* Patch to python bindings
@ 2009-03-04 20:34 Daniel J Walsh
2009-03-27 13:55 ` Xavier Toth
0 siblings, 1 reply; 3+ messages in thread
From: Daniel J Walsh @ 2009-03-04 20:34 UTC (permalink / raw)
To: SE Linux
[-- Attachment #1: Type: text/plain, Size: 494 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Eliminate lots of avc calls that can not be done in scripting languages.
Throw an exception on error rather then just returning an error code.
setfilecon(x,y) will now throw exeptions.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkmu5e4ACgkQrlYvE4MpobNyBwCg1hmyqzJw7HLf7nV9qokqOmwW
akwAnjKcWtv3EM84nZgDt6IYN9QQxZa3
=5lpv
-----END PGP SIGNATURE-----
[-- Attachment #2: libselinux-swig.patch --]
[-- Type: text/plain, Size: 1530 bytes --]
--- nsalibselinux/src/selinuxswig.i 2008-08-28 09:34:24.000000000 -0400
+++ libselinux-2.0.78/src/selinuxswig.i 2009-03-04 15:23:52.000000000 -0500
@@ -47,8 +47,36 @@
%ignore set_matchpathcon_printf;
%ignore set_matchpathcon_invalidcon;
%ignore set_matchpathcon_canoncon;
-
+%ignore set_selinuxmnt;
+%ignore avc_entry_ref_init;
+%ignore avc_entry_ref;
+%ignore avc_memory_callback;
+%ignore avc_log_callback;
+%ignore avc_thread_callback;
+%ignore avc_lock_callback;
+%ignore avc_cache_stats;
+%ignore av_decision;
+%ignore selinux_opt;
+%ignore selinux_callback;
+%ignore selinux_get_callback;
+%ignore selinux_set_callback;
+%ignore SELboolean;
+%ignore security_class_mapping;
+%ignore print_access_vector;
+%ignore set_matchpathcon_flags;
+%ignore matchpathcon_fini;
+%ignore matchpathcon_filespec_destroy;
+%ignore matchpathcon_filespec_eval;
+%ignore matchpathcon_checkmatches;
%ignore avc_add_callback;
+%ignore avc_sid_stats;
+%ignore avc_av_stats;
+%ignore avc_audit;
+%ignore avc_destroy;
+%ignore avc_cleanup;
+%ignore avc_computer_member;
+%ignore selinux_set_mapping;
+%ignore security_id;
%include "../include/selinux/selinux.h"
%include "../include/selinux/avc.h"
--- nsalibselinux/src/selinuxswig_python.i 2009-01-13 08:45:35.000000000 -0500
+++ libselinux-2.0.78/src/selinuxswig_python.i 2009-03-04 15:23:52.000000000 -0500
@@ -150,4 +159,12 @@
free($1);
}
+%exception {
+ $action
+ if (result < 0) {
+ PyErr_SetFromErrno(PyExc_OSError);
+ return NULL;
+ }
+}
+
%include "selinuxswig.i"
[-- Attachment #3: libselinux-swig.patch.sig --]
[-- Type: application/pgp-signature, Size: 72 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Patch to python bindings
2009-03-04 20:34 Patch to python bindings Daniel J Walsh
@ 2009-03-27 13:55 ` Xavier Toth
2009-03-27 14:08 ` Xavier Toth
0 siblings, 1 reply; 3+ messages in thread
From: Xavier Toth @ 2009-03-27 13:55 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux, Joe Nall
On Wed, Mar 4, 2009 at 3:34 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Eliminate lots of avc calls that can not be done in scripting languages.
>
> Throw an exception on error rather then just returning an error code.
>
> setfilecon(x,y) will now throw exeptions.
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkmu5e4ACgkQrlYvE4MpobNyBwCg1hmyqzJw7HLf7nV9qokqOmwW
> akwAnjKcWtv3EM84nZgDt6IYN9QQxZa3
> =5lpv
> -----END PGP SIGNATURE-----
>
> --- nsalibselinux/src/selinuxswig.i 2008-08-28 09:34:24.000000000 -0400
> +++ libselinux-2.0.78/src/selinuxswig.i 2009-03-04 15:23:52.000000000 -0500
> @@ -47,8 +47,36 @@
> %ignore set_matchpathcon_printf;
> %ignore set_matchpathcon_invalidcon;
> %ignore set_matchpathcon_canoncon;
> -
> +%ignore set_selinuxmnt;
> +%ignore avc_entry_ref_init;
> +%ignore avc_entry_ref;
> +%ignore avc_memory_callback;
> +%ignore avc_log_callback;
> +%ignore avc_thread_callback;
> +%ignore avc_lock_callback;
> +%ignore avc_cache_stats;
> +%ignore av_decision;
> +%ignore selinux_opt;
> +%ignore selinux_callback;
> +%ignore selinux_get_callback;
> +%ignore selinux_set_callback;
> +%ignore SELboolean;
> +%ignore security_class_mapping;
> +%ignore print_access_vector;
> +%ignore set_matchpathcon_flags;
> +%ignore matchpathcon_fini;
> +%ignore matchpathcon_filespec_destroy;
> +%ignore matchpathcon_filespec_eval;
> +%ignore matchpathcon_checkmatches;
> %ignore avc_add_callback;
> +%ignore avc_sid_stats;
> +%ignore avc_av_stats;
> +%ignore avc_audit;
> +%ignore avc_destroy;
> +%ignore avc_cleanup;
> +%ignore avc_computer_member;
> +%ignore selinux_set_mapping;
> +%ignore security_id;
>
> %include "../include/selinux/selinux.h"
> %include "../include/selinux/avc.h"
> --- nsalibselinux/src/selinuxswig_python.i 2009-01-13 08:45:35.000000000 -0500
> +++ libselinux-2.0.78/src/selinuxswig_python.i 2009-03-04 15:23:52.000000000 -0500
> @@ -150,4 +159,12 @@
> free($1);
> }
>
> +%exception {
> + $action
> + if (result < 0) {
> + PyErr_SetFromErrno(PyExc_OSError);
> + return NULL;
> + }
> +}
> +
> %include "selinuxswig.i"
>
>
Could you please rollback this change as we are using av_decision.
> +%ignore av_decision;
For example:
def check_dominance(con):
(rc, raw_con) = selinux.selinux_trans_to_raw_context(con)
(rc, dom_context) = selinux.getcon()
(rc, dom_raw_context) = selinux.selinux_trans_to_raw_context(dom_context)
avd = selinux.av_decision()
selinux.avc_reset()
rc = selinux.security_compute_av_raw(dom_raw_context, raw_con, SECCLASS_CONT
EXT, CONTEXT__CONTAINS, avd)
if (avd.allowed & CONTEXT__CONTAINS) == CONTEXT__CONTAINS:
return True
else:
return False
Thanks
Ted
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Patch to python bindings
2009-03-27 13:55 ` Xavier Toth
@ 2009-03-27 14:08 ` Xavier Toth
0 siblings, 0 replies; 3+ messages in thread
From: Xavier Toth @ 2009-03-27 14:08 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux, Joe Nall
On Fri, Mar 27, 2009 at 8:55 AM, Xavier Toth <txtoth@gmail.com> wrote:
> On Wed, Mar 4, 2009 at 3:34 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Eliminate lots of avc calls that can not be done in scripting languages.
>>
>> Throw an exception on error rather then just returning an error code.
>>
>> setfilecon(x,y) will now throw exeptions.
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.9 (GNU/Linux)
>> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>>
>> iEYEARECAAYFAkmu5e4ACgkQrlYvE4MpobNyBwCg1hmyqzJw7HLf7nV9qokqOmwW
>> akwAnjKcWtv3EM84nZgDt6IYN9QQxZa3
>> =5lpv
>> -----END PGP SIGNATURE-----
>>
>> --- nsalibselinux/src/selinuxswig.i 2008-08-28 09:34:24.000000000 -0400
>> +++ libselinux-2.0.78/src/selinuxswig.i 2009-03-04 15:23:52.000000000 -0500
>> @@ -47,8 +47,36 @@
>> %ignore set_matchpathcon_printf;
>> %ignore set_matchpathcon_invalidcon;
>> %ignore set_matchpathcon_canoncon;
>> -
>> +%ignore set_selinuxmnt;
>> +%ignore avc_entry_ref_init;
>> +%ignore avc_entry_ref;
>> +%ignore avc_memory_callback;
>> +%ignore avc_log_callback;
>> +%ignore avc_thread_callback;
>> +%ignore avc_lock_callback;
>> +%ignore avc_cache_stats;
>> +%ignore av_decision;
>> +%ignore selinux_opt;
>> +%ignore selinux_callback;
>> +%ignore selinux_get_callback;
>> +%ignore selinux_set_callback;
>> +%ignore SELboolean;
>> +%ignore security_class_mapping;
>> +%ignore print_access_vector;
>> +%ignore set_matchpathcon_flags;
>> +%ignore matchpathcon_fini;
>> +%ignore matchpathcon_filespec_destroy;
>> +%ignore matchpathcon_filespec_eval;
>> +%ignore matchpathcon_checkmatches;
>> %ignore avc_add_callback;
>> +%ignore avc_sid_stats;
>> +%ignore avc_av_stats;
>> +%ignore avc_audit;
>> +%ignore avc_destroy;
>> +%ignore avc_cleanup;
>> +%ignore avc_computer_member;
>> +%ignore selinux_set_mapping;
>> +%ignore security_id;
>>
>> %include "../include/selinux/selinux.h"
>> %include "../include/selinux/avc.h"
>> --- nsalibselinux/src/selinuxswig_python.i 2009-01-13 08:45:35.000000000 -0500
>> +++ libselinux-2.0.78/src/selinuxswig_python.i 2009-03-04 15:23:52.000000000 -0500
>> @@ -150,4 +159,12 @@
>> free($1);
>> }
>>
>> +%exception {
>> + $action
>> + if (result < 0) {
>> + PyErr_SetFromErrno(PyExc_OSError);
>> + return NULL;
>> + }
>> +}
>> +
>> %include "selinuxswig.i"
>>
>>
>
> Could you please rollback this change as we are using av_decision.
>> +%ignore av_decision;
>
> For example:
> def check_dominance(con):
> (rc, raw_con) = selinux.selinux_trans_to_raw_context(con)
> (rc, dom_context) = selinux.getcon()
> (rc, dom_raw_context) = selinux.selinux_trans_to_raw_context(dom_context)
>
> avd = selinux.av_decision()
> selinux.avc_reset()
> rc = selinux.security_compute_av_raw(dom_raw_context, raw_con, SECCLASS_CONT
> EXT, CONTEXT__CONTAINS, avd)
> if (avd.allowed & CONTEXT__CONTAINS) == CONTEXT__CONTAINS:
> return True
> else:
> return False
>
>
> Thanks
> Ted
>
Or do I need to change my code, if so how?
Ted
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-03-27 14:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-03-04 20:34 Patch to python bindings Daniel J Walsh
2009-03-27 13:55 ` Xavier Toth
2009-03-27 14:08 ` Xavier Toth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.