Re: [Patch 1/2] libsemanage: remember and retrieve dontaudit settings

[Christopher Pardy <cpardy@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2780 bytes --]

On 07/01/2009 10:08 PM, Christopher Pardy wrote:
> This is a heavily modified version of the patch I recently submitted. 
> It provides 3 new functions: in libsepol sepol_get_disable_dontaudit; 
> in libsemanage semanage_get_disable_dontaudit; in libselinux 
> is_dontaudit_disabled. It also fixes issues with the previous patch.
>
> The justification for this patch is the same as the one I posted 
> earlier. Simply, there is currently no way to know if dontaudit rules 
> are  enabled. Additionally once don't audit rules are turned they turn 
> themselves off after policy rebuild (is that the desired 
> functionality?) This patch provides  a way to check on both the 
> current and pending state of the dontaudit rules and it maintains this 
> state between policy rebuilds.
>
> Signed-off-by Christopher Pardy <cpardy@redhat.com>
Patch 1 implements libsepol function. Including inline and attaching in 
case thunderbird messes up tabs.

diff -urN selinux.orig/libsepol/include/sepol/handle.h 
selinux/libsepol/include/sepol/handle.h
--- selinux.orig/libsepol/include/sepol/handle.h    2009-07-01 
21:05:26.823235749 -0400
+++ selinux/libsepol/include/sepol/handle.h    2009-07-01 
21:08:33.277237031 -0400
@@ -7,6 +7,12 @@
  /* Create and return a sepol handle. */
  sepol_handle_t *sepol_handle_create(void);

+/* Get whether or not dontaudits will be disabled, same values as
+ * specified by disable dont audit. This value reflects the state
+ * your system will be set to upon commit, not nessesarily it's
+ * current state.*/
+int sepol_get_disable_dontaudit(sepol_handle_t * sh);
+
  /* Set whether or not to disable dontaudits, 0 is default and does
   * not disable dontaudits, 1 disables them */
  void sepol_set_disable_dontaudit(sepol_handle_t * sh, int 
disable_dontaudit);
diff -urN selinux.orig/libsepol/src/handle.c selinux/libsepol/src/handle.c
--- selinux.orig/libsepol/src/handle.c    2009-07-01 21:05:26.854236864 
-0400
+++ selinux/libsepol/src/handle.c    2009-07-01 21:07:15.532236991 -0400
@@ -21,6 +21,12 @@
      return sh;
  }

+int sepol_get_disable_dontaudit(sepol_handle_t *sh)
+{
+    assert(sh !=NULL);
+    return sh->disable_dontaudit;
+}
+
  void sepol_set_disable_dontaudit(sepol_handle_t * sh, int 
disable_dontaudit)
  {
      assert(sh !=NULL);
diff -urN selinux.orig/libsepol/src/libsepol.map 
selinux/libsepol/src/libsepol.map
--- selinux.orig/libsepol/src/libsepol.map    2009-07-01 
21:05:26.848236011 -0400
+++ selinux/libsepol/src/libsepol.map    2009-07-01 21:07:45.948485729 -0400
@@ -12,6 +12,7 @@
      sepol_policydb_*; sepol_set_policydb_from_file;
      sepol_policy_kern_*;
      sepol_policy_file_*;
+    sepol_get_disable_dontaudit;
      sepol_set_disable_dontaudit;
      sepol_set_expand_consume_base;
    local: *;

[-- Attachment #2: selinux.patch1 --]
[-- Type: text/plain, Size: 1768 bytes --]

diff -urN selinux.orig/libsepol/include/sepol/handle.h selinux/libsepol/include/sepol/handle.h
--- selinux.orig/libsepol/include/sepol/handle.h	2009-07-01 21:05:26.823235749 -0400
+++ selinux/libsepol/include/sepol/handle.h	2009-07-01 21:08:33.277237031 -0400
@@ -7,6 +7,12 @@
 /* Create and return a sepol handle. */
 sepol_handle_t *sepol_handle_create(void);
 
+/* Get whether or not dontaudits will be disabled, same values as
+ * specified by disable dont audit. This value reflects the state
+ * your system will be set to upon commit, not nessesarily it's
+ * current state.*/
+int sepol_get_disable_dontaudit(sepol_handle_t * sh);
+
 /* Set whether or not to disable dontaudits, 0 is default and does 
  * not disable dontaudits, 1 disables them */
 void sepol_set_disable_dontaudit(sepol_handle_t * sh, int disable_dontaudit);
diff -urN selinux.orig/libsepol/src/handle.c selinux/libsepol/src/handle.c
--- selinux.orig/libsepol/src/handle.c	2009-07-01 21:05:26.854236864 -0400
+++ selinux/libsepol/src/handle.c	2009-07-01 21:07:15.532236991 -0400
@@ -21,6 +21,12 @@
 	return sh;
 }
 
+int sepol_get_disable_dontaudit(sepol_handle_t *sh)
+{
+	assert(sh !=NULL);
+	return sh->disable_dontaudit;
+}
+
 void sepol_set_disable_dontaudit(sepol_handle_t * sh, int disable_dontaudit)
 {
 	assert(sh !=NULL);
diff -urN selinux.orig/libsepol/src/libsepol.map selinux/libsepol/src/libsepol.map
--- selinux.orig/libsepol/src/libsepol.map	2009-07-01 21:05:26.848236011 -0400
+++ selinux/libsepol/src/libsepol.map	2009-07-01 21:07:45.948485729 -0400
@@ -12,6 +12,7 @@
 	sepol_policydb_*; sepol_set_policydb_from_file; 
 	sepol_policy_kern_*;
 	sepol_policy_file_*;
+	sepol_get_disable_dontaudit;
 	sepol_set_disable_dontaudit;
 	sepol_set_expand_consume_base;
   local: *;