223 lines
9.4 KiB
Diff
223 lines
9.4 KiB
Diff
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.26/Makefile
|
|
--- nsapolicycoreutils/Makefile 2007-07-16 14:20:43.000000000 -0400
|
|
+++ policycoreutils-2.0.26/Makefile 2007-09-18 16:40:57.000000000 -0400
|
|
@@ -1,4 +1,4 @@
|
|
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
|
|
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
|
|
|
|
all install relabel clean indent:
|
|
@for subdir in $(SUBDIRS); do \
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.26/restorecond/restorecond.c
|
|
--- nsapolicycoreutils/restorecond/restorecond.c 2007-07-16 14:20:41.000000000 -0400
|
|
+++ policycoreutils-2.0.26/restorecond/restorecond.c 2007-09-18 16:40:57.000000000 -0400
|
|
@@ -210,9 +210,10 @@
|
|
}
|
|
|
|
if (fsetfilecon(fd, scontext) < 0) {
|
|
- syslog(LOG_ERR,
|
|
- "set context %s->%s failed:'%s'\n",
|
|
- filename, scontext, strerror(errno));
|
|
+ if (errno != EOPNOTSUPP)
|
|
+ syslog(LOG_ERR,
|
|
+ "set context %s->%s failed:'%s'\n",
|
|
+ filename, scontext, strerror(errno));
|
|
if (retcontext >= 0)
|
|
free(prev_context);
|
|
free(scontext);
|
|
@@ -225,8 +226,9 @@
|
|
if (retcontext >= 0)
|
|
free(prev_context);
|
|
} else {
|
|
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
- filename, strerror(errno));
|
|
+ if (errno != EOPNOTSUPP)
|
|
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
+ filename, strerror(errno));
|
|
}
|
|
free(scontext);
|
|
close(fd);
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.26/semanage/seobject.py
|
|
--- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400
|
|
+++ policycoreutils-2.0.26/semanage/seobject.py 2007-09-18 16:40:57.000000000 -0400
|
|
@@ -210,6 +210,7 @@
|
|
os.write(fd, self.out())
|
|
os.close(fd)
|
|
os.rename(newfilename, self.filename)
|
|
+ os.system("/sbin/service mcstrans reload > /dev/null")
|
|
|
|
class semanageRecords:
|
|
def __init__(self):
|
|
@@ -1024,14 +1025,31 @@
|
|
def __init__(self):
|
|
semanageRecords.__init__(self)
|
|
|
|
- def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
|
|
+ def createcon(self, target, seuser = "system_u"):
|
|
+ (rc, con) = semanage_context_create(self.sh)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not create context for %s") % target)
|
|
if seuser == "":
|
|
seuser = "system_u"
|
|
+
|
|
+ rc = semanage_context_set_user(self.sh, con, seuser)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set user in file context for %s") % target)
|
|
+
|
|
+ rc = semanage_context_set_role(self.sh, con, "object_r")
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set role in file context for %s") % target)
|
|
+
|
|
if is_mls_enabled == 1:
|
|
- if serange == "":
|
|
- serange = "s0"
|
|
- else:
|
|
- serange = untranslate(serange)
|
|
+ rc = semanage_context_set_mls(self.sh, con, "s0")
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
+
|
|
+ return con
|
|
+
|
|
+ def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
|
|
+ if is_mls_enabled == 1:
|
|
+ serange = untranslate(serange)
|
|
|
|
if type == "":
|
|
raise ValueError(_("SELinux Type is required"))
|
|
@@ -1051,33 +1069,23 @@
|
|
raise ValueError(_("Could not create file context for %s") % target)
|
|
|
|
rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
|
|
- (rc, con) = semanage_context_create(self.sh)
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not create context for %s") % target)
|
|
-
|
|
- rc = semanage_context_set_user(self.sh, con, seuser)
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not set user in file context for %s") % target)
|
|
-
|
|
- rc = semanage_context_set_role(self.sh, con, "object_r")
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not set role in file context for %s") % target)
|
|
-
|
|
- rc = semanage_context_set_type(self.sh, con, type)
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not set type in file context for %s") % target)
|
|
+ if type != "<<none>>":
|
|
+ con = self.createcon(target, seuser)
|
|
|
|
- if serange != "":
|
|
- rc = semanage_context_set_mls(self.sh, con, serange)
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
+ rc = semanage_context_set_type(self.sh, con, type)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set type in file context for %s") % target)
|
|
+
|
|
+ if serange != "":
|
|
+ rc = semanage_context_set_mls(self.sh, con, serange)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
|
|
semanage_fcontext_set_type(fcontext, file_types[ftype])
|
|
|
|
- rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
- if rc < 0:
|
|
- raise ValueError(_("Could not set file context for %s") % target)
|
|
-
|
|
rc = semanage_begin_transaction(self.sh)
|
|
if rc < 0:
|
|
raise ValueError(_("Could not start semanage transaction"))
|
|
@@ -1090,7 +1098,8 @@
|
|
if rc < 0:
|
|
raise ValueError(_("Could not add file context for %s") % target)
|
|
|
|
- semanage_context_free(con)
|
|
+ if type != "<<none>>":
|
|
+ semanage_context_free(con)
|
|
semanage_fcontext_key_free(k)
|
|
semanage_fcontext_free(fcontext)
|
|
|
|
@@ -1112,16 +1121,29 @@
|
|
if rc < 0:
|
|
raise ValueError(_("Could not query file context for %s") % target)
|
|
|
|
- con = semanage_fcontext_get_con(fcontext)
|
|
+ if setype != "<<none>>":
|
|
+ con = semanage_fcontext_get_con(fcontext)
|
|
|
|
- if serange != "":
|
|
- semanage_context_set_mls(self.sh, con, untranslate(serange))
|
|
- if seuser != "":
|
|
- semanage_context_set_user(self.sh, con, seuser)
|
|
- if setype != "":
|
|
- semanage_context_set_type(self.sh, con, setype)
|
|
-
|
|
- rc = semanage_begin_transaction(self.sh)
|
|
+ if con == None:
|
|
+ con = self.createcon(target)
|
|
+
|
|
+ if serange != "":
|
|
+ semanage_context_set_mls(self.sh, con, untranslate(serange))
|
|
+ if seuser != "":
|
|
+ semanage_context_set_user(self.sh, con, seuser)
|
|
+
|
|
+ if setype != "":
|
|
+ semanage_context_set_type(self.sh, con, setype)
|
|
+
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
+ else:
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, None)
|
|
+ if rc < 0:
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
+
|
|
+ rc = semanage_begin_transaction(self.sh)
|
|
if rc < 0:
|
|
raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
@@ -1283,9 +1305,12 @@
|
|
raise ValueError(_("Could not list booleans"))
|
|
|
|
for boolean in self.blist:
|
|
- name = semanage_bool_get_name(boolean)
|
|
- value = semanage_bool_get_value(boolean)
|
|
- ddict[name] = value
|
|
+ value = []
|
|
+ name = semanage_bool_get_name(boolean)
|
|
+ value[0] = semanage_bool_get_value(boolean)
|
|
+ value[1] = selinux.security_get_boolean_pending(boolean)
|
|
+ value[2] = selinux.security_get_boolean_active(boolean)
|
|
+ ddict[name] = value
|
|
|
|
return ddict
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.26/semodule/semodule.8
|
|
--- nsapolicycoreutils/semodule/semodule.8 2007-07-16 14:20:42.000000000 -0400
|
|
+++ policycoreutils-2.0.26/semodule/semodule.8 2007-09-18 16:40:57.000000000 -0400
|
|
@@ -23,6 +23,9 @@
|
|
.B \-B, \-\-build
|
|
force a rebuild of policy (also reloads unless -n is used)
|
|
.TP
|
|
+.B \-D, \-\-disable_dontaudit
|
|
+Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
|
|
+.TP
|
|
.B \-i,\-\-install=MODULE_PKG
|
|
install/replace a module package
|
|
.TP
|
|
@@ -58,6 +61,10 @@
|
|
$ semodule -i httpd.pp
|
|
# List non-base modules.
|
|
$ semodule -l
|
|
+# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
|
|
+$ semodule -DB
|
|
+# Turn "dontaudit" rules back on.
|
|
+$ semodule -B
|
|
# Install or replace all non-base modules in the current directory.
|
|
$ semodule -i *.pp
|
|
# Install or replace all modules in the current directory.
|