Re: Add restorecon and install methods for libselinux python bindings.

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2448 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel J Walsh wrote:
> Joshua Brindle wrote:
>> Daniel J Walsh wrote:
>> Luke Macken wrote restorecon and install functions used in Fedora
>> Infrastructure which can be used to install files with the proper
>> context and to fix the labels of files/directories without having to
>> exec restorecon.
> 
>> diff --exclude-from=exclude -N -u -r
>> nsalibselinux/src/selinuxswig_python.i
>> libselinux-2.0.75/src/selinuxswig_python.i
>> --- nsalibselinux/src/selinuxswig_python.i    2008-08-28
>> 09:34:24.000000000 -0400
>> +++ libselinux-2.0.75/src/selinuxswig_python.i    2008-11-14
>> 17:09:50.000000000 -0500
>> @@ -6,6 +6,32 @@
>>     #include "selinux/selinux.h"
>> %}
> 
>> +%pythoncode %{
>> +
>> +import shutil, os
>> +
>> +def restorecon(path, recursive=False):
>> +    """ Restore SELinux context on a given path """
>> +    mode = os.stat(path)[stat.ST_MODE]
> 
>> stat doesn't exist here, perhaps he meant mode?
> 
>> +    status, context = matchpathcon(path, mode)
>> +    if status == 0:
>> +        lsetfilecon(path, context)
>> +        if recursive:
>> +            os.path.walk(path, lambda arg, dirname, fnames:
>> +                             map(restorecon, [os.path.join(dirname, fname)
>> +                              s                for fname in fnames]),
>> None)
> 
>> typo, the s causes a syntax error
> 
>> +
>> +def copytree(src, dest):
>> +    """ An SELinux-friendly shutil.copytree method """
>> +    shutil.copytree(src, dest)
>> +    restorecon(dest, recursive=True)
>> +
>> +def install(src, dest):
>> +    """ An SELinux-friendly shutil.move method """
>> +    shutil.move(src, dest)
>> +    restorecon(dest, recursive=True)
>> +%}
>> +
>> /* security_get_boolean_names() typemap */
>> %typemap(argout) (char ***names, int *len) {
>>     PyObject* list = PyList_New(*$2);
> 
>> This patch doesn't appear correct, I'll fix the things above, have you
>> been testing this at all?
> 
> Must have sent you a bad patch.
> 
> 
> This is what the current patch looks like.
> 
And this is still broken.

One more fix.

+    mode = os.stat(path)[stat.ST_MODE]
should be
+    mode = os.lstat(path)[stat.ST_MODE]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkljeTgACgkQrlYvE4MpobP3sACgnyo4HIvhaQ3TWmfph94ElSvF
84gAoLi4v7/UaWmpvTO5oIdvHj/tsb0H
=D91y
-----END PGP SIGNATURE-----

[-- Attachment #2: libselinux-rhat.patch --]
[-- Type: text/plain, Size: 1286 bytes --]

diff --exclude-from=exclude -N -u -r nsalibselinux/src/selinuxswig_python.i libselinux-2.0.76/src/selinuxswig_python.i
--- nsalibselinux/src/selinuxswig_python.i	2008-08-28 09:34:24.000000000 -0400
+++ libselinux-2.0.76/src/selinuxswig_python.i	2008-12-02 09:14:48.000000000 -0500
@@ -6,6 +6,32 @@
 	#include "selinux/selinux.h"
 %}
 
+%pythoncode %{
+
+import shutil, os, stat
+
+def restorecon(path, recursive=False):
+    """ Restore SELinux context on a given path """
+    mode = os.lstat(path)[stat.ST_MODE]
+    status, context = matchpathcon(path, mode)
+    if status == 0:
+        lsetfilecon(path, context)
+        if recursive:
+            os.path.walk(path, lambda arg, dirname, fnames:
+                             map(restorecon, [os.path.join(dirname, fname)
+                                              for fname in fnames]), None)
+
+def copytree(src, dest):
+    """ An SELinux-friendly shutil.copytree method """
+    shutil.copytree(src, dest)
+    restorecon(dest, recursive=True)
+
+def install(src, dest):
+    """ An SELinux-friendly shutil.move method """
+    shutil.move(src, dest)
+    restorecon(dest, recursive=True)
+%}
+
 /* security_get_boolean_names() typemap */
 %typemap(argout) (char ***names, int *len) {
 	PyObject* list = PyList_New(*$2);

[-- Attachment #3: libselinux-rhat.patch.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]