* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-4
- Fixes for multiple transactions
This commit is contained in:
Daniel J Walsh
parent
c7da14e85c
commit
b0592a727f
@ -1,4 +1,4 @@
|
||||
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile
|
||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile
|
||||
--- nsapolicycoreutils/Makefile 2008-08-05 09:58:35.000000000 -0400
|
||||
+++ policycoreutils-2.0.54/Makefile 2008-08-06 18:05:28.000000000 -0400
|
||||
@@ -1,4 +1,4 @@
|
||||
@ -7,7 +7,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
|
||||
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
|
||||
|
||||
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf
|
||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf
|
||||
--- nsapolicycoreutils/restorecond/restorecond.conf 2008-08-05 09:58:27.000000000 -0400
|
||||
+++ policycoreutils-2.0.54/restorecond/restorecond.conf 2008-08-06 18:05:28.000000000 -0400
|
||||
@@ -1,3 +1,4 @@
|
||||
@ -15,7 +15,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
/etc/resolv.conf
|
||||
/etc/samba/secrets.tdb
|
||||
/etc/mtab
|
||||
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage
|
||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage
|
||||
--- nsapolicycoreutils/semanage/semanage 2008-08-05 09:58:26.000000000 -0400
|
||||
+++ policycoreutils-2.0.54/semanage/semanage 2008-08-07 08:18:35.000000000 -0400
|
||||
@@ -20,7 +20,7 @@
|
||||
@ -326,9 +326,9 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
errorExit(error.args[1])
|
||||
- except KeyboardInterrupt, error:
|
||||
- sys.exit(0)
|
||||
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py
|
||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py
|
||||
--- nsapolicycoreutils/semanage/seobject.py 2008-08-05 09:58:26.000000000 -0400
|
||||
+++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-06 18:07:21.000000000 -0400
|
||||
+++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-07 10:57:22.000000000 -0400
|
||||
@@ -26,7 +26,6 @@
|
||||
PROGNAME="policycoreutils"
|
||||
import sepolgen.module as module
|
||||
@ -401,17 +401,18 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
- if not self.semanaged:
|
||||
- semanage_handle_destroy(self.sh)
|
||||
- raise ValueError(_("SELinux policy is not managed or store cannot be accessed."))
|
||||
-
|
||||
- rc = semanage_access_check(self.sh)
|
||||
- if rc < SEMANAGE_CAN_READ:
|
||||
- semanage_handle_destroy(self.sh)
|
||||
- raise ValueError(_("Cannot read policy store."))
|
||||
+ if handle != None:
|
||||
+ self.transaction = True
|
||||
+ self.sh = handle
|
||||
+ else:
|
||||
+ self.sh=get_handle(store)
|
||||
+ self.transaction = False
|
||||
|
||||
- rc = semanage_access_check(self.sh)
|
||||
- if rc < SEMANAGE_CAN_READ:
|
||||
- semanage_handle_destroy(self.sh)
|
||||
- raise ValueError(_("Cannot read policy store."))
|
||||
+
|
||||
+ def deleteall(self):
|
||||
+ raise ValueError(_("Not yet implemented"))
|
||||
|
||||
@ -420,15 +421,15 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
+ if self.transaction:
|
||||
+ return
|
||||
+ rc = semanage_begin_transaction(self.sh)
|
||||
if rc < 0:
|
||||
- semanage_handle_destroy(self.sh)
|
||||
- raise ValueError(_("Could not establish semanage connection"))
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not start semanage transaction"))
|
||||
+ def commit(self):
|
||||
+ if self.transaction:
|
||||
+ return
|
||||
+ rc = semanage_commit(self.sh)
|
||||
+ if rc < 0:
|
||||
if rc < 0:
|
||||
- semanage_handle_destroy(self.sh)
|
||||
- raise ValueError(_("Could not establish semanage connection"))
|
||||
+ raise ValueError(_("Could not commit semanage transaction"))
|
||||
+
|
||||
+class permissiveRecords(semanageRecords):
|
||||
@ -450,13 +451,21 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
for root, dirs, files in os.walk("tmp", topdown=False):
|
||||
for name in files:
|
||||
os.remove(os.path.join(root, name))
|
||||
@@ -335,9 +364,8 @@
|
||||
rc = semanage_module_remove(self.sh, "permissive_%s" % n)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
|
||||
@@ -331,13 +360,12 @@
|
||||
os.rmdir(os.path.join(root, name))
|
||||
|
||||
def delete(self, name):
|
||||
- for n in name.split():
|
||||
- rc = semanage_module_remove(self.sh, "permissive_%s" % n)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
|
||||
+ for n in name.split():
|
||||
+ rc = semanage_module_remove(self.sh, "permissive_%s" % n)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
|
||||
+
|
||||
+ self.commit()
|
||||
|
||||
@ -511,7 +520,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
(rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
@@ -425,30 +424,26 @@
|
||||
@@ -425,115 +424,108 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not set SELinux user for %s") % name)
|
||||
|
||||
@ -547,74 +556,140 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
- oldsename = ""
|
||||
- oldserange = ""
|
||||
- try:
|
||||
- if sename == "" and serange == "":
|
||||
- raise ValueError(_("Requires seuser or serange"))
|
||||
+ def __modify(self, name, sename = "", serange = ""):
|
||||
if sename == "" and serange == "":
|
||||
raise ValueError(_("Requires seuser or serange"))
|
||||
+ if sename == "" and serange == "":
|
||||
+ raise ValueError(_("Requires seuser or serange"))
|
||||
|
||||
@@ -477,28 +472,27 @@
|
||||
else:
|
||||
sename = oldsename
|
||||
- (rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s") % name)
|
||||
+ (rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc,exists) = semanage_seuser_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("Login mapping for %s is not defined") % name)
|
||||
+ (rc,exists) = semanage_seuser_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("Login mapping for %s is not defined") % name)
|
||||
|
||||
- (rc,u) = semanage_seuser_query(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not query seuser for %s") % name)
|
||||
+ (rc,u) = semanage_seuser_query(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not query seuser for %s") % name)
|
||||
|
||||
- oldserange = semanage_seuser_get_mlsrange(u)
|
||||
- oldsename = semanage_seuser_get_sename(u)
|
||||
- if serange != "":
|
||||
- semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange))
|
||||
- else:
|
||||
- serange = oldserange
|
||||
- if sename != "":
|
||||
- semanage_seuser_set_sename(self.sh, u, sename)
|
||||
- else:
|
||||
- sename = oldsename
|
||||
+ oldserange = semanage_seuser_get_mlsrange(u)
|
||||
+ oldsename = semanage_seuser_get_sename(u)
|
||||
+ if serange != "":
|
||||
+ semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange))
|
||||
+ else:
|
||||
+ serange = oldserange
|
||||
|
||||
- rc = semanage_begin_transaction(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not start semanage transaction"))
|
||||
-
|
||||
rc = semanage_seuser_modify_local(self.sh, k, u)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not modify login mapping for %s") % name)
|
||||
+ if sename != "":
|
||||
+ semanage_seuser_set_sename(self.sh, u, sename)
|
||||
+ else:
|
||||
+ sename = oldsename
|
||||
|
||||
- rc = semanage_seuser_modify_local(self.sh, k, u)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not modify login mapping for %s") % name)
|
||||
+ rc = semanage_seuser_modify_local(self.sh, k, u)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not modify login mapping for %s") % name)
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not modify login mapping for %s") % name)
|
||||
-
|
||||
+ semanage_seuser_key_free(k)
|
||||
+ semanage_seuser_free(u)
|
||||
|
||||
- except ValueError, error:
|
||||
- mylog.log(0,"modify selinux user mapping", name, sename,"", serange, oldsename, "", oldserange);
|
||||
- raise error
|
||||
-
|
||||
- mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
|
||||
semanage_seuser_key_free(k)
|
||||
semanage_seuser_free(u)
|
||||
- semanage_seuser_key_free(k)
|
||||
- semanage_seuser_free(u)
|
||||
+ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
|
||||
|
||||
- def delete(self, name):
|
||||
+ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
|
||||
+
|
||||
+
|
||||
+ def modify(self, name, sename = "", serange = ""):
|
||||
try:
|
||||
- (rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s") % name)
|
||||
+ self.begin()
|
||||
+ self.__modify(name, sename, serange)
|
||||
+ self.commit()
|
||||
+
|
||||
|
||||
- (rc,exists) = semanage_seuser_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("Login mapping for %s is not defined") % name)
|
||||
+ except ValueError, error:
|
||||
+ mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", "");
|
||||
+ raise error
|
||||
+
|
||||
+ def __delete(self, name):
|
||||
(rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
@@ -515,12 +509,7 @@
|
||||
if not exists:
|
||||
raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name)
|
||||
+ (rc,k) = semanage_seuser_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc,exists) = semanage_seuser_exists_local(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name)
|
||||
+ (rc,exists) = semanage_seuser_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("Login mapping for %s is not defined") % name)
|
||||
|
||||
- rc = semanage_begin_transaction(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not start semanage transaction"))
|
||||
-
|
||||
rc = semanage_seuser_del_local(self.sh, k)
|
||||
-
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not delete login mapping for %s") % name)
|
||||
+ (rc,exists) = semanage_seuser_exists_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name)
|
||||
|
||||
@@ -524,16 +513,19 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not delete login mapping for %s") % name)
|
||||
- rc = semanage_seuser_del_local(self.sh, k)
|
||||
+ rc = semanage_seuser_del_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not delete login mapping for %s") % name)
|
||||
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not delete login mapping for %s") % name)
|
||||
+ semanage_seuser_key_free(k)
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not delete login mapping for %s") % name)
|
||||
+ semanage_seuser_key_free(k)
|
||||
+
|
||||
+ def delete(self, name):
|
||||
+ try:
|
||||
+ self.begin()
|
||||
@ -639,29 +714,94 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if is_mls_enabled == 1:
|
||||
if serange == "":
|
||||
serange = "s0"
|
||||
@@ -580,8 +572,9 @@
|
||||
@@ -580,170 +572,167 @@
|
||||
else:
|
||||
selevel = untranslate(selevel)
|
||||
|
||||
- seroles = " ".join(roles)
|
||||
- try:
|
||||
- (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s") % name)
|
||||
-
|
||||
- (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
- if exists:
|
||||
- raise ValueError(_("SELinux user %s is already defined") % name)
|
||||
+ if len(roles) < 1:
|
||||
+ raise ValueError(_("You must add at least one role for %s") % name)
|
||||
+
|
||||
(rc,k) = semanage_user_key_create(self.sh, name)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
@@ -620,31 +613,29 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not extract key for %s") % name)
|
||||
+ (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc,u) = semanage_user_create(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create SELinux user for %s") % name)
|
||||
+ (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
+ if exists:
|
||||
+ raise ValueError(_("SELinux user %s is already defined") % name)
|
||||
|
||||
- rc = semanage_user_set_name(self.sh, u, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not set name for %s") % name)
|
||||
+ (rc,u) = semanage_user_create(self.sh)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create SELinux user for %s") % name)
|
||||
|
||||
- for r in roles:
|
||||
- rc = semanage_user_add_role(self.sh, u, r)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not add role %s for %s") % (r, name))
|
||||
+ rc = semanage_user_set_name(self.sh, u, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not set name for %s") % name)
|
||||
|
||||
- if is_mls_enabled == 1:
|
||||
- rc = semanage_user_set_mlsrange(self.sh, u, serange)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not set MLS range for %s") % name)
|
||||
+ for r in roles:
|
||||
+ rc = semanage_user_add_role(self.sh, u, r)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not add role %s for %s") % (r, name))
|
||||
|
||||
- rc = semanage_user_set_mlslevel(self.sh, u, selevel)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not set MLS level for %s") % name)
|
||||
- rc = semanage_user_set_prefix(self.sh, u, prefix)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
|
||||
- (rc,key) = semanage_user_key_extract(self.sh,u)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not extract key for %s") % name)
|
||||
+ if is_mls_enabled == 1:
|
||||
+ rc = semanage_user_set_mlsrange(self.sh, u, serange)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not set MLS range for %s") % name)
|
||||
|
||||
- rc = semanage_begin_transaction(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not start semanage transaction"))
|
||||
-
|
||||
rc = semanage_user_modify_local(self.sh, k, u)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not add SELinux user %s") % name)
|
||||
+ rc = semanage_user_set_mlslevel(self.sh, u, selevel)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not set MLS level for %s") % name)
|
||||
+ rc = semanage_user_set_prefix(self.sh, u, prefix)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
|
||||
+ (rc,key) = semanage_user_key_extract(self.sh,u)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not extract key for %s") % name)
|
||||
|
||||
- rc = semanage_user_modify_local(self.sh, k, u)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not add SELinux user %s") % name)
|
||||
+ rc = semanage_user_modify_local(self.sh, k, u)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not add SELinux user %s") % name)
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
@ -689,64 +829,161 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
oldserange = ""
|
||||
newroles = string.join(roles, ' ');
|
||||
- try:
|
||||
if prefix == "" and len(roles) == 0 and serange == "" and selevel == "":
|
||||
if is_mls_enabled == 1:
|
||||
raise ValueError(_("Requires prefix, roles, level or range"))
|
||||
@@ -688,29 +677,27 @@
|
||||
if r not in rlist:
|
||||
semanage_user_add_role(self.sh, u, r)
|
||||
- if prefix == "" and len(roles) == 0 and serange == "" and selevel == "":
|
||||
- if is_mls_enabled == 1:
|
||||
- raise ValueError(_("Requires prefix, roles, level or range"))
|
||||
- else:
|
||||
- raise ValueError(_("Requires prefix or roles"))
|
||||
+ if prefix == "" and len(roles) == 0 and serange == "" and selevel == "":
|
||||
+ if is_mls_enabled == 1:
|
||||
+ raise ValueError(_("Requires prefix, roles, level or range"))
|
||||
+ else:
|
||||
+ raise ValueError(_("Requires prefix or roles"))
|
||||
|
||||
- (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s") % name)
|
||||
+ (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("SELinux user %s is not defined") % name)
|
||||
+ (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("SELinux user %s is not defined") % name)
|
||||
|
||||
- (rc,u) = semanage_user_query(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not query user for %s") % name)
|
||||
+ (rc,u) = semanage_user_query(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not query user for %s") % name)
|
||||
|
||||
- oldserange = semanage_user_get_mlsrange(u)
|
||||
- (rc, rlist) = semanage_user_get_roles(self.sh, u)
|
||||
- if rc >= 0:
|
||||
- oldroles = string.join(rlist, ' ');
|
||||
- newroles = newroles + ' ' + oldroles;
|
||||
+ oldserange = semanage_user_get_mlsrange(u)
|
||||
+ (rc, rlist) = semanage_user_get_roles(self.sh, u)
|
||||
+ if rc >= 0:
|
||||
+ oldroles = string.join(rlist, ' ');
|
||||
+ newroles = newroles + ' ' + oldroles;
|
||||
+
|
||||
+
|
||||
+ if serange != "":
|
||||
+ semanage_user_set_mlsrange(self.sh, u, untranslate(serange))
|
||||
+ if selevel != "":
|
||||
+ semanage_user_set_mlslevel(self.sh, u, untranslate(selevel))
|
||||
+
|
||||
+ if prefix != "":
|
||||
+ semanage_user_set_prefix(self.sh, u, prefix)
|
||||
+
|
||||
+ if len(roles) != 0:
|
||||
+ for r in rlist:
|
||||
+ if r not in roles:
|
||||
+ semanage_user_del_role(u, r)
|
||||
+ for r in roles:
|
||||
+ if r not in rlist:
|
||||
+ semanage_user_add_role(self.sh, u, r)
|
||||
|
||||
+ rc = semanage_user_modify_local(self.sh, k, u)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not modify SELinux user %s") % name)
|
||||
|
||||
- if serange != "":
|
||||
- semanage_user_set_mlsrange(self.sh, u, untranslate(serange))
|
||||
- if selevel != "":
|
||||
- semanage_user_set_mlslevel(self.sh, u, untranslate(selevel))
|
||||
-
|
||||
- if prefix != "":
|
||||
- semanage_user_set_prefix(self.sh, u, prefix)
|
||||
-
|
||||
- if len(roles) != 0:
|
||||
- for r in rlist:
|
||||
- if r not in roles:
|
||||
- semanage_user_del_role(u, r)
|
||||
- for r in roles:
|
||||
- if r not in rlist:
|
||||
- semanage_user_add_role(self.sh, u, r)
|
||||
+ semanage_user_key_free(k)
|
||||
+ semanage_user_free(u)
|
||||
+
|
||||
+ mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
|
||||
|
||||
- rc = semanage_begin_transaction(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not start semanage transaction"))
|
||||
-
|
||||
rc = semanage_user_modify_local(self.sh, k, u)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not modify SELinux user %s") % name)
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- rc = semanage_user_modify_local(self.sh, k, u)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not modify SELinux user %s") % name)
|
||||
-
|
||||
- except ValueError, error:
|
||||
- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
|
||||
- raise error
|
||||
+ semanage_user_key_free(k)
|
||||
+ semanage_user_free(u)
|
||||
|
||||
mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not modify SELinux user %s") % name)
|
||||
+ def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""):
|
||||
+ try:
|
||||
+ self.begin()
|
||||
+ self.__modify(name, roles, selevel, serange, prefix)
|
||||
+ self.commit()
|
||||
|
||||
except ValueError, error:
|
||||
- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
|
||||
+ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "")
|
||||
raise error
|
||||
-
|
||||
- mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
|
||||
-
|
||||
- semanage_user_key_free(k)
|
||||
- semanage_user_free(u)
|
||||
|
||||
- def delete(self, name):
|
||||
+ def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""):
|
||||
try:
|
||||
+ self.begin()
|
||||
+ self.__modify(name, roles, selevel, serange, prefix)
|
||||
+ self.commit()
|
||||
+
|
||||
+ except ValueError, error:
|
||||
+ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "")
|
||||
+ raise error
|
||||
+
|
||||
- try:
|
||||
- (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s") % name)
|
||||
+ def __delete(self, name):
|
||||
(rc,k) = semanage_user_key_create(self.sh, name)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
@@ -727,23 +714,23 @@
|
||||
if not exists:
|
||||
raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name)
|
||||
+ (rc,k) = semanage_user_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("SELinux user %s is not defined") % name)
|
||||
+ (rc,exists) = semanage_user_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("SELinux user %s is not defined") % name)
|
||||
|
||||
- (rc,exists) = semanage_user_exists_local(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
- if not exists:
|
||||
- raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name)
|
||||
+ (rc,exists) = semanage_user_exists_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
+ if not exists:
|
||||
+ raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name)
|
||||
|
||||
- rc = semanage_begin_transaction(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not start semanage transaction"))
|
||||
-
|
||||
rc = semanage_user_del_local(self.sh, k)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not delete SELinux user %s") % name)
|
||||
+ rc = semanage_user_del_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not delete SELinux user %s") % name)
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- rc = semanage_user_del_local(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not delete SELinux user %s") % name)
|
||||
+ semanage_user_key_free(k)
|
||||
@ -756,7 +993,10 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
+ self.begin()
|
||||
+ self.__delete(name)
|
||||
+ self.commit()
|
||||
+
|
||||
|
||||
- rc = semanage_commit(self.sh)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not delete SELinux user %s") % name)
|
||||
except ValueError, error:
|
||||
mylog.log(0,"delete SELinux user record", name)
|
||||
raise error
|
||||
@ -766,7 +1006,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
|
||||
def get_all(self, locallist = 0):
|
||||
ddict = {}
|
||||
@@ -808,7 +795,7 @@
|
||||
@@ -808,7 +797,7 @@
|
||||
raise ValueError(_("Could not create a key for %s/%s") % (proto, port))
|
||||
return ( k, proto_d, low, high )
|
||||
|
||||
@ -775,7 +1015,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if is_mls_enabled == 1:
|
||||
if serange == "":
|
||||
serange = "s0"
|
||||
@@ -857,23 +844,20 @@
|
||||
@@ -857,23 +846,20 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not set port context for %s/%s") % (proto, port))
|
||||
|
||||
@ -805,7 +1045,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if serange == "" and setype == "":
|
||||
if is_mls_enabled == 1:
|
||||
raise ValueError(_("Requires setype or serange"))
|
||||
@@ -899,29 +883,24 @@
|
||||
@@ -899,29 +885,24 @@
|
||||
if setype != "":
|
||||
semanage_context_set_type(self.sh, con, setype)
|
||||
|
||||
@ -841,7 +1081,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
|
||||
for port in plist:
|
||||
proto = semanage_port_get_proto(port)
|
||||
@@ -938,11 +917,9 @@
|
||||
@@ -938,11 +919,9 @@
|
||||
raise ValueError(_("Could not delete the port %s") % port_str)
|
||||
semanage_port_key_free(k)
|
||||
|
||||
@ -855,7 +1095,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
( k, proto_d, low, high ) = self.__genkey(port, proto)
|
||||
(rc,exists) = semanage_port_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
@@ -956,20 +933,17 @@
|
||||
@@ -956,20 +935,17 @@
|
||||
if not exists:
|
||||
raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port))
|
||||
|
||||
@ -881,7 +1121,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
def get_all(self, locallist = 0):
|
||||
ddict = {}
|
||||
if locallist:
|
||||
@@ -1035,7 +1009,7 @@
|
||||
@@ -1035,7 +1011,7 @@
|
||||
def __init__(self, store = ""):
|
||||
semanageRecords.__init__(self, store)
|
||||
|
||||
@ -890,7 +1130,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if is_mls_enabled == 1:
|
||||
if serange == "":
|
||||
serange = "s0"
|
||||
@@ -1089,23 +1063,20 @@
|
||||
@@ -1089,23 +1065,20 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not set message context for %s") % interface)
|
||||
|
||||
@ -920,7 +1160,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if serange == "" and setype == "":
|
||||
raise ValueError(_("Requires setype or serange"))
|
||||
|
||||
@@ -1130,22 +1101,19 @@
|
||||
@@ -1130,22 +1103,19 @@
|
||||
if setype != "":
|
||||
semanage_context_set_type(self.sh, con, setype)
|
||||
|
||||
@ -949,7 +1189,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
(rc,k) = semanage_iface_key_create(self.sh, interface)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create key for %s") % interface)
|
||||
@@ -1162,20 +1130,17 @@
|
||||
@@ -1162,20 +1132,17 @@
|
||||
if not exists:
|
||||
raise ValueError(_("Interface %s is defined in policy, cannot be deleted") % interface)
|
||||
|
||||
@ -975,7 +1215,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
def get_all(self, locallist = 0):
|
||||
ddict = {}
|
||||
if locallist:
|
||||
@@ -1234,7 +1199,7 @@
|
||||
@@ -1234,7 +1201,7 @@
|
||||
if target == "" or target.find("\n") >= 0:
|
||||
raise ValueError(_("Invalid file specification"))
|
||||
|
||||
@ -984,7 +1224,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
self.validate(target)
|
||||
|
||||
if is_mls_enabled == 1:
|
||||
@@ -1275,24 +1240,22 @@
|
||||
@@ -1275,24 +1242,22 @@
|
||||
|
||||
semanage_fcontext_set_type(fcontext, file_types[ftype])
|
||||
|
||||
@ -1016,7 +1256,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if serange == "" and setype == "" and seuser == "":
|
||||
raise ValueError(_("Requires setype, serange or seuser"))
|
||||
self.validate(target)
|
||||
@@ -1333,29 +1296,25 @@
|
||||
@@ -1333,29 +1298,25 @@
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not set file context for %s") % target)
|
||||
|
||||
@ -1053,7 +1293,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
|
||||
for fcontext in flist:
|
||||
target = semanage_fcontext_get_expr(fcontext)
|
||||
@@ -1370,11 +1329,9 @@
|
||||
@@ -1370,11 +1331,9 @@
|
||||
raise ValueError(_("Could not delete the file context %s") % target)
|
||||
semanage_fcontext_key_free(k)
|
||||
|
||||
@ -1067,7 +1307,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
(rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % target)
|
||||
@@ -1391,20 +1348,17 @@
|
||||
@@ -1391,20 +1350,17 @@
|
||||
else:
|
||||
raise ValueError(_("File context for %s is not defined") % target)
|
||||
|
||||
@ -1093,7 +1333,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
def get_all(self, locallist = 0):
|
||||
l = []
|
||||
if locallist:
|
||||
@@ -1486,9 +1440,8 @@
|
||||
@@ -1486,9 +1442,8 @@
|
||||
|
||||
def modify(self, name, value=None, use_file=False):
|
||||
|
||||
@ -1105,7 +1345,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
if use_file:
|
||||
fd = open(name)
|
||||
for b in fd.read().split("\n"):
|
||||
@@ -1498,18 +1451,16 @@
|
||||
@@ -1498,18 +1453,16 @@
|
||||
|
||||
try:
|
||||
boolname, val = b.split("=")
|
||||
@ -1127,7 +1367,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
|
||||
|
||||
(rc,k) = semanage_bool_key_create(self.sh, name)
|
||||
if rc < 0:
|
||||
@@ -1526,42 +1477,30 @@
|
||||
@@ -1526,42 +1479,30 @@
|
||||
if not exists:
|
||||
raise ValueError(_("Boolean %s is defined in policy, cannot be deleted") % name)
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
Summary: SELinux policy core utilities
|
||||
Name: policycoreutils
|
||||
Version: 2.0.54
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
|
||||
@ -192,7 +192,7 @@ if [ "$1" -ge "1" ]; then
|
||||
fi
|
||||
|
||||
%changelog
|
||||
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-3
|
||||
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-4
|
||||
- Fixes for multiple transactions
|
||||
|
||||
* Wed Aug 6 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-2
|
||||
|
||||
Loading…
Reference in New Issue
Block a user