diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.9/audit2allow/Makefile --- nsapolicycoreutils/audit2allow/Makefile 2007-02-07 12:11:49.000000000 -0500 +++ policycoreutils-2.0.9/audit2allow/Makefile 2007-04-18 14:32:01.000000000 -0400 @@ -1,6 +1,7 @@ # Installation directories. PREFIX ?= ${DESTDIR}/usr BINDIR ?= $(PREFIX)/bin +SBINDIR ?= $(PREFIX)/sbin LIBDIR ?= $(PREFIX)/lib MANDIR ?= $(PREFIX)/share/man LOCALEDIR ?= /usr/share/locale @@ -10,7 +11,7 @@ install: all -mkdir -p $(BINDIR) install -m 755 audit2allow $(BINDIR) - install -m 755 sepolgen-ifgen $(BINDIR) + install -m 755 sepolgen-ifgen $(SBINDIR) -mkdir -p $(MANDIR)/man1 install -m 644 audit2allow.1 $(MANDIR)/man1/ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/Makefile policycoreutils-2.0.9/audit2why/Makefile --- nsapolicycoreutils/audit2why/Makefile 2006-11-16 17:14:26.000000000 -0500 +++ policycoreutils-2.0.9/audit2why/Makefile 2007-04-18 14:28:26.000000000 -0400 @@ -1,6 +1,6 @@ # Installation directories. PREFIX ?= ${DESTDIR}/usr -BINDIR ?= $(PREFIX)/sbin +BINDIR ?= $(PREFIX)/bin LIBDIR ?= ${PREFIX}/lib MANDIR ?= $(PREFIX)/share/man LOCALEDIR ?= /usr/share/locale diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.9/Makefile --- nsapolicycoreutils/Makefile 2006-11-16 17:15:00.000000000 -0500 +++ policycoreutils-2.0.9/Makefile 2007-04-16 13:26:34.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui all install relabel clean indent: @for subdir in $(SUBDIRS); do \ diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.9/restorecon/restorecon.c --- nsapolicycoreutils/restorecon/restorecon.c 2006-11-16 17:14:26.000000000 -0500 +++ policycoreutils-2.0.9/restorecon/restorecon.c 2007-04-18 14:26:39.000000000 -0400 @@ -16,6 +16,7 @@ * -v Show changes in file labels. * -o filename save list of files with incorrect context * -F Force reset of context to match file_context for customizable files + * -l Limit directory tree walk to a single filesystem * * pathname... The file(s) to label * @@ -50,6 +51,7 @@ static int recurse = 0; static int file_exist = 1; static int force = 0; +static int onefs = 0; #define STAT_BLOCK_SIZE 1 static int pipe_fds[2] = { -1, -1 }; static unsigned long long count = 0; @@ -326,18 +328,20 @@ rc = fork(); if (rc == 0) { close(pipe_fds[0]); - nftw(buf, pre_stat, 1024, FTW_PHYS); + nftw(buf, pre_stat, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0)); exit(1); } if (rc > 0) close(pipe_fds[1]); if (rc == -1 || rc > 0) { - if (nftw(buf, apply_spec, 1024, FTW_PHYS)) { + if (nftw(buf, apply_spec, 1024, + FTW_PHYS | (onefs ? FTW_MOUNT : 0))) { if (!file_exist && errno == ENOENT) return; fprintf(stderr, - "%s: error while labeling files under %s\n", - progname, buf); + "%s: %s: %s\n", + progname, buf, strerror(errno)); errors++; } } @@ -367,11 +371,14 @@ set_matchpathcon_flags(MATCHPATHCON_NOTRANS); - while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) { + while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) { switch (opt) { case 'n': change = 0; break; + case 'l': + onefs = 1; + break; case 'i': file_exist = 0; break; diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.9/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2007-02-22 08:53:22.000000000 -0500 +++ policycoreutils-2.0.9/restorecond/restorecond.c 2007-04-16 13:26:34.000000000 -0400 @@ -210,9 +210,10 @@ } if (fsetfilecon(fd, scontext) < 0) { - syslog(LOG_ERR, - "set context %s->%s failed:'%s'\n", - filename, scontext, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, + "set context %s->%s failed:'%s'\n", + filename, scontext, strerror(errno)); if (retcontext >= 0) free(prev_context); free(scontext); @@ -225,8 +226,9 @@ if (retcontext >= 0) free(prev_context); } else { - syslog(LOG_ERR, "get context on %s failed: '%s'\n", - filename, strerror(errno)); + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, "get context on %s failed: '%s'\n", + filename, strerror(errno)); } free(scontext); close(fd); diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.9/restorecond/restorecond.conf --- nsapolicycoreutils/restorecond/restorecond.conf 2006-11-20 12:19:55.000000000 -0500 +++ policycoreutils-2.0.9/restorecond/restorecond.conf 2007-04-16 13:26:34.000000000 -0400 @@ -1,7 +1,10 @@ /etc/resolv.conf +/etc/localtime /etc/samba/secrets.tdb /etc/mtab /var/run/utmp +/var/run/faillog /var/log/wtmp +/etc/lvm/.cache ~/public_html ~/.mozilla/plugins/libflashplayer.so diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.init policycoreutils-2.0.9/restorecond/restorecond.init --- nsapolicycoreutils/restorecond/restorecond.init 2007-03-01 17:23:40.000000000 -0500 +++ policycoreutils-2.0.9/restorecond/restorecond.init 2007-04-16 13:26:34.000000000 -0400 @@ -73,6 +73,7 @@ ;; status) status restorecond + RETVAL=$? ;; restart|reload) restart diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.9/scripts/chcat --- nsapolicycoreutils/scripts/chcat 2007-02-22 08:53:22.000000000 -0500 +++ policycoreutils-2.0.9/scripts/chcat 2007-04-16 13:26:34.000000000 -0400 @@ -74,9 +74,11 @@ if i not in cats: cats.append(i) - new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ",")) - if new_serange[-1:] == ":": - new_serange = new_serange[:-1] + + if len(cats) > 0: + new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) + else + new_serange = "%s-%s" % (serange[0], top[0]) if add_ind: cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u) @@ -151,10 +153,11 @@ if i in cats: cats.remove(i) - new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ",")) - if new_serange[-1:] == ":": - new_serange = new_serange[:-1] - + if len(cats) > 0: + new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats)) + else + new_serange = "%s-%s" % (serange[0], top[0]) + if add_ind: cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u) else: diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.9/scripts/fixfiles --- nsapolicycoreutils/scripts/fixfiles 2007-01-11 08:56:30.000000000 -0500 +++ policycoreutils-2.0.9/scripts/fixfiles 2007-04-16 13:26:34.000000000 -0400 @@ -138,7 +138,7 @@ exit $? fi LogReadOnly -${SETFILES} ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE +${SETFILES} -q ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE exit $? } diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.9/scripts/genhomedircon --- nsapolicycoreutils/scripts/genhomedircon 2006-11-28 09:24:33.000000000 -0500 +++ policycoreutils-2.0.9/scripts/genhomedircon 2007-04-20 13:58:01.000000000 -0400 @@ -26,6 +26,7 @@ import sys, os, pwd, string, getopt, re from semanage import *; +import selinux import gettext gettext.install('policycoreutils') @@ -135,6 +136,9 @@ self.contextdir = "/contexts" self.filecontextdir = self.contextdir+"/files" self.usepwd = usepwd + self.default_user = "user_u" + self.default_prefix = "user" + self.users = self.getUsers() def getFileContextDir(self): return self.selinuxdir+self.type+self.filecontextdir @@ -211,6 +215,10 @@ prefs["prefix"] = prefix prefs["home"] = home udict[user] = prefs + + def setDefaultUser(self, user, prefix): + self.default_user = user + self.default_prefix = prefix def getUsers(self): udict = {} @@ -219,7 +227,11 @@ for seuser in list: user = [] seusername = semanage_seuser_get_sename(seuser) - self.adduser(udict, semanage_seuser_get_name(seuser), seusername, self.get_default_prefix(seusername)) + prefix = self.get_default_prefix(seusername) + if semanage_seuser_get_name(seuser) == "__default__": + self.setDefaultUser(seusername, prefix) + + self.adduser(udict, semanage_seuser_get_name(seuser), seusername, prefix) else: try: @@ -249,7 +261,10 @@ i = i.replace("HOME_DIR", home) i = i.replace("ROLE", prefix) i = i.replace("system_u", seuser) - ret = ret+i + # Validate if the generated context exists. Some user types may not exist + scon = i.split()[-1] + if selinux.security_check_context(scon) == 0: + ret = ret+i fd.close() return ret @@ -266,12 +281,11 @@ return ret def genHomeDirContext(self): - users = self.getUsers() ret = "" # Fill in HOME and prefix for users that are defined - for u in users.keys(): - ret += self.getHomeDirContext (u, users[u]["seuser"], users[u]["home"], users[u]["prefix"]) - ret += self.getUserContext (u, users[u]["seuser"], users[u]["prefix"]) + for u in self.users.keys(): + ret += self.getHomeDirContext (u, self.users[u]["seuser"], self.users[u]["home"], self.users[u]["prefix"]) + ret += self.getUserContext (u, self.users[u]["seuser"], self.users[u]["prefix"]) return ret+"\n" def checkExists(self, home): @@ -318,9 +332,9 @@ def genoutput(self): ret = self.heading() for h in self.getHomeDirs(): - ret += self.getHomeDirContext ("user_u", "user_u" , h+'/[^/]*', "user") + ret += self.getHomeDirContext (self.default_user, self.default_user, h+'/[^/]*', self.default_prefix) ret += self.getHomeRootContext(h) - ret += self.getUserContext(".*", "user_u", "user") + "\n" + ret += self.getUserContext(".*", self.default_user, self.default_prefix) + "\n" ret += self.genHomeDirContext() return ret diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.9/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2007-04-12 12:43:06.000000000 -0400 +++ policycoreutils-2.0.9/semanage/seobject.py 2007-04-16 13:26:34.000000000 -0400 @@ -210,6 +210,7 @@ os.write(fd, self.out()) os.close(fd) os.rename(newfilename, self.filename) + os.system("/sbin/service mcstrans reload > /dev/null") class semanageRecords: def __init__(self): @@ -1283,9 +1284,12 @@ raise ValueError(_("Could not list booleans")) for boolean in self.blist: - name = semanage_bool_get_name(boolean) - value = semanage_bool_get_value(boolean) - ddict[name] = value + value = [] + name = semanage_bool_get_name(boolean) + value[0] = semanage_bool_get_value(boolean) + value[1] = selinux.security_get_boolean_pending(boolean) + value[2] = selinux.security_get_boolean_active(boolean) + ddict[name] = value return ddict