rpms/policycoreutils
7
0
Fork 0
Code Issues Pull Requests Releases Activity
12a6440402
policycoreutils/policycoreutils-rhat.patch

1327 lines
59 KiB
Diff
Raw Blame History

diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile
index 77d8c80..eca632b 100644
--- a/policycoreutils/Makefile
+++ b/policycoreutils/Makefile
@@ -1,4 +1,4 @@
-SUBDIRS = setfiles semanage load_policy newrole run_init sandbox secon audit2allow audit2why sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui
+SUBDIRS = setfiles semanage semanage/default_encoding load_policy newrole run_init sandbox secon audit2allow audit2why sestatus semodule_package semodule semodule_link semodule_expand semodule_deps sepolgen-ifgen setsebool scripts po man gui
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
diff --git a/policycoreutils/audit2allow/sepolgen-ifgen b/policycoreutils/audit2allow/sepolgen-ifgen
index ef4bec3..9b313ec 100644
--- a/policycoreutils/audit2allow/sepolgen-ifgen
+++ b/policycoreutils/audit2allow/sepolgen-ifgen
@@ -61,20 +61,10 @@ def parse_options():
return options
-def get_policy():
- i = selinux.security_policyvers()
- p = selinux.selinux_binary_policy_path() + "." + str(i)
- while i > 0 and not os.path.exists(p):
- i = i - 1
- p = selinux.selinux_binary_policy_path() + "." + str(i)
- if i > 0:
- return p
- return None
-
def get_attrs(policy_path):
try:
if not policy_path:
- policy_path = get_policy()
+ policy_path = selinux.selinux_current_policy_path()
if not policy_path:
sys.stderr.write("No installed policy to check\n")
return None
diff --git a/policycoreutils/gui/Makefile b/policycoreutils/gui/Makefile
index 1464971..153da2d 100644
--- a/policycoreutils/gui/Makefile
+++ b/policycoreutils/gui/Makefile
@@ -16,7 +16,8 @@ portsPage.py \
semanagePage.py \
statusPage.py \
system-config-selinux.glade \
-usersPage.py
+usersPage.py \
+selinux.tbl
all: $(TARGETS) system-config-selinux.py polgengui.py templates polgen.py
diff --git a/policycoreutils/gui/selinux.tbl b/policycoreutils/gui/selinux.tbl
new file mode 100644
index 0000000..07ccf6e
--- /dev/null
+++ b/policycoreutils/gui/selinux.tbl
@@ -0,0 +1,233 @@
+acct_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for acct daemon")
+allow_daemons_dump_core _("Admin") _("Allow all daemons to write corefiles to /")
+allow_daemons_use_tty _("Admin") _("Allow all daemons the ability to use unallocated ttys")
+allow_gadmin_exec_content _("User Privs") _("Allow gadmin SELinux user account to execute files in home directory or /tmp")
+allow_guest_exec_content _("User Privs") _("Allow guest SELinux user account to execute files in home directory or /tmp")
+allow_java_execstack _("Memory Protection") _("Allow java executable stack")
+allow_mount_anyfile _("Mount") _("Allow mount to mount any file")
+allow_mounton_anydir _("Mount") _("Allow mount to mount any directory")
+allow_mplayer_execstack _("Memory Protection") _("Allow mplayer executable stack")
+allow_ssh_keysign _("SSH") _("Allow ssh to run ssh-keysign")
+allow_staff_exec_content _("User Privs") _("Allow staff SELinux user account to execute files in home directory or /tmp")
+allow_sysadm_exec_content _("User Privs") _("Allow sysadm SELinux user account to execute files in home directory or /tmp")
+allow_unconfined_exec_content _("User Privs") _("Allow unconfined SELinux user account to execute files in home directory or /tmp")
+allow_unlabeled_packets _("Network Configuration") _("Allow unlabeled packets to flow on the network")
+allow_user_exec_content _("User Privs") _("Allow user SELinux user account to execute files in home directory or /tmp")
+allow_unconfined_execmem_dyntrans _("Memory Protection") _("Allow unconfined to dyntrans to unconfined_execmem")
+allow_user_mysql_connect _("Databases") _("Allow user to connect to mysql socket")
+allow_user_postgresql_connect _("Databases") _("Allow user to connect to postgres socket")
+allow_write_xshm _("XServer") _("Allow clients to write to X shared memory")
+allow_xguest_exec_content _("User Privs") _("Allow xguest SELinux user account to execute files in home directory or /tmp")
+allow_ypbind _("NIS") _("Allow daemons to run with NIS")
+browser_confine_staff _("Web Applications") _("Transition staff SELinux user to Web Browser Domain")
+browser_confine_sysadm _("Web Applications") _("Transition sysadm SELinux user to Web Browser Domain")
+browser_confine_user _("Web Applications") _("Transition user SELinux user to Web Browser Domain")
+browser_confine_xguest _("Web Applications") _("Transition xguest SELinux user to Web Browser Domain")
+browser_write_staff_data _("Web Applications") _("Allow staff Web Browsers to write to home directories")
+browser_write_sysadm_data _("Web Applications") _("Allow staff Web Browsers to write to home directories")
+browser_write_user_data _("Web Applications") _("Allow staff Web Browsers to write to home directories")
+browser_write_xguest_data _("Web Applications") _("Allow staff Web Browsers to write to home directories")
+amanda_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for amanda")
+amavis_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for amavis")
+apmd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for apmd daemon")
+arpwatch_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for arpwatch daemon")
+auditd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for auditd daemon")
+automount_disable_trans _("Mount") _("Disable SELinux protection for automount daemon")
+avahi_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for avahi")
+bluetooth_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for bluetooth daemon")
+canna_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for canna daemon")
+cardmgr_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for cardmgr daemon")
+ccs_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for Cluster Server")
+cdrecord_read_content _("User Privs") _("Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files")
+ciped_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ciped daemon")
+clamd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for clamd daemon")
+clamscan_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for clamscan")
+clvmd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for clvmd")
+comsat_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for comsat daemon")
+courier_authdaemon_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for courier daemon")
+courier_pcp_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for courier daemon")
+courier_pop_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for courier daemon")
+courier_sqwebmail_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for courier daemon")
+courier_tcpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for courier daemon")
+cpucontrol_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for cpucontrol daemon")
+cpuspeed_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for cpuspeed daemon")
+crond_disable_trans _("Cron") _("Disable SELinux protection for crond daemon")
+cupsd_config_disable_trans _("Printing") _("Disable SELinux protection for cupsd back end server")
+cupsd_disable_trans _("Printing") _("Disable SELinux protection for cupsd daemon")
+cupsd_lpd_disable_trans _("Printing") _("Disable SELinux protection for cupsd_lpd")
+cvs_disable_trans _("CVS") _("Disable SELinux protection for cvs daemon")
+cyrus_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for cyrus daemon")
+dbskkd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dbskkd daemon")
+dbusd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dbusd daemon")
+dccd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dccd")
+dccifd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dccifd")
+dccm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dccm")
+ddt_client_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ddt daemon")
+devfsd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for devfsd daemon")
+dhcpc_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dhcpc daemon")
+dhcpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dhcpd daemon")
+dictd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dictd daemon")
+direct_sysadm_daemon _("Admin") _("Allow sysadm_t to directly start daemons")
+disable_evolution_trans _("Web Applications") _("Disable SELinux protection for Evolution")
+disable_games_trans _("Games") _("Disable SELinux protection for games")
+disable_mozilla_trans _("Web Applications") _("Disable SELinux protection for the web browsers")
+disable_thunderbird_trans _("Web Applications") _("Disable SELinux protection for Thunderbird")
+distccd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for distccd daemon")
+dmesg_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dmesg daemon")
+dnsmasq_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dnsmasq daemon")
+dovecot_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for dovecot daemon")
+entropyd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for entropyd daemon")
+fetchmail_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for fetchmail")
+fingerd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for fingerd daemon")
+freshclam_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for freshclam daemon")
+fsdaemon_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for fsdaemon daemon")
+gpm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for gpm daemon")
+gssd_disable_trans _("NFS") _("Disable SELinux protection for gss daemon")
+hald_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for Hal daemon")
+hide_broken_symptoms _("Compatibility") _("Do not audit things that we know to be broken but which are not security risks")
+hostname_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for hostname daemon")
+hotplug_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for hotplug daemon")
+howl_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for howl daemon")
+hplip_disable_trans _("Printing") _("Disable SELinux protection for cups hplip daemon")
+httpd_rotatelogs_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for httpd rotatelogs")
+httpd_suexec_disable_trans _("HTTPD Service") _("Disable SELinux protection for http suexec")
+hwclock_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for hwclock daemon")
+i18n_input_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for i18n daemon")
+imazesrv_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for imazesrv daemon")
+inetd_child_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for inetd child daemons")
+inetd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for inetd daemon")
+innd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for innd daemon")
+iptables_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for iptables daemon")
+ircd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ircd daemon")
+irqbalance_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for irqbalance daemon")
+iscsid_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for iscsi daemon")
+jabberd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for jabberd daemon")
+kadmind_disable_trans _("Kerberos") _("Disable SELinux protection for kadmind daemon")
+klogd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for klogd daemon")
+krb5kdc_disable_trans _("Kerberos") _("Disable SELinux protection for krb5kdc daemon")
+ktalkd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ktalk daemons")
+kudzu_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for kudzu daemon")
+locate_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for locate daemon")
+lpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for lpd daemon")
+lrrd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for lrrd daemon")
+lvm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for lvm daemon")
+mailman_mail_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for mailman")
+mail_read_content _("Web Applications") _("Allow evolution and thunderbird to read user files")
+mdadm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for mdadm daemon")
+monopd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for monopd daemon")
+mozilla_read_content _("Web Applications") _("Allow the mozilla browser to read user files")
+mrtg_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for mrtg daemon")
+mysqld_disable_trans _("Databases") _("Disable SELinux protection for mysqld daemon")
+nagios_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for nagios daemon")
+named_disable_trans _("Name Service") _("Disable SELinux protection for named daemon")
+nessusd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for nessusd daemon")
+NetworkManager_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for NetworkManager")
+nfsd_disable_trans _("NFS") _("Disable SELinux protection for nfsd daemon")
+nmbd_disable_trans _("Samba") _("Disable SELinux protection for nmbd daemon")
+nrpe_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for nrpe daemon")
+nscd_disable_trans _("Name Service") _("Disable SELinux protection for nscd daemon")
+nsd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for nsd daemon")
+ntpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ntpd daemon")
+oddjob_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for oddjob")
+oddjob_mkhomedir_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for oddjob_mkhomedir")
+openvpn_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for openvpn daemon")
+pam_console_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for pam daemon")
+pegasus_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for pegasus")
+perdition_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for perdition daemon")
+portmap_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for portmap daemon")
+portslave_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for portslave daemon")
+postfix_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for postfix")
+postgresql_disable_trans _("Databases") _("Disable SELinux protection for postgresql daemon")
+pppd_for_user _("pppd") _("Allow pppd to be run for a regular user")
+pptp_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for pptp")
+prelink_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for prelink daemon")
+privoxy_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for privoxy daemon")
+ptal_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ptal daemon")
+pxe_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for pxe daemon")
+pyzord_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for pyzord")
+quota_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for quota daemon")
+radiusd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for radiusd daemon")
+radvd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for radvd daemon")
+rdisc_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for rdisc")
+readahead_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for readahead")
+read_default_t _("Admin") _("Allow programs to read files in non-standard locations (default_t)")
+restorecond_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for restorecond")
+rhgb_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for rhgb daemon")
+ricci_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ricci")
+ricci_modclusterd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ricci_modclusterd")
+rlogind_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for rlogind daemon")
+rpcd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for rpcd daemon")
+rshd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for rshd")
+rsync_disable_trans _("rsync") _("Disable SELinux protection for rsync daemon")
+run_ssh_inetd _("SSH") _("Allow ssh to run from inetd instead of as a daemon")
+samba_share_nfs _("Samba") _("Allow Samba to share nfs directories")
+allow_saslauthd_read_shadow _("SASL authentication server") _("Allow sasl authentication server to read /etc/shadow")
+allow_xserver_execmem _("XServer") _("Allow X-Windows server to map a memory region as both executable and writable")
+saslauthd_disable_trans _("SASL authentication server") _("Disable SELinux protection for saslauthd daemon")
+scannerdaemon_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for scannerdaemon daemon")
+secure_mode _("Admin") _("Do not allow transition to sysadm_t, sudo and su effected")
+secure_mode_insmod _("Admin") _("Do not allow any processes to load kernel modules")
+secure_mode_policyload _("Admin") _("Do not allow any processes to modify kernel SELinux policy")
+sendmail_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for sendmail daemon")
+setrans_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for setrans")
+setroubleshootd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for setroubleshoot daemon")
+slapd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for slapd daemon")
+slrnpull_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for slrnpull daemon")
+smbd_disable_trans _("Samba") _("Disable SELinux protection for smbd daemon")
+snmpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for snmpd daemon")
+snort_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for snort daemon")
+soundd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for soundd daemon")
+sound_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for sound daemon")
+spamd_disable_trans _("Spam Protection") _("Disable SELinux protection for spamd daemon")
+spamd_enable_home_dirs _("Spam Protection") _("Allow spamd to access home directories")
+spamassassin_can_network _("Spam Protection") _("Allow Spam Assassin daemon network access")
+speedmgmt_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for speedmgmt daemon")
+squid_connect_any _("Squid") _("Allow squid daemon to connect to the network")
+squid_disable_trans _("Squid") _("Disable SELinux protection for squid daemon")
+ssh_keygen_disable_trans _("SSH") _("Disable SELinux protection for ssh daemon")
+ssh_sysadm_login _("SSH") _("Allow ssh logins as sysadm_r:sysadm_t")
+staff_read_sysadm_file _("Admin") _("Allow staff_r users to search the sysadm home dir and read files (such as ~/.bashrc)")
+stunnel_disable_trans _("Universal SSL tunnel") _("Disable SELinux protection for stunnel daemon")
+stunnel_is_daemon _("Universal SSL tunnel") _("Allow stunnel daemon to run as standalone, outside of xinetd")
+swat_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for swat daemon")
+sxid_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for sxid daemon")
+syslogd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for syslogd daemon")
+system_crond_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for system cron jobs")
+tcpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for tcp daemon")
+telnetd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for telnet daemon")
+tftpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for tftpd daemon")
+transproxy_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for transproxy daemon")
+udev_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for udev daemon")
+uml_switch_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for uml daemon")
+unlimitedInetd _("Admin") _("Allow xinetd to run unconfined, including any services it starts that do not have a domain transition explicitly defined")
+unlimitedRC _("Admin") _("Allow rc scripts to run unconfined, including any daemon started by an rc script that does not have a domain transition explicitly defined")
+unlimitedRPM _("Admin") _("Allow rpm to run unconfined")
+unlimitedUtils _("Admin") _("Allow privileged utilities like hotplug and insmod to run unconfined")
+updfstab_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for updfstab daemon")
+uptimed_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for uptimed daemon")
+user_canbe_sysadm _("User Privs") _("Allow user_r to reach sysadm_r via su, sudo, or userhelper. Otherwise, only staff_r can do so")
+user_can_mount _("Mount") _("Allow users to execute the mount command")
+user_direct_mouse _("User Privs") _("Allow regular users direct mouse access (only allow the X server)")
+user_dmesg _("User Privs") _("Allow users to run the dmesg command")
+user_net_control _("User Privs") _("Allow users to control network interfaces (also needs USERCTL=true)")
+user_ping _("User Privs") _("Allow normal user to execute ping")
+user_rw_noexattrfile _("User Privs") _("Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY)")
+user_rw_usb _("User Privs") _("Allow users to rw usb devices")
+user_tcp_server _("User Privs") _("Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols")
+user_ttyfile_stat _("User Privs") _("Allow user to stat ttyfiles")
+uucpd_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for uucpd daemon")
+vmware_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for vmware daemon")
+watchdog_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for watchdog daemon")
+winbind_disable_trans _("Samba") _("Disable SELinux protection for winbind daemon")
+xdm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for xdm daemon")
+xdm_sysadm_login _("XServer") _("Allow xdm logins as sysadm_r:sysadm_t")
+xend_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for xen daemon")
+xen_use_raw_disk _("XEN") _("Allow xen to read/write physical disk devices")
+xfs_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for xfs daemon")
+xm_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for xen control")
+ypbind_disable_trans _("NIS") _("Disable SELinux protection for ypbind daemon")
+yppasswdd_disable_trans _("NIS") _("Disable SELinux protection for NIS Password Daemon")
+ypserv_disable_trans _("SELinux Service Protection") _("Disable SELinux protection for ypserv daemon")
+ypxfr_disable_trans _("NIS") _("Disable SELinux protection for NIS Transfer Daemon")
+webadm_manage_user_files _("HTTPD Service") _("Allow SELinux webadm user to manage unprivileged users home directories")
+webadm_read_user_files _("HTTPD Service") _("Allow SELinux webadm user to read unprivileged users home directories")
diff --git a/policycoreutils/gui/templates/etc_rw.py b/policycoreutils/gui/templates/etc_rw.py
index 0d3dbfe..dcf445e 100644
--- a/policycoreutils/gui/templates/etc_rw.py
+++ b/policycoreutils/gui/templates/etc_rw.py
@@ -29,7 +29,13 @@ files_type(TEMPLATETYPE_etc_rw_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t)
-files_etc_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, { dir file })
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t)
+files_etc_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, { dir file lnk_file })
+"""
+
+te_stream_rules="""
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t)
+files_etc_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t, sock_file)
"""
########################### Interface File #############################
@@ -68,8 +74,8 @@ interface(`TEMPLATETYPE_read_conf_files',`
type TEMPLATETYPE_etc_rw_t;
')
- allow $1 TEMPLATETYPE_etc_rw_t:file read_file_perms;
allow $1 TEMPLATETYPE_etc_rw_t:dir list_dir_perms;
+ read_files_pattern($1, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t)
files_search_etc($1)
')
@@ -94,6 +100,27 @@ interface(`TEMPLATETYPE_manage_conf_files',`
"""
+if_stream_rules="""\
+########################################
+## <summary>
+## Connect to TEMPLATETYPE over a unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`TEMPLATETYPE_stream_connect',`
+ gen_require(`
+ type TEMPLATETYPE_t, TEMPLATETYPE_etc_rw_t;
+ ')
+
+ files_search_etc($1)
+ stream_connect_pattern($1, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_etc_rw_t, TEMPLATETYPE_t)
+')
+"""
+
if_admin_types="""
type TEMPLATETYPE_etc_rw_t;"""
diff --git a/policycoreutils/gui/templates/executable.py b/policycoreutils/gui/templates/executable.py
index 5b39d77..824fddd 100644
--- a/policycoreutils/gui/templates/executable.py
+++ b/policycoreutils/gui/templates/executable.py
@@ -50,7 +50,9 @@ policy_module(TEMPLATETYPE, 1.0.0)
type TEMPLATETYPE_t;
type TEMPLATETYPE_exec_t;
-dbus_system_domain(TEMPLATETYPE_t, TEMPLATETYPE_exec_t)
+domain_type(TEMPLATETYPE_t)
+domain_entry_file(TEMPLATETYPE_t, TEMPLATETYPE_exec_t)
+role system_r types TEMPLATETYPE_t;
permissive TEMPLATETYPE_t;
"""
@@ -123,6 +125,9 @@ te_inetd_rules="""
"""
te_dbusd_rules="""
+optional_policy(`
+ dbus_system_domain(TEMPLATETYPE_t, TEMPLATETYPE_exec_t)
+')
"""
te_userapp_rules="""
@@ -281,7 +286,7 @@ interface(`TEMPLATETYPE_role',`
TEMPLATETYPE_domtrans($2)
ps_process_pattern($2, TEMPLATETYPE_t)
- allow $2 TEMPLATETYPE_t:process signal;
+ allow $2 TEMPLATETYPE_t:process { signull signal sigkill };
')
"""
diff --git a/policycoreutils/gui/templates/rw.py b/policycoreutils/gui/templates/rw.py
index 5dfc42f..143f56a 100644
--- a/policycoreutils/gui/templates/rw.py
+++ b/policycoreutils/gui/templates/rw.py
@@ -29,6 +29,7 @@ files_type(TEMPLATETYPE_rw_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t)
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t)
"""
########################### Interface File #############################
@@ -67,7 +68,7 @@ interface(`TEMPLATETYPE_read_rw_files',`
type TEMPLATETYPE_rw_t;
')
- allow $1 TEMPLATETYPE_rw_t:file read_file_perms;
+ read_files_pattern($1, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t)
allow $1 TEMPLATETYPE_rw_t:dir list_dir_perms;
files_search_rw($1)
')
@@ -111,6 +112,30 @@ interface(`TEMPLATETYPE_manage_rw_dirs',`
"""
+te_stream_rules="""
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t)
+"""
+
+if_stream_rules="""\
+########################################
+## <summary>
+## Connect to TEMPLATETYPE over a unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`TEMPLATETYPE_stream_connect',`
+ gen_require(`
+ type TEMPLATETYPE_t, TEMPLATETYPE_rw_t;
+ ')
+
+ stream_connect_pattern($1, TEMPLATETYPE_rw_t, TEMPLATETYPE_rw_t, TEMPLATETYPE_t)
+')
+"""
+
if_admin_types="""
type TEMPLATETYPE_rw_t;"""
diff --git a/policycoreutils/gui/templates/tmp.py b/policycoreutils/gui/templates/tmp.py
index d2adaa4..c000a75 100644
--- a/policycoreutils/gui/templates/tmp.py
+++ b/policycoreutils/gui/templates/tmp.py
@@ -29,7 +29,13 @@ files_tmp_file(TEMPLATETYPE_tmp_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t)
-files_tmp_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, { dir file })
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t)
+files_tmp_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, { dir file lnk_file })
+"""
+
+te_stream_rules="""
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t)
+files_tmp_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_tmp_t, sock_file)
"""
if_rules="""
@@ -68,7 +74,7 @@ interface(`TEMPLATETYPE_read_tmp_files',`
')
files_search_tmp($1)
- allow $1 TEMPLATETYPE_tmp_t:file read_file_perms;
+ read_files_pattern($1, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t)
')
########################################
@@ -93,6 +99,27 @@ interface(`TEMPLATETYPE_manage_tmp',`
')
"""
+if_stream_rules="""\
+########################################
+## <summary>
+## Connect to TEMPLATETYPE over a unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`TEMPLATETYPE_stream_connect',`
+ gen_require(`
+ type TEMPLATETYPE_t, TEMPLATETYPE_tmp_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, TEMPLATETYPE_tmp_t, TEMPLATETYPE_tmp_t, TEMPLATETYPE_t)
+')
+"""
+
if_admin_types="""
type TEMPLATETYPE_tmp_t;"""
diff --git a/policycoreutils/gui/templates/var_cache.py b/policycoreutils/gui/templates/var_cache.py
index 8efc1d9..3789723 100644
--- a/policycoreutils/gui/templates/var_cache.py
+++ b/policycoreutils/gui/templates/var_cache.py
@@ -30,7 +30,12 @@ te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, TEMPLATETYPE_cache_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, TEMPLATETYPE_cache_t)
manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, TEMPLATETYPE_cache_t)
-files_var_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, { dir file })
+files_var_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, { dir file lnk_file })
+"""
+
+te_stream_rules="""\
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, TEMPLATETYPE_cache_t)
+files_var_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_cache_t, sock_file)
"""
########################### Interface File #############################
@@ -114,6 +119,26 @@ interface(`TEMPLATETYPE_manage_cache_dirs',`
"""
+if_stream_rules="""
+########################################
+## <summary>
+## Connect to TEMPLATETYPE over a unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`TEMPLATETYPE_stream_connect',`
+ gen_require(`
+ type TEMPLATETYPE_t, TEMPLATETYPE_cache_t;
+ ')
+
+ stream_connect_pattern($1, TEMPLATETYPE_cache_t, TEMPLATETYPE_cache_t)
+')
+"""
+
if_admin_types="""
type TEMPLATETYPE_cache_t;"""
diff --git a/policycoreutils/gui/templates/var_lib.py b/policycoreutils/gui/templates/var_lib.py
index 8bde8c6..148c13e 100644
--- a/policycoreutils/gui/templates/var_lib.py
+++ b/policycoreutils/gui/templates/var_lib.py
@@ -29,11 +29,12 @@ files_type(TEMPLATETYPE_var_lib_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, TEMPLATETYPE_var_lib_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, TEMPLATETYPE_var_lib_t)
-files_var_lib_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, { dir file })
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, TEMPLATETYPE_var_lib_t)
+files_var_lib_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, { dir file lnk_file })
"""
te_stream_rules="""\
-allow TEMPLATETYPE_t TEMPLATETYPE_var_lib_t:sock_file manage_sock_file_perms;
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, TEMPLATETYPE_var_lib_t)
files_var_lib_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_lib_t, sock_file)
"""
diff --git a/policycoreutils/gui/templates/var_log.py b/policycoreutils/gui/templates/var_log.py
index b57b93d..371dd7e 100644
--- a/policycoreutils/gui/templates/var_log.py
+++ b/policycoreutils/gui/templates/var_log.py
@@ -30,7 +30,8 @@ logging_log_file(TEMPLATETYPE_log_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_log_t, TEMPLATETYPE_log_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_log_t, TEMPLATETYPE_log_t)
-logging_log_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_log_t, { dir file })
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_log_t, TEMPLATETYPE_log_t)
+logging_log_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_log_t, { dir file lnk_file })
"""
########################### Interface File #############################
diff --git a/policycoreutils/gui/templates/var_run.py b/policycoreutils/gui/templates/var_run.py
index 916f44c..563eebb 100644
--- a/policycoreutils/gui/templates/var_run.py
+++ b/policycoreutils/gui/templates/var_run.py
@@ -29,11 +29,12 @@ files_pid_file(TEMPLATETYPE_var_run_t)
te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, TEMPLATETYPE_var_run_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, TEMPLATETYPE_var_run_t)
-files_pid_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, { dir file })
+manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, TEMPLATETYPE_var_run_t)
+files_pid_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, { dir file lnk_file })
"""
te_stream_rules="""
-allow TEMPLATETYPE_t TEMPLATETYPE_var_run_t:sock_file manage_sock_file_perms;
+manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, TEMPLATETYPE_var_run_t)
files_pid_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_var_run_t, sock_file)
"""
@@ -54,7 +55,7 @@ interface(`TEMPLATETYPE_read_pid_files',`
')
files_search_pids($1)
- allow $1 TEMPLATETYPE_var_run_t:file read_file_perms;
+ read_files_pattern($1, TEMPLATETYPE_var_run_t, TEMPLATETYPE_var_run_t)
')
"""
diff --git a/policycoreutils/gui/templates/var_spool.py b/policycoreutils/gui/templates/var_spool.py
index 8055a9e..dccb5f1 100644
--- a/policycoreutils/gui/templates/var_spool.py
+++ b/policycoreutils/gui/templates/var_spool.py
@@ -30,7 +30,12 @@ te_rules="""
manage_dirs_pattern(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, TEMPLATETYPE_spool_t)
manage_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, TEMPLATETYPE_spool_t)
manage_lnk_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, TEMPLATETYPE_spool_t)
-files_spool_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, { dir file })
+files_spool_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, { dir file lnk_file })
+"""
+
+te_stream_rules="""\
+manage_sock_files_pattern(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, TEMPLATETYPE_spool_t)
+files_spool_filetrans(TEMPLATETYPE_t, TEMPLATETYPE_spool_t, sock_file)
"""
########################### Interface File #############################
@@ -113,6 +118,26 @@ interface(`TEMPLATETYPE_manage_spool_dirs',`
"""
+if_stream_rules="""
+########################################
+## <summary>
+## Connect to TEMPLATETYPE over a unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`TEMPLATETYPE_stream_connect',`
+ gen_require(`
+ type TEMPLATETYPE_t, TEMPLATETYPE_spool_t;
+ ')
+
+ stream_connect_pattern($1, TEMPLATETYPE_spool_t, TEMPLATETYPE_spool_t)
+')
+"""
+
if_admin_types="""
type TEMPLATETYPE_spool_t;"""
diff --git a/policycoreutils/load_policy/Makefile b/policycoreutils/load_policy/Makefile
index 5da2e0d..7c5bab0 100644
--- a/policycoreutils/load_policy/Makefile
+++ b/policycoreutils/load_policy/Makefile
@@ -19,7 +19,7 @@ install: all
test -d $(MANDIR)/man8 || install -m 755 -d $(MANDIR)/man8
install -m 644 load_policy.8 $(MANDIR)/man8/
-mkdir -p $(USRSBINDIR)
- -ln -sf /sbin/load_policy $(USRSBINDIR)/load_policy
+ -ln -sf $(SBINDIR)/load_policy $(USRSBINDIR)/load_policy
clean:
-rm -f $(TARGETS) *.o
diff --git a/policycoreutils/sandbox/seunshare.c b/policycoreutils/sandbox/seunshare.c
index 3bb3c4b..d16e331 100644
--- a/policycoreutils/sandbox/seunshare.c
+++ b/policycoreutils/sandbox/seunshare.c
@@ -31,6 +31,12 @@
#include <selinux/context.h> /* for context-mangling functions */
#include <dirent.h>
+
+/*
+ * Note setfsuid never returns an error code. But the compiler complains if
+ * I do not check, so I am checking for -1, which should never happen.
+ */
+
#ifdef USE_NLS
#include <locale.h> /* for setlocale() */
#include <libintl.h> /* for gettext() */
@@ -617,12 +623,15 @@ static int cleanup_tmpdir(const char *tmpdir, const char *src,
free(cmdbuf); cmdbuf = NULL;
/* remove runtime temporary directory */
- setfsuid(0);
+ if (setfsuid(0) < 0)
+ rc++;
+
if (rmdir(tmpdir) == -1)
fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno));
- setfsuid(pwd->pw_uid);
+ if (setfsuid(pwd->pw_uid) < 0)
+ rc++;
- return 0;
+ return rc;
}
/**
@@ -642,7 +651,9 @@ static char *create_tmpdir(const char *src, struct stat *src_st,
/* get selinux context */
if (execcon) {
- setfsuid(pwd->pw_uid);
+ if (setfsuid(pwd->pw_uid) < 0)
+ goto err;
+
if ((fd_s = open(src, O_RDONLY)) < 0) {
fprintf(stderr, _("Failed to open directory %s: %s\n"), src, strerror(errno));
goto err;
@@ -661,7 +672,8 @@ static char *create_tmpdir(const char *src, struct stat *src_st,
}
/* ok to not reach this if there is an error */
- setfsuid(0);
+ if (setfsuid(0) < 0)
+ goto err;
}
if (asprintf(&tmpdir, "/tmp/.sandbox-%s-XXXXXX", pwd->pw_name) == -1) {
@@ -716,14 +728,16 @@ static char *create_tmpdir(const char *src, struct stat *src_st,
}
}
- setfsuid(pwd->pw_uid);
+ if (setfsuid(pwd->pw_uid) < 0)
+ goto err;
if (rsynccmd(src, tmpdir, &cmdbuf) < 0) {
goto err;
}
/* ok to not reach this if there is an error */
- setfsuid(0);
+ if (setfsuid(0) < 0)
+ goto err;
if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) {
fprintf(stderr, _("Failed to populate runtime temporary directory\n"));
@@ -916,7 +930,8 @@ int main(int argc, char **argv) {
/* Changing fsuid is usually required when user-specified directory is
* on an NFS mount. It's also desired to avoid leaking info about
* existence of the files not accessible to the user. */
- setfsuid(uid);
+ if (setfsuid(uid) < 0)
+ return -1;
/* verify homedir and tmpdir */
if (homedir_s && (
@@ -925,7 +940,7 @@ int main(int argc, char **argv) {
if (tmpdir_s && (
verify_directory(tmpdir_s, NULL, &st_tmpdir_s) < 0 ||
check_owner_uid(uid, tmpdir_s, &st_tmpdir_s))) return -1;
- setfsuid(0);
+ if (setfsuid(0) < 0) return -1;
/* create runtime tmpdir */
if (tmpdir_s && (tmpdir_r = create_tmpdir(tmpdir_s, &st_tmpdir_s,
@@ -959,7 +974,7 @@ int main(int argc, char **argv) {
}
/* assume fsuid==ruid after this point */
- setfsuid(uid);
+ if (setfsuid(uid) < 0) goto childerr;
/* mount homedir and tmpdir, in this order */
if (homedir_s && seunshare_mount(homedir_s, pwd->pw_dir,
@@ -1005,7 +1020,7 @@ int main(int argc, char **argv) {
/* selinux context */
if (execcon && setexeccon(execcon) != 0) {
- fprintf(stderr, _("Could not set exec context to %s.\n"), execcon);
+ fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
goto childerr;
}
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index 989b1ae..19a4ff0 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -114,6 +114,7 @@ exclude_dirs() {
# Set global Variables
#
fullFlag=0
+VERBOSE="-p"
FORCEFLAG=""
DIRS=""
RPMILES=""
@@ -176,7 +177,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
esac; \
fi; \
done | \
- ${RESTORECON} -i -f - -R -p `exclude_dirs`; \
+ ${RESTORECON} ${VERBOSE} -i -f - -R `exclude_dirs`; \
rm -f ${TEMPFILE} ${PREFCTEMPFILE}
fi
}
@@ -206,12 +207,12 @@ if [ ! -z "$PREFC" ]; then
fi
if [ ! -z "$RPMFILES" ]; then
for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
- rpmlist $i | ${RESTORECON} ${FORCEFLAG} $* -R -i -f - 2>&1 | cat >> $LOGFILE
+ rpmlist $i | ${RESTORECON} ${FORCEFLAG} ${VERBOSE} $* -R -i -f - 2>&1 | cat >> $LOGFILE
done
exit $?
fi
if [ ! -z "$FILEPATH" ]; then
- ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 | cat >> $LOGFILE
+ ${RESTORECON} ${FORCEFLAG} ${VERBOSE} -R $* $FILEPATH 2>&1 | cat >> $LOGFILE
return
fi
[ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
@@ -286,7 +287,7 @@ process() {
# Make sure they specified one of the three valid commands
#
case "$1" in
- restore) restore -p ;;
+ restore) restore;;
check) restore -n -v;;
verify) restore -n -o -;;
relabel) relabel;;
@@ -317,11 +318,14 @@ if [ $# = 0 ]; then
fi
# See how we were called.
-while getopts "C:FfR:l:" i; do
+while getopts "C:FfR:l:v" i; do
case "$i" in
f)
fullFlag=1
;;
+ v)
+ VERBOSE="-v"
+ ;;
R)
RPMFILES=$OPTARG
;;
diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
index 0b4cbaa..9ab7334 100644
--- a/policycoreutils/scripts/fixfiles.8
+++ b/policycoreutils/scripts/fixfiles.8
@@ -5,13 +5,13 @@ fixfiles \- fix file SELinux security contexts.
.SH "SYNOPSIS"
.B fixfiles
-.I [-F] [-l logfile ] { check | restore|[-f] relabel | verify } [[dir/file] ... ]
+.I [-v] [-F] [-l logfile ] { check | restore|[-f] relabel | verify } [[dir/file] ... ]
.B fixfiles
-.I [-F] [ -R rpmpackagename[,rpmpackagename...] ] [-l logfile ] { check | restore | verify }
+.I [-v] [-F] [ -R rpmpackagename[,rpmpackagename...] ] [-l logfile ] { check | restore | verify }
.B fixfiles
-.I [ -C PREVIOUS_FILECONTEXT ] [-l logfile ] { check | restore | verify }
+.I [-v] [ -C PREVIOUS_FILECONTEXT ] [-l logfile ] { check | restore | verify }
.B fixfiles
.I onboot
@@ -54,6 +54,10 @@ Use the rpm database to discover all files within the specified packages and res
.B -C PREVIOUS_FILECONTEXT
Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.
+.TP
+.B -v
+Modify verbosity from progess to verbose. (Run restorecon with -v instead of -p)
+
.SH "ARGUMENTS"
One of:
.TP
diff --git a/policycoreutils/scripts/genhomedircon b/policycoreutils/scripts/genhomedircon
new file mode 100644
index 0000000..58b19cd
--- /dev/null
+++ b/policycoreutils/scripts/genhomedircon
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/sbin/semodule -Bn
diff --git a/policycoreutils/semanage/default_encoding/Makefile b/policycoreutils/semanage/default_encoding/Makefile
new file mode 100644
index 0000000..e15a877
--- /dev/null
+++ b/policycoreutils/semanage/default_encoding/Makefile
@@ -0,0 +1,8 @@
+all:
+ LDFLAGS="" python setup.py build
+
+install: all
+ LDFLAGS="" python setup.py install --root=$(DESTDIR)/
+
+clean:
+ rm -rf build *~
diff --git a/policycoreutils/semanage/default_encoding/default_encoding.c b/policycoreutils/semanage/default_encoding/default_encoding.c
new file mode 100644
index 0000000..023b8f4
--- /dev/null
+++ b/policycoreutils/semanage/default_encoding/default_encoding.c
@@ -0,0 +1,57 @@
+/*
+ * Authors:
+ * John Dennis <jdennis@redhat.com>
+ *
+ * Copyright (C) 2009 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <Python.h>
+
+PyDoc_STRVAR(setdefaultencoding_doc,
+"setdefaultencoding(encoding='utf-8')\n\
+\n\
+Set the current default string encoding used by the Unicode implementation.\n\
+Defaults to utf-8."
+);
+
+static PyObject *
+setdefaultencoding(PyObject *self, PyObject *args, PyObject *kwds)
+{
+ static char *kwlist[] = {"utf-8", NULL};
+ char *encoding;
+
+ if (!PyArg_ParseTupleAndKeywords(args, kwds, "s:setdefaultencoding", kwlist, &encoding))
+ return NULL;
+
+ if (PyUnicode_SetDefaultEncoding(encoding))
+ return NULL;
+
+ Py_RETURN_NONE;
+}
+
+static PyMethodDef methods[] = {
+ {"setdefaultencoding", (PyCFunction)setdefaultencoding, METH_VARARGS|METH_KEYWORDS, setdefaultencoding_doc},
+ {NULL, NULL} /* sentinel */
+};
+
+
+PyMODINIT_FUNC
+initdefault_encoding_utf8(void)
+{
+ PyUnicode_SetDefaultEncoding("utf-8");
+ Py_InitModule3("default_encoding_utf8", methods, "Forces the default encoding to utf-8");
+}
diff --git a/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py b/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py
new file mode 100644
index 0000000..ccb6b8b
--- /dev/null
+++ b/policycoreutils/semanage/default_encoding/policycoreutils/__init__.py
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006,2007,2008, 2009 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
diff --git a/policycoreutils/semanage/default_encoding/setup.py b/policycoreutils/semanage/default_encoding/setup.py
new file mode 100644
index 0000000..e2befdb
--- /dev/null
+++ b/policycoreutils/semanage/default_encoding/setup.py
@@ -0,0 +1,38 @@
+# Authors:
+# John Dennis <jdennis@redhat.com>
+#
+# Copyright (C) 2009 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+
+from distutils.core import setup, Extension
+
+default_encoding_utf8 = Extension('policycoreutils.default_encoding_utf8', ['default_encoding.c'])
+
+setup(name = 'policycoreutils-default-encoding',
+ version = '0.1',
+ description = 'Forces the default encoding in Python to be utf-8',
+ long_description = 'Forces the default encoding in Python to be utf-8',
+ author = 'John Dennis',
+ author_email = 'jdennis@redhat.com',
+ maintainer = 'John Dennis',
+ maintainer_email = 'jdennis@redhat.com',
+ license = 'GPLv3+',
+ platforms = 'posix',
+ url = '',
+ download_url = '',
+ ext_modules = [default_encoding_utf8],
+ packages=["policycoreutils"],
+)
diff --git a/policycoreutils/semanage/semanage b/policycoreutils/semanage/semanage
index f4602a9..61d455c 100644
--- a/policycoreutils/semanage/semanage
+++ b/policycoreutils/semanage/semanage
@@ -20,6 +20,7 @@
# 02111-1307 USA
#
#
+import policycoreutils.default_encoding_utf8
import sys, getopt, re
import seobject
import selinux
@@ -32,7 +33,7 @@ gettext.textdomain(PROGNAME)
try:
gettext.install(PROGNAME,
localedir="/usr/share/locale",
- unicode=False,
+ unicode=True,
codeset = 'utf-8')
except IOError:
import __builtin__
diff --git a/policycoreutils/semanage/seobject.py b/policycoreutils/semanage/seobject.py
index ad7dc8c..22eac14 100644
--- a/policycoreutils/semanage/seobject.py
+++ b/policycoreutils/semanage/seobject.py
@@ -30,11 +30,10 @@ from IPy import IP
import gettext
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
gettext.textdomain(PROGNAME)
-try:
- gettext.install(PROGNAME, localedir = "/usr/share/locale", unicode = 1)
-except IOError:
- import __builtin__
- __builtin__.__dict__['_'] = unicode
+
+import gettext
+translation=gettext.translation(PROGNAME, localedir = "/usr/share/locale", fallback=True)
+_=translation.ugettext
import syslog
@@ -493,7 +492,9 @@ class loginRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if exists:
- raise ValueError(_("Login mapping for %s is already defined") % name)
+ semanage_seuser_key_free(k)
+ return self.__modify(name, sename, serange)
+
if name[0] == '%':
try:
grp.getgrnam(name[1:])
@@ -738,7 +739,8 @@ class seluserRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if exists:
- raise ValueError(_("SELinux user %s is already defined") % name)
+ semanage_user_key_free(k)
+ return self.__modify(name, roles, selevel, serange, prefix)
(rc, u) = semanage_user_create(self.sh)
if rc < 0:
@@ -1262,7 +1264,8 @@ class nodeRecords(semanageRecords):
(rc, exists) = semanage_node_exists(self.sh, k)
if exists:
- raise ValueError(_("Addr %s already defined") % addr)
+ semanage_node_key_free(k)
+ return self.__modify(addr, mask, self.protocol[proto], serange, ctype)
(rc, node) = semanage_node_create(self.sh)
if rc < 0:
@@ -1460,7 +1463,8 @@ class interfaceRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if exists:
- raise ValueError(_("Interface %s already defined") % interface)
+ semanage_iface_key_free(k)
+ return self.__modify(interface, serange, ctype)
(rc, iface) = semanage_iface_create(self.sh)
if rc < 0:
@@ -1753,7 +1757,8 @@ class fcontextRecords(semanageRecords):
raise ValueError(_("Could not check if file context for %s is defined") % target)
if exists:
- raise ValueError(_("File context for %s already defined") % target)
+ semanage_fcontext_key_free(k)
+ return self.__modify(target, type, ftype, serange, seuser)
(rc, fcontext) = semanage_fcontext_create(self.sh)
if rc < 0:
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
index 4c62b41..01fc818 100644
--- a/policycoreutils/setfiles/restore.c
+++ b/policycoreutils/setfiles/restore.c
@@ -105,6 +105,7 @@ static int restore(FTSENT *ftsent)
char *my_file = strdupa(ftsent->fts_path);
int ret = -1;
security_context_t curcon = NULL, newcon = NULL;
+ float progress;
if (match(my_file, ftsent->fts_statp, &newcon) < 0)
/* Check for no matching specification. */
@@ -113,7 +114,14 @@ static int restore(FTSENT *ftsent)
if (r_opts->progress) {
r_opts->count++;
if (r_opts->count % STAR_COUNT == 0) {
- fprintf(stdout, "*");
+ if (r_opts->progress == 1) {
+ fprintf(stdout, "*");
+ } else {
+ if (r_opts->nfile > 0) {
+ progress = (r_opts->count < r_opts->nfile) ? (100.0 * r_opts->count / r_opts->nfile) : 100;
+ fprintf(stdout, "\r%-.1f%%", progress);
+ }
+ }
fflush(stdout);
}
}
@@ -283,6 +291,8 @@ static int apply_spec(FTSENT *ftsent)
return rc;
}
+#include <sys/statvfs.h>
+
static int process_one(char *name, int recurse_this_path)
{
int rc = 0;
@@ -332,6 +342,7 @@ static int process_one(char *name, int recurse_this_path)
continue;
}
}
+
rc = apply_spec(ftsent);
if (rc == SKIP)
fts_set(fts_handle, ftsent, FTS_SKIP);
@@ -611,12 +622,22 @@ static int filespec_add(ino_t ino, const security_context_t con, const char *fil
}
#include <sys/utsname.h>
+int file_system_count(char *name) {
+ struct statvfs statvfs_buf;
+ int nfile = 0;
+ memset(&statvfs_buf, 0, sizeof(statvfs_buf));
+ if (!statvfs(name, &statvfs_buf)) {
+ nfile = statvfs_buf.f_files - statvfs_buf.f_ffree;
+ }
+ return nfile;
+}
+
/*
Search /proc/mounts for all file systems that do not support extended
attributes and add them to the exclude directory table. File systems
- that support security labels have the seclabel option.
+ that support security labels have the seclabel option, return total file count
*/
-void exclude_non_seclabel_mounts()
+int exclude_non_seclabel_mounts()
{
struct utsname uts;
FILE *fp;
@@ -625,16 +646,16 @@ void exclude_non_seclabel_mounts()
int index = 0, found = 0;
char *mount_info[4];
char *buf = NULL, *item;
-
+ int nfile = 0;
/* Check to see if the kernel supports seclabel */
if (uname(&uts) == 0 && strverscmp(uts.release, "2.6.30") < 0)
- return;
+ return 0;
if (is_selinux_enabled() <= 0)
- return;
+ return 0;
fp = fopen("/proc/mounts", "r");
if (!fp)
- return;
+ return 0;
while ((num = getline(&buf, &len, fp)) != -1) {
found = 0;
@@ -661,6 +682,7 @@ void exclude_non_seclabel_mounts()
while (item != NULL) {
if (strcmp(item, "seclabel") == 0) {
found = 1;
+ nfile += file_system_count(mount_info[1]);
break;
}
item = strtok(NULL, ",");
@@ -673,5 +695,7 @@ void exclude_non_seclabel_mounts()
free(buf);
fclose(fp);
+ /* return estimated #Files + 5% for directories and hard links */
+ return nfile * 1.05;
}
diff --git a/policycoreutils/setfiles/restore.h b/policycoreutils/setfiles/restore.h
index ac27222..57ae46a 100644
--- a/policycoreutils/setfiles/restore.h
+++ b/policycoreutils/setfiles/restore.h
@@ -14,6 +14,7 @@
#include <selinux/label.h>
#include <stdlib.h>
#include <limits.h>
+#include <stdint.h>
#define STAR_COUNT 1000
@@ -21,7 +22,8 @@
struct restore_opts {
int add_assoc; /* Track inode associations for conflict detection. */
int progress;
- unsigned long long count;
+ uint64_t count; /* Number of files processed so far */
+ uint64_t nfile; /* Estimated total number of files */
int debug;
int change;
int hard_links;
@@ -49,6 +51,6 @@ int exclude(const char *path);
void remove_exclude(const char *directory);
int process_one_realpath(char *name, int recurse);
int process_glob(char *name, int recurse);
-void exclude_non_seclabel_mounts();
+int exclude_non_seclabel_mounts();
#endif
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
index ffbb9d1..91d02bd 100644
--- a/policycoreutils/setfiles/restorecon.8
+++ b/policycoreutils/setfiles/restorecon.8
@@ -55,7 +55,8 @@ don't change any file labels (passive check).
save list of files with incorrect context in outfilename.
.TP
.B \-p
-show progress by printing * every STAR_COUNT files.
+show progress by printing * every STAR_COUNT files. (If you relabel the entire OS, this will show you the percentage complete.)
+
.TP
.B \-R, \-r
change files and directories file labels recursively (descend directories).
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index 7ff54f9..89d2a49 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -60,7 +60,7 @@ don't change any file labels (passive check).
save list of files with incorrect context in filename.
.TP
.B \-p
-show progress by printing * every STAR_COUNT files.
+show progress by printing * every STAR_COUNT files. (If you relabel the entire OS, this will show you the percentage complete.)
.TP
.B \-q
suppress non-error output.
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index ca24003..b11e49f 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -159,6 +159,7 @@ int main(int argc, char **argv)
/* Initialize variables */
r_opts.progress = 0;
r_opts.count = 0;
+ r_opts.nfile = 0;
r_opts.debug = 0;
r_opts.change = 1;
r_opts.verbose = 0;
@@ -222,7 +223,7 @@ int main(int argc, char **argv)
}
/* This must happen before getopt. */
- exclude_non_seclabel_mounts();
+ r_opts.nfile = exclude_non_seclabel_mounts();
/* Process any options. */
while ((opt = getopt(argc, argv, "c:de:f:hilno:pqrsvFRW0")) > 0) {
@@ -346,7 +347,7 @@ int main(int argc, char **argv)
"Progress and Verbose mutually exclusive\n");
usage(argv[0]);
}
- r_opts.progress = 1;
+ r_opts.progress++;
break;
case 'W':
warn_no_match = 1;
@@ -360,6 +361,14 @@ int main(int argc, char **argv)
}
}
+ for (i = optind; i < argc; i++) {
+ if (!strcmp(argv[i], "/")) {
+ mass_relabel = 1;
+ if (r_opts.progress)
+ r_opts.progress++;
+ }
+ }
+
if (!iamrestorecon) {
if (policyfile) {
if (optind != (argc - 1))
@@ -426,12 +435,8 @@ int main(int argc, char **argv)
if (strcmp(input_filename, "-") != 0)
fclose(f);
} else {
- for (i = optind; i < argc; i++) {
- if (!strcmp(argv[i], "/"))
- mass_relabel = 1;
-
+ for (i = optind; i < argc; i++)
errors |= process_glob(argv[i], recurse) < 0;
- }
}
maybe_audit_mass_relabel(mass_relabel, errors);
Reference in New Issue View Git Blame Copy Permalink