diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/audit2allow policycoreutils-2.0.57/audit2allow/audit2allow
--- nsapolicycoreutils/audit2allow/audit2allow 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/audit2allow/audit2allow 2009-05-26 12:05:46.000000000 +0200
@@ -42,10 +42,10 @@
from optparse import OptionParser
parser = OptionParser(version=self.VERSION)
- parser.add_option("-a", "--audit", action="store_true", dest="audit", default=False,
+ parser.add_option("-a", "--all", action="store_true", dest="audit", default=False,
help="read input from audit log - conflicts with -i")
parser.add_option("-d", "--dmesg", action="store_true", dest="dmesg", default=False,
- help="read input from dmesg - conflicts with --audit and --input")
+ help="read input from dmesg - conflicts with --all and --input")
parser.add_option("-i", "--input", dest="input",
help="read input from <input> - conflicts with -a")
parser.add_option("-l", "--lastreload", action="store_true", dest="lastreload", default=False,
@@ -82,9 +82,9 @@
# Make -d, -a, and -i conflict
if options.audit is True:
if options.input is not None:
- sys.stderr.write("error: --audit conflicts with --input\n")
+ sys.stderr.write("error: --all conflicts with --input\n")
if options.dmesg is True:
- sys.stderr.write("error: --audit conflicts with --dmesg\n")
+ sys.stderr.write("error: --all conflicts with --dmesg\n")
if options.input is not None and options.dmesg is True:
sys.stderr.write("error: --input conflicts with --dmesg\n")
@@ -200,7 +200,7 @@
try:
fd = open(filename, "w")
except IOError, e:
- sys.stderr.write("could not write output file: %s\n", str(e))
+ sys.stderr.write("could not write output file: %s\n" % str(e))
sys.exit(1)
writer.write(generator.get_module(), fd)
@@ -287,7 +287,11 @@
def __output(self):
if self.__options.audit2why:
- return self.__output_audit2why()
+ try:
+ return self.__output_audit2why()
+ except RuntimeError, e:
+ print e
+ sys.exit(1)
g = policygen.PolicyGenerator()
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/audit2allow.1 policycoreutils-2.0.57/audit2allow/audit2allow.1
--- nsapolicycoreutils/audit2allow/audit2allow.1 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/audit2allow/audit2allow.1 2009-05-26 12:05:46.000000000 +0200
@@ -44,9 +44,6 @@
Note that all audit messages are not available via dmesg when
auditd is running; use "ausearch -m avc | audit2allow" or "-a" instead.
.TP
-.B "\-f" | "\-\-fcfile" <File Context File>
-Add File Context File to generated Module Package. Requires -M option.
-.TP
.B "\-h" | "\-\-help"
Print a short usage message
.TP
@@ -78,11 +75,8 @@
Generate reference policy using installed macros.
This attempts to match denials against interfaces and may be inaccurate.
.TP
-.B "\-t " | "\-\-tefile"
-Indicates input file is a te (type enforcement) file. This can be used to translate old te format to new policy format.
-.TP
.B "\-w" | "\-\-why"
-Translates SELinux audit messages into a description of why the access wasn denied
+Translates SELinux audit messages into a description of why the access was denied
.TP
.B "\-v" | "\-\-verbose"
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.57/Makefile
--- nsapolicycoreutils/Makefile 2008-09-22 19:25:07.000000000 +0200
+++ policycoreutils-2.0.57/Makefile 2009-05-26 12:05:46.000000000 +0200
@@ -1,4 +1,4 @@
-SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.c policycoreutils-2.0.57/newrole/newrole.c
--- nsapolicycoreutils/newrole/newrole.c 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/newrole/newrole.c 2009-05-26 12:05:46.000000000 +0200
@@ -553,7 +553,7 @@
new_caps = cap_init();
tmp_caps = cap_init();
if (!new_caps || !tmp_caps) {
- fprintf(stderr, _("Error initing capabilities, aborting.\n"));
+ fprintf(stderr, _("Error initializing capabilities, aborting.\n"));
return -1;
}
rc |= cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET);
@@ -631,7 +631,7 @@
/* Non-root caller, suid root path */
new_caps = cap_init();
if (!new_caps) {
- fprintf(stderr, _("Error initing capabilities, aborting.\n"));
+ fprintf(stderr, _("Error initializing capabilities, aborting.\n"));
return -1;
}
rc |= cap_set_flag(new_caps, CAP_PERMITTED, 6, cap_list, CAP_SET);
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/Makefile policycoreutils-2.0.57/restorecond/Makefile
--- nsapolicycoreutils/restorecond/Makefile 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/Makefile 2009-05-26 12:05:46.000000000 +0200
@@ -20,7 +20,7 @@
install -m 755 restorecond $(SBINDIR)
install -m 644 restorecond.8 $(MANDIR)/man8
-mkdir -p $(INITDIR)
- install -m 644 restorecond.init $(INITDIR)/restorecond
+ install -m 755 restorecond.init $(INITDIR)/restorecond
-mkdir -p $(SELINUXDIR)
install -m 600 restorecond.conf $(SELINUXDIR)/restorecond.conf
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.57/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/restorecond.c 2009-05-26 12:05:46.000000000 +0200
@@ -1,7 +1,7 @@
/*
* restorecond
*
- * Copyright (C) 2006 Red Hat
+ * Copyright (C) 2006-2009 Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software; you can redistribute it and/or
@@ -75,7 +75,7 @@
static int debug_mode = 0;
static int verbose_mode = 0;
-static void restore(const char *filename);
+static void restore(const char *filename, int exact);
struct watchList {
struct watchList *next;
@@ -113,12 +113,13 @@
printf("%d: File=%s\n", wd, file);
while (ptr != NULL) {
if (ptr->wd == wd) {
- if (strings_list_find(ptr->files, file) == 0) {
+ int exact=0;
+ if (strings_list_find(ptr->files, file, &exact) == 0) {
char *path = NULL;
if (asprintf(&path, "%s/%s", ptr->dir, file) <
0)
exitApp("Error allocating memory.");
- restore(path);
+ restore(path, exact);
free(path);
return 0;
}
@@ -155,7 +156,7 @@
Set the file context to the default file context for this system.
Same as restorecon.
*/
-static void restore(const char *filename)
+static void restore(const char *filename, int exact)
{
int retcontext = 0;
security_context_t scontext = NULL;
@@ -181,9 +182,11 @@
}
if (!(st.st_mode & S_IFDIR) && st.st_nlink > 1) {
- syslog(LOG_ERR,
- "Will not restore a file with more than one hard link (%s) %s\n",
- filename, strerror(errno));
+ if (exact) {
+ syslog(LOG_ERR,
+ "Will not restore a file with more than one hard link (%s) %s\n",
+ filename, strerror(errno));
+ }
close(fd);
return;
}
@@ -283,6 +286,8 @@
inotify_rm_watch(fd, master_wd);
master_wd =
inotify_add_watch(fd, watch_file_path, IN_MOVED_FROM | IN_MODIFY);
+ if (master_wd == -1)
+ exitApp("Error watching config file.");
}
/*
@@ -396,7 +401,7 @@
char *file = basename(path);
ptr = firstDir;
- restore(path);
+ restore(path, 1);
while (ptr != NULL) {
if (strcmp(dir, ptr->dir) == 0) {
@@ -411,7 +416,14 @@
if (!ptr)
exitApp("Out of Memory");
+
ptr->wd = inotify_add_watch(fd, dir, IN_CREATE | IN_MOVED_TO);
+ if (ptr->wd == -1) {
+ free(ptr);
+ syslog(LOG_ERR, "Unable to watch (%s) %s\n",
+ path, strerror(errno));
+ return;
+ }
ptr->dir = strdup(dir);
if (!ptr->dir)
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.57/restorecond/restorecond.conf
--- nsapolicycoreutils/restorecond/restorecond.conf 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/restorecond.conf 2009-05-26 12:05:46.000000000 +0200
@@ -5,4 +5,7 @@
/var/run/utmp
/var/log/wtmp
~/*
-~/.mozilla/plugins/libflashplayer.so
+/root/.ssh
+/root/.ssh/*
+
+
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/stringslist.c policycoreutils-2.0.57/restorecond/stringslist.c
--- nsapolicycoreutils/restorecond/stringslist.c 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/stringslist.c 2009-05-26 12:05:46.000000000 +0200
@@ -55,9 +55,10 @@
*list = newptr;
}
-int strings_list_find(struct stringsList *ptr, const char *string)
+int strings_list_find(struct stringsList *ptr, const char *string, int *exact)
{
while (ptr) {
+ *exact = strcmp(ptr->string, string) == 0;
int cmp = fnmatch(ptr->string, string, 0);
if (cmp == 0)
return 0; /* Match found */
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/stringslist.h policycoreutils-2.0.57/restorecond/stringslist.h
--- nsapolicycoreutils/restorecond/stringslist.h 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/stringslist.h 2009-05-26 12:05:46.000000000 +0200
@@ -31,7 +31,7 @@
void strings_list_free(struct stringsList *list);
void strings_list_add(struct stringsList **list, const char *string);
void strings_list_print(struct stringsList *list);
-int strings_list_find(struct stringsList *list, const char *string);
+int strings_list_find(struct stringsList *list, const char *string, int *exact);
int strings_list_diff(struct stringsList *from, struct stringsList *to);
#endif
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/utmpwatcher.c policycoreutils-2.0.57/restorecond/utmpwatcher.c
--- nsapolicycoreutils/restorecond/utmpwatcher.c 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/restorecond/utmpwatcher.c 2009-05-26 12:05:46.000000000 +0200
@@ -57,7 +57,7 @@
utmp_ptr = NULL;
FILE *cfg = fopen(utmp_path, "r");
if (!cfg)
- exitApp("Error reading config file.");
+ exitApp("Error reading utmp file.");
while (fread(&u, sizeof(struct utmp), 1, cfg) > 0) {
if (u.ut_type == USER_PROCESS)
@@ -69,6 +69,9 @@
utmp_wd =
inotify_add_watch(inotify_fd, utmp_path, IN_MOVED_FROM | IN_MODIFY);
+ if (utmp_wd == -1)
+ exitApp("Error watching utmp file.");
+
if (prev_utmp_ptr) {
changed = strings_list_diff(prev_utmp_ptr, utmp_ptr);
strings_list_free(prev_utmp_ptr);
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.57/scripts/chcat
--- nsapolicycoreutils/scripts/chcat 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/scripts/chcat 2009-05-26 12:05:46.000000000 +0200
@@ -281,16 +281,18 @@
def expandCats(cats):
newcats = []
for c in cats:
- if c.find(".") != -1:
- c = c.split(".")
- for i in range(int(c[0][1:]), int(c[1][1:]) + 1):
- x = ("c%d" % i)
- if x not in newcats:
- newcats.append("c%d" % i)
- else:
- for i in c.split(","):
+ for i in c.split(","):
+ if i.find(".") != -1:
+ j = i.split(".")
+ for k in range(int(j[0][1:]), int(j[1][1:]) + 1):
+ x = ("c%d" % k)
+ if x not in newcats:
+ newcats.append(x)
+ else:
if i not in newcats:
newcats.append(i)
+ if len(newcats) > 25:
+ return cats
return newcats
def translate(cats):
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.57/scripts/fixfiles
--- nsapolicycoreutils/scripts/fixfiles 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/scripts/fixfiles 2009-05-26 12:05:46.000000000 +0200
@@ -3,7 +3,7 @@
#
# Script to restore labels on a SELinux box
#
-# Copyright (C) 2004 Red Hat, Inc.
+# Copyright (C) 2004-2009 Red Hat, Inc.
# Authors: Dan Walsh <dwalsh@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
@@ -36,8 +36,8 @@
LOGGER=/usr/sbin/logger
SETFILES=/sbin/setfiles
RESTORECON=/sbin/restorecon
-FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs ).*\(rw/{print $3}';`
-FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs ).*\(ro/{print $3}';`
+FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';`
+FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';`
FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
SELINUXTYPE="targeted"
if [ -e /etc/selinux/config ]; then
@@ -122,7 +122,7 @@
fi
if [ ! -z "$RPMFILES" ]; then
for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
- rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1 >> $LOGFILE
+ rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f - 2>&1 >> $LOGFILE
done
exit $?
fi
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.57/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/semanage/seobject.py 2009-05-26 12:07:51.000000000 +0200
@@ -35,7 +35,7 @@
import __builtin__
__builtin__.__dict__['_'] = unicode
-is_mls_enabled = selinux.is_selinux_mls_enabled()
+is_mls_enabled = not selinux.is_selinux_enabled() or selinux.is_selinux_mls_enabled()
import syslog
@@ -965,7 +965,7 @@
proto_str = semanage_port_get_proto_str(proto)
low = semanage_port_get_low(port)
high = semanage_port_get_high(port)
- ddict[(low, high)] = (ctype, proto_str, level)
+ ddict[(low, high, proto_str)] = (ctype, level)
return ddict
def get_all_by_type(self, locallist = 0):
@@ -1433,8 +1433,14 @@
(rc,exists) = semanage_fcontext_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
- if exists:
- raise ValueError(_("File context for %s already defined") % target)
+
+ if not exists:
+ (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if file context for %s is defined") % target)
+
+ if exists:
+ raise ValueError(_("File context for %s already defined") % target)
(rc,fcontext) = semanage_fcontext_create(self.sh)
if rc < 0:
@@ -1481,15 +1487,19 @@
if rc < 0:
raise ValueError(_("Could not create a key for %s") % target)
- (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ (rc,exists) = semanage_fcontext_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if not exists:
- raise ValueError(_("File context for %s is not defined") % target)
+ (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
+ if not exists:
+ raise ValueError(_("File context for %s is not defined") % target)
(rc,fcontext) = semanage_fcontext_query_local(self.sh, k)
if rc < 0:
- raise ValueError(_("Could not query file context for %s") % target)
+ (rc,fcontext) = semanage_fcontext_query(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not query file context for %s") % target)
if setype != "<<none>>":
con = semanage_fcontext_get_con(fcontext)
@@ -1591,30 +1601,33 @@
self.flist += fclocal
+ ddict = {}
for fcontext in self.flist:
expr = semanage_fcontext_get_expr(fcontext)
ftype = semanage_fcontext_get_type(fcontext)
ftype_str = semanage_fcontext_get_type_str(ftype)
con = semanage_fcontext_get_con(fcontext)
if con:
- l.append((expr, ftype_str, semanage_context_get_user(con), semanage_context_get_role(con), semanage_context_get_type(con), semanage_context_get_mls(con)))
+ ddict[(expr, ftype_str)] = (semanage_context_get_user(con), semanage_context_get_role(con), semanage_context_get_type(con), semanage_context_get_mls(con))
else:
- l.append((expr, ftype_str, con))
+ ddict[(expr, ftype_str)] = con
- return l
+ return ddict
def list(self, heading = 1, locallist = 0 ):
if heading:
print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
- fcon_list = self.get_all(locallist)
- for fcon in fcon_list:
- if len(fcon) > 3:
+ fcon_dict = self.get_all(locallist)
+ keys = fcon_dict.keys()
+ keys.sort()
+ for k in keys:
+ if fcon_dict[k]:
if is_mls_enabled:
- print "%-50s %-18s %s:%s:%s:%s " % (fcon[0], fcon[1], fcon[2], fcon[3], fcon[4], translate(fcon[5],False))
+ print "%-50s %-18s %s:%s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1], fcon_dict[k][2], translate(fcon_dict[k][3],False))
else:
- print "%-50s %-18s %s:%s:%s " % (fcon[0], fcon[1], fcon[2], fcon[3],fcon[4])
+ print "%-50s %-18s %s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1],fcon_dict[k][2])
else:
- print "%-50s %-18s <<None>>" % (fcon[0], fcon[1])
+ print "%-50s %-18s <<None>>" % (k[0], k[1])
class booleanRecords(semanageRecords):
def __init__(self, store = ""):
diff --exclude-from=exclude --exclude=sepolgen-1.0.14 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/setfiles/setfiles.c policycoreutils-2.0.57/setfiles/setfiles.c
--- nsapolicycoreutils/setfiles/setfiles.c 2008-09-22 19:25:08.000000000 +0200
+++ policycoreutils-2.0.57/setfiles/setfiles.c 2009-05-26 12:05:46.000000000 +0200
@@ -29,6 +29,8 @@
static int mass_relabel;
static int mass_relabel_errs;
+#define STAR_COUNT 1000
+
static FILE *outfile = NULL;
static int force = 0;
#define STAT_BLOCK_SIZE 1
@@ -444,11 +446,11 @@
if (progress) {
count++;
- if (count % 80000 == 0) {
+ if (count % (80 * STAR_COUNT) == 0) {
fprintf(stdout, "\n");
fflush(stdout);
}
- if (count % 1000 == 0) {
+ if (count % STAR_COUNT == 0) {
fprintf(stdout, "*");
fflush(stdout);
}
@@ -1017,7 +1019,7 @@
free(excludeArray[i].directory);
}
- if (progress)
+ if (progress && count >= STAR_COUNT)
printf("\n");
exit(errors);
}