diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py index f7f05cb..6b94239 100644 --- a/policycoreutils/sepolicy/sepolicy/__init__.py +++ b/policycoreutils/sepolicy/sepolicy/__init__.py @@ -98,6 +98,21 @@ def get_conditionals_format_text(cond): def get_types_from_attribute(attribute): return info(ATTRIBUTE,attribute)[0]["types"] +def get_attributes_from_type(setype): + return info(TYPE,setype)[0]["attributes"] + +def file_type_is_executable(setype): + if "exec_type" in get_attributes_from_type(setype): + return True + else: + return False + +def file_type_is_entrypoint(setype): + if "entry_type" in get_attributes_from_type(setype): + return True + else: + return False + file_type_str = {} file_type_str["a"] = _("all files") file_type_str["f"] = _("regular file") diff --git a/policycoreutils/sepolicy/sepolicy/manpage.py b/policycoreutils/sepolicy/sepolicy/manpage.py index 9af0794..8daca56 100755 --- a/policycoreutils/sepolicy/sepolicy/manpage.py +++ b/policycoreutils/sepolicy/sepolicy/manpage.py @@ -679,10 +679,13 @@ Default Defined Ports:""") def _file_context(self): flist=[] + flist_non_exec=[] mpaths=[] for f in self.all_file_types: if f.startswith(self.domainname): flist.append(f) + if not file_type_is_executable(f) or not file_type_is_entrypoint(f): + flist_non_exec.append(f) if f in self.fcdict: mpaths = mpaths + self.fcdict[f]["regex"] if len(mpaths) == 0: @@ -734,19 +737,20 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d .PP """ % {'domainname':self.domainname, 'equiv': e, 'alt': e.split('/')[-1] }) - self.fd.write(r""" + if flist_non_exec: + self.fd.write(r""" .PP .B STANDARD FILE CONTEXT SELinux defines the file context types for the %(domainname)s, if you wanted to store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk. -.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?' +.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?' .br .B restorecon -R -v /srv/my%(domainname)s_content Note: SELinux often uses regular expressions to specify labels that match multiple files. -""" % {'domainname':self.domainname, "type":flist[0] }) +""" % {'domainname':self.domainname, "type":flist_non_exec[-1] }) self.fd.write(r""" .I The following file types are defined for %(domainname)s: