2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.16/audit2allow/Makefile
|
|
|
|
--- nsapolicycoreutils/audit2allow/Makefile 2007-05-04 09:14:49.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/audit2allow/Makefile 2007-09-18 14:18:45.000000000 -0400
|
2007-04-18 18:35:04 +00:00
|
|
|
@@ -1,6 +1,7 @@
|
2007-03-23 12:54:17 +00:00
|
|
|
# Installation directories.
|
|
|
|
PREFIX ?= ${DESTDIR}/usr
|
2007-04-18 18:35:04 +00:00
|
|
|
BINDIR ?= $(PREFIX)/bin
|
|
|
|
+SBINDIR ?= $(PREFIX)/sbin
|
2007-03-23 12:54:17 +00:00
|
|
|
LIBDIR ?= $(PREFIX)/lib
|
|
|
|
MANDIR ?= $(PREFIX)/share/man
|
|
|
|
LOCALEDIR ?= /usr/share/locale
|
2007-04-18 18:35:04 +00:00
|
|
|
@@ -10,7 +11,7 @@
|
|
|
|
install: all
|
|
|
|
-mkdir -p $(BINDIR)
|
|
|
|
install -m 755 audit2allow $(BINDIR)
|
|
|
|
- install -m 755 sepolgen-ifgen $(BINDIR)
|
|
|
|
+ install -m 755 sepolgen-ifgen $(SBINDIR)
|
|
|
|
-mkdir -p $(MANDIR)/man1
|
|
|
|
install -m 644 audit2allow.1 $(MANDIR)/man1/
|
|
|
|
|
2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.16/Makefile
|
|
|
|
--- nsapolicycoreutils/Makefile 2007-05-04 09:14:49.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/Makefile 2007-09-18 14:18:45.000000000 -0400
|
2006-11-14 16:03:27 +00:00
|
|
|
@@ -1,4 +1,4 @@
|
|
|
|
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
|
|
|
|
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
|
|
|
|
|
|
|
|
all install relabel clean indent:
|
|
|
|
@for subdir in $(SUBDIRS); do \
|
2007-09-18 18:25:11 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.1 policycoreutils-2.0.16/newrole/newrole.1
|
|
|
|
--- nsapolicycoreutils/newrole/newrole.1 2007-05-04 09:14:50.000000000 -0400
|
|
|
|
+++ policycoreutils-2.0.16/newrole/newrole.1 2007-09-18 14:20:13.000000000 -0400
|
|
|
|
@@ -47,6 +47,12 @@
|
|
|
|
In particular, an argument of -- -c will cause the next argument to be
|
|
|
|
treated as a command by most command interpreters.
|
|
|
|
.PP
|
|
|
|
+If a command argument is specified to newrole and the command name is found
|
|
|
|
+in /etc/selinux/newrole_pam.conf, then the pam service name listed in that
|
|
|
|
+file for the command will be used rather than the normal newrole pam
|
|
|
|
+configuration. This allows for per-command pam configuration when
|
|
|
|
+invoked via newrole, e.g. to skip the interactive re-authentication phase.
|
|
|
|
+.PP
|
|
|
|
The new shell will be the shell specified in the user's entry in the
|
|
|
|
.I /etc/passwd
|
|
|
|
file.
|
|
|
|
@@ -81,14 +87,22 @@
|
|
|
|
# id -Z
|
|
|
|
staff_u:sysadm_r:sysadm_t:Secret
|
|
|
|
|
|
|
|
+.PP
|
|
|
|
+Running a program in a given role or level:
|
|
|
|
+ # newrole -r sysadm_r -- -c "/path/to/app arg1 arg2..."
|
|
|
|
+ # newrole -l Secret -- -c "/path/to/app arg1 arg2..."
|
|
|
|
+
|
|
|
|
.SH FILES
|
|
|
|
/etc/passwd - user account information
|
|
|
|
.br
|
|
|
|
/etc/shadow - encrypted passwords and age information
|
|
|
|
.br
|
|
|
|
/etc/selinux/<policy>/contexts/default_type - default types for roles
|
|
|
|
+.br
|
|
|
|
/etc/selinux/<policy>/contexts/securetty_types - securetty types for level changes
|
|
|
|
.br
|
|
|
|
+/etc/selinux/newrole_pam.conf - optional mapping of commands to separate pam service names
|
|
|
|
+.br
|
|
|
|
.SH SEE ALSO
|
|
|
|
.B runcon
|
|
|
|
(1)
|
2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.16/restorecon/restorecon.c
|
|
|
|
--- nsapolicycoreutils/restorecon/restorecon.c 2007-05-04 09:14:48.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/restorecon/restorecon.c 2007-09-18 14:18:45.000000000 -0400
|
2007-04-18 18:35:04 +00:00
|
|
|
@@ -16,6 +16,7 @@
|
|
|
|
* -v Show changes in file labels.
|
|
|
|
* -o filename save list of files with incorrect context
|
|
|
|
* -F Force reset of context to match file_context for customizable files
|
|
|
|
+ * -l Limit directory tree walk to a single filesystem
|
|
|
|
*
|
|
|
|
* pathname... The file(s) to label
|
|
|
|
*
|
|
|
|
@@ -50,6 +51,7 @@
|
|
|
|
static int recurse = 0;
|
|
|
|
static int file_exist = 1;
|
|
|
|
static int force = 0;
|
|
|
|
+static int onefs = 0;
|
|
|
|
#define STAT_BLOCK_SIZE 1
|
|
|
|
static int pipe_fds[2] = { -1, -1 };
|
|
|
|
static unsigned long long count = 0;
|
2007-04-24 14:44:06 +00:00
|
|
|
@@ -326,17 +328,19 @@
|
2007-04-18 18:35:04 +00:00
|
|
|
rc = fork();
|
|
|
|
if (rc == 0) {
|
|
|
|
close(pipe_fds[0]);
|
|
|
|
- nftw(buf, pre_stat, 1024, FTW_PHYS);
|
|
|
|
+ nftw(buf, pre_stat, 1024,
|
|
|
|
+ FTW_PHYS | (onefs ? FTW_MOUNT : 0));
|
|
|
|
exit(1);
|
|
|
|
}
|
|
|
|
if (rc > 0)
|
|
|
|
close(pipe_fds[1]);
|
|
|
|
if (rc == -1 || rc > 0) {
|
|
|
|
- if (nftw(buf, apply_spec, 1024, FTW_PHYS)) {
|
|
|
|
+ if (nftw(buf, apply_spec, 1024,
|
|
|
|
+ FTW_PHYS | (onefs ? FTW_MOUNT : 0))) {
|
2007-03-23 12:54:17 +00:00
|
|
|
if (!file_exist && errno == ENOENT)
|
|
|
|
return;
|
|
|
|
fprintf(stderr,
|
2007-04-24 14:44:06 +00:00
|
|
|
- "%s: error while traversing %s: %s\n",
|
2007-03-23 12:54:17 +00:00
|
|
|
+ "%s: %s: %s\n",
|
2007-04-24 14:44:06 +00:00
|
|
|
progname, buf, strerror(errno));
|
2007-03-23 12:54:17 +00:00
|
|
|
errors++;
|
|
|
|
}
|
2007-04-18 18:35:04 +00:00
|
|
|
@@ -367,11 +371,14 @@
|
|
|
|
|
|
|
|
set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
|
|
|
|
|
|
|
|
- while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) {
|
|
|
|
+ while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) {
|
|
|
|
switch (opt) {
|
|
|
|
case 'n':
|
|
|
|
change = 0;
|
|
|
|
break;
|
|
|
|
+ case 'l':
|
|
|
|
+ onefs = 1;
|
|
|
|
+ break;
|
|
|
|
case 'i':
|
|
|
|
file_exist = 0;
|
|
|
|
break;
|
2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.16/restorecond/restorecond.c
|
|
|
|
--- nsapolicycoreutils/restorecond/restorecond.c 2007-05-04 09:14:47.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/restorecond/restorecond.c 2007-09-18 14:18:45.000000000 -0400
|
2006-11-29 17:48:22 +00:00
|
|
|
@@ -210,9 +210,10 @@
|
|
|
|
}
|
|
|
|
|
|
|
|
if (fsetfilecon(fd, scontext) < 0) {
|
|
|
|
- syslog(LOG_ERR,
|
|
|
|
- "set context %s->%s failed:'%s'\n",
|
|
|
|
- filename, scontext, strerror(errno));
|
|
|
|
+ if (errno != EOPNOTSUPP)
|
|
|
|
+ syslog(LOG_ERR,
|
|
|
|
+ "set context %s->%s failed:'%s'\n",
|
|
|
|
+ filename, scontext, strerror(errno));
|
|
|
|
if (retcontext >= 0)
|
|
|
|
free(prev_context);
|
|
|
|
free(scontext);
|
|
|
|
@@ -225,8 +226,9 @@
|
|
|
|
if (retcontext >= 0)
|
|
|
|
free(prev_context);
|
|
|
|
} else {
|
|
|
|
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
|
|
- filename, strerror(errno));
|
|
|
|
+ if (errno != EOPNOTSUPP)
|
|
|
|
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
|
|
+ filename, strerror(errno));
|
|
|
|
}
|
|
|
|
free(scontext);
|
|
|
|
close(fd);
|
2007-06-22 13:36:24 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.16/scripts/chcat
|
|
|
|
--- nsapolicycoreutils/scripts/chcat 2007-05-04 09:14:49.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/scripts/chcat 2007-09-18 14:18:45.000000000 -0400
|
2007-06-22 13:36:24 +00:00
|
|
|
@@ -77,7 +77,7 @@
|
|
|
|
|
|
|
|
if len(cats) > 0:
|
|
|
|
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
|
|
|
|
- else
|
|
|
|
+ else:
|
|
|
|
new_serange = "%s-%s" % (serange[0], top[0])
|
|
|
|
|
|
|
|
if add_ind:
|
|
|
|
@@ -155,7 +155,7 @@
|
|
|
|
|
|
|
|
if len(cats) > 0:
|
|
|
|
new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
|
|
|
|
- else
|
|
|
|
+ else:
|
|
|
|
new_serange = "%s-%s" % (serange[0], top[0])
|
|
|
|
|
|
|
|
if add_ind:
|
2007-07-23 14:31:19 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.16/scripts/fixfiles
|
|
|
|
--- nsapolicycoreutils/scripts/fixfiles 2007-05-04 09:14:49.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/scripts/fixfiles 2007-09-18 14:21:45.000000000 -0400
|
|
|
|
@@ -88,7 +88,7 @@
|
|
|
|
esac; \
|
|
|
|
fi; \
|
|
|
|
done | \
|
|
|
|
- while read pattern ; do find $pattern \
|
|
|
|
+ while read pattern ; do sh -c "find $pattern" \
|
|
|
|
! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \
|
|
|
|
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \
|
|
|
|
done 2> /dev/null | \
|
2007-07-23 14:31:19 +00:00
|
|
|
@@ -108,6 +108,7 @@
|
|
|
|
|
|
|
|
rpmlist() {
|
|
|
|
rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
|
|
|
|
+[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr
|
|
|
|
}
|
|
|
|
|
|
|
|
#
|
2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.16/scripts/genhomedircon
|
|
|
|
--- nsapolicycoreutils/scripts/genhomedircon 2007-05-04 09:14:49.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/scripts/genhomedircon 2007-09-18 14:18:45.000000000 -0400
|
2007-06-01 14:36:17 +00:00
|
|
|
@@ -193,7 +193,7 @@
|
|
|
|
return prefix
|
|
|
|
|
|
|
|
def adduser(self, udict, user, seuser, prefix):
|
|
|
|
- if seuser == "user_u" or user == "__default__" or user == "system_u":
|
|
|
|
+ if seuser == self.default_user or user == "__default__" or user == "system_u":
|
|
|
|
return
|
|
|
|
# !!! chooses first prefix in the list to use in the file context !!!
|
|
|
|
try:
|
|
|
|
@@ -263,7 +263,7 @@
|
|
|
|
i = i.replace("system_u", seuser)
|
|
|
|
# Validate if the generated context exists. Some user types may not exist
|
|
|
|
scon = i.split()[-1]
|
|
|
|
- if selinux.security_check_context(scon) == 0:
|
|
|
|
+ if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0:
|
|
|
|
ret = ret+i
|
|
|
|
fd.close()
|
|
|
|
return ret
|
2007-05-04 17:30:00 +00:00
|
|
|
@@ -302,7 +302,7 @@
|
|
|
|
|
|
|
|
regex = re.sub("\(\/\.\*\)\?", "", regex)
|
|
|
|
regex = regex + "/*$"
|
|
|
|
- if re.search(home, regex, 0):
|
2007-07-06 13:49:35 +00:00
|
|
|
+ if re.match(regex,home):
|
2007-05-04 17:30:00 +00:00
|
|
|
return 1
|
|
|
|
except:
|
|
|
|
continue
|
2007-10-31 11:12:23 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.16/semanage/semanage
|
|
|
|
--- nsapolicycoreutils/semanage/semanage 2007-05-04 09:14:48.000000000 -0400
|
|
|
|
+++ policycoreutils-2.0.16/semanage/semanage 2007-10-31 07:04:57.000000000 -0400
|
|
|
|
@@ -34,7 +34,10 @@
|
|
|
|
sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
|
|
|
|
|
|
|
|
try:
|
|
|
|
- gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
|
|
|
|
+ gettext.install(PROGNAME,
|
|
|
|
+ localedir="/usr/share/locale",
|
|
|
|
+ unicode=False,
|
|
|
|
+ codeset = 'utf-8')
|
|
|
|
except IOError:
|
|
|
|
import __builtin__
|
|
|
|
__builtin__.__dict__['_'] = unicode
|
|
|
|
@@ -45,13 +48,14 @@
|
|
|
|
|
|
|
|
def usage(message = ""):
|
|
|
|
print _('\
|
|
|
|
-semanage {login|user|port|interface|fcontext|translation} -l [-n] \n\
|
|
|
|
+semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\
|
|
|
|
semanage login -{a|d|m} [-sr] login_name\n\
|
|
|
|
semanage user -{a|d|m} [-LrRP] selinux_name\n\
|
|
|
|
semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\
|
|
|
|
semanage interface -{a|d|m} [-tr] interface_spec\n\
|
|
|
|
semanage fcontext -{a|d|m} [-frst] file_spec\n\
|
|
|
|
semanage translation -{a|d|m} [-T] level\n\n\
|
|
|
|
+semanage boolean -{d|m} boolean\n\n\
|
|
|
|
\
|
|
|
|
Primary Options:\n\
|
|
|
|
\
|
|
|
|
@@ -59,10 +63,12 @@
|
|
|
|
-d, --delete Delete a OBJECT record NAME\n\
|
|
|
|
-m, --modify Modify a OBJECT record NAME\n\
|
|
|
|
-l, --list List the OBJECTS\n\n\
|
|
|
|
+ -C, --locallist List OBJECTS local customizations\n\n\
|
|
|
|
+ -D, --deleteall Remove all OBJECTS local customizations\n\
|
|
|
|
\
|
|
|
|
-h, --help Display this message\n\
|
|
|
|
- -n, --noheading Do not print heading when listing OBJECTS\n\n\
|
|
|
|
-\
|
|
|
|
+ -n, --noheading Do not print heading when listing OBJECTS\n\
|
|
|
|
+ -S, --store Select and alternate SELinux store to manage\n\n\
|
|
|
|
Object-specific Options (see above):\n\
|
|
|
|
-f, --ftype File Type of OBJECT \n\
|
|
|
|
"" (all files) \n\
|
|
|
|
@@ -95,7 +101,7 @@
|
|
|
|
|
|
|
|
def get_options():
|
|
|
|
valid_option={}
|
|
|
|
- valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading' ]
|
|
|
|
+ valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-C', '--locallist', '-D', '--deleteall', '-S', '--store' ]
|
|
|
|
valid_option["login"] = []
|
|
|
|
valid_option["login"] += valid_everyone + [ '-s', '--seuser', '-r', '--range']
|
|
|
|
valid_option["user"] = []
|
|
|
|
@@ -108,6 +114,8 @@
|
|
|
|
valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
|
|
|
|
valid_option["translation"] = []
|
|
|
|
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
|
|
|
|
+ valid_option["boolean"] = []
|
|
|
|
+ valid_option["boolean"] += valid_everyone
|
|
|
|
return valid_option
|
|
|
|
|
|
|
|
#
|
|
|
|
@@ -131,7 +139,10 @@
|
|
|
|
add = 0
|
|
|
|
modify = 0
|
|
|
|
delete = 0
|
|
|
|
+ deleteall = 0
|
|
|
|
list = 0
|
|
|
|
+ locallist = 0
|
|
|
|
+ store = ""
|
|
|
|
if len(sys.argv) < 3:
|
|
|
|
usage(_("Requires 2 or more arguments"))
|
|
|
|
|
|
|
|
@@ -143,16 +154,19 @@
|
|
|
|
args = sys.argv[2:]
|
|
|
|
|
|
|
|
gopts, cmds = getopt.getopt(args,
|
|
|
|
- 'adf:lhmnp:s:R:L:r:t:T:P:',
|
|
|
|
+ 'adf:lhmnp:s:CDR:L:r:t:T:P:S:',
|
|
|
|
['add',
|
|
|
|
'delete',
|
|
|
|
+ 'deleteall',
|
|
|
|
'ftype=',
|
|
|
|
'help',
|
|
|
|
'list',
|
|
|
|
'modify',
|
|
|
|
'noheading',
|
|
|
|
+ 'localist',
|
|
|
|
'proto=',
|
|
|
|
'seuser=',
|
|
|
|
+ 'store=',
|
|
|
|
'range=',
|
|
|
|
'level=',
|
|
|
|
'roles=',
|
|
|
|
@@ -174,6 +188,10 @@
|
|
|
|
if modify or add:
|
|
|
|
usage()
|
|
|
|
delete = 1
|
|
|
|
+ if o == "-D" or o == "--deleteall":
|
|
|
|
+ if modify:
|
|
|
|
+ usage()
|
|
|
|
+ deleteall = 1
|
|
|
|
if o == "-f" or o == "--ftype":
|
|
|
|
ftype=a
|
|
|
|
if o == "-h" or o == "--help":
|
|
|
|
@@ -182,11 +200,17 @@
|
|
|
|
if o == "-n" or o == "--noheading":
|
|
|
|
heading=0
|
|
|
|
|
|
|
|
+ if o == "-C" or o == "--locallist":
|
|
|
|
+ locallist=1
|
|
|
|
+
|
|
|
|
if o == "-m"or o == "--modify":
|
|
|
|
if delete or add:
|
|
|
|
usage()
|
|
|
|
modify = 1
|
|
|
|
|
|
|
|
+ if o == "-S" or o == '--store':
|
|
|
|
+ store = a
|
|
|
|
+
|
|
|
|
if o == "-r" or o == '--range':
|
|
|
|
if is_mls_enabled == 0:
|
|
|
|
errorExit(_("range not supported on Non MLS machines"))
|
|
|
|
@@ -219,31 +243,38 @@
|
|
|
|
setrans = a
|
|
|
|
|
|
|
|
if object == "login":
|
|
|
|
- OBJECT = seobject.loginRecords()
|
|
|
|
+ OBJECT = seobject.loginRecords(store)
|
|
|
|
|
|
|
|
if object == "user":
|
|
|
|
- OBJECT = seobject.seluserRecords()
|
|
|
|
+ OBJECT = seobject.seluserRecords(store)
|
|
|
|
|
|
|
|
if object == "port":
|
|
|
|
- OBJECT = seobject.portRecords()
|
|
|
|
+ OBJECT = seobject.portRecords(store)
|
|
|
|
|
|
|
|
if object == "interface":
|
|
|
|
- OBJECT = seobject.interfaceRecords()
|
|
|
|
+ OBJECT = seobject.interfaceRecords(store)
|
|
|
|
|
|
|
|
if object == "fcontext":
|
|
|
|
- OBJECT = seobject.fcontextRecords()
|
|
|
|
+ OBJECT = seobject.fcontextRecords(store)
|
|
|
|
+
|
|
|
|
+ if object == "boolean":
|
|
|
|
+ OBJECT = seobject.booleanRecords(store)
|
|
|
|
|
|
|
|
if object == "translation":
|
|
|
|
OBJECT = seobject.setransRecords()
|
|
|
|
|
|
|
|
if list:
|
|
|
|
- OBJECT.list(heading)
|
|
|
|
+ OBJECT.list(heading, locallist)
|
|
|
|
+ sys.exit(0);
|
|
|
|
+
|
|
|
|
+ if deleteall:
|
|
|
|
+ OBJECT.deleteall()
|
|
|
|
sys.exit(0);
|
|
|
|
|
|
|
|
if len(cmds) != 1:
|
|
|
|
usage()
|
|
|
|
-
|
|
|
|
- target = cmds[0]
|
|
|
|
+
|
|
|
|
+ target = cmds[0]
|
|
|
|
|
|
|
|
if add:
|
|
|
|
if object == "login":
|
|
|
|
@@ -271,6 +302,9 @@
|
|
|
|
sys.exit(0);
|
|
|
|
|
|
|
|
if modify:
|
|
|
|
+ if object == "boolean":
|
|
|
|
+ OBJECT.modify(target, value)
|
|
|
|
+
|
|
|
|
if object == "login":
|
|
|
|
OBJECT.modify(target, seuser, serange)
|
|
|
|
|
2007-06-01 14:36:17 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.16/semanage/seobject.py
|
|
|
|
--- nsapolicycoreutils/semanage/seobject.py 2007-05-04 09:14:48.000000000 -0400
|
2007-10-31 11:12:23 +00:00
|
|
|
+++ policycoreutils-2.0.16/semanage/seobject.py 2007-10-31 07:04:59.000000000 -0400
|
|
|
|
@@ -170,7 +170,7 @@
|
|
|
|
rec += "%s=%s\n" % (k, self.ddict[k])
|
|
|
|
return rec
|
|
|
|
|
|
|
|
- def list(self,heading = 1):
|
|
|
|
+ def list(self,heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
print "\n%-25s %s\n" % (_("Level"), _("Translation"))
|
|
|
|
keys = self.ddict.keys()
|
|
|
|
@@ -210,13 +210,17 @@
|
2006-11-15 21:14:38 +00:00
|
|
|
os.write(fd, self.out())
|
|
|
|
os.close(fd)
|
|
|
|
os.rename(newfilename, self.filename)
|
|
|
|
+ os.system("/sbin/service mcstrans reload > /dev/null")
|
2007-02-22 15:14:00 +00:00
|
|
|
|
2006-11-15 21:14:38 +00:00
|
|
|
class semanageRecords:
|
2007-10-31 11:12:23 +00:00
|
|
|
- def __init__(self):
|
|
|
|
+ def __init__(self, store):
|
|
|
|
self.sh = semanage_handle_create()
|
|
|
|
if not self.sh:
|
|
|
|
raise ValueError(_("Could not create semanage handle"))
|
|
|
|
|
|
|
|
+ if store != "":
|
|
|
|
+ semanage_select_store(self.sh, store, SEMANAGE_CON_DIRECT);
|
|
|
|
+
|
|
|
|
self.semanaged = semanage_is_managed(self.sh)
|
|
|
|
|
|
|
|
if not self.semanaged:
|
|
|
|
@@ -234,8 +238,8 @@
|
|
|
|
raise ValueError(_("Could not establish semanage connection"))
|
|
|
|
|
|
|
|
class loginRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
|
|
|
|
def add(self, name, sename, serange):
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
@@ -389,10 +393,12 @@
|
|
|
|
mylog.log(1,"delete SELinux user mapping", name);
|
|
|
|
semanage_seuser_key_free(k)
|
|
|
|
|
|
|
|
-
|
|
|
|
- def get_all(self):
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.ulist) = semanage_seuser_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.ulist) = semanage_seuser_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.ulist) = semanage_seuser_list(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not list login mappings"))
|
|
|
|
|
|
|
|
@@ -401,8 +407,8 @@
|
|
|
|
ddict[name] = (semanage_seuser_get_sename(u), semanage_seuser_get_mlsrange(u))
|
|
|
|
return ddict
|
|
|
|
|
|
|
|
- def list(self,heading = 1):
|
|
|
|
- ddict = self.get_all()
|
|
|
|
+ def list(self,heading = 1, locallist = 0):
|
|
|
|
+ ddict = self.get_all(locallist)
|
|
|
|
keys = ddict.keys()
|
|
|
|
keys.sort()
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
@@ -417,8 +423,8 @@
|
|
|
|
print "%-25s %-25s" % (k, ddict[k][0])
|
|
|
|
|
|
|
|
class seluserRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
|
|
|
|
def add(self, name, roles, selevel, serange, prefix):
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
@@ -601,9 +607,12 @@
|
|
|
|
mylog.log(1,"delete SELinux user record", name)
|
|
|
|
semanage_user_key_free(k)
|
|
|
|
|
|
|
|
- def get_all(self):
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.ulist) = semanage_user_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.ulist) = semanage_user_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.ulist) = semanage_user_list(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not list SELinux users"))
|
|
|
|
|
|
|
|
@@ -618,8 +627,8 @@
|
|
|
|
|
|
|
|
return ddict
|
|
|
|
|
|
|
|
- def list(self, heading = 1):
|
|
|
|
- ddict = self.get_all()
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
+ ddict = self.get_all(locallist)
|
|
|
|
keys = ddict.keys()
|
|
|
|
keys.sort()
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
@@ -635,8 +644,8 @@
|
|
|
|
print "%-15s %s" % (k, ddict[k][3])
|
|
|
|
|
|
|
|
class portRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
|
|
|
|
def __genkey(self, port, proto):
|
|
|
|
if proto == "tcp":
|
|
|
|
@@ -767,6 +776,34 @@
|
|
|
|
semanage_port_key_free(k)
|
|
|
|
semanage_port_free(p)
|
|
|
|
|
|
|
|
+ def deleteall(self):
|
|
|
|
+ (rc, plist) = semanage_port_list_local(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list the ports"))
|
|
|
|
+
|
|
|
|
+ rc = semanage_begin_transaction(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
+
|
|
|
|
+ for port in plist:
|
|
|
|
+ proto = semanage_port_get_proto(port)
|
|
|
|
+ proto_str = semanage_port_get_proto_str(proto)
|
|
|
|
+ low = semanage_port_get_low(port)
|
|
|
|
+ high = semanage_port_get_high(port)
|
|
|
|
+ port_str = "%s-%s" % (low, high)
|
|
|
|
+ ( k, proto_d, low, high ) = self.__genkey(port_str , proto_str)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not create a key for %s") % port_str)
|
|
|
|
+
|
|
|
|
+ rc = semanage_port_del_local(self.sh, k)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete the port %s") % port_str)
|
|
|
|
+ semanage_port_key_free(k)
|
|
|
|
+
|
|
|
|
+ rc = semanage_commit(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete the %s") % port_str)
|
|
|
|
+
|
|
|
|
def delete(self, port, proto):
|
|
|
|
( k, proto_d, low, high ) = self.__genkey(port, proto)
|
|
|
|
(rc,exists) = semanage_port_exists(self.sh, k)
|
|
|
|
@@ -795,9 +832,12 @@
|
|
|
|
|
|
|
|
semanage_port_key_free(k)
|
|
|
|
|
|
|
|
- def get_all(self):
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.plist) = semanage_port_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.plist) = semanage_port_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.plist) = semanage_port_list(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not list ports"))
|
|
|
|
|
|
|
|
@@ -814,9 +854,12 @@
|
|
|
|
ddict[(low, high)] = (ctype, proto_str, level)
|
|
|
|
return ddict
|
|
|
|
|
|
|
|
- def get_all_by_type(self):
|
|
|
|
+ def get_all_by_type(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.plist) = semanage_port_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.plist) = semanage_port_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.plist) = semanage_port_list(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not list ports"))
|
|
|
|
|
|
|
|
@@ -837,10 +880,10 @@
|
|
|
|
ddict[(ctype,proto_str)].append("%d-%d" % (low, high))
|
|
|
|
return ddict
|
|
|
|
|
|
|
|
- def list(self, heading = 1):
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number"))
|
|
|
|
- ddict = self.get_all_by_type()
|
|
|
|
+ ddict = self.get_all_by_type(locallist)
|
|
|
|
keys = ddict.keys()
|
|
|
|
keys.sort()
|
|
|
|
for i in keys:
|
|
|
|
@@ -851,8 +894,8 @@
|
|
|
|
print rec
|
|
|
|
|
|
|
|
class interfaceRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
|
|
|
|
def add(self, interface, serange, ctype):
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
@@ -995,9 +1038,12 @@
|
|
|
|
|
|
|
|
semanage_iface_key_free(k)
|
|
|
|
|
|
|
|
- def get_all(self):
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.ilist) = semanage_iface_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.ilist) = semanage_iface_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.ilist) = semanage_iface_list(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not list interfaces"))
|
|
|
|
|
|
|
|
@@ -1007,10 +1053,10 @@
|
|
|
|
|
|
|
|
return ddict
|
|
|
|
|
|
|
|
- def list(self, heading = 1):
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
print "%-30s %s\n" % (_("SELinux Interface"), _("Context"))
|
|
|
|
- ddict = self.get_all()
|
|
|
|
+ ddict = self.get_all(locallist)
|
|
|
|
keys = ddict.keys()
|
|
|
|
keys.sort()
|
|
|
|
if is_mls_enabled:
|
|
|
|
@@ -1021,17 +1067,40 @@
|
|
|
|
print "%-30s %s:%s:%s " % (k,ddict[k][0], ddict[k][1],ddict[k][2])
|
|
|
|
|
|
|
|
class fcontextRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
-
|
|
|
|
- def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
+
|
|
|
|
+ def createcon(self, target, seuser = "system_u"):
|
|
|
|
+ (rc, con) = semanage_context_create(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not create context for %s") % target)
|
|
|
|
if seuser == "":
|
|
|
|
seuser = "system_u"
|
|
|
|
+
|
|
|
|
+ rc = semanage_context_set_user(self.sh, con, seuser)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set user in file context for %s") % target)
|
|
|
|
+
|
|
|
|
+ rc = semanage_context_set_role(self.sh, con, "object_r")
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set role in file context for %s") % target)
|
|
|
|
+
|
|
|
|
if is_mls_enabled == 1:
|
|
|
|
- if serange == "":
|
|
|
|
- serange = "s0"
|
|
|
|
- else:
|
|
|
|
- serange = untranslate(serange)
|
|
|
|
+ rc = semanage_context_set_mls(self.sh, con, "s0")
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
|
|
+
|
|
|
|
+ return con
|
|
|
|
+
|
|
|
|
+ def validate(self, target):
|
|
|
|
+ if target == "" or target.find("\n") >= 0:
|
|
|
|
+ raise ValueError(_("Invalid file specification"))
|
|
|
|
+
|
|
|
|
+ def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
|
|
|
|
+ self.validate(target)
|
|
|
|
+
|
|
|
|
+ if is_mls_enabled == 1:
|
|
|
|
+ serange = untranslate(serange)
|
|
|
|
|
|
|
|
if type == "":
|
|
|
|
raise ValueError(_("SELinux Type is required"))
|
|
|
|
@@ -1051,33 +1120,23 @@
|
|
|
|
raise ValueError(_("Could not create file context for %s") % target)
|
|
|
|
|
|
|
|
rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
|
|
|
|
- (rc, con) = semanage_context_create(self.sh)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not create context for %s") % target)
|
|
|
|
+ if type != "<<none>>":
|
|
|
|
+ con = self.createcon(target, seuser)
|
|
|
|
|
|
|
|
- rc = semanage_context_set_user(self.sh, con, seuser)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set user in file context for %s") % target)
|
|
|
|
-
|
|
|
|
- rc = semanage_context_set_role(self.sh, con, "object_r")
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set role in file context for %s") % target)
|
|
|
|
-
|
|
|
|
- rc = semanage_context_set_type(self.sh, con, type)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set type in file context for %s") % target)
|
|
|
|
-
|
|
|
|
- if serange != "":
|
|
|
|
- rc = semanage_context_set_mls(self.sh, con, serange)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
|
|
+ rc = semanage_context_set_type(self.sh, con, type)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set type in file context for %s") % target)
|
|
|
|
+
|
|
|
|
+ if serange != "":
|
|
|
|
+ rc = semanage_context_set_mls(self.sh, con, serange)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
|
|
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
|
|
|
|
|
|
semanage_fcontext_set_type(fcontext, file_types[ftype])
|
|
|
|
|
|
|
|
- rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not set file context for %s") % target)
|
|
|
|
-
|
|
|
|
rc = semanage_begin_transaction(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
@@ -1090,13 +1149,15 @@
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not add file context for %s") % target)
|
|
|
|
|
|
|
|
- semanage_context_free(con)
|
|
|
|
+ if type != "<<none>>":
|
|
|
|
+ semanage_context_free(con)
|
|
|
|
semanage_fcontext_key_free(k)
|
|
|
|
semanage_fcontext_free(fcontext)
|
|
|
|
|
|
|
|
def modify(self, target, setype, ftype, serange, seuser):
|
|
|
|
if serange == "" and setype == "" and seuser == "":
|
|
|
|
raise ValueError(_("Requires setype, serange or seuser"))
|
|
|
|
+ self.validate(target)
|
|
|
|
|
|
|
|
(rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
if rc < 0:
|
|
|
|
@@ -1112,16 +1173,29 @@
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not query file context for %s") % target)
|
|
|
|
|
|
|
|
- con = semanage_fcontext_get_con(fcontext)
|
|
|
|
+ if setype != "<<none>>":
|
|
|
|
+ con = semanage_fcontext_get_con(fcontext)
|
|
|
|
|
|
|
|
- if serange != "":
|
|
|
|
- semanage_context_set_mls(self.sh, con, untranslate(serange))
|
|
|
|
- if seuser != "":
|
|
|
|
- semanage_context_set_user(self.sh, con, seuser)
|
|
|
|
- if setype != "":
|
|
|
|
- semanage_context_set_type(self.sh, con, setype)
|
|
|
|
-
|
|
|
|
- rc = semanage_begin_transaction(self.sh)
|
|
|
|
+ if con == None:
|
|
|
|
+ con = self.createcon(target)
|
|
|
|
+
|
|
|
|
+ if serange != "":
|
|
|
|
+ semanage_context_set_mls(self.sh, con, untranslate(serange))
|
|
|
|
+ if seuser != "":
|
|
|
|
+ semanage_context_set_user(self.sh, con, seuser)
|
|
|
|
+
|
|
|
|
+ if setype != "":
|
|
|
|
+ semanage_context_set_type(self.sh, con, setype)
|
|
|
|
+
|
|
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
|
|
+ else:
|
|
|
|
+ rc = semanage_fcontext_set_con(self.sh, fcontext, None)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not set file context for %s") % target)
|
|
|
|
+
|
|
|
|
+ rc = semanage_begin_transaction(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
|
|
|
|
@@ -1136,6 +1210,32 @@
|
|
|
|
semanage_fcontext_key_free(k)
|
|
|
|
semanage_fcontext_free(fcontext)
|
|
|
|
|
|
|
|
+ def deleteall(self):
|
|
|
|
+ (rc, flist) = semanage_fcontext_list_local(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list the file contexts"))
|
|
|
|
+
|
|
|
|
+ rc = semanage_begin_transaction(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
+
|
|
|
|
+ for fcontext in flist:
|
|
|
|
+ target = semanage_fcontext_get_expr(fcontext)
|
|
|
|
+ ftype = semanage_fcontext_get_type(fcontext)
|
|
|
|
+ ftype_str = semanage_fcontext_get_type_str(ftype)
|
|
|
|
+ (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str])
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not create a key for %s") % target)
|
|
|
|
+
|
|
|
|
+ rc = semanage_fcontext_del_local(self.sh, k)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete the file context %s") % target)
|
|
|
|
+ semanage_fcontext_key_free(k)
|
|
|
|
+
|
|
|
|
+ rc = semanage_commit(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete the file context %s") % target)
|
|
|
|
+
|
|
|
|
def delete(self, target, ftype):
|
|
|
|
(rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
|
|
|
if rc < 0:
|
|
|
|
@@ -1167,17 +1267,20 @@
|
|
|
|
|
|
|
|
semanage_fcontext_key_free(k)
|
|
|
|
|
|
|
|
- def get_all(self):
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
l = []
|
|
|
|
- (rc, self.flist) = semanage_fcontext_list(self.sh)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not list file contexts"))
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.flist) = semanage_fcontext_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.flist) = semanage_fcontext_list(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list file contexts"))
|
|
|
|
+
|
|
|
|
+ (rc, fclocal) = semanage_fcontext_list_local(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list local file contexts"))
|
|
|
|
|
|
|
|
- (rc, fclocal) = semanage_fcontext_list_local(self.sh)
|
|
|
|
- if rc < 0:
|
|
|
|
- raise ValueError(_("Could not list local file contexts"))
|
|
|
|
-
|
|
|
|
- self.flist += fclocal
|
|
|
|
+ self.flist += fclocal
|
|
|
|
|
|
|
|
for fcontext in self.flist:
|
|
|
|
expr = semanage_fcontext_get_expr(fcontext)
|
|
|
|
@@ -1191,10 +1294,10 @@
|
|
|
|
|
|
|
|
return l
|
|
|
|
|
|
|
|
- def list(self, heading = 1):
|
|
|
|
+ def list(self, heading = 1, locallist = 0 ):
|
|
|
|
if heading:
|
|
|
|
print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
|
|
|
|
- fcon_list = self.get_all()
|
|
|
|
+ fcon_list = self.get_all(locallist)
|
|
|
|
for fcon in fcon_list:
|
|
|
|
if len(fcon) > 3:
|
|
|
|
if is_mls_enabled:
|
|
|
|
@@ -1205,9 +1308,9 @@
|
|
|
|
print "%-50s %-18s <<None>>" % (fcon[0], fcon[1])
|
|
|
|
|
|
|
|
class booleanRecords(semanageRecords):
|
|
|
|
- def __init__(self):
|
|
|
|
- semanageRecords.__init__(self)
|
|
|
|
-
|
|
|
|
+ def __init__(self, store = ""):
|
|
|
|
+ semanageRecords.__init__(self, store)
|
|
|
|
+
|
|
|
|
def modify(self, name, value = ""):
|
|
|
|
if value == "":
|
|
|
|
raise ValueError(_("Requires value"))
|
|
|
|
@@ -1266,34 +1369,62 @@
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
|
|
|
|
- rc = semanage_fcontext_del_local(self.sh, k)
|
|
|
|
+ rc = semanage_bool_del_local(self.sh, k)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not delete boolean %s") % name)
|
|
|
|
|
|
|
|
rc = semanage_commit(self.sh)
|
|
|
|
if rc < 0:
|
|
|
|
raise ValueError(_("Could not delete boolean %s") % name)
|
|
|
|
-
|
|
|
|
semanage_bool_key_free(k)
|
|
|
|
|
|
|
|
- def get_all(self):
|
|
|
|
+ def deleteall(self):
|
|
|
|
+ (rc, self.blist) = semanage_bool_list_local(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not list booleans"))
|
|
|
|
+
|
|
|
|
+ rc = semanage_begin_transaction(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not start semanage transaction"))
|
|
|
|
+
|
|
|
|
+ for boolean in self.blist:
|
|
|
|
+ name = semanage_bool_get_name(boolean)
|
|
|
|
+ (rc,k) = semanage_bool_key_create(self.sh, name)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not create a key for %s") % name)
|
|
|
|
+
|
|
|
|
+ rc = semanage_bool_del_local(self.sh, k)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete boolean %s") % name)
|
|
|
|
+ semanage_bool_key_free(k)
|
|
|
|
+
|
|
|
|
+ rc = semanage_commit(self.sh)
|
|
|
|
+ if rc < 0:
|
|
|
|
+ raise ValueError(_("Could not delete boolean %s") % name)
|
|
|
|
+ def get_all(self, locallist = 0):
|
|
|
|
ddict = {}
|
|
|
|
- (rc, self.blist) = semanage_bool_list(self.sh)
|
|
|
|
+ if locallist:
|
|
|
|
+ (rc, self.blist) = semanage_bool_list_local(self.sh)
|
|
|
|
+ else:
|
|
|
|
+ (rc, self.blist) = semanage_bool_list(self.sh)
|
|
|
|
if rc < 0:
|
2007-03-13 00:48:19 +00:00
|
|
|
raise ValueError(_("Could not list booleans"))
|
|
|
|
|
|
|
|
for boolean in self.blist:
|
|
|
|
- name = semanage_bool_get_name(boolean)
|
|
|
|
- value = semanage_bool_get_value(boolean)
|
|
|
|
- ddict[name] = value
|
|
|
|
+ value = []
|
|
|
|
+ name = semanage_bool_get_name(boolean)
|
2007-10-31 11:12:23 +00:00
|
|
|
+ value.append(semanage_bool_get_value(boolean))
|
|
|
|
+ value.append(selinux.security_get_boolean_pending(name))
|
|
|
|
+ value.append(selinux.security_get_boolean_active(name))
|
2007-03-13 00:48:19 +00:00
|
|
|
+ ddict[name] = value
|
|
|
|
|
|
|
|
return ddict
|
|
|
|
|
2007-10-31 11:12:23 +00:00
|
|
|
- def list(self, heading = 1):
|
|
|
|
+ def list(self, heading = 1, locallist = 0):
|
|
|
|
if heading:
|
|
|
|
- print "%-50s %-18s\n" % (_("SELinux boolean"), _("value"))
|
|
|
|
- ddict = self.get_all()
|
|
|
|
+ print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") )
|
|
|
|
+ ddict = self.get_all(locallist)
|
|
|
|
keys = ddict.keys()
|
|
|
|
for k in keys:
|
|
|
|
if ddict[k]:
|
|
|
|
- print "%-50s %-18s " % (k[0], ddict[k][0])
|
|
|
|
+ print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2])
|
2007-06-13 13:15:00 +00:00
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setsebool/setsebool.c policycoreutils-2.0.16/setsebool/setsebool.c
|
|
|
|
--- nsapolicycoreutils/setsebool/setsebool.c 2007-05-04 09:14:48.000000000 -0400
|
2007-09-18 18:25:11 +00:00
|
|
|
+++ policycoreutils-2.0.16/setsebool/setsebool.c 2007-09-18 14:18:45.000000000 -0400
|
2007-06-13 13:15:00 +00:00
|
|
|
@@ -160,6 +160,8 @@
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
semanage_disconnect(handle);
|
|
|
|
+ semanage_handle_destroy(handle);
|
|
|
|
+ return 0;
|
|
|
|
|
|
|
|
err:
|
|
|
|
semanage_bool_key_free(bool_key);
|