diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.16/audit2allow/Makefile --- nsapolicycoreutils/audit2allow/Makefile 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/audit2allow/Makefile 2007-09-18 14:18:45.000000000 -0400 @@ -1,6 +1,7 @@ # Installation directories. PREFIX ?= ${DESTDIR}/usr BINDIR ?= $(PREFIX)/bin +SBINDIR ?= $(PREFIX)/sbin LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man LOCALEDIR ?= /usr/share/locale @@ -10,7 +11,7 @@ install: all -mkdir -p $(BINDIR) install -m 755 audit2allow $(BINDIR) - install -m 755 sepolgen-ifgen $(BINDIR) + install -m 755 sepolgen-ifgen $(SBINDIR) -mkdir -p $(MANDIR)/man1 install -m 644 audit2allow.1 $(MANDIR)/man1/ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.16/Makefile --- nsapolicycoreutils/Makefile 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/Makefile 2007-09-18 14:18:45.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui all install relabel clean indent: @for subdir in $(SUBDIRS); do \ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.1 policycoreutils-2.0.16/newrole/newrole.1 --- nsapolicycoreutils/newrole/newrole.1 2007-05-04 09:14:50.000000000 -0400 +++ policycoreutils-2.0.16/newrole/newrole.1 2007-09-18 14:20:13.000000000 -0400 @@ -47,6 +47,12 @@ In particular, an argument of -- -c will cause the next argument to be treated as a command by most command interpreters. .PP +If a command argument is specified to newrole and the command name is found +in /etc/selinux/newrole_pam.conf, then the pam service name listed in that +file for the command will be used rather than the normal newrole pam +configuration. This allows for per-command pam configuration when +invoked via newrole, e.g. to skip the interactive re-authentication phase. +.PP The new shell will be the shell specified in the user's entry in the .I /etc/passwd file. @@ -81,14 +87,22 @@ # id -Z staff_u:sysadm_r:sysadm_t:Secret +.PP +Running a program in a given role or level: + # newrole -r sysadm_r -- -c "/path/to/app arg1 arg2..." + # newrole -l Secret -- -c "/path/to/app arg1 arg2..." + .SH FILES /etc/passwd - user account information .br /etc/shadow - encrypted passwords and age information .br /etc/selinux//contexts/default_type - default types for roles +.br /etc/selinux//contexts/securetty_types - securetty types for level changes .br +/etc/selinux/newrole_pam.conf - optional mapping of commands to separate pam service names +.br .SH SEE ALSO .B runcon (1) diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.16/restorecon/restorecon.c --- nsapolicycoreutils/restorecon/restorecon.c 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/restorecon/restorecon.c 2007-09-18 14:18:45.000000000 -0400 @@ -16,6 +16,7 @@ * -v Show changes in file labels. * -o filename save list of files with incorrect context * -F Force reset of context to match file_context for customizable files + * -l Limit directory tree walk to a single filesystem * * pathname... The file(s) to label * @@ -50,6 +51,7 @@ static int recurse = 0; static int file_exist = 1; static int force = 0; +static int onefs = 0; #define STAT_BLOCK_SIZE 1 static int pipe_fds[2] = { -1, -1 }; static unsigned long long count = 0; @@ -326,17 +328,19 @@ rc = fork(); if (rc == 0) { close(pipe_fds[0]); - nftw(buf, pre_stat, 1024, FTW_PHYS); + nftw(buf, pre_stat, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0)); exit(1); } if (rc > 0) close(pipe_fds[1]); if (rc == -1 || rc > 0) { - if (nftw(buf, apply_spec, 1024, FTW_PHYS)) { + if (nftw(buf, apply_spec, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0))) { if (!file_exist && errno == ENOENT) return; fprintf(stderr, - "%s: error while traversing %s: %s\n", + "%s: %s: %s\n", progname, buf, strerror(errno)); errors++; } @@ -367,11 +371,14 @@ set_matchpathcon_flags(MATCHPATHCON_NOTRANS); - while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) { + while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) { switch (opt) { case 'n': change = 0; break; + case 'l': + onefs = 1; + break; case 'i': file_exist = 0; break; diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.16/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2007-05-04 09:14:47.000000000 -0400 +++ policycoreutils-2.0.16/restorecond/restorecond.c 2007-09-18 14:18:45.000000000 -0400 @@ -210,9 +210,10 @@ } if (fsetfilecon(fd, scontext) < 0) { - syslog(LOG_ERR, - "set context %s->%s failed:'%s'\n", - filename, scontext, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, + "set context %s->%s failed:'%s'\n", + filename, scontext, strerror(errno)); if (retcontext >= 0) free(prev_context); free(scontext); @@ -225,8 +226,9 @@ if (retcontext >= 0) free(prev_context); } else { - syslog(LOG_ERR, "get context on %s failed: '%s'\n", - filename, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, "get context on %s failed: '%s'\n", + filename, strerror(errno)); } free(scontext); close(fd); diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.16/scripts/chcat --- nsapolicycoreutils/scripts/chcat 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/chcat 2007-09-18 14:18:45.000000000 -0400 @@ -77,7 +77,7 @@ if len(cats) > 0: new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) - else + else: new_serange = "%s-%s" % (serange[0], top[0]) if add_ind: @@ -155,7 +155,7 @@ if len(cats) > 0: new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) - else + else: new_serange = "%s-%s" % (serange[0], top[0]) if add_ind: diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.16/scripts/fixfiles --- nsapolicycoreutils/scripts/fixfiles 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/fixfiles 2007-09-18 14:21:45.000000000 -0400 @@ -88,7 +88,7 @@ esac; \ fi; \ done | \ - while read pattern ; do find $pattern \ + while read pattern ; do sh -c "find $pattern" \ ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \ \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \ done 2> /dev/null | \ @@ -108,6 +108,7 @@ rpmlist() { rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' ' +[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr } # diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.16/scripts/genhomedircon --- nsapolicycoreutils/scripts/genhomedircon 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/genhomedircon 2007-09-18 14:18:45.000000000 -0400 @@ -193,7 +193,7 @@ return prefix def adduser(self, udict, user, seuser, prefix): - if seuser == "user_u" or user == "__default__" or user == "system_u": + if seuser == self.default_user or user == "__default__" or user == "system_u": return # !!! chooses first prefix in the list to use in the file context !!! try: @@ -263,7 +263,7 @@ i = i.replace("system_u", seuser) # Validate if the generated context exists. Some user types may not exist scon = i.split()[-1] - if selinux.security_check_context(scon) == 0: + if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0: ret = ret+i fd.close() return ret @@ -302,7 +302,7 @@ regex = re.sub("\(\/\.\*\)\?", "", regex) regex = regex + "/*$" - if re.search(home, regex, 0): + if re.match(regex,home): return 1 except: continue diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.16/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/semanage/seobject.py 2007-09-18 14:18:45.000000000 -0400 @@ -210,6 +210,7 @@ os.write(fd, self.out()) os.close(fd) os.rename(newfilename, self.filename) + os.system("/sbin/service mcstrans reload > /dev/null") class semanageRecords: def __init__(self): @@ -1283,9 +1284,12 @@ raise ValueError(_("Could not list booleans")) for boolean in self.blist: - name = semanage_bool_get_name(boolean) - value = semanage_bool_get_value(boolean) - ddict[name] = value + value = [] + name = semanage_bool_get_name(boolean) + value[0] = semanage_bool_get_value(boolean) + value[1] = selinux.security_get_boolean_pending(boolean) + value[2] = selinux.security_get_boolean_active(boolean) + ddict[name] = value return ddict diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setsebool/setsebool.c policycoreutils-2.0.16/setsebool/setsebool.c --- nsapolicycoreutils/setsebool/setsebool.c 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/setsebool/setsebool.c 2007-09-18 14:18:45.000000000 -0400 @@ -160,6 +160,8 @@ goto err; semanage_disconnect(handle); + semanage_handle_destroy(handle); + return 0; err: semanage_bool_key_free(bool_key);