diff --exclude-from=exclude -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-1.29.8/scripts/chcat --- nsapolicycoreutils/scripts/chcat 2006-01-18 11:12:43.000000000 -0500 +++ policycoreutils-1.29.8/scripts/chcat 2006-01-18 13:52:39.000000000 -0500 @@ -281,6 +281,7 @@ print "Usage %s -d File ..." % sys.argv[0] print "Usage %s -l -d user ..." % sys.argv[0] print "Usage %s -L" % sys.argv[0] + print "Usage %s -L -l user" % sys.argv[0] print "Use -- to end option list. For example" print "chcat -- -CompanyConfidential /docs/businessplan.odt" print "chcat -l +CompanyConfidential juser" @@ -298,12 +299,8 @@ return 0 def listusercats(users): - seusers = seobject.loginRecords().get_all() for u in users: - if u in seusers.keys(): - cats=seobject.translate(seusers[u][1]) - else: - cats=seobject.translate(seusers["__default__"][1]) + cats=seobject.translate(selinux.getseuserbyname(u)[2]) cats=cats.split("-") if len(cats) > 1 and cats[1] != "s0": print "%s: %s" % (u, cats[1]) @@ -350,10 +347,17 @@ if delete_ind: sys.exit(chcat_replace(["s0"], ["s0"], cmds, login_ind)) + if login_ind: + if len(cmds) >= 1: + for u in cmds: + try: + pwd.getpwnam(u) + except KeyError, e: + error( "User %s does not exist" % u) + else: + cmds.append(os.getlogin()) if list_ind: if login_ind: - if len(cmds) < 1: - usage() sys.exit(listusercats(cmds)) else: if len(cmds) > 0: diff --exclude-from=exclude -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-1.29.8/semanage/semanage --- nsapolicycoreutils/semanage/semanage 2006-01-18 11:12:43.000000000 -0500 +++ policycoreutils-1.29.8/semanage/semanage 2006-01-18 17:02:47.000000000 -0500 @@ -30,11 +30,12 @@ def usage(message = ""): print '\ -semanage user [-admLRr] SELINUX_USER\n\ +semanage fcontext [-admhfrst] INTERFACE\n\ +semanage interface [-admtr] INTERFACE\n\ semanage login [-admsr] LOGIN_NAME\n\ semanage port [-admtpr] PORT | PORTRANGE\n\ -semanage interface [-admtr] INTERFACE\n\ -semanage fcontext [-admhfrst] INTERFACE\n\ +semanage translation [-adm] LEVEL\n\ +semanage user [-admLRr] SELINUX_USER\n\ -a, --add Add a OBJECT record NAME\n\ -d, --delete Delete a OBJECT record NAME\n\ -f, --ftype File Type of OBJECT \n\ @@ -47,6 +48,7 @@ -R, --roles SELinux Roles (Separate by spaces)\n\ -s, --seuser SELinux user name\n\ -t, --type SELinux Type for the object\n\ + -T, --trans SELinux Level Translation\n\ -v, --verbose verbose output\n\ ' print message @@ -62,7 +64,7 @@ # # try: - objectlist = ("login", "user", "port", "interface", "fcontext") + objectlist = ("login", "user", "port", "interface", "fcontext", "translation") input = sys.stdin output = sys.stdout serange = "" @@ -71,6 +73,7 @@ selevel = "" setype = "" ftype = "" + setrans = "" roles = "" seuser = "" heading=1 @@ -88,7 +91,7 @@ args = sys.argv[2:] gopts, cmds = getopt.getopt(args, - 'adf:lhmnp:P:s:R:L:r:t:v', + 'adf:lhmnp:P:s:R:L:r:t:vT:', ['add', 'delete', 'ftype=', @@ -103,6 +106,7 @@ 'level=', 'roles=', 'type=', + 'trans=', 'verbose' ]) for o,a in gopts: @@ -149,6 +153,9 @@ if o == "-t" or o == "--type": setype = a + if o == "-T" or o == "--trans": + setrans = a + if o == "-v" or o == "--verbose": verbose = 1 @@ -167,6 +174,9 @@ if object == "fcontext": OBJECT = seobject.fcontextRecords() + if object == "translation": + OBJECT = seobject.setransRecords() + if list: OBJECT.list(heading) sys.exit(0); @@ -180,6 +190,9 @@ if object == "login": OBJECT.add(target, seuser, serange) + if object == "translation": + OBJECT.add(target, setrans) + if object == "user": rlist = roles.split() if len(rlist) == 0: @@ -200,6 +213,9 @@ if object == "login": OBJECT.modify(target, seuser, serange) + if object == "translation": + OBJECT.modify(target, setrans) + if object == "user": rlist = roles.split() OBJECT.modify(target, rlist, selevel, serange) diff --exclude-from=exclude -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-1.29.8/semanage/semanage.8 --- nsapolicycoreutils/semanage/semanage.8 2006-01-18 11:12:43.000000000 -0500 +++ policycoreutils-1.29.8/semanage/semanage.8 2006-01-18 17:04:31.000000000 -0500 @@ -13,6 +13,8 @@ .br .B semanage interface \-{a|d|m} [\-tr] interface_spec .br +.B semanage translation \-{a|d|m} [\-T] level +.br .B semanage fcontext \-{a|d|m} [\-frst] file_spec .P @@ -23,7 +25,7 @@ .BR semanage program. .br -This tool is used to configure SELinux Policy. You can configure SELinux User Mappings, SELinux Port Mappings, SELinux Users. File Context and Network Interfaces. +This tool is used to configure SELinux Policy. You can configure SELinux User Mappings, SELinux Port Mappings, SELinux Users. File Context and Network Interfaces and MLS/MCS Translations. .SH "OPTIONS" .TP @@ -64,6 +66,9 @@ .I \-t, \-\-type SELinux Type for the object .TP +.I \-T, \-\-trans +SELinux Translation +.TP .I \-v, \-\-verbose verbose output diff --exclude-from=exclude -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-1.29.8/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2006-01-18 11:12:43.000000000 -0500 +++ policycoreutils-1.29.8/semanage/seobject.py 2006-01-18 17:03:01.000000000 -0500 @@ -21,9 +21,18 @@ # # -import pwd, string, selinux +import pwd, string, selinux, tempfile, os, re from semanage import *; +def validate_level(raw): + sensitivity="s([0-9]|1[0-5])" + category="c(1?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])" + range=category + "(\." + category +")?" + categories = range + "(\," + range + ")*" + sensitivity + "(:categies)?" + reg = sensitivity + "(-" + sensitivity + ")?" + "(:" + categories + ")?" + return re.search("^" + reg +"$",raw) + def translate(raw, prepend=1): if prepend == 1: context="a:b:c:%s" % raw @@ -54,6 +63,82 @@ else: return raw +class setransRecords: + def __init__(self): + self.filename=selinux.selinux_translations_path() + fd=open(self.filename, "r") + translations=fd.read().split('\n') + fd.close() + self.dict={} + self.comments=[] + for r in translations: + if len(r) == 0: + continue + i=r.strip() + if i== "" or i[0] == "#": + self.comments.append(r) + continue + i=i.split("=") + if len(i) != 2: + self.comments.append(r) + continue + self.dict[i[0]] = i[1] + + def get_all(self): + return self.dict + + def out(self): + rec="" + for c in self.comments: + rec+=c +"\n" + keys=self.dict.keys() + keys.sort() + for k in keys: + rec += "%s=%s\n" % (k, self.dict[k]) + return rec + + def list(self,heading=1): + if heading: + print "\n%-25s %s\n" % ("Level", "Translation") + keys=self.dict.keys() + keys.sort() + for k in keys: + print "%-25s %s" % (k, self.dict[k]) + + def add(self, raw, trans): + if trans.find(" ") >= 0: + raise ValueError("Translations can not contain spaces '%s' " % trans) + + if validate_level(raw) == None: + raise ValueError("Invalid Level '%s' " % raw) + + if self.dict.has_key(raw): + raise ValueError("%s already defined in translations" % raw) + else: + self.dict[raw]=trans + self.save() + + def modify(self, raw, trans): + if trans.find(" ") >= 0: + + raise ValueError("Translations can not contain spaces '%s' " % trans) + if self.dict.has_key(raw): + self.dict[raw]=trans + else: + raise ValueError("%s not defined in translations" % raw) + self.save() + + def delete(self, raw): + self.dict.pop(raw) + self.save() + + def save(self): + newfilename = tempfile.mktemp('', self.filename) + fd=open(newfilename, "w") + fd.write(self.out()) + fd.close() + os.rename(newfilename, self.filename) + class semanageRecords: def __init__(self): self.sh = semanage_handle_create() @@ -421,11 +506,11 @@ rc = semanage_port_modify_local(self.sh, k, p) if rc < 0: - raise ValueError("Failed to add port %s/%s" % (proto, port)) + raise ValueError("Failed to modify port %s/%s" % (proto, port)) rc = semanage_commit(self.sh) if rc < 0: - raise ValueError("Failed to add port %s/%s" % (proto, port)) + raise ValueError("Failed to modify port %s/%s" % (proto, port)) def modify(self, port, proto, serange, setype): if serange == "" and setype == "": @@ -458,7 +543,7 @@ rc = semanage_commit(self.sh) if rc < 0: - raise ValueError("Failed to add port %s/%s" % (proto, port)) + raise ValueError("Failed to modify port %s/%s" % (proto, port)) def delete(self, port, proto): ( k, proto_d, low, high ) = self.__genkey(port, proto) @@ -491,22 +576,44 @@ for idx in range(self.psize): u = semanage_port_by_idx(self.plist, idx) con = semanage_port_get_con(u) - name = semanage_context_get_type(con) + type = semanage_context_get_type(con) + if type == "reserved_port_t": + continue + level = semanage_context_get_mls(con) proto=semanage_port_get_proto_str(u) low=semanage_port_get_low(u) high = semanage_port_get_high(u) - if (name, proto) not in dict.keys(): - dict[(name,proto)]=[] + dict[(low, high)]=(type, proto, level) + return dict + + def get_all_by_type(self): + dict={} + (rc, self.plist, self.psize) = semanage_port_list(self.sh) + if rc < 0: + raise ValueError("Could not list ports") + + for idx in range(self.psize): + u = semanage_port_by_idx(self.plist, idx) + con = semanage_port_get_con(u) + type = semanage_context_get_type(con) + if type == "reserved_port_t": + continue + level = semanage_context_get_mls(con) + proto=semanage_port_get_proto_str(u) + low=semanage_port_get_low(u) + high = semanage_port_get_high(u) + if (type, proto) not in dict.keys(): + dict[(type,proto)]=[] if low == high: - dict[(name,proto)].append("%d" % low) + dict[(type,proto)].append("%d" % low) else: - dict[(name,proto)].append("%d-%d" % (low, high)) + dict[(type,proto)].append("%d-%d" % (low, high)) return dict def list(self, heading=1): if heading: - print "%-30s %-8s %s\n" % ("SELinux Port Name", "Proto", "Port Number") - dict=self.get_all() + print "%-30s %-8s %s\n" % ("SELinux Port Type", "Proto", "Port Number") + dict=self.get_all_by_type() keys=dict.keys() keys.sort() for i in keys: diff --exclude-from=exclude -N -u -r nsapolicycoreutils/setsebool/setsebool.c policycoreutils-1.29.8/setsebool/setsebool.c --- nsapolicycoreutils/setsebool/setsebool.c 2006-01-04 13:07:46.000000000 -0500 +++ policycoreutils-1.29.8/setsebool/setsebool.c 2006-01-18 13:27:42.000000000 -0500 @@ -130,7 +130,7 @@ for (j = 0; j < boolcnt; j++) { - if (semanage_bool_create(handle, &boolean) < 0) + if (semanage_bool_create(handle, &boolean) < 0) goto err; if (semanage_bool_set_name(handle, boolean, boollist[j].name) < 0) @@ -144,9 +144,10 @@ if (permanent && semanage_bool_modify_local(handle, bool_key, boolean) < 0) goto err; - if (semanage_bool_set_active(handle, bool_key, boolean) < 0) + if (semanage_bool_set_active(handle, bool_key, boolean) < 0) { + fprintf(stderr, "Could not change boolean %s\n", boollist[j].name); goto err; - + } semanage_bool_key_free(bool_key); semanage_bool_free(boolean); bool_key = NULL;