diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.16/audit2allow/Makefile --- nsapolicycoreutils/audit2allow/Makefile 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/audit2allow/Makefile 2007-09-18 14:18:45.000000000 -0400 @@ -1,6 +1,7 @@ # Installation directories. PREFIX ?= ${DESTDIR}/usr BINDIR ?= $(PREFIX)/bin +SBINDIR ?= $(PREFIX)/sbin LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man LOCALEDIR ?= /usr/share/locale @@ -10,7 +11,7 @@ install: all -mkdir -p $(BINDIR) install -m 755 audit2allow $(BINDIR) - install -m 755 sepolgen-ifgen $(BINDIR) + install -m 755 sepolgen-ifgen $(SBINDIR) -mkdir -p $(MANDIR)/man1 install -m 644 audit2allow.1 $(MANDIR)/man1/ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.16/Makefile --- nsapolicycoreutils/Makefile 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/Makefile 2007-09-18 14:18:45.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui all install relabel clean indent: @for subdir in $(SUBDIRS); do \ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.1 policycoreutils-2.0.16/newrole/newrole.1 --- nsapolicycoreutils/newrole/newrole.1 2007-05-04 09:14:50.000000000 -0400 +++ policycoreutils-2.0.16/newrole/newrole.1 2007-09-18 14:20:13.000000000 -0400 @@ -47,6 +47,12 @@ In particular, an argument of -- -c will cause the next argument to be treated as a command by most command interpreters. .PP +If a command argument is specified to newrole and the command name is found +in /etc/selinux/newrole_pam.conf, then the pam service name listed in that +file for the command will be used rather than the normal newrole pam +configuration. This allows for per-command pam configuration when +invoked via newrole, e.g. to skip the interactive re-authentication phase. +.PP The new shell will be the shell specified in the user's entry in the .I /etc/passwd file. @@ -81,14 +87,22 @@ # id -Z staff_u:sysadm_r:sysadm_t:Secret +.PP +Running a program in a given role or level: + # newrole -r sysadm_r -- -c "/path/to/app arg1 arg2..." + # newrole -l Secret -- -c "/path/to/app arg1 arg2..." + .SH FILES /etc/passwd - user account information .br /etc/shadow - encrypted passwords and age information .br /etc/selinux//contexts/default_type - default types for roles +.br /etc/selinux//contexts/securetty_types - securetty types for level changes .br +/etc/selinux/newrole_pam.conf - optional mapping of commands to separate pam service names +.br .SH SEE ALSO .B runcon (1) diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.16/restorecon/restorecon.c --- nsapolicycoreutils/restorecon/restorecon.c 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/restorecon/restorecon.c 2007-09-18 14:18:45.000000000 -0400 @@ -16,6 +16,7 @@ * -v Show changes in file labels. * -o filename save list of files with incorrect context * -F Force reset of context to match file_context for customizable files + * -l Limit directory tree walk to a single filesystem * * pathname... The file(s) to label * @@ -50,6 +51,7 @@ static int recurse = 0; static int file_exist = 1; static int force = 0; +static int onefs = 0; #define STAT_BLOCK_SIZE 1 static int pipe_fds[2] = { -1, -1 }; static unsigned long long count = 0; @@ -326,17 +328,19 @@ rc = fork(); if (rc == 0) { close(pipe_fds[0]); - nftw(buf, pre_stat, 1024, FTW_PHYS); + nftw(buf, pre_stat, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0)); exit(1); } if (rc > 0) close(pipe_fds[1]); if (rc == -1 || rc > 0) { - if (nftw(buf, apply_spec, 1024, FTW_PHYS)) { + if (nftw(buf, apply_spec, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0))) { if (!file_exist && errno == ENOENT) return; fprintf(stderr, - "%s: error while traversing %s: %s\n", + "%s: %s: %s\n", progname, buf, strerror(errno)); errors++; } @@ -367,11 +371,14 @@ set_matchpathcon_flags(MATCHPATHCON_NOTRANS); - while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) { + while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) { switch (opt) { case 'n': change = 0; break; + case 'l': + onefs = 1; + break; case 'i': file_exist = 0; break; diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.16/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2007-05-04 09:14:47.000000000 -0400 +++ policycoreutils-2.0.16/restorecond/restorecond.c 2007-09-18 14:18:45.000000000 -0400 @@ -210,9 +210,10 @@ } if (fsetfilecon(fd, scontext) < 0) { - syslog(LOG_ERR, - "set context %s->%s failed:'%s'\n", - filename, scontext, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, + "set context %s->%s failed:'%s'\n", + filename, scontext, strerror(errno)); if (retcontext >= 0) free(prev_context); free(scontext); @@ -225,8 +226,9 @@ if (retcontext >= 0) free(prev_context); } else { - syslog(LOG_ERR, "get context on %s failed: '%s'\n", - filename, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, "get context on %s failed: '%s'\n", + filename, strerror(errno)); } free(scontext); close(fd); diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.16/scripts/chcat --- nsapolicycoreutils/scripts/chcat 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/chcat 2007-09-18 14:18:45.000000000 -0400 @@ -77,7 +77,7 @@ if len(cats) > 0: new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) - else + else: new_serange = "%s-%s" % (serange[0], top[0]) if add_ind: @@ -155,7 +155,7 @@ if len(cats) > 0: new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) - else + else: new_serange = "%s-%s" % (serange[0], top[0]) if add_ind: diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.16/scripts/fixfiles --- nsapolicycoreutils/scripts/fixfiles 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/fixfiles 2007-11-06 15:03:08.000000000 -0500 @@ -88,11 +88,11 @@ esac; \ fi; \ done | \ - while read pattern ; do find $pattern \ + while read pattern ; do sh -c "find $pattern" \ ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \ \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \ done 2> /dev/null | \ - ${RESTORECON} $2 -v -f - + ${RESTORECON} $2 -f - rm -f ${TEMPFILE} ${PREFCTEMPFILE} fi } @@ -108,6 +108,7 @@ rpmlist() { rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' ' +[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr } # diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.16/scripts/genhomedircon --- nsapolicycoreutils/scripts/genhomedircon 2007-05-04 09:14:49.000000000 -0400 +++ policycoreutils-2.0.16/scripts/genhomedircon 2007-09-18 14:18:45.000000000 -0400 @@ -193,7 +193,7 @@ return prefix def adduser(self, udict, user, seuser, prefix): - if seuser == "user_u" or user == "__default__" or user == "system_u": + if seuser == self.default_user or user == "__default__" or user == "system_u": return # !!! chooses first prefix in the list to use in the file context !!! try: @@ -263,7 +263,7 @@ i = i.replace("system_u", seuser) # Validate if the generated context exists. Some user types may not exist scon = i.split()[-1] - if selinux.security_check_context(scon) == 0: + if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0: ret = ret+i fd.close() return ret @@ -302,7 +302,7 @@ regex = re.sub("\(\/\.\*\)\?", "", regex) regex = regex + "/*$" - if re.search(home, regex, 0): + if re.match(regex,home): return 1 except: continue diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.16/semanage/semanage --- nsapolicycoreutils/semanage/semanage 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/semanage/semanage 2007-10-31 07:04:57.000000000 -0400 @@ -34,7 +34,10 @@ sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace') try: - gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1) + gettext.install(PROGNAME, + localedir="/usr/share/locale", + unicode=False, + codeset = 'utf-8') except IOError: import __builtin__ __builtin__.__dict__['_'] = unicode @@ -45,13 +48,14 @@ def usage(message = ""): print _('\ -semanage {login|user|port|interface|fcontext|translation} -l [-n] \n\ +semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\ semanage login -{a|d|m} [-sr] login_name\n\ semanage user -{a|d|m} [-LrRP] selinux_name\n\ semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\ semanage interface -{a|d|m} [-tr] interface_spec\n\ semanage fcontext -{a|d|m} [-frst] file_spec\n\ semanage translation -{a|d|m} [-T] level\n\n\ +semanage boolean -{d|m} boolean\n\n\ \ Primary Options:\n\ \ @@ -59,10 +63,12 @@ -d, --delete Delete a OBJECT record NAME\n\ -m, --modify Modify a OBJECT record NAME\n\ -l, --list List the OBJECTS\n\n\ + -C, --locallist List OBJECTS local customizations\n\n\ + -D, --deleteall Remove all OBJECTS local customizations\n\ \ -h, --help Display this message\n\ - -n, --noheading Do not print heading when listing OBJECTS\n\n\ -\ + -n, --noheading Do not print heading when listing OBJECTS\n\ + -S, --store Select and alternate SELinux store to manage\n\n\ Object-specific Options (see above):\n\ -f, --ftype File Type of OBJECT \n\ "" (all files) \n\ @@ -95,7 +101,7 @@ def get_options(): valid_option={} - valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading' ] + valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-C', '--locallist', '-D', '--deleteall', '-S', '--store' ] valid_option["login"] = [] valid_option["login"] += valid_everyone + [ '-s', '--seuser', '-r', '--range'] valid_option["user"] = [] @@ -108,6 +114,8 @@ valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] valid_option["translation"] = [] valid_option["translation"] += valid_everyone + [ '-T', '--trans' ] + valid_option["boolean"] = [] + valid_option["boolean"] += valid_everyone return valid_option # @@ -131,7 +139,10 @@ add = 0 modify = 0 delete = 0 + deleteall = 0 list = 0 + locallist = 0 + store = "" if len(sys.argv) < 3: usage(_("Requires 2 or more arguments")) @@ -143,16 +154,19 @@ args = sys.argv[2:] gopts, cmds = getopt.getopt(args, - 'adf:lhmnp:s:R:L:r:t:T:P:', + 'adf:lhmnp:s:CDR:L:r:t:T:P:S:', ['add', 'delete', + 'deleteall', 'ftype=', 'help', 'list', 'modify', 'noheading', + 'localist', 'proto=', 'seuser=', + 'store=', 'range=', 'level=', 'roles=', @@ -174,6 +188,10 @@ if modify or add: usage() delete = 1 + if o == "-D" or o == "--deleteall": + if modify: + usage() + deleteall = 1 if o == "-f" or o == "--ftype": ftype=a if o == "-h" or o == "--help": @@ -182,11 +200,17 @@ if o == "-n" or o == "--noheading": heading=0 + if o == "-C" or o == "--locallist": + locallist=1 + if o == "-m"or o == "--modify": if delete or add: usage() modify = 1 + if o == "-S" or o == '--store': + store = a + if o == "-r" or o == '--range': if is_mls_enabled == 0: errorExit(_("range not supported on Non MLS machines")) @@ -219,31 +243,38 @@ setrans = a if object == "login": - OBJECT = seobject.loginRecords() + OBJECT = seobject.loginRecords(store) if object == "user": - OBJECT = seobject.seluserRecords() + OBJECT = seobject.seluserRecords(store) if object == "port": - OBJECT = seobject.portRecords() + OBJECT = seobject.portRecords(store) if object == "interface": - OBJECT = seobject.interfaceRecords() + OBJECT = seobject.interfaceRecords(store) if object == "fcontext": - OBJECT = seobject.fcontextRecords() + OBJECT = seobject.fcontextRecords(store) + + if object == "boolean": + OBJECT = seobject.booleanRecords(store) if object == "translation": OBJECT = seobject.setransRecords() if list: - OBJECT.list(heading) + OBJECT.list(heading, locallist) + sys.exit(0); + + if deleteall: + OBJECT.deleteall() sys.exit(0); if len(cmds) != 1: usage() - - target = cmds[0] + + target = cmds[0] if add: if object == "login": @@ -271,6 +302,9 @@ sys.exit(0); if modify: + if object == "boolean": + OBJECT.modify(target, value) + if object == "login": OBJECT.modify(target, seuser, serange) diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.16/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/semanage/seobject.py 2007-10-31 07:04:59.000000000 -0400 @@ -170,7 +170,7 @@ rec += "%s=%s\n" % (k, self.ddict[k]) return rec - def list(self,heading = 1): + def list(self,heading = 1, locallist = 0): if heading: print "\n%-25s %s\n" % (_("Level"), _("Translation")) keys = self.ddict.keys() @@ -210,13 +210,17 @@ os.write(fd, self.out()) os.close(fd) os.rename(newfilename, self.filename) + os.system("/sbin/service mcstrans reload > /dev/null") class semanageRecords: - def __init__(self): + def __init__(self, store): self.sh = semanage_handle_create() if not self.sh: raise ValueError(_("Could not create semanage handle")) + if store != "": + semanage_select_store(self.sh, store, SEMANAGE_CON_DIRECT); + self.semanaged = semanage_is_managed(self.sh) if not self.semanaged: @@ -234,8 +238,8 @@ raise ValueError(_("Could not establish semanage connection")) class loginRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) + def __init__(self, store = ""): + semanageRecords.__init__(self, store) def add(self, name, sename, serange): if is_mls_enabled == 1: @@ -389,10 +393,12 @@ mylog.log(1,"delete SELinux user mapping", name); semanage_seuser_key_free(k) - - def get_all(self): + def get_all(self, locallist = 0): ddict = {} - (rc, self.ulist) = semanage_seuser_list(self.sh) + if locallist: + (rc, self.ulist) = semanage_seuser_list_local(self.sh) + else: + (rc, self.ulist) = semanage_seuser_list(self.sh) if rc < 0: raise ValueError(_("Could not list login mappings")) @@ -401,8 +407,8 @@ ddict[name] = (semanage_seuser_get_sename(u), semanage_seuser_get_mlsrange(u)) return ddict - def list(self,heading = 1): - ddict = self.get_all() + def list(self,heading = 1, locallist = 0): + ddict = self.get_all(locallist) keys = ddict.keys() keys.sort() if is_mls_enabled == 1: @@ -417,8 +423,8 @@ print "%-25s %-25s" % (k, ddict[k][0]) class seluserRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) + def __init__(self, store = ""): + semanageRecords.__init__(self, store) def add(self, name, roles, selevel, serange, prefix): if is_mls_enabled == 1: @@ -601,9 +607,12 @@ mylog.log(1,"delete SELinux user record", name) semanage_user_key_free(k) - def get_all(self): + def get_all(self, locallist = 0): ddict = {} - (rc, self.ulist) = semanage_user_list(self.sh) + if locallist: + (rc, self.ulist) = semanage_user_list_local(self.sh) + else: + (rc, self.ulist) = semanage_user_list(self.sh) if rc < 0: raise ValueError(_("Could not list SELinux users")) @@ -618,8 +627,8 @@ return ddict - def list(self, heading = 1): - ddict = self.get_all() + def list(self, heading = 1, locallist = 0): + ddict = self.get_all(locallist) keys = ddict.keys() keys.sort() if is_mls_enabled == 1: @@ -635,8 +644,8 @@ print "%-15s %s" % (k, ddict[k][3]) class portRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) + def __init__(self, store = ""): + semanageRecords.__init__(self, store) def __genkey(self, port, proto): if proto == "tcp": @@ -767,6 +776,34 @@ semanage_port_key_free(k) semanage_port_free(p) + def deleteall(self): + (rc, plist) = semanage_port_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list the ports")) + + rc = semanage_begin_transaction(self.sh) + if rc < 0: + raise ValueError(_("Could not start semanage transaction")) + + for port in plist: + proto = semanage_port_get_proto(port) + proto_str = semanage_port_get_proto_str(proto) + low = semanage_port_get_low(port) + high = semanage_port_get_high(port) + port_str = "%s-%s" % (low, high) + ( k, proto_d, low, high ) = self.__genkey(port_str , proto_str) + if rc < 0: + raise ValueError(_("Could not create a key for %s") % port_str) + + rc = semanage_port_del_local(self.sh, k) + if rc < 0: + raise ValueError(_("Could not delete the port %s") % port_str) + semanage_port_key_free(k) + + rc = semanage_commit(self.sh) + if rc < 0: + raise ValueError(_("Could not delete the %s") % port_str) + def delete(self, port, proto): ( k, proto_d, low, high ) = self.__genkey(port, proto) (rc,exists) = semanage_port_exists(self.sh, k) @@ -795,9 +832,12 @@ semanage_port_key_free(k) - def get_all(self): + def get_all(self, locallist = 0): ddict = {} - (rc, self.plist) = semanage_port_list(self.sh) + if locallist: + (rc, self.plist) = semanage_port_list_local(self.sh) + else: + (rc, self.plist) = semanage_port_list(self.sh) if rc < 0: raise ValueError(_("Could not list ports")) @@ -814,9 +854,12 @@ ddict[(low, high)] = (ctype, proto_str, level) return ddict - def get_all_by_type(self): + def get_all_by_type(self, locallist = 0): ddict = {} - (rc, self.plist) = semanage_port_list(self.sh) + if locallist: + (rc, self.plist) = semanage_port_list_local(self.sh) + else: + (rc, self.plist) = semanage_port_list(self.sh) if rc < 0: raise ValueError(_("Could not list ports")) @@ -837,10 +880,10 @@ ddict[(ctype,proto_str)].append("%d-%d" % (low, high)) return ddict - def list(self, heading = 1): + def list(self, heading = 1, locallist = 0): if heading: print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number")) - ddict = self.get_all_by_type() + ddict = self.get_all_by_type(locallist) keys = ddict.keys() keys.sort() for i in keys: @@ -851,8 +894,8 @@ print rec class interfaceRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) + def __init__(self, store = ""): + semanageRecords.__init__(self, store) def add(self, interface, serange, ctype): if is_mls_enabled == 1: @@ -995,9 +1038,12 @@ semanage_iface_key_free(k) - def get_all(self): + def get_all(self, locallist = 0): ddict = {} - (rc, self.ilist) = semanage_iface_list(self.sh) + if locallist: + (rc, self.ilist) = semanage_iface_list_local(self.sh) + else: + (rc, self.ilist) = semanage_iface_list(self.sh) if rc < 0: raise ValueError(_("Could not list interfaces")) @@ -1007,10 +1053,10 @@ return ddict - def list(self, heading = 1): + def list(self, heading = 1, locallist = 0): if heading: print "%-30s %s\n" % (_("SELinux Interface"), _("Context")) - ddict = self.get_all() + ddict = self.get_all(locallist) keys = ddict.keys() keys.sort() if is_mls_enabled: @@ -1021,17 +1067,40 @@ print "%-30s %s:%s:%s " % (k,ddict[k][0], ddict[k][1],ddict[k][2]) class fcontextRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) - - def add(self, target, type, ftype = "", serange = "", seuser = "system_u"): + def __init__(self, store = ""): + semanageRecords.__init__(self, store) + + def createcon(self, target, seuser = "system_u"): + (rc, con) = semanage_context_create(self.sh) + if rc < 0: + raise ValueError(_("Could not create context for %s") % target) if seuser == "": seuser = "system_u" + + rc = semanage_context_set_user(self.sh, con, seuser) + if rc < 0: + raise ValueError(_("Could not set user in file context for %s") % target) + + rc = semanage_context_set_role(self.sh, con, "object_r") + if rc < 0: + raise ValueError(_("Could not set role in file context for %s") % target) + if is_mls_enabled == 1: - if serange == "": - serange = "s0" - else: - serange = untranslate(serange) + rc = semanage_context_set_mls(self.sh, con, "s0") + if rc < 0: + raise ValueError(_("Could not set mls fields in file context for %s") % target) + + return con + + def validate(self, target): + if target == "" or target.find("\n") >= 0: + raise ValueError(_("Invalid file specification")) + + def add(self, target, type, ftype = "", serange = "", seuser = "system_u"): + self.validate(target) + + if is_mls_enabled == 1: + serange = untranslate(serange) if type == "": raise ValueError(_("SELinux Type is required")) @@ -1051,33 +1120,23 @@ raise ValueError(_("Could not create file context for %s") % target) rc = semanage_fcontext_set_expr(self.sh, fcontext, target) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: - raise ValueError(_("Could not create context for %s") % target) + if type != "<>": + con = self.createcon(target, seuser) - rc = semanage_context_set_user(self.sh, con, seuser) - if rc < 0: - raise ValueError(_("Could not set user in file context for %s") % target) - - rc = semanage_context_set_role(self.sh, con, "object_r") - if rc < 0: - raise ValueError(_("Could not set role in file context for %s") % target) - - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: - raise ValueError(_("Could not set type in file context for %s") % target) - - if serange != "": - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: - raise ValueError(_("Could not set mls fields in file context for %s") % target) + rc = semanage_context_set_type(self.sh, con, type) + if rc < 0: + raise ValueError(_("Could not set type in file context for %s") % target) + + if serange != "": + rc = semanage_context_set_mls(self.sh, con, serange) + if rc < 0: + raise ValueError(_("Could not set mls fields in file context for %s") % target) + rc = semanage_fcontext_set_con(self.sh, fcontext, con) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) semanage_fcontext_set_type(fcontext, file_types[ftype]) - rc = semanage_fcontext_set_con(self.sh, fcontext, con) - if rc < 0: - raise ValueError(_("Could not set file context for %s") % target) - rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) @@ -1090,13 +1149,15 @@ if rc < 0: raise ValueError(_("Could not add file context for %s") % target) - semanage_context_free(con) + if type != "<>": + semanage_context_free(con) semanage_fcontext_key_free(k) semanage_fcontext_free(fcontext) def modify(self, target, setype, ftype, serange, seuser): if serange == "" and setype == "" and seuser == "": raise ValueError(_("Requires setype, serange or seuser")) + self.validate(target) (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: @@ -1112,16 +1173,29 @@ if rc < 0: raise ValueError(_("Could not query file context for %s") % target) - con = semanage_fcontext_get_con(fcontext) + if setype != "<>": + con = semanage_fcontext_get_con(fcontext) - if serange != "": - semanage_context_set_mls(self.sh, con, untranslate(serange)) - if seuser != "": - semanage_context_set_user(self.sh, con, seuser) - if setype != "": - semanage_context_set_type(self.sh, con, setype) - - rc = semanage_begin_transaction(self.sh) + if con == None: + con = self.createcon(target) + + if serange != "": + semanage_context_set_mls(self.sh, con, untranslate(serange)) + if seuser != "": + semanage_context_set_user(self.sh, con, seuser) + + if setype != "": + semanage_context_set_type(self.sh, con, setype) + + rc = semanage_fcontext_set_con(self.sh, fcontext, con) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) + else: + rc = semanage_fcontext_set_con(self.sh, fcontext, None) + if rc < 0: + raise ValueError(_("Could not set file context for %s") % target) + + rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) @@ -1136,6 +1210,32 @@ semanage_fcontext_key_free(k) semanage_fcontext_free(fcontext) + def deleteall(self): + (rc, flist) = semanage_fcontext_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list the file contexts")) + + rc = semanage_begin_transaction(self.sh) + if rc < 0: + raise ValueError(_("Could not start semanage transaction")) + + for fcontext in flist: + target = semanage_fcontext_get_expr(fcontext) + ftype = semanage_fcontext_get_type(fcontext) + ftype_str = semanage_fcontext_get_type_str(ftype) + (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str]) + if rc < 0: + raise ValueError(_("Could not create a key for %s") % target) + + rc = semanage_fcontext_del_local(self.sh, k) + if rc < 0: + raise ValueError(_("Could not delete the file context %s") % target) + semanage_fcontext_key_free(k) + + rc = semanage_commit(self.sh) + if rc < 0: + raise ValueError(_("Could not delete the file context %s") % target) + def delete(self, target, ftype): (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype]) if rc < 0: @@ -1167,17 +1267,20 @@ semanage_fcontext_key_free(k) - def get_all(self): + def get_all(self, locallist = 0): l = [] - (rc, self.flist) = semanage_fcontext_list(self.sh) - if rc < 0: - raise ValueError(_("Could not list file contexts")) + if locallist: + (rc, self.flist) = semanage_fcontext_list_local(self.sh) + else: + (rc, self.flist) = semanage_fcontext_list(self.sh) + if rc < 0: + raise ValueError(_("Could not list file contexts")) + + (rc, fclocal) = semanage_fcontext_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list local file contexts")) - (rc, fclocal) = semanage_fcontext_list_local(self.sh) - if rc < 0: - raise ValueError(_("Could not list local file contexts")) - - self.flist += fclocal + self.flist += fclocal for fcontext in self.flist: expr = semanage_fcontext_get_expr(fcontext) @@ -1191,10 +1294,10 @@ return l - def list(self, heading = 1): + def list(self, heading = 1, locallist = 0 ): if heading: print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context")) - fcon_list = self.get_all() + fcon_list = self.get_all(locallist) for fcon in fcon_list: if len(fcon) > 3: if is_mls_enabled: @@ -1205,9 +1308,9 @@ print "%-50s %-18s <>" % (fcon[0], fcon[1]) class booleanRecords(semanageRecords): - def __init__(self): - semanageRecords.__init__(self) - + def __init__(self, store = ""): + semanageRecords.__init__(self, store) + def modify(self, name, value = ""): if value == "": raise ValueError(_("Requires value")) @@ -1266,34 +1369,62 @@ if rc < 0: raise ValueError(_("Could not start semanage transaction")) - rc = semanage_fcontext_del_local(self.sh, k) + rc = semanage_bool_del_local(self.sh, k) if rc < 0: raise ValueError(_("Could not delete boolean %s") % name) rc = semanage_commit(self.sh) if rc < 0: raise ValueError(_("Could not delete boolean %s") % name) - semanage_bool_key_free(k) - def get_all(self): + def deleteall(self): + (rc, self.blist) = semanage_bool_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list booleans")) + + rc = semanage_begin_transaction(self.sh) + if rc < 0: + raise ValueError(_("Could not start semanage transaction")) + + for boolean in self.blist: + name = semanage_bool_get_name(boolean) + (rc,k) = semanage_bool_key_create(self.sh, name) + if rc < 0: + raise ValueError(_("Could not create a key for %s") % name) + + rc = semanage_bool_del_local(self.sh, k) + if rc < 0: + raise ValueError(_("Could not delete boolean %s") % name) + semanage_bool_key_free(k) + + rc = semanage_commit(self.sh) + if rc < 0: + raise ValueError(_("Could not delete boolean %s") % name) + def get_all(self, locallist = 0): ddict = {} - (rc, self.blist) = semanage_bool_list(self.sh) + if locallist: + (rc, self.blist) = semanage_bool_list_local(self.sh) + else: + (rc, self.blist) = semanage_bool_list(self.sh) if rc < 0: raise ValueError(_("Could not list booleans")) for boolean in self.blist: - name = semanage_bool_get_name(boolean) - value = semanage_bool_get_value(boolean) - ddict[name] = value + value = [] + name = semanage_bool_get_name(boolean) + value.append(semanage_bool_get_value(boolean)) + value.append(selinux.security_get_boolean_pending(name)) + value.append(selinux.security_get_boolean_active(name)) + ddict[name] = value return ddict - def list(self, heading = 1): + def list(self, heading = 1, locallist = 0): if heading: - print "%-50s %-18s\n" % (_("SELinux boolean"), _("value")) - ddict = self.get_all() + print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") ) + ddict = self.get_all(locallist) keys = ddict.keys() for k in keys: if ddict[k]: - print "%-50s %-18s " % (k[0], ddict[k][0]) + print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2]) diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setsebool/setsebool.c policycoreutils-2.0.16/setsebool/setsebool.c --- nsapolicycoreutils/setsebool/setsebool.c 2007-05-04 09:14:48.000000000 -0400 +++ policycoreutils-2.0.16/setsebool/setsebool.c 2007-09-18 14:18:45.000000000 -0400 @@ -160,6 +160,8 @@ goto err; semanage_disconnect(handle); + semanage_handle_destroy(handle); + return 0; err: semanage_bool_key_free(bool_key);