From b0592a727fb4ef85eafb68d2c61b70e12b35cbe6 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Thu, 7 Aug 2008 20:04:12 +0000 Subject: [PATCH] * Thu Aug 7 2008 Dan Walsh 2.0.54-4 - Fixes for multiple transactions --- policycoreutils-rhat.patch | 478 ++++++++++++++++++++++++++++--------- policycoreutils.spec | 4 +- 2 files changed, 361 insertions(+), 121 deletions(-) diff --git a/policycoreutils-rhat.patch b/policycoreutils-rhat.patch index 27ff460..43888dd 100644 --- a/policycoreutils-rhat.patch +++ b/policycoreutils-rhat.patch @@ -1,4 +1,4 @@ -diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile +diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile --- nsapolicycoreutils/Makefile 2008-08-05 09:58:35.000000000 -0400 +++ policycoreutils-2.0.54/Makefile 2008-08-06 18:05:28.000000000 -0400 @@ -1,4 +1,4 @@ @@ -7,7 +7,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) -diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf +diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf --- nsapolicycoreutils/restorecond/restorecond.conf 2008-08-05 09:58:27.000000000 -0400 +++ policycoreutils-2.0.54/restorecond/restorecond.conf 2008-08-06 18:05:28.000000000 -0400 @@ -1,3 +1,4 @@ @@ -15,7 +15,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl /etc/resolv.conf /etc/samba/secrets.tdb /etc/mtab -diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage +diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage --- nsapolicycoreutils/semanage/semanage 2008-08-05 09:58:26.000000000 -0400 +++ policycoreutils-2.0.54/semanage/semanage 2008-08-07 08:18:35.000000000 -0400 @@ -20,7 +20,7 @@ @@ -326,9 +326,9 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl errorExit(error.args[1]) - except KeyboardInterrupt, error: - sys.exit(0) -diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py +diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2008-08-05 09:58:26.000000000 -0400 -+++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-06 18:07:21.000000000 -0400 ++++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-07 10:57:22.000000000 -0400 @@ -26,7 +26,6 @@ PROGNAME="policycoreutils" import sepolgen.module as module @@ -401,17 +401,18 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl - if not self.semanaged: - semanage_handle_destroy(self.sh) - raise ValueError(_("SELinux policy is not managed or store cannot be accessed.")) +- +- rc = semanage_access_check(self.sh) +- if rc < SEMANAGE_CAN_READ: +- semanage_handle_destroy(self.sh) +- raise ValueError(_("Cannot read policy store.")) + if handle != None: + self.transaction = True + self.sh = handle + else: + self.sh=get_handle(store) + self.transaction = False - -- rc = semanage_access_check(self.sh) -- if rc < SEMANAGE_CAN_READ: -- semanage_handle_destroy(self.sh) -- raise ValueError(_("Cannot read policy store.")) ++ + def deleteall(self): + raise ValueError(_("Not yet implemented")) @@ -420,15 +421,15 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl + if self.transaction: + return + rc = semanage_begin_transaction(self.sh) - if rc < 0: -- semanage_handle_destroy(self.sh) -- raise ValueError(_("Could not establish semanage connection")) ++ if rc < 0: + raise ValueError(_("Could not start semanage transaction")) + def commit(self): + if self.transaction: + return + rc = semanage_commit(self.sh) -+ if rc < 0: + if rc < 0: +- semanage_handle_destroy(self.sh) +- raise ValueError(_("Could not establish semanage connection")) + raise ValueError(_("Could not commit semanage transaction")) + +class permissiveRecords(semanageRecords): @@ -450,13 +451,21 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl for root, dirs, files in os.walk("tmp", topdown=False): for name in files: os.remove(os.path.join(root, name)) -@@ -335,9 +364,8 @@ - rc = semanage_module_remove(self.sh, "permissive_%s" % n) - if rc < 0: - raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name) +@@ -331,13 +360,12 @@ + os.rmdir(os.path.join(root, name)) + + def delete(self, name): +- for n in name.split(): +- rc = semanage_module_remove(self.sh, "permissive_%s" % n) +- if rc < 0: +- raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name) - rc = semanage_commit(self.sh) - if rc < 0: - raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name) ++ for n in name.split(): ++ rc = semanage_module_remove(self.sh, "permissive_%s" % n) ++ if rc < 0: ++ raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name) + + self.commit() @@ -511,7 +520,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl (rc,k) = semanage_seuser_key_create(self.sh, name) if rc < 0: raise ValueError(_("Could not create a key for %s") % name) -@@ -425,30 +424,26 @@ +@@ -425,115 +424,108 @@ if rc < 0: raise ValueError(_("Could not set SELinux user for %s") % name) @@ -547,74 +556,140 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl - oldsename = "" - oldserange = "" - try: +- if sename == "" and serange == "": +- raise ValueError(_("Requires seuser or serange")) + def __modify(self, name, sename = "", serange = ""): - if sename == "" and serange == "": - raise ValueError(_("Requires seuser or serange")) ++ if sename == "" and serange == "": ++ raise ValueError(_("Requires seuser or serange")) -@@ -477,28 +472,27 @@ - else: - sename = oldsename +- (rc,k) = semanage_seuser_key_create(self.sh, name) +- if rc < 0: +- raise ValueError(_("Could not create a key for %s") % name) ++ (rc,k) = semanage_seuser_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) + +- (rc,exists) = semanage_seuser_exists(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if login mapping for %s is defined") % name) +- if not exists: +- raise ValueError(_("Login mapping for %s is not defined") % name) ++ (rc,exists) = semanage_seuser_exists(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if login mapping for %s is defined") % name) ++ if not exists: ++ raise ValueError(_("Login mapping for %s is not defined") % name) + +- (rc,u) = semanage_seuser_query(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not query seuser for %s") % name) ++ (rc,u) = semanage_seuser_query(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not query seuser for %s") % name) + +- oldserange = semanage_seuser_get_mlsrange(u) +- oldsename = semanage_seuser_get_sename(u) +- if serange != "": +- semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange)) +- else: +- serange = oldserange +- if sename != "": +- semanage_seuser_set_sename(self.sh, u, sename) +- else: +- sename = oldsename ++ oldserange = semanage_seuser_get_mlsrange(u) ++ oldsename = semanage_seuser_get_sename(u) ++ if serange != "": ++ semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange)) ++ else: ++ serange = oldserange - rc = semanage_begin_transaction(self.sh) - if rc < 0: - raise ValueError(_("Could not start semanage transaction")) -- - rc = semanage_seuser_modify_local(self.sh, k, u) - if rc < 0: - raise ValueError(_("Could not modify login mapping for %s") % name) ++ if sename != "": ++ semanage_seuser_set_sename(self.sh, u, sename) ++ else: ++ sename = oldsename + +- rc = semanage_seuser_modify_local(self.sh, k, u) +- if rc < 0: +- raise ValueError(_("Could not modify login mapping for %s") % name) ++ rc = semanage_seuser_modify_local(self.sh, k, u) ++ if rc < 0: ++ raise ValueError(_("Could not modify login mapping for %s") % name) - rc = semanage_commit(self.sh) - if rc < 0: - raise ValueError(_("Could not modify login mapping for %s") % name) -- ++ semanage_seuser_key_free(k) ++ semanage_seuser_free(u) + - except ValueError, error: - mylog.log(0,"modify selinux user mapping", name, sename,"", serange, oldsename, "", oldserange); - raise error - - mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); - semanage_seuser_key_free(k) - semanage_seuser_free(u) +- semanage_seuser_key_free(k) +- semanage_seuser_free(u) ++ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); - def delete(self, name): -+ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); -+ -+ + def modify(self, name, sename = "", serange = ""): try: +- (rc,k) = semanage_seuser_key_create(self.sh, name) +- if rc < 0: +- raise ValueError(_("Could not create a key for %s") % name) + self.begin() + self.__modify(name, sename, serange) + self.commit() -+ + +- (rc,exists) = semanage_seuser_exists(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if login mapping for %s is defined") % name) +- if not exists: +- raise ValueError(_("Login mapping for %s is not defined") % name) + except ValueError, error: + mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", ""); + raise error + + def __delete(self, name): - (rc,k) = semanage_seuser_key_create(self.sh, name) - if rc < 0: - raise ValueError(_("Could not create a key for %s") % name) -@@ -515,12 +509,7 @@ - if not exists: - raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name) ++ (rc,k) = semanage_seuser_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) + +- (rc,exists) = semanage_seuser_exists_local(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if login mapping for %s is defined") % name) +- if not exists: +- raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name) ++ (rc,exists) = semanage_seuser_exists(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if login mapping for %s is defined") % name) ++ if not exists: ++ raise ValueError(_("Login mapping for %s is not defined") % name) - rc = semanage_begin_transaction(self.sh) - if rc < 0: - raise ValueError(_("Could not start semanage transaction")) -- - rc = semanage_seuser_del_local(self.sh, k) -- - if rc < 0: - raise ValueError(_("Could not delete login mapping for %s") % name) ++ (rc,exists) = semanage_seuser_exists_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if login mapping for %s is defined") % name) ++ if not exists: ++ raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name) -@@ -524,16 +513,19 @@ - if rc < 0: - raise ValueError(_("Could not delete login mapping for %s") % name) +- rc = semanage_seuser_del_local(self.sh, k) ++ rc = semanage_seuser_del_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not delete login mapping for %s") % name) + +- if rc < 0: +- raise ValueError(_("Could not delete login mapping for %s") % name) ++ semanage_seuser_key_free(k) - rc = semanage_commit(self.sh) - if rc < 0: - raise ValueError(_("Could not delete login mapping for %s") % name) -+ semanage_seuser_key_free(k) -+ + def delete(self, name): + try: + self.begin() @@ -639,29 +714,94 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if is_mls_enabled == 1: if serange == "": serange = "s0" -@@ -580,8 +572,9 @@ +@@ -580,170 +572,167 @@ else: selevel = untranslate(selevel) - seroles = " ".join(roles) - try: +- (rc,k) = semanage_user_key_create(self.sh, name) +- if rc < 0: +- raise ValueError(_("Could not create a key for %s") % name) +- +- (rc,exists) = semanage_user_exists(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if SELinux user %s is defined") % name) +- if exists: +- raise ValueError(_("SELinux user %s is already defined") % name) + if len(roles) < 1: + raise ValueError(_("You must add at least one role for %s") % name) + - (rc,k) = semanage_user_key_create(self.sh, name) - if rc < 0: - raise ValueError(_("Could not create a key for %s") % name) -@@ -620,31 +613,29 @@ - if rc < 0: - raise ValueError(_("Could not extract key for %s") % name) ++ (rc,k) = semanage_user_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) + +- (rc,u) = semanage_user_create(self.sh) +- if rc < 0: +- raise ValueError(_("Could not create SELinux user for %s") % name) ++ (rc,exists) = semanage_user_exists(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if SELinux user %s is defined") % name) ++ if exists: ++ raise ValueError(_("SELinux user %s is already defined") % name) + +- rc = semanage_user_set_name(self.sh, u, name) +- if rc < 0: +- raise ValueError(_("Could not set name for %s") % name) ++ (rc,u) = semanage_user_create(self.sh) ++ if rc < 0: ++ raise ValueError(_("Could not create SELinux user for %s") % name) + +- for r in roles: +- rc = semanage_user_add_role(self.sh, u, r) +- if rc < 0: +- raise ValueError(_("Could not add role %s for %s") % (r, name)) ++ rc = semanage_user_set_name(self.sh, u, name) ++ if rc < 0: ++ raise ValueError(_("Could not set name for %s") % name) + +- if is_mls_enabled == 1: +- rc = semanage_user_set_mlsrange(self.sh, u, serange) +- if rc < 0: +- raise ValueError(_("Could not set MLS range for %s") % name) ++ for r in roles: ++ rc = semanage_user_add_role(self.sh, u, r) ++ if rc < 0: ++ raise ValueError(_("Could not add role %s for %s") % (r, name)) + +- rc = semanage_user_set_mlslevel(self.sh, u, selevel) +- if rc < 0: +- raise ValueError(_("Could not set MLS level for %s") % name) +- rc = semanage_user_set_prefix(self.sh, u, prefix) +- if rc < 0: +- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix)) +- (rc,key) = semanage_user_key_extract(self.sh,u) +- if rc < 0: +- raise ValueError(_("Could not extract key for %s") % name) ++ if is_mls_enabled == 1: ++ rc = semanage_user_set_mlsrange(self.sh, u, serange) ++ if rc < 0: ++ raise ValueError(_("Could not set MLS range for %s") % name) - rc = semanage_begin_transaction(self.sh) - if rc < 0: - raise ValueError(_("Could not start semanage transaction")) -- - rc = semanage_user_modify_local(self.sh, k, u) - if rc < 0: - raise ValueError(_("Could not add SELinux user %s") % name) ++ rc = semanage_user_set_mlslevel(self.sh, u, selevel) ++ if rc < 0: ++ raise ValueError(_("Could not set MLS level for %s") % name) ++ rc = semanage_user_set_prefix(self.sh, u, prefix) ++ if rc < 0: ++ raise ValueError(_("Could not add prefix %s for %s") % (r, prefix)) ++ (rc,key) = semanage_user_key_extract(self.sh,u) ++ if rc < 0: ++ raise ValueError(_("Could not extract key for %s") % name) + +- rc = semanage_user_modify_local(self.sh, k, u) +- if rc < 0: +- raise ValueError(_("Could not add SELinux user %s") % name) ++ rc = semanage_user_modify_local(self.sh, k, u) ++ if rc < 0: ++ raise ValueError(_("Could not add SELinux user %s") % name) - rc = semanage_commit(self.sh) - if rc < 0: @@ -689,64 +829,161 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl oldserange = "" newroles = string.join(roles, ' '); - try: - if prefix == "" and len(roles) == 0 and serange == "" and selevel == "": - if is_mls_enabled == 1: - raise ValueError(_("Requires prefix, roles, level or range")) -@@ -688,29 +677,27 @@ - if r not in rlist: - semanage_user_add_role(self.sh, u, r) +- if prefix == "" and len(roles) == 0 and serange == "" and selevel == "": +- if is_mls_enabled == 1: +- raise ValueError(_("Requires prefix, roles, level or range")) +- else: +- raise ValueError(_("Requires prefix or roles")) ++ if prefix == "" and len(roles) == 0 and serange == "" and selevel == "": ++ if is_mls_enabled == 1: ++ raise ValueError(_("Requires prefix, roles, level or range")) ++ else: ++ raise ValueError(_("Requires prefix or roles")) + +- (rc,k) = semanage_user_key_create(self.sh, name) +- if rc < 0: +- raise ValueError(_("Could not create a key for %s") % name) ++ (rc,k) = semanage_user_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) + +- (rc,exists) = semanage_user_exists(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if SELinux user %s is defined") % name) +- if not exists: +- raise ValueError(_("SELinux user %s is not defined") % name) ++ (rc,exists) = semanage_user_exists(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if SELinux user %s is defined") % name) ++ if not exists: ++ raise ValueError(_("SELinux user %s is not defined") % name) + +- (rc,u) = semanage_user_query(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not query user for %s") % name) ++ (rc,u) = semanage_user_query(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not query user for %s") % name) + +- oldserange = semanage_user_get_mlsrange(u) +- (rc, rlist) = semanage_user_get_roles(self.sh, u) +- if rc >= 0: +- oldroles = string.join(rlist, ' '); +- newroles = newroles + ' ' + oldroles; ++ oldserange = semanage_user_get_mlsrange(u) ++ (rc, rlist) = semanage_user_get_roles(self.sh, u) ++ if rc >= 0: ++ oldroles = string.join(rlist, ' '); ++ newroles = newroles + ' ' + oldroles; ++ ++ ++ if serange != "": ++ semanage_user_set_mlsrange(self.sh, u, untranslate(serange)) ++ if selevel != "": ++ semanage_user_set_mlslevel(self.sh, u, untranslate(selevel)) ++ ++ if prefix != "": ++ semanage_user_set_prefix(self.sh, u, prefix) ++ ++ if len(roles) != 0: ++ for r in rlist: ++ if r not in roles: ++ semanage_user_del_role(u, r) ++ for r in roles: ++ if r not in rlist: ++ semanage_user_add_role(self.sh, u, r) + ++ rc = semanage_user_modify_local(self.sh, k, u) ++ if rc < 0: ++ raise ValueError(_("Could not modify SELinux user %s") % name) + +- if serange != "": +- semanage_user_set_mlsrange(self.sh, u, untranslate(serange)) +- if selevel != "": +- semanage_user_set_mlslevel(self.sh, u, untranslate(selevel)) +- +- if prefix != "": +- semanage_user_set_prefix(self.sh, u, prefix) +- +- if len(roles) != 0: +- for r in rlist: +- if r not in roles: +- semanage_user_del_role(u, r) +- for r in roles: +- if r not in rlist: +- semanage_user_add_role(self.sh, u, r) ++ semanage_user_key_free(k) ++ semanage_user_free(u) ++ ++ mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) - rc = semanage_begin_transaction(self.sh) - if rc < 0: - raise ValueError(_("Could not start semanage transaction")) -- - rc = semanage_user_modify_local(self.sh, k, u) - if rc < 0: - raise ValueError(_("Could not modify SELinux user %s") % name) -- rc = semanage_commit(self.sh) +- rc = semanage_user_modify_local(self.sh, k, u) - if rc < 0: - raise ValueError(_("Could not modify SELinux user %s") % name) - -- except ValueError, error: -- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) -- raise error -+ semanage_user_key_free(k) -+ semanage_user_free(u) - - mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) +- rc = semanage_commit(self.sh) +- if rc < 0: +- raise ValueError(_("Could not modify SELinux user %s") % name) ++ def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""): ++ try: ++ self.begin() ++ self.__modify(name, roles, selevel, serange, prefix) ++ self.commit() + except ValueError, error: +- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) ++ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "") + raise error +- +- mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) +- - semanage_user_key_free(k) - semanage_user_free(u) - def delete(self, name): -+ def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""): - try: -+ self.begin() -+ self.__modify(name, roles, selevel, serange, prefix) -+ self.commit() -+ -+ except ValueError, error: -+ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "") -+ raise error -+ +- try: +- (rc,k) = semanage_user_key_create(self.sh, name) +- if rc < 0: +- raise ValueError(_("Could not create a key for %s") % name) + def __delete(self, name): - (rc,k) = semanage_user_key_create(self.sh, name) - if rc < 0: - raise ValueError(_("Could not create a key for %s") % name) -@@ -727,23 +714,23 @@ - if not exists: - raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name) ++ (rc,k) = semanage_user_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) + +- (rc,exists) = semanage_user_exists(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if SELinux user %s is defined") % name) +- if not exists: +- raise ValueError(_("SELinux user %s is not defined") % name) ++ (rc,exists) = semanage_user_exists(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if SELinux user %s is defined") % name) ++ if not exists: ++ raise ValueError(_("SELinux user %s is not defined") % name) + +- (rc,exists) = semanage_user_exists_local(self.sh, k) +- if rc < 0: +- raise ValueError(_("Could not check if SELinux user %s is defined") % name) +- if not exists: +- raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name) ++ (rc,exists) = semanage_user_exists_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if SELinux user %s is defined") % name) ++ if not exists: ++ raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name) - rc = semanage_begin_transaction(self.sh) - if rc < 0: - raise ValueError(_("Could not start semanage transaction")) -- - rc = semanage_user_del_local(self.sh, k) - if rc < 0: - raise ValueError(_("Could not delete SELinux user %s") % name) ++ rc = semanage_user_del_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not delete SELinux user %s") % name) -- rc = semanage_commit(self.sh) +- rc = semanage_user_del_local(self.sh, k) - if rc < 0: - raise ValueError(_("Could not delete SELinux user %s") % name) + semanage_user_key_free(k) @@ -756,7 +993,10 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl + self.begin() + self.__delete(name) + self.commit() -+ + +- rc = semanage_commit(self.sh) +- if rc < 0: +- raise ValueError(_("Could not delete SELinux user %s") % name) except ValueError, error: mylog.log(0,"delete SELinux user record", name) raise error @@ -766,7 +1006,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl def get_all(self, locallist = 0): ddict = {} -@@ -808,7 +795,7 @@ +@@ -808,7 +797,7 @@ raise ValueError(_("Could not create a key for %s/%s") % (proto, port)) return ( k, proto_d, low, high ) @@ -775,7 +1015,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if is_mls_enabled == 1: if serange == "": serange = "s0" -@@ -857,23 +844,20 @@ +@@ -857,23 +846,20 @@ if rc < 0: raise ValueError(_("Could not set port context for %s/%s") % (proto, port)) @@ -805,7 +1045,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if serange == "" and setype == "": if is_mls_enabled == 1: raise ValueError(_("Requires setype or serange")) -@@ -899,29 +883,24 @@ +@@ -899,29 +885,24 @@ if setype != "": semanage_context_set_type(self.sh, con, setype) @@ -841,7 +1081,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl for port in plist: proto = semanage_port_get_proto(port) -@@ -938,11 +917,9 @@ +@@ -938,11 +919,9 @@ raise ValueError(_("Could not delete the port %s") % port_str) semanage_port_key_free(k) @@ -855,7 +1095,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl ( k, proto_d, low, high ) = self.__genkey(port, proto) (rc,exists) = semanage_port_exists(self.sh, k) if rc < 0: -@@ -956,20 +933,17 @@ +@@ -956,20 +935,17 @@ if not exists: raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port)) @@ -881,7 +1121,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl def get_all(self, locallist = 0): ddict = {} if locallist: -@@ -1035,7 +1009,7 @@ +@@ -1035,7 +1011,7 @@ def __init__(self, store = ""): semanageRecords.__init__(self, store) @@ -890,7 +1130,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if is_mls_enabled == 1: if serange == "": serange = "s0" -@@ -1089,23 +1063,20 @@ +@@ -1089,23 +1065,20 @@ if rc < 0: raise ValueError(_("Could not set message context for %s") % interface) @@ -920,7 +1160,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if serange == "" and setype == "": raise ValueError(_("Requires setype or serange")) -@@ -1130,22 +1101,19 @@ +@@ -1130,22 +1103,19 @@ if setype != "": semanage_context_set_type(self.sh, con, setype) @@ -949,7 +1189,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl (rc,k) = semanage_iface_key_create(self.sh, interface) if rc < 0: raise ValueError(_("Could not create key for %s") % interface) -@@ -1162,20 +1130,17 @@ +@@ -1162,20 +1132,17 @@ if not exists: raise ValueError(_("Interface %s is defined in policy, cannot be deleted") % interface) @@ -975,7 +1215,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl def get_all(self, locallist = 0): ddict = {} if locallist: -@@ -1234,7 +1199,7 @@ +@@ -1234,7 +1201,7 @@ if target == "" or target.find("\n") >= 0: raise ValueError(_("Invalid file specification")) @@ -984,7 +1224,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl self.validate(target) if is_mls_enabled == 1: -@@ -1275,24 +1240,22 @@ +@@ -1275,24 +1242,22 @@ semanage_fcontext_set_type(fcontext, file_types[ftype]) @@ -1016,7 +1256,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if serange == "" and setype == "" and seuser == "": raise ValueError(_("Requires setype, serange or seuser")) self.validate(target) -@@ -1333,29 +1296,25 @@ +@@ -1333,29 +1298,25 @@ if rc < 0: raise ValueError(_("Could not set file context for %s") % target) @@ -1053,7 +1293,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl for fcontext in flist: target = semanage_fcontext_get_expr(fcontext) -@@ -1370,11 +1329,9 @@ +@@ -1370,11 +1331,9 @@ raise ValueError(_("Could not delete the file context %s") % target) semanage_fcontext_key_free(k) @@ -1067,7 +1307,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: raise ValueError(_("Could not create a key for %s") % target) -@@ -1391,20 +1348,17 @@ +@@ -1391,20 +1350,17 @@ else: raise ValueError(_("File context for %s is not defined") % target) @@ -1093,7 +1333,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl def get_all(self, locallist = 0): l = [] if locallist: -@@ -1486,9 +1440,8 @@ +@@ -1486,9 +1442,8 @@ def modify(self, name, value=None, use_file=False): @@ -1105,7 +1345,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl if use_file: fd = open(name) for b in fd.read().split("\n"): -@@ -1498,18 +1451,16 @@ +@@ -1498,18 +1453,16 @@ try: boolname, val = b.split("=") @@ -1127,7 +1367,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl (rc,k) = semanage_bool_key_create(self.sh, name) if rc < 0: -@@ -1526,42 +1477,30 @@ +@@ -1526,42 +1479,30 @@ if not exists: raise ValueError(_("Boolean %s is defined in policy, cannot be deleted") % name) diff --git a/policycoreutils.spec b/policycoreutils.spec index 6bb7957..d6e6a2b 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -6,7 +6,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 2.0.54 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ Group: System Environment/Base Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz @@ -192,7 +192,7 @@ if [ "$1" -ge "1" ]; then fi %changelog -* Thu Aug 7 2008 Dan Walsh 2.0.54-3 +* Thu Aug 7 2008 Dan Walsh 2.0.54-4 - Fixes for multiple transactions * Wed Aug 6 2008 Dan Walsh 2.0.54-2