* Re: Why is customizing labeling and seusers so SLOOOOOOOWWWWW.
2008-08-08 16:51 ` Joshua Brindle
@ 2008-08-08 20:51 ` Daniel J Walsh
0 siblings, 0 replies; 3+ messages in thread
From: Daniel J Walsh @ 2008-08-08 20:51 UTC (permalink / raw)
To: Joshua Brindle; +Cc: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 501 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Here is the patch as far as I have gotten too.
fcontext seems to work but seusers is not working yet.
I will not be able to work on it until next week.
The seuser.final handling is a problem.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkicsb0ACgkQrlYvE4MpobNXQgCfbidqndTVwoJFb/qGy8Y8aqBC
Fm0An1gMtWAbeg4ZsN4iWfMy92BHpEAj
=9NoU
-----END PGP SIGNATURE-----
[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 4421 bytes --]
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/direct_api.c libsemanage-2.0.27/src/direct_api.c
--- nsalibsemanage/src/direct_api.c 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.27/src/direct_api.c 2008-08-08 15:54:40.000000000 -0400
@@ -491,9 +491,9 @@
/* FIXME: get rid of these, once we support loading the existing policy,
* instead of rebuilding it */
- modified |= seusers_modified;
- modified |= fcontexts_modified;
- modified |= users_extra_modified;
+ // modified |= seusers_modified;
+ // modified |= fcontexts_modified;
+ // modified |= users_extra_modified;
/* If there were policy changes, or explicitly requested, rebuild the policy */
if (sh->do_rebuild || modified) {
@@ -667,8 +667,71 @@
retval = semanage_verify_kernel(sh);
if (retval < 0)
goto cleanup;
- }
+ } else {
+ sepol_policydb_create(&out);
+ modified |= seusers_modified;
+ modified |= fcontexts_modified;
+ modified |= users_extra_modified;
+ ERR(sh, "modified %d.",modified);
+
+ retval = semanage_read_policydb(sh, out);
+ if (retval < 0)
+ goto cleanup;
+
+ dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase,out);
+ dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);
+
+ if (seusers_modified) {
+ retval = semanage_link_sandbox(sh, &base);
+ if (retval < 0)
+ goto cleanup;
+ /* Seusers */
+ if (sepol_module_package_get_seusers_len(base)) {
+ ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_SEUSERS);
+ ERR(sh, "out %s", ofilename);
+ if (ofilename == NULL) {
+ retval = -1;
+ goto cleanup;
+ }
+ retval = write_file(sh, ofilename,
+ sepol_module_package_get_seusers(base),
+ sepol_module_package_get_seusers_len(base));
+ if (retval < 0)
+ goto cleanup;
+
+ pseusers->dtable->drop_cache(pseusers->dbase);
+
+ } else {
+ retval = pseusers->dtable->clear(sh, pseusers->dbase);
+ if (retval < 0)
+ goto cleanup;
+ }
+ /* Users_extra */
+ if (sepol_module_package_get_user_extra_len(base)) {
+ ERR(sh, "out %s", ofilename);
+ ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA);
+ if (ofilename == NULL) {
+ retval = -1;
+ goto cleanup;
+ }
+ retval = write_file(sh, ofilename,
+ sepol_module_package_get_user_extra(base),
+ sepol_module_package_get_user_extra_len(base));
+ if (retval < 0)
+ goto cleanup;
+ pusers_extra->dtable->drop_cache(pusers_extra->dbase);
+
+ } else {
+ retval = pusers_extra->dtable->clear(sh, pusers_extra->dbase);
+ if (retval < 0)
+ goto cleanup;
+ }
+ }
+ }
/* FIXME: else if !modified, but seusers_modified,
* load the existing policy instead of rebuilding */
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.c libsemanage-2.0.27/src/semanage_store.c
--- nsalibsemanage/src/semanage_store.c 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.27/src/semanage_store.c 2008-08-08 15:23:20.000000000 -0400
@@ -1648,6 +1648,47 @@
}
/**
+ * Read the policy from the sandbox (kernel)
+ */
+int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
+{
+
+ int retval = STATUS_ERR;
+ const char *kernel_filename = NULL;
+ struct sepol_policy_file *pf = NULL;
+ FILE *infile = NULL;
+
+ if ((kernel_filename =
+ semanage_path(SEMANAGE_ACTIVE, SEMANAGE_KERNEL)) == NULL) {
+ goto cleanup;
+ }
+ if ((infile = fopen(kernel_filename, "r")) == NULL) {
+ ERR(sh, "Could not open kernel policy %s for reading.",
+ kernel_filename);
+ goto cleanup;
+ }
+ __fsetlocking(infile, FSETLOCKING_BYCALLER);
+ if (sepol_policy_file_create(&pf)) {
+ ERR(sh, "Out of memory!");
+ goto cleanup;
+ }
+ sepol_policy_file_set_fp(pf, infile);
+ sepol_policy_file_set_handle(pf, sh->sepolh);
+ if (sepol_policydb_read(in, pf) == -1) {
+ ERR(sh, "Error while reading kernel policy from %s.",
+ kernel_filename);
+ goto cleanup;
+ }
+ retval = STATUS_SUCCESS;
+
+ cleanup:
+ if (infile != NULL) {
+ fclose(infile);
+ }
+ sepol_policy_file_free(pf);
+ return retval;
+}
+/**
* Writes the final policy to the sandbox (kernel)
*/
int semanage_write_policydb(semanage_handle_t * sh, sepol_policydb_t * out)
[-- Attachment #3: diff.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread