diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.26/Makefile --- nsapolicycoreutils/Makefile 2007-07-16 14:20:43.000000000 -0400 +++ policycoreutils-2.0.26/Makefile 2007-09-18 16:40:57.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui all install relabel clean indent: @for subdir in $(SUBDIRS); do \ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.26/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2007-07-16 14:20:41.000000000 -0400 +++ policycoreutils-2.0.26/restorecond/restorecond.c 2007-09-18 16:40:57.000000000 -0400 @@ -210,9 +210,10 @@ } if (fsetfilecon(fd, scontext) < 0) { - syslog(LOG_ERR, - "set context %s->%s failed:'%s'\n", - filename, scontext, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, + "set context %s->%s failed:'%s'\n", + filename, scontext, strerror(errno)); if (retcontext >= 0) free(prev_context); free(scontext); @@ -225,8 +226,9 @@ if (retcontext >= 0) free(prev_context); } else { - syslog(LOG_ERR, "get context on %s failed: '%s'\n", - filename, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, "get context on %s failed: '%s'\n", + filename, strerror(errno)); } free(scontext); close(fd); diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.26/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400 +++ policycoreutils-2.0.26/semanage/seobject.py 2007-09-18 16:40:57.000000000 -0400 @@ -210,6 +210,7 @@ os.write(fd, self.out()) os.close(fd) os.rename(newfilename, self.filename) + os.system("/sbin/service mcstrans reload > /dev/null") class semanageRecords: def __init__(self): @@ -1024,14 +1025,31 @@ def __init__(self): semanageRecords.__init__(self) - def add(self, target, type, ftype = "", serange = "", seuser = "system_u"): + def createcon(self, target, seuser = "system_u"): + (rc, con) = semanage_context_create(self.sh) + if rc < 0: + raise ValueError(_("Could not create context for %s") % target) if seuser == "": seuser = "system_u" + + rc = semanage_context_set_user(self.sh, con, seuser) + if rc < 0: + raise ValueError(_("Could not set user in file context for %s") % target) + + rc = semanage_context_set_role(self.sh, con, "object_r") + if rc < 0: + raise ValueError(_("Could not set role in file context for %s") % target) + if is_mls_enabled == 1: - if serange == "": - serange = "s0" - else: - serange = untranslate(serange) + rc = semanage_context_set_mls(self.sh, con, "s0") + if rc < 0: + raise ValueError(_("Could not set mls fields in file context for %s") % target) + + return con + + def add(self, target, type, ftype = "", serange = "", seuser = "system_u"): + if is_mls_enabled == 1: + serange = untranslate(serange) if type == "": raise ValueError(_("SELinux Type is required")) @@ -1051,33 +1069,23 @@ raise ValueError(_("Could not create file context for %s") % target) rc = semanage_fcontext_set_expr(self.sh, fcontext, target) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: - raise ValueError(_("Could not create context for %s") % target) - - rc = semanage_context_set_user(self.sh, con, seuser) - if rc < 0: - raise ValueError(_("Could not set user in file context for %s") % target) - - rc = semanage_context_set_role(self.sh, con, "object_r") - if rc < 0: - raise ValueError(_("Could not set role in file context for %s") % target) - - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: - raise ValueError(_("Could not set type in file context for %s") % target) + if type != "<>": + con = self.createcon(target, seuser) - if serange != "": - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: - raise ValueError(_("Could not set mls fields in file context for %s") % target) + rc = semanage_context_set_type(self.sh, con, type) + if rc < 0: + raise ValueError(_("Could not set type in file context for %s") % target) + + if serange != "": + rc = semanage_context_set_mls(self.sh, con, serange) + if rc < 0: + raise ValueError(_("Could not set mls fields in file context for %s") % target) + rc = semanage_fcontext_set_con(self.sh, fcontext, con) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) semanage_fcontext_set_type(fcontext, file_types[ftype]) - rc = semanage_fcontext_set_con(self.sh, fcontext, con) - if rc < 0: - raise ValueError(_("Could not set file context for %s") % target) - rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) @@ -1090,7 +1098,8 @@ if rc < 0: raise ValueError(_("Could not add file context for %s") % target) - semanage_context_free(con) + if type != "<>": + semanage_context_free(con) semanage_fcontext_key_free(k) semanage_fcontext_free(fcontext) @@ -1112,16 +1121,29 @@ if rc < 0: raise ValueError(_("Could not query file context for %s") % target) - con = semanage_fcontext_get_con(fcontext) + if setype != "<>": + con = semanage_fcontext_get_con(fcontext) - if serange != "": - semanage_context_set_mls(self.sh, con, untranslate(serange)) - if seuser != "": - semanage_context_set_user(self.sh, con, seuser) - if setype != "": - semanage_context_set_type(self.sh, con, setype) - - rc = semanage_begin_transaction(self.sh) + if con == None: + con = self.createcon(target) + + if serange != "": + semanage_context_set_mls(self.sh, con, untranslate(serange)) + if seuser != "": + semanage_context_set_user(self.sh, con, seuser) + + if setype != "": + semanage_context_set_type(self.sh, con, setype) + + rc = semanage_fcontext_set_con(self.sh, fcontext, con) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) + else: + rc = semanage_fcontext_set_con(self.sh, fcontext, None) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) + + rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) @@ -1283,9 +1305,12 @@ raise ValueError(_("Could not list booleans")) for boolean in self.blist: - name = semanage_bool_get_name(boolean) - value = semanage_bool_get_value(boolean) - ddict[name] = value + value = [] + name = semanage_bool_get_name(boolean) + value[0] = semanage_bool_get_value(boolean) + value[1] = selinux.security_get_boolean_pending(boolean) + value[2] = selinux.security_get_boolean_active(boolean) + ddict[name] = value return ddict diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.26/semodule/semodule.8 --- nsapolicycoreutils/semodule/semodule.8 2007-07-16 14:20:42.000000000 -0400 +++ policycoreutils-2.0.26/semodule/semodule.8 2007-09-18 16:40:57.000000000 -0400 @@ -23,6 +23,9 @@ .B \-B, \-\-build force a rebuild of policy (also reloads unless -n is used) .TP +.B \-D, \-\-disable_dontaudit +Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt +.TP .B \-i,\-\-install=MODULE_PKG install/replace a module package .TP @@ -58,6 +61,10 @@ $ semodule -i httpd.pp # List non-base modules. $ semodule -l +# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing. +$ semodule -DB +# Turn "dontaudit" rules back on. +$ semodule -B # Install or replace all non-base modules in the current directory. $ semodule -i *.pp # Install or replace all modules in the current directory.