* [PATCH] Only invoke RPM on RPM-enabled Linux distributions
@ 2015-06-09 11:26 Sven Vermeulen
2015-06-09 12:19 ` Stephen Smalley
2015-06-12 12:59 ` Stephen Smalley
0 siblings, 2 replies; 6+ messages in thread
From: Sven Vermeulen @ 2015-06-09 11:26 UTC (permalink / raw)
To: selinux
When calling "sepolgen generate" to automatically generate a SELinux
policy template, the command fails when it cannot invoke RPM related
commands on Linux distributions that do not support RPM by default:
Failed to retrieve rpm info for selinux-policy
Traceback (most recent call last):
File "/usr/lib/python-exec/python2.7/sepolicy", line 643, in <module>
args.func(args)
File "/usr/lib/python-exec/python2.7/sepolicy", line 517, in generate
print mypolicy.generate(args.path)
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1370, in generate
out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1219, in write_spec
fd.write(self.generate_spec())
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1181, in generate_spec
selinux_policyver = get_rpm_nvr_list("selinux-policy")[1]
TypeError: 'NoneType' object has no attribute '__getitem__'
As the RPM related steps are only needed on RPM-enabled distributions,
we should ignore these steps on other Linux distribution platforms.
In this patch, we use the Python platform module to get the Linux
distribution, and only start the RPM-related activities on Linux
distributions that use RPM as their native package manager.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
policycoreutils/sepolicy/sepolicy/generate.py | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/policycoreutils/sepolicy/sepolicy/generate.py b/policycoreutils/sepolicy/sepolicy/generate.py
index 6b53035..4858582 100644
--- a/policycoreutils/sepolicy/sepolicy/generate.py
+++ b/policycoreutils/sepolicy/sepolicy/generate.py
@@ -26,6 +26,7 @@ import re
import sepolicy
from sepolicy import get_all_types, get_all_attributes, get_all_roles
import time
+import platform
from templates import executable
from templates import boolean
@@ -1171,7 +1172,8 @@ allow %s_t %s_t:%s_socket name_%s;
newsh += re.sub("TEMPLATETYPE", self.name, t1)
newsh += self.generate_user_sh()
- newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
+ if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+ newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
return newsh
@@ -1367,6 +1369,7 @@ Warning %s does not exist
out += "%s # %s\n" % (self.write_if(out_dir), _("Interface file"))
out += "%s # %s\n" % (self.write_fc(out_dir), _("File Contexts file"))
if self.type != NEWTYPE:
- out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
+ if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+ out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
out += "%s # %s\n" % (self.write_sh(out_dir), _("Setup Script"))
return out
--
2.3.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] Only invoke RPM on RPM-enabled Linux distributions
2015-06-09 11:26 [PATCH] Only invoke RPM on RPM-enabled Linux distributions Sven Vermeulen
@ 2015-06-09 12:19 ` Stephen Smalley
2015-06-11 15:22 ` Sven Vermeulen
2015-06-12 12:59 ` Stephen Smalley
1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2015-06-09 12:19 UTC (permalink / raw)
To: Sven Vermeulen, selinux
On 06/09/2015 07:26 AM, Sven Vermeulen wrote:
> When calling "sepolgen generate" to automatically generate a SELinux
> policy template, the command fails when it cannot invoke RPM related
> commands on Linux distributions that do not support RPM by default:
>
> Failed to retrieve rpm info for selinux-policy
> Traceback (most recent call last):
> File "/usr/lib/python-exec/python2.7/sepolicy", line 643, in <module>
> args.func(args)
> File "/usr/lib/python-exec/python2.7/sepolicy", line 517, in generate
> print mypolicy.generate(args.path)
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1370, in generate
> out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1219, in write_spec
> fd.write(self.generate_spec())
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1181, in generate_spec
> selinux_policyver = get_rpm_nvr_list("selinux-policy")[1]
> TypeError: 'NoneType' object has no attribute '__getitem__'
>
> As the RPM related steps are only needed on RPM-enabled distributions,
> we should ignore these steps on other Linux distribution platforms.
>
> In this patch, we use the Python platform module to get the Linux
> distribution, and only start the RPM-related activities on Linux
> distributions that use RPM as their native package manager.
>
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Is there a more general way that we could do this without hardcoding
checks of distribution names? Maybe we could just test for the
existence of rpm?
> ---
> policycoreutils/sepolicy/sepolicy/generate.py | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/policycoreutils/sepolicy/sepolicy/generate.py b/policycoreutils/sepolicy/sepolicy/generate.py
> index 6b53035..4858582 100644
> --- a/policycoreutils/sepolicy/sepolicy/generate.py
> +++ b/policycoreutils/sepolicy/sepolicy/generate.py
> @@ -26,6 +26,7 @@ import re
> import sepolicy
> from sepolicy import get_all_types, get_all_attributes, get_all_roles
> import time
> +import platform
>
> from templates import executable
> from templates import boolean
> @@ -1171,7 +1172,8 @@ allow %s_t %s_t:%s_socket name_%s;
> newsh += re.sub("TEMPLATETYPE", self.name, t1)
>
> newsh += self.generate_user_sh()
> - newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
> + if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
> + newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
>
> return newsh
>
> @@ -1367,6 +1369,7 @@ Warning %s does not exist
> out += "%s # %s\n" % (self.write_if(out_dir), _("Interface file"))
> out += "%s # %s\n" % (self.write_fc(out_dir), _("File Contexts file"))
> if self.type != NEWTYPE:
> - out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> + if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
> + out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> out += "%s # %s\n" % (self.write_sh(out_dir), _("Setup Script"))
> return out
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Only invoke RPM on RPM-enabled Linux distributions
2015-06-09 12:19 ` Stephen Smalley
@ 2015-06-11 15:22 ` Sven Vermeulen
2015-06-12 12:33 ` Stephen Smalley
2015-06-12 13:00 ` Petr Lautrbach
0 siblings, 2 replies; 6+ messages in thread
From: Sven Vermeulen @ 2015-06-11 15:22 UTC (permalink / raw)
To: Stephen Smalley; +Cc: selinux
On Tue, Jun 09, 2015 at 08:19:24AM -0400, Stephen Smalley wrote:
> On 06/09/2015 07:26 AM, Sven Vermeulen wrote:
> > In this patch, we use the Python platform module to get the Linux
> > distribution, and only start the RPM-related activities on Linux
> > distributions that use RPM as their native package manager.
> >
> > Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
>
> Is there a more general way that we could do this without hardcoding
> checks of distribution names? Maybe we could just test for the
> existence of rpm?
That wouldn't be sufficient.
The rpm binary might be installed for other reasons. The code in sepolicy is
used to query the rpm database and search for specific package names. This
is distribution-specific behavior.
If you rather check on the rpm binary, then additional checks will need to
be added to make sure that the assumptions that the code takes (such as
"selinux-policy" package being available) are valid as well.
Wkr,
Sven Vermeulen
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Only invoke RPM on RPM-enabled Linux distributions
2015-06-11 15:22 ` Sven Vermeulen
@ 2015-06-12 12:33 ` Stephen Smalley
2015-06-12 13:00 ` Petr Lautrbach
1 sibling, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2015-06-12 12:33 UTC (permalink / raw)
To: Sven Vermeulen; +Cc: selinux
On 06/11/2015 11:22 AM, Sven Vermeulen wrote:
> On Tue, Jun 09, 2015 at 08:19:24AM -0400, Stephen Smalley wrote:
>> On 06/09/2015 07:26 AM, Sven Vermeulen wrote:
>>> In this patch, we use the Python platform module to get the Linux
>>> distribution, and only start the RPM-related activities on Linux
>>> distributions that use RPM as their native package manager.
>>>
>>> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
>>
>> Is there a more general way that we could do this without hardcoding
>> checks of distribution names? Maybe we could just test for the
>> existence of rpm?
>
> That wouldn't be sufficient.
>
> The rpm binary might be installed for other reasons. The code in sepolicy is
> used to query the rpm database and search for specific package names. This
> is distribution-specific behavior.
>
> If you rather check on the rpm binary, then additional checks will need to
> be added to make sure that the assumptions that the code takes (such as
> "selinux-policy" package being available) are valid as well.
Ok, I guess we'll have to go with your patch then. It would be better
though if there were some way to ask the system what package manager is
in use.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Only invoke RPM on RPM-enabled Linux distributions
2015-06-09 11:26 [PATCH] Only invoke RPM on RPM-enabled Linux distributions Sven Vermeulen
2015-06-09 12:19 ` Stephen Smalley
@ 2015-06-12 12:59 ` Stephen Smalley
1 sibling, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2015-06-12 12:59 UTC (permalink / raw)
To: Sven Vermeulen, selinux
On 06/09/2015 07:26 AM, Sven Vermeulen wrote:
> When calling "sepolgen generate" to automatically generate a SELinux
> policy template, the command fails when it cannot invoke RPM related
> commands on Linux distributions that do not support RPM by default:
>
> Failed to retrieve rpm info for selinux-policy
> Traceback (most recent call last):
> File "/usr/lib/python-exec/python2.7/sepolicy", line 643, in <module>
> args.func(args)
> File "/usr/lib/python-exec/python2.7/sepolicy", line 517, in generate
> print mypolicy.generate(args.path)
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1370, in generate
> out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1219, in write_spec
> fd.write(self.generate_spec())
> File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1181, in generate_spec
> selinux_policyver = get_rpm_nvr_list("selinux-policy")[1]
> TypeError: 'NoneType' object has no attribute '__getitem__'
>
> As the RPM related steps are only needed on RPM-enabled distributions,
> we should ignore these steps on other Linux distribution platforms.
>
> In this patch, we use the Python platform module to get the Linux
> distribution, and only start the RPM-related activities on Linux
> distributions that use RPM as their native package manager.
>
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Thanks, applied.
> ---
> policycoreutils/sepolicy/sepolicy/generate.py | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/policycoreutils/sepolicy/sepolicy/generate.py b/policycoreutils/sepolicy/sepolicy/generate.py
> index 6b53035..4858582 100644
> --- a/policycoreutils/sepolicy/sepolicy/generate.py
> +++ b/policycoreutils/sepolicy/sepolicy/generate.py
> @@ -26,6 +26,7 @@ import re
> import sepolicy
> from sepolicy import get_all_types, get_all_attributes, get_all_roles
> import time
> +import platform
>
> from templates import executable
> from templates import boolean
> @@ -1171,7 +1172,8 @@ allow %s_t %s_t:%s_socket name_%s;
> newsh += re.sub("TEMPLATETYPE", self.name, t1)
>
> newsh += self.generate_user_sh()
> - newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
> + if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
> + newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
>
> return newsh
>
> @@ -1367,6 +1369,7 @@ Warning %s does not exist
> out += "%s # %s\n" % (self.write_if(out_dir), _("Interface file"))
> out += "%s # %s\n" % (self.write_fc(out_dir), _("File Contexts file"))
> if self.type != NEWTYPE:
> - out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> + if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
> + out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
> out += "%s # %s\n" % (self.write_sh(out_dir), _("Setup Script"))
> return out
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Only invoke RPM on RPM-enabled Linux distributions
2015-06-11 15:22 ` Sven Vermeulen
2015-06-12 12:33 ` Stephen Smalley
@ 2015-06-12 13:00 ` Petr Lautrbach
1 sibling, 0 replies; 6+ messages in thread
From: Petr Lautrbach @ 2015-06-12 13:00 UTC (permalink / raw)
To: Sven Vermeulen, Stephen Smalley; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 1320 bytes --]
Dne 11.6.2015 v 17:22 Sven Vermeulen napsal(a):
> On Tue, Jun 09, 2015 at 08:19:24AM -0400, Stephen Smalley wrote:
>> On 06/09/2015 07:26 AM, Sven Vermeulen wrote:
>>> In this patch, we use the Python platform module to get the Linux
>>> distribution, and only start the RPM-related activities on Linux
>>> distributions that use RPM as their native package manager.
>>>
>>> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
>>
>> Is there a more general way that we could do this without hardcoding
>> checks of distribution names? Maybe we could just test for the
>> existence of rpm?
>
> That wouldn't be sufficient.
>
> The rpm binary might be installed for other reasons. The code in sepolicy is
> used to query the rpm database and search for specific package names. This
> is distribution-specific behavior.
>
> If you rather check on the rpm binary, then additional checks will need to
> be added to make sure that the assumptions that the code takes (such as
> "selinux-policy" package being available) are valid as well.
It might be useful to amend the code to check a return value of
get_rpm_nvr_list(). If it's None, you can assume that rpm is not
installed since rpmlib is probably unusable or there's no valid rpm
database entries.
Petr
--
Petr Lautrbach
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-06-12 13:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-09 11:26 [PATCH] Only invoke RPM on RPM-enabled Linux distributions Sven Vermeulen
2015-06-09 12:19 ` Stephen Smalley
2015-06-11 15:22 ` Sven Vermeulen
2015-06-12 12:33 ` Stephen Smalley
2015-06-12 13:00 ` Petr Lautrbach
2015-06-12 12:59 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.