policycoreutils/policycoreutils-rhat.patch

diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.26/Makefile
--- nsapolicycoreutils/Makefile	2007-07-16 14:20:43.000000000 -0400
+++ policycoreutils-2.0.26/Makefile	2007-09-18 16:40:57.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
 
 all install relabel clean indent:
 	@for subdir in $(SUBDIRS); do \
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.26/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c	2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.26/restorecond/restorecond.c	2007-09-18 16:40:57.000000000 -0400
@@ -210,9 +210,10 @@
 			}
 
 			if (fsetfilecon(fd, scontext) < 0) {
-				syslog(LOG_ERR,
-				       "set context %s->%s failed:'%s'\n",
-				       filename, scontext, strerror(errno));
+				if (errno != EOPNOTSUPP) 
+					syslog(LOG_ERR,
+					       "set context %s->%s failed:'%s'\n",
+					       filename, scontext, strerror(errno));
 				if (retcontext >= 0)
 					free(prev_context);
 				free(scontext);
@@ -225,8 +226,9 @@
 		if (retcontext >= 0)
 			free(prev_context);
 	} else {
-		syslog(LOG_ERR, "get context on %s failed: '%s'\n",
-		       filename, strerror(errno));
+		if (errno != EOPNOTSUPP) 
+			syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+			       filename, strerror(errno));
 	}
 	free(scontext);
 	close(fd);
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.26/semanage/semanage
--- nsapolicycoreutils/semanage/semanage	2007-08-23 16:52:26.000000000 -0400
+++ policycoreutils-2.0.26/semanage/semanage	2007-09-24 16:41:52.000000000 -0400
@@ -48,13 +48,14 @@
 
 	def usage(message = ""):
 		print _('\
-semanage {login|user|port|interface|fcontext|translation} -l [-n] \n\
+semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\
 semanage login -{a|d|m} [-sr] login_name\n\
 semanage user -{a|d|m} [-LrRP] selinux_name\n\
 semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\
 semanage interface -{a|d|m} [-tr] interface_spec\n\
 semanage fcontext -{a|d|m} [-frst] file_spec\n\
 semanage translation -{a|d|m} [-T] level\n\n\
+semanage boolean -{d|m} boolean\n\n\
 \
 Primary Options:\n\
 \
@@ -62,6 +63,8 @@
 	-d, --delete     Delete a OBJECT record NAME\n\
 	-m, --modify     Modify a OBJECT record NAME\n\
 	-l, --list       List the OBJECTS\n\n\
+	-C, --locallist  List OBJECTS local customizations\n\n\
+	-D, --deleteall  Remove all OBJECTS local customizations\n\
 \
 	-h, --help       Display this message\n\
 	-n, --noheading  Do not print heading when listing OBJECTS\n\n\
@@ -98,7 +101,7 @@
 
 	def get_options():
 		valid_option={}
-		valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading' ]
+		valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-C', '--locallist', '-D', '--deleteall']
 		valid_option["login"] = []
 		valid_option["login"] += valid_everyone + [ '-s', '--seuser', '-r', '--range']
 		valid_option["user"] = []
@@ -111,6 +114,8 @@
 		valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser',  '-t', '--type', '-r', '--range'] 
 		valid_option["translation"] = []
 		valid_option["translation"] += valid_everyone + [ '-T', '--trans' ] 
+		valid_option["boolean"] = []
+		valid_option["boolean"] += valid_everyone 
 		return valid_option
 
 	#
@@ -134,7 +139,9 @@
 		add = 0
 		modify = 0
 		delete = 0
+		deleteall = 0
 		list = 0
+		locallist = 0
 		if len(sys.argv) < 3:
 			usage(_("Requires 2 or more arguments"))
 			
@@ -146,14 +153,16 @@
 		args = sys.argv[2:]
 
 		gopts, cmds = getopt.getopt(args,
-					    'adf:lhmnp:s:R:L:r:t:T:P:',
+					    'adf:lhmnp:s:CDR:L:r:t:T:P:',
 					    ['add',
 					     'delete',
+					     'deleteall',
 					     'ftype=',
 					     'help',
 					     'list', 
 					     'modify',
 					     'noheading',
+					     'localist',
 					     'proto=',
 					     'seuser=',
 					     'range=',
@@ -177,6 +186,10 @@
 				if modify or add:
 					usage()
 				delete = 1
+			if o == "-D"  or o == "--deleteall":
+				if modify:
+                                       usage()
+				deleteall = 1
 			if o == "-f"  or o == "--ftype":
 				ftype=a
 			if o == "-h" or o == "--help":
@@ -185,6 +198,9 @@
 			if o == "-n" or o == "--noheading":
 				heading=0
 
+			if o == "-C" or o == "--locallist":
+				locallist=1
+
 			if o == "-m"or o == "--modify":
 				if delete or add:
 					usage()
@@ -236,17 +252,24 @@
 		if object == "fcontext":
 			OBJECT = seobject.fcontextRecords()
 		
+		if object == "boolean":
+			OBJECT = seobject.booleanRecords()
+		
 		if object == "translation":
 			OBJECT = seobject.setransRecords()
 		
 		if list:
-			OBJECT.list(heading)
+			OBJECT.list(heading, locallist)
+			sys.exit(0);
+			
+		if deleteall:
+			OBJECT.deleteall()
 			sys.exit(0);
 			
 		if len(cmds) != 1:
 			usage()
-
-		target = cmds[0]
+                        
+                target = cmds[0]
 
 		if add:
 			if object == "login":
@@ -274,6 +297,9 @@
 			sys.exit(0);
 			
 		if modify:
+			if object == "boolean":
+				OBJECT.modify(target, value)
+
 			if object == "login":
 				OBJECT.modify(target, seuser, serange)
 
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.26/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py	2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.26/semanage/seobject.py	2007-09-24 16:42:14.000000000 -0400
@@ -170,7 +170,7 @@
 			rec += "%s=%s\n" %  (k, self.ddict[k])
 		return rec
 	
-	def list(self,heading = 1):
+	def list(self,heading = 1, locallist = 0):
 		if heading:
 			print "\n%-25s %s\n" % (_("Level"), _("Translation"))
 		keys = self.ddict.keys()
@@ -210,6 +210,7 @@
 		os.write(fd, self.out())
 		os.close(fd)
 		os.rename(newfilename, self.filename)
+                os.system("/sbin/service mcstrans reload > /dev/null")
                 
 class semanageRecords:
 	def __init__(self):
@@ -389,10 +390,12 @@
 		mylog.log(1,"delete SELinux user mapping", name);
 		semanage_seuser_key_free(k)
 
-		
-	def get_all(self):
+	def get_all(self, locallist = 0):
 		ddict = {}
-		(rc, self.ulist) = semanage_seuser_list(self.sh)
+                if locallist:
+                       (rc, self.ulist) = semanage_seuser_list_local(self.sh)
+                else:
+                       (rc, self.ulist) = semanage_seuser_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list login mappings"))
 
@@ -401,8 +404,8 @@
 			ddict[name] = (semanage_seuser_get_sename(u), semanage_seuser_get_mlsrange(u))
 		return ddict
 
-	def list(self,heading = 1):
-		ddict = self.get_all()
+	def list(self,heading = 1, locallist = 0):
+		ddict = self.get_all(locallist)
 		keys = ddict.keys()
 		keys.sort()
 		if is_mls_enabled == 1:
@@ -601,9 +604,12 @@
 		mylog.log(1,"delete SELinux user record", name)
 		semanage_user_key_free(k)		
 
-	def get_all(self):
+	def get_all(self, locallist = 0):
 		ddict = {}
-		(rc, self.ulist) = semanage_user_list(self.sh)
+                if locallist:
+                       (rc, self.ulist) = semanage_user_list_local(self.sh)
+                else:
+                       (rc, self.ulist) = semanage_user_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list SELinux users"))
 
@@ -618,8 +624,8 @@
 
 		return ddict
 
-	def list(self, heading = 1):
-		ddict = self.get_all()
+	def list(self, heading = 1, locallist = 0):
+		ddict = self.get_all(locallist)
 		keys = ddict.keys()
 		keys.sort()
 		if is_mls_enabled == 1:
@@ -795,9 +801,12 @@
 		
 		semanage_port_key_free(k)
 
-	def get_all(self):
+	def get_all(self, locallist = 0):
 		ddict = {}
-		(rc, self.plist) = semanage_port_list(self.sh)
+                if locallist:
+                       (rc, self.plist) = semanage_port_list_local(self.sh)
+                else:
+                       (rc, self.plist) = semanage_port_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list ports"))
 
@@ -814,9 +823,12 @@
 			ddict[(low, high)] = (ctype, proto_str, level)
 		return ddict
 
-	def get_all_by_type(self):
+	def get_all_by_type(self, locallist = 0):
 		ddict = {}
-		(rc, self.plist) = semanage_port_list(self.sh)
+                if locallist:
+                       (rc, self.plist) = semanage_port_list_local(self.sh)
+                else:
+                       (rc, self.plist) = semanage_port_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list ports"))
 
@@ -837,10 +849,10 @@
 				ddict[(ctype,proto_str)].append("%d-%d" % (low, high))
 		return ddict
 
-	def list(self, heading = 1):
+	def list(self, heading = 1, locallist = 0):
 		if heading:
 			print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number"))
-		ddict = self.get_all_by_type()
+		ddict = self.get_all_by_type(locallist)
 		keys = ddict.keys()
 		keys.sort()
 		for i in keys:
@@ -995,9 +1007,12 @@
 		
 		semanage_iface_key_free(k)
 
-	def get_all(self):
+	def get_all(self, locallist = 0):
 		ddict = {}
-		(rc, self.ilist) = semanage_iface_list(self.sh)
+                if locallist:
+                       (rc, self.ilist) = semanage_iface_list_local(self.sh)
+                else:
+                       (rc, self.ilist) = semanage_iface_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list interfaces"))
 
@@ -1007,10 +1022,10 @@
 
 		return ddict
 			
-	def list(self, heading = 1):
+	def list(self, heading = 1, locallist = 0):
 		if heading:
 			print "%-30s %s\n" % (_("SELinux Interface"), _("Context"))
-		ddict = self.get_all()
+		ddict = self.get_all(locallist)
 		keys = ddict.keys()
 		keys.sort()
 		if is_mls_enabled:
@@ -1024,14 +1039,31 @@
 	def __init__(self):
 		semanageRecords.__init__(self)
 		
-	def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+        def createcon(self, target, seuser = "system_u"):
+                (rc, con) = semanage_context_create(self.sh)
+                if rc < 0:
+                       raise ValueError(_("Could not create context for %s") % target)
 		if seuser == "":
 			seuser = "system_u"
+
+                rc = semanage_context_set_user(self.sh, con, seuser)
+                if rc < 0:
+                       raise ValueError(_("Could not set user in file context for %s") % target)
+		
+                rc = semanage_context_set_role(self.sh, con, "object_r")
+                if rc < 0:
+                       raise ValueError(_("Could not set role in file context for %s") % target)
+
 		if is_mls_enabled == 1:
-			if serange == "":
-				serange = "s0"
-			else:
-				serange = untranslate(serange)
+                       rc = semanage_context_set_mls(self.sh, con, "s0")
+                       if rc < 0:
+                              raise ValueError(_("Could not set mls fields in file context for %s") % target)
+
+                return con
+               
+	def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+		if is_mls_enabled == 1:
+                       serange = untranslate(serange)
 			
 		if type == "":
 			raise ValueError(_("SELinux Type is required"))
@@ -1051,33 +1083,23 @@
 			raise ValueError(_("Could not create file context for %s") % target)
 		
 		rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
-		(rc, con) = semanage_context_create(self.sh)
-		if rc < 0:
-			raise ValueError(_("Could not create context for %s") % target)
+                if type != "<<none>>":
+                       con = self.createcon(target, seuser)
 
-		rc = semanage_context_set_user(self.sh, con, seuser)
-		if rc < 0:
-			raise ValueError(_("Could not set user in file context for %s") % target)
-		
-		rc = semanage_context_set_role(self.sh, con, "object_r")
-		if rc < 0:
-			raise ValueError(_("Could not set role in file context for %s") % target)
-
-		rc = semanage_context_set_type(self.sh, con, type)
-		if rc < 0:
-			raise ValueError(_("Could not set type in file context for %s") % target)
-
-		if serange != "":
-			rc = semanage_context_set_mls(self.sh, con, serange)
-			if rc < 0:
-				raise ValueError(_("Could not set mls fields in file context for %s") % target)
+                       rc = semanage_context_set_type(self.sh, con, type)
+                       if rc < 0:
+                              raise ValueError(_("Could not set type in file context for %s") % target)
+
+                       if serange != "":
+                              rc = semanage_context_set_mls(self.sh, con, serange)
+                              if rc < 0:
+                                     raise ValueError(_("Could not set mls fields in file context for %s") % target)
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
 
 		semanage_fcontext_set_type(fcontext, file_types[ftype])
 
-		rc = semanage_fcontext_set_con(self.sh, fcontext, con)
-		if rc < 0:
-			raise ValueError(_("Could not set file context for %s") % target)
-
 		rc = semanage_begin_transaction(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not start semanage transaction"))
@@ -1090,7 +1112,8 @@
 		if rc < 0:
 			raise ValueError(_("Could not add file context for %s") % target)
 
-		semanage_context_free(con)
+                if type != "<<none>>":
+                       semanage_context_free(con)
 		semanage_fcontext_key_free(k)
 		semanage_fcontext_free(fcontext)
 
@@ -1112,16 +1135,29 @@
 		if rc < 0:
 			raise ValueError(_("Could not query file context for %s") % target)
 
-		con = semanage_fcontext_get_con(fcontext)
+                if setype != "<<none>>":
+                       con = semanage_fcontext_get_con(fcontext)
 			
-		if serange != "":
-			semanage_context_set_mls(self.sh, con, untranslate(serange))
-		if seuser != "":
-			semanage_context_set_user(self.sh, con, seuser)	
-		if setype != "":
-			semanage_context_set_type(self.sh, con, setype)
-
-		rc = semanage_begin_transaction(self.sh)
+                       if con == None:
+                              con = self.createcon(target)
+                              
+                       if serange != "":
+                              semanage_context_set_mls(self.sh, con, untranslate(serange))
+                       if seuser != "":
+                              semanage_context_set_user(self.sh, con, seuser)
+                              
+                       if setype != "":
+                              semanage_context_set_type(self.sh, con, setype)
+
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
+                else:
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, None)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
+                       
+                rc = semanage_begin_transaction(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not start semanage transaction"))
 
@@ -1167,17 +1203,20 @@
 
 		semanage_fcontext_key_free(k)		
 
-	def get_all(self):
+	def get_all(self, locallist = 0):
 		l = []
-		(rc, self.flist) = semanage_fcontext_list(self.sh)
-		if rc < 0:
-			raise ValueError(_("Could not list file contexts"))
-
-		(rc, fclocal) = semanage_fcontext_list_local(self.sh)
-		if rc < 0:
-			raise ValueError(_("Could not list local file contexts"))
+                if locallist:
+                       (rc, self.flist) = semanage_fcontext_list_local(self.sh)
+                else:
+                       (rc, self.flist) = semanage_fcontext_list(self.sh)
+                       if rc < 0:
+                              raise ValueError(_("Could not list file contexts"))
+
+                       (rc, fclocal) = semanage_fcontext_list_local(self.sh)
+                       if rc < 0:
+                              raise ValueError(_("Could not list local file contexts"))
 
-		self.flist += fclocal
+                       self.flist += fclocal
 
 		for fcontext in self.flist:
 			expr = semanage_fcontext_get_expr(fcontext)
@@ -1191,10 +1230,10 @@
 
 		return l
 			
-	def list(self, heading = 1):
+	def list(self, heading = 1, locallist = 0 ):
 		if heading:
 			print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
-		fcon_list = self.get_all()
+		fcon_list = self.get_all(locallist)
 		for fcon in fcon_list:
 			if len(fcon) > 3:
 				if is_mls_enabled:
@@ -1266,34 +1305,62 @@
 		if rc < 0:
 			raise ValueError(_("Could not start semanage transaction"))
 
-		rc = semanage_fcontext_del_local(self.sh, k)
+		rc = semanage_bool_del_local(self.sh, k)
 		if rc < 0:
 			raise ValueError(_("Could not delete boolean %s") % name)
 	
 		rc = semanage_commit(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not delete boolean %s") % name)
-		
 		semanage_bool_key_free(k)
 
-	def get_all(self):
+	def deleteall(self):
+		(rc, self.blist) = semanage_bool_list_local(self.sh)
+		if rc < 0:
+			raise ValueError(_("Could not list booleans"))
+
+		rc = semanage_begin_transaction(self.sh)
+		if rc < 0:
+			raise ValueError(_("Could not start semanage transaction"))
+
+		for boolean in self.blist:
+                       name = semanage_bool_get_name(boolean)
+                       (rc,k) = semanage_bool_key_create(self.sh, name)
+                       if rc < 0:
+                              raise ValueError(_("Could not create a key for %s") % name)
+
+                       rc = semanage_bool_del_local(self.sh, k)
+                       if rc < 0:
+                              raise ValueError(_("Could not delete boolean %s") % name)
+                       semanage_bool_key_free(k)
+	
+		rc = semanage_commit(self.sh)
+		if rc < 0:
+			raise ValueError(_("Could not delete boolean %s") % name)
+	def get_all(self, locallist = 0):
 		ddict = {}
-		(rc, self.blist) = semanage_bool_list(self.sh)
+                if locallist:
+                       (rc, self.blist) = semanage_bool_list_local(self.sh)
+                else:
+                       (rc, self.blist) = semanage_bool_list(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not list booleans"))
 
 		for boolean in self.blist:
-			name = semanage_bool_get_name(boolean)
-			value = semanage_bool_get_value(boolean)
-			ddict[name] = value
+                       value = []
+                       name = semanage_bool_get_name(boolean)
+                       value.append(semanage_bool_get_value(boolean))
+                       value.append(selinux.security_get_boolean_pending(name))
+                       value.append(selinux.security_get_boolean_active(name))
+                       ddict[name] = value
 
 		return ddict
 			
-	def list(self, heading = 1):
+	def list(self, heading = 1, locallist = 0):
 		if heading:
-			print "%-50s %-18s\n" % (_("SELinux boolean"), _("value"))
-		ddict = self.get_all()
+			print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"),  _("active") )
+		ddict = self.get_all(locallist)
 		keys = ddict.keys()
 		for k in keys:
 			if ddict[k]:
-				print "%-50s %-18s " % (k[0], ddict[k][0])
+				print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2])
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.26/semodule/semodule.8
--- nsapolicycoreutils/semodule/semodule.8	2007-07-16 14:20:42.000000000 -0400
+++ policycoreutils-2.0.26/semodule/semodule.8	2007-09-18 16:40:57.000000000 -0400
@@ -23,6 +23,9 @@
 .B \-B, \-\-build		
 force a rebuild of policy (also reloads unless -n is used)
 .TP
+.B \-D, \-\-disable_dontaudit
+Temporarily remove dontaudits from policy.  Reverts whenever policy is rebuilt
+.TP
 .B \-i,\-\-install=MODULE_PKG
 install/replace a module package
 .TP
@@ -58,6 +61,10 @@
 $ semodule -i httpd.pp
 # List non-base modules.
 $ semodule -l
+# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
+$ semodule -DB
+# Turn "dontaudit" rules back on.
+$ semodule -B
 # Install or replace all non-base modules in the current directory.
 $ semodule -i *.pp
 # Install or replace all modules in the current directory.