semodule patch to use new semanage interfaces

semodule patch to use new semanage interfaces

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 372 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Allows semodule to read bzip compressed policy packages directly.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkUU5QACgkQrlYvE4MpobMHGQCdGwEl3h1ZwV92u1mfgrr3z7XT
NGYAoIwz76N7QFdEr8I0t3ncGhbo6heq
=raBi
-----END PGP SIGNATURE-----

[-- Attachment #2: semodule.patch --]
[-- Type: text/plain, Size: 2164 bytes --]

--- nsapolicycoreutils/semodule/semodule.c	2008-08-28 09:34:24.000000000 -0400
+++ policycoreutils-2.0.57/semodule/semodule.c	2008-10-10 16:04:46.000000000 -0400
@@ -60,24 +60,6 @@
 	free(commands);
 }
 
-/* mmap() a file to '*data', returning the total number of bytes in
- * the file.  Returns 0 if file could not be opened or mapped. */
-static size_t map_file(char *filename, char **data)
-{
-	int fd;
-	struct stat sb;
-	if ((fd = open(filename, O_RDONLY)) == -1) {
-		return 0;
-	}
-	if (fstat(fd, &sb) == -1 ||
-	    (*data = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0)) ==
-	    MAP_FAILED) {
-		sb.st_size = 0;
-	}
-	close(fd);
-	return sb.st_size;
-}
-
 /* Signal handlers. */
 static void handle_signal(int sig_num)
 {
@@ -339,16 +321,6 @@
 	for (i = 0; i < num_commands; i++) {
 		enum client_modes mode = commands[i].mode;
 		char *mode_arg = commands[i].arg;
-		char *data = NULL;
-		size_t data_len = 0;
-		if (mode == INSTALL_M || mode == UPGRADE_M || mode == BASE_M) {
-			if ((data_len = map_file(mode_arg, &data)) == 0) {
-				fprintf(stderr,
-					"%s:  Could not read file '%s': %s\n",
-					argv[0], mode_arg, errno ? strerror(errno) : "");
-				goto cleanup;
-			}
-		}
 		switch (mode) {
 		case INSTALL_M:{
 				if (verbose) {
@@ -357,7 +329,7 @@
 					     mode_arg);
 				}
 				result =
-				    semanage_module_install(sh, data, data_len);
+				    semanage_module_install_file(sh, mode_arg);
 				break;
 			}
 		case UPGRADE_M:{
@@ -367,7 +339,7 @@
 					     mode_arg);
 				}
 				result =
-				    semanage_module_upgrade(sh, data, data_len);
+				    semanage_module_upgrade_file(sh, mode_arg);
 				break;
 			}
 		case BASE_M:{
@@ -377,8 +349,7 @@
 					     mode_arg);
 				}
 				result =
-				    semanage_module_install_base(sh, data,
-								 data_len);
+				    semanage_module_install_base_file(sh, mode_arg);
 				break;
 			}
 		case REMOVE_M:{
@@ -429,9 +400,6 @@
 			}
 		}
 		commit += do_commit[mode];
-		if (mode == INSTALL_M || mode == UPGRADE_M || mode == BASE_M) {
-			munmap(data, data_len);
-		}
 		if (result < 0) {
 			fprintf(stderr, "%s:  Failed on %s!\n", argv[0],
 				mode_arg ? : "list");

[-- Attachment #3: semodule.patch.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]

Re: semodule patch to use new semanage interfaces

[Joshua Brindle]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Allows semodule to read bzip compressed policy packages directly.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkkUU5QACgkQrlYvE4MpobMHGQCdGwEl3h1ZwV92u1mfgrr3z7XT
> NGYAoIwz76N7QFdEr8I0t3ncGhbo6heq
> =raBi
> -----END PGP SIGNATURE-----
>   

I'm finally looking at these (sorry it took so long)..

I thought one part of it was suppose to make hard links to files if you 
install but after merging this patch and the compression support I try 
semodule -i /usr/share/selinux/targeted/somepolicy.pp.bz2 (I'm on F10 
and they are already bzip'd) and instead of making a hard link to the 
bz2 it looks like it writes the uncompressed file to 
/etc/selinux/targeted/modules/active/modules. Am I misunderstanding the 
intention of these patches?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule patch to use new semanage interfaces

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Joshua Brindle wrote:
> Daniel J Walsh wrote:
> Allows semodule to read bzip compressed policy packages directly.

> I'm finally looking at these (sorry it took so long)..

> I thought one part of it was suppose to make hard links to files if you
> install but after merging this patch and the compression support I try
> semodule -i /usr/share/selinux/targeted/somepolicy.pp.bz2 (I'm on F10
> and they are already bzip'd) and instead of making a hard link to the
> bz2 it looks like it writes the uncompressed file to
> /etc/selinux/targeted/modules/active/modules. Am I misunderstanding the
> intention of these patches?

Originally this was the intention but it was wrong.  The problem is the
file context would start to get screwed up every where and we end up
with the /etc/selinux/targeted/modules/active/ directory looking like a
patchwork of labels.

So the patch makes a compressed copy whether or not the file is
originally compressed in the new location.

It does use the hard links for creating the snapshot directory though.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkliZoEACgkQrlYvE4MpobMAQgCfdlq4J4KO0/wejYLYkVUhdf4K
Yn8An25Mf2zzbcIbNRUDOw09iutxfFyi
=ruHv
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule patch to use new semanage interfaces

[Joshua Brindle]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Joshua Brindle wrote:
>   
>> Daniel J Walsh wrote:
>> Allows semodule to read bzip compressed policy packages directly.
>>     
>
>   
>> I'm finally looking at these (sorry it took so long)..
>>     
>
>   
>> I thought one part of it was suppose to make hard links to files if you
>> install but after merging this patch and the compression support I try
>> semodule -i /usr/share/selinux/targeted/somepolicy.pp.bz2 (I'm on F10
>> and they are already bzip'd) and instead of making a hard link to the
>> bz2 it looks like it writes the uncompressed file to
>> /etc/selinux/targeted/modules/active/modules. Am I misunderstanding the
>> intention of these patches?
>>     
>
> Originally this was the intention but it was wrong.  The problem is the
> file context would start to get screwed up every where and we end up
> with the /etc/selinux/targeted/modules/active/ directory looking like a
> patchwork of labels.
>
> So the patch makes a compressed copy whether or not the file is
> originally compressed in the new location.
>
> It does use the hard links for creating the snapshot directory though.
>
>   

So... what is the purpose of the *_file functions if you don't copy the 
data anymore?

I see now that the files in /etc/selinux/.../modules/active are bzip 
files but with a .pp extension, confusing.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule patch to use new semanage interfaces

[Joshua Brindle]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Joshua Brindle wrote:
>   
>> Daniel J Walsh wrote:
>>     
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Joshua Brindle wrote:
>>>  
>>>       
>>>> Daniel J Walsh wrote:
>>>> Allows semodule to read bzip compressed policy packages directly.
>>>>     
>>>>         
>>>  
>>>       
>>>> I'm finally looking at these (sorry it took so long)..
>>>>     
>>>>         
>>>  
>>>       
>>>> I thought one part of it was suppose to make hard links to files if you
>>>> install but after merging this patch and the compression support I try
>>>> semodule -i /usr/share/selinux/targeted/somepolicy.pp.bz2 (I'm on F10
>>>> and they are already bzip'd) and instead of making a hard link to the
>>>> bz2 it looks like it writes the uncompressed file to
>>>> /etc/selinux/targeted/modules/active/modules. Am I misunderstanding the
>>>> intention of these patches?
>>>>     
>>>>         
>>> Originally this was the intention but it was wrong.  The problem is the
>>> file context would start to get screwed up every where and we end up
>>> with the /etc/selinux/targeted/modules/active/ directory looking like a
>>> patchwork of labels.
>>>
>>> So the patch makes a compressed copy whether or not the file is
>>> originally compressed in the new location.
>>>
>>> It does use the hard links for creating the snapshot directory though.
>>>
>>>   
>>>       
>> So... what is the purpose of the *_file functions if you don't copy the
>> data anymore?
>>
>> I see now that the files in /etc/selinux/.../modules/active are bzip
>> files but with a .pp extension, confusing.
>>
>>     
> Because you don't know if the file you are installing is a compressed pp
> or a regular one.
>
> I want to ship compressed pp files for now on, but existing pp files are
> not compressed.  semodule should be smart enough to not care

I see now, the *_file does the same thing semodule use to do but also 
checks if the data is a bzip.

We might want to mark those old functions as deprecated since it is 
likely they won't be able to use any policy modules shipped going forward.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: semodule patch to use new semanage interfaces

[Joshua Brindle]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Allows semodule to read bzip compressed policy packages directly.

Merged in policycoreutils 2.0.61

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.