diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/audit2allow policycoreutils-2.0.62/audit2allow/audit2allow --- nsapolicycoreutils/audit2allow/audit2allow 2009-01-13 08:45:35.000000000 -0500 +++ policycoreutils-2.0.62/audit2allow/audit2allow 2009-05-04 13:40:26.000000000 -0400 @@ -126,6 +126,7 @@ elif self.__options.audit: try: messages = audit.get_audit_msgs() + messages += audit.get_log_msgs() except OSError, e: sys.stderr.write('could not run ausearch - "%s"\n' % str(e)) sys.exit(1) diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.62/Makefile --- nsapolicycoreutils/Makefile 2008-08-28 09:34:24.000000000 -0400 +++ policycoreutils-2.0.62/Makefile 2009-05-04 13:40:26.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/Makefile policycoreutils-2.0.62/restorecond/Makefile --- nsapolicycoreutils/restorecond/Makefile 2009-02-18 16:44:47.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/Makefile 2009-05-05 15:49:19.000000000 -0400 @@ -2,16 +2,21 @@ PREFIX ?= ${DESTDIR}/usr SBINDIR ?= $(PREFIX)/sbin MANDIR = $(PREFIX)/share/man +AUTOSTARTDIR = $(DESTDIR)/etc/xdg/autostart +DBUSSERVICEDIR = $(DESTDIR)/usr/share/dbus-1/services + +autostart_DATA = sealertauto.desktop INITDIR = $(DESTDIR)/etc/rc.d/init.d SELINUXDIR = $(DESTDIR)/etc/selinux CFLAGS ?= -g -Werror -Wall -W -override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64 -LDLIBS += -lselinux -L$(PREFIX)/lib +override CFLAGS += -I$(PREFIX)/include -I/usr/include/dbus-1.0 -I/usr/lib64/dbus-1.0/include -I/usr/lib/dbus-1.0/include -D_FILE_OFFSET_BITS=64 -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include -I/usr/lib/glib-2.0/include + +LDLIBS += -lselinux -ldbus-glib-1 -lglib-2.0 -L$(PREFIX)/lib all: restorecond -restorecond: restorecond.o utmpwatcher.o stringslist.o +restorecond: restorecond.o stringslist.o user.o $(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS) install: all @@ -22,7 +27,12 @@ -mkdir -p $(INITDIR) install -m 755 restorecond.init $(INITDIR)/restorecond -mkdir -p $(SELINUXDIR) - install -m 600 restorecond.conf $(SELINUXDIR)/restorecond.conf + install -m 644 restorecond.conf $(SELINUXDIR)/restorecond.conf + install -m 644 restorecond_user.conf $(SELINUXDIR)/restorecond_user.conf + -mkdir -p $(AUTOSTARTDIR) + install -m 600 restorecond.desktop $(AUTOSTARTDIR)/restorecond.desktop + -mkdir -p $(DBUSSERVICEDIR) + install -m 600 org.selinux.Restorecond.service $(DBUSSERVICEDIR)/org.selinux.Restorecond.service relabel: install /sbin/restorecon $(SBINDIR)/restorecond diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/org.selinux.Restorecond.service policycoreutils-2.0.62/restorecond/org.selinux.Restorecond.service --- nsapolicycoreutils/restorecond/org.selinux.Restorecond.service 1969-12-31 19:00:00.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/org.selinux.Restorecond.service 2009-05-04 13:40:26.000000000 -0400 @@ -0,0 +1,3 @@ +[D-BUS Service] +Name=org.selinux.Restorecond +Exec=/usr/sbin/restorecond -u diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.62/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2009-02-18 16:44:47.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/restorecond.c 2009-05-04 13:40:26.000000000 -0400 @@ -54,25 +54,31 @@ #include #include #include +#include +#include #include "restorecond.h" #include "stringslist.h" -#include "utmpwatcher.h" +extern int start(void); +extern int server(int); extern char *dirname(char *path); static int master_fd = -1; static int master_wd = -1; static int terminate = 0; +static char *server_watch_file = "/etc/selinux/restorecond.conf"; +static char *user_watch_file = "/etc/selinux/restorecond_user.conf"; +static char *watch_file; + #include -#include /* size of the event structure, not counting name */ #define EVENT_SIZE (sizeof (struct inotify_event)) /* reasonable guess as to size of 1024 events */ #define BUF_LEN (1024 * (EVENT_SIZE + 16)) -static int debug_mode = 0; +int debug_mode = 0; static int verbose_mode = 0; static void restore(const char *filename, int exact); @@ -104,7 +110,7 @@ see if it is one that we are watching. */ -static int watch_list_find(int wd, const char *file) +int watch_list_find(int wd, const char *file) { struct watchList *ptr = NULL; ptr = firstDir; @@ -135,7 +141,7 @@ return -1; } -static void watch_list_free(int fd) +void watch_list_free(int fd) { struct watchList *ptr = NULL; struct watchList *prev = NULL; @@ -152,6 +158,12 @@ firstDir = NULL; } +static void done(void) { + watch_list_free(master_fd); + close(master_fd); + matchpathcon_fini(); +} + /* Set the file context to the default file context for this system. Same as restorecon. @@ -241,6 +253,8 @@ { char *line_buf = NULL; size_t len = 0; + uid_t uid = getuid(); + struct passwd *pwd = getpwuid(uid); while (getline(&line_buf, &len, cfg) > 0) { char *buffer = line_buf; @@ -252,8 +266,12 @@ if (l <= 0) continue; buffer[l] = 0; - if (buffer[0] == '~') - utmpwatcher_add(fd, &buffer[1]); + if (buffer[0] == '~') { + char *ptr=NULL; + asprintf(&ptr, "%s%s", pwd->pw_dir, &buffer[1]); + watch_list_add(fd, ptr); + free(ptr); + } else { watch_list_add(fd, buffer); } @@ -267,9 +285,8 @@ homedirs. */ -static void read_config(int fd) +static void read_config(int fd, const char *watch_file_path) { - char *watch_file_path = "/etc/selinux/restorecond.conf"; FILE *cfg = NULL; if (debug_mode) @@ -278,8 +295,10 @@ watch_list_free(fd); cfg = fopen(watch_file_path, "r"); - if (!cfg) - exitApp("Error reading config file."); + if (!cfg){ + perror(watch_file_path); + exitApp("Error reading config file"); + } process_config(fd, cfg); fclose(cfg); @@ -316,21 +335,10 @@ event->wd, event->mask, event->cookie, event->len); if (event->wd == master_wd) - read_config(fd); + read_config(fd, watch_file); else { - switch (utmpwatcher_handle(fd, event->wd)) { - case -1: /* Message was not for utmpwatcher */ - if (event->len) - watch_list_find(event->wd, event->name); - break; - - case 1: /* utmp has changed need to reload */ - read_config(fd); - break; - - default: /* No users logged in or out */ - break; - } + if (event->len) + watch_list_find(event->wd, event->name); } i += EVENT_SIZE + event->len; @@ -374,7 +382,7 @@ static void usage(char *program) { - printf("%s [-d] [-v] \n", program); + printf("%s [-d] [-s] [-f restorecond_file ] [-v] \n", program); exit(0); } @@ -393,7 +401,9 @@ void watch_list_add(int fd, const char *path) { struct watchList *ptr = NULL; + size_t i = 0; struct watchList *prev = NULL; + glob_t globbuf; char *x = strdup(path); if (!x) exitApp("Out of Memory"); @@ -401,7 +411,15 @@ char *file = basename(path); ptr = firstDir; - restore(path, 1); + globbuf.gl_offs = 1; + if (glob(path, + GLOB_TILDE, + NULL, + &globbuf) >= 0) { + for (i=0; i < globbuf.gl_pathc; i++) + restore(globbuf.gl_pathv[i], 1); + globfree(&globbuf); + } while (ptr != NULL) { if (strcmp(dir, ptr->dir) == 0) { @@ -445,14 +463,8 @@ { int opt; struct sigaction sa; + int run_as_user = 0; -#ifndef DEBUG - /* Make sure we are root */ - if (getuid() != 0) { - fprintf(stderr, "You must be root to run this program.\n"); - return 1; - } -#endif /* Make sure we are root */ if (is_selinux_enabled() != 1) { fprintf(stderr, "Daemon requires SELinux be enabled to run.\n"); @@ -471,11 +483,18 @@ if (master_fd < 0) exitApp("inotify_init"); - while ((opt = getopt(argc, argv, "dv")) > 0) { + atexit( done ); + while ((opt = getopt(argc, argv, "uf:dv")) > 0) { switch (opt) { case 'd': debug_mode = 1; break; + case 'f': + watch_file = optarg; + break; + case 'u': + run_as_user = 1; + break; case 'v': verbose_mode = 1; break; @@ -483,7 +502,18 @@ usage(argv[0]); } } - read_config(master_fd); + + if (getuid() != 0) { + watch_file = user_watch_file; + read_config(master_fd, watch_file); + if (run_as_user) + return server(master_fd); + else + return start(); + } + + watch_file = server_watch_file; + read_config(master_fd, watch_file); if (!debug_mode) daemon(0, 0); @@ -496,9 +526,10 @@ watch_list_free(master_fd); close(master_fd); matchpathcon_fini(); - utmpwatcher_free(); if (pidfile) unlink(pidfile); return 0; } + + diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.62/restorecond/restorecond.conf --- nsapolicycoreutils/restorecond/restorecond.conf 2009-02-18 16:44:47.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/restorecond.conf 2009-05-04 13:40:26.000000000 -0400 @@ -4,4 +4,5 @@ /etc/mtab /var/run/utmp /var/log/wtmp -~/* +/root/* +/root/.ssh/* diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.desktop policycoreutils-2.0.62/restorecond/restorecond.desktop --- nsapolicycoreutils/restorecond/restorecond.desktop 1969-12-31 19:00:00.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/restorecond.desktop 2009-05-04 13:40:26.000000000 -0400 @@ -0,0 +1,7 @@ +[Desktop Entry] +Name=File Context maintainer +Exec=/usr/sbin/restorecond +Comment=Fix file context in owned by the user +Encoding=UTF-8 +Type=Application +StartupNotify=false diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond_user.conf policycoreutils-2.0.62/restorecond/restorecond_user.conf --- nsapolicycoreutils/restorecond/restorecond_user.conf 1969-12-31 19:00:00.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/restorecond_user.conf 2009-05-04 13:40:26.000000000 -0400 @@ -0,0 +1,2 @@ +~/* +~/public_html/* diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/user.c policycoreutils-2.0.62/restorecond/user.c --- nsapolicycoreutils/restorecond/user.c 1969-12-31 19:00:00.000000000 -0500 +++ policycoreutils-2.0.62/restorecond/user.c 2009-05-04 13:40:26.000000000 -0400 @@ -0,0 +1,223 @@ +/* + * restorecond + * + * Copyright (C) 2006-2009 Red Hat + * see file 'COPYING' for use and warranty information + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of + * the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. +.* + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA + * 02111-1307 USA + * + * Authors: + * Dan Walsh + * +*/ + +/* + * PURPOSE: + * This daemon program watches for the creation of files listed in a config file + * and makes sure that there security context matches the systems defaults + * + * USAGE: + * restorecond [-d] [-v] + * + * -d Run in debug mode + * -v Run in verbose mode (Report missing files) + * + * EXAMPLE USAGE: + * restorecond + * + */ + +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "restorecond.h" +#include "stringslist.h" +#include +#include +#include +#include + +extern int watch_list_find(int wd, const char *file); +extern void watch_list_free(int fd); +extern int debug_mode; + +static DBusHandlerResult signal_filter (DBusConnection *connection, DBusMessage *message, void *user_data); + +static const char *PATH="/org/selinux/Restorecond"; +//static const char *BUSNAME="org.selinux.Restorecond"; +static const char *INTERFACE="org.selinux.RestorecondIface"; +static const char *RULE="type='signal',interface='org.selinux.RestorecondIface'"; + +#include + +/* size of the event structure, not counting name */ +#define EVENT_SIZE (sizeof (struct inotify_event)) +/* reasonable guess as to size of 1024 events */ +#define BUF_LEN (1024 * (EVENT_SIZE + 16)) + +static gboolean +io_channel_callback + (GIOChannel *source, + GIOCondition condition, + gpointer data __attribute__((__unused__))) +{ + + char buffer[BUF_LEN+1]; + gsize bytes_read; + unsigned int i = 0; + + if (condition & G_IO_IN) { + /* Data is available. */ + g_io_channel_read + (source, buffer, + sizeof (buffer), + &bytes_read); + + while (i < bytes_read) { + struct inotify_event *event; + event = (struct inotify_event *)&buffer[i]; + if (debug_mode) + printf("wd=%d mask=%u cookie=%u len=%u\n", + event->wd, event->mask, + event->cookie, event->len); + if (event->len) + watch_list_find(event->wd, event->name); + + i += EVENT_SIZE + event->len; + } + } + + /* An error happened while reading + the file. */ + + if (condition & G_IO_NVAL) + return FALSE; + + /* We have reached the end of the + file. */ + + if (condition & G_IO_HUP) { + g_io_channel_close (source); + return FALSE; + } + + /* Returning TRUE will make sure + the callback remains associated + to the channel. */ + + return TRUE; +} + +static DBusHandlerResult +signal_filter (DBusConnection *connection __attribute__ ((__unused__)), DBusMessage *message, void *user_data) +{ + /* User data is the event loop we are running in */ + GMainLoop *loop = user_data; + + /* A signal from the bus saying we are about to be disconnected */ + if (dbus_message_is_signal + (message, INTERFACE, "Stop")) { + + /* Tell the main loop to quit */ + g_main_loop_quit (loop); + /* We have handled this message, don't pass it on */ + return DBUS_HANDLER_RESULT_HANDLED; + } + /* A Ping signal on the com.burtonini.dbus.Signal interface */ + else if (dbus_message_is_signal (message, INTERFACE, "Start")) { + DBusError error; + dbus_error_init (&error); + g_print("Start received\n"); + return DBUS_HANDLER_RESULT_HANDLED; + } + return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; +} + + +int start() { + DBusConnection *bus; + DBusError error; + DBusMessage *message; + + /* Get a connection to the session bus */ + dbus_error_init (&error); + bus = dbus_bus_get (DBUS_BUS_SESSION, &error); + if (!bus) { + g_warning ("Failed to connect to the D-BUS daemon: %s", error.message); + dbus_error_free (&error); + return 1; + } + + + /* Create a new signal "Start" on the interface, + * from the object */ + message = dbus_message_new_signal (PATH, + INTERFACE, "Start"); + /* Send the signal */ + dbus_connection_send (bus, message, NULL); + /* Free the signal now we have finished with it */ + dbus_message_unref (message); + return 0; +} + +int server(int master_fd) { + GMainLoop *loop; + DBusConnection *bus; + DBusError error; + + loop = g_main_loop_new (NULL, FALSE); + + dbus_error_init (&error); + if(getuid() == 0) { + bus = dbus_bus_get (DBUS_BUS_SYSTEM, &error); + } else { + bus = dbus_bus_get (DBUS_BUS_SESSION, &error); + } + if (!bus) { + g_warning ("Failed to connect to the D-BUS daemon: %s", error.message); + dbus_error_free (&error); + return 1; + } + dbus_connection_setup_with_g_main (bus, NULL); + + /* listening to messages from all objects as no path is specified */ + dbus_bus_add_match (bus, RULE, &error); // see signals from the given interfacey + dbus_connection_add_filter (bus, signal_filter, loop, NULL); + + set_matchpathcon_flags(MATCHPATHCON_NOTRANS); + + GIOChannel *c = g_io_channel_unix_new(master_fd); + + g_io_add_watch_full( c, + G_PRIORITY_HIGH, + G_IO_IN|G_IO_ERR|G_IO_HUP, + io_channel_callback, NULL, NULL); + + g_main_loop_run (loop); + return 0; +} diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.62/scripts/chcat --- nsapolicycoreutils/scripts/chcat 2009-01-13 08:45:35.000000000 -0500 +++ policycoreutils-2.0.62/scripts/chcat 2009-05-04 13:40:26.000000000 -0400 @@ -281,14 +281,14 @@ def expandCats(cats): newcats = [] for c in cats: - if c.find(".") != -1: - c = c.split(".") - for i in range(int(c[0][1:]), int(c[1][1:]) + 1): - x = ("c%d" % i) - if x not in newcats: - newcats.append("c%d" % i) - else: - for i in c.split(","): + for i in c.split(","): + if i.find(".") != -1: + j = i.split(".") + for k in range(int(j[0][1:]), int(j[1][1:]) + 1): + x = ("c%d" % k) + if x not in newcats: + newcats.append(x) + else: if i not in newcats: newcats.append(i) if len(newcats) > 25: diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.62/scripts/fixfiles --- nsapolicycoreutils/scripts/fixfiles 2009-02-18 16:44:47.000000000 -0500 +++ policycoreutils-2.0.62/scripts/fixfiles 2009-05-05 10:47:08.000000000 -0400 @@ -89,7 +89,7 @@ fi; \ done | \ while read pattern ; do sh -c "find $pattern \ - ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o \ + ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune -o \ \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \ done 2> /dev/null | \ ${RESTORECON} $* -0 -f - @@ -122,14 +122,14 @@ fi if [ ! -z "$RPMFILES" ]; then for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do - rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1 >> $LOGFILE + rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f - 2>&1 >> $LOGFILE done exit $? fi if [ ! -z "$FILEPATH" ]; then if [ -x /usr/bin/find ]; then /usr/bin/find "$FILEPATH" \ - ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o -print0 | \ + ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o fstype btrfs \) -prune -o -print0 | \ ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE else ${RESTORECON} ${OUTFILES} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.62/semanage/semanage --- nsapolicycoreutils/semanage/semanage 2009-02-18 16:44:47.000000000 -0500 +++ policycoreutils-2.0.62/semanage/semanage 2009-05-04 13:40:26.000000000 -0400 @@ -44,16 +44,17 @@ text = _(""" semanage [ -S store ] -i [ input_file | - ] -semanage {boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n] +semanage {module,boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n] semanage login -{a|d|m} [-sr] login_name | %groupname semanage user -{a|d|m} [-LrRP] selinux_name semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range semanage interface -{a|d|m} [-tr] interface_spec semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] addr -semanage fcontext -{a|d|m} [-frst] file_spec +semanage fcontext -{a|d|m} [-frst] [-e path ] file_spec semanage translation -{a|d|m} [-T] level semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file -semanage permissive -{d|a} type +semanage permissive -{a|d} type +semanage module -{a|d|} module Primary Options: @@ -68,6 +69,7 @@ -h, --help Display this message -n, --noheading Do not print heading when listing OBJECTS -S, --store Select and alternate SELinux store to manage + --dontaudit Turn on or off dontaudit rules Object-specific Options (see above): @@ -84,6 +86,7 @@ -F, --file Treat target as an input file for command, change multiple settings -p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6) -M, --mask Netmask + -e, --equil Make target equil to this paths labeling -P, --prefix Prefix for home directory labeling -L, --level Default SELinux Level (MLS/MCS Systems only) -R, --roles SELinux Roles (ex: "sysadm_r staff_r") @@ -115,11 +118,14 @@ valid_option["node"] = [] valid_option["node"] += valid_everyone + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol'] valid_option["fcontext"] = [] - valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] + valid_option["fcontext"] += valid_everyone + [ '-e', '--equil', '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] valid_option["translation"] = [] valid_option["translation"] += valid_everyone + [ '-T', '--trans' ] valid_option["boolean"] = [] valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0", "-F", "--file"] + valid_option["module"] = [] + valid_option["module"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '--dontaudit'] + valid_option["permissive"] = [] valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ] return valid_option @@ -192,7 +198,10 @@ locallist = False use_file = False store = "" + equil="" + dontaudit = "" + object = argv[0] option_dict=get_options() if object not in option_dict.keys(): @@ -201,10 +210,12 @@ args = argv[1:] gopts, cmds = getopt.getopt(args, - '01adf:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:', + '01ade:f:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:', ['add', 'delete', 'deleteall', + 'dontaudit=', + 'equil=', 'ftype=', 'file', 'help', @@ -241,16 +252,24 @@ if modify or add: raise ValueError(_("%s bad option") % o) delete = True + if o == "-D" or o == "--deleteall": if modify: raise ValueError(_("%s bad option") % o) deleteall = True + if o == "-f" or o == "--ftype": - ftype=a + ftype = a + + if o == "-e" or o == "--equil": + equil = a if o == "-F" or o == "--file": use_file = True + if o == "--dontaudit": + dontaudit = not int(a) + if o == "-h" or o == "--help": raise ValueError(_("%s bad option") % o) @@ -323,6 +342,9 @@ if object == "boolean": OBJECT = seobject.booleanRecords(store) + + if object == "module": + OBJECT = seobject.moduleRecords(store) if object == "translation": OBJECT = seobject.setransRecords() @@ -341,6 +363,13 @@ OBJECT.deleteall() return + if dontaudit != "": + if object == "module": + OBJECT.dontaudit(dontaudit) + else: + raise ValueError(_("%s bad option") % o) + return + if len(cmds) != 1: raise ValueError(_("%s bad option") % o) @@ -362,11 +391,17 @@ if object == "interface": OBJECT.add(target, serange, setype) + if object == "module": + OBJECT.add(target) + if object == "node": OBJECT.add(target, mask, proto, serange, setype) if object == "fcontext": - OBJECT.add(target, setype, ftype, serange, seuser) + if equil == "": + OBJECT.add(target, setype, ftype, serange, seuser) + else: + OBJECT.add_equil(target, equil) if object == "permissive": OBJECT.add(target) @@ -386,6 +421,9 @@ rlist = roles.split() OBJECT.modify(target, rlist, selevel, serange, prefix) + if object == "module": + OBJECT.modify(target) + if object == "port": OBJECT.modify(target, proto, serange, setype) @@ -396,7 +434,10 @@ OBJECT.modify(target, mask, proto, serange, setype) if object == "fcontext": - OBJECT.modify(target, setype, ftype, serange, seuser) + if equil == "": + OBJECT.modify(target, setype, ftype, serange, seuser) + else: + OBJECT.modify_equil(target, equil) return @@ -405,7 +446,7 @@ OBJECT.delete(target, proto) elif object == "fcontext": - OBJECT.delete(target, ftype) + OBJECT.delete(target, ftype) elif object == "node": OBJECT.delete(target, mask, proto) @@ -464,10 +505,10 @@ else: fd = open(input, 'r') trans = seobject.semanageRecords(store) - trans.begin() + trans.start() for l in fd.readlines(): process_args(mkargv(l)) - trans.commit() + trans.finish() else: process_args(sys.argv[1:]) diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-2.0.62/semanage/semanage.8 --- nsapolicycoreutils/semanage/semanage.8 2008-08-28 09:34:24.000000000 -0400 +++ policycoreutils-2.0.62/semanage/semanage.8 2009-05-04 13:40:26.000000000 -0400 @@ -21,6 +21,8 @@ .br .B semanage permissive \-{a|d} type .br +.B semanage module \-{a|d} policy_package +.br .B semanage translation \-{a|d|m} [\-T] level .P diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.62/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2008-11-14 17:10:15.000000000 -0500 +++ policycoreutils-2.0.62/semanage/seobject.py 2009-05-05 14:45:58.000000000 -0400 @@ -1,5 +1,5 @@ #! /usr/bin/python -E -# Copyright (C) 2005, 2006, 2007, 2008 Red Hat +# Copyright (C) 2005, 2006, 2007, 2008, 2009 Red Hat # see file 'COPYING' for use and warranty information # # semanage is a tool for managing SELinux configuration files @@ -21,16 +21,16 @@ # # -import pwd, grp, string, selinux, tempfile, os, re, sys +import pwd, grp, string, selinux, tempfile, os, re, sys, stat from semanage import *; -PROGNAME="policycoreutils" +PROGNAME = "policycoreutils" import sepolgen.module as module import gettext gettext.bindtextdomain(PROGNAME, "/usr/share/locale") gettext.textdomain(PROGNAME) try: - gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1) + gettext.install(PROGNAME, localedir = "/usr/share/locale", unicode = 1) except IOError: import __builtin__ __builtin__.__dict__['_'] = unicode @@ -96,7 +96,7 @@ self.audit_fd = audit.audit_open() def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""): - audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0],str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success); + audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0], str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success); except: class logger: def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""): @@ -104,7 +104,7 @@ message = "Successful: " else: message = "Failed: " - message += " %s name=%s" % (msg,name) + message += " %s name=%s" % (msg, name) if sename != "": message += " sename=" + sename if old_sename != "": @@ -123,9 +123,9 @@ import xml.etree.ElementTree -booleans_dict={} +booleans_dict = {} try: - tree=xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml") + tree = xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml") for l in tree.findall("layer"): for m in l.findall("module"): for b in m.findall("tunable"): @@ -160,12 +160,12 @@ cat_range = category + "(\." + category +")?" categories = cat_range + "(\," + cat_range + ")*" reg = sensitivity + "(-" + sensitivity + ")?" + "(:" + categories + ")?" - return re.search("^" + reg +"$",raw) + return re.search("^" + reg +"$", raw) def translate(raw, prepend = 1): - filler="a:b:c:" + filler = "a:b:c:" if prepend == 1: - context = "%s%s" % (filler,raw) + context = "%s%s" % (filler, raw) else: context = raw (rc, trans) = selinux.selinux_raw_to_trans_context(context) @@ -179,9 +179,9 @@ return trans def untranslate(trans, prepend = 1): - filler="a:b:c:" + filler = "a:b:c:" if prepend == 1: - context = "%s%s" % (filler,trans) + context = "%s%s" % (filler, trans) else: context = trans @@ -234,7 +234,7 @@ rec += "%s=%s\n" % (k, self.ddict[k]) return rec - def list(self,heading = 1, locallist = 0): + def list(self, heading = 1, locallist = 0): if heading: print "\n%-25s %s\n" % (_("Level"), _("Translation")) keys = self.ddict.keys() @@ -273,6 +273,7 @@ (fd, newfilename) = tempfile.mkstemp('', self.filename) os.write(fd, self.out()) os.close(fd) + os.chmod(newfilename, os.stat(self.filename)[stat.ST_MODE]) os.rename(newfilename, self.filename) os.system("/sbin/service mcstrans reload > /dev/null") @@ -281,15 +282,20 @@ global handle if handle != None: - self.transaction = True self.sh = handle else: - self.sh=get_handle(store) - self.transaction = False + self.sh = get_handle(store) + self.transaction = False def deleteall(self): raise ValueError(_("Not yet implemented")) + def start(self): + if self.transaction: + raise ValueError(_("Semanage transaction already in progress")) + self.begin() + self.transaction = True + def begin(self): if self.transaction: return @@ -303,6 +309,55 @@ if rc < 0: raise ValueError(_("Could not commit semanage transaction")) + def finish(self): + if not self.transaction: + raise ValueError(_("Semanage transaction not in progress")) + self.transaction = False + self.commit() + +class moduleRecords(semanageRecords): + def __init__(self, store): + semanageRecords.__init__(self, store) + + def get_all(self): + l = [] + (rc, mlist, number) = semanage_module_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list SELinux modules")) + + for i in range(number): + mod = semanage_module_list_nth(mlist, i) + name = semanage_module_get_name(mod) + l.append(name) + return l + + def dontaudit(self, dontaudit = 0): + self.begin() + rc = semanage_set_disable_dontaudit(self.sh, dontaudit) + self.commit() + rc = semanage_reload_policy(self.sh) + + def list(self, heading = 1, locallist = 0): + if heading: + print "\n%-25s\n" % (_("Modules")) + for t in self.get_all(): + print t + + def add(self, modules): + import glob + for m in modules.split(): + rc = semanage_module_install_file(self.sh, m); + if rc >= 0: + self.commit() + + def delete(self, modules): + for m in modules.split(): + rc = semanage_module_remove(self.sh, m) + if rc < 0: + raise ValueError(_("Could not remove module %s (remove failed)") % name) + + self.commit() + class permissiveRecords(semanageRecords): def __init__(self, store): semanageRecords.__init__(self, store) @@ -320,7 +375,7 @@ l.append(name.split("permissive_")[1]) return l - def list(self,heading = 1, locallist = 0): + def list(self, heading = 1, locallist = 0): if heading: print "\n%-25s\n" % (_("Permissive Types")) for t in self.get_all(): @@ -328,6 +383,7 @@ def add(self, type): + import glob name = "permissive_%s" % type dirname = "/var/lib/selinux" os.chdir(dirname) @@ -341,7 +397,7 @@ permissive %s; """ % (name, type, type) - fd = open(filename,'w') + fd = open(filename, 'w') fd.write(modtxt) fd.close() mc = module.ModuleCompiler() @@ -351,16 +407,19 @@ fd.close() rc = semanage_module_install(self.sh, data, len(data)); - if rc < 0: - raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name) - - self.commit() + if rc >= 0: + self.commit() - for root, dirs, files in os.walk("tmp", topdown=False): + for root, dirs, files in os.walk("tmp", topdown = False): for name in files: os.remove(os.path.join(root, name)) for name in dirs: os.rmdir(os.path.join(root, name)) + os.removedirs("tmp") + for i in glob.glob("permissive_%s.*" % type): + os.remove(i) + if rc < 0: + raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name) def delete(self, name): for n in name.split(): @@ -390,11 +449,11 @@ if sename == "": sename = "user_u" - (rc,k) = semanage_seuser_key_create(self.sh, name) + (rc, k) = semanage_seuser_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_seuser_exists(self.sh, k) + (rc, exists) = semanage_seuser_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if login mapping for %s is defined") % name) if exists: @@ -410,7 +469,7 @@ except: raise ValueError(_("Linux User %s does not exist") % name) - (rc,u) = semanage_seuser_create(self.sh) + (rc, u) = semanage_seuser_create(self.sh) if rc < 0: raise ValueError(_("Could not create login mapping for %s") % name) @@ -450,17 +509,17 @@ if sename == "" and serange == "": raise ValueError(_("Requires seuser or serange")) - (rc,k) = semanage_seuser_key_create(self.sh, name) + (rc, k) = semanage_seuser_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_seuser_exists(self.sh, k) + (rc, exists) = semanage_seuser_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if login mapping for %s is defined") % name) if not exists: raise ValueError(_("Login mapping for %s is not defined") % name) - (rc,u) = semanage_seuser_query(self.sh, k) + (rc, u) = semanage_seuser_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query seuser for %s") % name) @@ -483,7 +542,7 @@ semanage_seuser_key_free(k) semanage_seuser_free(u) - mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); + mylog.log(1, "modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); def modify(self, name, sename = "", serange = ""): try: @@ -492,21 +551,21 @@ self.commit() except ValueError, error: - mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", ""); + mylog.log(0, "modify selinux user mapping", name, sename, "", serange, "", "", ""); raise error def __delete(self, name): - (rc,k) = semanage_seuser_key_create(self.sh, name) + (rc, k) = semanage_seuser_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_seuser_exists(self.sh, k) + (rc, exists) = semanage_seuser_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if login mapping for %s is defined") % name) if not exists: raise ValueError(_("Login mapping for %s is not defined") % name) - (rc,exists) = semanage_seuser_exists_local(self.sh, k) + (rc, exists) = semanage_seuser_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if login mapping for %s is defined") % name) if not exists: @@ -525,10 +584,10 @@ self.commit() except ValueError, error: - mylog.log(0,"delete SELinux user mapping", name); + mylog.log(0, "delete SELinux user mapping", name); raise error - mylog.log(1,"delete SELinux user mapping", name); + mylog.log(1, "delete SELinux user mapping", name); def get_all(self, locallist = 0): ddict = {} @@ -578,17 +637,17 @@ if len(roles) < 1: raise ValueError(_("You must add at least one role for %s") % name) - (rc,k) = semanage_user_key_create(self.sh, name) + (rc, k) = semanage_user_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_user_exists(self.sh, k) + (rc, exists) = semanage_user_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if SELinux user %s is defined") % name) if exists: raise ValueError(_("SELinux user %s is already defined") % name) - (rc,u) = semanage_user_create(self.sh) + (rc, u) = semanage_user_create(self.sh) if rc < 0: raise ValueError(_("Could not create SELinux user for %s") % name) @@ -612,7 +671,7 @@ rc = semanage_user_set_prefix(self.sh, u, prefix) if rc < 0: raise ValueError(_("Could not add prefix %s for %s") % (r, prefix)) - (rc,key) = semanage_user_key_extract(self.sh,u) + (rc, key) = semanage_user_key_extract(self.sh,u) if rc < 0: raise ValueError(_("Could not extract key for %s") % name) @@ -645,17 +704,17 @@ else: raise ValueError(_("Requires prefix or roles")) - (rc,k) = semanage_user_key_create(self.sh, name) + (rc, k) = semanage_user_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_user_exists(self.sh, k) + (rc, exists) = semanage_user_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if SELinux user %s is defined") % name) if not exists: raise ValueError(_("SELinux user %s is not defined") % name) - (rc,u) = semanage_user_query(self.sh, k) + (rc, u) = semanage_user_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query user for %s") % name) @@ -703,17 +762,17 @@ raise error def __delete(self, name): - (rc,k) = semanage_user_key_create(self.sh, name) + (rc, k) = semanage_user_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_user_exists(self.sh, k) + (rc, exists) = semanage_user_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if SELinux user %s is defined") % name) if not exists: raise ValueError(_("SELinux user %s is not defined") % name) - (rc,exists) = semanage_user_exists_local(self.sh, k) + (rc, exists) = semanage_user_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if SELinux user %s is defined") % name) if not exists: @@ -795,7 +854,7 @@ low = int(ports[0]) high = int(ports[1]) - (rc,k) = semanage_port_key_create(self.sh, low, high, proto_d) + (rc, k) = semanage_port_key_create(self.sh, low, high, proto_d) if rc < 0: raise ValueError(_("Could not create a key for %s/%s") % (proto, port)) return ( k, proto_d, low, high ) @@ -812,13 +871,13 @@ ( k, proto_d, low, high ) = self.__genkey(port, proto) - (rc,exists) = semanage_port_exists(self.sh, k) + (rc, exists) = semanage_port_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) if exists: raise ValueError(_("Port %s/%s already defined") % (proto, port)) - (rc,p) = semanage_port_create(self.sh) + (rc, p) = semanage_port_create(self.sh) if rc < 0: raise ValueError(_("Could not create port for %s/%s") % (proto, port)) @@ -871,13 +930,13 @@ ( k, proto_d, low, high ) = self.__genkey(port, proto) - (rc,exists) = semanage_port_exists(self.sh, k) + (rc, exists) = semanage_port_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) if not exists: raise ValueError(_("Port %s/%s is not defined") % (proto,port)) - (rc,p) = semanage_port_query(self.sh, k) + (rc, p) = semanage_port_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query port %s/%s") % (proto, port)) @@ -926,13 +985,13 @@ def __delete(self, port, proto): ( k, proto_d, low, high ) = self.__genkey(port, proto) - (rc,exists) = semanage_port_exists(self.sh, k) + (rc, exists) = semanage_port_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) if not exists: raise ValueError(_("Port %s/%s is not defined") % (proto, port)) - (rc,exists) = semanage_port_exists_local(self.sh, k) + (rc, exists) = semanage_port_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) if not exists: @@ -1038,17 +1097,17 @@ if ctype == "": raise ValueError(_("SELinux Type is required")) - (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto) + (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto) if rc < 0: raise ValueError(_("Could not create key for %s") % addr) if rc < 0: raise ValueError(_("Could not check if addr %s is defined") % addr) - (rc,exists) = semanage_node_exists(self.sh, k) + (rc, exists) = semanage_node_exists(self.sh, k) if exists: raise ValueError(_("Addr %s already defined") % addr) - (rc,node) = semanage_node_create(self.sh) + (rc, node) = semanage_node_create(self.sh) if rc < 0: raise ValueError(_("Could not create addr for %s") % addr) @@ -1113,17 +1172,17 @@ if serange == "" and setype == "": raise ValueError(_("Requires setype or serange")) - (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto) + (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto) if rc < 0: raise ValueError(_("Could not create key for %s") % addr) - (rc,exists) = semanage_node_exists(self.sh, k) + (rc, exists) = semanage_node_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if addr %s is defined") % addr) if not exists: raise ValueError(_("Addr %s is not defined") % addr) - (rc,node) = semanage_node_query(self.sh, k) + (rc, node) = semanage_node_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query addr %s") % addr) @@ -1160,17 +1219,17 @@ else: raise ValueError(_("Unknown or missing protocol")) - (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto) + (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto) if rc < 0: raise ValueError(_("Could not create key for %s") % addr) - (rc,exists) = semanage_node_exists(self.sh, k) + (rc, exists) = semanage_node_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if addr %s is defined") % addr) if not exists: raise ValueError(_("Addr %s is not defined") % addr) - (rc,exists) = semanage_node_exists_local(self.sh, k) + (rc, exists) = semanage_node_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if addr %s is defined") % addr) if not exists: @@ -1240,17 +1299,17 @@ if ctype == "": raise ValueError(_("SELinux Type is required")) - (rc,k) = semanage_iface_key_create(self.sh, interface) + (rc, k) = semanage_iface_key_create(self.sh, interface) if rc < 0: raise ValueError(_("Could not create key for %s") % interface) - (rc,exists) = semanage_iface_exists(self.sh, k) + (rc, exists) = semanage_iface_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if interface %s is defined") % interface) if exists: raise ValueError(_("Interface %s already defined") % interface) - (rc,iface) = semanage_iface_create(self.sh) + (rc, iface) = semanage_iface_create(self.sh) if rc < 0: raise ValueError(_("Could not create interface for %s") % interface) @@ -1301,17 +1360,17 @@ if serange == "" and setype == "": raise ValueError(_("Requires setype or serange")) - (rc,k) = semanage_iface_key_create(self.sh, interface) + (rc, k) = semanage_iface_key_create(self.sh, interface) if rc < 0: raise ValueError(_("Could not create key for %s") % interface) - (rc,exists) = semanage_iface_exists(self.sh, k) + (rc, exists) = semanage_iface_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if interface %s is defined") % interface) if not exists: raise ValueError(_("Interface %s is not defined") % interface) - (rc,iface) = semanage_iface_query(self.sh, k) + (rc, iface) = semanage_iface_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query interface %s") % interface) @@ -1335,17 +1394,17 @@ self.commit() def __delete(self, interface): - (rc,k) = semanage_iface_key_create(self.sh, interface) + (rc, k) = semanage_iface_key_create(self.sh, interface) if rc < 0: raise ValueError(_("Could not create key for %s") % interface) - (rc,exists) = semanage_iface_exists(self.sh, k) + (rc, exists) = semanage_iface_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if interface %s is defined") % interface) if not exists: raise ValueError(_("Interface %s is not defined") % interface) - (rc,exists) = semanage_iface_exists_local(self.sh, k) + (rc, exists) = semanage_iface_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if interface %s is defined") % interface) if not exists: @@ -1393,6 +1452,48 @@ class fcontextRecords(semanageRecords): def __init__(self, store = ""): semanageRecords.__init__(self, store) + self.equiv = {} + self.equil_ind = False + try: + fd = open(selinux.selinux_file_context_subs_path(), "r") + for i in fd.readlines(): + src, dst = i.split() + self.equiv[src] = dst + fd.close() + except IOError: + pass + + def commit(self): + if self.equil_ind: + subs_file = selinux.selinux_file_context_subs_path() + tmpfile = "%s.tmp" % subs_file + fd = open(tmpfile, "w") + for src in self.equiv.keys(): + fd.write("%s %s\n" % (src, self.equiv[src])) + fd.close() + try: + os.chmod(tmpfile, os.stat(subs_file)[stat.ST_MODE]) + except: + pass + os.rename(tmpfile,subs_file) + self.equil_ind = False + semanageRecords.commit(self) + + def add_equil(self, src, dst): + self.begin() + if src in self.equiv.keys(): + raise ValueError(_("Equivalence class for %s already exists") % src) + self.equiv[src] = dst + self.equil_ind = True + self.commit() + + def modify_equil(self, src, dst): + self.begin() + if src not in self.equiv.keys(): + raise ValueError(_("Equivalence class for %s does not exists") % src) + self.equiv[src] = dst + self.equil_ind = True + self.commit() def createcon(self, target, seuser = "system_u"): (rc, con) = semanage_context_create(self.sh) @@ -1429,23 +1530,23 @@ if type == "": raise ValueError(_("SELinux Type is required")) - (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) + (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: raise ValueError(_("Could not create key for %s") % target) - (rc,exists) = semanage_fcontext_exists(self.sh, k) + (rc, exists) = semanage_fcontext_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if file context for %s is defined") % target) if not exists: - (rc,exists) = semanage_fcontext_exists_local(self.sh, k) + (rc, exists) = semanage_fcontext_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if file context for %s is defined") % target) if exists: raise ValueError(_("File context for %s already defined") % target) - (rc,fcontext) = semanage_fcontext_create(self.sh) + (rc, fcontext) = semanage_fcontext_create(self.sh) if rc < 0: raise ValueError(_("Could not create file context for %s") % target) @@ -1486,21 +1587,21 @@ raise ValueError(_("Requires setype, serange or seuser")) self.validate(target) - (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) + (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: raise ValueError(_("Could not create a key for %s") % target) - (rc,exists) = semanage_fcontext_exists(self.sh, k) + (rc, exists) = semanage_fcontext_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if file context for %s is defined") % target) if not exists: - (rc,exists) = semanage_fcontext_exists_local(self.sh, k) + (rc, exists) = semanage_fcontext_exists_local(self.sh, k) if not exists: raise ValueError(_("File context for %s is not defined") % target) - (rc,fcontext) = semanage_fcontext_query_local(self.sh, k) + (rc, fcontext) = semanage_fcontext_query_local(self.sh, k) if rc < 0: - (rc,fcontext) = semanage_fcontext_query(self.sh, k) + (rc, fcontext) = semanage_fcontext_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query file context for %s") % target) @@ -1550,7 +1651,7 @@ target = semanage_fcontext_get_expr(fcontext) ftype = semanage_fcontext_get_type(fcontext) ftype_str = semanage_fcontext_get_type_str(ftype) - (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str]) + (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str]) if rc < 0: raise ValueError(_("Could not create a key for %s") % target) @@ -1558,19 +1659,26 @@ if rc < 0: raise ValueError(_("Could not delete the file context %s") % target) semanage_fcontext_key_free(k) - + + self.equiv = {} + self.equil_ind = True self.commit() def __delete(self, target, ftype): - (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) + if target in self.equiv.keys(): + self.equiv.pop(target) + self.equil_ind = True + return + + (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: raise ValueError(_("Could not create a key for %s") % target) - (rc,exists) = semanage_fcontext_exists_local(self.sh, k) + (rc, exists) = semanage_fcontext_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if file context for %s is defined") % target) if not exists: - (rc,exists) = semanage_fcontext_exists(self.sh, k) + (rc, exists) = semanage_fcontext_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if file context for %s is defined") % target) if exists: @@ -1617,11 +1725,11 @@ return ddict def list(self, heading = 1, locallist = 0 ): - if heading: - print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context")) fcon_dict = self.get_all(locallist) keys = fcon_dict.keys() keys.sort() + if len(keys) > 0 and heading: + print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context")) for k in keys: if fcon_dict[k]: if is_mls_enabled: @@ -1630,11 +1738,17 @@ print "%-50s %-18s %s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1],fcon_dict[k][2]) else: print "%-50s %-18s <>" % (k[0], k[1]) + if len(self.equiv.keys()) > 0: + if heading: + print _("\nSELinux fcontext Equivalence \n") + + for src in self.equiv.keys(): + print "%s == %s" % (src, self.equiv[src]) class booleanRecords(semanageRecords): def __init__(self, store = ""): semanageRecords.__init__(self, store) - self.dict={} + self.dict = {} self.dict["TRUE"] = 1 self.dict["FALSE"] = 0 self.dict["ON"] = 1 @@ -1643,16 +1757,16 @@ self.dict["0"] = 0 def __mod(self, name, value): - (rc,k) = semanage_bool_key_create(self.sh, name) + (rc, k) = semanage_bool_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_bool_exists(self.sh, k) + (rc, exists) = semanage_bool_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if boolean %s is defined") % name) if not exists: raise ValueError(_("Boolean %s is not defined") % name) - (rc,b) = semanage_bool_query(self.sh, k) + (rc, b) = semanage_bool_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query file context %s") % name) @@ -1670,7 +1784,7 @@ semanage_bool_key_free(k) semanage_bool_free(b) - def modify(self, name, value=None, use_file=False): + def modify(self, name, value = None, use_file = False): self.begin() @@ -1694,16 +1808,16 @@ def __delete(self, name): - (rc,k) = semanage_bool_key_create(self.sh, name) + (rc, k) = semanage_bool_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) - (rc,exists) = semanage_bool_exists(self.sh, k) + (rc, exists) = semanage_bool_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if boolean %s is defined") % name) if not exists: raise ValueError(_("Boolean %s is not defined") % name) - (rc,exists) = semanage_bool_exists_local(self.sh, k) + (rc, exists) = semanage_bool_exists_local(self.sh, k) if rc < 0: raise ValueError(_("Could not check if boolean %s is defined") % name) if not exists: @@ -1762,7 +1876,7 @@ return _("unknown") def list(self, heading = True, locallist = False, use_file = False): - on_off = (_("off"),_("on")) + on_off = (_("off"), _("on")) if use_file: ddict = self.get_all(locallist) keys = ddict.keys() diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setfiles/setfiles.c policycoreutils-2.0.62/setfiles/setfiles.c --- nsapolicycoreutils/setfiles/setfiles.c 2008-08-28 09:34:24.000000000 -0400 +++ policycoreutils-2.0.62/setfiles/setfiles.c 2009-05-04 13:40:26.000000000 -0400 @@ -29,6 +29,8 @@ static int mass_relabel; static int mass_relabel_errs; +#define STAR_COUNT 1000 + static FILE *outfile = NULL; static int force = 0; #define STAT_BLOCK_SIZE 1 @@ -444,11 +446,11 @@ if (progress) { count++; - if (count % 80000 == 0) { + if (count % (80 * STAR_COUNT) == 0) { fprintf(stdout, "\n"); fflush(stdout); } - if (count % 1000 == 0) { + if (count % STAR_COUNT == 0) { fprintf(stdout, "*"); fflush(stdout); } @@ -1017,7 +1019,7 @@ free(excludeArray[i].directory); } - if (progress) + if (progress && count >= STAR_COUNT) printf("\n"); exit(errors); }