620 lines
21 KiB
Diff
620 lines
21 KiB
Diff
diff --git selinux-python-2.9-rc1/Makefile selinux-python-2.9-rc1/Makefile
|
|
index 9b66d52..00312db 100644
|
|
--- selinux-python-2.9-rc1/Makefile
|
|
+++ selinux-python-2.9-rc1/Makefile
|
|
@@ -1,4 +1,4 @@
|
|
-SUBDIRS = sepolicy audit2allow semanage sepolgen chcat
|
|
+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po
|
|
|
|
all install relabel clean indent test:
|
|
@for subdir in $(SUBDIRS); do \
|
|
diff --git selinux-python-2.9-rc1/chcat/chcat selinux-python-2.9-rc1/chcat/chcat
|
|
index 5bef007..27c537e 100755
|
|
--- selinux-python-2.9-rc1/chcat/chcat
|
|
+++ selinux-python-2.9-rc1/chcat/chcat
|
|
@@ -30,7 +30,7 @@ import getopt
|
|
import selinux
|
|
import seobject
|
|
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
diff --git selinux-python-2.9-rc1/po/Makefile selinux-python-2.9-rc1/po/Makefile
|
|
new file mode 100644
|
|
index 0000000..4e052d5
|
|
--- /dev/null
|
|
+++ selinux-python-2.9-rc1/po/Makefile
|
|
@@ -0,0 +1,83 @@
|
|
+#
|
|
+# Makefile for the PO files (translation) catalog
|
|
+#
|
|
+
|
|
+PREFIX ?= /usr
|
|
+
|
|
+# What is this package?
|
|
+NLSPACKAGE = python
|
|
+POTFILE = $(NLSPACKAGE).pot
|
|
+INSTALL = /usr/bin/install -c -p
|
|
+INSTALL_DATA = $(INSTALL) -m 644
|
|
+INSTALL_DIR = /usr/bin/install -d
|
|
+
|
|
+# destination directory
|
|
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
|
+
|
|
+# PO catalog handling
|
|
+MSGMERGE = msgmerge
|
|
+MSGMERGE_FLAGS = -q
|
|
+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE)
|
|
+MSGFMT = msgfmt
|
|
+
|
|
+# All possible linguas
|
|
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
|
+
|
|
+# Only the files matching what the user has set in LINGUAS
|
|
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
|
+
|
|
+# if no valid LINGUAS, build all languages
|
|
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
|
+
|
|
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
|
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
|
+POTFILES = $(shell cat POTFILES)
|
|
+
|
|
+#default:: clean
|
|
+
|
|
+all:: $(MOFILES)
|
|
+
|
|
+$(POTFILE): $(POTFILES)
|
|
+ $(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)
|
|
+ $(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade
|
|
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
|
+ rm -f $(NLSPACKAGE).po; \
|
|
+ else \
|
|
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
|
+ fi; \
|
|
+
|
|
+
|
|
+refresh-po: Makefile
|
|
+ for cat in $(POFILES); do \
|
|
+ lang=`basename $$cat .po`; \
|
|
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
|
+ mv -f $$lang.pot $$lang.po ; \
|
|
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
|
+ else \
|
|
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
|
+ rm -f $$lang.pot ; \
|
|
+ fi \
|
|
+ done
|
|
+
|
|
+clean:
|
|
+ @rm -fv *mo *~ .depend
|
|
+ @rm -rf tmp
|
|
+
|
|
+install: $(MOFILES)
|
|
+ @for n in $(MOFILES); do \
|
|
+ l=`basename $$n .mo`; \
|
|
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
|
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
|
+ done
|
|
+
|
|
+%.mo: %.po
|
|
+ $(MSGFMT) -o $@ $<
|
|
+report:
|
|
+ @for cat in $(wildcard *.po); do \
|
|
+ echo -n "$$cat: "; \
|
|
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
|
+ done
|
|
+
|
|
+.PHONY: missing depend
|
|
+
|
|
+relabel:
|
|
diff --git selinux-python-2.9-rc1/po/POTFILES selinux-python-2.9-rc1/po/POTFILES
|
|
new file mode 100644
|
|
index 0000000..128eb87
|
|
--- /dev/null
|
|
+++ selinux-python-2.9-rc1/po/POTFILES
|
|
@@ -0,0 +1,10 @@
|
|
+../audit2allow/audit2allow
|
|
+../chcat/chcat
|
|
+../semanage/semanage
|
|
+../semanage/seobject.py
|
|
+../sepolgen/src/sepolgen/interfaces.py
|
|
+../sepolicy/sepolicy/generate.py
|
|
+../sepolicy/sepolicy/gui.py
|
|
+../sepolicy/sepolicy/__init__.py
|
|
+../sepolicy/sepolicy/interface.py
|
|
+../sepolicy/sepolicy.py
|
|
diff --git selinux-python-2.9-rc1/semanage/semanage selinux-python-2.9-rc1/semanage/semanage
|
|
index 49add51..18f4a6a 100644
|
|
--- selinux-python-2.9-rc1/semanage/semanage
|
|
+++ selinux-python-2.9-rc1/semanage/semanage
|
|
@@ -27,7 +27,7 @@ import traceback
|
|
import argparse
|
|
import seobject
|
|
import sys
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
@@ -609,19 +609,19 @@ def setupInterfaceParser(subparsers):
|
|
|
|
def handleModule(args):
|
|
OBJECT = seobject.moduleRecords(args)
|
|
- if args.action == "add":
|
|
- OBJECT.add(args.module_name, args.priority)
|
|
- if args.action == "enable":
|
|
- OBJECT.set_enabled(args.module_name, True)
|
|
- if args.action == "disable":
|
|
- OBJECT.set_enabled(args.module_name, False)
|
|
- if args.action == "remove":
|
|
- OBJECT.delete(args.module_name, args.priority)
|
|
- if args.action is "deleteall":
|
|
+ if args.action_add:
|
|
+ OBJECT.add(args.action_add, args.priority)
|
|
+ if args.action_enable:
|
|
+ OBJECT.set_enabled(args.action_enable, True)
|
|
+ if args.action_disable:
|
|
+ OBJECT.set_enabled(args.action_disable, False)
|
|
+ if args.action_remove:
|
|
+ OBJECT.delete(args.action_remove, args.priority)
|
|
+ if args.action == "deleteall":
|
|
OBJECT.deleteall()
|
|
if args.action == "list":
|
|
OBJECT.list(args.noheading, args.locallist)
|
|
- if args.action is "extract":
|
|
+ if args.action == "extract":
|
|
for i in OBJECT.customized():
|
|
print("module %s" % str(i))
|
|
|
|
@@ -635,14 +635,13 @@ def setupModuleParser(subparsers):
|
|
parser_add_priority(moduleParser, "module")
|
|
|
|
mgroup = moduleParser.add_mutually_exclusive_group(required=True)
|
|
- parser_add_add(mgroup, "module")
|
|
parser_add_list(mgroup, "module")
|
|
parser_add_extract(mgroup, "module")
|
|
parser_add_deleteall(mgroup, "module")
|
|
- mgroup.add_argument('-r', '--remove', dest='action', action='store_const', const='remove', help=_("Remove a module"))
|
|
- mgroup.add_argument('-d', '--disable', dest='action', action='store_const', const='disable', help=_("Disable a module"))
|
|
- mgroup.add_argument('-e', '--enable', dest='action', action='store_const', const='enable', help=_("Enable a module"))
|
|
- moduleParser.add_argument('module_name', nargs='?', default=None, help=_('Name of the module to act on'))
|
|
+ mgroup.add_argument('-a', '--add', dest='action_add', action='store', nargs=1, metavar='module_name', help=_("Add a module"))
|
|
+ mgroup.add_argument('-r', '--remove', dest='action_remove', action='store', nargs='+', metavar='module_name', help=_("Remove a module"))
|
|
+ mgroup.add_argument('-d', '--disable', dest='action_disable', action='store', nargs='+', metavar='module_name', help=_("Disable a module"))
|
|
+ mgroup.add_argument('-e', '--enable', dest='action_enable', action='store', nargs='+', metavar='module_name', help=_("Enable a module"))
|
|
moduleParser.set_defaults(func=handleModule)
|
|
|
|
|
|
@@ -744,9 +743,7 @@ def handlePermissive(args):
|
|
if args.action is "delete":
|
|
OBJECT.delete(args.type)
|
|
else:
|
|
- args.parser.print_usage(sys.stderr)
|
|
- sys.stderr.write(_('semanage permissive: error: the following argument is required: type\n'))
|
|
- sys.exit(1)
|
|
+ args.parser.error(message=_('semanage permissive: error: the following argument is required: type\n'))
|
|
|
|
|
|
def setupPermissiveParser(subparsers):
|
|
diff --git selinux-python-2.9-rc1/semanage/semanage.8 selinux-python-2.9-rc1/semanage/semanage.8
|
|
index 0bdb90f..0cdcfcc 100644
|
|
--- selinux-python-2.9-rc1/semanage/semanage.8
|
|
+++ selinux-python-2.9-rc1/semanage/semanage.8
|
|
@@ -57,9 +57,8 @@ to SELinux user identities (which controls the initial security context
|
|
assigned to Linux users when they login and bounds their authorized role set)
|
|
as well as security context mappings for various kinds of objects, such
|
|
as network ports, interfaces, infiniband pkeys and endports, and nodes (hosts)
|
|
-as well as the file context mapping. See the EXAMPLES section below for some
|
|
-examples of common usage. Note that the semanage login command deals with the
|
|
-mapping from Linux usernames (logins) to SELinux user identities,
|
|
+as well as the file context mapping. Note that the semanage login command deals
|
|
+with the mapping from Linux usernames (logins) to SELinux user identities,
|
|
while the semanage user command deals with the mapping from SELinux
|
|
user identities to authorized role sets. In most cases, only the
|
|
former mapping needs to be adjusted by the administrator; the latter
|
|
diff --git selinux-python-2.9-rc1/semanage/seobject.py selinux-python-2.9-rc1/semanage/seobject.py
|
|
index 556d3ba..c9aaebe 100644
|
|
--- selinux-python-2.9-rc1/semanage/seobject.py
|
|
+++ selinux-python-2.9-rc1/semanage/seobject.py
|
|
@@ -30,10 +30,10 @@ import sys
|
|
import stat
|
|
import socket
|
|
from semanage import *
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
import sepolicy
|
|
import setools
|
|
-from IPy import IP
|
|
+import ipaddress
|
|
|
|
try:
|
|
import gettext
|
|
@@ -401,6 +401,8 @@ class moduleRecords(semanageRecords):
|
|
print("%-25s %-9s %-5s %s" % (t[0], t[2], t[3], disabled))
|
|
|
|
def add(self, file, priority):
|
|
+ if type(file) == list:
|
|
+ file = file[0]
|
|
if not os.path.exists(file):
|
|
raise ValueError(_("Module does not exist: %s ") % file)
|
|
|
|
@@ -413,7 +415,9 @@ class moduleRecords(semanageRecords):
|
|
self.commit()
|
|
|
|
def set_enabled(self, module, enable):
|
|
- for m in module.split():
|
|
+ if type(module) == str:
|
|
+ module = module.split()
|
|
+ for m in module:
|
|
rc, key = semanage_module_key_create(self.sh)
|
|
if rc < 0:
|
|
raise ValueError(_("Could not create module key"))
|
|
@@ -435,7 +439,9 @@ class moduleRecords(semanageRecords):
|
|
if rc < 0:
|
|
raise ValueError(_("Invalid priority %d (needs to be between 1 and 999)") % priority)
|
|
|
|
- for m in module.split():
|
|
+ if type(module) == str:
|
|
+ module = module.split()
|
|
+ for m in module:
|
|
rc = semanage_module_remove(self.sh, m)
|
|
if rc < 0 and rc != -2:
|
|
raise ValueError(_("Could not remove module %s (remove failed)") % m)
|
|
@@ -1852,13 +1858,13 @@ class nodeRecords(semanageRecords):
|
|
|
|
# verify valid comination
|
|
if len(mask) == 0 or mask[0] == "/":
|
|
- i = IP(addr + mask)
|
|
- newaddr = i.strNormal(0)
|
|
- newmask = str(i.netmask())
|
|
- if newmask == "0.0.0.0" and i.version() == 6:
|
|
+ i = ipaddress.ip_network(addr + mask)
|
|
+ newaddr = str(i.network_address)
|
|
+ newmask = str(i.netmask)
|
|
+ if newmask == "0.0.0.0" and i.version == 6:
|
|
newmask = "::"
|
|
|
|
- protocol = "ipv%d" % i.version()
|
|
+ protocol = "ipv%d" % i.version
|
|
|
|
try:
|
|
newprotocol = self.protocol.index(protocol)
|
|
diff --git selinux-python-2.9-rc1/sepolgen/src/sepolgen/sepolgeni18n.py selinux-python-2.9-rc1/sepolgen/src/sepolgen/sepolgeni18n.py
|
|
index 998c435..56ebd80 100644
|
|
--- selinux-python-2.9-rc1/sepolgen/src/sepolgen/sepolgeni18n.py
|
|
+++ selinux-python-2.9-rc1/sepolgen/src/sepolgen/sepolgeni18n.py
|
|
@@ -19,7 +19,7 @@
|
|
|
|
try:
|
|
import gettext
|
|
- t = gettext.translation( 'yumex' )
|
|
+ t = gettext.translation( 'selinux-python' )
|
|
_ = t.gettext
|
|
except:
|
|
def _(str):
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy.py selinux-python-2.9-rc1/sepolicy/sepolicy.py
|
|
index 8cc7e8c..759f43e 100755
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy.py
|
|
@@ -27,7 +27,7 @@ import selinux
|
|
import sepolicy
|
|
from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text
|
|
import argparse
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy/__init__.py selinux-python-2.9-rc1/sepolicy/sepolicy/__init__.py
|
|
index 6f72947..1b116f6 100644
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy/__init__.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy/__init__.py
|
|
@@ -15,7 +15,7 @@ import os
|
|
import re
|
|
import gzip
|
|
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
@@ -1211,27 +1211,14 @@ def boolean_desc(boolean):
|
|
|
|
|
|
def get_os_version():
|
|
- os_version = ""
|
|
- pkg_name = "selinux-policy"
|
|
+ system_release = ""
|
|
try:
|
|
- try:
|
|
- from commands import getstatusoutput
|
|
- except ImportError:
|
|
- from subprocess import getstatusoutput
|
|
- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name)
|
|
- if rc == 0:
|
|
- os_version = output.split(".")[-2]
|
|
- except:
|
|
- os_version = ""
|
|
-
|
|
- if os_version[0:2] == "fc":
|
|
- os_version = "Fedora" + os_version[2:]
|
|
- elif os_version[0:2] == "el":
|
|
- os_version = "RHEL" + os_version[2:]
|
|
- else:
|
|
- os_version = ""
|
|
+ with open('/etc/system-release') as f:
|
|
+ system_release = f.readline().rstrip()
|
|
+ except IOError:
|
|
+ system_release = "Misc"
|
|
|
|
- return os_version
|
|
+ return system_release
|
|
|
|
|
|
def reinit():
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy/generate.py selinux-python-2.9-rc1/sepolicy/sepolicy/generate.py
|
|
index 37ddfc7..a25a749 100644
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy/generate.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy/generate.py
|
|
@@ -51,7 +51,7 @@ import sepolgen.defaults as defaults
|
|
##
|
|
## I18N
|
|
##
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
@@ -102,7 +102,9 @@ def get_all_ports():
|
|
for p in sepolicy.info(sepolicy.PORT):
|
|
if p['type'] == "reserved_port_t" or \
|
|
p['type'] == "port_t" or \
|
|
- p['type'] == "hi_reserved_port_t":
|
|
+ p['type'] == "hi_reserved_port_t" or \
|
|
+ p['type'] == "ephemeral_port_t" or \
|
|
+ p['type'] == "unreserved_port_t":
|
|
continue
|
|
dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
|
|
return dict
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy/gui.py selinux-python-2.9-rc1/sepolicy/sepolicy/gui.py
|
|
index fde233a..fe9e630 100644
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy/gui.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy/gui.py
|
|
@@ -43,7 +43,7 @@ import os
|
|
import re
|
|
import unicodedata
|
|
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy/interface.py selinux-python-2.9-rc1/sepolicy/sepolicy/interface.py
|
|
index 18374dc..ca0122d 100644
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy/interface.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy/interface.py
|
|
@@ -32,7 +32,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us
|
|
##
|
|
## I18N
|
|
##
|
|
-PROGNAME = "policycoreutils"
|
|
+PROGNAME = "selinux-python"
|
|
try:
|
|
import gettext
|
|
kwargs = {}
|
|
diff --git selinux-python-2.9-rc1/sepolicy/sepolicy/manpage.py selinux-python-2.9-rc1/sepolicy/sepolicy/manpage.py
|
|
index cfcb7c3..2cb3c7e 100755
|
|
--- selinux-python-2.9-rc1/sepolicy/sepolicy/manpage.py
|
|
+++ selinux-python-2.9-rc1/sepolicy/sepolicy/manpage.py
|
|
@@ -126,8 +126,33 @@ def gen_domains():
|
|
domains.sort()
|
|
return domains
|
|
|
|
-types = None
|
|
|
|
+exec_types = None
|
|
+
|
|
+def _gen_exec_types():
|
|
+ global exec_types
|
|
+ if exec_types is None:
|
|
+ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"]
|
|
+ return exec_types
|
|
+
|
|
+entry_types = None
|
|
+
|
|
+def _gen_entry_types():
|
|
+ global entry_types
|
|
+ if entry_types is None:
|
|
+ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
|
|
+ return entry_types
|
|
+
|
|
+mcs_constrained_types = None
|
|
+
|
|
+def _gen_mcs_constrained_types():
|
|
+ global mcs_constrained_types
|
|
+ if mcs_constrained_types is None:
|
|
+ mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
|
+ return mcs_constrained_types
|
|
+
|
|
+
|
|
+types = None
|
|
|
|
def _gen_types():
|
|
global types
|
|
@@ -150,10 +175,6 @@ def prettyprint(f, trim):
|
|
manpage_domains = []
|
|
manpage_roles = []
|
|
|
|
-fedora_releases = ["Fedora17", "Fedora18"]
|
|
-rhel_releases = ["RHEL6", "RHEL7"]
|
|
-
|
|
-
|
|
def get_alphabet_manpages(manpage_list):
|
|
alphabet_manpages = dict.fromkeys(string.ascii_letters, [])
|
|
for i in string.ascii_letters:
|
|
@@ -183,7 +204,7 @@ def convert_manpage_to_html(html_manpage, manpage):
|
|
class HTMLManPages:
|
|
|
|
"""
|
|
- Generate a HHTML Manpages on an given SELinux domains
|
|
+ Generate a HTML Manpages on an given SELinux domains
|
|
"""
|
|
|
|
def __init__(self, manpage_roles, manpage_domains, path, os_version):
|
|
@@ -191,9 +212,9 @@ class HTMLManPages:
|
|
self.manpage_domains = get_alphabet_manpages(manpage_domains)
|
|
self.os_version = os_version
|
|
self.old_path = path + "/"
|
|
- self.new_path = self.old_path + self.os_version + "/"
|
|
+ self.new_path = self.old_path
|
|
|
|
- if self.os_version in fedora_releases or self.os_version in rhel_releases:
|
|
+ if self.os_version:
|
|
self.__gen_html_manpages()
|
|
else:
|
|
print("SELinux HTML man pages can not be generated for this %s" % os_version)
|
|
@@ -202,7 +223,6 @@ class HTMLManPages:
|
|
def __gen_html_manpages(self):
|
|
self._write_html_manpage()
|
|
self._gen_index()
|
|
- self._gen_body()
|
|
self._gen_css()
|
|
|
|
def _write_html_manpage(self):
|
|
@@ -220,67 +240,21 @@ class HTMLManPages:
|
|
convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r)
|
|
|
|
def _gen_index(self):
|
|
- index = self.old_path + "index.html"
|
|
- fd = open(index, 'w')
|
|
- fd.write("""
|
|
-<html>
|
|
-<head>
|
|
- <link rel=stylesheet type="text/css" href="style.css" title="style">
|
|
- <title>SELinux man pages online</title>
|
|
-</head>
|
|
-<body>
|
|
-<h1>SELinux man pages</h1>
|
|
-<br></br>
|
|
-Fedora or Red Hat Enterprise Linux Man Pages.</h2>
|
|
-<br></br>
|
|
-<hr>
|
|
-<h3>Fedora</h3>
|
|
-<table><tr>
|
|
-<td valign="middle">
|
|
-</td>
|
|
-</tr></table>
|
|
-<pre>
|
|
-""")
|
|
- for f in fedora_releases:
|
|
- fd.write("""
|
|
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (f, f, f, f))
|
|
-
|
|
- fd.write("""
|
|
-</pre>
|
|
-<hr>
|
|
-<h3>RHEL</h3>
|
|
-<table><tr>
|
|
-<td valign="middle">
|
|
-</td>
|
|
-</tr></table>
|
|
-<pre>
|
|
-""")
|
|
- for r in rhel_releases:
|
|
- fd.write("""
|
|
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (r, r, r, r))
|
|
-
|
|
- fd.write("""
|
|
-</pre>
|
|
- """)
|
|
- fd.close()
|
|
- print("%s has been created" % index)
|
|
-
|
|
- def _gen_body(self):
|
|
html = self.new_path + self.os_version + ".html"
|
|
fd = open(html, 'w')
|
|
fd.write("""
|
|
<html>
|
|
<head>
|
|
- <link rel=stylesheet type="text/css" href="../style.css" title="style">
|
|
- <title>Linux man-pages online for Fedora18</title>
|
|
+ <link rel=stylesheet type="text/css" href="style.css" title="style">
|
|
+ <title>SELinux man pages</title>
|
|
</head>
|
|
<body>
|
|
-<h1>SELinux man pages for Fedora18</h1>
|
|
+<h1>SELinux man pages for %s</h1>
|
|
<hr>
|
|
<table><tr>
|
|
<td valign="middle">
|
|
<h3>SELinux roles</h3>
|
|
-""")
|
|
+""" % self.os_version)
|
|
for letter in self.manpage_roles:
|
|
if len(self.manpage_roles[letter]):
|
|
fd.write("""
|
|
@@ -424,6 +398,9 @@ class ManPage:
|
|
self.all_file_types = sepolicy.get_all_file_types()
|
|
self.role_allows = sepolicy.get_all_role_allows()
|
|
self.types = _gen_types()
|
|
+ self.exec_types = _gen_exec_types()
|
|
+ self.entry_types = _gen_entry_types()
|
|
+ self.mcs_constrained_types = _gen_mcs_constrained_types()
|
|
|
|
if self.source_files:
|
|
self.fcpath = self.root + "file_contexts"
|
|
@@ -736,10 +713,13 @@ Default Defined Ports:""")
|
|
|
|
def _file_context(self):
|
|
flist = []
|
|
+ flist_non_exec = []
|
|
mpaths = []
|
|
for f in self.all_file_types:
|
|
if f.startswith(self.domainname):
|
|
flist.append(f)
|
|
+ if not f in self.exec_types or not f in self.entry_types:
|
|
+ flist_non_exec.append(f)
|
|
if f in self.fcdict:
|
|
mpaths = mpaths + self.fcdict[f]["regex"]
|
|
if len(mpaths) == 0:
|
|
@@ -791,19 +771,20 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
|
.PP
|
|
""" % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
|
|
|
|
- self.fd.write(r"""
|
|
+ if flist_non_exec:
|
|
+ self.fd.write(r"""
|
|
.PP
|
|
.B STANDARD FILE CONTEXT
|
|
|
|
SELinux defines the file context types for the %(domainname)s, if you wanted to
|
|
store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk.
|
|
|
|
-.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
|
|
+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
|
|
.br
|
|
.B restorecon -R -v /srv/my%(domainname)s_content
|
|
|
|
Note: SELinux often uses regular expressions to specify labels that match multiple files.
|
|
-""" % {'domainname': self.domainname, "type": flist[0]})
|
|
+""" % {'domainname': self.domainname, "type": flist_non_exec[-1]})
|
|
|
|
self.fd.write(r"""
|
|
.I The following file types are defined for %(domainname)s:
|
|
@@ -974,11 +955,7 @@ All executeables with the default executable label, usually stored in /usr/bin a
|
|
%s""" % ", ".join(paths))
|
|
|
|
def _mcs_types(self):
|
|
- try:
|
|
- mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
|
- except StopIteration:
|
|
- return
|
|
- if self.type not in mcs_constrained_type['types']:
|
|
+ if self.type not in self.mcs_constrained_types['types']:
|
|
return
|
|
self.fd.write ("""
|
|
.SH "MCS Constrained"
|