93 lines
7.1 KiB
Diff
93 lines
7.1 KiB
Diff
From 17b468428b8a30476d6add39e8a83ff550005968 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
|
Date: Tue, 14 Jan 2025 16:52:28 +0100
|
|
Subject: [PATCH] semanage: improve -e documentation and fix delete operation
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
Content-type: text/plain
|
|
|
|
Improve the documentation around the -e/--equal option for semanage
|
|
fcontext.
|
|
|
|
Closes: https://github.com/SELinuxProject/selinux/issues/457
|
|
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
|
|
Acked-by: Petr Lautrbach <lautrbach@redhat.com>
|
|
---
|
|
python/semanage/semanage | 13 +++++++------
|
|
python/semanage/semanage-fcontext.8 | 6 +++---
|
|
2 files changed, 10 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
|
index b269b9fca65b..891662699afd 100644
|
|
--- a/python/semanage/semanage
|
|
+++ b/python/semanage/semanage
|
|
@@ -54,7 +54,7 @@ usage_login = "semanage login [-h] [-n] [-N] [-S STORE] ["
|
|
usage_login_dict = {' --add': ('-s SEUSER', '-r RANGE', 'LOGIN',), ' --modify': ('-s SEUSER', '-r RANGE', 'LOGIN',), ' --delete': ('LOGIN',), ' --list': ('-C',), ' --extract': ('',), ' --deleteall': ('',)}
|
|
|
|
usage_fcontext = "semanage fcontext [-h] [-n] [-N] [-S STORE] ["
|
|
-usage_fcontext_dict = {' --add': ('(', '-t TYPE', '-f FTYPE', '-r RANGE', '-s SEUSER', '|', '-e EQUAL', ')', 'FILE_SPEC',), ' --delete': ('(', '-t TYPE', '-f FTYPE', '|', '-e EQUAL', ')', 'FILE_SPEC',), ' --modify': ('(', '-t TYPE', '-f FTYPE', '-r RANGE', '-s SEUSER', '|', '-e EQUAL', ')', 'FILE_SPEC',), ' --list': ('[-C]',), ' --extract': ('',), ' --deleteall': ('',)}
|
|
+usage_fcontext_dict = {' --add': ('(', '-t TYPE', '-f FTYPE', '-r RANGE', '-s SEUSER', '|', '-e TARGET_PATH', ')', 'FILE_SPEC',), ' --delete': ('(', '-t TYPE', '-f FTYPE', '|', '-e TARGET_PATH', ')', 'FILE_SPEC',), ' --modify': ('(', '-t TYPE', '-f FTYPE', '-r RANGE', '-s SEUSER', '|', '-e TARGET_PATH', ')', 'FILE_SPEC',), ' --list': ('[-C]',), ' --extract': ('',), ' --deleteall': ('',)}
|
|
|
|
usage_user = "semanage user [-h] [-n] [-N] [-S STORE] ["
|
|
usage_user_dict = {' --add': ('(', '-L LEVEL', '-R ROLES', '-r RANGE', 'SEUSER', ')'), ' --delete': ('SEUSER',), ' --modify': ('(', '-L LEVEL', '-R ROLES', '-r RANGE', '-s SEUSER', 'SEUSER', ')'), ' --list': ('-C',), ' --extract': ('',), ' --deleteall': ('',)}
|
|
@@ -306,7 +306,7 @@ def setupLoginParser(subparsers):
|
|
def handleFcontext(args):
|
|
fcontext_args = {'list': [('equal', 'ftype', 'seuser', 'type'), ('')], 'add': [('locallist'), ('type', 'file_spec')], 'modify': [('locallist'), ('type', 'file_spec')], 'delete': [('locallist'), ('file_spec')], 'extract': [('locallist', 'equal', 'ftype', 'seuser', 'type'), ('')], 'deleteall': [('locallist'), ('')]}
|
|
# we can not use mutually for equal because we can define some actions together with equal
|
|
- fcontext_equal_args = {'equal': [('list', 'locallist', 'type', 'ftype', 'seuser', 'deleteall', 'extract'), ()]}
|
|
+ fcontext_equal_args = {'equal': [('list', 'locallist', 'type', 'ftype', 'seuser', 'deleteall', 'extract'), ('file_spec')]}
|
|
|
|
if args.action and args.equal:
|
|
handle_opts(args, fcontext_equal_args, "equal")
|
|
@@ -355,9 +355,10 @@ def setupFcontextParser(subparsers):
|
|
parser_add_extract(fcontext_action, "fcontext")
|
|
parser_add_deleteall(fcontext_action, "fcontext")
|
|
|
|
- fcontextParser.add_argument('-e', '--equal', help=_(
|
|
- 'Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target \
|
|
-path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.'
|
|
+ fcontextParser.add_argument('-e', '--equal', metavar='TARGET_PATH', help=_(
|
|
+ 'Substitute FILE_SPEC with TARGET_PATH for file label lookup. This is used with fcontext. Requires source and target \
|
|
+path arguments to be path prefixes and does not support regular expressions. \
|
|
+The context labeling for the target subtree is made equivalent to that defined for the source.'
|
|
))
|
|
fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_(
|
|
'File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use d to match only \
|
|
@@ -368,7 +369,7 @@ If you do not specify a file type, the file type will default to "all files".'
|
|
parser_add_seuser(fcontextParser, "fcontext")
|
|
parser_add_type(fcontextParser, "fcontext")
|
|
parser_add_range(fcontextParser, "fcontext")
|
|
- fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
|
|
+ fcontextParser.add_argument('file_spec', nargs='?', default=None, metavar='FILE_SPEC', help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
|
|
fcontextParser.set_defaults(func=handleFcontext)
|
|
|
|
|
|
diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
|
|
index 3e327d88d146..3a96c62fda5d 100644
|
|
--- a/python/semanage/semanage-fcontext.8
|
|
+++ b/python/semanage/semanage-fcontext.8
|
|
@@ -3,7 +3,7 @@
|
|
semanage\-fcontext \- SELinux Policy Management file context tool
|
|
|
|
.SH "SYNOPSIS"
|
|
-.B semanage fcontext [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add ( \-t TYPE \-f FTYPE \-r RANGE \-s SEUSER | \-e EQUAL ) FILE_SPEC | \-\-delete ( \-t TYPE \-f FTYPE | \-e EQUAL ) FILE_SPEC | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify ( \-t TYPE \-f FTYPE \-r RANGE \-s SEUSER | \-e EQUAL ) FILE_SPEC ]
|
|
+.B semanage fcontext [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add ( \-t TYPE \-f FTYPE \-r RANGE \-s SEUSER | \-e TARGET_PATH ) FILE_SPEC | \-\-delete ( \-t TYPE \-f FTYPE | \-e TARGET_PATH ) FILE_SPEC | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify ( \-t TYPE \-f FTYPE \-r RANGE \-s SEUSER | \-e TARGET_PATH ) FILE_SPEC ]
|
|
|
|
.SH "DESCRIPTION"
|
|
semanage is used to configure certain elements of
|
|
@@ -66,8 +66,8 @@ Extract customizable commands, for use within a transaction
|
|
.I \-D, \-\-deleteall
|
|
Remove all local customizations
|
|
.TP
|
|
-.I \-e EQUAL, \-\-equal EQUAL
|
|
-Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.
|
|
+.I \-e TARGET_PATH, \-\-equal TARGET_PATH
|
|
+Substitute FILE_SPEC with TARGET_PATH for file label lookup. This is used with fcontext. Requires source and target path arguments to be path prefixes and does not support regular expressions. The context labeling for the target subtree is made equivalent to that defined for the source.
|
|
.TP
|
|
.I \-f [{a,f,d,c,b,s,l,p}], \-\-ftype [{a,f,d,c,b,s,l,p}]
|
|
File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use 'd' to match only directories or 'f' to match only regular files. The following file type options can be passed: f (regular file),d (directory),c (character device), b (block device),s (socket),l (symbolic link),p (named pipe). If you do not specify a file type, the file type will default to "all files".
|
|
--
|
|
2.53.0
|
|
|