* newrole O_NONBLOCK change (Was: Re: policycoreutils patch)
[not found] <45DB0AB8.3070803@redhat.com>
@ 2007-02-20 16:17 ` Stephen Smalley
2007-02-20 17:42 ` Daniel J Walsh
2007-02-20 17:58 ` Linda Knippers
2007-02-20 16:22 ` chcat changes " Stephen Smalley
2007-02-21 17:22 ` policycoreutils patch Stephen Smalley
2 siblings, 2 replies; 26+ messages in thread
From: Stephen Smalley @ 2007-02-20 16:17 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
> newrole hangs on a attached terminal device. Nonblocking allows it to
> proceed.
Won't this have side effects on programs run from the newrole'd shell?
Should newrole open them with O_NONBLOCK and then clear it via fcntl
before exec'ing the child shell?
> plain text document attachment (diff)
> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.c policycoreutils-2.0.1/newrole/newrole.c
> --- nsapolicycoreutils/newrole/newrole.c 2007-01-24 10:03:59.000000000 -0500
> +++ policycoreutils-2.0.1/newrole/newrole.c 2007-02-15 15:16:09.000000000 -0500
> @@ -640,7 +640,7 @@
> }
>
> /* Re-open TTY descriptor */
> - fd = open(ttyn, O_RDWR);
> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
> if (fd < 0) {
> fprintf(stderr, _("Error! Could not open %s.\n"), ttyn);
> return fd;
> @@ -1131,13 +1131,13 @@
> fprintf(stderr, _("Could not close descriptors.\n"));
> goto err_close_pam;
> }
> - fd = open(ttyn, O_RDONLY);
> + fd = open(ttyn, O_RDONLY|O_NONBLOCK);
> if (fd != 0)
> goto err_close_pam;
> - fd = open(ttyn, O_RDWR);
> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
> if (fd != 1)
> goto err_close_pam;
> - fd = open(ttyn, O_RDWR);
> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
> if (fd != 2)
> goto err_close_pam;
>
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* chcat changes (Was: Re: policycoreutils patch)
[not found] <45DB0AB8.3070803@redhat.com>
2007-02-20 16:17 ` newrole O_NONBLOCK change (Was: Re: policycoreutils patch) Stephen Smalley
@ 2007-02-20 16:22 ` Stephen Smalley
2007-02-20 17:56 ` Daniel J Walsh
2007-02-21 17:22 ` policycoreutils patch Stephen Smalley
2 siblings, 1 reply; 26+ messages in thread
From: Stephen Smalley @ 2007-02-20 16:22 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux, Karl MacMillan
On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
> chcat fixes:
> * Broken stderr handling fix
> * if serange ends in a ":" chop it off.
> * Switch chcat to exec semanage rather than use builtin so that
> proper transitions happen, otherwise I would have to run chcat under an
> semanage context.
Why would a range end in a ":"? Context translation issue?
> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.1/scripts/chcat
> --- nsapolicycoreutils/scripts/chcat 2006-11-16 17:14:27.000000000 -0500
> +++ policycoreutils-2.0.1/scripts/chcat 2007-02-15 15:16:09.000000000 -0500
> @@ -25,11 +25,22 @@
> import commands, sys, os, pwd, string, getopt, selinux
> import seobject
> import gettext
> +import codecs
> +import locale
> +sys.stderr = codecs.getwriter(locale.getpreferredencoding())(sys.__stderr__, 'replace')
> +sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
>
> try:
> gettext.install('policycoreutils')
> -except:
> - pass
> +except IOError:
> + import __builtin__
> + __builtin__.__dict__['_'] = unicode
> +
> +def errorExit(error):
> + sys.stderr.write("%s: " % sys.argv[0])
> + sys.stderr.write("%s\n" % error)
> + sys.stderr.flush()
> + sys.exit(1)
>
> def verify_users(users):
> for u in users:
> @@ -62,12 +73,20 @@
> for i in newcat[1:]:
> if i not in cats:
> cats.append(i)
> +
> new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
> -
> + if new_serange[-1:] == ":":
> + new_serange = new_serange[:-1]
> +
> if add_ind:
> - logins.add(u, user[0], new_serange)
> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
> else:
> - logins.modify(u, user[0], new_serange)
> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
> + rc = commands.getstatusoutput(cmd)
> + if rc[0] != 0:
> + print rc[1]
> + errors += 1
> +
> return errors
>
> def chcat_add(orig, newcat, objects,login_ind):
> @@ -133,11 +152,17 @@
> cats.remove(i)
>
> new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
> + if new_serange[-1:] == ":":
> + new_serange = new_serange[:-1]
>
> if add_ind:
> - logins.add(u, user[0], new_serange)
> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
> else:
> - logins.modify(u, user[0], new_serange)
> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
> + rc = commands.getstatusoutput(cmd)
> + if rc[0] != 0:
> + print rc[1]
> + errors += 1
> return errors
>
> def chcat_remove(orig, newcat, objects, login_ind):
> @@ -198,11 +223,17 @@
> user = seusers["__default__"]
> serange = user[1].split("-")
> new_serange = "%s-%s:%s" % (serange[0],newcat[0], string.join(newcat[1:], ","))
> -
> + if new_serange[-1:] == ":":
> + new_serange = new_serange[:-1]
> +
> if add_ind:
> - logins.add(u, user[0], new_serange)
> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
> else:
> - logins.modify(u, user[0], new_serange)
> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
> + rc = commands.getstatusoutput(cmd)
> + if rc[0] != 0:
> + print rc[1]
> + errors += 1
> return errors
>
> def chcat_replace(newcat, objects, login_ind):
> @@ -362,6 +393,10 @@
>
> if list_ind == 0 and len(cmds) < 1:
> usage()
> +
> + except getopt.error, error:
> + errorExit(_("Options Error %s ") % error.msg)
> +
> except ValueError, e:
> usage()
>
> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat.8 policycoreutils-2.0.1/scripts/chcat.8
> --- nsapolicycoreutils/scripts/chcat.8 2007-01-17 11:11:34.000000000 -0500
> +++ policycoreutils-2.0.1/scripts/chcat.8 2007-02-15 15:16:09.000000000 -0500
> @@ -3,30 +3,31 @@
> chcat \- change file SELinux security category
> .SH SYNOPSIS
> .B chcat
> -\fICATEGORY FILE\fR...
> +\fIcategory file\fR...
> .br
> .B chcat -l
> -\fICATEGORY USER\fR...
> +\fIcategory user\fR...
> .br
> .B chcat
> -\fI[[+|-]CATEGORY],...] FILE\fR...
> +\fI[[+|-]category...] file\fR...
> .br
> .B chcat -l
> -\fI[[+|-]CATEGORY],...] USER\fR...
> +\fI[[+|-]category...] user\fR...
> .br
> .B chcat
> -[\fI-d\fR] \fIFILE\fR...
> +[\fI-d\fR] \fIfile\fR...
> .br
> .B chcat -l
> -[\fI-d\fR] \fIUSER\fR...
> +[\fI-d\fR] \fIuser\fR...
> .br
> .B chcat
> -\fI-L\fR [-l] [ USER ... ]
> +\fI-L\fR [ -l ] [ user ... ]
> .br
> +.SH DESCRIPTION
> .PP
> -Change/Remove the security CATEGORY for each FILE/USER.
> +Change/Remove the security \fIcategory\fR for each \fIfile\fR or \fIuser\fR.
> .PP
> -Use +/- to add/remove categories from a FILE/USER.
> +Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR.
> .PP
> .B
> Note:
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: newrole O_NONBLOCK change (Was: Re: policycoreutils patch)
2007-02-20 16:17 ` newrole O_NONBLOCK change (Was: Re: policycoreutils patch) Stephen Smalley
@ 2007-02-20 17:42 ` Daniel J Walsh
2007-02-20 17:58 ` Linda Knippers
1 sibling, 0 replies; 26+ messages in thread
From: Daniel J Walsh @ 2007-02-20 17:42 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SE Linux
Stephen Smalley wrote:
> On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
>
>> newrole hangs on a attached terminal device. Nonblocking allows it to
>> proceed.
>>
>
> Won't this have side effects on programs run from the newrole'd shell?
> Should newrole open them with O_NONBLOCK and then clear it via fcntl
> before exec'ing the child shell
>
Linda Knippers submitted this patch for bugzilla.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228102
I am not sure if setting it back to non blocking would still cause the hang.
>
>> plain text document attachment (diff)
>> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.c policycoreutils-2.0.1/newrole/newrole.c
>> --- nsapolicycoreutils/newrole/newrole.c 2007-01-24 10:03:59.000000000 -0500
>> +++ policycoreutils-2.0.1/newrole/newrole.c 2007-02-15 15:16:09.000000000 -0500
>> @@ -640,7 +640,7 @@
>> }
>>
>> /* Re-open TTY descriptor */
>> - fd = open(ttyn, O_RDWR);
>> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
>> if (fd < 0) {
>> fprintf(stderr, _("Error! Could not open %s.\n"), ttyn);
>> return fd;
>> @@ -1131,13 +1131,13 @@
>> fprintf(stderr, _("Could not close descriptors.\n"));
>> goto err_close_pam;
>> }
>> - fd = open(ttyn, O_RDONLY);
>> + fd = open(ttyn, O_RDONLY|O_NONBLOCK);
>> if (fd != 0)
>> goto err_close_pam;
>> - fd = open(ttyn, O_RDWR);
>> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
>> if (fd != 1)
>> goto err_close_pam;
>> - fd = open(ttyn, O_RDWR);
>> + fd = open(ttyn, O_RDWR|O_NONBLOCK);
>> if (fd != 2)
>> goto err_close_pam;
>>
>>
>
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: chcat changes (Was: Re: policycoreutils patch)
2007-02-20 16:22 ` chcat changes " Stephen Smalley
@ 2007-02-20 17:56 ` Daniel J Walsh
2007-02-21 16:37 ` Karl MacMillan
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2007-02-20 17:56 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SE Linux, Karl MacMillan
Stephen Smalley wrote:
> On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
>
>> chcat fixes:
>> * Broken stderr handling fix
>> * if serange ends in a ":" chop it off.
>> * Switch chcat to exec semanage rather than use builtin so that
>> proper transitions happen, otherwise I would have to run chcat under an
>> semanage context.
>>
>
> Why would a range end in a ":"? Context translation issue?
>
>
No.
new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats,
","))
if new_serange[-1:] == ":":
new_serange = new_serange[:-1]
If you did not have cats you would end up with s0-s0:
>> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.1/scripts/chcat
>> --- nsapolicycoreutils/scripts/chcat 2006-11-16 17:14:27.000000000 -0500
>> +++ policycoreutils-2.0.1/scripts/chcat 2007-02-15 15:16:09.000000000 -0500
>> @@ -25,11 +25,22 @@
>> import commands, sys, os, pwd, string, getopt, selinux
>> import seobject
>> import gettext
>> +import codecs
>> +import locale
>> +sys.stderr = codecs.getwriter(locale.getpreferredencoding())(sys.__stderr__, 'replace')
>> +sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
>>
>> try:
>> gettext.install('policycoreutils')
>> -except:
>> - pass
>> +except IOError:
>> + import __builtin__
>> + __builtin__.__dict__['_'] = unicode
>> +
>> +def errorExit(error):
>> + sys.stderr.write("%s: " % sys.argv[0])
>> + sys.stderr.write("%s\n" % error)
>> + sys.stderr.flush()
>> + sys.exit(1)
>>
>> def verify_users(users):
>> for u in users:
>> @@ -62,12 +73,20 @@
>> for i in newcat[1:]:
>> if i not in cats:
>> cats.append(i)
>> +
>> new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
>> -
>> + if new_serange[-1:] == ":":
>> + new_serange = new_serange[:-1]
>> +
>> if add_ind:
>> - logins.add(u, user[0], new_serange)
>> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
>> else:
>> - logins.modify(u, user[0], new_serange)
>> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
>> + rc = commands.getstatusoutput(cmd)
>> + if rc[0] != 0:
>> + print rc[1]
>> + errors += 1
>> +
>> return errors
>>
>> def chcat_add(orig, newcat, objects,login_ind):
>> @@ -133,11 +152,17 @@
>> cats.remove(i)
>>
>> new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
>> + if new_serange[-1:] == ":":
>> + new_serange = new_serange[:-1]
>>
>> if add_ind:
>> - logins.add(u, user[0], new_serange)
>> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
>> else:
>> - logins.modify(u, user[0], new_serange)
>> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
>> + rc = commands.getstatusoutput(cmd)
>> + if rc[0] != 0:
>> + print rc[1]
>> + errors += 1
>> return errors
>>
>> def chcat_remove(orig, newcat, objects, login_ind):
>> @@ -198,11 +223,17 @@
>> user = seusers["__default__"]
>> serange = user[1].split("-")
>> new_serange = "%s-%s:%s" % (serange[0],newcat[0], string.join(newcat[1:], ","))
>> -
>> + if new_serange[-1:] == ":":
>> + new_serange = new_serange[:-1]
>> +
>> if add_ind:
>> - logins.add(u, user[0], new_serange)
>> + cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
>> else:
>> - logins.modify(u, user[0], new_serange)
>> + cmd = "semanage login -m -r %s -s %s %s" % (new_serange, user[0], u)
>> + rc = commands.getstatusoutput(cmd)
>> + if rc[0] != 0:
>> + print rc[1]
>> + errors += 1
>> return errors
>>
>> def chcat_replace(newcat, objects, login_ind):
>> @@ -362,6 +393,10 @@
>>
>> if list_ind == 0 and len(cmds) < 1:
>> usage()
>> +
>> + except getopt.error, error:
>> + errorExit(_("Options Error %s ") % error.msg)
>> +
>> except ValueError, e:
>> usage()
>>
>> diff --exclude-from=exclude --exclude=sepolgen-1.0.0 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat.8 policycoreutils-2.0.1/scripts/chcat.8
>> --- nsapolicycoreutils/scripts/chcat.8 2007-01-17 11:11:34.000000000 -0500
>> +++ policycoreutils-2.0.1/scripts/chcat.8 2007-02-15 15:16:09.000000000 -0500
>> @@ -3,30 +3,31 @@
>> chcat \- change file SELinux security category
>> .SH SYNOPSIS
>> .B chcat
>> -\fICATEGORY FILE\fR...
>> +\fIcategory file\fR...
>> .br
>> .B chcat -l
>> -\fICATEGORY USER\fR...
>> +\fIcategory user\fR...
>> .br
>> .B chcat
>> -\fI[[+|-]CATEGORY],...] FILE\fR...
>> +\fI[[+|-]category...] file\fR...
>> .br
>> .B chcat -l
>> -\fI[[+|-]CATEGORY],...] USER\fR...
>> +\fI[[+|-]category...] user\fR...
>> .br
>> .B chcat
>> -[\fI-d\fR] \fIFILE\fR...
>> +[\fI-d\fR] \fIfile\fR...
>> .br
>> .B chcat -l
>> -[\fI-d\fR] \fIUSER\fR...
>> +[\fI-d\fR] \fIuser\fR...
>> .br
>> .B chcat
>> -\fI-L\fR [-l] [ USER ... ]
>> +\fI-L\fR [ -l ] [ user ... ]
>> .br
>> +.SH DESCRIPTION
>> .PP
>> -Change/Remove the security CATEGORY for each FILE/USER.
>> +Change/Remove the security \fIcategory\fR for each \fIfile\fR or \fIuser\fR.
>> .PP
>> -Use +/- to add/remove categories from a FILE/USER.
>> +Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR.
>> .PP
>> .B
>> Note:
>>
>
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: newrole O_NONBLOCK change (Was: Re: policycoreutils patch)
2007-02-20 16:17 ` newrole O_NONBLOCK change (Was: Re: policycoreutils patch) Stephen Smalley
2007-02-20 17:42 ` Daniel J Walsh
@ 2007-02-20 17:58 ` Linda Knippers
1 sibling, 0 replies; 26+ messages in thread
From: Linda Knippers @ 2007-02-20 17:58 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Daniel J Walsh, SE Linux
Stephen Smalley wrote:
> On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
>
>>newrole hangs on a attached terminal device. Nonblocking allows it to
>>proceed.
>
>
> Won't this have side effects on programs run from the newrole'd shell?
> Should newrole open them with O_NONBLOCK and then clear it via fcntl
> before exec'ing the child shell?
Yep, it causes 'more' to not work, for example, so this is no good.
I'd like to understand why the open is hanging in the first place.
-- ljk
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: chcat changes (Was: Re: policycoreutils patch)
2007-02-20 17:56 ` Daniel J Walsh
@ 2007-02-21 16:37 ` Karl MacMillan
0 siblings, 0 replies; 26+ messages in thread
From: Karl MacMillan @ 2007-02-21 16:37 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
Daniel J Walsh wrote:
> Stephen Smalley wrote:
>> On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
>>
>>> chcat fixes:
>>> * Broken stderr handling fix
>>> * if serange ends in a ":" chop it off.
>>> * Switch chcat to exec semanage rather than use builtin so that
>>> proper transitions happen, otherwise I would have to run chcat under
>>> an semanage context.
>>>
>>
>> Why would a range end in a ":"? Context translation issue?
>>
>>
> No.
> new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats,
> ","))
> if new_serange[-1:] == ":":
> new_serange = new_serange[:-1]
> If you did not have cats you would end up with s0-s0:
>
Then why not something more direct (completely untested):
new_serange = "%s-%s" % (searange[0], top[0])
new_cats = ",".join(cats)
if new_cats != '':
new_serange = new_serange + ":" + new_cats
I think that the list subscripting with -1 and : is confusing to
non-python programmers. Also, I think that use of string.join is
discouraged in favor of using the join method on strings - though that
likely looks as odd as a -1 index to a non-python programmer.
Karl
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
[not found] <45DB0AB8.3070803@redhat.com>
2007-02-20 16:17 ` newrole O_NONBLOCK change (Was: Re: policycoreutils patch) Stephen Smalley
2007-02-20 16:22 ` chcat changes " Stephen Smalley
@ 2007-02-21 17:22 ` Stephen Smalley
2 siblings, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2007-02-21 17:22 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Tue, 2007-02-20 at 09:50 -0500, Daniel J Walsh wrote:
> newrole hangs on a attached terminal device. Nonblocking allows it to
> proceed.
I dropped this, per the bugzilla report (fixable by passing -L to agetty
in inittab).
> chcat fixes:
> * Broken stderr handling fix
> * if serange ends in a ":" chop it off.
> * Switch chcat to exec semanage rather than use builtin so that
> proper transitions happen, otherwise I would have to run chcat under an
> semanage context.
>
> Man pages fixes to be more standard.
>
>
> More translations.
I merged the rest, except for the call to mcstrans reload from
seobject.py.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2008-10-23 17:15 Daniel J Walsh
@ 2008-11-10 15:52 ` Joshua Brindle
0 siblings, 0 replies; 26+ messages in thread
From: Joshua Brindle @ 2008-11-10 15:52 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Fix error message in newrole.
>
> Change semange fcontext -a to check for local customizations rather then
> global, so you can modify a file context.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkkAsR4ACgkQrlYvE4MpobPkRgCfQQNFw9DE8oGt7ecsl7ikXJhM
> vGIAoKRp+37SMzpfgIoOC9VY0S7bmR+V
> =pwc5
> -----END PGP SIGNATURE-----
>
Merged in to policycoreutils-2.0.58
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2008-10-23 17:15 Daniel J Walsh
2008-11-10 15:52 ` Joshua Brindle
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2008-10-23 17:15 UTC (permalink / raw)
To: SE Linux
[-- Attachment #1: Type: text/plain, Size: 453 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Fix error message in newrole.
Change semange fcontext -a to check for local customizations rather then
global, so you can modify a file context.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkkAsR4ACgkQrlYvE4MpobPkRgCfQQNFw9DE8oGt7ecsl7ikXJhM
vGIAoKRp+37SMzpfgIoOC9VY0S7bmR+V
=pwc5
-----END PGP SIGNATURE-----
[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 1648 bytes --]
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/newrole/newrole.c policycoreutils-2.0.57/newrole/newrole.c
--- nsapolicycoreutils/newrole/newrole.c 2008-08-28 09:34:24.000000000 -0400
+++ policycoreutils-2.0.57/newrole/newrole.c 2008-10-17 16:43:52.000000000 -0400
@@ -553,7 +553,7 @@
new_caps = cap_init();
tmp_caps = cap_init();
if (!new_caps || !tmp_caps) {
- fprintf(stderr, _("Error initing capabilities, aborting.\n"));
+ fprintf(stderr, _("Error initializing capabilities, aborting.\n"));
return -1;
}
rc |= cap_set_flag(new_caps, CAP_PERMITTED, 1, cap_list, CAP_SET);
@@ -631,7 +631,7 @@
/* Non-root caller, suid root path */
new_caps = cap_init();
if (!new_caps) {
- fprintf(stderr, _("Error initing capabilities, aborting.\n"));
+ fprintf(stderr, _("Error initializing capabilities, aborting.\n"));
return -1;
}
rc |= cap_set_flag(new_caps, CAP_PERMITTED, 6, cap_list, CAP_SET);
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.57/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py 2008-09-12 11:48:15.000000000 -0400
+++ policycoreutils-2.0.57/semanage/seobject.py 2008-10-23 11:04:33.000000000 -0400
@@ -1430,7 +1430,7 @@
if rc < 0:
raise ValueError(_("Could not create key for %s") % target)
- (rc,exists) = semanage_fcontext_exists(self.sh, k)
+ (rc,exists) = semanage_fcontext_exists_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if file context for %s is defined") % target)
if exists:
[-- Attachment #3: diff.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2008-08-05 13:44 ` Stephen Smalley
2008-08-05 13:57 ` Stephen Smalley
@ 2008-08-05 14:20 ` Daniel J Walsh
1 sibling, 0 replies; 26+ messages in thread
From: Daniel J Walsh @ 2008-08-05 14:20 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SE Linux
Stephen Smalley wrote:
> On Fri, 2008-08-01 at 07:43 -0400, Daniel J Walsh wrote:
> Adds support for boolean files, name/value pairs as input and output.
> Allows you to set a large amount of booleans at once.
>
> Add support from groupname in semanage login. This will allow you to
> associate groups of Linux Users with an SELinux user. Uses same syntax
> as sudo. Requires patch to libselinux.
>
> Cleanup of semanage variables. Change use of 1/0 to True/False.
>
> Remove bad use of raise(out)
>
>> Looks ok other than adding gui to the Makefile since we don't have that
>> one. But upon trying "semanage login -a -s root %wheel", I get:
>> libsemanage.get_users: user %wheel not in password file
>
>> So it seems that we also need libsemanage to understand the %groupname
>> syntax? That is coming from genhomedircon.c.
>
>> If actually supporting per-role file labeling, then we'd need
>> libsemanage to expand the group and add the individual users for
>> generating home directory entries.
>
>
Yet another reason to remove the atrocity that is per role labeling.
Changing the default role of a user or group of users should not involve
the relabeling of a potentially huge amount of files, never mind that
you can't fix /tmp files. Stop the insanity...
Then we have the problem of shared homedirs where you have different
roles on different machines, and potentially can log in to the same
machine with different roles depending on how you login. guest_r if you
login via ssh but staff_r via the console.
Someday I will win this battle...
--SNIP--
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2008-08-05 13:44 ` Stephen Smalley
@ 2008-08-05 13:57 ` Stephen Smalley
2008-08-05 14:20 ` Daniel J Walsh
1 sibling, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2008-08-05 13:57 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Tue, 2008-08-05 at 09:44 -0400, Stephen Smalley wrote:
> On Fri, 2008-08-01 at 07:43 -0400, Daniel J Walsh wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Adds support for boolean files, name/value pairs as input and output.
> > Allows you to set a large amount of booleans at once.
> >
> > Add support from groupname in semanage login. This will allow you to
> > associate groups of Linux Users with an SELinux user. Uses same syntax
> > as sudo. Requires patch to libselinux.
> >
> > Cleanup of semanage variables. Change use of 1/0 to True/False.
> >
> > Remove bad use of raise(out)
>
> Looks ok other than adding gui to the Makefile since we don't have that
> one. But upon trying "semanage login -a -s root %wheel", I get:
> libsemanage.get_users: user %wheel not in password file
>
> So it seems that we also need libsemanage to understand the %groupname
> syntax? That is coming from genhomedircon.c.
>
> If actually supporting per-role file labeling, then we'd need
> libsemanage to expand the group and add the individual users for
> generating home directory entries.
As a minimal fix, we can do this to avoid the noise from genhomedircon.
But for the per-role file labeling, we'll ultimately need the group to
be expanded I think.
Index: libsemanage/src/genhomedircon.c
===================================================================
--- libsemanage/src/genhomedircon.c (revision 2943)
+++ libsemanage/src/genhomedircon.c (working copy)
@@ -762,6 +762,10 @@
if (strcmp(name, TEMPLATE_SEUSER) == 0)
continue;
+ /* %groupname syntax */
+ if (name[0] == '%')
+ continue;
+
/* find the user structure given the name */
u = bsearch(seuname, user_list, nusers, sizeof(semanage_user_t *),
(int (*)(const void *, const void *))
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2008-08-01 11:43 Daniel J Walsh
@ 2008-08-05 13:44 ` Stephen Smalley
2008-08-05 13:57 ` Stephen Smalley
2008-08-05 14:20 ` Daniel J Walsh
0 siblings, 2 replies; 26+ messages in thread
From: Stephen Smalley @ 2008-08-05 13:44 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Fri, 2008-08-01 at 07:43 -0400, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Adds support for boolean files, name/value pairs as input and output.
> Allows you to set a large amount of booleans at once.
>
> Add support from groupname in semanage login. This will allow you to
> associate groups of Linux Users with an SELinux user. Uses same syntax
> as sudo. Requires patch to libselinux.
>
> Cleanup of semanage variables. Change use of 1/0 to True/False.
>
> Remove bad use of raise(out)
Looks ok other than adding gui to the Makefile since we don't have that
one. But upon trying "semanage login -a -s root %wheel", I get:
libsemanage.get_users: user %wheel not in password file
So it seems that we also need libsemanage to understand the %groupname
syntax? That is coming from genhomedircon.c.
If actually supporting per-role file labeling, then we'd need
libsemanage to expand the group and add the individual users for
generating home directory entries.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkiS9t8ACgkQrlYvE4MpobN0/gCgsoXMR/oDibFEw3SNFxwQlhrY
> gZIAn1wMYnPg+o2ixNVQsWYBOw1NN4Pd
> =69RK
> -----END PGP SIGNATURE-----
> plain text document attachment (diff)
> diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.53/Makefile
> --- nsapolicycoreutils/Makefile 2008-06-12 23:25:24.000000000 -0400
> +++ policycoreutils-2.0.53/Makefile 2008-07-29 16:25:16.000000000 -0400
> @@ -1,4 +1,4 @@
> -SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
> +SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
>
> INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
>
> diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.53/restorecond/restorecond.c
> --- nsapolicycoreutils/restorecond/restorecond.c 2008-06-12 23:25:21.000000000 -0400
> +++ policycoreutils-2.0.53/restorecond/restorecond.c 2008-07-29 16:25:16.000000000 -0400
> @@ -210,9 +210,10 @@
> }
>
> if (fsetfilecon(fd, scontext) < 0) {
> - syslog(LOG_ERR,
> - "set context %s->%s failed:'%s'\n",
> - filename, scontext, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR,
> + "set context %s->%s failed:'%s'\n",
> + filename, scontext, strerror(errno));
> if (retcontext >= 0)
> free(prev_context);
> free(scontext);
> @@ -225,8 +226,9 @@
> if (retcontext >= 0)
> free(prev_context);
> } else {
> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> - filename, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> + filename, strerror(errno));
> }
> free(scontext);
> close(fd);
> diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.53/semanage/semanage
> --- nsapolicycoreutils/semanage/semanage 2008-07-02 17:19:15.000000000 -0400
> +++ policycoreutils-2.0.53/semanage/semanage 2008-08-01 07:30:43.000000000 -0400
> @@ -45,13 +45,13 @@
> def usage(message = ""):
> print _("""
> semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n]
> -semanage login -{a|d|m} [-sr] login_name
> +semanage login -{a|d|m} [-sr] login_name | %groupname
> semanage user -{a|d|m} [-LrRP] selinux_name
> semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range
> semanage interface -{a|d|m} [-tr] interface_spec
> semanage fcontext -{a|d|m} [-frst] file_spec
> semanage translation -{a|d|m} [-T] level
> -semanage boolean -{d|m} boolean
> +semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
> semanage permissive -{d|a} type
>
> Primary Options:
> @@ -79,6 +79,7 @@
> -l (symbolic link)
> -p (named pipe)
>
> + -F, --file Treat target as an input file for command, change multiple settings
> -p, --proto Port protocol (tcp or udp)
> -P, --prefix Prefix for home directory labeling
> -L, --level Default SELinux Level (MLS/MCS Systems only)
> @@ -114,7 +115,7 @@
> valid_option["translation"] = []
> valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
> valid_option["boolean"] = []
> - valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0" ]
> + valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0", "-F", "--file"]
> valid_option["permissive"] = []
> valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ]
> return valid_option
> @@ -134,15 +135,16 @@
> setrans = ""
> roles = ""
> seuser = ""
> - prefix = ""
> - heading=1
> - value=0
> - add = 0
> - modify = 0
> - delete = 0
> - deleteall = 0
> - list = 0
> - locallist = 0
> + prefix = "user"
> + heading = True
> + value = None
> + add = False
> + modify = False
> + delete = False
> + deleteall = False
> + list = False
> + locallist = False
> + use_file = False
> store = ""
> if len(sys.argv) < 3:
> usage(_("Requires 2 or more arguments"))
> @@ -155,11 +157,12 @@
> args = sys.argv[2:]
>
> gopts, cmds = getopt.getopt(args,
> - '01adf:lhmnp:s:CDR:L:r:t:T:P:S:',
> + '01adf:lhmnp:s:FCDR:L:r:t:T:P:S:',
> ['add',
> 'delete',
> 'deleteall',
> 'ftype=',
> + 'file',
> 'help',
> 'list',
> 'modify',
> @@ -185,31 +188,35 @@
> if o == "-a" or o == "--add":
> if modify or delete:
> usage()
> - add = 1
> + add = True
>
> if o == "-d" or o == "--delete":
> if modify or add:
> usage()
> - delete = 1
> + delete = True
> if o == "-D" or o == "--deleteall":
> if modify:
> usage()
> - deleteall = 1
> + deleteall = True
> if o == "-f" or o == "--ftype":
> ftype=a
> +
> + if o == "-F" or o == "--file":
> + use_file = True
> +
> if o == "-h" or o == "--help":
> usage()
>
> if o == "-n" or o == "--noheading":
> - heading=0
> + heading = False
>
> if o == "-C" or o == "--locallist":
> - locallist=1
> + locallist = True
>
> if o == "-m"or o == "--modify":
> if delete or add:
> usage()
> - modify = 1
> + modify = True
>
> if o == "-S" or o == '--store':
> store = a
> @@ -220,7 +227,7 @@
> serange = a
>
> if o == "-l" or o == "--list":
> - list = 1
> + list = True
>
> if o == "-L" or o == '--level':
> if is_mls_enabled == 0:
> @@ -246,9 +253,9 @@
> setrans = a
>
> if o == "--on" or o == "-1":
> - value = 1
> - if o == "-off" or o == "-0":
> - value = 0
> + value = "on"
> + if o == "--off" or o == "-0":
> + value = "off"
>
> if object == "login":
> OBJECT = seobject.loginRecords(store)
> @@ -275,7 +282,10 @@
> OBJECT = seobject.permissiveRecords(store)
>
> if list:
> - OBJECT.list(heading, locallist)
> + if object == "boolean":
> + OBJECT.list(heading, locallist, use_file)
> + else:
> + OBJECT.list(heading, locallist)
> sys.exit(0);
>
> if deleteall:
> @@ -295,12 +305,10 @@
> OBJECT.add(target, setrans)
>
> if object == "user":
> - rlist = roles.split()
> - if len(rlist) == 0:
> - raise ValueError(_("You must specify a role"))
> - if prefix == "":
> - raise ValueError(_("You must specify a prefix"))
> - OBJECT.add(target, rlist, selevel, serange, prefix)
> + rlist = []
> + if not use_file:
> + rlist = roles.split()
> + OBJECT.add(target, rlist, selevel, serange, prefix)
>
> if object == "port":
> OBJECT.add(target, proto, serange, setype)
> @@ -317,7 +325,7 @@
>
> if modify:
> if object == "boolean":
> - OBJECT.modify(target, value)
> + OBJECT.modify(target, value, use_file)
>
> if object == "login":
> OBJECT.modify(target, seuser, serange)
> diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-2.0.53/semanage/semanage.8
> --- nsapolicycoreutils/semanage/semanage.8 2008-07-02 17:19:15.000000000 -0400
> +++ policycoreutils-2.0.53/semanage/semanage.8 2008-08-01 07:05:54.000000000 -0400
> @@ -3,11 +3,11 @@
> semanage \- SELinux Policy Management tool
>
> .SH "SYNOPSIS"
> -.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|lC|D} [\-n]
> +.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|D} [\-n] [\-S store]
> .br
> -.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] boolean
> +.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] -F boolean | boolean_file
> .br
> -.B semanage login \-{a|d|m} [\-sr] login_name
> +.B semanage login \-{a|d|m} [\-sr] login_name | %groupname
> .br
> .B semanage user \-{a|d|m} [\-LrRP] selinux_name
> .br
> @@ -54,6 +54,11 @@
> File Type. This is used with fcontext.
> Requires a file type as shown in the mode field by ls, e.g. use -d to match only directories or -- to match only regular files.
> .TP
> +.I \-F, \-\-file
> +Set multiple records from the input file. When used with the \-l \-\-list, it will output the current settings to stdout in the proper format.
> +
> +Currently booleans only.
> +.TP
> .I \-h, \-\-help
> display this message
> .TP
> @@ -87,6 +92,9 @@
> .I \-s, \-\-seuser
> SELinux user name
> .TP
> +.I \-S, \-\-store
> +Select and alternate SELinux store to manage
> +.TP
> .I \-t, \-\-type
> SELinux Type for the object
> .TP
> @@ -99,6 +107,8 @@
> $ semanage user -l
> # Allow joe to login as staff_u
> $ semanage login -a -s staff_u joe
> +# Allow the group clerks to login as user_u
> +$ semanage login -a -s user_u %clerks
> # Add file-context for everything under /web (used by restorecon)
> $ semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
> # Allow Apache to listen on port 81
> diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.53/semanage/seobject.py
> --- nsapolicycoreutils/semanage/seobject.py 2008-07-29 09:15:39.000000000 -0400
> +++ policycoreutils-2.0.53/semanage/seobject.py 2008-08-01 07:24:34.000000000 -0400
> @@ -21,7 +21,7 @@
> #
> #
>
> -import pwd, string, selinux, tempfile, os, re, sys
> +import pwd, grp, string, selinux, tempfile, os, re, sys
> from semanage import *;
> PROGNAME="policycoreutils"
> import sepolgen.module as module
> @@ -330,20 +330,15 @@
> for name in dirs:
> os.rmdir(os.path.join(root, name))
>
> - if rc != 0:
> - raise ValueError(out)
> -
> -
> def delete(self, name):
> for n in name.split():
> rc = semanage_module_remove(self.sh, "permissive_%s" % n)
> if rc < 0:
> raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
> - rc = semanage_commit(self.sh)
> - if rc < 0:
> - raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
> + rc = semanage_commit(self.sh)
> + if rc < 0:
> + raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
>
> -
> def deleteall(self):
> l = self.get_all()
> if len(l) > 0:
> @@ -402,10 +397,16 @@
> raise ValueError(_("Could not check if login mapping for %s is defined") % name)
> if exists:
> raise ValueError(_("Login mapping for %s is already defined") % name)
> - try:
> - pwd.getpwnam(name)
> - except:
> - raise ValueError(_("Linux User %s does not exist") % name)
> + if name[0] == '%':
> + try:
> + grp.getgrnam(name[1:])
> + except:
> + raise ValueError(_("Linux Group %s does not exist") % name[1:])
> + else:
> + try:
> + pwd.getpwnam(name)
> + except:
> + raise ValueError(_("Linux User %s does not exist") % name)
>
> (rc,u) = semanage_seuser_create(self.sh)
> if rc < 0:
> @@ -1447,54 +1448,72 @@
> class booleanRecords(semanageRecords):
> def __init__(self, store = ""):
> semanageRecords.__init__(self, store)
> + self.dict={}
> + self.dict["TRUE"] = 1
> + self.dict["FALSE"] = 0
> + self.dict["ON"] = 1
> + self.dict["OFF"] = 0
> + self.dict["1"] = 1
> + self.dict["0"] = 0
>
> - def modify(self, name, value = ""):
> - if value == "":
> - raise ValueError(_("Requires value"))
> -
> - (rc,k) = semanage_bool_key_create(self.sh, name)
> - if rc < 0:
> - raise ValueError(_("Could not create a key for %s") % name)
> -
> - (rc,exists) = semanage_bool_exists(self.sh, k)
> - if rc < 0:
> - raise ValueError(_("Could not check if boolean %s is defined") % name)
> - if not exists:
> - raise ValueError(_("Boolean %s is not defined") % name)
> -
> - (rc,b) = semanage_bool_query(self.sh, k)
> - if rc < 0:
> - raise ValueError(_("Could not query file context %s") % name)
> + def __mod(self, name, value):
> + (rc,k) = semanage_bool_key_create(self.sh, name)
> + if rc < 0:
> + raise ValueError(_("Could not create a key for %s") % name)
> + (rc,exists) = semanage_bool_exists(self.sh, k)
> + if rc < 0:
> + raise ValueError(_("Could not check if boolean %s is defined") % name)
> + if not exists:
> + raise ValueError(_("Boolean %s is not defined") % name)
> +
> + (rc,b) = semanage_bool_query(self.sh, k)
> + if rc < 0:
> + raise ValueError(_("Could not query file context %s") % name)
>
> - if value != "":
> - nvalue = int(value)
> - semanage_bool_set_value(b, nvalue)
> + if value.upper() in self.dict:
> + semanage_bool_set_value(b, self.dict[value.upper()])
> else:
> - raise ValueError(_("You must specify a value"))
> + raise ValueError(_("You must specify one of the following values: %s") % ", ".join(self.dict.keys()) )
> +
> + rc = semanage_bool_set_active(self.sh, k, b)
> + if rc < 0:
> + raise ValueError(_("Could not set active value of boolean %s") % name)
> + rc = semanage_bool_modify_local(self.sh, k, b)
> + if rc < 0:
> + raise ValueError(_("Could not modify boolean %s") % name)
> + semanage_bool_key_free(k)
> + semanage_bool_free(b)
>
> + def modify(self, name, value=None, use_file=False):
> +
> rc = semanage_begin_transaction(self.sh)
> if rc < 0:
> raise ValueError(_("Could not start semanage transaction"))
> -
> - rc = semanage_bool_set_active(self.sh, k, b)
> - if rc < 0:
> - raise ValueError(_("Could not set active value of boolean %s") % name)
> - rc = semanage_bool_modify_local(self.sh, k, b)
> - if rc < 0:
> - raise ValueError(_("Could not modify boolean %s") % name)
> + if use_file:
> + fd = open(name)
> + for b in fd.read().split("\n"):
> + b = b.strip()
> + if len(b) == 0:
> + continue
> +
> + try:
> + boolname, val = b.split("=")
> + except ValueError, e:
> + raise ValueError(_("Bad format %s: Record %s" % ( name, b) ))
> + self.__mod(boolname.strip(), val.strip())
> + fd.close()
> + else:
> + self.__mod(name, value)
>
> rc = semanage_commit(self.sh)
> if rc < 0:
> raise ValueError(_("Could not modify boolean %s") % name)
>
> - semanage_bool_key_free(k)
> - semanage_bool_free(b)
> -
> def delete(self, name):
> - (rc,k) = semanage_bool_key_create(self.sh, name)
> - if rc < 0:
> - raise ValueError(_("Could not create a key for %s") % name)
>
> + (rc,k) = semanage_bool_key_create(self.sh, name)
> + if rc < 0:
> + raise ValueError(_("Could not create a key for %s") % name)
> (rc,exists) = semanage_bool_exists(self.sh, k)
> if rc < 0:
> raise ValueError(_("Could not check if boolean %s is defined") % name)
> @@ -1571,8 +1590,15 @@
> else:
> return _("unknown")
>
> - def list(self, heading = 1, locallist = 0):
> + def list(self, heading = True, locallist = False, use_file = False):
> on_off = (_("off"),_("on"))
> + if use_file:
> + ddict = self.get_all(locallist)
> + keys = ddict.keys()
> + for k in keys:
> + if ddict[k]:
> + print "%s=%s" % (k, ddict[k][2])
> + return
> if heading:
> print "%-40s %s\n" % (_("SELinux boolean"), _("Description"))
> ddict = self.get_all(locallist)
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2008-08-01 11:43 Daniel J Walsh
2008-08-05 13:44 ` Stephen Smalley
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2008-08-01 11:43 UTC (permalink / raw)
To: SE Linux
[-- Attachment #1: Type: text/plain, Size: 709 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Adds support for boolean files, name/value pairs as input and output.
Allows you to set a large amount of booleans at once.
Add support from groupname in semanage login. This will allow you to
associate groups of Linux Users with an SELinux user. Uses same syntax
as sudo. Requires patch to libselinux.
Cleanup of semanage variables. Change use of 1/0 to True/False.
Remove bad use of raise(out)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkiS9t8ACgkQrlYvE4MpobN0/gCgsoXMR/oDibFEw3SNFxwQlhrY
gZIAn1wMYnPg+o2ixNVQsWYBOw1NN4Pd
=69RK
-----END PGP SIGNATURE-----
[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 16555 bytes --]
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.53/Makefile
--- nsapolicycoreutils/Makefile 2008-06-12 23:25:24.000000000 -0400
+++ policycoreutils-2.0.53/Makefile 2008-07-29 16:25:16.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null)
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.53/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c 2008-06-12 23:25:21.000000000 -0400
+++ policycoreutils-2.0.53/restorecond/restorecond.c 2008-07-29 16:25:16.000000000 -0400
@@ -210,9 +210,10 @@
}
if (fsetfilecon(fd, scontext) < 0) {
- syslog(LOG_ERR,
- "set context %s->%s failed:'%s'\n",
- filename, scontext, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR,
+ "set context %s->%s failed:'%s'\n",
+ filename, scontext, strerror(errno));
if (retcontext >= 0)
free(prev_context);
free(scontext);
@@ -225,8 +226,9 @@
if (retcontext >= 0)
free(prev_context);
} else {
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
- filename, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+ filename, strerror(errno));
}
free(scontext);
close(fd);
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.53/semanage/semanage
--- nsapolicycoreutils/semanage/semanage 2008-07-02 17:19:15.000000000 -0400
+++ policycoreutils-2.0.53/semanage/semanage 2008-08-01 07:30:43.000000000 -0400
@@ -45,13 +45,13 @@
def usage(message = ""):
print _("""
semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n]
-semanage login -{a|d|m} [-sr] login_name
+semanage login -{a|d|m} [-sr] login_name | %groupname
semanage user -{a|d|m} [-LrRP] selinux_name
semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range
semanage interface -{a|d|m} [-tr] interface_spec
semanage fcontext -{a|d|m} [-frst] file_spec
semanage translation -{a|d|m} [-T] level
-semanage boolean -{d|m} boolean
+semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
semanage permissive -{d|a} type
Primary Options:
@@ -79,6 +79,7 @@
-l (symbolic link)
-p (named pipe)
+ -F, --file Treat target as an input file for command, change multiple settings
-p, --proto Port protocol (tcp or udp)
-P, --prefix Prefix for home directory labeling
-L, --level Default SELinux Level (MLS/MCS Systems only)
@@ -114,7 +115,7 @@
valid_option["translation"] = []
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
valid_option["boolean"] = []
- valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0" ]
+ valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0", "-F", "--file"]
valid_option["permissive"] = []
valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ]
return valid_option
@@ -134,15 +135,16 @@
setrans = ""
roles = ""
seuser = ""
- prefix = ""
- heading=1
- value=0
- add = 0
- modify = 0
- delete = 0
- deleteall = 0
- list = 0
- locallist = 0
+ prefix = "user"
+ heading = True
+ value = None
+ add = False
+ modify = False
+ delete = False
+ deleteall = False
+ list = False
+ locallist = False
+ use_file = False
store = ""
if len(sys.argv) < 3:
usage(_("Requires 2 or more arguments"))
@@ -155,11 +157,12 @@
args = sys.argv[2:]
gopts, cmds = getopt.getopt(args,
- '01adf:lhmnp:s:CDR:L:r:t:T:P:S:',
+ '01adf:lhmnp:s:FCDR:L:r:t:T:P:S:',
['add',
'delete',
'deleteall',
'ftype=',
+ 'file',
'help',
'list',
'modify',
@@ -185,31 +188,35 @@
if o == "-a" or o == "--add":
if modify or delete:
usage()
- add = 1
+ add = True
if o == "-d" or o == "--delete":
if modify or add:
usage()
- delete = 1
+ delete = True
if o == "-D" or o == "--deleteall":
if modify:
usage()
- deleteall = 1
+ deleteall = True
if o == "-f" or o == "--ftype":
ftype=a
+
+ if o == "-F" or o == "--file":
+ use_file = True
+
if o == "-h" or o == "--help":
usage()
if o == "-n" or o == "--noheading":
- heading=0
+ heading = False
if o == "-C" or o == "--locallist":
- locallist=1
+ locallist = True
if o == "-m"or o == "--modify":
if delete or add:
usage()
- modify = 1
+ modify = True
if o == "-S" or o == '--store':
store = a
@@ -220,7 +227,7 @@
serange = a
if o == "-l" or o == "--list":
- list = 1
+ list = True
if o == "-L" or o == '--level':
if is_mls_enabled == 0:
@@ -246,9 +253,9 @@
setrans = a
if o == "--on" or o == "-1":
- value = 1
- if o == "-off" or o == "-0":
- value = 0
+ value = "on"
+ if o == "--off" or o == "-0":
+ value = "off"
if object == "login":
OBJECT = seobject.loginRecords(store)
@@ -275,7 +282,10 @@
OBJECT = seobject.permissiveRecords(store)
if list:
- OBJECT.list(heading, locallist)
+ if object == "boolean":
+ OBJECT.list(heading, locallist, use_file)
+ else:
+ OBJECT.list(heading, locallist)
sys.exit(0);
if deleteall:
@@ -295,12 +305,10 @@
OBJECT.add(target, setrans)
if object == "user":
- rlist = roles.split()
- if len(rlist) == 0:
- raise ValueError(_("You must specify a role"))
- if prefix == "":
- raise ValueError(_("You must specify a prefix"))
- OBJECT.add(target, rlist, selevel, serange, prefix)
+ rlist = []
+ if not use_file:
+ rlist = roles.split()
+ OBJECT.add(target, rlist, selevel, serange, prefix)
if object == "port":
OBJECT.add(target, proto, serange, setype)
@@ -317,7 +325,7 @@
if modify:
if object == "boolean":
- OBJECT.modify(target, value)
+ OBJECT.modify(target, value, use_file)
if object == "login":
OBJECT.modify(target, seuser, serange)
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-2.0.53/semanage/semanage.8
--- nsapolicycoreutils/semanage/semanage.8 2008-07-02 17:19:15.000000000 -0400
+++ policycoreutils-2.0.53/semanage/semanage.8 2008-08-01 07:05:54.000000000 -0400
@@ -3,11 +3,11 @@
semanage \- SELinux Policy Management tool
.SH "SYNOPSIS"
-.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|lC|D} [\-n]
+.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|D} [\-n] [\-S store]
.br
-.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] boolean
+.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] -F boolean | boolean_file
.br
-.B semanage login \-{a|d|m} [\-sr] login_name
+.B semanage login \-{a|d|m} [\-sr] login_name | %groupname
.br
.B semanage user \-{a|d|m} [\-LrRP] selinux_name
.br
@@ -54,6 +54,11 @@
File Type. This is used with fcontext.
Requires a file type as shown in the mode field by ls, e.g. use -d to match only directories or -- to match only regular files.
.TP
+.I \-F, \-\-file
+Set multiple records from the input file. When used with the \-l \-\-list, it will output the current settings to stdout in the proper format.
+
+Currently booleans only.
+.TP
.I \-h, \-\-help
display this message
.TP
@@ -87,6 +92,9 @@
.I \-s, \-\-seuser
SELinux user name
.TP
+.I \-S, \-\-store
+Select and alternate SELinux store to manage
+.TP
.I \-t, \-\-type
SELinux Type for the object
.TP
@@ -99,6 +107,8 @@
$ semanage user -l
# Allow joe to login as staff_u
$ semanage login -a -s staff_u joe
+# Allow the group clerks to login as user_u
+$ semanage login -a -s user_u %clerks
# Add file-context for everything under /web (used by restorecon)
$ semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
# Allow Apache to listen on port 81
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.53/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py 2008-07-29 09:15:39.000000000 -0400
+++ policycoreutils-2.0.53/semanage/seobject.py 2008-08-01 07:24:34.000000000 -0400
@@ -21,7 +21,7 @@
#
#
-import pwd, string, selinux, tempfile, os, re, sys
+import pwd, grp, string, selinux, tempfile, os, re, sys
from semanage import *;
PROGNAME="policycoreutils"
import sepolgen.module as module
@@ -330,20 +330,15 @@
for name in dirs:
os.rmdir(os.path.join(root, name))
- if rc != 0:
- raise ValueError(out)
-
-
def delete(self, name):
for n in name.split():
rc = semanage_module_remove(self.sh, "permissive_%s" % n)
if rc < 0:
raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
- rc = semanage_commit(self.sh)
- if rc < 0:
- raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
+ rc = semanage_commit(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
-
def deleteall(self):
l = self.get_all()
if len(l) > 0:
@@ -402,10 +397,16 @@
raise ValueError(_("Could not check if login mapping for %s is defined") % name)
if exists:
raise ValueError(_("Login mapping for %s is already defined") % name)
- try:
- pwd.getpwnam(name)
- except:
- raise ValueError(_("Linux User %s does not exist") % name)
+ if name[0] == '%':
+ try:
+ grp.getgrnam(name[1:])
+ except:
+ raise ValueError(_("Linux Group %s does not exist") % name[1:])
+ else:
+ try:
+ pwd.getpwnam(name)
+ except:
+ raise ValueError(_("Linux User %s does not exist") % name)
(rc,u) = semanage_seuser_create(self.sh)
if rc < 0:
@@ -1447,54 +1448,72 @@
class booleanRecords(semanageRecords):
def __init__(self, store = ""):
semanageRecords.__init__(self, store)
+ self.dict={}
+ self.dict["TRUE"] = 1
+ self.dict["FALSE"] = 0
+ self.dict["ON"] = 1
+ self.dict["OFF"] = 0
+ self.dict["1"] = 1
+ self.dict["0"] = 0
- def modify(self, name, value = ""):
- if value == "":
- raise ValueError(_("Requires value"))
-
- (rc,k) = semanage_bool_key_create(self.sh, name)
- if rc < 0:
- raise ValueError(_("Could not create a key for %s") % name)
-
- (rc,exists) = semanage_bool_exists(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not check if boolean %s is defined") % name)
- if not exists:
- raise ValueError(_("Boolean %s is not defined") % name)
-
- (rc,b) = semanage_bool_query(self.sh, k)
- if rc < 0:
- raise ValueError(_("Could not query file context %s") % name)
+ def __mod(self, name, value):
+ (rc,k) = semanage_bool_key_create(self.sh, name)
+ if rc < 0:
+ raise ValueError(_("Could not create a key for %s") % name)
+ (rc,exists) = semanage_bool_exists(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not check if boolean %s is defined") % name)
+ if not exists:
+ raise ValueError(_("Boolean %s is not defined") % name)
+
+ (rc,b) = semanage_bool_query(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not query file context %s") % name)
- if value != "":
- nvalue = int(value)
- semanage_bool_set_value(b, nvalue)
+ if value.upper() in self.dict:
+ semanage_bool_set_value(b, self.dict[value.upper()])
else:
- raise ValueError(_("You must specify a value"))
+ raise ValueError(_("You must specify one of the following values: %s") % ", ".join(self.dict.keys()) )
+
+ rc = semanage_bool_set_active(self.sh, k, b)
+ if rc < 0:
+ raise ValueError(_("Could not set active value of boolean %s") % name)
+ rc = semanage_bool_modify_local(self.sh, k, b)
+ if rc < 0:
+ raise ValueError(_("Could not modify boolean %s") % name)
+ semanage_bool_key_free(k)
+ semanage_bool_free(b)
+ def modify(self, name, value=None, use_file=False):
+
rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
-
- rc = semanage_bool_set_active(self.sh, k, b)
- if rc < 0:
- raise ValueError(_("Could not set active value of boolean %s") % name)
- rc = semanage_bool_modify_local(self.sh, k, b)
- if rc < 0:
- raise ValueError(_("Could not modify boolean %s") % name)
+ if use_file:
+ fd = open(name)
+ for b in fd.read().split("\n"):
+ b = b.strip()
+ if len(b) == 0:
+ continue
+
+ try:
+ boolname, val = b.split("=")
+ except ValueError, e:
+ raise ValueError(_("Bad format %s: Record %s" % ( name, b) ))
+ self.__mod(boolname.strip(), val.strip())
+ fd.close()
+ else:
+ self.__mod(name, value)
rc = semanage_commit(self.sh)
if rc < 0:
raise ValueError(_("Could not modify boolean %s") % name)
- semanage_bool_key_free(k)
- semanage_bool_free(b)
-
def delete(self, name):
- (rc,k) = semanage_bool_key_create(self.sh, name)
- if rc < 0:
- raise ValueError(_("Could not create a key for %s") % name)
+ (rc,k) = semanage_bool_key_create(self.sh, name)
+ if rc < 0:
+ raise ValueError(_("Could not create a key for %s") % name)
(rc,exists) = semanage_bool_exists(self.sh, k)
if rc < 0:
raise ValueError(_("Could not check if boolean %s is defined") % name)
@@ -1571,8 +1590,15 @@
else:
return _("unknown")
- def list(self, heading = 1, locallist = 0):
+ def list(self, heading = True, locallist = False, use_file = False):
on_off = (_("off"),_("on"))
+ if use_file:
+ ddict = self.get_all(locallist)
+ keys = ddict.keys()
+ for k in keys:
+ if ddict[k]:
+ print "%s=%s" % (k, ddict[k][2])
+ return
if heading:
print "%-40s %s\n" % (_("SELinux boolean"), _("Description"))
ddict = self.get_all(locallist)
[-- Attachment #3: diff.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2008-01-11 21:15 Daniel J Walsh
@ 2008-01-23 21:01 ` Stephen Smalley
0 siblings, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2008-01-23 21:01 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Fri, 2008-01-11 at 16:15 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Make sepolgen-ifgen return errors.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkeH3HkACgkQrlYvE4MpobNe3ACeN095D7eEMgV1K6YlWMtXX1ck
> 6JoAniapk+chTq3cOQ3kqWZbvYhwEAAf
> =Eslh
> -----END PGP SIGNATURE-----
> plain text document attachment (policycoreutils-sepolgen.patch)
> diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/sepolgen-ifgen policycoreutils-2.0.35/audit2allow/sepolgen-ifgen
> --- nsapolicycoreutils/audit2allow/sepolgen-ifgen 2007-07-16 14:20:41.000000000 -0400
> +++ policycoreutils-2.0.35/audit2allow/sepolgen-ifgen 2008-01-11 11:17:46.000000000 -0500
> @@ -80,7 +80,10 @@
> if_set.to_file(f)
> f.close()
>
> - return 0
> + if refparser.success:
> + return 0
> + else:
> + return 1
>
> if __name__ == "__main__":
> sys.exit(main())
Merged.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2008-01-11 21:15 Daniel J Walsh
2008-01-23 21:01 ` Stephen Smalley
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2008-01-11 21:15 UTC (permalink / raw)
To: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 341 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Make sepolgen-ifgen return errors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkeH3HkACgkQrlYvE4MpobNe3ACeN095D7eEMgV1K6YlWMtXX1ck
6JoAniapk+chTq3cOQ3kqWZbvYhwEAAf
=Eslh
-----END PGP SIGNATURE-----
[-- Attachment #2: policycoreutils-sepolgen.patch --]
[-- Type: text/plain, Size: 565 bytes --]
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/sepolgen-ifgen policycoreutils-2.0.35/audit2allow/sepolgen-ifgen
--- nsapolicycoreutils/audit2allow/sepolgen-ifgen 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.35/audit2allow/sepolgen-ifgen 2008-01-11 11:17:46.000000000 -0500
@@ -80,7 +80,10 @@
if_set.to_file(f)
f.close()
- return 0
+ if refparser.success:
+ return 0
+ else:
+ return 1
if __name__ == "__main__":
sys.exit(main())
[-- Attachment #3: policycoreutils-sepolgen.patch.sig --]
[-- Type: application/octet-stream, Size: 72 bytes --]
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-12-06 18:34 Daniel J Walsh
@ 2007-12-07 20:19 ` Stephen Smalley
0 siblings, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2007-12-07 20:19 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-12-06 at 13:34 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> The first patch to fixfiles, eliminates the verbose updates when doing a
> diff with an old file context. This was potentially causing lots of
> messages in yum updates and caused an error during update.
>
> Also better handling of arguments when passed into fixfiles.
>
> The second patch adds better handling of boolean to semanage. The
> biggest improvement is the tool now extracts out the boolean description
> when listing, making searching for a boolean easier.
/usr/sbin/semanage boolean -l yields no output with this patch?
SELinux boolean Description
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFHWEC9rlYvE4MpobMRAq3gAJ94UxlJ7lwij+WtkYkp0r4PmfB9cwCglprd
> SgvCBh97RlQtNpS6QYoHr+c=
> =s0k6
> -----END PGP SIGNATURE-----
> plain text document attachment (policycoreutils-rhat.patch.part001)
> --- nsapolicycoreutils/scripts/fixfiles 2007-08-23 16:52:26.000000000 -0400
> +++ policycoreutils-2.0.31/scripts/fixfiles 2007-11-16 16:30:21.000000000 -0500
> @@ -92,7 +92,7 @@
> ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \
> \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \
> done 2> /dev/null | \
> - ${RESTORECON} $2 -v -f -
> + ${RESTORECON} $2 -f -
> rm -f ${TEMPFILE} ${PREFCTEMPFILE}
> fi
> }
> @@ -189,21 +189,27 @@
> case "$i" in
> f)
> fullFlag=1
> + shift 1
> ;;
> R)
> RPMFILES=$OPTARG
> + shift 2
> ;;
> o)
> OUTFILES=$OPTARG
> + shift 2
> ;;
> l)
> LOGFILE=$OPTARG
> + shift 2
> ;;
> C)
> PREFC=$OPTARG
> + shift 2
> ;;
> F)
> FORCEFLAG="-F"
> + shift 1
> ;;
> *)
> usage
> @@ -211,10 +217,8 @@
> esac
> done
>
> -
> # Check for the command
> -eval command=\$${OPTIND}
> -let OPTIND=$OPTIND+1
> +command=$1
> if [ -z $command ]; then
> usage
> fi
> @@ -223,17 +227,15 @@
> # check if they specified both DIRS and RPMFILES
> #
>
> +shift 1
> if [ ! -z "$RPMFILES" ]; then
> - if [ $OPTIND -le $# ]; then
> + if [ $# -gt 0 ]; then
> usage
> fi
> else
> - while [ $OPTIND -le $# ]; do
> - eval DIR=\$${OPTIND}
> - DIRS="$DIRS $DIR"
> - let OPTIND=$OPTIND+1
> - done
> + DIRS=$*
> fi
> +
> #
> # Make sure they specified one of the three valid commands
> #
> plain text document attachment (policycoreutils-rhat.patch.part002)
> --- nsapolicycoreutils/semanage/seobject.py 2007-10-07 21:46:43.000000000 -0400
> +++ policycoreutils-2.0.31/semanage/seobject.py 2007-11-19 17:35:04.000000000 -0500
> @@ -1,5 +1,5 @@
> #! /usr/bin/python -E
> -# Copyright (C) 2005 Red Hat
> +# Copyright (C) 2005, 2006, 2007 Red Hat
> # see file 'COPYING' for use and warranty information
> #
> # semanage is a tool for managing SELinux configuration files
> @@ -88,6 +88,35 @@
>
> mylog = logger()
>
> +import sys, os
> +import re
> +import xml.etree.ElementTree
> +
> +booleans_dict={}
> +try:
> + tree=xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
> + for l in tree.findall("layer"):
> + for m in l.findall("module"):
> + for b in m.findall("tunable"):
> + desc = b.find("desc").find("p").text.strip("\n")
> + desc = re.sub("\n", " ", desc)
> + booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc)
> + for b in m.findall("bool"):
> + desc = b.find("desc").find("p").text.strip("\n")
> + desc = re.sub("\n", " ", desc)
> + booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc)
> + for i in tree.findall("bool"):
> + desc = i.find("desc").find("p").text.strip("\n")
> + desc = re.sub("\n", " ", desc)
> + booleans_dict[i.get('name')] = (_("global"), i.get('dftval'), desc)
> + for i in tree.findall("tunable"):
> + desc = i.find("desc").find("p").text.strip("\n")
> + desc = re.sub("\n", " ", desc)
> + booleans_dict[i.get('name')] = (_("global"), i.get('dftval'), desc)
> +except IOError, e:
> + #print _("Failed to translate booleans.\n%s") % e
> + pass
> +
> def validate_level(raw):
> sensitivity = "s[0-9]*"
> category = "c[0-9]*"
> @@ -1095,7 +1121,13 @@
>
> return con
>
> + def validate(self, target):
> + if target == "" or target.find("\n") >= 0:
> + raise ValueError(_("Invalid file specification"))
> +
> def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
> + self.validate(target)
> +
> if is_mls_enabled == 1:
> serange = untranslate(serange)
>
> @@ -1154,6 +1186,7 @@
> def modify(self, target, setype, ftype, serange, seuser):
> if serange == "" and setype == "" and seuser == "":
> raise ValueError(_("Requires setype, serange or seuser"))
> + self.validate(target)
>
> (rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
> if rc < 0:
> @@ -1328,11 +1362,14 @@
> if value != "":
> nvalue = int(value)
> semanage_bool_set_value(b, nvalue)
> + else:
> + raise ValueError(_("You must specify a value"))
>
> rc = semanage_begin_transaction(self.sh)
> if rc < 0:
> raise ValueError(_("Could not start semanage transaction"))
>
> + rc = semanage_bool_set_active(self.sh, k, b)
> rc = semanage_bool_modify_local(self.sh, k, b)
> if rc < 0:
> raise ValueError(_("Could not modify boolean %s") % name)
> @@ -1416,11 +1453,25 @@
>
> return ddict
>
> + def get_desc(self, boolean):
> + if boolean in booleans_dict:
> + return _(booleans_dict[boolean][2])
> + else:
> + return boolean
> +
> + def get_category(self, boolean):
> + if boolean in booleans_dict:
> + return _(booleans_dict[boolean][0])
> + else:
> + return _("unknown")
> +
> def list(self, heading = 1, locallist = 0):
> + on_off = (_("off"),_("on"))
> if heading:
> - print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") )
> + print "%-40s %s\n" % (_("SELinux boolean"), _("Description"))
> ddict = self.get_all(locallist)
> keys = ddict.keys()
> for k in keys:
> if ddict[k]:
> - print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2])
> + print "%-30s -> %-5s %s" % (k, on_off[ddict[k][2]], self.get_desc(k))
> +
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2007-12-06 18:34 Daniel J Walsh
2007-12-07 20:19 ` Stephen Smalley
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2007-12-06 18:34 UTC (permalink / raw)
To: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 756 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The first patch to fixfiles, eliminates the verbose updates when doing a
diff with an old file context. This was potentially causing lots of
messages in yum updates and caused an error during update.
Also better handling of arguments when passed into fixfiles.
The second patch adds better handling of boolean to semanage. The
biggest improvement is the tool now extracts out the boolean description
when listing, making searching for a boolean easier.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFHWEC9rlYvE4MpobMRAq3gAJ94UxlJ7lwij+WtkYkp0r4PmfB9cwCglprd
SgvCBh97RlQtNpS6QYoHr+c=
=s0k6
-----END PGP SIGNATURE-----
[-- Attachment #2: policycoreutils-rhat.patch.part001 --]
[-- Type: text/plain, Size: 1386 bytes --]
--- nsapolicycoreutils/scripts/fixfiles 2007-08-23 16:52:26.000000000 -0400
+++ policycoreutils-2.0.31/scripts/fixfiles 2007-11-16 16:30:21.000000000 -0500
@@ -92,7 +92,7 @@
! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o \
\( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print; \
done 2> /dev/null | \
- ${RESTORECON} $2 -v -f -
+ ${RESTORECON} $2 -f -
rm -f ${TEMPFILE} ${PREFCTEMPFILE}
fi
}
@@ -189,21 +189,27 @@
case "$i" in
f)
fullFlag=1
+ shift 1
;;
R)
RPMFILES=$OPTARG
+ shift 2
;;
o)
OUTFILES=$OPTARG
+ shift 2
;;
l)
LOGFILE=$OPTARG
+ shift 2
;;
C)
PREFC=$OPTARG
+ shift 2
;;
F)
FORCEFLAG="-F"
+ shift 1
;;
*)
usage
@@ -211,10 +217,8 @@
esac
done
-
# Check for the command
-eval command=\$${OPTIND}
-let OPTIND=$OPTIND+1
+command=$1
if [ -z $command ]; then
usage
fi
@@ -223,17 +227,15 @@
# check if they specified both DIRS and RPMFILES
#
+shift 1
if [ ! -z "$RPMFILES" ]; then
- if [ $OPTIND -le $# ]; then
+ if [ $# -gt 0 ]; then
usage
fi
else
- while [ $OPTIND -le $# ]; do
- eval DIR=\$${OPTIND}
- DIRS="$DIRS $DIR"
- let OPTIND=$OPTIND+1
- done
+ DIRS=$*
fi
+
#
# Make sure they specified one of the three valid commands
#
[-- Attachment #3: policycoreutils-rhat.patch.part002 --]
[-- Type: text/plain, Size: 4235 bytes --]
--- nsapolicycoreutils/semanage/seobject.py 2007-10-07 21:46:43.000000000 -0400
+++ policycoreutils-2.0.31/semanage/seobject.py 2007-11-19 17:35:04.000000000 -0500
@@ -1,5 +1,5 @@
#! /usr/bin/python -E
-# Copyright (C) 2005 Red Hat
+# Copyright (C) 2005, 2006, 2007 Red Hat
# see file 'COPYING' for use and warranty information
#
# semanage is a tool for managing SELinux configuration files
@@ -88,6 +88,35 @@
mylog = logger()
+import sys, os
+import re
+import xml.etree.ElementTree
+
+booleans_dict={}
+try:
+ tree=xml.etree.ElementTree.parse("/usr/share/selinux/devel/policy.xml")
+ for l in tree.findall("layer"):
+ for m in l.findall("module"):
+ for b in m.findall("tunable"):
+ desc = b.find("desc").find("p").text.strip("\n")
+ desc = re.sub("\n", " ", desc)
+ booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc)
+ for b in m.findall("bool"):
+ desc = b.find("desc").find("p").text.strip("\n")
+ desc = re.sub("\n", " ", desc)
+ booleans_dict[b.get('name')] = (m.get("name"), b.get('dftval'), desc)
+ for i in tree.findall("bool"):
+ desc = i.find("desc").find("p").text.strip("\n")
+ desc = re.sub("\n", " ", desc)
+ booleans_dict[i.get('name')] = (_("global"), i.get('dftval'), desc)
+ for i in tree.findall("tunable"):
+ desc = i.find("desc").find("p").text.strip("\n")
+ desc = re.sub("\n", " ", desc)
+ booleans_dict[i.get('name')] = (_("global"), i.get('dftval'), desc)
+except IOError, e:
+ #print _("Failed to translate booleans.\n%s") % e
+ pass
+
def validate_level(raw):
sensitivity = "s[0-9]*"
category = "c[0-9]*"
@@ -1095,7 +1121,13 @@
return con
+ def validate(self, target):
+ if target == "" or target.find("\n") >= 0:
+ raise ValueError(_("Invalid file specification"))
+
def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ self.validate(target)
+
if is_mls_enabled == 1:
serange = untranslate(serange)
@@ -1154,6 +1186,7 @@
def modify(self, target, setype, ftype, serange, seuser):
if serange == "" and setype == "" and seuser == "":
raise ValueError(_("Requires setype, serange or seuser"))
+ self.validate(target)
(rc,k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
if rc < 0:
@@ -1328,11 +1362,14 @@
if value != "":
nvalue = int(value)
semanage_bool_set_value(b, nvalue)
+ else:
+ raise ValueError(_("You must specify a value"))
rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
+ rc = semanage_bool_set_active(self.sh, k, b)
rc = semanage_bool_modify_local(self.sh, k, b)
if rc < 0:
raise ValueError(_("Could not modify boolean %s") % name)
@@ -1416,11 +1453,25 @@
return ddict
+ def get_desc(self, boolean):
+ if boolean in booleans_dict:
+ return _(booleans_dict[boolean][2])
+ else:
+ return boolean
+
+ def get_category(self, boolean):
+ if boolean in booleans_dict:
+ return _(booleans_dict[boolean][0])
+ else:
+ return _("unknown")
+
def list(self, heading = 1, locallist = 0):
+ on_off = (_("off"),_("on"))
if heading:
- print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") )
+ print "%-40s %s\n" % (_("SELinux boolean"), _("Description"))
ddict = self.get_all(locallist)
keys = ddict.keys()
for k in keys:
if ddict[k]:
- print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2])
+ print "%-30s -> %-5s %s" % (k, on_off[ddict[k][2]], self.get_desc(k))
+
[-- Attachment #4: policycoreutils-rhat.patch.part001.sig --]
[-- Type: application/octet-stream, Size: 65 bytes --]
[-- Attachment #5: policycoreutils-rhat.patch.part002.sig --]
[-- Type: application/octet-stream, Size: 65 bytes --]
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-06-01 14:32 Daniel J Walsh
@ 2007-06-05 14:05 ` Stephen Smalley
0 siblings, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2007-06-05 14:05 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux, Joshua Brindle, Mark Goldman
On Fri, 2007-06-01 at 10:32 -0400, Daniel J Walsh wrote:
> policycoreutils should be checking if the user is the default_type not
> hard coded to user_u.
>
> Also if selinux is not enabled, the verification step should not
> happen. This is causing problems in chroot environments for the install.
>
> Both these fixes should go into the new genhomedircon that is being
> added to semanage.
Thanks, merged into the current genhomedircon script on trunk.
> plain text document attachment (diff)
> diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.19/scripts/genhomedircon
> --- nsapolicycoreutils/scripts/genhomedircon 2007-05-18 09:58:33.000000000 -0400
> +++ policycoreutils-2.0.19/scripts/genhomedircon 2007-06-01 10:29:32.000000000 -0400
> @@ -193,7 +193,7 @@
> return prefix
>
> def adduser(self, udict, user, seuser, prefix):
> - if seuser == "user_u" or user == "__default__" or user == "system_u":
> + if seuser == self.default_user or user == "__default__" or user == "system_u":
> return
> # !!! chooses first prefix in the list to use in the file context !!!
> try:
> @@ -263,7 +263,7 @@
> i = i.replace("system_u", seuser)
> # Validate if the generated context exists. Some user types may not exist
> scon = i.split()[-1]
> - if selinux.security_check_context(scon) == 0:
> + if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0:
> ret = ret+i
> fd.close()
> return ret
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2007-06-01 14:32 Daniel J Walsh
2007-06-05 14:05 ` Stephen Smalley
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2007-06-01 14:32 UTC (permalink / raw)
To: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 324 bytes --]
policycoreutils should be checking if the user is the default_type not
hard coded to user_u.
Also if selinux is not enabled, the verification step should not
happen. This is causing problems in chroot environments for the install.
Both these fixes should go into the new genhomedircon that is being
added to semanage.
[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 1028 bytes --]
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.19/scripts/genhomedircon
--- nsapolicycoreutils/scripts/genhomedircon 2007-05-18 09:58:33.000000000 -0400
+++ policycoreutils-2.0.19/scripts/genhomedircon 2007-06-01 10:29:32.000000000 -0400
@@ -193,7 +193,7 @@
return prefix
def adduser(self, udict, user, seuser, prefix):
- if seuser == "user_u" or user == "__default__" or user == "system_u":
+ if seuser == self.default_user or user == "__default__" or user == "system_u":
return
# !!! chooses first prefix in the list to use in the file context !!!
try:
@@ -263,7 +263,7 @@
i = i.replace("system_u", seuser)
# Validate if the generated context exists. Some user types may not exist
scon = i.split()[-1]
- if selinux.security_check_context(scon) == 0:
+ if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0:
ret = ret+i
fd.close()
return ret
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-04-27 14:30 ` Karl MacMillan
@ 2007-04-27 15:10 ` Stephen Smalley
0 siblings, 0 replies; 26+ messages in thread
From: Stephen Smalley @ 2007-04-27 15:10 UTC (permalink / raw)
To: Karl MacMillan; +Cc: Daniel J Walsh, SE Linux
On Fri, 2007-04-27 at 10:30 -0400, Karl MacMillan wrote:
> On Fri, 2007-04-27 at 08:50 -0400, Daniel J Walsh wrote:
> > Karl MacMillan wrote:
> > > On Thu, 2007-04-26 at 11:30 -0400, Daniel J Walsh wrote:
> > >
> > >> This patch moves audit2why to /usr/bin to match audit2allow, since both
> > >> can be used from userspace. Also moves sepolgen-ifget to /usr/sbin,
> > >> since this is not to be run by normal users.
> > >>
> > >>
> > >
> > > sepolgen-ifgen can be run by a normal user and the output saved to an
> > > arbitrary file. audit2allow also has flags for reading the interface
> > > information from a non-default flag. So I think it should stay
> > > in /usr/bin.
> > >
> > > I merged the audit2why change to trunk, stable, and policyrep.
> > >
> > > Karl
> > >
> > >
> > >
> > I guess the argument would be just because it can be run by a normal
> > user, should it be placed in /usr/bin?
>
> That was my thinking.
>
> > I look at apps that are almost
> > never run by normal users and tend to put them in /usr/sbin. But
> > overall I don't really care. The only problem is that I have
> > selinux-policy-devel package executes it in /usr/sbin. So moving it
> > back to /usr/bin would be a hassle.
>
> I don't really care - anyone else have an opinion? Otherwise I can merge
> the move to sbin.
I have no strong opinion, but I think moving things around unnecessarily
leads to confusion and breakage and should be avoided. And that these
kinds of changes should not be made in the Fedora packages _before_
being accepted upstream.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-04-27 12:50 ` Daniel J Walsh
@ 2007-04-27 14:30 ` Karl MacMillan
2007-04-27 15:10 ` Stephen Smalley
0 siblings, 1 reply; 26+ messages in thread
From: Karl MacMillan @ 2007-04-27 14:30 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
On Fri, 2007-04-27 at 08:50 -0400, Daniel J Walsh wrote:
> Karl MacMillan wrote:
> > On Thu, 2007-04-26 at 11:30 -0400, Daniel J Walsh wrote:
> >
> >> This patch moves audit2why to /usr/bin to match audit2allow, since both
> >> can be used from userspace. Also moves sepolgen-ifget to /usr/sbin,
> >> since this is not to be run by normal users.
> >>
> >>
> >
> > sepolgen-ifgen can be run by a normal user and the output saved to an
> > arbitrary file. audit2allow also has flags for reading the interface
> > information from a non-default flag. So I think it should stay
> > in /usr/bin.
> >
> > I merged the audit2why change to trunk, stable, and policyrep.
> >
> > Karl
> >
> >
> >
> I guess the argument would be just because it can be run by a normal
> user, should it be placed in /usr/bin?
That was my thinking.
> I look at apps that are almost
> never run by normal users and tend to put them in /usr/sbin. But
> overall I don't really care. The only problem is that I have
> selinux-policy-devel package executes it in /usr/sbin. So moving it
> back to /usr/bin would be a hassle.
I don't really care - anyone else have an opinion? Otherwise I can merge
the move to sbin.
Karl
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-04-26 19:18 ` Karl MacMillan
@ 2007-04-27 12:50 ` Daniel J Walsh
2007-04-27 14:30 ` Karl MacMillan
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2007-04-27 12:50 UTC (permalink / raw)
To: Karl MacMillan; +Cc: Stephen Smalley, SE Linux
Karl MacMillan wrote:
> On Thu, 2007-04-26 at 11:30 -0400, Daniel J Walsh wrote:
>
>> This patch moves audit2why to /usr/bin to match audit2allow, since both
>> can be used from userspace. Also moves sepolgen-ifget to /usr/sbin,
>> since this is not to be run by normal users.
>>
>>
>
> sepolgen-ifgen can be run by a normal user and the output saved to an
> arbitrary file. audit2allow also has flags for reading the interface
> information from a non-default flag. So I think it should stay
> in /usr/bin.
>
> I merged the audit2why change to trunk, stable, and policyrep.
>
> Karl
>
>
>
I guess the argument would be just because it can be run by a normal
user, should it be placed in /usr/bin? I look at apps that are almost
never run by normal users and tend to put them in /usr/sbin. But
overall I don't really care. The only problem is that I have
selinux-policy-devel package executes it in /usr/sbin. So moving it
back to /usr/bin would be a hassle.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: policycoreutils patch
2007-04-26 15:30 Daniel J Walsh
@ 2007-04-26 19:18 ` Karl MacMillan
2007-04-27 12:50 ` Daniel J Walsh
0 siblings, 1 reply; 26+ messages in thread
From: Karl MacMillan @ 2007-04-26 19:18 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
On Thu, 2007-04-26 at 11:30 -0400, Daniel J Walsh wrote:
> This patch moves audit2why to /usr/bin to match audit2allow, since both
> can be used from userspace. Also moves sepolgen-ifget to /usr/sbin,
> since this is not to be run by normal users.
>
sepolgen-ifgen can be run by a normal user and the output saved to an
arbitrary file. audit2allow also has flags for reading the interface
information from a non-default flag. So I think it should stay
in /usr/bin.
I merged the audit2why change to trunk, stable, and policyrep.
Karl
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2007-04-26 15:30 Daniel J Walsh
2007-04-26 19:18 ` Karl MacMillan
0 siblings, 1 reply; 26+ messages in thread
From: Daniel J Walsh @ 2007-04-26 15:30 UTC (permalink / raw)
To: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 187 bytes --]
This patch moves audit2why to /usr/bin to match audit2allow, since both
can be used from userspace. Also moves sepolgen-ifget to /usr/sbin,
since this is not to be run by normal users.
[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 1342 bytes --]
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.10/audit2allow/Makefile
--- nsapolicycoreutils/audit2allow/Makefile 2007-02-07 12:11:49.000000000 -0500
+++ policycoreutils-2.0.10/audit2allow/Makefile 2007-04-24 14:43:23.000000000 -0400
@@ -1,6 +1,7 @@
# Installation directories.
PREFIX ?= ${DESTDIR}/usr
BINDIR ?= $(PREFIX)/bin
+SBINDIR ?= $(PREFIX)/sbin
LIBDIR ?= $(PREFIX)/lib
MANDIR ?= $(PREFIX)/share/man
LOCALEDIR ?= /usr/share/locale
@@ -10,7 +11,7 @@
install: all
-mkdir -p $(BINDIR)
install -m 755 audit2allow $(BINDIR)
- install -m 755 sepolgen-ifgen $(BINDIR)
+ install -m 755 sepolgen-ifgen $(SBINDIR)
-mkdir -p $(MANDIR)/man1
install -m 644 audit2allow.1 $(MANDIR)/man1/
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/Makefile policycoreutils-2.0.10/audit2why/Makefile
--- nsapolicycoreutils/audit2why/Makefile 2006-11-16 17:14:26.000000000 -0500
+++ policycoreutils-2.0.10/audit2why/Makefile 2007-04-24 14:43:23.000000000 -0400
@@ -1,6 +1,6 @@
# Installation directories.
PREFIX ?= ${DESTDIR}/usr
-BINDIR ?= $(PREFIX)/sbin
+BINDIR ?= $(PREFIX)/bin
LIBDIR ?= ${PREFIX}/lib
MANDIR ?= $(PREFIX)/share/man
LOCALEDIR ?= /usr/share/locale
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2006-03-29 15:19 Daniel J Walsh
0 siblings, 0 replies; 26+ messages in thread
From: Daniel J Walsh @ 2006-03-29 15:19 UTC (permalink / raw)
To: Stephen Smalley, SE Linux
[-- Attachment #1: Type: text/plain, Size: 461 bytes --]
Updated patch for policycoreutils.
Many fixes for audit2allow for generating reference policy.
Now looks for dontaudit as well as allow rules.
Generate policy_module if generating a reference module
No longer puts roles in gen_requires lines
Clears all classes, roles, types on reload switch
Fix for restorcond to handle renames of files in the same directory.
Fix files script to use find instead of restorecond -R directly.
[-- Attachment #2: policycoreutils-rhat.patch --]
[-- Type: text/x-patch, Size: 30835 bytes --]
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/audit2allow/audit2allow policycoreutils-1.30.1/audit2allow/audit2allow
--- nsapolicycoreutils/audit2allow/audit2allow 2006-03-10 09:48:04.000000000 -0500
+++ policycoreutils-1.30.1/audit2allow/audit2allow 2006-03-29 10:08:58.000000000 -0500
@@ -27,15 +27,14 @@
import commands, sys, os, pwd, string, getopt, re, selinux
obj="(\{[^\}]*\}|[^ \t:]*)"
-allow_regexp="allow[ \t]+%s[ \t]*%s[ \t]*:[ \t]*%s[ \t]*%s" % (obj, obj, obj, obj)
-
+allow_regexp="(allow|dontaudit)[ \t]+%s[ \t]*%s[ \t]*:[ \t]*%s[ \t]*%s" % (obj, obj, obj, obj)
awk_script='/^[[:blank:]]*interface[[:blank:]]*\(/ {\n\
IFACEFILE=FILENAME\n\
IFACENAME = gensub("^[[:blank:]]*interface[[:blank:]]*\\\\(\`?","","g",$0);\n\
IFACENAME = gensub("\'?,.*$","","g",IFACENAME);\n\
}\n\
\n\
-/^[[:blank:]]*allow[[:blank:]]+.*;[[:blank:]]*$/ {\n\
+/^[[:blank:]]*(allow|dontaudit)[[:blank:]]+.*;[[:blank:]]*$/ {\n\
\n\
if ((length(IFACENAME) > 0) && (IFACEFILE == FILENAME)){\n\
ALLOW = gensub("^[[:blank:]]*","","g",$0)\n\
@@ -84,14 +83,13 @@
m=re.match(regexp,r)
if m==None:
continue
- else:
- val=m.groups()
+ val=m.groups()
file=os.path.basename(val[0]).split(".")[0]
iface=val[1]
- Scon=val[2].split()
- Tcon=val[3].split()
- Class=val[4].split()
- Access=trans.get(val[5].split())
+ Scon=val[3].split()
+ Tcon=val[4].split()
+ Class=val[5].split()
+ Access=trans.get(val[6].split())
for s in Scon:
for t in Tcon:
for c in Class:
@@ -217,12 +215,15 @@
class seruleRecords:
def __init__(self, input, last_reload=0, verbose=0, te_ind=0):
self.last_reload=last_reload
- self.seRules={}
+ self.initialize()
+ self.load(input, te_ind)
+ self.gen_ref_policy = False
+
+ def initialize(self):
+ self.seRules={}
self.seclasses={}
self.types=[]
self.roles=[]
- self.load(input, te_ind)
- self.gen_ref_policy = False
def gen_reference_policy(self):
self.gen_ref_policy = True
@@ -330,7 +331,7 @@
return
if "load_policy" in avc and self.last_reload:
- self.seRules={}
+ self.initialize()
if "granted" in avc:
return
@@ -395,6 +396,9 @@
self.types.append(type)
def gen_module(self, module):
+ if self.gen_ref_policy:
+ return "policy_module(%s, 1.0);" % module
+ else:
return "module %s 1.0;" % module
def gen_requires(self):
@@ -403,11 +407,11 @@
keys=self.seclasses.keys()
keys.sort()
rec="\n\nrequire {\n"
- if len(self.roles) > 0:
- for i in self.roles:
- rec += "\trole %s; \n" % i
- rec += "\n"
-
+# if len(self.roles) > 0:
+# for i in self.roles:
+# rec += "\trole %s; \n" % i
+# rec += "\n"
+#
for i in keys:
access=self.seclasses[i]
if len(access) > 1:
@@ -423,7 +427,7 @@
for i in self.types:
rec += "\ttype %s; \n" % i
- rec += " };\n\n\n"
+ rec += "};\n\n"
return rec
def out(self, require=0, module=""):
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/Makefile policycoreutils-1.30.1/Makefile
--- nsapolicycoreutils/Makefile 2005-11-29 10:55:01.000000000 -0500
+++ policycoreutils-1.30.1/Makefile 2006-03-28 23:03:06.000000000 -0500
@@ -1,4 +1,4 @@
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand setsebool po
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand setsebool po
all install relabel clean:
@for subdir in $(SUBDIRS); do \
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/Makefile policycoreutils-1.30.1/restorecond/Makefile
--- nsapolicycoreutils/restorecond/Makefile 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/Makefile 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,29 @@
+# Installation directories.
+PREFIX ?= ${DESTDIR}/usr
+SBINDIR ?= $(PREFIX)/sbin
+MANDIR = $(PREFIX)/share/man
+INITDIR = $(DESTDIR)/etc/rc.d/init.d
+SELINUXDIR = $(DESTDIR)/etc/selinux
+
+CFLAGS ?= -g -Werror -Wall -W
+override CFLAGS += -I$(PREFIX)/include -D_FILE_OFFSET_BITS=64
+LDLIBS += -lselinux -L$(PREFIX)/lib
+
+all: restorecond
+
+restorecond: restorecond.o utmpwatcher.o stringslist.o
+ $(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
+
+install: all
+ [ -d $(MANDIR)/man8 ] || mkdir -p $(MANDIR)/man8
+ -mkdir -p $(SBINDIR)
+ install -m 755 restorecond $(SBINDIR)
+ install -m 644 restorecond.8 $(MANDIR)/man8
+ -mkdir -p $(INITDIR)
+ install -m 644 restorecond.init $(INITDIR)/restorecond
+ -mkdir -p $(SELINUXDIR)
+ install -m 600 restorecond.conf $(SELINUXDIR)/restorecond.conf
+
+clean:
+ -rm -f restorecond *.o *~
+
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/restorecond.8 policycoreutils-1.30.1/restorecond/restorecond.8
--- nsapolicycoreutils/restorecond/restorecond.8 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/restorecond.8 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,31 @@
+.TH "restorecond" "8" "2002031409" "" ""
+.SH "NAME"
+restorecond \- daemon that watches for file creation and then corrects file context
+
+.SH "SYNOPSIS"
+.B restorecond [\-d]
+.P
+
+.SH "DESCRIPTION"
+This manual page describes the
+.BR restorecond
+program.
+.P
+This daemon uses inotify to watch files listed in the /etc/selinux/POLICYTYPE/restorconfiles.conf, when they are created, this daemon will make sure they have
+the correct file context associated with the policy.
+
+.SH "OPTIONS"
+.TP
+.B \-d
+Turns on debugging mode. Application will stay in the foreground and lots of
+debugs messages start printing.
+
+.SH "AUTHOR"
+This man page was written by Dan Walsh <dwalsh@redhat.com>.
+The program was written by Dan Walsh <dwalsh@redhat.com>.
+
+.SH "FILES"
+/etc/selinux/POLICYTYPE/restorconfiles.conf
+
+.SH "SEE ALSO"
+.BR restorecon (8),
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-1.30.1/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/restorecond.c 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,451 @@
+/*
+ * restorecond
+ *
+ * Copyright (C) 2006 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+.*
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+ * 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+*/
+
+/*
+ * PURPOSE:
+ * This daemon program watches for the creation of files listed in a config file
+ * and makes sure that there security context matches the systems defaults
+ *
+ * USAGE:
+ * restorecond [-d]
+ *
+ * -d Run in debug mode
+ *
+ * EXAMPLE USAGE:
+ * restorecond
+ *
+ */
+
+#define _GNU_SOURCE
+#include <sys/inotify.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <string.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <syslog.h>
+#include <limits.h>
+#include <fcntl.h>
+
+#include "restorecond.h"
+#include "stringslist.h"
+#include "utmpwatcher.h"
+
+extern char *dirname(char *path);
+static int master_fd=-1;
+static int master_wd=-1;
+static int terminate=0;
+
+#include <selinux/selinux.h>
+#include <utmp.h>
+
+/* size of the event structure, not counting name */
+#define EVENT_SIZE (sizeof (struct inotify_event))
+/* reasonable guess as to size of 1024 events */
+#define BUF_LEN (1024 * (EVENT_SIZE + 16))
+
+static int debug_mode=0;
+
+static void restore(const char *filename);
+
+struct watchList {
+ struct watchList *next;
+ int wd;
+ char *dir;
+ struct stringsList *files;
+};
+struct watchList *firstDir=NULL;
+
+/* Compare two contexts to see if their differences are "significant",
+ * or whether the only difference is in the user. */
+static int only_changed_user(const char *a, const char *b)
+{
+ char *rest_a, *rest_b; /* Rest of the context after the user */
+ if (!a || !b) return 0;
+ rest_a = strchr(a, ':');
+ rest_b = strchr(b, ':');
+ if (!rest_a || !rest_b) return 0;
+ return (strcmp(rest_a, rest_b) == 0);
+}
+
+/*
+ A file was in a direcroty has been created. This function checks to
+ see if it is one that we are watching.
+*/
+
+static int watch_list_find(int wd, const char *file) {
+ struct watchList *ptr=NULL;
+ ptr=firstDir;
+
+ if (debug_mode)
+ printf("%d: File=%s\n", wd, file);
+ while (ptr != NULL) {
+ if (ptr->wd == wd) {
+ if (strings_list_find(ptr->files, file) == 0) {
+ char *path=NULL;
+ if (asprintf(&path, "%s/%s",ptr->dir, file) < 0)
+ exitApp("Error allocating memory.");
+ restore (path);
+ free(path);
+ return 0;
+ }
+ if (debug_mode)
+ strings_list_print(ptr->files);
+
+ /* Not found in this directory */
+ return -1;
+ }
+ ptr=ptr->next;
+ }
+ /* Did not find a directory */
+ return -1;
+}
+
+static void watch_list_free(int fd) {
+ struct watchList *ptr=NULL;
+ struct watchList *prev=NULL;
+ ptr=firstDir;
+
+ while (ptr!=NULL) {
+ inotify_rm_watch(fd, ptr->wd);
+ strings_list_free(ptr->files);
+ free(ptr->dir);
+ prev=ptr;
+ ptr=ptr->next;
+ free(prev);
+ }
+ firstDir=NULL;
+}
+
+/*
+ Set the file context to the default file context for this system.
+ Same as restorecon.
+*/
+static void restore(const char *filename) {
+ int retcontext=0;
+ security_context_t scontext=NULL;
+ security_context_t prev_context=NULL;
+ struct stat st;
+ int fd=-1;
+ if (debug_mode)
+ printf("restore %s\n", filename);
+
+ fd = open(filename, O_NOFOLLOW | O_RDONLY );
+ if ( fd < 0 ) {
+ syslog(LOG_ERR,"Unable to open file (%s) %s\n", filename,strerror(errno));
+ return;
+ }
+
+
+ if (fstat(fd, &st)!=0) {
+ syslog(LOG_ERR,"Unable to stat file (%s) %s\n", filename,strerror(errno));
+ close(fd);
+ return;
+ }
+
+ if (! (st.st_mode & S_IFDIR) && st.st_nlink > 1) {
+ syslog(LOG_ERR,"Will not restore a file with more than one hard link (%s) %s\n", filename,strerror(errno));
+ close(fd);
+ return;
+ }
+
+ if (matchpathcon(filename, st.st_mode, &scontext) < 0) {
+ if (errno == ENOENT)
+ return;
+ syslog(LOG_ERR,"matchpathcon(%s) failed %s\n", filename,strerror(errno));
+ return;
+ }
+ retcontext=fgetfilecon(fd,&prev_context);
+
+ if (retcontext >= 0 || errno == ENODATA) {
+ if (retcontext < 0) prev_context=NULL;
+ if (retcontext < 0 ||
+ (strcmp(prev_context,scontext) != 0)) {
+
+ if (only_changed_user(scontext, prev_context) != 0) {
+ free(scontext);
+ free(prev_context);
+ close(fd);
+ return;
+ }
+
+ if (fsetfilecon(fd,scontext) < 0) {
+ syslog(LOG_ERR,"set context %s->%s failed:'%s'\n",
+ filename, scontext, strerror(errno));
+ if (retcontext >= 0)
+ free(prev_context);
+ free(scontext);
+ close(fd);
+ return;
+ }
+ syslog(LOG_WARNING,"Reset file context %s: %s->%s\n", filename, prev_context, scontext);
+ }
+ if (retcontext >= 0)
+ free(prev_context);
+ }
+ else {
+ syslog(LOG_ERR,"get context on %s failed: '%s'\n",
+ filename, strerror(errno));
+ }
+ free(scontext);
+ close(fd);
+}
+
+static void process_config(int fd, FILE *cfg) {
+ char *line_buf=NULL;
+ unsigned int len=0;
+
+ while (getline(&line_buf, &len, cfg)>0) {
+ char *buffer=line_buf;
+ while(isspace(*buffer))
+ buffer++;
+ if(buffer[0] == '#') continue;
+ int l=strlen(buffer)-1;
+ if ( l <= 0 ) continue;
+ buffer[l]=0;
+ if(buffer[0] == '~')
+ utmpwatcher_add(fd, &buffer[1]);
+ else {
+ watch_list_add(fd, buffer);
+ }
+ }
+ free(line_buf);
+}
+
+/*
+ Read config file ignoring Comment lines
+ Files specified one per line. Files with "~" will be expanded to the logged in users
+ homedirs.
+*/
+
+static void read_config(int fd) {
+ char *watch_file_path="/etc/selinux/restorecond.conf";
+
+ FILE *cfg = NULL;
+ if (debug_mode)
+ printf("Read Config\n");
+
+ watch_list_free(fd);
+
+ cfg=fopen(watch_file_path, "r");
+ if (!cfg) exitApp("Error reading config file.");
+ process_config(fd, cfg);
+ fclose(cfg);
+
+ inotify_rm_watch(fd, master_wd);
+ master_wd=inotify_add_watch (fd, watch_file_path, IN_MOVED_FROM | IN_MODIFY);
+}
+
+/*
+ Inotify watch loop
+*/
+static int watch(int fd) {
+ char buf[BUF_LEN];
+ int len, i = 0;
+ len = read(fd, buf, BUF_LEN);
+ if (len < 0) {
+ if (terminate == 0) {
+ syslog(LOG_ERR, "Read error (%s)", strerror(errno));
+ return 0;
+ }
+ syslog(LOG_ERR, "terminated");
+ return -1;
+ } else if (!len)
+ /* BUF_LEN too small? */
+ return -1;
+ while (i < len) {
+ struct inotify_event *event;
+ event = (struct inotify_event *) &buf[i];
+ if (debug_mode)
+ printf ("wd=%d mask=%u cookie=%u len=%u\n",
+ event->wd, event->mask,
+ event->cookie, event->len);
+ if (event->wd == master_wd)
+ read_config(fd);
+ else {
+ switch (utmpwatcher_handle(fd, event->wd)) {
+ case -1: /* Message was not for utmpwatcher */
+ if (event->len)
+ watch_list_find (event->wd, event->name);
+ break;
+
+ case 1: /* utmp has changed need to reload */
+ read_config(fd);
+ break;
+
+ default: /* No users logged in or out */
+ break;
+ }
+ }
+
+
+ i += EVENT_SIZE + event->len;
+ }
+ return 0;
+}
+
+static const char *pidfile = "/var/run/restorecond.pid";
+
+static int write_pid_file(void)
+{
+ int pidfd, len;
+ char val[16];
+
+ len = snprintf(val, sizeof(val), "%u\n", getpid());
+ if (len < 0) {
+ syslog(LOG_ERR, "Pid error (%s)", strerror(errno));
+ pidfile = 0;
+ return 1;
+ }
+ pidfd = open(pidfile, O_CREAT | O_TRUNC | O_NOFOLLOW | O_WRONLY, 0644);
+ if (pidfd < 0) {
+ syslog(LOG_ERR, "Unable to set pidfile (%s)",
+ strerror(errno));
+ pidfile = 0;
+ return 1;
+ }
+ (void)write(pidfd, val, (unsigned int)len);
+ close(pidfd);
+ return 0;
+}
+
+/*
+ * SIGTERM handler
+ */
+static void term_handler()
+{
+ terminate=1;
+ /* trigger a failure in the watch */
+ close(master_fd);
+}
+
+static void usage(char *program) {
+ printf("%s [-d] \n", program);
+ exit(0);
+}
+
+void exitApp(const char *msg) {
+ perror(msg);
+ exit(-1);
+}
+
+/*
+ Add a file to the watch list. We are watching for file creation, so we actually
+ put the watch on the directory and then examine all files created in that directory
+ to see if it is one that we are watching.
+*/
+
+void watch_list_add(int fd, const char *path) {
+ struct watchList *ptr=NULL;
+ struct watchList *prev=NULL;
+ char *x=strdup(path);
+ if (!x) exitApp("Out of Memory");
+ char *dir=dirname(x);
+ char *file=basename(path);
+ ptr=firstDir;
+
+ restore(path);
+
+ while (ptr!=NULL) {
+ if (strcmp(dir, ptr->dir) == 0) {
+ strings_list_add(&ptr->files, file);
+ free(x);
+ return;
+ }
+ prev=ptr;
+ ptr=ptr->next;
+ }
+ ptr=calloc(1, sizeof(struct watchList));
+
+ if (!ptr) exitApp("Out of Memory");
+ ptr->wd=inotify_add_watch (fd, dir, IN_CREATE | IN_MOVED_TO );
+
+ ptr->dir=strdup(dir);
+ if (!ptr->dir) exitApp("Out of Memory");
+
+ strings_list_add(&ptr->files, file);
+ if (prev)
+ prev->next=ptr;
+ else
+ firstDir=ptr;
+
+ if (debug_mode)
+ printf("%d: Dir=%s, File=%s\n", ptr->wd, ptr->dir, file);
+
+ free(x);
+}
+
+int main(int argc, char **argv) {
+ int opt;
+ struct sigaction sa;
+
+#ifndef DEBUG
+ /* Make sure we are root */
+ if (getuid() != 0) {
+ fprintf(stderr, "You must be root to run this program.\n");
+ return 4;
+ }
+#endif
+
+ /* Register sighandlers */
+ sa.sa_flags = 0 ;
+ sa.sa_handler = term_handler;
+ sigemptyset( &sa.sa_mask ) ;
+ sigaction( SIGTERM, &sa, NULL );
+
+ master_fd = inotify_init ();
+ if (master_fd < 0)
+ exitApp("inotify_init");
+
+ while ((opt = getopt(argc, argv, "d")) > 0) {
+ switch (opt) {
+ case 'd':
+ debug_mode = 1;
+ break;
+ case '?':
+ usage(argv[0]);
+ }
+ }
+ read_config(master_fd);
+
+ write_pid_file();
+
+ if (! debug_mode)
+ daemon(0, 0);
+
+ while (watch(master_fd) == 0 ) {};
+
+ watch_list_free(master_fd);
+ close(master_fd);
+ if (pidfile)
+ unlink(pidfile);
+
+ return 0;
+}
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-1.30.1/restorecond/restorecond.conf
--- nsapolicycoreutils/restorecond/restorecond.conf 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/restorecond.conf 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,4 @@
+/etc/resolv.conf
+/etc/mtab
+/var/run/utmp
+~/public_html
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/restorecond.h policycoreutils-1.30.1/restorecond/restorecond.h
--- nsapolicycoreutils/restorecond/restorecond.h 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/restorecond.h 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,31 @@
+/* restorecond.h --
+ * Copyright 2006 Red Hat Inc., Durham, North Carolina.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+ */
+
+#ifndef RESTORED_CONFIG_H
+#define RESTORED_CONFIG_H
+
+void exitApp(const char *msg);
+void watch_list_add(int inotify_fd, const char *path);
+
+#endif
+
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/restorecond.init policycoreutils-1.30.1/restorecond/restorecond.init
--- nsapolicycoreutils/restorecond/restorecond.init 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/restorecond.init 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,61 @@
+#!/bin/sh
+#
+# restorecond: Daemo used to maintain path file context
+#
+# chkconfig: 2345 10 90
+# description: restorecond uses inotify to look for creation of new files listed in the
+# /etc/selinux/POLICYTYPE/restorefiles.conf file, and sets the correct security
+# context.
+#
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+start()
+{
+ echo -n $"Starting restorecond: "
+ daemon /usr/sbin/restorecond
+
+ touch /var/lock/subsys/restorecond
+ echo
+}
+
+stop()
+{
+ echo -n $"Shutting down restorecond: "
+ killproc restorecond
+
+ rm -f /var/lock/subsys/restorecond
+ echo
+}
+restart()
+{
+ stop
+ start
+}
+
+[ -f /usr/sbin/restorecond ] || exit 0
+
+# See how we were called.
+case "$1" in
+ start)
+ start
+ ;;
+ stop)
+ stop
+ ;;
+ status)
+ status restorecond
+ ;;
+ restart|reload)
+ restart
+ ;;
+ condrestart)
+ [ -e /var/lock/subsys/restorecond ] && restart || :
+ ;;
+ *)
+ echo $"Usage: $0 {start|stop|restart|reload|condrestart}"
+ exit 1
+esac
+
+exit 0
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/stringslist.c policycoreutils-1.30.1/restorecond/stringslist.c
--- nsapolicycoreutils/restorecond/stringslist.c 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/stringslist.c 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2006 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+.*
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+ * 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+*/
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "stringslist.h"
+#include "restorecond.h"
+
+/* Sorted lists */
+void strings_list_add(struct stringsList **list, const char *string) {
+ struct stringsList *ptr=*list;
+ struct stringsList *prev=NULL;
+ struct stringsList *newptr=NULL;
+ while(ptr) {
+ int cmp=strcmp(string, ptr->string);
+ if (cmp < 0) break; /* Not on list break out to add */
+ if (cmp == 0) return; /* Already on list */
+ prev=ptr;
+ ptr=ptr->next;
+ }
+ newptr=calloc(1, sizeof(struct stringsList));
+ if (!newptr) exitApp("Out of Memory");
+ newptr->string=strdup(string);
+ newptr->next = ptr;
+ if (prev)
+ prev->next=newptr;
+ else
+ *list=newptr;
+}
+
+int strings_list_find(struct stringsList *ptr, const char *string) {
+ while (ptr) {
+ int cmp=strcmp(string, ptr->string);
+ if (cmp < 0) return -1; /* Not on list break out to add */
+ if (cmp == 0) return 0; /* Already on list */
+ ptr=ptr->next;
+ }
+ return -1;
+}
+
+void strings_list_free(struct stringsList *ptr) {
+ struct stringsList *prev=NULL;
+ while (ptr) {
+ free(ptr->string);
+ prev=ptr;
+ ptr=ptr->next;
+ free(prev);
+ }
+}
+
+int strings_list_diff(struct stringsList *from, struct stringsList *to) {
+ while (from != NULL && to != NULL) {
+ if (strcmp(from->string, to->string) != 0) return 1;
+ from=from->next;
+ to=to->next;
+ }
+ if (from != NULL || to != NULL) return 1;
+ return 0;
+}
+
+void strings_list_print(struct stringsList *ptr) {
+ while (ptr) {
+ printf("%s\n", ptr->string);
+ ptr=ptr->next;
+ }
+}
+
+
+#ifdef TEST
+void exitApp(const char *msg) {
+ perror(msg);
+ exit(-1);
+}
+
+int main(int argc, char **argv) {
+ struct stringsList *list=NULL;
+ struct stringsList *list1=NULL;
+ strings_list_add(&list, "/etc/resolv.conf");
+ strings_list_add(&list, "/etc/walsh");
+ strings_list_add(&list, "/etc/mtab");
+ strings_list_add(&list, "/etc/walsh");
+ if (strings_list_diff(list, list) != 0) printf ("strings_list_diff test1 bug\n");
+ strings_list_add(&list1, "/etc/walsh");
+ if (strings_list_diff(list, list1) == 0) printf ("strings_list_diff test2 bug\n");
+ strings_list_add(&list1, "/etc/walsh");
+ strings_list_add(&list1, "/etc/resolv.conf");
+ strings_list_add(&list1, "/etc/mtab1");
+ if (strings_list_diff(list, list1) == 0) printf ("strings_list_diff test3 bug\n");
+ printf ("strings list\n");
+ strings_list_print(list);
+ printf ("strings list1\n");
+ strings_list_print(list1);
+ strings_list_free(list);
+ strings_list_free(list1);
+}
+#endif
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/stringslist.h policycoreutils-1.30.1/restorecond/stringslist.h
--- nsapolicycoreutils/restorecond/stringslist.h 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/stringslist.h 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,37 @@
+/* stringslist.h --
+ * Copyright 2006 Red Hat Inc., Durham, North Carolina.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+ */
+#ifndef STRINGSLIST_H
+#define STRINGSLIST_H
+
+struct stringsList {
+ struct stringsList *next;
+ char *string;
+};
+
+void strings_list_free(struct stringsList *list);
+void strings_list_add(struct stringsList **list, const char *string);
+void strings_list_print(struct stringsList *list);
+int strings_list_find(struct stringsList *list, const char *string);
+int strings_list_diff(struct stringsList *from, struct stringsList *to);
+
+#endif
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/utmpwatcher.c policycoreutils-1.30.1/restorecond/utmpwatcher.c
--- nsapolicycoreutils/restorecond/utmpwatcher.c 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/utmpwatcher.c 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,105 @@
+/*
+ * utmpwatcher.c
+ *
+ * Copyright (C) 2006 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+.*
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+ * 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+ *
+*/
+
+#define _GNU_SOURCE
+#include <sys/inotify.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <syslog.h>
+
+#include <limits.h>
+#include <utmp.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include "restorecond.h"
+#include "utmpwatcher.h"
+#include "stringslist.h"
+
+static struct stringsList *utmp_ptr=NULL;
+static int utmp_wd=-1;
+
+unsigned int utmpwatcher_handle(int inotify_fd, int wd) {
+ int changed=0;
+ struct utmp u;
+ char *utmp_path="/var/run/utmp";
+ struct stringsList *prev_utmp_ptr=utmp_ptr;
+ if (wd != utmp_wd) return -1;
+
+ utmp_ptr=NULL;
+ FILE *cfg=fopen(utmp_path, "r");
+ if (!cfg) exitApp("Error reading config file.");
+
+ while (fread(&u, sizeof(struct utmp), 1, cfg) > 0) {
+ if (u.ut_type == USER_PROCESS)
+ strings_list_add(&utmp_ptr, u.ut_user);
+ }
+ fclose(cfg);
+ if (utmp_wd >= 0)
+ inotify_rm_watch(inotify_fd, utmp_wd);
+
+ utmp_wd=inotify_add_watch (inotify_fd, utmp_path, IN_MOVED_FROM | IN_MODIFY);
+ if (prev_utmp_ptr) {
+ changed=strings_list_diff(prev_utmp_ptr, utmp_ptr);
+ strings_list_free(prev_utmp_ptr);
+ }
+ return changed;
+}
+
+static void watch_file(int inotify_fd, const char *file) {
+ struct stringsList *ptr=utmp_ptr;
+
+ while(ptr) {
+ struct passwd *pwd=getpwnam(ptr->string);
+ if (pwd) {
+ char *path=NULL;
+ if (asprintf(&path, "%s%s",pwd->pw_dir, file) < 0)
+ exitApp("Error allocating memory.");
+ watch_list_add(inotify_fd, path);
+ free(path);
+ }
+ ptr=ptr->next;
+ }
+}
+
+void utmpwatcher_add(int inotify_fd, const char *path) {
+ if (utmp_ptr == NULL) {
+ utmpwatcher_handle(inotify_fd, utmp_wd);
+ }
+ watch_file(inotify_fd, path);
+}
+
+#ifdef TEST
+int main(int argc, char **argv) {
+ read_utmp();
+ return 0;
+}
+#endif
+
+
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecond/utmpwatcher.h policycoreutils-1.30.1/restorecond/utmpwatcher.h
--- nsapolicycoreutils/restorecond/utmpwatcher.h 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-1.30.1/restorecond/utmpwatcher.h 2006-03-28 23:03:06.000000000 -0500
@@ -0,0 +1,29 @@
+/* utmpwatcher.h --
+ * Copyright 2006 Red Hat Inc., Durham, North Carolina.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Authors:
+ * Dan Walsh <dwalsh@redhat.com>
+ *
+ */
+#ifndef UTMPWATCHER_H
+#define UTMPWATCHER_H
+
+unsigned int utmpwatcher_handle(int inotify_fd, int wd);
+void utmpwatcher_add(int inotify_fd, const char *path);
+
+#endif
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-1.30.1/scripts/fixfiles
--- nsapolicycoreutils/scripts/fixfiles 2006-01-04 13:07:46.000000000 -0500
+++ policycoreutils-1.30.1/scripts/fixfiles 2006-03-28 23:03:06.000000000 -0500
@@ -124,7 +124,15 @@
exit $?
fi
if [ ! -z "$DIRS" ]; then
- ${RESTORECON} ${OUTFILES} ${FORCEFLAG} -R $1 -v $DIRS 2>&1 >> $LOGFILE
+ if [ -x /usr/bin/find ]; then
+ for d in ${DIRS} ; do find $d \
+ ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs \) -prune -o -print | \
+ ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $1 -v -f - 2>&1 >> $LOGFILE
+ done
+ else
+ ${RESTORECON} ${OUTFILES} ${FORCEFLAG} -R $1 -v $DIRS 2>&1 >> $LOGFILE
+ fi
+
exit $?
fi
LogReadOnly
^ permalink raw reply [flat|nested] 26+ messages in thread
* policycoreutils patch
@ 2003-11-19 3:40 Russell Coker
0 siblings, 0 replies; 26+ messages in thread
From: Russell Coker @ 2003-11-19 3:40 UTC (permalink / raw)
To: SE Linux
[-- Attachment #1: Type: text/plain, Size: 570 bytes --]
I have attached a small patch to policycoreutils. This fixes a bunch of minor
warnings in setfiles (the sb_unused change is just to flag the parameter as
one we know we aren't using), and makes some Makefile changes to assist in
packaging.
Steve, I believe that this is worthy of including in the next release.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
[-- Attachment #2: policycoreutils.diff --]
[-- Type: text/x-diff, Size: 13372 bytes --]
diff -rup /tmp/policycoreutils-1.2/load_policy/Makefile ./load_policy/Makefile
--- /tmp/policycoreutils-1.2/load_policy/Makefile 2003-08-28 02:07:11.000000000 +1000
+++ ./load_policy/Makefile 2003-11-19 14:11:56.000000000 +1100
@@ -3,7 +3,8 @@ PREFIX ?= ${DESTDIR}/usr
SBINDIR ?= $(PREFIX)/sbin
LOCALEDIR ?= /usr/share/locale
-CFLAGS = -Wall -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
+CFLAGS = -Wall
+override CFLAGS += -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
LDLIBS += -lselinux
# Build static so that we can put it on an initrd.
diff -rup /tmp/policycoreutils-1.2/newrole/Makefile ./newrole/Makefile
--- /tmp/policycoreutils-1.2/newrole/Makefile 2003-08-28 02:07:12.000000000 +1000
+++ ./newrole/Makefile 2003-11-19 14:11:41.000000000 +1100
@@ -5,8 +5,8 @@ MANDIR ?= $(PREFIX)/share/man
ETCDIR ?= $(DESTDIR)/etc
LOCALEDIR = /usr/share/locale
-CFLAGS = -Wall -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-override CFLAGS += -DUSE_PAM
+CFLAGS = -Wall
+override CFLAGS += -DUSE_PAM -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
LDLIBS += -lselinux -lattr -ldl -lpam -lpam_misc
TARGETS=$(patsubst %.c,%,$(wildcard *.c))
diff -rup /tmp/policycoreutils-1.2/run_init/Makefile ./run_init/Makefile
--- /tmp/policycoreutils-1.2/run_init/Makefile 2003-08-28 02:07:16.000000000 +1000
+++ ./run_init/Makefile 2003-11-19 14:12:26.000000000 +1100
@@ -6,8 +6,8 @@ MANDIR ?= $(PREFIX)/share/man
ETCDIR ?= $(DESTDIR)/etc
LOCALEDIR ?= /usr/share/locale
-CFLAGS = -Wall -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
-override CFLAGS += -DUSE_PAM
+CFLAGS = -Wall
+override CFLAGS += -DUSE_PAM -DLOCALEDIR="\"$(LOCALEDIR)\"" -DPACKAGE="\"policycoreutils\""
LDLIBS += -lselinux -lattr -ldl -lpam -lpam_misc
TARGETS=$(patsubst %.c,%,$(wildcard *.c))
diff -rup /tmp/policycoreutils-1.2/setfiles/setfiles.c ./setfiles/setfiles.c
--- /tmp/policycoreutils-1.2/setfiles/setfiles.c 2003-09-26 01:06:13.000000000 +1000
+++ ./setfiles/setfiles.c 2003-11-19 14:35:55.000000000 +1100
@@ -212,7 +212,7 @@ int find_stem_from_file(const char **buf
* same order as in the specification file.
* Sorting occurs based on hasMetaChars
*/
-static spec_t *spec;
+static spec_t *spec_arr;
static int nspec;
/*
@@ -270,15 +270,15 @@ static file_spec_t *file_spec_add(ino_t
}
- no_conflict = (strcmp(spec[fl->specind].context,spec[specind].context) == 0);
+ no_conflict = (strcmp(spec_arr[fl->specind].context,spec_arr[specind].context) == 0);
if (no_conflict)
return fl;
fprintf(stderr,
"%s: conflicting specifications for %s and %s, using %s.\n",
progname, file, fl->file,
- ((specind > fl->specind) ? spec[specind].
- context : spec[fl->specind].context));
+ ((specind > fl->specind) ? spec_arr[specind].
+ context : spec_arr[fl->specind].context));
fl->specind =
(specind >
fl->specind) ? specind : fl->specind;
@@ -403,23 +403,23 @@ int match(const char *name, struct stat
*/
for (i = nspec - 1; i >= 0; i--)
{
- if(spec[i].stem_id == -1 || spec[i].stem_id == file_stem)
+ if(spec_arr[i].stem_id == -1 || spec_arr[i].stem_id == file_stem)
{
- if(spec[i].stem_id == -1)
- ret = regexec(&spec[i].regex, name, 0, NULL, 0);
+ if(spec_arr[i].stem_id == -1)
+ ret = regexec(&spec_arr[i].regex, name, 0, NULL, 0);
else
- ret = regexec(&spec[i].regex, buf, 0, NULL, 0);
+ ret = regexec(&spec_arr[i].regex, buf, 0, NULL, 0);
if (ret == 0 &&
- (!spec[i].mode
- || (sb->st_mode & S_IFMT) == spec[i].mode)) break;
+ (!spec_arr[i].mode
+ || (sb->st_mode & S_IFMT) == spec_arr[i].mode)) break;
if (ret) {
if (ret == REG_NOMATCH)
continue;
- regerror(ret, &spec[i].regex, errbuf,
+ regerror(ret, &spec_arr[i].regex, errbuf,
sizeof errbuf);
fprintf(stderr,
"%s: unable to match %s against %s: %s\n",
- progname, name, spec[i].regex_str,
+ progname, name, spec_arr[i].regex_str,
errbuf);
return -1;
}
@@ -430,7 +430,7 @@ int match(const char *name, struct stat
/* No matching specification. */
return -1;
- spec[i].matches++;
+ spec_arr[i].matches++;
return i;
}
@@ -439,8 +439,8 @@ int match(const char *name, struct stat
int spec_compare(const void* specA, const void* specB)
{
return(
- ((struct spec *)specB)->hasMetaChars -
- ((struct spec *)specA)->hasMetaChars
+ ((const struct spec *)specB)->hasMetaChars -
+ ((const struct spec *)specA)->hasMetaChars
);
}
@@ -456,20 +456,20 @@ int nodups_specs()
struct spec *curr_spec;
for (ii = 0; ii < nspec; ii++) {
- curr_spec = &spec[ii];
+ curr_spec = &spec_arr[ii];
for (jj = ii + 1; jj < nspec; jj++) {
/* Check if same RE string */
- if ((!strcmp(spec[jj].regex_str, curr_spec->regex_str))
+ if ((!strcmp(spec_arr[jj].regex_str, curr_spec->regex_str))
&&
- (!spec[jj].mode || !curr_spec->mode
- || spec[jj].mode == curr_spec->mode)) {
+ (!spec_arr[jj].mode || !curr_spec->mode
+ || spec_arr[jj].mode == curr_spec->mode)) {
/* Same RE string found */
- if (strcmp(spec[jj].context, curr_spec->context)) {
+ if (strcmp(spec_arr[jj].context, curr_spec->context)) {
/* If different contexts, give warning */
fprintf(stderr,
"ERROR: Multiple different specifications for %s (%s and %s).\n",
curr_spec->regex_str,
- spec[jj].context,
+ spec_arr[jj].context,
curr_spec->context);
}
else {
@@ -533,7 +533,7 @@ void spec_hasMetaChars(struct spec *spec
case '{':
spec->hasMetaChars = 1;
return;
- case '\\': // skip the next character
+ case '\\': /* skip the next character */
c++;
break;
default:
@@ -553,7 +553,7 @@ void spec_hasMetaChars(struct spec *spec
* the directory traversal.
*/
static int apply_spec(const char *file,
- const struct stat *sb, int flag, struct FTW *s)
+ const struct stat *sb_unused, int flag, struct FTW *s_unused)
{
const char *my_file;
file_spec_t *fl;
@@ -596,14 +596,14 @@ static int apply_spec(const char *file,
}
if (debug) {
- if (spec[i].type_str) {
+ if (spec_arr[i].type_str) {
printf("%s: %s matched by (%s,%s,%s)\n", progname,
- my_file, spec[i].regex_str,
- spec[i].type_str, spec[i].context);
+ my_file, spec_arr[i].regex_str,
+ spec_arr[i].type_str, spec_arr[i].context);
} else {
printf("%s: %s matched by (%s,%s)\n", progname,
- my_file, spec[i].regex_str,
- spec[i].context);
+ my_file, spec_arr[i].regex_str,
+ spec_arr[i].context);
}
}
@@ -626,15 +626,15 @@ static int apply_spec(const char *file,
* <<none>> or the file is already labeled according to the
* specification.
*/
- if ((strcmp(spec[i].context, "<<none>>") == 0) ||
- (strcmp(context,spec[i].context) == 0)) {
+ if ((strcmp(spec_arr[i].context, "<<none>>") == 0) ||
+ (strcmp(context,spec_arr[i].context) == 0)) {
freecon(context);
return 0;
}
if (verbose) {
printf("%s: relabeling %s from %s to %s\n", progname,
- my_file, context, spec[i].context);
+ my_file, context, spec_arr[i].context);
}
freecon(context);
@@ -648,11 +648,11 @@ static int apply_spec(const char *file,
/*
* Relabel the file to the specified context.
*/
- ret = lsetfilecon(my_file, spec[i].context);
+ ret = lsetfilecon(my_file, spec_arr[i].context);
if (ret) {
perror(my_file);
fprintf(stderr, "%s: unable to relabel %s to %s\n",
- progname, my_file, spec[i].context);
+ progname, my_file, spec_arr[i].context);
return 1;
}
@@ -680,7 +680,7 @@ void set_rootpath(const char *arg)
int main(int argc, char **argv)
{
FILE *fp;
- char buf[255 + 1], *buf_p;
+ char line_buf[255 + 1], *buf_p;
char *regex, *type, *context;
char *anchored_regex;
int opt, items, len, lineno, pass, regerr, i;
@@ -754,30 +754,30 @@ int main(int argc, char **argv)
for (pass = 0; pass < 2; pass++) {
lineno = 0;
nspec = 0;
- while (fgets(buf, sizeof buf, fp)) {
+ while (fgets(line_buf, sizeof line_buf, fp)) {
lineno++;
- len = strlen(buf);
- if (buf[len - 1] != '\n') {
+ len = strlen(line_buf);
+ if (line_buf[len - 1] != '\n') {
fprintf(stderr,
"%s: no newline on line number %d (only read %s)\n",
- argv[0], lineno, buf);
+ argv[0], lineno, line_buf);
inc_err();
continue;
}
- buf[len - 1] = 0;
- buf_p = buf;
+ line_buf[len - 1] = 0;
+ buf_p = line_buf;
while (isspace(*buf_p))
buf_p++;
/* Skip comment lines and empty lines. */
if (*buf_p == '#' || *buf_p == 0)
continue;
items =
- sscanf(buf, "%as %as %as", ®ex, &type,
+ sscanf(line_buf, "%as %as %as", ®ex, &type,
&context);
if (items < 2) {
fprintf(stderr,
"%s: line number %d is missing fields (only read %s)\n",
- argv[0], lineno, buf);
+ argv[0], lineno, line_buf);
inc_err();
if (items == 1)
free(regex);
@@ -791,12 +791,12 @@ int main(int argc, char **argv)
if (pass == 1) {
/* On the second pass, compile and store the specification in spec. */
- const char *buf = regex;
- spec[nspec].stem_id = find_stem_from_spec(&buf);
- spec[nspec].regex_str = regex;
+ const char *reg_buf = regex;
+ spec_arr[nspec].stem_id = find_stem_from_spec(®_buf);
+ spec_arr[nspec].regex_str = regex;
/* Anchor the regular expression. */
- len = strlen(buf);
+ len = strlen(reg_buf);
anchored_regex = malloc(len + 3);
if (!anchored_regex) {
fprintf(stderr,
@@ -804,16 +804,16 @@ int main(int argc, char **argv)
argv[0], lineno);
exit(1);
}
- sprintf(anchored_regex, "^%s$", buf);
+ sprintf(anchored_regex, "^%s$", reg_buf);
/* Compile the regular expression. */
regerr =
- regcomp(&spec[nspec].regex,
+ regcomp(&spec_arr[nspec].regex,
anchored_regex,
REG_EXTENDED | REG_NOSUB);
if (regerr < 0) {
regerror(regerr,
- &spec[nspec].regex,
+ &spec_arr[nspec].regex,
errbuf, sizeof errbuf);
fprintf(stderr,
"%s: unable to compile regular expression %s on line number %d: %s\n",
@@ -824,8 +824,8 @@ int main(int argc, char **argv)
free(anchored_regex);
/* Convert the type string to a mode format */
- spec[nspec].type_str = type;
- spec[nspec].mode = 0;
+ spec_arr[nspec].type_str = type;
+ spec_arr[nspec].mode = 0;
if (!type)
goto skip_type;
len = strlen(type);
@@ -838,25 +838,25 @@ int main(int argc, char **argv)
}
switch (type[1]) {
case 'b':
- spec[nspec].mode = S_IFBLK;
+ spec_arr[nspec].mode = S_IFBLK;
break;
case 'c':
- spec[nspec].mode = S_IFCHR;
+ spec_arr[nspec].mode = S_IFCHR;
break;
case 'd':
- spec[nspec].mode = S_IFDIR;
+ spec_arr[nspec].mode = S_IFDIR;
break;
case 'p':
- spec[nspec].mode = S_IFIFO;
+ spec_arr[nspec].mode = S_IFIFO;
break;
case 'l':
- spec[nspec].mode = S_IFLNK;
+ spec_arr[nspec].mode = S_IFLNK;
break;
case 's':
- spec[nspec].mode = S_IFSOCK;
+ spec_arr[nspec].mode = S_IFSOCK;
break;
case '-':
- spec[nspec].mode = S_IFREG;
+ spec_arr[nspec].mode = S_IFREG;
break;
default:
fprintf(stderr,
@@ -867,7 +867,7 @@ int main(int argc, char **argv)
skip_type:
- spec[nspec].context = context;
+ spec_arr[nspec].context = context;
if (strcmp(context, "<<none>>")) {
if (security_check_context(context) < 0) {
@@ -881,7 +881,7 @@ int main(int argc, char **argv)
/* Determine if specification has
* any meta characters in the RE */
- spec_hasMetaChars(&spec[nspec]);
+ spec_hasMetaChars(&spec_arr[nspec]);
}
nspec++;
@@ -901,21 +901,21 @@ int main(int argc, char **argv)
nspec);
if (nspec == 0)
exit(0);
- if ((spec = malloc(sizeof(spec_t) * nspec)) ==
+ if ((spec_arr = malloc(sizeof(spec_t) * nspec)) ==
NULL) {
fprintf(stderr,
"%s: insufficient memory for specifications\n",
argv[0]);
exit(1);
}
- bzero(spec, sizeof(spec_t) * nspec);
+ bzero(spec_arr, sizeof(spec_t) * nspec);
rewind(fp);
}
}
fclose(fp);
/* Sort the specifications with most general first */
- qsort(spec, nspec, sizeof(struct spec), spec_compare);
+ qsort(spec_arr, nspec, sizeof(struct spec), spec_compare);
/* Verify no exact duplicates */
if (nodups_specs() != 0) {
@@ -988,17 +988,17 @@ int main(int argc, char **argv)
if (warn_no_match) {
for (i = 0; i < nspec; i++) {
- if (spec[i].matches == 0) {
- if (spec[i].type_str) {
+ if (spec_arr[i].matches == 0) {
+ if (spec_arr[i].type_str) {
printf
("%s: Warning! No matches for (%s, %s, %s)\n",
- argv[0], spec[i].regex_str,
- spec[i].type_str, spec[i].context);
+ argv[0], spec_arr[i].regex_str,
+ spec_arr[i].type_str, spec_arr[i].context);
} else {
printf
("%s: Warning! No matches for (%s, %s)\n",
- argv[0], spec[i].regex_str,
- spec[i].context);
+ argv[0], spec_arr[i].regex_str,
+ spec_arr[i].context);
}
}
}
^ permalink raw reply [flat|nested] 26+ messages in thread
end of thread, other threads:[~2008-11-10 15:52 UTC | newest]
Thread overview: 26+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <45DB0AB8.3070803@redhat.com>
2007-02-20 16:17 ` newrole O_NONBLOCK change (Was: Re: policycoreutils patch) Stephen Smalley
2007-02-20 17:42 ` Daniel J Walsh
2007-02-20 17:58 ` Linda Knippers
2007-02-20 16:22 ` chcat changes " Stephen Smalley
2007-02-20 17:56 ` Daniel J Walsh
2007-02-21 16:37 ` Karl MacMillan
2007-02-21 17:22 ` policycoreutils patch Stephen Smalley
2008-10-23 17:15 Daniel J Walsh
2008-11-10 15:52 ` Joshua Brindle
-- strict thread matches above, loose matches on Subject: below --
2008-08-01 11:43 Daniel J Walsh
2008-08-05 13:44 ` Stephen Smalley
2008-08-05 13:57 ` Stephen Smalley
2008-08-05 14:20 ` Daniel J Walsh
2008-01-11 21:15 Daniel J Walsh
2008-01-23 21:01 ` Stephen Smalley
2007-12-06 18:34 Daniel J Walsh
2007-12-07 20:19 ` Stephen Smalley
2007-06-01 14:32 Daniel J Walsh
2007-06-05 14:05 ` Stephen Smalley
2007-04-26 15:30 Daniel J Walsh
2007-04-26 19:18 ` Karl MacMillan
2007-04-27 12:50 ` Daniel J Walsh
2007-04-27 14:30 ` Karl MacMillan
2007-04-27 15:10 ` Stephen Smalley
2006-03-29 15:19 Daniel J Walsh
2003-11-19 3:40 Russell Coker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.