rpms
/
policycoreutils
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-4 

- Fixes for multiple transactions
This commit is contained in:
Daniel J Walsh 2008-08-07 20:04:12 +00:00
parent c7da14e85c
commit b0592a727f
2 changed files with 361 additions and 121 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

478
policycoreutils-rhat.patch
View File

@ -1,4 +1,4 @@
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.54/Makefile
--- nsapolicycoreutils/Makefile 2008-08-05 09:58:35.000000000 -0400 --- nsapolicycoreutils/Makefile 2008-08-05 09:58:35.000000000 -0400
+++ policycoreutils-2.0.54/Makefile 2008-08-06 18:05:28.000000000 -0400 +++ policycoreutils-2.0.54/Makefile 2008-08-06 18:05:28.000000000 -0400
@@ -1,4 +1,4 @@ @@ -1,4 +1,4 @@
@ -7,7 +7,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.54/restorecond/restorecond.conf
--- nsapolicycoreutils/restorecond/restorecond.conf 2008-08-05 09:58:27.000000000 -0400 --- nsapolicycoreutils/restorecond/restorecond.conf 2008-08-05 09:58:27.000000000 -0400
+++ policycoreutils-2.0.54/restorecond/restorecond.conf 2008-08-06 18:05:28.000000000 -0400 +++ policycoreutils-2.0.54/restorecond/restorecond.conf 2008-08-06 18:05:28.000000000 -0400
@@ -1,3 +1,4 @@ @@ -1,3 +1,4 @@
@ -15,7 +15,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
/etc/resolv.conf /etc/resolv.conf
/etc/samba/secrets.tdb /etc/samba/secrets.tdb
/etc/mtab /etc/mtab
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.54/semanage/semanage
--- nsapolicycoreutils/semanage/semanage 2008-08-05 09:58:26.000000000 -0400 --- nsapolicycoreutils/semanage/semanage 2008-08-05 09:58:26.000000000 -0400
+++ policycoreutils-2.0.54/semanage/semanage 2008-08-07 08:18:35.000000000 -0400 +++ policycoreutils-2.0.54/semanage/semanage 2008-08-07 08:18:35.000000000 -0400
@@ -20,7 +20,7 @@ @@ -20,7 +20,7 @@
@ -326,9 +326,9 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
errorExit(error.args[1]) errorExit(error.args[1])
- except KeyboardInterrupt, error: - except KeyboardInterrupt, error:
- sys.exit(0) - sys.exit(0)
diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.54/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py 2008-08-05 09:58:26.000000000 -0400 --- nsapolicycoreutils/semanage/seobject.py 2008-08-05 09:58:26.000000000 -0400
+++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-06 18:07:21.000000000 -0400 +++ policycoreutils-2.0.54/semanage/seobject.py 2008-08-07 10:57:22.000000000 -0400
@@ -26,7 +26,6 @@ @@ -26,7 +26,6 @@
PROGNAME="policycoreutils" PROGNAME="policycoreutils"
import sepolgen.module as module import sepolgen.module as module
@ -401,17 +401,18 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
- if not self.semanaged: - if not self.semanaged:
- semanage_handle_destroy(self.sh) - semanage_handle_destroy(self.sh)
- raise ValueError(_("SELinux policy is not managed or store cannot be accessed.")) - raise ValueError(_("SELinux policy is not managed or store cannot be accessed."))
-
- rc = semanage_access_check(self.sh)
- if rc < SEMANAGE_CAN_READ:
- semanage_handle_destroy(self.sh)
- raise ValueError(_("Cannot read policy store."))
+ if handle != None: + if handle != None:
+ self.transaction = True + self.transaction = True
+ self.sh = handle + self.sh = handle
+ else: + else:
+ self.sh=get_handle(store) + self.sh=get_handle(store)
+ self.transaction = False + self.transaction = False
+
- rc = semanage_access_check(self.sh)
- if rc < SEMANAGE_CAN_READ:
- semanage_handle_destroy(self.sh)
- raise ValueError(_("Cannot read policy store."))
+ def deleteall(self): + def deleteall(self):
+ raise ValueError(_("Not yet implemented")) + raise ValueError(_("Not yet implemented"))
@ -420,15 +421,15 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
+ if self.transaction: + if self.transaction:
+ return + return
+ rc = semanage_begin_transaction(self.sh) + rc = semanage_begin_transaction(self.sh)
if rc < 0: + if rc < 0:
- semanage_handle_destroy(self.sh)
- raise ValueError(_("Could not establish semanage connection"))
+ raise ValueError(_("Could not start semanage transaction")) + raise ValueError(_("Could not start semanage transaction"))
+ def commit(self): + def commit(self):
+ if self.transaction: + if self.transaction:
+ return + return
+ rc = semanage_commit(self.sh) + rc = semanage_commit(self.sh)
+ if rc < 0: if rc < 0:
- semanage_handle_destroy(self.sh)
- raise ValueError(_("Could not establish semanage connection"))
+ raise ValueError(_("Could not commit semanage transaction")) + raise ValueError(_("Could not commit semanage transaction"))
+ +
+class permissiveRecords(semanageRecords): +class permissiveRecords(semanageRecords):
@ -450,13 +451,21 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
for root, dirs, files in os.walk("tmp", topdown=False): for root, dirs, files in os.walk("tmp", topdown=False):
for name in files: for name in files:
os.remove(os.path.join(root, name)) os.remove(os.path.join(root, name))
@@ -335,9 +364,8 @@ @@ -331,13 +360,12 @@
rc = semanage_module_remove(self.sh, "permissive_%s" % n) os.rmdir(os.path.join(root, name))
if rc < 0:
raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name) def delete(self, name):
- for n in name.split():
- rc = semanage_module_remove(self.sh, "permissive_%s" % n)
- if rc < 0:
- raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
- rc = semanage_commit(self.sh) - rc = semanage_commit(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name) - raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
+ for n in name.split():
+ rc = semanage_module_remove(self.sh, "permissive_%s" % n)
+ if rc < 0:
+ raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
+ +
+ self.commit() + self.commit()
@ -511,7 +520,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
(rc,k) = semanage_seuser_key_create(self.sh, name) (rc,k) = semanage_seuser_key_create(self.sh, name)
if rc < 0: if rc < 0:
raise ValueError(_("Could not create a key for %s") % name) raise ValueError(_("Could not create a key for %s") % name)
@@ -425,30 +424,26 @@ @@ -425,115 +424,108 @@
if rc < 0: if rc < 0:
raise ValueError(_("Could not set SELinux user for %s") % name) raise ValueError(_("Could not set SELinux user for %s") % name)
@ -547,74 +556,140 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
- oldsename = "" - oldsename = ""
- oldserange = "" - oldserange = ""
- try: - try:
- if sename == "" and serange == "":
- raise ValueError(_("Requires seuser or serange"))
+ def __modify(self, name, sename = "", serange = ""): + def __modify(self, name, sename = "", serange = ""):
if sename == "" and serange == "": + if sename == "" and serange == "":
raise ValueError(_("Requires seuser or serange")) + raise ValueError(_("Requires seuser or serange"))
@@ -477,28 +472,27 @@ - (rc,k) = semanage_seuser_key_create(self.sh, name)
else: - if rc < 0:
sename = oldsename - raise ValueError(_("Could not create a key for %s") % name)
+ (rc,k) = semanage_seuser_key_create(self.sh, name)
+ if rc < 0:
+ raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_seuser_exists(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
- if not exists:
- raise ValueError(_("Login mapping for %s is not defined") % name)
+ (rc,exists) = semanage_seuser_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
+ if not exists:
+ raise ValueError(_("Login mapping for %s is not defined") % name)
- (rc,u) = semanage_seuser_query(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not query seuser for %s") % name)
+ (rc,u) = semanage_seuser_query(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not query seuser for %s") % name)
- oldserange = semanage_seuser_get_mlsrange(u)
- oldsename = semanage_seuser_get_sename(u)
- if serange != "":
- semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange))
- else:
- serange = oldserange
- if sename != "":
- semanage_seuser_set_sename(self.sh, u, sename)
- else:
- sename = oldsename
+ oldserange = semanage_seuser_get_mlsrange(u)
+ oldsename = semanage_seuser_get_sename(u)
+ if serange != "":
+ semanage_seuser_set_mlsrange(self.sh, u, untranslate(serange))
+ else:
+ serange = oldserange
- rc = semanage_begin_transaction(self.sh) - rc = semanage_begin_transaction(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not start semanage transaction")) - raise ValueError(_("Could not start semanage transaction"))
- + if sename != "":
rc = semanage_seuser_modify_local(self.sh, k, u) + semanage_seuser_set_sename(self.sh, u, sename)
if rc < 0: + else:
raise ValueError(_("Could not modify login mapping for %s") % name) + sename = oldsename
- rc = semanage_seuser_modify_local(self.sh, k, u)
- if rc < 0:
- raise ValueError(_("Could not modify login mapping for %s") % name)
+ rc = semanage_seuser_modify_local(self.sh, k, u)
+ if rc < 0:
+ raise ValueError(_("Could not modify login mapping for %s") % name)
- rc = semanage_commit(self.sh) - rc = semanage_commit(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not modify login mapping for %s") % name) - raise ValueError(_("Could not modify login mapping for %s") % name)
- + semanage_seuser_key_free(k)
+ semanage_seuser_free(u)
- except ValueError, error: - except ValueError, error:
- mylog.log(0,"modify selinux user mapping", name, sename,"", serange, oldsename, "", oldserange); - mylog.log(0,"modify selinux user mapping", name, sename,"", serange, oldsename, "", oldserange);
- raise error - raise error
- -
- mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange); - mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
semanage_seuser_key_free(k) - semanage_seuser_key_free(k)
semanage_seuser_free(u) - semanage_seuser_free(u)
+ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
- def delete(self, name): - def delete(self, name):
+ mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
+
+
+ def modify(self, name, sename = "", serange = ""): + def modify(self, name, sename = "", serange = ""):
try: try:
- (rc,k) = semanage_seuser_key_create(self.sh, name)
- if rc < 0:
- raise ValueError(_("Could not create a key for %s") % name)
+ self.begin() + self.begin()
+ self.__modify(name, sename, serange) + self.__modify(name, sename, serange)
+ self.commit() + self.commit()
+
- (rc,exists) = semanage_seuser_exists(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
- if not exists:
- raise ValueError(_("Login mapping for %s is not defined") % name)
+ except ValueError, error: + except ValueError, error:
+ mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", ""); + mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", "");
+ raise error + raise error
+ +
+ def __delete(self, name): + def __delete(self, name):
(rc,k) = semanage_seuser_key_create(self.sh, name) + (rc,k) = semanage_seuser_key_create(self.sh, name)
if rc < 0: + if rc < 0:
raise ValueError(_("Could not create a key for %s") % name) + raise ValueError(_("Could not create a key for %s") % name)
@@ -515,12 +509,7 @@
if not exists: - (rc,exists) = semanage_seuser_exists_local(self.sh, k)
raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name) - if rc < 0:
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
- if not exists:
- raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name)
+ (rc,exists) = semanage_seuser_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
+ if not exists:
+ raise ValueError(_("Login mapping for %s is not defined") % name)
- rc = semanage_begin_transaction(self.sh) - rc = semanage_begin_transaction(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not start semanage transaction")) - raise ValueError(_("Could not start semanage transaction"))
- + (rc,exists) = semanage_seuser_exists_local(self.sh, k)
rc = semanage_seuser_del_local(self.sh, k) + if rc < 0:
- + raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if rc < 0: + if not exists:
raise ValueError(_("Could not delete login mapping for %s") % name) + raise ValueError(_("Login mapping for %s is defined in policy, cannot be deleted") % name)
@@ -524,16 +513,19 @@ - rc = semanage_seuser_del_local(self.sh, k)
if rc < 0: + rc = semanage_seuser_del_local(self.sh, k)
raise ValueError(_("Could not delete login mapping for %s") % name) + if rc < 0:
+ raise ValueError(_("Could not delete login mapping for %s") % name)
- if rc < 0:
- raise ValueError(_("Could not delete login mapping for %s") % name)
+ semanage_seuser_key_free(k)
- rc = semanage_commit(self.sh) - rc = semanage_commit(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not delete login mapping for %s") % name) - raise ValueError(_("Could not delete login mapping for %s") % name)
+ semanage_seuser_key_free(k)
+
+ def delete(self, name): + def delete(self, name):
+ try: + try:
+ self.begin() + self.begin()
@ -639,29 +714,94 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if is_mls_enabled == 1: if is_mls_enabled == 1:
if serange == "": if serange == "":
serange = "s0" serange = "s0"
@@ -580,8 +572,9 @@ @@ -580,170 +572,167 @@
else: else:
selevel = untranslate(selevel) selevel = untranslate(selevel)
- seroles = " ".join(roles) - seroles = " ".join(roles)
- try: - try:
- (rc,k) = semanage_user_key_create(self.sh, name)
- if rc < 0:
- raise ValueError(_("Could not create a key for %s") % name)
-
- (rc,exists) = semanage_user_exists(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
- if exists:
- raise ValueError(_("SELinux user %s is already defined") % name)
+ if len(roles) < 1: + if len(roles) < 1:
+ raise ValueError(_("You must add at least one role for %s") % name) + raise ValueError(_("You must add at least one role for %s") % name)
+ +
(rc,k) = semanage_user_key_create(self.sh, name) + (rc,k) = semanage_user_key_create(self.sh, name)
if rc < 0: + if rc < 0:
raise ValueError(_("Could not create a key for %s") % name) + raise ValueError(_("Could not create a key for %s") % name)
@@ -620,31 +613,29 @@
if rc < 0: - (rc,u) = semanage_user_create(self.sh)
raise ValueError(_("Could not extract key for %s") % name) - if rc < 0:
- raise ValueError(_("Could not create SELinux user for %s") % name)
+ (rc,exists) = semanage_user_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
+ if exists:
+ raise ValueError(_("SELinux user %s is already defined") % name)
- rc = semanage_user_set_name(self.sh, u, name)
- if rc < 0:
- raise ValueError(_("Could not set name for %s") % name)
+ (rc,u) = semanage_user_create(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not create SELinux user for %s") % name)
- for r in roles:
- rc = semanage_user_add_role(self.sh, u, r)
- if rc < 0:
- raise ValueError(_("Could not add role %s for %s") % (r, name))
+ rc = semanage_user_set_name(self.sh, u, name)
+ if rc < 0:
+ raise ValueError(_("Could not set name for %s") % name)
- if is_mls_enabled == 1:
- rc = semanage_user_set_mlsrange(self.sh, u, serange)
- if rc < 0:
- raise ValueError(_("Could not set MLS range for %s") % name)
+ for r in roles:
+ rc = semanage_user_add_role(self.sh, u, r)
+ if rc < 0:
+ raise ValueError(_("Could not add role %s for %s") % (r, name))
- rc = semanage_user_set_mlslevel(self.sh, u, selevel)
- if rc < 0:
- raise ValueError(_("Could not set MLS level for %s") % name)
- rc = semanage_user_set_prefix(self.sh, u, prefix)
- if rc < 0:
- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
- (rc,key) = semanage_user_key_extract(self.sh,u)
- if rc < 0:
- raise ValueError(_("Could not extract key for %s") % name)
+ if is_mls_enabled == 1:
+ rc = semanage_user_set_mlsrange(self.sh, u, serange)
+ if rc < 0:
+ raise ValueError(_("Could not set MLS range for %s") % name)
- rc = semanage_begin_transaction(self.sh) - rc = semanage_begin_transaction(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not start semanage transaction")) - raise ValueError(_("Could not start semanage transaction"))
- + rc = semanage_user_set_mlslevel(self.sh, u, selevel)
rc = semanage_user_modify_local(self.sh, k, u) + if rc < 0:
if rc < 0: + raise ValueError(_("Could not set MLS level for %s") % name)
raise ValueError(_("Could not add SELinux user %s") % name) + rc = semanage_user_set_prefix(self.sh, u, prefix)
+ if rc < 0:
+ raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
+ (rc,key) = semanage_user_key_extract(self.sh,u)
+ if rc < 0:
+ raise ValueError(_("Could not extract key for %s") % name)
- rc = semanage_user_modify_local(self.sh, k, u)
- if rc < 0:
- raise ValueError(_("Could not add SELinux user %s") % name)
+ rc = semanage_user_modify_local(self.sh, k, u)
+ if rc < 0:
+ raise ValueError(_("Could not add SELinux user %s") % name)
- rc = semanage_commit(self.sh) - rc = semanage_commit(self.sh)
- if rc < 0: - if rc < 0:
@ -689,64 +829,161 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
oldserange = "" oldserange = ""
newroles = string.join(roles, ' '); newroles = string.join(roles, ' ');
- try: - try:
if prefix == "" and len(roles) == 0 and serange == "" and selevel == "": - if prefix == "" and len(roles) == 0 and serange == "" and selevel == "":
if is_mls_enabled == 1: - if is_mls_enabled == 1:
raise ValueError(_("Requires prefix, roles, level or range")) - raise ValueError(_("Requires prefix, roles, level or range"))
@@ -688,29 +677,27 @@ - else:
if r not in rlist: - raise ValueError(_("Requires prefix or roles"))
semanage_user_add_role(self.sh, u, r) + if prefix == "" and len(roles) == 0 and serange == "" and selevel == "":
+ if is_mls_enabled == 1:
+ raise ValueError(_("Requires prefix, roles, level or range"))
+ else:
+ raise ValueError(_("Requires prefix or roles"))
- (rc,k) = semanage_user_key_create(self.sh, name)
- if rc < 0:
- raise ValueError(_("Could not create a key for %s") % name)
+ (rc,k) = semanage_user_key_create(self.sh, name)
+ if rc < 0:
+ raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_user_exists(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
- if not exists:
- raise ValueError(_("SELinux user %s is not defined") % name)
+ (rc,exists) = semanage_user_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
+ if not exists:
+ raise ValueError(_("SELinux user %s is not defined") % name)
- (rc,u) = semanage_user_query(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not query user for %s") % name)
+ (rc,u) = semanage_user_query(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not query user for %s") % name)
- oldserange = semanage_user_get_mlsrange(u)
- (rc, rlist) = semanage_user_get_roles(self.sh, u)
- if rc >= 0:
- oldroles = string.join(rlist, ' ');
- newroles = newroles + ' ' + oldroles;
+ oldserange = semanage_user_get_mlsrange(u)
+ (rc, rlist) = semanage_user_get_roles(self.sh, u)
+ if rc >= 0:
+ oldroles = string.join(rlist, ' ');
+ newroles = newroles + ' ' + oldroles;
+
+
+ if serange != "":
+ semanage_user_set_mlsrange(self.sh, u, untranslate(serange))
+ if selevel != "":
+ semanage_user_set_mlslevel(self.sh, u, untranslate(selevel))
+
+ if prefix != "":
+ semanage_user_set_prefix(self.sh, u, prefix)
+
+ if len(roles) != 0:
+ for r in rlist:
+ if r not in roles:
+ semanage_user_del_role(u, r)
+ for r in roles:
+ if r not in rlist:
+ semanage_user_add_role(self.sh, u, r)
+ rc = semanage_user_modify_local(self.sh, k, u)
+ if rc < 0:
+ raise ValueError(_("Could not modify SELinux user %s") % name)
- if serange != "":
- semanage_user_set_mlsrange(self.sh, u, untranslate(serange))
- if selevel != "":
- semanage_user_set_mlslevel(self.sh, u, untranslate(selevel))
-
- if prefix != "":
- semanage_user_set_prefix(self.sh, u, prefix)
-
- if len(roles) != 0:
- for r in rlist:
- if r not in roles:
- semanage_user_del_role(u, r)
- for r in roles:
- if r not in rlist:
- semanage_user_add_role(self.sh, u, r)
+ semanage_user_key_free(k)
+ semanage_user_free(u)
+
+ mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
- rc = semanage_begin_transaction(self.sh) - rc = semanage_begin_transaction(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not start semanage transaction")) - raise ValueError(_("Could not start semanage transaction"))
-
rc = semanage_user_modify_local(self.sh, k, u)
if rc < 0:
raise ValueError(_("Could not modify SELinux user %s") % name)
- rc = semanage_commit(self.sh) - rc = semanage_user_modify_local(self.sh, k, u)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not modify SELinux user %s") % name) - raise ValueError(_("Could not modify SELinux user %s") % name)
- -
- except ValueError, error: - rc = semanage_commit(self.sh)
- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) - if rc < 0:
- raise error - raise ValueError(_("Could not modify SELinux user %s") % name)
+ semanage_user_key_free(k) + def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""):
+ semanage_user_free(u) + try:
+ self.begin()
mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange) + self.__modify(name, roles, selevel, serange, prefix)
+ self.commit()
except ValueError, error:
- mylog.log(0,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
+ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "")
raise error
-
- mylog.log(1,"modify SELinux user record", name, "", newroles, serange, "", oldroles, oldserange)
-
- semanage_user_key_free(k) - semanage_user_key_free(k)
- semanage_user_free(u) - semanage_user_free(u)
- def delete(self, name): - def delete(self, name):
+ def modify(self, name, roles = [], selevel = "", serange = "", prefix = ""): - try:
try: - (rc,k) = semanage_user_key_create(self.sh, name)
+ self.begin() - if rc < 0:
+ self.__modify(name, roles, selevel, serange, prefix) - raise ValueError(_("Could not create a key for %s") % name)
+ self.commit()
+
+ except ValueError, error:
+ mylog.log(0,"modify SELinux user record", name, "", " ".join(roles), serange, "", "", "")
+ raise error
+
+ def __delete(self, name): + def __delete(self, name):
(rc,k) = semanage_user_key_create(self.sh, name) + (rc,k) = semanage_user_key_create(self.sh, name)
if rc < 0: + if rc < 0:
raise ValueError(_("Could not create a key for %s") % name) + raise ValueError(_("Could not create a key for %s") % name)
@@ -727,23 +714,23 @@
if not exists: - (rc,exists) = semanage_user_exists(self.sh, k)
raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name) - if rc < 0:
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
- if not exists:
- raise ValueError(_("SELinux user %s is not defined") % name)
+ (rc,exists) = semanage_user_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
+ if not exists:
+ raise ValueError(_("SELinux user %s is not defined") % name)
- (rc,exists) = semanage_user_exists_local(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
- if not exists:
- raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name)
+ (rc,exists) = semanage_user_exists_local(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
+ if not exists:
+ raise ValueError(_("SELinux user %s is defined in policy, cannot be deleted") % name)
- rc = semanage_begin_transaction(self.sh) - rc = semanage_begin_transaction(self.sh)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not start semanage transaction")) - raise ValueError(_("Could not start semanage transaction"))
- + rc = semanage_user_del_local(self.sh, k)
rc = semanage_user_del_local(self.sh, k) + if rc < 0:
if rc < 0: + raise ValueError(_("Could not delete SELinux user %s") % name)
raise ValueError(_("Could not delete SELinux user %s") % name)
- rc = semanage_commit(self.sh) - rc = semanage_user_del_local(self.sh, k)
- if rc < 0: - if rc < 0:
- raise ValueError(_("Could not delete SELinux user %s") % name) - raise ValueError(_("Could not delete SELinux user %s") % name)
+ semanage_user_key_free(k) + semanage_user_key_free(k)
@ -756,7 +993,10 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
+ self.begin() + self.begin()
+ self.__delete(name) + self.__delete(name)
+ self.commit() + self.commit()
+
- rc = semanage_commit(self.sh)
- if rc < 0:
- raise ValueError(_("Could not delete SELinux user %s") % name)
except ValueError, error: except ValueError, error:
mylog.log(0,"delete SELinux user record", name) mylog.log(0,"delete SELinux user record", name)
raise error raise error
@ -766,7 +1006,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
def get_all(self, locallist = 0): def get_all(self, locallist = 0):
ddict = {} ddict = {}
@@ -808,7 +795,7 @@ @@ -808,7 +797,7 @@
raise ValueError(_("Could not create a key for %s/%s") % (proto, port)) raise ValueError(_("Could not create a key for %s/%s") % (proto, port))
return ( k, proto_d, low, high ) return ( k, proto_d, low, high )
@ -775,7 +1015,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if is_mls_enabled == 1: if is_mls_enabled == 1:
if serange == "": if serange == "":
serange = "s0" serange = "s0"
@@ -857,23 +844,20 @@ @@ -857,23 +846,20 @@
if rc < 0: if rc < 0:
raise ValueError(_("Could not set port context for %s/%s") % (proto, port)) raise ValueError(_("Could not set port context for %s/%s") % (proto, port))
@ -805,7 +1045,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if serange == "" and setype == "": if serange == "" and setype == "":
if is_mls_enabled == 1: if is_mls_enabled == 1:
raise ValueError(_("Requires setype or serange")) raise ValueError(_("Requires setype or serange"))
@@ -899,29 +883,24 @@ @@ -899,29 +885,24 @@
if setype != "": if setype != "":
semanage_context_set_type(self.sh, con, setype) semanage_context_set_type(self.sh, con, setype)
@ -841,7 +1081,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
for port in plist: for port in plist:
proto = semanage_port_get_proto(port) proto = semanage_port_get_proto(port)
@@ -938,11 +917,9 @@ @@ -938,11 +919,9 @@
raise ValueError(_("Could not delete the port %s") % port_str) raise ValueError(_("Could not delete the port %s") % port_str)
semanage_port_key_free(k) semanage_port_key_free(k)
@ -855,7 +1095,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
( k, proto_d, low, high ) = self.__genkey(port, proto) ( k, proto_d, low, high ) = self.__genkey(port, proto)
(rc,exists) = semanage_port_exists(self.sh, k) (rc,exists) = semanage_port_exists(self.sh, k)
if rc < 0: if rc < 0:
@@ -956,20 +933,17 @@ @@ -956,20 +935,17 @@
if not exists: if not exists:
raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port)) raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port))
@ -881,7 +1121,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
def get_all(self, locallist = 0): def get_all(self, locallist = 0):
ddict = {} ddict = {}
if locallist: if locallist:
@@ -1035,7 +1009,7 @@ @@ -1035,7 +1011,7 @@
def __init__(self, store = ""): def __init__(self, store = ""):
semanageRecords.__init__(self, store) semanageRecords.__init__(self, store)
@ -890,7 +1130,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if is_mls_enabled == 1: if is_mls_enabled == 1:
if serange == "": if serange == "":
serange = "s0" serange = "s0"
@@ -1089,23 +1063,20 @@ @@ -1089,23 +1065,20 @@
if rc < 0: if rc < 0:
raise ValueError(_("Could not set message context for %s") % interface) raise ValueError(_("Could not set message context for %s") % interface)
@ -920,7 +1160,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if serange == "" and setype == "": if serange == "" and setype == "":
raise ValueError(_("Requires setype or serange")) raise ValueError(_("Requires setype or serange"))
@@ -1130,22 +1101,19 @@ @@ -1130,22 +1103,19 @@
if setype != "": if setype != "":
semanage_context_set_type(self.sh, con, setype) semanage_context_set_type(self.sh, con, setype)
@ -949,7 +1189,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
(rc,k) = semanage_iface_key_create(self.sh, interface) (rc,k) = semanage_iface_key_create(self.sh, interface)
if rc < 0: if rc < 0:
raise ValueError(_("Could not create key for %s") % interface) raise ValueError(_("Could not create key for %s") % interface)
@@ -1162,20 +1130,17 @@ @@ -1162,20 +1132,17 @@
if not exists: if not exists:
raise ValueError(_("Interface %s is defined in policy, cannot be deleted") % interface) raise ValueError(_("Interface %s is defined in policy, cannot be deleted") % interface)
@ -975,7 +1215,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
def get_all(self, locallist = 0): def get_all(self, locallist = 0):
ddict = {} ddict = {}
if locallist: if locallist:
@@ -1234,7 +1199,7 @@ @@ -1234,7 +1201,7 @@
if target == "" or target.find("\n") >= 0: if target == "" or target.find("\n") >= 0:
raise ValueError(_("Invalid file specification")) raise ValueError(_("Invalid file specification"))
@ -984,7 +1224,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
self.validate(target) self.validate(target)
if is_mls_enabled == 1: if is_mls_enabled == 1:
@@ -1275,24 +1240,22 @@ @@ -1275,24 +1242,22 @@
semanage_fcontext_set_type(fcontext, file_types[ftype]) semanage_fcontext_set_type(fcontext, file_types[ftype])
@ -1016,7 +1256,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if serange == "" and setype == "" and seuser == "": if serange == "" and setype == "" and seuser == "":
raise ValueError(_("Requires setype, serange or seuser")) raise ValueError(_("Requires setype, serange or seuser"))
self.validate(target) self.validate(target)
@@ -1333,29 +1296,25 @@ @@ -1333,29 +1298,25 @@
if rc < 0: if rc < 0:
raise ValueError(_("Could not set file context for %s") % target) raise ValueError(_("Could not set file context for %s") % target)
@ -1053,7 +1293,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
for fcontext in flist: for fcontext in flist:
target = semanage_fcontext_get_expr(fcontext) target = semanage_fcontext_get_expr(fcontext)
@@ -1370,11 +1329,9 @@ @@ -1370,11 +1331,9 @@
raise ValueError(_("Could not delete the file context %s") % target) raise ValueError(_("Could not delete the file context %s") % target)
semanage_fcontext_key_free(k) semanage_fcontext_key_free(k)
@ -1067,7 +1307,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
(rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
if rc < 0: if rc < 0:
raise ValueError(_("Could not create a key for %s") % target) raise ValueError(_("Could not create a key for %s") % target)
@@ -1391,20 +1348,17 @@ @@ -1391,20 +1350,17 @@
else: else:
raise ValueError(_("File context for %s is not defined") % target) raise ValueError(_("File context for %s is not defined") % target)
@ -1093,7 +1333,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
def get_all(self, locallist = 0): def get_all(self, locallist = 0):
l = [] l = []
if locallist: if locallist:
@@ -1486,9 +1440,8 @@ @@ -1486,9 +1442,8 @@
def modify(self, name, value=None, use_file=False): def modify(self, name, value=None, use_file=False):
@ -1105,7 +1345,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
if use_file: if use_file:
fd = open(name) fd = open(name)
for b in fd.read().split("\n"): for b in fd.read().split("\n"):
@@ -1498,18 +1451,16 @@ @@ -1498,18 +1453,16 @@
try: try:
boolname, val = b.split("=") boolname, val = b.split("=")
@ -1127,7 +1367,7 @@ diff -b -B --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --excl
(rc,k) = semanage_bool_key_create(self.sh, name) (rc,k) = semanage_bool_key_create(self.sh, name)
if rc < 0: if rc < 0:
@@ -1526,42 +1477,30 @@ @@ -1526,42 +1479,30 @@
if not exists: if not exists:
raise ValueError(_("Boolean %s is defined in policy, cannot be deleted") % name) raise ValueError(_("Boolean %s is defined in policy, cannot be deleted") % name)

4
policycoreutils.spec
View File

@ -6,7 +6,7 @@
Summary: SELinux policy core utilities Summary: SELinux policy core utilities
Name: policycoreutils Name: policycoreutils
Version: 2.0.54 Version: 2.0.54
Release: 3%{?dist} Release: 4%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
@ -192,7 +192,7 @@ if [ "$1" -ge "1" ]; then
fi fi
%changelog %changelog
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-3 * Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-4
- Fixes for multiple transactions - Fixes for multiple transactions
* Wed Aug 6 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-2 * Wed Aug 6 2008 Dan Walsh <dwalsh@redhat.com> 2.0.54-2