Re: [PATCH] libsemanage: Add semanage_mls_enabled interface

[Joshua Brindle <method@manicmethod.com>]

Stephen Smalley wrote:
> Add a semanage_mls_enabled() interface to libsemanage so that
> semanage/seobject can be rewritten to use it to test whether MLS is
> enabled for a given policy store rather than checking the runtime MLS
> enabled status, which can be misleading when using semanage on a
> SELinux-disabled host or when using semanage on a store other than the
> active one.  Sample usage:
> 	from semanage import *
> 	handle = semanage_handle_create()
> 	rc = semanage_connect(handle)
> 	rc = semanage_mls_enabled(handle)
>
> diff --git a/libsemanage/include/semanage/handle.h b/libsemanage/include/semanage/handle.h
> index e065070..0123d1d 100644
> --- a/libsemanage/include/semanage/handle.h
> +++ b/libsemanage/include/semanage/handle.h
> @@ -117,6 +117,9 @@ int semanage_access_check(semanage_handle_t * sh);
>  /* returns 0 if not connected, 1 if connected */
>  int semanage_is_connected(semanage_handle_t * sh);
>  
> +/* returns 1 if policy is MLS, 0 otherwise. */
> +int semanage_mls_enabled(semanage_handle_t *sh);
> +
>  /* META NOTES
>   *
>   * For all functions a non-negative number indicates success. For some
> diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c
> index 1732758..88f35a6 100644
> --- a/libsemanage/src/direct_api.c
> +++ b/libsemanage/src/direct_api.c
> @@ -1050,3 +1050,22 @@ int semanage_direct_access_check(semanage_handle_t * sh)
>  
>  	return semanage_store_access_check(sh);
>  }
> +
> +int semanage_direct_mls_enabled(semanage_handle_t * sh)
> +{
> +	sepol_policydb_t *p = NULL;
> +	int retval;
> +
> +	retval = sepol_policydb_create(&p);
> +	if (retval < 0)
> +		goto cleanup;
> +	
> +	retval = semanage_read_policydb(sh, p);
> +	if (retval < 0)
> +		goto cleanup;
> +
> +	retval = sepol_policydb_mls_enabled(p);
> +cleanup:
> +	sepol_policydb_free(p);
> +	return retval;
> +}
> diff --git a/libsemanage/src/direct_api.h b/libsemanage/src/direct_api.h
> index 8f625f5..ffd428e 100644
> --- a/libsemanage/src/direct_api.h
> +++ b/libsemanage/src/direct_api.h
> @@ -37,4 +37,6 @@ int semanage_direct_is_managed(struct semanage_handle *sh);
>  
>  int semanage_direct_access_check(struct semanage_handle *sh);
>  
> +int semanage_direct_mls_enabled(struct semanage_handle *sh);
> +
>  #endif
> diff --git a/libsemanage/src/handle.c b/libsemanage/src/handle.c
> index b94db11..95e10c1 100644
> --- a/libsemanage/src/handle.c
> +++ b/libsemanage/src/handle.c
> @@ -157,6 +157,20 @@ int semanage_is_managed(semanage_handle_t * sh)
>  	return -1;
>  }
>  
> +int semanage_mls_enabled(semanage_handle_t * sh)
> +{
> +	assert(sh != NULL);
> +	switch (sh->conf->store_type) {
> +	case SEMANAGE_CON_DIRECT:
> +		return semanage_direct_mls_enabled(sh);
> +	default:
> +		ERR(sh,
> +		    "The connection type specified within your semanage.conf file has not been implemented yet.");
> +		/* fall through */
> +	}
> +	return -1;
> +}
> +
>  int semanage_connect(semanage_handle_t * sh)
>  {
>  	assert(sh != NULL);
> diff --git a/libsemanage/src/libsemanage.map b/libsemanage/src/libsemanage.map
> index 56a83f0..ae11ade 100644
> --- a/libsemanage/src/libsemanage.map
> +++ b/libsemanage/src/libsemanage.map
> @@ -14,5 +14,6 @@ LIBSEMANAGE_1.0 {
>  	  semanage_node_*;
>  	  semanage_fcontext_*; semanage_access_check; semanage_set_create_store;
>  	  semanage_is_connected; semanage_set_disable_dontaudit;
> +	  semanage_mls_enabled;
>    local: *;
>  };
> diff --git a/libsemanage/src/semanage.py b/libsemanage/src/semanage.py
> index 6a2327a..56e5a14 100644
> --- a/libsemanage/src/semanage.py
> +++ b/libsemanage/src/semanage.py
> @@ -76,6 +76,7 @@ SEMANAGE_CAN_READ = _semanage.SEMANAGE_CAN_READ
>  SEMANAGE_CAN_WRITE = _semanage.SEMANAGE_CAN_WRITE
>  semanage_access_check = _semanage.semanage_access_check
>  semanage_is_connected = _semanage.semanage_is_connected
> +semanage_mls_enabled = _semanage.semanage_mls_enabled
>  semanage_module_install = _semanage.semanage_module_install
>  semanage_module_upgrade = _semanage.semanage_module_upgrade
>  semanage_module_install_base = _semanage.semanage_module_install_base
> diff --git a/libsemanage/src/semanageswig_wrap.c b/libsemanage/src/semanageswig_wrap.c
> index 86736b0..afa3dc2 100644
> --- a/libsemanage/src/semanageswig_wrap.c
> +++ b/libsemanage/src/semanageswig_wrap.c
> @@ -3400,6 +3400,28 @@ fail:
>  }
>  
>  
> +SWIGINTERN PyObject *_wrap_semanage_mls_enabled(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
> +  PyObject *resultobj = 0;
> +  semanage_handle_t *arg1 = (semanage_handle_t *) 0 ;
> +  int result;
> +  void *argp1 = 0 ;
> +  int res1 = 0 ;
> +  PyObject * obj0 = 0 ;
> +  
> +  if (!PyArg_ParseTuple(args,(char *)"O:semanage_mls_enabled",&obj0)) SWIG_fail;
> +  res1 = SWIG_ConvertPtr(obj0, &argp1,SWIGTYPE_p_semanage_handle, 0 |  0 );
> +  if (!SWIG_IsOK(res1)) {
> +    SWIG_exception_fail(SWIG_ArgError(res1), "in method '" "semanage_mls_enabled" "', argument " "1"" of type '" "semanage_handle_t *""'"); 
> +  }
> +  arg1 = (semanage_handle_t *)(argp1);
> +  result = (int)semanage_mls_enabled(arg1);
> +  resultobj = SWIG_From_int((int)(result));
> +  return resultobj;
> +fail:
> +  return NULL;
> +}
> +
> +
>  SWIGINTERN PyObject *_wrap_semanage_module_install(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
>    PyObject *resultobj = 0;
>    semanage_handle_t *arg1 = (semanage_handle_t *) 0 ;
> @@ -11391,6 +11413,7 @@ static PyMethodDef SwigMethods[] = {
>  	 { (char *)"semanage_commit", _wrap_semanage_commit, METH_VARARGS, NULL},
>  	 { (char *)"semanage_access_check", _wrap_semanage_access_check, METH_VARARGS, NULL},
>  	 { (char *)"semanage_is_connected", _wrap_semanage_is_connected, METH_VARARGS, NULL},
> +	 { (char *)"semanage_mls_enabled", _wrap_semanage_mls_enabled, METH_VARARGS, NULL},
>  	 { (char *)"semanage_module_install", _wrap_semanage_module_install, METH_VARARGS, NULL},
>  	 { (char *)"semanage_module_upgrade", _wrap_semanage_module_upgrade, METH_VARARGS, NULL},
>  	 { (char *)"semanage_module_install_base", _wrap_semanage_module_install_base, METH_VARARGS, NULL},
>
>
>   

Signed-off-by: Joshua Brindle <method@manicmethod.com>

Merge at will.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.