From: Daniel J Walsh <dwalsh@redhat.com>
To: Stephen Smalley <sds@tycho.nsa.gov>, SE Linux <selinux@tycho.nsa.gov>
Subject: policycoreutils patches
Date: Thu, 02 Aug 2007 14:46:25 -0400 [thread overview]
Message-ID: <46B22681.2030107@redhat.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 671 bytes --]
nsapolicycoreutils_audit2allow_Makefile - Move sepolgen-iggen to sbindir.
nsapolicycoreutils_run_init_Makefile Change permissions to 755 instead
of 555, Some audit scripts are reporting problems with 755 permissions.
nsapolicycoreutils_scripts_chcat - Missing : after else commands
nsapolicycoreutils_scripts_fixfiles - Certain patterns were not
expanding. So relabel was not complete also fix error handling
nsapolicycoreutils_scripts_genhomedircon - Speed up processing by a
factor of 10 by precompiling regex
nsapolicycoreutils_semanage_semanage - Fix handling of internationalization
nsapolicycoreutils_semanage_seobject.py - Allow users to specify <<none>>
[-- Attachment #2: nsapolicycoreutils_audit2allow_Makefile --]
[-- Type: text/plain, Size: 629 bytes --]
--- nsapolicycoreutils/audit2allow/Makefile 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/audit2allow/Makefile 2007-07-31 15:45:57.000000000 -0400
@@ -1,6 +1,7 @@
# Installation directories.
PREFIX ?= ${DESTDIR}/usr
BINDIR ?= $(PREFIX)/bin
+SBINDIR ?= $(PREFIX)/sbin
LIBDIR ?= $(PREFIX)/lib
MANDIR ?= $(PREFIX)/share/man
LOCALEDIR ?= /usr/share/locale
@@ -10,7 +11,7 @@
install: all
-mkdir -p $(BINDIR)
install -m 755 audit2allow $(BINDIR)
- install -m 755 sepolgen-ifgen $(BINDIR)
+ install -m 755 sepolgen-ifgen $(SBINDIR)
-mkdir -p $(MANDIR)/man1
install -m 644 audit2allow.1 $(MANDIR)/man1/
[-- Attachment #3: nsapolicycoreutils_run_init_Makefile --]
[-- Type: text/plain, Size: 610 bytes --]
--- nsapolicycoreutils/run_init/Makefile 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/run_init/Makefile 2007-07-31 15:45:57.000000000 -0400
@@ -34,8 +34,8 @@
install: all
test -d $(SBINDIR) || install -m 755 -d $(SBINDIR)
test -d $(MANDIR)/man1 || install -m 755 -d $(MANDIR)/man1
- install -m 555 run_init $(SBINDIR)
- install -m 555 open_init_pty $(SBINDIR)
+ install -m 755 run_init $(SBINDIR)
+ install -m 755 open_init_pty $(SBINDIR)
install -m 644 run_init.8 $(MANDIR)/man8/
install -m 644 open_init_pty.8 $(MANDIR)/man8/
ifeq (${PAMH}, /usr/include/security/pam_appl.h)
[-- Attachment #4: nsapolicycoreutils_scripts_chcat --]
[-- Type: text/plain, Size: 656 bytes --]
--- nsapolicycoreutils/scripts/chcat 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/scripts/chcat 2007-07-31 15:45:57.000000000 -0400
@@ -77,7 +77,7 @@
if len(cats) > 0:
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
- else
+ else:
new_serange = "%s-%s" % (serange[0], top[0])
if add_ind:
@@ -155,7 +155,7 @@
if len(cats) > 0:
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
- else
+ else:
new_serange = "%s-%s" % (serange[0], top[0])
if add_ind:
[-- Attachment #5: nsapolicycoreutils_scripts_fixfiles --]
[-- Type: text/plain, Size: 753 bytes --]
--- nsapolicycoreutils/scripts/fixfiles 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/scripts/fixfiles 2007-07-31 15:45:57.000000000 -0400
@@ -88,7 +88,7 @@
esac; \
fi; \
done | \
- while read pattern ; do find $pattern \
+ while read pattern ; do sh -c "find $pattern" \
! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \
done 2> /dev/null | \
@@ -108,6 +108,7 @@
rpmlist() {
rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
+[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr
}
#
[-- Attachment #6: nsapolicycoreutils_scripts_genhomedircon --]
[-- Type: text/plain, Size: 1464 bytes --]
--- nsapolicycoreutils/scripts/genhomedircon 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/scripts/genhomedircon 2007-08-01 16:03:41.000000000 -0400
@@ -139,7 +139,22 @@
self.default_user = "user_u"
self.default_prefix = "user"
self.users = self.getUsers()
+ fd = open(self.getFileContextFile())
+ self.fclines=[]
+ for i in fd.readlines():
+ try:
+ regex = i.split()[0]
+ #match a trailing .+
+ regex = re.sub("\.+$", "", regex)
+ regex = re.sub("\.\*$", "", regex)
+ regex = re.sub("\(\/\.\*\)\?", "", regex)
+ regex = regex + "/*$"
+ self.fclines.append(re.compile(regex))
+ except:
+ continue
+ fd.close()
+
def getFileContextDir(self):
return self.selinuxdir+self.type+self.filecontextdir
@@ -289,20 +304,9 @@
return ret+"\n"
def checkExists(self, home):
- fd = open(self.getFileContextFile())
- for i in fd.readlines():
- if len(i) == 0:
- continue
+ for i in self.fclines:
try:
- regex = i.split()[0]
- #match a trailing .+
- regex = re.sub("\.+$", "", regex)
- regex = re.sub("\.\*$", "", regex)
- #strip a (/.*)? which matches anything trailing to a /*$ which matches trailing /'s
-
- regex = re.sub("\(\/\.\*\)\?", "", regex)
- regex = regex + "/*$"
- if re.search(regex,home, 0):
+ if i.match(home):
return 1
except:
continue
[-- Attachment #7: nsapolicycoreutils_semanage_semanage --]
[-- Type: text/plain, Size: 609 bytes --]
--- nsapolicycoreutils/semanage/semanage 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/semanage/semanage 2007-07-31 15:45:57.000000000 -0400
@@ -34,7 +34,10 @@
sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
try:
- gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
+ gettext.install(PROGNAME,
+ localedir="/usr/share/locale",
+ unicode=False,
+ codeset = 'utf-8')
except IOError:
import __builtin__
__builtin__.__dict__['_'] = unicode
[-- Attachment #8: nsapolicycoreutils_semanage_seobject.py --]
[-- Type: text/x-python, Size: 6307 bytes --]
--- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.22/semanage/seobject.py 2007-08-01 09:54:14.000000000 -0400
@@ -1024,14 +1025,31 @@
def __init__(self):
semanageRecords.__init__(self)
- def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ def createcon(self, target, seuser = "system_u"):
+ (rc, con) = semanage_context_create(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not create context for %s") % target)
if seuser == "":
seuser = "system_u"
+
+ rc = semanage_context_set_user(self.sh, con, seuser)
+ if rc < 0:
+ raise ValueError(_("Could not set user in file context for %s") % target)
+
+ rc = semanage_context_set_role(self.sh, con, "object_r")
+ if rc < 0:
+ raise ValueError(_("Could not set role in file context for %s") % target)
+
if is_mls_enabled == 1:
- if serange == "":
- serange = "s0"
- else:
- serange = untranslate(serange)
+ rc = semanage_context_set_mls(self.sh, con, "s0")
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+
+ return con
+
+ def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ if is_mls_enabled == 1:
+ serange = untranslate(serange)
if type == "":
raise ValueError(_("SELinux Type is required"))
@@ -1051,33 +1069,23 @@
raise ValueError(_("Could not create file context for %s") % target)
rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
- (rc, con) = semanage_context_create(self.sh)
- if rc < 0:
- raise ValueError(_("Could not create context for %s") % target)
-
- rc = semanage_context_set_user(self.sh, con, seuser)
- if rc < 0:
- raise ValueError(_("Could not set user in file context for %s") % target)
-
- rc = semanage_context_set_role(self.sh, con, "object_r")
- if rc < 0:
- raise ValueError(_("Could not set role in file context for %s") % target)
-
- rc = semanage_context_set_type(self.sh, con, type)
- if rc < 0:
- raise ValueError(_("Could not set type in file context for %s") % target)
+ if type != "<<none>>":
+ con = self.createcon(target, seuser)
- if serange != "":
- rc = semanage_context_set_mls(self.sh, con, serange)
- if rc < 0:
- raise ValueError(_("Could not set mls fields in file context for %s") % target)
+ rc = semanage_context_set_type(self.sh, con, type)
+ if rc < 0:
+ raise ValueError(_("Could not set type in file context for %s") % target)
+
+ if serange != "":
+ rc = semanage_context_set_mls(self.sh, con, serange)
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
semanage_fcontext_set_type(fcontext, file_types[ftype])
- rc = semanage_fcontext_set_con(self.sh, fcontext, con)
- if rc < 0:
- raise ValueError(_("Could not set file context for %s") % target)
-
rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1090,7 +1098,8 @@
if rc < 0:
raise ValueError(_("Could not add file context for %s") % target)
- semanage_context_free(con)
+ if type != "<<none>>":
+ semanage_context_free(con)
semanage_fcontext_key_free(k)
semanage_fcontext_free(fcontext)
@@ -1112,16 +1121,29 @@
if rc < 0:
raise ValueError(_("Could not query file context for %s") % target)
- con = semanage_fcontext_get_con(fcontext)
+ if setype != "<<none>>":
+ con = semanage_fcontext_get_con(fcontext)
- if serange != "":
- semanage_context_set_mls(self.sh, con, untranslate(serange))
- if seuser != "":
- semanage_context_set_user(self.sh, con, seuser)
- if setype != "":
- semanage_context_set_type(self.sh, con, setype)
-
- rc = semanage_begin_transaction(self.sh)
+ if con == None:
+ con = self.createcon(target)
+
+ if serange != "":
+ semanage_context_set_mls(self.sh, con, untranslate(serange))
+ if seuser != "":
+ semanage_context_set_user(self.sh, con, seuser)
+
+ if setype != "":
+ semanage_context_set_type(self.sh, con, setype)
+
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+ else:
+ rc = semanage_fcontext_set_con(self.sh, fcontext, None)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+
+ rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1283,9 +1305,12 @@
raise ValueError(_("Could not list booleans"))
for boolean in self.blist:
- name = semanage_bool_get_name(boolean)
- value = semanage_bool_get_value(boolean)
- ddict[name] = value
+ value = []
+ name = semanage_bool_get_name(boolean)
+ value[0] = semanage_bool_get_value(boolean)
+ value[1] = selinux.security_get_boolean_pending(boolean)
+ value[2] = selinux.security_get_boolean_active(boolean)
+ ddict[name] = value
return ddict
next reply other threads:[~2007-08-02 18:46 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-08-02 18:46 Daniel J Walsh [this message]
2007-08-16 17:21 ` policycoreutils patches Stephen Smalley
2007-08-17 13:20 ` Karl MacMillan
-- strict thread matches above, loose matches on Subject: below --
2007-01-03 18:05 Policycoreutils patches Daniel J Walsh
2007-01-04 16:28 ` Stephen Smalley
2007-01-04 16:49 ` Stephen Smalley
2007-01-04 22:07 ` Daniel J Walsh
2007-01-05 18:16 ` Stephen Smalley
2007-01-05 18:55 ` Stephen Smalley
2007-01-08 16:15 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46B22681.2030107@redhat.com \
--to=dwalsh@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.