From b840c70cea2e1608532f44ae0eb25a5345e8dc00 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Aug 14 2008 20:17:19 +0000 Subject: - Don't rebuild on fcontext or seuser modifications --- diff --git a/libsemanage-rhat.patch b/libsemanage-rhat.patch index 04d845a..f1b7014 100644 --- a/libsemanage-rhat.patch +++ b/libsemanage-rhat.patch @@ -1,6 +1,60 @@ -diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.25/src/genhomedircon.c +diff --exclude-from=exclude -N -u -r nsalibsemanage/src/direct_api.c libsemanage-2.0.27/src/direct_api.c +--- nsalibsemanage/src/direct_api.c 2008-06-12 23:25:16.000000000 -0400 ++++ libsemanage-2.0.27/src/direct_api.c 2008-08-14 11:51:15.000000000 -0400 +@@ -489,12 +489,6 @@ + modified |= ifaces->dtable->is_modified(ifaces->dbase); + modified |= nodes->dtable->is_modified(nodes->dbase); + +- /* FIXME: get rid of these, once we support loading the existing policy, +- * instead of rebuilding it */ +- modified |= seusers_modified; +- modified |= fcontexts_modified; +- modified |= users_extra_modified; +- + /* If there were policy changes, or explicitly requested, rebuild the policy */ + if (sh->do_rebuild || modified) { + +@@ -667,11 +661,34 @@ + retval = semanage_verify_kernel(sh); + if (retval < 0) + goto cleanup; +- } ++ } else { ++ sepol_policydb_create(&out); ++ modified |= seusers_modified; ++ modified |= fcontexts_modified; ++ modified |= users_extra_modified; ++ ++ retval = semanage_read_policydb(sh, out); ++ if (retval < 0) ++ goto cleanup; ++ ++ dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase,out); ++ dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out); ++ dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out); ++ dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out); ++ dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out); + +- /* FIXME: else if !modified, but seusers_modified, +- * load the existing policy instead of rebuilding */ ++ if (seusers_modified) { ++ retval = pseusers->dtable->clear(sh, pseusers->dbase); ++ if (retval < 0) ++ goto cleanup; ++ } + ++ retval = semanage_base_merge_components(sh); ++ if (retval < 0) ++ goto cleanup; ++ ++ /* Seusers */ ++ } + /* ======= Post-process: Validate non-policydb components ===== */ + + /* Validate local modifications to file contexts. +diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.27/src/genhomedircon.c --- nsalibsemanage/src/genhomedircon.c 2008-08-05 09:57:28.000000000 -0400 -+++ libsemanage-2.0.25/src/genhomedircon.c 2008-07-17 14:32:45.000000000 -0400 ++++ libsemanage-2.0.27/src/genhomedircon.c 2008-08-08 14:00:37.000000000 -0400 @@ -21,6 +21,7 @@ */ @@ -25,12 +79,76 @@ diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libseman {NULL, NULL} }; Ustr *line = USTR_NULL; -diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.25/src/semanage.conf +diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.27/src/semanage.conf --- nsalibsemanage/src/semanage.conf 2008-06-12 23:25:16.000000000 -0400 -+++ libsemanage-2.0.25/src/semanage.conf 2008-07-17 13:58:44.000000000 -0400 ++++ libsemanage-2.0.27/src/semanage.conf 2008-08-08 14:00:37.000000000 -0400 @@ -35,4 +35,4 @@ # given in . Change this setting if a different # version is necessary. #policy-version = 19 - +expand-check=0 +diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.c libsemanage-2.0.27/src/semanage_store.c +--- nsalibsemanage/src/semanage_store.c 2008-06-12 23:25:16.000000000 -0400 ++++ libsemanage-2.0.27/src/semanage_store.c 2008-08-08 15:23:20.000000000 -0400 +@@ -1648,6 +1648,47 @@ + } + + /** ++ * Read the policy from the sandbox (kernel) ++ */ ++int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in) ++{ ++ ++ int retval = STATUS_ERR; ++ const char *kernel_filename = NULL; ++ struct sepol_policy_file *pf = NULL; ++ FILE *infile = NULL; ++ ++ if ((kernel_filename = ++ semanage_path(SEMANAGE_ACTIVE, SEMANAGE_KERNEL)) == NULL) { ++ goto cleanup; ++ } ++ if ((infile = fopen(kernel_filename, "r")) == NULL) { ++ ERR(sh, "Could not open kernel policy %s for reading.", ++ kernel_filename); ++ goto cleanup; ++ } ++ __fsetlocking(infile, FSETLOCKING_BYCALLER); ++ if (sepol_policy_file_create(&pf)) { ++ ERR(sh, "Out of memory!"); ++ goto cleanup; ++ } ++ sepol_policy_file_set_fp(pf, infile); ++ sepol_policy_file_set_handle(pf, sh->sepolh); ++ if (sepol_policydb_read(in, pf) == -1) { ++ ERR(sh, "Error while reading kernel policy from %s.", ++ kernel_filename); ++ goto cleanup; ++ } ++ retval = STATUS_SUCCESS; ++ ++ cleanup: ++ if (infile != NULL) { ++ fclose(infile); ++ } ++ sepol_policy_file_free(pf); ++ return retval; ++} ++/** + * Writes the final policy to the sandbox (kernel) + */ + int semanage_write_policydb(semanage_handle_t * sh, sepol_policydb_t * out) +diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.h libsemanage-2.0.27/src/semanage_store.h +--- nsalibsemanage/src/semanage_store.h 2008-06-12 23:25:16.000000000 -0400 ++++ libsemanage-2.0.27/src/semanage_store.h 2008-08-11 09:05:16.000000000 -0400 +@@ -97,6 +97,9 @@ + sepol_module_package_t * base, + sepol_policydb_t ** policydb); + ++int semanage_read_policydb(semanage_handle_t * sh, ++ sepol_policydb_t * policydb); ++ + int semanage_write_policydb(semanage_handle_t * sh, + sepol_policydb_t * policydb); + diff --git a/libsemanage.spec b/libsemanage.spec index 663433b..c9e09e2 100644 --- a/libsemanage.spec +++ b/libsemanage.spec @@ -3,7 +3,7 @@ Summary: SELinux binary policy manipulation library Name: libsemanage Version: 2.0.27 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPLv2+ Group: System Environment/Libraries Source: http://www.nsa.gov/selinux/archives/libsemanage-%{version}.tgz @@ -78,6 +78,9 @@ rm -rf ${RPM_BUILD_ROOT} %{_mandir}/man3/* %changelog +* Tue Aug 5 2008 Dan Walsh - 2.0.27-2 +- Don't rebuild on fcontext or seuser modifications + * Tue Aug 5 2008 Dan Walsh - 2.0.27-1 - Update to upstream * Modify genhomedircon to skip %groupname entries.