||
|
+ home = pwd.getpwnam(user)[5]
|
||||||
|
+ if home == "/":
|
||||||
|
+ # Probably install so hard code to /root
|
||||||
|
+ if user == "root":
|
||||||
|
+ home = "/root"
|
||||||
|
+ else:
|
||||||
|
+ return
|
||||||
|
+ except KeyError:
|
||||||
|
+ if user == "root":
|
||||||
|
+ home = "/root"
|
||||||
|
+ else:
|
||||||
|
+ sys.stderr.write("The user \"%s\" is not present in the passwd file, skipping...\n" % user)
|
||||||
|
+ return
|
||||||
|
+ prefs = {}
|
||||||
|
+ prefs["seuser"] = seuser
|
||||||
|
+ prefs["prefix"] = prefix
|
||||||
|
+ prefs["home"] = home
|
||||||
|
+ udict[user] = prefs
|
||||||
|
+
|
||||||
|
+ def setDefaultUser(self, user, prefix):
|
||||||
|
+ self.default_user = user
|
||||||
|
+ self.default_prefix = prefix
|
||||||
|
+
|
||||||
|
+ def getUsers(self):
|
||||||
|
+ udict = {}
|
||||||
|
+ if self.semanaged:
|
||||||
|
+ (status, list) = semanage_seuser_list(self.semanageHandle)
|
||||||
|
+ for seuser in list:
|
||||||
|
+ user = []
|
||||||
|
+ seusername = semanage_seuser_get_sename(seuser)
|
||||||
|
+ prefix = self.get_default_prefix(seusername)
|
||||||
|
+ if semanage_seuser_get_name(seuser) == "__default__":
|
||||||
|
+ self.setDefaultUser(seusername, prefix)
|
||||||
|
+
|
||||||
|
+ self.adduser(udict, semanage_seuser_get_name(seuser), seusername, prefix)
|
||||||
|
+
|
||||||
|
+ else:
|
||||||
|
+ try:
|
||||||
|
+ fd = open(self.selinuxdir+self.type+"/seusers")
|
||||||
|
+ for u in fd.readlines():
|
||||||
|
+ u = u.strip()
|
||||||
|
+ if len(u) == 0 or u[0] == "#":
|
||||||
|
+ continue
|
||||||
|
+ user = u.split(":")
|
||||||
|
+ if len(user) < 2:
|
||||||
|
+ continue
|
||||||
|
+
|
||||||
|
+ prefix = self.get_old_prefix(user[1])
|
||||||
|
+ self.adduser(udict, user[0], user[1], prefix)
|
||||||
|
+ fd.close()
|
||||||
|
+ except IOError, error:
|
||||||
|
+ # Must be install so force add of root
|
||||||
|
+ self.adduser(udict, "root", "root", "root")
|
||||||
|
+
|
||||||
|
+ return udict
|
||||||
|
+
|
||||||
|
+ def getHomeDirContext(self, user, seuser, home, prefix):
|
||||||
|
+ ret = "\n\n#\n# Home Context for user %s\n#\n\n" % user
|
||||||
|
+ fd = open(self.getHomeDirTemplate(), 'r')
|
||||||
|
+ for i in fd.readlines():
|
||||||
|
+ if i.startswith("HOME_DIR") == 1:
|
||||||
|
+ i = i.replace("HOME_DIR", home)
|
||||||
|
+ i = i.replace("ROLE", prefix)
|
||||||
|
+ i = i.replace("system_u", seuser)
|
||||||
|
+ # Validate if the generated context exists. Some user types may not exist
|
||||||
|
+ scon = i.split()[-1]
|
||||||
|
+ if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0:
|
||||||
|
+ ret = ret+i
|
||||||
|
+ fd.close()
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+ def getUserContext(self, user, sel_user, prefix):
|
||||||
|
+ ret = ""
|
||||||
|
+ fd = open(self.getHomeDirTemplate(), 'r')
|
||||||
|
+ for i in fd.readlines():
|
||||||
+ if i.find("USER") > 0:
|
+ if i.find("USER") > 0:
|
||||||
i = i.replace("USER", user)
|
+ i = i.replace("USER", user)
|
||||||
i = i.replace("ROLE", prefix)
|
+ i = i.replace("ROLE", prefix)
|
||||||
i = i.replace("system_u", sel_user)
|
+ i = i.replace("system_u", sel_user)
|
||||||
@@ -289,20 +304,9 @@
|
+ ret = ret+i
|
||||||
return ret+"\n"
|
+ fd.close()
|
||||||
|
+ return ret
|
||||||
def checkExists(self, home):
|
+
|
||||||
- fd = open(self.getFileContextFile())
|
+ def genHomeDirContext(self):
|
||||||
- for i in fd.readlines():
|
+ ret = ""
|
||||||
- if len(i) == 0:
|
+ # Fill in HOME and prefix for users that are defined
|
||||||
- continue
|
+ for u in self.users.keys():
|
||||||
|
+ ret += self.getHomeDirContext (u, self.users[u]["seuser"], self.users[u]["home"], self.users[u]["prefix"])
|
||||||
|
+ ret += self.getUserContext (u, self.users[u]["seuser"], self.users[u]["prefix"])
|
||||||
|
+ return ret+"\n"
|
||||||
|
+
|
||||||
|
+ def checkExists(self, home):
|
||||||
+ for i in self.fclines:
|
+ for i in self.fclines:
|
||||||
try:
|
+ try:
|
||||||
- regex = i.split()[0]
|
|
||||||
- #match a trailing .+
|
|
||||||
- regex = re.sub("\.+$", "", regex)
|
|
||||||
- regex = re.sub("\.\*$", "", regex)
|
|
||||||
- #strip a (/.*)? which matches anything trailing to a /*$ which matches trailing /'s
|
|
||||||
-
|
|
||||||
- regex = re.sub("\(\/\.\*\)\?", "", regex)
|
|
||||||
- regex = regex + "/*$"
|
|
||||||
- if re.search(regex,home, 0):
|
|
||||||
+ if i.match(home):
|
+ if i.match(home):
|
||||||
return 1
|
+ return 1
|
||||||
except:
|
+ except:
|
||||||
continue
|
+ continue
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.23/semanage/semanage
|
+ return 0
|
||||||
--- nsapolicycoreutils/semanage/semanage 2007-07-16 14:20:41.000000000 -0400
|
+
|
||||||
+++ policycoreutils-2.0.23/semanage/semanage 2007-08-22 16:29:22.000000000 -0400
|
+ def getHomeDirs(self):
|
||||||
@@ -34,7 +34,10 @@
|
+ homedirs = getDefaultHomeDir()
|
||||||
sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
|
+ starting_uid = getStartingUID()
|
||||||
|
+ if self.usepwd == 0:
|
||||||
|
+ return homedirs
|
||||||
|
+ ulist = pwd.getpwall()
|
||||||
|
+ for u in ulist:
|
||||||
|
+ if u[2] >= starting_uid and \
|
||||||
|
+ u[6] in VALID_SHELLS and \
|
||||||
|
+ u[5] != "/" and \
|
||||||
|
+ string.count(u[5], "/") > 1:
|
||||||
|
+ homedir = u[5][:string.rfind(u[5], "/")]
|
||||||
|
+ if not homedir in homedirs:
|
||||||
|
+ if self.checkExists(homedir) == 1:
|
||||||
|
+ warning("%s homedir %s or its parent directory conflicts with a\ndefined context in %s,\n%s will not create a new context. This usually indicates an incorrectly defined system account. If it is a system account please make sure its login shell is /sbin/nologin." % (u[0], u[5], self.getFileContextFile(), sys.argv[0]))
|
||||||
|
+ else:
|
||||||
|
+ homedirs.append(homedir)
|
||||||
|
+
|
||||||
|
+ homedirs.sort()
|
||||||
|
+ return homedirs
|
||||||
|
+
|
||||||
|
+ def genoutput(self):
|
||||||
|
+ ret = self.heading()
|
||||||
|
+ for h in self.getHomeDirs():
|
||||||
|
+ ret += self.getHomeDirContext (self.default_user, self.default_user, h+'/[^/]*', self.default_prefix)
|
||||||
|
+ ret += self.getHomeRootContext(h)
|
||||||
|
+ ret += self.getUserContext(".*", self.default_user, self.default_prefix) + "\n"
|
||||||
|
+ ret += self.genHomeDirContext()
|
||||||
|
+ return ret
|
||||||
|
+
|
||||||
|
+ def printout(self):
|
||||||
|
+ print self.genoutput()
|
||||||
|
+
|
||||||
|
+ def write(self):
|
||||||
|
+ fd = open(self.getFileContextDir()+"/file_contexts.homedirs", "w")
|
||||||
|
+ fd.write(self.genoutput())
|
||||||
|
+ fd.close()
|
||||||
|
+
|
||||||
|
+if os.getuid() > 0 or os.geteuid() > 0:
|
||||||
|
+ print _("You must be root to run %s.") % sys.argv[0]
|
||||||
|
+ sys.exit(1)
|
||||||
|
+
|
||||||
|
+try:
|
||||||
|
+ fd = open("/etc/shells", 'r')
|
||||||
|
+ VALID_SHELLS = fd.read().split("\n")
|
||||||
|
+ fd.close()
|
||||||
|
+ if "/sbin/nologin" in VALID_SHELLS:
|
||||||
|
+ VALID_SHELLS.remove("/sbin/nologin")
|
||||||
|
+ if "" in VALID_SHELLS:
|
||||||
|
+ VALID_SHELLS.remove("")
|
||||||
|
+except:
|
||||||
|
+ VALID_SHELLS = ['/bin/sh', '/bin/bash', '/bin/ash', '/bin/bsh', '/bin/ksh', '/usr/bin/ksh', '/usr/bin/pdksh', '/bin/tcsh', '/bin/csh', '/bin/zsh']
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# This script will generate home dir file context
|
||||||
|
+# based off the homedir_template file, entries in the password file, and
|
||||||
|
+#
|
||||||
|
+try:
|
||||||
|
+ usepwd = 1
|
||||||
|
+ directory = "/etc/selinux"
|
||||||
|
+ type = None
|
||||||
|
+ gopts, cmds = getopt.getopt(sys.argv[1:], 'hnd:t:', ['help',
|
||||||
|
+ 'type=',
|
||||||
|
+ 'nopasswd',
|
||||||
|
+ 'dir='])
|
||||||
|
+ for o,a in gopts:
|
||||||
|
+ if o == '--type' or o == "-t":
|
||||||
|
+ type = a
|
||||||
|
+ if o == '--nopasswd' or o == "-n":
|
||||||
|
+ usepwd = 0
|
||||||
|
+ if o == '--dir' or o == "-d":
|
||||||
|
+ directory = a
|
||||||
|
+ if o == '--help' or o == "-h":
|
||||||
|
+ usage()
|
||||||
|
+except getopt.error, error:
|
||||||
|
+ errorExit(_("Options Error %s ") % error)
|
||||||
|
+
|
||||||
|
+if type == None:
|
||||||
|
+ type = getSELinuxType(directory)
|
||||||
|
+
|
||||||
|
+if len(cmds) != 0:
|
||||||
|
+ usage(1)
|
||||||
|
+
|
||||||
|
+selconf = selinuxConfig(directory, type, usepwd)
|
||||||
|
+try:
|
||||||
|
+ selconf.write()
|
||||||
|
+except IOError, error:
|
||||||
|
+ sys.stderr.write("%s: %s\n" % ( sys.argv[0], error ))
|
||||||
|
+ sys.exit(1)
|
||||||
|
+
|
||||||
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon.8 policycoreutils-2.0.23/scripts/genhomedircon.8
|
||||||
|
--- nsapolicycoreutils/scripts/genhomedircon.8 1969-12-31 19:00:00.000000000 -0500
|
||||||
|
+++ policycoreutils-2.0.23/scripts/genhomedircon.8 2007-08-20 19:16:35.000000000 -0400
|
||||||
|
@@ -0,0 +1,82 @@
|
||||||
|
+.\" Hey, Emacs! This is an -*- nroff -*- source file.
|
||||||
|
+.\" Copyright (c) 2005 Manoj Srivastava <srivasta@debian.org>
|
||||||
|
+.\"
|
||||||
|
+.\" This is free documentation; you can redistribute it and/or
|
||||||
|
+.\" modify it under the terms of the GNU General Public License as
|
||||||
|
+.\" published by the Free Software Foundation; either version 2 of
|
||||||
|
+.\" the License, or (at your option) any later version.
|
||||||
|
+.\"
|
||||||
|
+.\" The GNU General Public License's references to "object code"
|
||||||
|
+.\" and "executables" are to be interpreted as the output of any
|
||||||
|
+.\" document formatting or typesetting system, including
|
||||||
|
+.\" intermediate and printed output.
|
||||||
|
+.\"
|
||||||
|
+.\" This manual is distributed in the hope that it will be useful,
|
||||||
|
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+.\" GNU General Public License for more details.
|
||||||
|
+.\"
|
||||||
|
+.\" You should have received a copy of the GNU General Public
|
||||||
|
+.\" License along with this manual; if not, write to the Free
|
||||||
|
+.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
|
||||||
|
+.\" USA.
|
||||||
|
+.\"
|
||||||
|
+.\"
|
||||||
|
+.TH GENHOMEDIRCON "8" "January 2005" "Security Enhanced Linux" ""
|
||||||
|
+.SH NAME
|
||||||
|
+genhomedircon \- generate SELinux file context configuration entries for user home directories
|
||||||
|
+.SH SYNOPSIS
|
||||||
|
+.B genhomedircon [ -d selinuxdir ] [-n | --nopasswd] [-t selinuxtype ] [-h]
|
||||||
|
+
|
||||||
|
+.SH OPTIONS
|
||||||
|
+.TP
|
||||||
|
+.B "\-h"
|
||||||
|
+Print a short usage message
|
||||||
|
+.TP
|
||||||
|
+.B "\-d selinuxdir (\-\-directory)"
|
||||||
|
+Directory where selinux files are installed defaults to /etc/selinux
|
||||||
|
+.TP
|
||||||
|
+.B
|
||||||
|
+\-n \-\-nopasswd
|
||||||
|
+Indicates to the utility not to read homedirectories out of the password database.
|
||||||
|
+.TP
|
||||||
|
+\-t selinuxtype (\-\-type)
|
||||||
|
+Indicates the selinux type of this install. Defaults to "targeted".
|
||||||
|
+.SH DESCRIPTION
|
||||||
|
+.PP
|
||||||
|
+This utility is used to generate file context configuration entries for
|
||||||
|
+user home directories based on their
|
||||||
|
+.B prefix
|
||||||
|
+entry in the the
|
||||||
|
+.B semanage user record.
|
||||||
|
+genhomedircon is run when building
|
||||||
|
+the policy. It is also run automaticaly when ever the
|
||||||
|
+.B semanage
|
||||||
|
+utility modifies
|
||||||
|
+.B user
|
||||||
|
+or
|
||||||
|
+.B login
|
||||||
|
+records.
|
||||||
|
+Specifically, we replace HOME_ROOT, HOME_DIR, and ROLE macros in the
|
||||||
|
+.I /etc/selinux/<<SELINUXTYPE>>/contexts/files/homedir_template
|
||||||
|
+file with generic and user-specific values. HOME_ROOT and HOME_DIR is replaced with each distinct location where login users homedirectories are located. Defaults to /home. ROLE is replaced based on the prefix entry in the
|
||||||
|
+.B user
|
||||||
|
+record.
|
||||||
|
+.PP
|
||||||
|
+genhomedircon searches through all password entires for all "login" user home directories, (as opposed
|
||||||
|
+to system users). Login users are those whose UID is greater than or equal
|
||||||
|
+.I STARTING_UID
|
||||||
|
+(default 500) and whose login shell is not "/sbin/nologin", or
|
||||||
|
+"/bin/false".
|
||||||
|
+.PP
|
||||||
|
+.SH AUTHOR
|
||||||
|
+This manual page was originally written by
|
||||||
|
+.I Manoj Srivastava <srivasta@debian.org>,
|
||||||
|
+for the Debian GNU/Linux system, based on the comments and the code
|
||||||
|
+in the utility, and then updated by Dan Walsh of Red Hat. The
|
||||||
|
+.B genhomedircon
|
||||||
|
+utility was originally written by
|
||||||
|
+.I Dan Walsh of Red Hat
|
||||||
|
+with some modifications by
|
||||||
|
+.I Tresys Technology, LLC.
|
||||||
|
+
|
||||||
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/Makefile policycoreutils-2.0.23/scripts/Makefile
|
||||||
|
--- nsapolicycoreutils/scripts/Makefile 2007-08-23 16:52:26.000000000 -0400
|
||||||
|
+++ policycoreutils-2.0.23/scripts/Makefile 2007-08-20 19:16:35.000000000 -0400
|
||||||
|
@@ -5,14 +5,18 @@
|
||||||
|
MANDIR ?= $(PREFIX)/share/man
|
||||||
|
LOCALEDIR ?= /usr/share/locale
|
||||||
|
|
||||||
try:
|
-all: fixfiles
|
||||||
- gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
|
+TARGETS=genhomedircon
|
||||||
+ gettext.install(PROGNAME,
|
+
|
||||||
+ localedir="/usr/share/locale",
|
+all: $(TARGETS) fixfiles
|
||||||
+ unicode=False,
|
|
||||||
+ codeset = 'utf-8')
|
install: all
|
||||||
except IOError:
|
-mkdir -p $(BINDIR)
|
||||||
import __builtin__
|
+ install -m 755 $(TARGETS) $(SBINDIR)
|
||||||
__builtin__.__dict__['_'] = unicode
|
install -m 755 chcat $(BINDIR)
|
||||||
|
install -m 755 fixfiles $(DESTDIR)/sbin
|
||||||
|
-mkdir -p $(MANDIR)/man8
|
||||||
|
install -m 644 fixfiles.8 $(MANDIR)/man8/
|
||||||
|
+ install -m 644 genhomedircon.8 $(MANDIR)/man8/
|
||||||
|
install -m 644 chcat.8 $(MANDIR)/man8/
|
||||||
|
|
||||||
|
clean:
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.23/semanage/seobject.py
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.23/semanage/seobject.py
|
||||||
--- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400
|
--- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400
|
||||||
+++ policycoreutils-2.0.23/semanage/seobject.py 2007-08-22 16:29:22.000000000 -0400
|
+++ policycoreutils-2.0.23/semanage/seobject.py 2007-08-22 16:29:22.000000000 -0400
|
||||||
|
|||||||
@ -5,8 +5,8 @@
|
|||||||
%define sepolgenver 1.0.8
|
%define sepolgenver 1.0.8
|
||||||
Summary: SELinux policy core utilities
|
Summary: SELinux policy core utilities
|
||||||
Name: policycoreutils
|
Name: policycoreutils
|
||||||
Version: 2.0.23
|
Version: 2.0.25
|
||||||
Release: 2%{?dist}
|
Release: 1%{?dist}
|
||||||
License: GPL
|
License: GPL
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
|
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
|
||||||
@ -193,6 +193,15 @@ if [ "$1" -ge "1" ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Aug 23 2007 Dan Walsh <dwalsh@redhat.com> 2.0.25-1
|
||||||
|
- Update semodule man page
|
||||||
|
* Fix genhomedircon searching for USER from Todd Miller
|
||||||
|
* Install run_init with mode 0755 from Dan Walsh.
|
||||||
|
* Fix chcat from Dan Walsh.
|
||||||
|
* Fix fixfiles pattern expansion and error reporting from Dan Walsh.
|
||||||
|
* Optimize genhomedircon to compile regexes once from Dan Walsh.
|
||||||
|
* Fix semanage gettext call from Dan Walsh.
|
||||||
|
|
||||||
* Thu Aug 23 2007 Dan Walsh <dwalsh@redhat.com> 2.0.23-2
|
* Thu Aug 23 2007 Dan Walsh <dwalsh@redhat.com> 2.0.23-2
|
||||||
- Update semodule man page
|
- Update semodule man page
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user