|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#! /usr/bin/python -Es
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# Copyright (C) 2012 Red Hat
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# AUTHOR: Dan Walsh <dwalsh@redhat.com>
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# see file 'COPYING' for use and warranty information
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# semanage is a tool for managing SELinux configuration files
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# This program is free software; you can redistribute it and/or
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# modify it under the terms of the GNU General Public License as
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# published by the Free Software Foundation; either version 2 of
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# the License, or (at your option) any later version.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# This program is distributed in the hope that it will be useful,
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# GNU General Public License for more details.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# You should have received a copy of the GNU General Public License
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# along with this program; if not, write to the Free Software
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# 02111-1307 USA
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
import argparse
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import senetwork
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import seobject
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import selinux
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import datetime
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import setools
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import commands
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import sys
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
import os
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import xml.etree.ElementTree
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
modules_dict = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
try:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
tree = xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for l in tree.findall("layer"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for m in l.findall("module"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
name = m.get("name")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if name == "user" or name == "unconfined":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
continue
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if name == "unprivuser":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
name = "user"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if name == "unconfineduser":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
name = "unconfined"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for b in m.findall("summary"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
modules_dict[name] = b.text
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
except IOError, e:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
pass
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_attributes = map(lambda x: x['name'], setools.seinfo(setools.ATTRIBUTE))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
entrypoints = setools.seinfo(setools.ATTRIBUTE,"entry_type")[0]["types"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
alldomains = setools.seinfo(setools.ATTRIBUTE,"domain")[0]["types"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
domains = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fc_path = selinux.selinux_file_context_path()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fd = open(selinux.selinux_file_context_path(), "r")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fc = fd.readlines()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fd.close()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fd = open(selinux.selinux_file_context_path()+".homedirs", "r")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fc += fd.readlines()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fd.close()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in fc:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
rec = i.split()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
try:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
t = rec[-1].split(":")[2]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if t in fcdict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict[t].append(rec[0])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict[t] = [ rec[0] ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
except:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
pass
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["logfile"] = [ "all log files" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["user_tmp_type"] = [ "all user tmp files" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["user_home_type"] = [ "all user home files" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["virt_image_type"] = [ "all virtual image files" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["noxattrfs"] = [ "all files on file systems which do not support extended attributes" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["sandbox_tmpfs_type"] = [ "all sandbox content in tmpfs file systems" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["user_tmpfs_type"] = [ "all user content in tmpfs file systems" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fcdict["file_type"] = [ "all files on the system" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
role_allows = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for rule in commands.getoutput("sesearch --role_allow").split("\n"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
role = rule.split()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(role) == 3 and role[0] == "allow" and role[1] != "system_r" and role[2][:-1] != "system_r":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if role[1] not in role_allows:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
role_allows[role[1]] = [role[2][:-1]]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
role_allows[role[1]].append(role[2][:-1])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#role_allows = setools.sesearch([setools.ROLE_ALLOW],{'scontext':self.type,'tcontext':'ping_t', 'class':'process'})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
roles = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
allroles = map(lambda x: x['name'], setools.seinfo(setools.ROLE))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for r in allroles:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if r not in [ "system_r", "object_r" ]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
roles.append(r[:-2])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for d in alldomains:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
found = False
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
domain = d[:-2]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if domain + "_exec_t" not in entrypoints:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
continue
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if domain in domains or name == "pam":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
continue
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
domains.append(domain)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for role in roles:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if role in domains:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
continue
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
domains.append(role)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
domains.sort()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
users = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
allusers = map(lambda x: x['name'], setools.seinfo(setools.USER))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for u in allusers:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if u not in [ "system_u", "root", "unconfined_u" ]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
users.append(u.replace("_u",""))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
users.sort()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
import setools
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_types = setools.seinfo(setools.TYPE)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
types = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for rec in all_types:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
try:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
types[rec["name"]] = rec["attributes"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
except:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
types[rec["name"]] = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
file_types = setools.seinfo(setools.ATTRIBUTE,"file_type")[0]["types"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
file_types.sort()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
port_types = setools.seinfo(setools.ATTRIBUTE,"port_type")[0]["types"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
port_types.sort()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
portrecs = seobject.portRecords().get_all_by_type()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
filerecs = seobject.fcontextRecords()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
files_dict = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
fdict = filerecs.get_all()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in fdict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if fdict[i]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if fdict[i][2] in files_dict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
files_dict[fdict[i][2]].append(i)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
files_dict[fdict[i][2]] = [i]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
boolrecs = seobject.booleanRecords()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
bools = seobject.booleans_dict.keys()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
man = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
date = datetime.datetime.now().strftime("%d %b %Y")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def prettyprint(f,trim):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return " ".join(f[:-len(trim)].split("_"))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
def get_os_version():
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = ""
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
pkg_name = "selinux-policy"
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
try:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
import commands
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
rc, output = commands.getstatusoutput("rpm -q '%s'" % pkg_name)
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
if rc == 0:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = output.split(".")[-2]
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
except:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = ""
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
if os_version[0:2] == "fc":
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = "Fedora"+os_version[2:]
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
elif os_version[0:2] == "el":
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = "RHEL"+os_version[2:]
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
else:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = ""
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
return os_version
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
os_version = get_os_version()
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
class ManPage:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
7659a8f |
def __init__(self, domainname, path):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.domainname = domainname
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.short_name = domainname
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.type = self.domainname + "_t"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd = open("%s/%s_selinux.8" % (path, domainname), 'w')
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if domainname in roles:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.__gen_user_man_page()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.__gen_man_page()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.close()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def __gen_user_man_page(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.role = self.domainname + "_r"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
try:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.desc = modules_dict[self.domainname]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
except:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.desc = "%s user role" % self.domainname
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.domainname in users:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.attributes = setools.seinfo(setools.TYPE,(self.type))[0]["attributes"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.user_header()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.user_attribute()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.can_sudo()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.xwindows_login()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
# until a new policy build with login_userdomain attribute
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
#self.terminal_login()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.network()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.booleans()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.home_exec()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.transitions()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.role_header()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.booleans()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.port_types()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.writes()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.footer()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def __gen_man_page(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.domainname[-1]=='d':
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.short_name = self.domainname[:-1]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.anon_list = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.attributes = {}
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.ptypes = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.get_ptypes()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for domain_type in self.ptypes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.attributes[domain_type] = setools.seinfo(setools.TYPE,("%s") % domain_type)[0]["attributes"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.header()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.booleans()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.nsswitch_domain()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.public_content()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.file_context()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.port_types()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.process_types()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.writes()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.footer()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def get_ptypes(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for f in alldomains:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.startswith(self.short_name):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.ptypes.append(f)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def header(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write('.TH "%(domainname)s_selinux" "8" "%(domainname)s" "dwalsh@redhat.com" "%(domainname)s SELinux Policy documentation"'
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
% {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "NAME"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
%(domainname)s_selinux \- Security Enhanced Linux Policy for the %(domainname)s processes
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "DESCRIPTION"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Security-Enhanced Linux secures the %(domainname)s processes via flexible mandatory access
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
control.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def explain(self, f):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_var_run_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /run directory." % prettyprint(f, "_var_run_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_pid_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /run directory." % prettyprint(f, "_pid_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_var_lib_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /var/lib directory." % prettyprint(f, "_var_lib_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_var_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /var directory." % prettyprint(f, "_var_lib_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_var_spool_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /var/spool directory." % prettyprint(f, "_spool_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_spool_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the %s files under the /var/spool directory." % prettyprint(f, "_spool_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_cache_t") or f.endswith("_var_cache_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store the files under the /var/cache directory."
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_keytab_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as kerberos keytab files."
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_lock_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s lock data, stored under the /var/lock directory" % prettyprint(f,"_lock_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_log_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the data as %s log data, usually stored under the /var/log directory." % prettyprint(f,"_log_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_config_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s configuration data, usually stored under the /etc directory." % prettyprint(f,"_config_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_conf_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s configuration data, usually stored under the /etc directory." % prettyprint(f,"_conf_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_exec_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "transition an executable to the %s_t domain." % f[:-len("_exec_t")]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_cgi_content_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s cgi content." % prettyprint(f, "_cgi_content_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_rw_content_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/write content." % prettyprint(f,"_rw_content_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_rw_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/write content." % prettyprint(f,"_rw_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_write_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/write content." % prettyprint(f,"_write_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_db_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s database content." % prettyprint(f,"_db_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_ra_content_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/append content." % prettyprint(f,"_ra_conten_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_cert_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s certificate data." % prettyprint(f,"_cert_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_key_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s key data." % prettyprint(f,"_key_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_secret_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s secret data." % prettyprint(f,"_key_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_ra_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/append content." % prettyprint(f,"_ra_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_ro_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s read/only content." % prettyprint(f,"_ro_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_modules_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s modules." % prettyprint(f, "_modules_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_content_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s content." % prettyprint(f, "_content_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_state_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s state data." % prettyprint(f, "_state_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_files_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s content." % prettyprint(f, "_files_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_file_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s content." % prettyprint(f, "_file_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_data_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s content." % prettyprint(f, "_data_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_file_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the data as %s content." % prettyprint(f, "_file_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_tmp_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store %s temporary files in the /tmp directories." % prettyprint(f, "_tmp_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_etc_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store %s files in the /etc directories." % prettyprint(f, "_tmp_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_home_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store %s files in the users home directory." % prettyprint(f, "_home_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_tmpfs_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "store %s files on a tmpfs file system." % prettyprint(f, "_tmpfs_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_unit_file_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat files as a systemd unit file."
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.endswith("_htaccess_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the file as a %s access file." % prettyprint(f, "_htaccess_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return "treat the files as %s data." % prettyprint(f,"_t")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def booleans(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.booltext = ""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for b in bools:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if b.find(self.short_name) >= 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if b.endswith("anon_write"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.anon_list.append(b)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
desc = seobject.booleans_dict[b][2][0].lower() + seobject.booleans_dict[b][2][1:]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if desc[-1] == ".":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
desc = desc[:-1]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.booltext += """
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you want to %s, you must turn on the %s boolean.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B setsebool -P %s 1
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (desc, b, b)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.booltext != "":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH BOOLEANS
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux policy is customizable based on least access required. %s policy is extremely flexible and has several booleans that allow you to manipulate the policy and run %s with the tightest access possible.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (self.domainname, self.domainname))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(self.booltext)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def nsswitch_domain(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
nsswitch_types = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
nsswitch_booleans = ['authlogin_nsswitch_use_ldap', 'kerberos_enabled']
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
nsswitchbooltext = ""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "nsswitch_domain" in all_attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH NSSWITCH DOMAIN
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for k in self.attributes.keys():
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "nsswitch_domain" in self.attributes[k]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
nsswitch_types.append(k)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(nsswitch_types):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in nsswitch_booleans:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
desc = seobject.booleans_dict[i][2][0].lower() + seobject.booleans_dict[i][2][1:-1]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
nsswitchbooltext += """
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you want to %s for the %s, you must turn on the %s boolean.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B setsebool -P %s 1
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (desc,(", ".join(nsswitch_types)), i, i)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(nsswitchbooltext)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def process_types(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(self.ptypes) == 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH PROCESS TYPES
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux defines process types (domains) for each process running on the system
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can see the context of a process using the \fB\-Z\fP option to \fBps\bP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Policy governs the access confined processes have to files.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux %(domainname)s policy is very flexible allowing users to setup their %(domainname)s processes in as secure a method as possible.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The following process types are defined for %(domainname)s:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE""" % ", ".join(self.ptypes))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Note:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage permissive -a PROCESS_TYPE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can be used to make a process type permissive. Permissive process types are not denied access by SELinux. AVC messages will still be generated.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def port_types(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.ports = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for f in port_types:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.startswith(self.short_name):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.ports.append(f)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(self.ports) == 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH PORT TYPES
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux defines port types to represent TCP and UDP ports.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can see the types associated with a port by using the following command:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage port -l
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Policy governs the access confined processes have to these ports.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux %(domainname)s policy is very flexible allowing users to setup their %(domainname)s processes in as secure a method as possible.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The following port types are defined for %(domainname)s:""" % {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for p in self.ports:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP 5
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP 10
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % p)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
once = True
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for prot in ( "tcp", "udp" ):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if (p,prot) in portrecs:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if once:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Default Defined Ports:""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
once = False
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
%s %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE""" % (prot, ",".join(portrecs[(p,prot)])))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def file_context(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH FILE CONTEXTS
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux requires files to have an extended attribute to define the file type.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can see the context of a file using the \fB\-Z\fP option to \fBls\bP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Policy governs the access confined processes have to these files.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux %(domainname)s policy is very flexible allowing users to setup their %(domainname)s processes in as secure a method as possible.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The following file types are defined for %(domainname)s:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for f in file_types:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f.startswith(self.domainname):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
- Set files with the %s type, if you want to %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (f, f, self.explain(f)))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f in files_dict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
plural = ""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(files_dict[f]) > 1:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
plural = "s"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP 5
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Path%s:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
%s""" % (plural, files_dict[f][0][0]))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for x in files_dict[f][1:]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(", %s" % x[0])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage fcontext
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
command. This will modify the SELinux labeling database. You will need to use
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B restorecon
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
to apply the labels.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def see_also(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
ret = ""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for d in domains:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if d == self.domainname:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
continue
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if d.startswith(self.short_name):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
ret += ", %s_selinux(8)" % d
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.domainname.startswith(d):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
ret += ", %s_selinux(8)" % d
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(ret)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def public_content(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(self.anon_list) > 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH SHARING FILES
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Allow %(domainname)s servers to read the /var/%(domainname)s directory by adding the public_content_t file type to the directory and by restoring the file type.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
semanage fcontext -a -t public_content_t "/var/%(domainname)s(/.*)?"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B restorecon -F -R -v /var/%(domainname)s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.pp
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Allow %(domainname)s servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the file type. This also requires the allow_%(domainname)sd_anon_write boolean to be set.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
semanage fcontext -a -t public_content_rw_t "/var/%(domainname)s/incoming(/.*)?"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B restorecon -F -R -v /var/%(domainname)s/incoming
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'domainname':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for b in self.anon_list:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
desc = seobject.booleans_dict[b][2][0].lower() + seobject.booleans_dict[b][2][1:]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you want to %s, you must turn on the %s boolean.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EX
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B setsebool -P %s 1
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.EE
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (desc, b, b))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def footer(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "COMMANDS"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage fcontext
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can also be used to manipulate default file context mappings.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage permissive
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can also be used to manipulate whether or not a process type is permissive.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage module
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can also be used to enable/disable/install/remove policy modules.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(self.ports) > 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage port
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can also be used to manipulate the port definitions
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.booltext != "":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage boolean
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
can also be used to manipulate the booleans
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.PP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B system-config-selinux
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
is a GUI tool available to customize SELinux policy settings.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH AUTHOR
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
This manual page was auto-generated by genman.py.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "SEE ALSO"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
selinux(8), %s(8), semanage(8), restorecon(8), chcon(1)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.booltext != "":
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(", setsebool(8)")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.see_also()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def valid_write(self, check, attributes):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if check in [ self.type, "domain" ]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return False
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if check.endswith("_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for a in attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if a in types[check]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return False
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return True
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def writes(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
permlist = setools.sesearch([setools.ALLOW],{'scontext':self.type, 'permlist':['open', 'write'], 'class':'file'})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if permlist == None:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
return
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write ("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "MANAGED FILES"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_writes = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
attributes = ["proc_type", "sysctl_type"]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in permlist:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if not i['tcontext'].endswith("_t"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
attributes.append(i['tcontext'])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in permlist:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.valid_write(i['tcontext'],attributes):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if i['tcontext'] not in all_writes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_writes.append(i['tcontext'])
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write ("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user type %s_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_writes.sort()
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "file_type" in all_writes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
all_writes = [ "file_type" ]
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for f in all_writes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % f)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if f in fcdict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for path in fcdict[f]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""\t%s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % path)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def user_header(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write('.TH "%(type)s_selinux" "8" "%(type)s" "mgrepl@redhat.com" "%(type)s SELinux Policy documentation"'
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
% {'type':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "NAME"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
%(user)s_u \- \fB%(desc)s\fP - Security Enhanced Linux Policy
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH DESCRIPTION
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
\fB%(user)s_u\fP is an SELinux User defined in the SELinux
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
policy. SELinux users have default roles, \fB%(user)s_r\fP. The
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
default role has a default type, \fB%(user)s_t\fP, associated with it.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user will usually login to a system with a context that looks like:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %(user)s_u:%(user)s_r:%(user)s_t:s0-s0:c0.c1023
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Linux users are automatically assigned an SELinux users at login.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Login programs use the SELinux User to assign initial context to the user's shell.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux policy uses the context to control the user's access.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
By default all users are assigned to the SELinux user via the \fB__default__\fP flag
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
On Targeted policy systems the \fB__default__\fP user is assigned to the \fBunconfined_u\fP SELinux user.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can list all Linux User to SELinux user mapping using:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage login -l
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you wanted to change the default user mapping to use the %(user)s_u user, you would execute:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage login -m -s %(user)s_u __default__
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'desc': self.desc, 'type':self.type, 'user':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "login_userdomain" in self.attributes and "login_userdomain" in all_attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
If you want to map the one Linux user (joe) to the SELinux user %(user)s, you would execute:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B $ semanage login -a -s %(user)s_u joe
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'user':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def can_sudo(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
sudotype = "%s_sudo_t" % self.domainname
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH SUDO
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if sudotype in types:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
role = self.domainname + "_r"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %(user)s can execute sudo.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can set up sudo to allow %(user)s to transition to an administrative domain:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Add one or more of the following record to sudoers using visudo.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % { 'user':self.domainname } )
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for adminrole in role_allows[role]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
USERNAME ALL=(ALL) ROLE=%(admin)s_r TYPE=%(admin)s_t COMMAND
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
sudo will run COMMAND as %(user)s_u:%(admin)s_r:%(admin)s_t:LEVEL
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'admin':adminrole[:-2], 'user':self.domainname } )
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You might also need to add one or more of these new roles to your SELinux user record.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
List the SELinux roles your SELinux user can reach by executing:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B $ semanage user -l |grep selinux_name
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Modify the roles list and add %(user)s_r to this list.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B $ semanage user -m -R '%(roles)s' %(user)s_u
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
For more details you can see semanage man page.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'user':self.domainname, "roles": " ".join([role] + role_allows[role]) } )
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux type %s_t is not allowed to execute sudo.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def user_attribute(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH USER DESCRIPTION
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "unconfined_usertype" in self.attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is an unconfined user. It means that a mapped Linux user to this SELinux user is supposed to be allow all actions.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "unpriv_userdomain" in self.attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is defined in policy as a unprivileged user. SELinux prevents unprivileged users from doing administration tasks without transitioning to a different role.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "admindomain" in self.attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is an admin user. It means that a mapped Linux user to this SELinux user is intended for administrative actions. Usually this is assigned to a root Linux user.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def xwindows_login(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "x_domain" in all_attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH X WINDOWS LOGIN
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "x_domain" in self.attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is able to X Windows login.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is not able to X Windows login.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def terminal_login(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "login_userdomain" in all_attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH TERMINAL LOGIN
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if "login_userdomain" in self.attributes:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is able to terminal login.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is not able to terminal login.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def network(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH NETWORK
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for net in ("tcp", "udp"):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
portdict = senetwork.get_network_connect(self.type, net, "name_bind")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(portdict) > 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is able to listen on the following %s ports.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (self.domainname, net))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for p in portdict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for recs in portdict[p]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % recs)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
portdict = senetwork.get_network_connect(self.type, "tcp", "name_connect")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(portdict) > 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is able to connect to the following tcp ports.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (self.domainname))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for p in portdict:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for recs in portdict[p]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B %s
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % recs)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def home_exec(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
permlist = setools.sesearch([setools.ALLOW],{'scontext':self.type,'tcontext':'user_home_type', 'class':'file', 'permlist':['ioctl', 'read', 'getattr', 'execute', 'execute_no_trans', 'open']})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH HOME_EXEC
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" )
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if permlist is not None:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is able execute home content files.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The SELinux user %s_u is not able execute home content files.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % self.domainname)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def transitions(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH TRANSITIONS
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Three things can happen when %(type)s attempts to execute a program.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
\fB1.\fP SELinux Policy can deny %(type)s from executing the program.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
\fB2.\fP SELinux Policy can allow %(type)s to execute the program in the current user type.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Execute the following to see the types that the SELinux user %(type)s can execute without transitioning:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B sesearch -A -s %(type)s -c file -p execute_no_trans
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.TP
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
\fB3.\fP SELinux can allow %(type)s to execute the program and transition to a new type.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Execute the following to see the types that the SELinux user %(type)s can execute and transition:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B $ sesearch -A -s %(type)s -c process -p transition
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'user':self.domainname, 'type':self.type})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
def role_header(self):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write('.TH "%(user)s_selinux" "8" "%(user)s" "mgrepl@redhat.com" "%(user)s SELinux Policy documentation"'
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
% {'user':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write(r"""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH "NAME"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
%(user)s_r \- \fB%(desc)s\fP - Security Enhanced Linux Policy
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.SH DESCRIPTION
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux supports Roles Based Access Control (RBAC), some Linux roles are login roles, while other roles need to be transition into.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.I Note:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Examples in this man page will use the
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B staff_u
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux user.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Non login roles are usually used for administrative tasks. For example, tasks that require root privileges. Roles control which types a user can run processes with. Roles often have default types assigned to them.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The default type for the %(user)s_r role is %(user)s_t.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
The
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B newrole
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
program to transition directly to this role.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B newrole -r %(user)s_r -t %(user)s_t
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B sudo
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
is the preferred method to do transition from one role to another. You setup sudo to transition to %(user)s_r by adding a similar line to the /etc/sudoers file.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
USERNAME ALL=(ALL) ROLE=%(user)s_r TYPE=%(user)s_t COMMAND
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.br
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
sudo will run COMMAND as staff_u:%(user)s_r:%(user)s_t:LEVEL
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
When using a a non login role, you need to setup SELinux so that your SELinux user can reach %(user)s_r role.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
Execute the following to see all of the assigned SELinux roles:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B semanage user -l
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You need to add %(user)s_r to the staff_u user. You could setup the staff_u user to be able to use the %(user)s_r role with a command like:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B $ semanage user -m -R 'staff_r system_r %(user)s_r' staff_u
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % {'desc': self.desc, 'user':self.domainname})
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
troles = []
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
for i in role_allows:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if self.domainname +"_r" in role_allows[i]:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
troles.append(i)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(troles) > 0:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
plural = ""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
if len(troles) > 1:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
plural = "s"
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
self.fd.write("""
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux policy also controls which roles can transition to a different role.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
You can list these rules using the following command.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
.B sesearch --role_allow
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
SELinux policy allows the %s role%s can transition to the %s_r role.
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
""" % (", ".join(troles), plural, self.domainname))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
ab5473d |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
class CheckPath(argparse.Action):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
def __call__(self, parser, namespace, values, option_string=None):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
if not os.path.exists(values):
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
raise ValueError("%s does not exist" % values)
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
if __name__ == '__main__':
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
parser = argparse.ArgumentParser(description='Generate SELinux man pages')
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
parser.add_argument("-p", "--path", dest="path", default="/tmp",
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
action=CheckPath,
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
help="Path in which tool will create SELinux man pages")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
group = parser.add_mutually_exclusive_group(required=True)
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
group.add_argument("-a", "--all", dest="all", default=False,
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
action="store_true",
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
help="All domains")
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
group.add_argument("-d", "--domain", nargs="+",
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
help="Domain name(s) of man pages to be created")
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
try:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
args = parser.parse_args()
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
path = args.path
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
if args.all:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
test_domains = domains
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
else:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
test_domains = args.domain
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
for domain in test_domains:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
print domain
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
ManPage(domain, path)
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
except ValueError,e:
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
sys.stderr.write("%s: %s" % (e.__class__.__name__, str(e)))
|
|
![](https://seccdn.libravatar.org/avatar/736367bde6478dadf14113cbc0c504521dd994dc28b5fd55dacf3eaee94ae556?s=16&d=retro) |
f1b4d62 |
sys.exit(1)
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
234c764 |
except Exception,e:
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
sys.stderr.write("exception %s: %s" % (e.__class__.__name__, str(e)))
|
|
![](https://seccdn.libravatar.org/avatar/a2cc8783a9727b89b4e4f4d85b9c74f5ebb768d0ee0302876f2c9a58b9377de8?s=16&d=retro) |
43a709d |
sys.exit(1)
|