From a33870f392c5ba522407ceb46301879d85d5f263 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 24 Sep 2007 20:43:32 +0000 Subject: [PATCH] * Mon Sep 24 2007 Dan Walsh 2.0.26-3 - Show local changes with semanage --- policycoreutils-rhat.patch | 393 +++++++++++++++++++++++++++++++++++-- policycoreutils.spec | 5 +- 2 files changed, 384 insertions(+), 14 deletions(-) diff --git a/policycoreutils-rhat.patch b/policycoreutils-rhat.patch index bfeaa27..ea76c72 100644 --- a/policycoreutils-rhat.patch +++ b/policycoreutils-rhat.patch @@ -36,9 +36,151 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po } free(scontext); close(fd); +diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.26/semanage/semanage +--- nsapolicycoreutils/semanage/semanage 2007-08-23 16:52:26.000000000 -0400 ++++ policycoreutils-2.0.26/semanage/semanage 2007-09-24 16:41:52.000000000 -0400 +@@ -48,13 +48,14 @@ + + def usage(message = ""): + print _('\ +-semanage {login|user|port|interface|fcontext|translation} -l [-n] \n\ ++semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\ + semanage login -{a|d|m} [-sr] login_name\n\ + semanage user -{a|d|m} [-LrRP] selinux_name\n\ + semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\ + semanage interface -{a|d|m} [-tr] interface_spec\n\ + semanage fcontext -{a|d|m} [-frst] file_spec\n\ + semanage translation -{a|d|m} [-T] level\n\n\ ++semanage boolean -{d|m} boolean\n\n\ + \ + Primary Options:\n\ + \ +@@ -62,6 +63,8 @@ + -d, --delete Delete a OBJECT record NAME\n\ + -m, --modify Modify a OBJECT record NAME\n\ + -l, --list List the OBJECTS\n\n\ ++ -C, --locallist List OBJECTS local customizations\n\n\ ++ -D, --deleteall Remove all OBJECTS local customizations\n\ + \ + -h, --help Display this message\n\ + -n, --noheading Do not print heading when listing OBJECTS\n\n\ +@@ -98,7 +101,7 @@ + + def get_options(): + valid_option={} +- valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading' ] ++ valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-C', '--locallist', '-D', '--deleteall'] + valid_option["login"] = [] + valid_option["login"] += valid_everyone + [ '-s', '--seuser', '-r', '--range'] + valid_option["user"] = [] +@@ -111,6 +114,8 @@ + valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] + valid_option["translation"] = [] + valid_option["translation"] += valid_everyone + [ '-T', '--trans' ] ++ valid_option["boolean"] = [] ++ valid_option["boolean"] += valid_everyone + return valid_option + + # +@@ -134,7 +139,9 @@ + add = 0 + modify = 0 + delete = 0 ++ deleteall = 0 + list = 0 ++ locallist = 0 + if len(sys.argv) < 3: + usage(_("Requires 2 or more arguments")) + +@@ -146,14 +153,16 @@ + args = sys.argv[2:] + + gopts, cmds = getopt.getopt(args, +- 'adf:lhmnp:s:R:L:r:t:T:P:', ++ 'adf:lhmnp:s:CDR:L:r:t:T:P:', + ['add', + 'delete', ++ 'deleteall', + 'ftype=', + 'help', + 'list', + 'modify', + 'noheading', ++ 'localist', + 'proto=', + 'seuser=', + 'range=', +@@ -177,6 +186,10 @@ + if modify or add: + usage() + delete = 1 ++ if o == "-D" or o == "--deleteall": ++ if modify: ++ usage() ++ deleteall = 1 + if o == "-f" or o == "--ftype": + ftype=a + if o == "-h" or o == "--help": +@@ -185,6 +198,9 @@ + if o == "-n" or o == "--noheading": + heading=0 + ++ if o == "-C" or o == "--locallist": ++ locallist=1 ++ + if o == "-m"or o == "--modify": + if delete or add: + usage() +@@ -236,17 +252,24 @@ + if object == "fcontext": + OBJECT = seobject.fcontextRecords() + ++ if object == "boolean": ++ OBJECT = seobject.booleanRecords() ++ + if object == "translation": + OBJECT = seobject.setransRecords() + + if list: +- OBJECT.list(heading) ++ OBJECT.list(heading, locallist) ++ sys.exit(0); ++ ++ if deleteall: ++ OBJECT.deleteall() + sys.exit(0); + + if len(cmds) != 1: + usage() +- +- target = cmds[0] ++ ++ target = cmds[0] + + if add: + if object == "login": +@@ -274,6 +297,9 @@ + sys.exit(0); + + if modify: ++ if object == "boolean": ++ OBJECT.modify(target, value) ++ + if object == "login": + OBJECT.modify(target, seuser, serange) + diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.26/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400 -+++ policycoreutils-2.0.26/semanage/seobject.py 2007-09-18 16:40:57.000000000 -0400 ++++ policycoreutils-2.0.26/semanage/seobject.py 2007-09-24 16:42:14.000000000 -0400 +@@ -170,7 +170,7 @@ + rec += "%s=%s\n" % (k, self.ddict[k]) + return rec + +- def list(self,heading = 1): ++ def list(self,heading = 1, locallist = 0): + if heading: + print "\n%-25s %s\n" % (_("Level"), _("Translation")) + keys = self.ddict.keys() @@ -210,6 +210,7 @@ os.write(fd, self.out()) os.close(fd) @@ -47,7 +189,131 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po class semanageRecords: def __init__(self): -@@ -1024,14 +1025,31 @@ +@@ -389,10 +390,12 @@ + mylog.log(1,"delete SELinux user mapping", name); + semanage_seuser_key_free(k) + +- +- def get_all(self): ++ def get_all(self, locallist = 0): + ddict = {} +- (rc, self.ulist) = semanage_seuser_list(self.sh) ++ if locallist: ++ (rc, self.ulist) = semanage_seuser_list_local(self.sh) ++ else: ++ (rc, self.ulist) = semanage_seuser_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list login mappings")) + +@@ -401,8 +404,8 @@ + ddict[name] = (semanage_seuser_get_sename(u), semanage_seuser_get_mlsrange(u)) + return ddict + +- def list(self,heading = 1): +- ddict = self.get_all() ++ def list(self,heading = 1, locallist = 0): ++ ddict = self.get_all(locallist) + keys = ddict.keys() + keys.sort() + if is_mls_enabled == 1: +@@ -601,9 +604,12 @@ + mylog.log(1,"delete SELinux user record", name) + semanage_user_key_free(k) + +- def get_all(self): ++ def get_all(self, locallist = 0): + ddict = {} +- (rc, self.ulist) = semanage_user_list(self.sh) ++ if locallist: ++ (rc, self.ulist) = semanage_user_list_local(self.sh) ++ else: ++ (rc, self.ulist) = semanage_user_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list SELinux users")) + +@@ -618,8 +624,8 @@ + + return ddict + +- def list(self, heading = 1): +- ddict = self.get_all() ++ def list(self, heading = 1, locallist = 0): ++ ddict = self.get_all(locallist) + keys = ddict.keys() + keys.sort() + if is_mls_enabled == 1: +@@ -795,9 +801,12 @@ + + semanage_port_key_free(k) + +- def get_all(self): ++ def get_all(self, locallist = 0): + ddict = {} +- (rc, self.plist) = semanage_port_list(self.sh) ++ if locallist: ++ (rc, self.plist) = semanage_port_list_local(self.sh) ++ else: ++ (rc, self.plist) = semanage_port_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list ports")) + +@@ -814,9 +823,12 @@ + ddict[(low, high)] = (ctype, proto_str, level) + return ddict + +- def get_all_by_type(self): ++ def get_all_by_type(self, locallist = 0): + ddict = {} +- (rc, self.plist) = semanage_port_list(self.sh) ++ if locallist: ++ (rc, self.plist) = semanage_port_list_local(self.sh) ++ else: ++ (rc, self.plist) = semanage_port_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list ports")) + +@@ -837,10 +849,10 @@ + ddict[(ctype,proto_str)].append("%d-%d" % (low, high)) + return ddict + +- def list(self, heading = 1): ++ def list(self, heading = 1, locallist = 0): + if heading: + print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number")) +- ddict = self.get_all_by_type() ++ ddict = self.get_all_by_type(locallist) + keys = ddict.keys() + keys.sort() + for i in keys: +@@ -995,9 +1007,12 @@ + + semanage_iface_key_free(k) + +- def get_all(self): ++ def get_all(self, locallist = 0): + ddict = {} +- (rc, self.ilist) = semanage_iface_list(self.sh) ++ if locallist: ++ (rc, self.ilist) = semanage_iface_list_local(self.sh) ++ else: ++ (rc, self.ilist) = semanage_iface_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list interfaces")) + +@@ -1007,10 +1022,10 @@ + + return ddict + +- def list(self, heading = 1): ++ def list(self, heading = 1, locallist = 0): + if heading: + print "%-30s %s\n" % (_("SELinux Interface"), _("Context")) +- ddict = self.get_all() ++ ddict = self.get_all(locallist) + keys = ddict.keys() + keys.sort() + if is_mls_enabled: +@@ -1024,14 +1039,31 @@ def __init__(self): semanageRecords.__init__(self) @@ -84,14 +350,16 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po if type == "": raise ValueError(_("SELinux Type is required")) -@@ -1051,33 +1069,23 @@ +@@ -1051,33 +1083,23 @@ raise ValueError(_("Could not create file context for %s") % target) rc = semanage_fcontext_set_expr(self.sh, fcontext, target) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: - raise ValueError(_("Could not create context for %s") % target) -- ++ if type != "<>": ++ con = self.createcon(target, seuser) + - rc = semanage_context_set_user(self.sh, con, seuser) - if rc < 0: - raise ValueError(_("Could not set user in file context for %s") % target) @@ -103,9 +371,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: - raise ValueError(_("Could not set type in file context for %s") % target) -+ if type != "<>": -+ con = self.createcon(target, seuser) - +- - if serange != "": - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: @@ -131,7 +397,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) -@@ -1090,7 +1098,8 @@ +@@ -1090,7 +1112,8 @@ if rc < 0: raise ValueError(_("Could not add file context for %s") % target) @@ -141,7 +407,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po semanage_fcontext_key_free(k) semanage_fcontext_free(fcontext) -@@ -1112,16 +1121,29 @@ +@@ -1112,16 +1135,29 @@ if rc < 0: raise ValueError(_("Could not query file context for %s") % target) @@ -180,7 +446,96 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po if rc < 0: raise ValueError(_("Could not start semanage transaction")) -@@ -1283,9 +1305,12 @@ +@@ -1167,17 +1203,20 @@ + + semanage_fcontext_key_free(k) + +- def get_all(self): ++ def get_all(self, locallist = 0): + l = [] +- (rc, self.flist) = semanage_fcontext_list(self.sh) +- if rc < 0: +- raise ValueError(_("Could not list file contexts")) +- +- (rc, fclocal) = semanage_fcontext_list_local(self.sh) +- if rc < 0: +- raise ValueError(_("Could not list local file contexts")) ++ if locallist: ++ (rc, self.flist) = semanage_fcontext_list_local(self.sh) ++ else: ++ (rc, self.flist) = semanage_fcontext_list(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not list file contexts")) ++ ++ (rc, fclocal) = semanage_fcontext_list_local(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not list local file contexts")) + +- self.flist += fclocal ++ self.flist += fclocal + + for fcontext in self.flist: + expr = semanage_fcontext_get_expr(fcontext) +@@ -1191,10 +1230,10 @@ + + return l + +- def list(self, heading = 1): ++ def list(self, heading = 1, locallist = 0 ): + if heading: + print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context")) +- fcon_list = self.get_all() ++ fcon_list = self.get_all(locallist) + for fcon in fcon_list: + if len(fcon) > 3: + if is_mls_enabled: +@@ -1266,34 +1305,62 @@ + if rc < 0: + raise ValueError(_("Could not start semanage transaction")) + +- rc = semanage_fcontext_del_local(self.sh, k) ++ rc = semanage_bool_del_local(self.sh, k) + if rc < 0: + raise ValueError(_("Could not delete boolean %s") % name) + + rc = semanage_commit(self.sh) + if rc < 0: + raise ValueError(_("Could not delete boolean %s") % name) +- + semanage_bool_key_free(k) + +- def get_all(self): ++ def deleteall(self): ++ (rc, self.blist) = semanage_bool_list_local(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not list booleans")) ++ ++ rc = semanage_begin_transaction(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not start semanage transaction")) ++ ++ for boolean in self.blist: ++ name = semanage_bool_get_name(boolean) ++ (rc,k) = semanage_bool_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) ++ ++ rc = semanage_bool_del_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not delete boolean %s") % name) ++ semanage_bool_key_free(k) ++ ++ rc = semanage_commit(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not delete boolean %s") % name) ++ def get_all(self, locallist = 0): + ddict = {} +- (rc, self.blist) = semanage_bool_list(self.sh) ++ if locallist: ++ (rc, self.blist) = semanage_bool_list_local(self.sh) ++ else: ++ (rc, self.blist) = semanage_bool_list(self.sh) + if rc < 0: raise ValueError(_("Could not list booleans")) for boolean in self.blist: @@ -189,13 +544,25 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po - ddict[name] = value + value = [] + name = semanage_bool_get_name(boolean) -+ value[0] = semanage_bool_get_value(boolean) -+ value[1] = selinux.security_get_boolean_pending(boolean) -+ value[2] = selinux.security_get_boolean_active(boolean) ++ value.append(semanage_bool_get_value(boolean)) ++ value.append(selinux.security_get_boolean_pending(name)) ++ value.append(selinux.security_get_boolean_active(name)) + ddict[name] = value return ddict +- def list(self, heading = 1): ++ def list(self, heading = 1, locallist = 0): + if heading: +- print "%-50s %-18s\n" % (_("SELinux boolean"), _("value")) +- ddict = self.get_all() ++ print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") ) ++ ddict = self.get_all(locallist) + keys = ddict.keys() + for k in keys: + if ddict[k]: +- print "%-50s %-18s " % (k[0], ddict[k][0]) ++ print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2]) diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.26/semodule/semodule.8 --- nsapolicycoreutils/semodule/semodule.8 2007-07-16 14:20:42.000000000 -0400 +++ policycoreutils-2.0.26/semodule/semodule.8 2007-09-18 16:40:57.000000000 -0400 diff --git a/policycoreutils.spec b/policycoreutils.spec index 75441c0..588ff03 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -6,7 +6,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 2.0.26 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ Group: System Environment/Base Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz @@ -199,6 +199,9 @@ if [ "$1" -ge "1" ]; then fi %changelog +* Mon Sep 24 2007 Dan Walsh 2.0.26-3 +- Show local changes with semanage + * Mon Sep 24 2007 Dan Walsh 2.0.26-2 - Fixed spelling mistakes in booleans defs - Update po