diff -up policycoreutils-2.0.62/audit2allow/audit2allow.rhat policycoreutils-2.0.62/audit2allow/audit2allow
--- policycoreutils-2.0.62/audit2allow/audit2allow.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/audit2allow/audit2allow 2009-05-05 10:49:02.000000000 -0400
@@ -126,6 +126,7 @@ class AuditToPolicy:
elif self.__options.audit:
try:
messages = audit.get_audit_msgs()
+ messages += audit.get_log_msgs()
except OSError, e:
sys.stderr.write('could not run ausearch - "%s"\n' % str(e))
sys.exit(1)
diff -up /dev/null policycoreutils-2.0.62/debugfiles.list
--- /dev/null 2009-05-04 15:46:32.150257971 -0400
+++ policycoreutils-2.0.62/debugfiles.list 2009-05-05 10:49:02.000000000 -0400
@@ -0,0 +1,64 @@
+%dir /usr/lib/debug
+%dir /usr/lib/debug/sbin
+%dir /usr/lib/debug/.build-id
+%dir /usr/lib/debug/.build-id/3d
+%dir /usr/lib/debug/.build-id/ec
+%dir /usr/lib/debug/.build-id/9d
+%dir /usr/lib/debug/.build-id/cb
+%dir /usr/lib/debug/.build-id/bc
+%dir /usr/lib/debug/.build-id/0a
+%dir /usr/lib/debug/.build-id/81
+%dir /usr/lib/debug/.build-id/ad
+%dir /usr/lib/debug/.build-id/7f
+%dir /usr/lib/debug/.build-id/f4
+%dir /usr/lib/debug/.build-id/15
+%dir /usr/lib/debug/.build-id/1d
+%dir /usr/lib/debug/.build-id/a8
+%dir /usr/lib/debug/.build-id/d3
+%dir /usr/lib/debug/usr
+%dir /usr/lib/debug/usr/sbin
+%dir /usr/lib/debug/usr/bin
+/usr/lib/debug/sbin/setfiles.debug
+/usr/lib/debug/sbin/restorecon.debug
+/usr/lib/debug/.build-id/3d/c26411dac65290297678f68c7d65c43039df70.debug
+/usr/lib/debug/.build-id/3d/c26411dac65290297678f68c7d65c43039df70
+/usr/lib/debug/.build-id/ec/2012afb3f104620e1d260c932419e6391474ab
+/usr/lib/debug/.build-id/ec/2012afb3f104620e1d260c932419e6391474ab.debug
+/usr/lib/debug/.build-id/9d/511790c5b6141b50c55b8fe8bc032d84827665.debug
+/usr/lib/debug/.build-id/9d/511790c5b6141b50c55b8fe8bc032d84827665
+/usr/lib/debug/.build-id/cb/29543b91147fcf47889d52fa8375c3a388dcce
+/usr/lib/debug/.build-id/cb/29543b91147fcf47889d52fa8375c3a388dcce.debug
+/usr/lib/debug/.build-id/bc/36b9f43fecf5bdb7cbc3780aea1de9a7192865
+/usr/lib/debug/.build-id/bc/36b9f43fecf5bdb7cbc3780aea1de9a7192865.debug
+/usr/lib/debug/.build-id/0a/2965fb8a1c2359677db2cd583f4caa9b79e082.debug
+/usr/lib/debug/.build-id/0a/2965fb8a1c2359677db2cd583f4caa9b79e082
+/usr/lib/debug/.build-id/81/4a2dc779e8dc03a30550b17393f4bf38cc3401.debug
+/usr/lib/debug/.build-id/81/4a2dc779e8dc03a30550b17393f4bf38cc3401
+/usr/lib/debug/.build-id/ad/d96fe93d52caa86fd8119e3a250b3ff1afc8be.debug
+/usr/lib/debug/.build-id/ad/d96fe93d52caa86fd8119e3a250b3ff1afc8be
+/usr/lib/debug/.build-id/7f/d8c1148b921ee7ce357dcc4827a35074d8744a.debug
+/usr/lib/debug/.build-id/7f/d8c1148b921ee7ce357dcc4827a35074d8744a
+/usr/lib/debug/.build-id/f4/3cc2016abf9b6152b720b604ffc7b05ada92b7.debug
+/usr/lib/debug/.build-id/f4/3cc2016abf9b6152b720b604ffc7b05ada92b7
+/usr/lib/debug/.build-id/15/cbead7609477306808e0d90860e7e0d69ccac8.debug
+/usr/lib/debug/.build-id/15/cbead7609477306808e0d90860e7e0d69ccac8
+/usr/lib/debug/.build-id/1d/b4d0c26d77215c7e45aa7da8d6622ec413951f.debug
+/usr/lib/debug/.build-id/1d/b4d0c26d77215c7e45aa7da8d6622ec413951f
+/usr/lib/debug/.build-id/a8/4bb87bec28cd2e948c72529f4640d56178107b
+/usr/lib/debug/.build-id/a8/4bb87bec28cd2e948c72529f4640d56178107b.debug
+/usr/lib/debug/.build-id/d3/a79f853588fb732304975cb781fe37f686e5b9
+/usr/lib/debug/.build-id/d3/a79f853588fb732304975cb781fe37f686e5b9.debug
+/usr/lib/debug/usr/sbin/load_policy.debug
+/usr/lib/debug/usr/sbin/restorecond.debug
+/usr/lib/debug/usr/sbin/semodule.debug
+/usr/lib/debug/usr/sbin/sestatus.debug
+/usr/lib/debug/usr/sbin/setsebool.debug
+/usr/lib/debug/usr/sbin/open_init_pty.debug
+/usr/lib/debug/usr/sbin/run_init.debug
+/usr/lib/debug/usr/bin/semodule_package.debug
+/usr/lib/debug/usr/bin/newrole.debug
+/usr/lib/debug/usr/bin/semodule_link.debug
+/usr/lib/debug/usr/bin/semodule_deps.debug
+/usr/lib/debug/usr/bin/semodule_expand.debug
+/usr/lib/debug/usr/bin/secon.debug
+/usr/src/debug/policycoreutils-2.0.62
diff -up /dev/null policycoreutils-2.0.62/debuglinks.list
--- /dev/null 2009-05-04 15:46:32.150257971 -0400
+++ policycoreutils-2.0.62/debuglinks.list 2009-05-05 10:49:02.000000000 -0400
@@ -0,0 +1,29 @@
+/usr/lib/debug/.build-id/f4/3cc2016abf9b6152b720b604ffc7b05ada92b7 /sbin/setfiles
+/usr/lib/debug/.build-id/f4/3cc2016abf9b6152b720b604ffc7b05ada92b7.debug /usr/lib/debug/sbin/setfiles.debug
+/usr/lib/debug/.build-id/3d/c26411dac65290297678f68c7d65c43039df70 /usr/sbin/open_init_pty
+/usr/lib/debug/.build-id/3d/c26411dac65290297678f68c7d65c43039df70.debug /usr/lib/debug/usr/sbin/open_init_pty.debug
+/usr/lib/debug/.build-id/15/cbead7609477306808e0d90860e7e0d69ccac8 /usr/sbin/sestatus
+/usr/lib/debug/.build-id/15/cbead7609477306808e0d90860e7e0d69ccac8.debug /usr/lib/debug/usr/sbin/sestatus.debug
+/usr/lib/debug/.build-id/81/4a2dc779e8dc03a30550b17393f4bf38cc3401 /usr/sbin/semodule
+/usr/lib/debug/.build-id/81/4a2dc779e8dc03a30550b17393f4bf38cc3401.debug /usr/lib/debug/usr/sbin/semodule.debug
+/usr/lib/debug/.build-id/d3/a79f853588fb732304975cb781fe37f686e5b9 /usr/sbin/load_policy
+/usr/lib/debug/.build-id/d3/a79f853588fb732304975cb781fe37f686e5b9.debug /usr/lib/debug/usr/sbin/load_policy.debug
+/usr/lib/debug/.build-id/a8/4bb87bec28cd2e948c72529f4640d56178107b /usr/sbin/run_init
+/usr/lib/debug/.build-id/a8/4bb87bec28cd2e948c72529f4640d56178107b.debug /usr/lib/debug/usr/sbin/run_init.debug
+/usr/lib/debug/.build-id/7f/d8c1148b921ee7ce357dcc4827a35074d8744a /usr/sbin/restorecond
+/usr/lib/debug/.build-id/7f/d8c1148b921ee7ce357dcc4827a35074d8744a.debug /usr/lib/debug/usr/sbin/restorecond.debug
+/usr/lib/debug/.build-id/ec/2012afb3f104620e1d260c932419e6391474ab /usr/sbin/setsebool
+/usr/lib/debug/.build-id/ec/2012afb3f104620e1d260c932419e6391474ab.debug /usr/lib/debug/usr/sbin/setsebool.debug
+/usr/lib/debug/.build-id/bc/36b9f43fecf5bdb7cbc3780aea1de9a7192865 /usr/bin/secon
+/usr/lib/debug/.build-id/bc/36b9f43fecf5bdb7cbc3780aea1de9a7192865.debug /usr/lib/debug/usr/bin/secon.debug
+/usr/lib/debug/.build-id/1d/b4d0c26d77215c7e45aa7da8d6622ec413951f /usr/bin/newrole
+/usr/lib/debug/.build-id/1d/b4d0c26d77215c7e45aa7da8d6622ec413951f.debug /usr/lib/debug/usr/bin/newrole.debug
+/usr/lib/debug/.build-id/0a/2965fb8a1c2359677db2cd583f4caa9b79e082 /usr/bin/semodule_link
+/usr/lib/debug/.build-id/0a/2965fb8a1c2359677db2cd583f4caa9b79e082.debug /usr/lib/debug/usr/bin/semodule_link.debug
+/usr/lib/debug/.build-id/ad/d96fe93d52caa86fd8119e3a250b3ff1afc8be /usr/bin/semodule_expand
+/usr/lib/debug/.build-id/ad/d96fe93d52caa86fd8119e3a250b3ff1afc8be.debug /usr/lib/debug/usr/bin/semodule_expand.debug
+/usr/lib/debug/.build-id/cb/29543b91147fcf47889d52fa8375c3a388dcce /usr/bin/semodule_package
+/usr/lib/debug/.build-id/cb/29543b91147fcf47889d52fa8375c3a388dcce.debug /usr/lib/debug/usr/bin/semodule_package.debug
+/usr/lib/debug/.build-id/9d/511790c5b6141b50c55b8fe8bc032d84827665 /usr/bin/semodule_deps
+/usr/lib/debug/.build-id/9d/511790c5b6141b50c55b8fe8bc032d84827665.debug /usr/lib/debug/usr/bin/semodule_deps.debug
+/usr/lib/debug/sbin/restorecon.debug /usr/lib/debug/sbin/setfiles.debug
diff -up policycoreutils-2.0.62/Makefile.rhat policycoreutils-2.0.62/Makefile
--- policycoreutils-2.0.62/Makefile.rhat 2009-02-18 16:45:00.000000000 -0500
+++ policycoreutils-2.0.62/Makefile 2009-05-05 10:49:02.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
diff -up policycoreutils-2.0.62/restorecond/restorecond.conf.rhat policycoreutils-2.0.62/restorecond/restorecond.conf
--- policycoreutils-2.0.62/restorecond/restorecond.conf.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/restorecond/restorecond.conf 2009-05-05 10:49:02.000000000 -0400
@@ -5,3 +5,7 @@
/var/run/utmp
/var/log/wtmp
~/*
+/root/.ssh
+/root/.ssh/*
+
+
diff -up policycoreutils-2.0.62/scripts/chcat.rhat policycoreutils-2.0.62/scripts/chcat
--- policycoreutils-2.0.62/scripts/chcat.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/scripts/chcat 2009-05-05 10:49:02.000000000 -0400
@@ -281,14 +281,14 @@ def isSensitivity(sensitivity):
def expandCats(cats):
newcats = []
for c in cats:
- if c.find(".") != -1:
- c = c.split(".")
- for i in range(int(c[0][1:]), int(c[1][1:]) + 1):
- x = ("c%d" % i)
- if x not in newcats:
- newcats.append("c%d" % i)
- else:
- for i in c.split(","):
+ for i in c.split(","):
+ if i.find(".") != -1:
+ j = i.split(".")
+ for k in range(int(j[0][1:]), int(j[1][1:]) + 1):
+ x = ("c%d" % k)
+ if x not in newcats:
+ newcats.append(x)
+ else:
if i not in newcats:
newcats.append(i)
if len(newcats) > 25:
diff -up policycoreutils-2.0.62/scripts/fixfiles.rhat policycoreutils-2.0.62/scripts/fixfiles
--- policycoreutils-2.0.62/scripts/fixfiles.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/scripts/fixfiles 2009-05-05 10:49:24.000000000 -0400
@@ -89,7 +89,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ];
fi; \
done | \
while read pattern ; do sh -c "find $pattern \
- ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o \
+ ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune -o \
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
done 2> /dev/null | \
${RESTORECON} $* -0 -f -
@@ -122,14 +122,14 @@ if [ ! -z "$PREFC" ]; then
fi
if [ ! -z "$RPMFILES" ]; then
for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
- rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1 >> $LOGFILE
+ rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f - 2>&1 >> $LOGFILE
done
exit $?
fi
if [ ! -z "$FILEPATH" ]; then
if [ -x /usr/bin/find ]; then
/usr/bin/find "$FILEPATH" \
- ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs \) -prune -o -print0 | \
+ ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o fstype btrfs \) -prune -o -print0 | \
${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
else
${RESTORECON} ${OUTFILES} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
diff -up policycoreutils-2.0.62/semanage/semanage.8.rhat policycoreutils-2.0.62/semanage/semanage.8
--- policycoreutils-2.0.62/semanage/semanage.8.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/semanage/semanage.8 2009-05-05 10:49:02.000000000 -0400
@@ -21,6 +21,8 @@ semanage \- SELinux Policy Management to
.br
.B semanage permissive \-{a|d} type
.br
+.B semanage module \-{a|d} policy_package
+.br
.B semanage translation \-{a|d|m} [\-T] level
.P
diff -up policycoreutils-2.0.62/semanage/semanage.rhat policycoreutils-2.0.62/semanage/semanage
--- policycoreutils-2.0.62/semanage/semanage.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/semanage/semanage 2009-05-05 10:49:02.000000000 -0400
@@ -44,16 +44,17 @@ if __name__ == '__main__':
text = _("""
semanage [ -S store ] -i [ input_file | - ]
-semanage {boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n]
+semanage {module,boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n]
semanage login -{a|d|m} [-sr] login_name | %groupname
semanage user -{a|d|m} [-LrRP] selinux_name
semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range
semanage interface -{a|d|m} [-tr] interface_spec
semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] addr
-semanage fcontext -{a|d|m} [-frst] file_spec
+semanage fcontext -{a|d|m} [-frst] [-e path ] file_spec
semanage translation -{a|d|m} [-T] level
semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
-semanage permissive -{d|a} type
+semanage permissive -{a|d} type
+semanage module -{a|d|} module
Primary Options:
@@ -68,6 +69,7 @@ Primary Options:
-h, --help Display this message
-n, --noheading Do not print heading when listing OBJECTS
-S, --store Select and alternate SELinux store to manage
+ --dontaudit Turn on or off dontaudit rules
Object-specific Options (see above):
@@ -84,6 +86,7 @@ Object-specific Options (see above):
-F, --file Treat target as an input file for command, change multiple settings
-p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6)
-M, --mask Netmask
+ -e, --equil Make target equil to this paths labeling
-P, --prefix Prefix for home directory labeling
-L, --level Default SELinux Level (MLS/MCS Systems only)
-R, --roles SELinux Roles (ex: "sysadm_r staff_r")
@@ -115,11 +118,14 @@ Object-specific Options (see above):
valid_option["node"] = []
valid_option["node"] += valid_everyone + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol']
valid_option["fcontext"] = []
- valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
+ valid_option["fcontext"] += valid_everyone + [ '-e', '--equil', '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
valid_option["translation"] = []
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
valid_option["boolean"] = []
valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0", "-F", "--file"]
+ valid_option["module"] = []
+ valid_option["module"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '--dontaudit']
+
valid_option["permissive"] = []
valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ]
return valid_option
@@ -192,7 +198,10 @@ Object-specific Options (see above):
locallist = False
use_file = False
store = ""
+ equil=""
+ dontaudit = ""
+
object = argv[0]
option_dict=get_options()
if object not in option_dict.keys():
@@ -201,10 +210,12 @@ Object-specific Options (see above):
args = argv[1:]
gopts, cmds = getopt.getopt(args,
- '01adf:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:',
+ '01ade:f:i:lhmnp:s:FCDR:L:r:t:T:P:S:M:',
['add',
'delete',
'deleteall',
+ 'dontaudit=',
+ 'equil=',
'ftype=',
'file',
'help',
@@ -241,16 +252,24 @@ Object-specific Options (see above):
if modify or add:
raise ValueError(_("%s bad option") % o)
delete = True
+
if o == "-D" or o == "--deleteall":
if modify:
raise ValueError(_("%s bad option") % o)
deleteall = True
+
if o == "-f" or o == "--ftype":
- ftype=a
+ ftype = a
+
+ if o == "-e" or o == "--equil":
+ equil = a
if o == "-F" or o == "--file":
use_file = True
+ if o == "--dontaudit":
+ dontaudit = a
+
if o == "-h" or o == "--help":
raise ValueError(_("%s bad option") % o)
@@ -323,6 +342,9 @@ Object-specific Options (see above):
if object == "boolean":
OBJECT = seobject.booleanRecords(store)
+
+ if object == "module":
+ OBJECT = seobject.moduleRecords(store)
if object == "translation":
OBJECT = seobject.setransRecords()
@@ -341,6 +363,13 @@ Object-specific Options (see above):
OBJECT.deleteall()
return
+ if dontaudit != "":
+ if object == "module":
+ OBJECT.dontaudit(dontaudit)
+ else:
+ raise ValueError(_("%s bad option") % o)
+ return
+
if len(cmds) != 1:
raise ValueError(_("%s bad option") % o)
@@ -362,11 +391,17 @@ Object-specific Options (see above):
if object == "interface":
OBJECT.add(target, serange, setype)
+ if object == "module":
+ OBJECT.add(target)
+
if object == "node":
OBJECT.add(target, mask, proto, serange, setype)
if object == "fcontext":
- OBJECT.add(target, setype, ftype, serange, seuser)
+ if equil == "":
+ OBJECT.add(target, setype, ftype, serange, seuser)
+ else:
+ OBJECT.add_equil(target, equil)
if object == "permissive":
OBJECT.add(target)
@@ -386,6 +421,9 @@ Object-specific Options (see above):
rlist = roles.split()
OBJECT.modify(target, rlist, selevel, serange, prefix)
+ if object == "module":
+ OBJECT.modify(target)
+
if object == "port":
OBJECT.modify(target, proto, serange, setype)
@@ -396,7 +434,10 @@ Object-specific Options (see above):
OBJECT.modify(target, mask, proto, serange, setype)
if object == "fcontext":
- OBJECT.modify(target, setype, ftype, serange, seuser)
+ if equil == "":
+ OBJECT.modify(target, setype, ftype, serange, seuser)
+ else:
+ OBJECT.modify_equil(target, equil)
return
@@ -405,7 +446,7 @@ Object-specific Options (see above):
OBJECT.delete(target, proto)
elif object == "fcontext":
- OBJECT.delete(target, ftype)
+ OBJECT.delete(target, ftype)
elif object == "node":
OBJECT.delete(target, mask, proto)
@@ -464,10 +505,10 @@ Object-specific Options (see above):
else:
fd = open(input, 'r')
trans = seobject.semanageRecords(store)
- trans.begin()
+ trans.start()
for l in fd.readlines():
process_args(mkargv(l))
- trans.commit()
+ trans.finish()
else:
process_args(sys.argv[1:])
diff -up policycoreutils-2.0.62/semanage/seobject.py.rhat policycoreutils-2.0.62/semanage/seobject.py
--- policycoreutils-2.0.62/semanage/seobject.py.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/semanage/seobject.py 2009-05-05 14:46:35.000000000 -0400
@@ -1,5 +1,5 @@
#! /usr/bin/python -E
-# Copyright (C) 2005, 2006, 2007, 2008 Red Hat
+# Copyright (C) 2005, 2006, 2007, 2008, 2009 Red Hat
# see file 'COPYING' for use and warranty information
#
# semanage is a tool for managing SELinux configuration files
@@ -21,16 +21,16 @@
#
#
-import pwd, grp, string, selinux, tempfile, os, re, sys
+import pwd, grp, string, selinux, tempfile, os, re, sys, stat
from semanage import *;
-PROGNAME="policycoreutils"
+PROGNAME = "policycoreutils"
import sepolgen.module as module
import gettext
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
gettext.textdomain(PROGNAME)
try:
- gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
+ gettext.install(PROGNAME, localedir = "/usr/share/locale", unicode = 1)
except IOError:
import __builtin__
__builtin__.__dict__['_'] = unicode
@@ -96,7 +96,7 @@ try:
self.audit_fd = audit.audit_open()
def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""):
- audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0],str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success);
+ audit.audit_log_semanage_message(self.audit_fd, audit.AUDIT_USER_ROLE_CHANGE, sys.argv[0], str(msg), name, 0, sename, serole, serange, old_sename, old_serole, old_serange, "", "", "", success);
except:
class logger:
def log(self, success, msg, name = "", sename = "", serole = "", serange = "", old_sename = "", old_serole = "", old_serange = ""):
@@ -104,7 +104,7 @@ except:
message = "Successful: "
else:
message = "Failed: "
- message += " %s name=%s" % (msg,name)
+ message += " %s name=%s" % (msg, name)
if sename != "":
message += " sename=" + sename
if old_sename != "":
@@ -123,9 +123,9 @@ mylog = logger()
import xml.etree.ElementTree
-booleans_dict={}
+booleans_dict = {}
try:
- tree=xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
+ tree = xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
for l in tree.findall("layer"):
for m in l.findall("module"):
for b in m.findall("tunable"):
@@ -160,12 +160,12 @@ def validate_level(raw):
cat_range = category + "(\." + category +")?"
categories = cat_range + "(\," + cat_range + ")*"
reg = sensitivity + "(-" + sensitivity + ")?" + "(:" + categories + ")?"
- return re.search("^" + reg +"$",raw)
+ return re.search("^" + reg +"$", raw)
def translate(raw, prepend = 1):
- filler="a:b:c:"
+ filler = "a:b:c:"
if prepend == 1:
- context = "%s%s" % (filler,raw)
+ context = "%s%s" % (filler, raw)
else:
context = raw
(rc, trans) = selinux.selinux_raw_to_trans_context(context)
@@ -179,9 +179,9 @@ def translate(raw, prepend = 1):
return trans
def untranslate(trans, prepend = 1):
- filler="a:b:c:"
+ filler = "a:b:c:"
if prepend == 1:
- context = "%s%s" % (filler,trans)
+ context = "%s%s" % (filler, trans)
else:
context = trans
@@ -234,7 +234,7 @@ class setransRecords:
rec += "%s=%s\n" % (k, self.ddict[k])
return rec
- def list(self,heading = 1, locallist = 0):
+ def list(self, heading = 1, locallist = 0):
if heading:
print "\n%-25s %s\n" % (_("Level"), _("Translation"))
keys = self.ddict.keys()
@@ -273,6 +273,7 @@ class setransRecords:
(fd, newfilename) = tempfile.mkstemp('', self.filename)
os.write(fd, self.out())
os.close(fd)
+ os.chmod(newfilename, os.stat(self.filename)[stat.ST_MODE])
os.rename(newfilename, self.filename)
os.system("/sbin/service mcstrans reload > /dev/null")
@@ -281,15 +282,20 @@ class semanageRecords:
global handle
if handle != None:
- self.transaction = True
self.sh = handle
else:
- self.sh=get_handle(store)
- self.transaction = False
+ self.sh = get_handle(store)
+ self.transaction = False
def deleteall(self):
raise ValueError(_("Not yet implemented"))
+ def start(self):
+ if self.transaction:
+ raise ValueError(_("Semanage transaction already in progress"))
+ self.begin()
+ self.transaction = True
+
def begin(self):
if self.transaction:
return
@@ -303,6 +309,55 @@ class semanageRecords:
if rc < 0:
raise ValueError(_("Could not commit semanage transaction"))
+ def finish(self):
+ if not self.transaction:
+ raise ValueError(_("Semanage transaction not in progress"))
+ self.transaction = False
+ self.commit()
+
+class moduleRecords(semanageRecords):
+ def __init__(self, store):
+ semanageRecords.__init__(self, store)
+
+ def get_all(self):
+ l = []
+ (rc, mlist, number) = semanage_module_list(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not list SELinux modules"))
+
+ for i in range(number):
+ mod = semanage_module_list_nth(mlist, i)
+ name = semanage_module_get_name(mod)
+ l.append(name)
+ return l
+
+ def dontaudit(self, dontaudit = 0):
+ self.begin()
+ rc = semanage_set_disable_dontaudit(self.sh, int(dontaudit))
+ self.commit()
+ rc = semanage_reload_policy(self.sh)
+
+ def list(self, heading = 1, locallist = 0):
+ if heading:
+ print "\n%-25s\n" % (_("Modules"))
+ for t in self.get_all():
+ print t
+
+ def add(self, modules):
+ import glob
+ for m in modules.split():
+ rc = semanage_module_install_file(self.sh, m);
+ if rc >= 0:
+ self.commit()
+
+ def delete(self, modules):
+ for m in modules.split():
+ rc = semanage_module_remove(self.sh, m)
+ if rc < 0:
+ raise ValueError(_("Could not remove module %s (remove failed)") % name)
+
+ self.commit()
+
class permissiveRecords(semanageRecords):
def __init__(self, store):
semanageRecords.__init__(self, store)
@@ -320,7 +375,7 @@ class permissiveRecords(semanageRecords)
l.append(name.split("permissive_")[1])
return l
- def list(self,heading = 1, locallist = 0):
+ def list(self, heading = 1, locallist = 0):
if heading:
print "\n%-25s\n" % (_("Permissive Types"))
for t in self.get_all():
@@ -328,6 +383,7 @@ class permissiveRecords(semanageRecords)
def add(self, type):
+ import glob
name = "permissive_%s" % type
dirname = "/var/lib/selinux"
os.chdir(dirname)
@@ -341,7 +397,7 @@ require {
permissive %s;
""" % (name, type, type)
- fd = open(filename,'w')
+ fd = open(filename, 'w')
fd.write(modtxt)
fd.close()
mc = module.ModuleCompiler()
@@ -351,16 +407,19 @@ permissive %s;
fd.close()
rc = semanage_module_install(self.sh, data, len(data));
- if rc < 0:
- raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name)
-
- self.commit()
+ if rc >= 0:
+ self.commit()
- for root, dirs, files in os.walk("tmp", topdown=False):
+ for root, dirs, files in os.walk("tmp", topdown = False):
for name in files:
os.remove(os.path.join(root, name))
for name in dirs:
os.rmdir(os.path.join(root, name))
+ os.removedirs("tmp")
+ for i in glob.glob("permissive_%s.*" % type):
+ os.remove(i)
+ if rc < 0:
+ raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name)
def delete(self, name):
for n in name.split():
@@ -390,11 +449,11 @@ class loginRecords(semanageRecords):
if sename == "":
sename = "user_u"
- (rc,k) = semanage_seuser_key_create(self.sh, name)
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_seuser_exists(self.sh, k)
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if exists:
@@ -410,7 +469,7 @@ class loginRecords(semanageRecords):
except:
raise ValueError(_("Linux User %s does not exist") % name)
- (rc,u) = semanage_seuser_create(self.sh)
+ (rc, u) = semanage_seuser_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create login mapping for %s") % name)
@@ -450,17 +509,17 @@ class loginRecords(semanageRecords):
if sename == "" and serange == "":
raise ValueError(_("Requires seuser or serange"))
- (rc,k) = semanage_seuser_key_create(self.sh, name)
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_seuser_exists(self.sh, k)
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if not exists:
raise ValueError(_("Login mapping for %s is not defined") % name)
- (rc,u) = semanage_seuser_query(self.sh, k)
+ (rc, u) = semanage_seuser_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query seuser for %s") % name)
@@ -483,7 +542,7 @@ class loginRecords(semanageRecords):
semanage_seuser_key_free(k)
semanage_seuser_free(u)
- mylog.log(1,"modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
+ mylog.log(1, "modify selinux user mapping", name, sename, "", serange, oldsename, "", oldserange);
def modify(self, name, sename = "", serange = ""):
try:
@@ -492,21 +551,21 @@ class loginRecords(semanageRecords):
self.commit()
except ValueError, error:
- mylog.log(0,"modify selinux user mapping", name, sename,"", serange, "", "", "");
+ mylog.log(0, "modify selinux user mapping", name, sename, "", serange, "", "", "");
raise error
def __delete(self, name):
- (rc,k) = semanage_seuser_key_create(self.sh, name)
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_seuser_exists(self.sh, k)
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if not exists:
raise ValueError(_("Login mapping for %s is not defined") % name)
- (rc,exists) = semanage_seuser_exists_local(self.sh, k)
+ (rc, exists) = semanage_seuser_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if not exists:
@@ -525,10 +584,10 @@ class loginRecords(semanageRecords):
self.commit()
except ValueError, error:
- mylog.log(0,"delete SELinux user mapping", name);
+ mylog.log(0, "delete SELinux user mapping", name);
raise error
- mylog.log(1,"delete SELinux user mapping", name);
+ mylog.log(1, "delete SELinux user mapping", name);
def get_all(self, locallist = 0):
ddict = {}
@@ -578,17 +637,17 @@ class seluserRecords(semanageRecords):
if len(roles) < 1:
raise ValueError(_("You must add at least one role for %s") % name)
- (rc,k) = semanage_user_key_create(self.sh, name)
+ (rc, k) = semanage_user_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_user_exists(self.sh, k)
+ (rc, exists) = semanage_user_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if exists:
raise ValueError(_("SELinux user %s is already defined") % name)
- (rc,u) = semanage_user_create(self.sh)
+ (rc, u) = semanage_user_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create SELinux user for %s") % name)
@@ -612,7 +671,7 @@ class seluserRecords(semanageRecords):
rc = semanage_user_set_prefix(self.sh, u, prefix)
if rc < 0:
raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
- (rc,key) = semanage_user_key_extract(self.sh,u)
+ (rc, key) = semanage_user_key_extract(self.sh,u)
if rc < 0:
raise ValueError(_("Could not extract key for %s") % name)
@@ -645,17 +704,17 @@ class seluserRecords(semanageRecords):
else:
raise ValueError(_("Requires prefix or roles"))
- (rc,k) = semanage_user_key_create(self.sh, name)
+ (rc, k) = semanage_user_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_user_exists(self.sh, k)
+ (rc, exists) = semanage_user_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if not exists:
raise ValueError(_("SELinux user %s is not defined") % name)
- (rc,u) = semanage_user_query(self.sh, k)
+ (rc, u) = semanage_user_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query user for %s") % name)
@@ -703,17 +762,17 @@ class seluserRecords(semanageRecords):
raise error
def __delete(self, name):
- (rc,k) = semanage_user_key_create(self.sh, name)
+ (rc, k) = semanage_user_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_user_exists(self.sh, k)
+ (rc, exists) = semanage_user_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if not exists:
raise ValueError(_("SELinux user %s is not defined") % name)
- (rc,exists) = semanage_user_exists_local(self.sh, k)
+ (rc, exists) = semanage_user_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if SELinux user %s is defined") % name)
if not exists:
@@ -795,7 +854,7 @@ class portRecords(semanageRecords):
low = int(ports[0])
high = int(ports[1])
- (rc,k) = semanage_port_key_create(self.sh, low, high, proto_d)
+ (rc, k) = semanage_port_key_create(self.sh, low, high, proto_d)
if rc < 0:
raise ValueError(_("Could not create a key for %s/%s") % (proto, port))
return ( k, proto_d, low, high )
@@ -812,13 +871,13 @@ class portRecords(semanageRecords):
( k, proto_d, low, high ) = self.__genkey(port, proto)
- (rc,exists) = semanage_port_exists(self.sh, k)
+ (rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if exists:
raise ValueError(_("Port %s/%s already defined") % (proto, port))
- (rc,p) = semanage_port_create(self.sh)
+ (rc, p) = semanage_port_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create port for %s/%s") % (proto, port))
@@ -871,13 +930,13 @@ class portRecords(semanageRecords):
( k, proto_d, low, high ) = self.__genkey(port, proto)
- (rc,exists) = semanage_port_exists(self.sh, k)
+ (rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if not exists:
raise ValueError(_("Port %s/%s is not defined") % (proto,port))
- (rc,p) = semanage_port_query(self.sh, k)
+ (rc, p) = semanage_port_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query port %s/%s") % (proto, port))
@@ -926,13 +985,13 @@ class portRecords(semanageRecords):
def __delete(self, port, proto):
( k, proto_d, low, high ) = self.__genkey(port, proto)
- (rc,exists) = semanage_port_exists(self.sh, k)
+ (rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if not exists:
raise ValueError(_("Port %s/%s is not defined") % (proto, port))
- (rc,exists) = semanage_port_exists_local(self.sh, k)
+ (rc, exists) = semanage_port_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if not exists:
@@ -1038,17 +1097,17 @@ class nodeRecords(semanageRecords):
if ctype == "":
raise ValueError(_("SELinux Type is required"))
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
if rc < 0:
raise ValueError(_("Could not create key for %s") % addr)
if rc < 0:
raise ValueError(_("Could not check if addr %s is defined") % addr)
- (rc,exists) = semanage_node_exists(self.sh, k)
+ (rc, exists) = semanage_node_exists(self.sh, k)
if exists:
raise ValueError(_("Addr %s already defined") % addr)
- (rc,node) = semanage_node_create(self.sh)
+ (rc, node) = semanage_node_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create addr for %s") % addr)
@@ -1113,17 +1172,17 @@ class nodeRecords(semanageRecords):
if serange == "" and setype == "":
raise ValueError(_("Requires setype or serange"))
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
if rc < 0:
raise ValueError(_("Could not create key for %s") % addr)
- (rc,exists) = semanage_node_exists(self.sh, k)
+ (rc, exists) = semanage_node_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if addr %s is defined") % addr)
if not exists:
raise ValueError(_("Addr %s is not defined") % addr)
- (rc,node) = semanage_node_query(self.sh, k)
+ (rc, node) = semanage_node_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query addr %s") % addr)
@@ -1160,17 +1219,17 @@ class nodeRecords(semanageRecords):
else:
raise ValueError(_("Unknown or missing protocol"))
- (rc,k) = semanage_node_key_create(self.sh, addr, mask, proto)
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
if rc < 0:
raise ValueError(_("Could not create key for %s") % addr)
- (rc,exists) = semanage_node_exists(self.sh, k)
+ (rc, exists) = semanage_node_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if addr %s is defined") % addr)
if not exists:
raise ValueError(_("Addr %s is not defined") % addr)
- (rc,exists) = semanage_node_exists_local(self.sh, k)
+ (rc, exists) = semanage_node_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if addr %s is defined") % addr)
if not exists:
@@ -1240,17 +1299,17 @@ class interfaceRecords(semanageRecords):
if ctype == "":
raise ValueError(_("SELinux Type is required"))
- (rc,k) = semanage_iface_key_create(self.sh, interface)
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
if rc < 0:
raise ValueError(_("Could not create key for %s") % interface)
- (rc,exists) = semanage_iface_exists(self.sh, k)
+ (rc, exists) = semanage_iface_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if exists:
raise ValueError(_("Interface %s already defined") % interface)
- (rc,iface) = semanage_iface_create(self.sh)
+ (rc, iface) = semanage_iface_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create interface for %s") % interface)
@@ -1301,17 +1360,17 @@ class interfaceRecords(semanageRecords):
if serange == "" and setype == "":
raise ValueError(_("Requires setype or serange"))
- (rc,k) = semanage_iface_key_create(self.sh, interface)
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
if rc < 0:
raise ValueError(_("Could not create key for %s") % interface)
- (rc,exists) = semanage_iface_exists(self.sh, k)
+ (rc, exists) = semanage_iface_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if not exists:
raise ValueError(_("Interface %s is not defined") % interface)
- (rc,iface) = semanage_iface_query(self.sh, k)
+ (rc, iface) = semanage_iface_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query interface %s") % interface)
@@ -1335,17 +1394,17 @@ class interfaceRecords(semanageRecords):
self.commit()
def __delete(self, interface):
- (rc,k) = semanage_iface_key_create(self.sh, interface)
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
if rc < 0:
raise ValueError(_("Could not create key for %s") % interface)
- (rc,exists) = semanage_iface_exists(self.sh, k)
+ (rc, exists) = semanage_iface_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if not exists:
raise ValueError(_("Interface %s is not defined") % interface)
- (rc,exists) = semanage_iface_exists_local(self.sh, k)
+ (rc, exists) = semanage_iface_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if interface %s is defined") % interface)
if not exists:
@@ -1393,6 +1452,48 @@ class interfaceRecords(semanageRecords):
class fcontextRecords(semanageRecords):
def __init__(self, store = ""):
semanageRecords.__init__(self, store)
+ self.equiv = {}
+ self.equil_ind = False
+ try:
+ fd = open(selinux.selinux_file_context_subs_path(), "r")
+ for i in fd.readlines():
+ src, dst = i.split()
+ self.equiv[src] = dst
+ fd.close()
+ except IOError:
+ pass
+
+ def commit(self):
+ if self.equil_ind:
+ subs_file = selinux.selinux_file_context_subs_path()
+ tmpfile = "%s.tmp" % subs_file
+ fd = open(tmpfile, "w")
+ for src in self.equiv.keys():
+ fd.write("%s %s\n" % (src, self.equiv[src]))
+ fd.close()
+ try:
+ os.chmod(tmpfile, os.stat(subs_file)[stat.ST_MODE])
+ except:
+ pass
+ os.rename(tmpfile,subs_file)
+ self.equil_ind = False
+ semanageRecords.commit(self)
+
+ def add_equil(self, src, dst):
+ self.begin()
+ if src in self.equiv.keys():
+ raise ValueError(_("Equivalence class for %s already exists") % src)
+ self.equiv[src] = dst
+ self.equil_ind = True
+ self.commit()
+
+ def modify_equil(self, src, dst):
+ self.begin()
+ if src not in self.equiv.keys():
+ raise ValueError(_("Equivalence class for %s does not exists") % src)
+ self.equiv[src] = dst
+ self.equil_ind = True
+ self.commit()
def createcon(self, target, seuser = "system_u"):
(rc, con) = semanage_context_create(self.sh)
@@ -1429,23 +1530,23 @@ class fcontextRecords(semanageRecords):
if type == "":
raise ValueError(_("SELinux Type is required"))
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
if rc < 0:
raise ValueError(_("Could not create key for %s") % target)
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if not exists:
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if exists:
raise ValueError(_("File context for %s already defined") % target)
- (rc,fcontext) = semanage_fcontext_create(self.sh)
+ (rc, fcontext) = semanage_fcontext_create(self.sh)
if rc < 0:
raise ValueError(_("Could not create file context for %s") % target)
@@ -1486,21 +1587,21 @@ class fcontextRecords(semanageRecords):
raise ValueError(_("Requires setype, serange or seuser"))
self.validate(target)
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
if rc < 0:
raise ValueError(_("Could not create a key for %s") % target)
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if not exists:
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
if not exists:
raise ValueError(_("File context for %s is not defined") % target)
- (rc,fcontext) = semanage_fcontext_query_local(self.sh, k)
+ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
if rc < 0:
- (rc,fcontext) = semanage_fcontext_query(self.sh, k)
+ (rc, fcontext) = semanage_fcontext_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query file context for %s") % target)
@@ -1550,7 +1651,7 @@ class fcontextRecords(semanageRecords):
target = semanage_fcontext_get_expr(fcontext)
ftype = semanage_fcontext_get_type(fcontext)
ftype_str = semanage_fcontext_get_type_str(ftype)
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str])
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype_str])
if rc < 0:
raise ValueError(_("Could not create a key for %s") % target)
@@ -1558,19 +1659,26 @@ class fcontextRecords(semanageRecords):
if rc < 0:
raise ValueError(_("Could not delete the file context %s") % target)
semanage_fcontext_key_free(k)
-
+
+ self.equiv = {}
+ self.equil_ind = True
self.commit()
def __delete(self, target, ftype):
- (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
+ if target in self.equiv.keys():
+ self.equiv.pop(target)
+ self.equil_ind = True
+ return
+
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
if rc < 0:
raise ValueError(_("Could not create a key for %s") % target)
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if not exists:
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if exists:
@@ -1617,11 +1725,11 @@ class fcontextRecords(semanageRecords):
return ddict
def list(self, heading = 1, locallist = 0 ):
- if heading:
- print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
fcon_dict = self.get_all(locallist)
keys = fcon_dict.keys()
keys.sort()
+ if len(keys) > 0 and heading:
+ print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
for k in keys:
if fcon_dict[k]:
if is_mls_enabled:
@@ -1630,11 +1738,17 @@ class fcontextRecords(semanageRecords):
print "%-50s %-18s %s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1],fcon_dict[k][2])
else:
print "%-50s %-18s <<None>>" % (k[0], k[1])
+ if len(self.equiv.keys()) > 0:
+ if heading:
+ print _("\nSELinux fcontext Equivalence \n")
+
+ for src in self.equiv.keys():
+ print "%s == %s" % (src, self.equiv[src])
class booleanRecords(semanageRecords):
def __init__(self, store = ""):
semanageRecords.__init__(self, store)
- self.dict={}
+ self.dict = {}
self.dict["TRUE"] = 1
self.dict["FALSE"] = 0
self.dict["ON"] = 1
@@ -1643,16 +1757,16 @@ class booleanRecords(semanageRecords):
self.dict["0"] = 0
def __mod(self, name, value):
- (rc,k) = semanage_bool_key_create(self.sh, name)
+ (rc, k) = semanage_bool_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_bool_exists(self.sh, k)
+ (rc, exists) = semanage_bool_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if boolean %s is defined") % name)
if not exists:
raise ValueError(_("Boolean %s is not defined") % name)
- (rc,b) = semanage_bool_query(self.sh, k)
+ (rc, b) = semanage_bool_query(self.sh, k)
if rc < 0:
raise ValueError(_("Could not query file context %s") % name)
@@ -1670,7 +1784,7 @@ class booleanRecords(semanageRecords):
semanage_bool_key_free(k)
semanage_bool_free(b)
- def modify(self, name, value=None, use_file=False):
+ def modify(self, name, value = None, use_file = False):
self.begin()
@@ -1694,16 +1808,16 @@ class booleanRecords(semanageRecords):
def __delete(self, name):
- (rc,k) = semanage_bool_key_create(self.sh, name)
+ (rc, k) = semanage_bool_key_create(self.sh, name)
if rc < 0:
raise ValueError(_("Could not create a key for %s") % name)
- (rc,exists) = semanage_bool_exists(self.sh, k)
+ (rc, exists) = semanage_bool_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if boolean %s is defined") % name)
if not exists:
raise ValueError(_("Boolean %s is not defined") % name)
- (rc,exists) = semanage_bool_exists_local(self.sh, k)
+ (rc, exists) = semanage_bool_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if boolean %s is defined") % name)
if not exists:
@@ -1762,7 +1876,7 @@ class booleanRecords(semanageRecords):
return _("unknown")
def list(self, heading = True, locallist = False, use_file = False):
- on_off = (_("off"),_("on"))
+ on_off = (_("off"), _("on"))
if use_file:
ddict = self.get_all(locallist)
keys = ddict.keys()
diff -up policycoreutils-2.0.62/setfiles/setfiles.c.rhat policycoreutils-2.0.62/setfiles/setfiles.c
--- policycoreutils-2.0.62/setfiles/setfiles.c.rhat 2009-02-18 16:45:01.000000000 -0500
+++ policycoreutils-2.0.62/setfiles/setfiles.c 2009-05-05 10:49:02.000000000 -0400
@@ -29,6 +29,8 @@
static int mass_relabel;
static int mass_relabel_errs;
+#define STAR_COUNT 1000
+
static FILE *outfile = NULL;
static int force = 0;
#define STAT_BLOCK_SIZE 1
@@ -444,11 +446,11 @@ static int restore(const char *file)
if (progress) {
count++;
- if (count % 80000 == 0) {
+ if (count % (80 * STAR_COUNT) == 0) {
fprintf(stdout, "\n");
fflush(stdout);
}
- if (count % 1000 == 0) {
+ if (count % STAR_COUNT == 0) {
fprintf(stdout, "*");
fflush(stdout);
}
@@ -1017,7 +1019,7 @@ int main(int argc, char **argv)
free(excludeArray[i].directory);
}
- if (progress)
+ if (progress && count >= STAR_COUNT)
printf("\n");
exit(errors);
}
diff -up policycoreutils-2.0.62/semanage/seobject.py~ policycoreutils-2.0.62/semanage/seobject.py
--- policycoreutils-2.0.62/semanage/seobject.py~ 2009-05-14 09:02:13.000000000 -0400
+++ policycoreutils-2.0.62/semanage/seobject.py 2009-05-14 09:03:05.000000000 -0400
@@ -1027,7 +1027,7 @@ class portRecords(semanageRecords):
proto_str = semanage_port_get_proto_str(proto)
low = semanage_port_get_low(port)
high = semanage_port_get_high(port)
- ddict[(low, high)] = (ctype, proto_str, level)
+ ddict[(low, high, proto_str)] = (ctype, level)
return ddict
def get_all_by_type(self, locallist = 0):
diff -up policycoreutils-2.0.62/setfiles/setfiles.c~ policycoreutils-2.0.62/setfiles/setfiles.c
--- policycoreutils-2.0.62/setfiles/setfiles.c~ 2009-09-09 16:50:37.000000000 +0200
+++ policycoreutils-2.0.62/setfiles/setfiles.c 2009-09-09 16:51:23.000000000 +0200
@@ -683,6 +683,8 @@ static int process_one(char *name)
progname, name, strerror(errno));
goto err;
}
+ close(pipe_fds[0]);
+ pipe_fds[0] = -1;
} else {
rc = restore(name);
if (rc)