- Updated version of policycoreutils * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh.
244 lines
9.7 KiB
Diff
244 lines
9.7 KiB
Diff
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.9/audit2allow/Makefile
|
|
--- nsapolicycoreutils/audit2allow/Makefile 2007-02-07 12:11:49.000000000 -0500
|
|
+++ policycoreutils-2.0.9/audit2allow/Makefile 2007-04-23 13:08:07.000000000 -0400
|
|
@@ -1,6 +1,7 @@
|
|
# Installation directories.
|
|
PREFIX ?= ${DESTDIR}/usr
|
|
BINDIR ?= $(PREFIX)/bin
|
|
+SBINDIR ?= $(PREFIX)/sbin
|
|
LIBDIR ?= $(PREFIX)/lib
|
|
MANDIR ?= $(PREFIX)/share/man
|
|
LOCALEDIR ?= /usr/share/locale
|
|
@@ -10,7 +11,7 @@
|
|
install: all
|
|
-mkdir -p $(BINDIR)
|
|
install -m 755 audit2allow $(BINDIR)
|
|
- install -m 755 sepolgen-ifgen $(BINDIR)
|
|
+ install -m 755 sepolgen-ifgen $(SBINDIR)
|
|
-mkdir -p $(MANDIR)/man1
|
|
install -m 644 audit2allow.1 $(MANDIR)/man1/
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/Makefile policycoreutils-2.0.9/audit2why/Makefile
|
|
--- nsapolicycoreutils/audit2why/Makefile 2006-11-16 17:14:26.000000000 -0500
|
|
+++ policycoreutils-2.0.9/audit2why/Makefile 2007-04-18 14:28:26.000000000 -0400
|
|
@@ -1,6 +1,6 @@
|
|
# Installation directories.
|
|
PREFIX ?= ${DESTDIR}/usr
|
|
-BINDIR ?= $(PREFIX)/sbin
|
|
+BINDIR ?= $(PREFIX)/bin
|
|
LIBDIR ?= ${PREFIX}/lib
|
|
MANDIR ?= $(PREFIX)/share/man
|
|
LOCALEDIR ?= /usr/share/locale
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/ChangeLog policycoreutils-2.0.9/ChangeLog
|
|
--- nsapolicycoreutils/ChangeLog 2007-04-24 10:36:17.000000000 -0400
|
|
+++ policycoreutils-2.0.9/ChangeLog 2007-04-12 12:43:10.000000000 -0400
|
|
@@ -1,6 +1,3 @@
|
|
-2.0.10 2007-04-24
|
|
- * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh.
|
|
-
|
|
2.0.9 2007-04-12
|
|
* Merged seobject setransRecords patch to return the first alias from Xavier Toth.
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.9/Makefile
|
|
--- nsapolicycoreutils/Makefile 2006-11-16 17:15:00.000000000 -0500
|
|
+++ policycoreutils-2.0.9/Makefile 2007-04-16 13:26:34.000000000 -0400
|
|
@@ -1,4 +1,4 @@
|
|
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
|
|
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
|
|
|
|
all install relabel clean indent:
|
|
@for subdir in $(SUBDIRS); do \
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.9/restorecon/restorecon.c
|
|
--- nsapolicycoreutils/restorecon/restorecon.c 2007-04-24 10:36:17.000000000 -0400
|
|
+++ policycoreutils-2.0.9/restorecon/restorecon.c 2007-04-18 14:26:39.000000000 -0400
|
|
@@ -16,6 +16,7 @@
|
|
* -v Show changes in file labels.
|
|
* -o filename save list of files with incorrect context
|
|
* -F Force reset of context to match file_context for customizable files
|
|
+ * -l Limit directory tree walk to a single filesystem
|
|
*
|
|
* pathname... The file(s) to label
|
|
*
|
|
@@ -50,6 +51,7 @@
|
|
static int recurse = 0;
|
|
static int file_exist = 1;
|
|
static int force = 0;
|
|
+static int onefs = 0;
|
|
#define STAT_BLOCK_SIZE 1
|
|
static int pipe_fds[2] = { -1, -1 };
|
|
static unsigned long long count = 0;
|
|
@@ -326,17 +328,19 @@
|
|
rc = fork();
|
|
if (rc == 0) {
|
|
close(pipe_fds[0]);
|
|
- nftw(buf, pre_stat, 1024, FTW_PHYS);
|
|
+ nftw(buf, pre_stat, 1024,
|
|
+ FTW_PHYS | (onefs ? FTW_MOUNT : 0));
|
|
exit(1);
|
|
}
|
|
if (rc > 0)
|
|
close(pipe_fds[1]);
|
|
if (rc == -1 || rc > 0) {
|
|
- if (nftw(buf, apply_spec, 1024, FTW_PHYS)) {
|
|
+ if (nftw(buf, apply_spec, 1024,
|
|
+ FTW_PHYS | (onefs ? FTW_MOUNT : 0))) {
|
|
if (!file_exist && errno == ENOENT)
|
|
return;
|
|
fprintf(stderr,
|
|
- "%s: error while traversing %s: %s\n",
|
|
+ "%s: %s: %s\n",
|
|
progname, buf, strerror(errno));
|
|
errors++;
|
|
}
|
|
@@ -367,11 +371,14 @@
|
|
|
|
set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
|
|
|
|
- while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) {
|
|
+ while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) {
|
|
switch (opt) {
|
|
case 'n':
|
|
change = 0;
|
|
break;
|
|
+ case 'l':
|
|
+ onefs = 1;
|
|
+ break;
|
|
case 'i':
|
|
file_exist = 0;
|
|
break;
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.9/restorecond/restorecond.c
|
|
--- nsapolicycoreutils/restorecond/restorecond.c 2007-02-22 08:53:22.000000000 -0500
|
|
+++ policycoreutils-2.0.9/restorecond/restorecond.c 2007-04-16 13:26:34.000000000 -0400
|
|
@@ -210,9 +210,10 @@
|
|
}
|
|
|
|
if (fsetfilecon(fd, scontext) < 0) {
|
|
- syslog(LOG_ERR,
|
|
- "set context %s->%s failed:'%s'\n",
|
|
- filename, scontext, strerror(errno));
|
|
+ if (errno != EOPNOTSUPP)
|
|
+ syslog(LOG_ERR,
|
|
+ "set context %s->%s failed:'%s'\n",
|
|
+ filename, scontext, strerror(errno));
|
|
if (retcontext >= 0)
|
|
free(prev_context);
|
|
free(scontext);
|
|
@@ -225,8 +226,9 @@
|
|
if (retcontext >= 0)
|
|
free(prev_context);
|
|
} else {
|
|
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
- filename, strerror(errno));
|
|
+ if (errno != EOPNOTSUPP)
|
|
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
|
|
+ filename, strerror(errno));
|
|
}
|
|
free(scontext);
|
|
close(fd);
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.9/restorecond/restorecond.conf
|
|
--- nsapolicycoreutils/restorecond/restorecond.conf 2006-11-20 12:19:55.000000000 -0500
|
|
+++ policycoreutils-2.0.9/restorecond/restorecond.conf 2007-04-16 13:26:34.000000000 -0400
|
|
@@ -1,7 +1,10 @@
|
|
/etc/resolv.conf
|
|
+/etc/localtime
|
|
/etc/samba/secrets.tdb
|
|
/etc/mtab
|
|
/var/run/utmp
|
|
+/var/run/faillog
|
|
/var/log/wtmp
|
|
+/etc/lvm/.cache
|
|
~/public_html
|
|
~/.mozilla/plugins/libflashplayer.so
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.9/scripts/genhomedircon
|
|
--- nsapolicycoreutils/scripts/genhomedircon 2007-04-24 10:36:17.000000000 -0400
|
|
+++ policycoreutils-2.0.9/scripts/genhomedircon 2007-04-20 13:58:01.000000000 -0400
|
|
@@ -136,6 +136,9 @@
|
|
self.contextdir = "/contexts"
|
|
self.filecontextdir = self.contextdir+"/files"
|
|
self.usepwd = usepwd
|
|
+ self.default_user = "user_u"
|
|
+ self.default_prefix = "user"
|
|
+ self.users = self.getUsers()
|
|
|
|
def getFileContextDir(self):
|
|
return self.selinuxdir+self.type+self.filecontextdir
|
|
@@ -212,6 +215,10 @@
|
|
prefs["prefix"] = prefix
|
|
prefs["home"] = home
|
|
udict[user] = prefs
|
|
+
|
|
+ def setDefaultUser(self, user, prefix):
|
|
+ self.default_user = user
|
|
+ self.default_prefix = prefix
|
|
|
|
def getUsers(self):
|
|
udict = {}
|
|
@@ -220,7 +227,11 @@
|
|
for seuser in list:
|
|
user = []
|
|
seusername = semanage_seuser_get_sename(seuser)
|
|
- self.adduser(udict, semanage_seuser_get_name(seuser), seusername, self.get_default_prefix(seusername))
|
|
+ prefix = self.get_default_prefix(seusername)
|
|
+ if semanage_seuser_get_name(seuser) == "__default__":
|
|
+ self.setDefaultUser(seusername, prefix)
|
|
+
|
|
+ self.adduser(udict, semanage_seuser_get_name(seuser), seusername, prefix)
|
|
|
|
else:
|
|
try:
|
|
@@ -270,12 +281,11 @@
|
|
return ret
|
|
|
|
def genHomeDirContext(self):
|
|
- users = self.getUsers()
|
|
ret = ""
|
|
# Fill in HOME and prefix for users that are defined
|
|
- for u in users.keys():
|
|
- ret += self.getHomeDirContext (u, users[u]["seuser"], users[u]["home"], users[u]["prefix"])
|
|
- ret += self.getUserContext (u, users[u]["seuser"], users[u]["prefix"])
|
|
+ for u in self.users.keys():
|
|
+ ret += self.getHomeDirContext (u, self.users[u]["seuser"], self.users[u]["home"], self.users[u]["prefix"])
|
|
+ ret += self.getUserContext (u, self.users[u]["seuser"], self.users[u]["prefix"])
|
|
return ret+"\n"
|
|
|
|
def checkExists(self, home):
|
|
@@ -322,9 +332,9 @@
|
|
def genoutput(self):
|
|
ret = self.heading()
|
|
for h in self.getHomeDirs():
|
|
- ret += self.getHomeDirContext ("user_u", "user_u" , h+'/[^/]*', "user")
|
|
+ ret += self.getHomeDirContext (self.default_user, self.default_user, h+'/[^/]*', self.default_prefix)
|
|
ret += self.getHomeRootContext(h)
|
|
- ret += self.getUserContext(".*", "user_u", "user") + "\n"
|
|
+ ret += self.getUserContext(".*", self.default_user, self.default_prefix) + "\n"
|
|
ret += self.genHomeDirContext()
|
|
return ret
|
|
|
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.9/semanage/seobject.py
|
|
--- nsapolicycoreutils/semanage/seobject.py 2007-04-12 12:43:06.000000000 -0400
|
|
+++ policycoreutils-2.0.9/semanage/seobject.py 2007-04-16 13:26:34.000000000 -0400
|
|
@@ -210,6 +210,7 @@
|
|
os.write(fd, self.out())
|
|
os.close(fd)
|
|
os.rename(newfilename, self.filename)
|
|
+ os.system("/sbin/service mcstrans reload > /dev/null")
|
|
|
|
class semanageRecords:
|
|
def __init__(self):
|
|
@@ -1283,9 +1284,12 @@
|
|
raise ValueError(_("Could not list booleans"))
|
|
|
|
for boolean in self.blist:
|
|
- name = semanage_bool_get_name(boolean)
|
|
- value = semanage_bool_get_value(boolean)
|
|
- ddict[name] = value
|
|
+ value = []
|
|
+ name = semanage_bool_get_name(boolean)
|
|
+ value[0] = semanage_bool_get_value(boolean)
|
|
+ value[1] = selinux.security_get_boolean_pending(boolean)
|
|
+ value[2] = selinux.security_get_boolean_active(boolean)
|
|
+ ddict[name] = value
|
|
|
|
return ddict
|
|
|