SELinux Archive on lore.kernel.org
 help / Atom feed
* [PATCH 1/2] python/chcat: improve the code readability
@ 2018-12-09 14:23 Nicolas Iooss
  2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
  2018-12-11  9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
  0 siblings, 2 replies; 5+ messages in thread
From: Nicolas Iooss @ 2018-12-09 14:23 UTC (permalink / raw)
  To: selinux

flake8 reports many warnings for chcat:

    chcat:7:1: E265 block comment should start with '# '
    chcat:29:1: F401 'string' imported but unused
    chcat:44:1: E722 do not use bare 'except'
    chcat:104:9: F841 local variable 'e' is assigned to but never used
    chcat:144:9: F841 local variable 'e' is assigned to but never used
    chcat:186:9: F841 local variable 'e' is assigned to but never used
    chcat:234:9: F841 local variable 'e' is assigned to but never used
    chcat:262:9: F841 local variable 'e' is assigned to but never used
    chcat:281:5: F841 local variable 'e' is assigned to but never used
    chcat:385:9: E722 do not use bare 'except'
    chcat:402:1: E305 expected 2 blank lines after class or function definition, found 1
    chcat:436:5: F841 local variable 'e' is assigned to but never used

Fix all of them.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
This patch needs to be applied after "python/chcat: use check_call instead of getstatusoutput",
https://lore.kernel.org/selinux/CAJfZ7=k+dNFE7AOO_FJhSMZP7WdvkJf3zbfqeY6kSkabOm+Uag@mail.gmail.com/T/#e720d3de77d336300faf6cc3d8a2940b70c9a169a

 python/chcat/chcat | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/python/chcat/chcat b/python/chcat/chcat
index 1de92306e963..73f757258807 100755
--- a/python/chcat/chcat
+++ b/python/chcat/chcat
@@ -4,7 +4,7 @@
 #
 #    chcat is a script that allows you modify the Security label on a file
 #
-#`   Author: Daniel Walsh <dwalsh@redhat.com>
+#    Author: Daniel Walsh <dwalsh@redhat.com>
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of the GNU General Public License as
@@ -26,7 +26,6 @@ import subprocess
 import sys
 import os
 import pwd
-import string
 import getopt
 import selinux
 import seobject
@@ -41,7 +40,7 @@ try:
                     localedir="/usr/share/locale",
                     codeset='utf-8',
                     **kwargs)
-except:
+except ImportError:
     try:
         import builtins
         builtins.__dict__['_'] = str
@@ -101,7 +100,7 @@ def chcat_user_add(newcat, users):
             cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
         try:
             subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-        except subprocess.CalledProcessError as e:
+        except subprocess.CalledProcessError:
             errors += 1
 
     return errors
@@ -141,7 +140,7 @@ def chcat_add(orig, newcat, objects, login_ind):
         cmd = ["chcon", "-l", "%s:%s" % (sensitivity, cat_string), f]
         try:
             subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-        except subprocess.CalledProcessError as e:
+        except subprocess.CalledProcessError:
             errors += 1
     return errors
 
@@ -183,7 +182,7 @@ def chcat_user_remove(newcat, users):
 
         try:
             subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-        except subprocess.CalledProcessError as e:
+        except subprocess.CalledProcessError:
             errors += 1
 
     return errors
@@ -231,7 +230,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
         cmd = ["chcon", "-l", new_serange, f]
         try:
             subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-        except subprocess.CalledProcessError as e:
+        except subprocess.CalledProcessError:
             errors += 1
     return errors
 
@@ -259,7 +258,7 @@ def chcat_user_replace(newcat, users):
             cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
         try:
             subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-        except subprocess.CalledProcessError as e:
+        except subprocess.CalledProcessError:
             errors += 1
     return errors
 
@@ -268,6 +267,7 @@ def chcat_replace(newcat, objects, login_ind):
     if login_ind == 1:
         return chcat_user_replace(newcat, objects)
     errors = 0
+    # newcat[0] is the sensitivity level, newcat[1:] are the categories
     if len(newcat) == 1:
         new_serange = newcat[0]
     else:
@@ -278,7 +278,7 @@ def chcat_replace(newcat, objects, login_ind):
     cmd = ["chcon", "-l", new_serange] + objects
     try:
         subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
-    except subprocess.CalledProcessError as e:
+    except subprocess.CalledProcessError:
         errors += 1
 
     return errors
@@ -382,7 +382,7 @@ def listusercats(users):
     if len(users) == 0:
         try:
             users.append(os.getlogin())
-        except:
+        except OSError:
             users.append(pwd.getpwuid(os.getuid()).pw_name)
 
     verify_users(users)
@@ -399,6 +399,7 @@ def error(msg):
     print("%s: %s" % (sys.argv[0], msg))
     sys.exit(1)
 
+
 if __name__ == '__main__':
     if selinux.is_selinux_mls_enabled() != 1:
         error("Requires a mls enabled system")
@@ -433,7 +434,7 @@ if __name__ == '__main__':
     except getopt.error as error:
         errorExit(_("Options Error %s ") % error.msg)
 
-    except ValueError as e:
+    except ValueError:
         usage()
 
     if delete_ind:
-- 
2.19.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
  2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
@ 2018-12-09 14:23 ` Nicolas Iooss
  2018-12-11  9:56   ` Petr Lautrbach
  2018-12-11  9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
  1 sibling, 1 reply; 5+ messages in thread
From: Nicolas Iooss @ 2018-12-09 14:23 UTC (permalink / raw)
  To: selinux

Using Vagrant with fedora/28-cloud-base image, SELinux logins are
configured this way:

    # semanage login -l
    Login Name           SELinux User         MLS/MCS Range        Service

    __default__          unconfined_u         s0-s0:c0.c1023       *
    root                 unconfined_u         s0-s0:c0.c1023       *
    vagrant              unconfined_u         s0-s0:c0.c1023       *

Using "chcat -l +c42 vagrant" successfully adds the category to user
vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
semanage login -l returns:

    vagrant              unconfined_u         s0-s0:c0.c1023,c42   *

This issue is caused by expandCats(), which refuses to return a list of
more than 25 categories. This causes chcat_user_remove() to work with
cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
it not been able to remove 'c42' from the list.

Fix this issue by splitting the list of categories before calling
expandCats().

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
 python/chcat/chcat | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/python/chcat/chcat b/python/chcat/chcat
index 73f757258807..5bef0073b7a4 100755
--- a/python/chcat/chcat
+++ b/python/chcat/chcat
@@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
         if len(serange) > 1:
             top = serange[1].split(":")
             if len(top) > 1:
-                cats.append(top[1])
-                cats = expandCats(cats)
+                cats = expandCats(top[1].split(','))
 
         for i in newcat[1:]:
             if i not in cats:
@@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
         if len(serange) > 1:
             top = serange[1].split(":")
             if len(top) > 1:
-                cats.append(top[1])
-                cats = expandCats(cats)
+                cats = expandCats(top[1].split(','))
 
         for i in newcat[1:]:
             if i in cats:
-- 
2.19.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 1/2] python/chcat: improve the code readability
  2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
  2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
@ 2018-12-11  9:55 ` Petr Lautrbach
  1 sibling, 0 replies; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-11  9:55 UTC (permalink / raw)
  To: selinux; +Cc: Nicolas Iooss

Nicolas Iooss <nicolas.iooss@m4x.org> writes:

> flake8 reports many warnings for chcat:
>
>     chcat:7:1: E265 block comment should start with '# '
>     chcat:29:1: F401 'string' imported but unused
>     chcat:44:1: E722 do not use bare 'except'
>     chcat:104:9: F841 local variable 'e' is assigned to but never used
>     chcat:144:9: F841 local variable 'e' is assigned to but never used
>     chcat:186:9: F841 local variable 'e' is assigned to but never used
>     chcat:234:9: F841 local variable 'e' is assigned to but never used
>     chcat:262:9: F841 local variable 'e' is assigned to but never used
>     chcat:281:5: F841 local variable 'e' is assigned to but never used
>     chcat:385:9: E722 do not use bare 'except'
>     chcat:402:1: E305 expected 2 blank lines after class or function definition, found 1
>     chcat:436:5: F841 local variable 'e' is assigned to but never used
>
> Fix all of them.
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>

Acked-by: Petr Lautrbach <plautrba@redhat.com>


> ---
> This patch needs to be applied after "python/chcat: use check_call instead of getstatusoutput",
> https://lore.kernel.org/selinux/CAJfZ7=k+dNFE7AOO_FJhSMZP7WdvkJf3zbfqeY6kSkabOm+Uag@mail.gmail.com/T/#e720d3de77d336300faf6cc3d8a2940b70c9a169a
>
>  python/chcat/chcat | 23 ++++++++++++-----------
>  1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/python/chcat/chcat b/python/chcat/chcat
> index 1de92306e963..73f757258807 100755
> --- a/python/chcat/chcat
> +++ b/python/chcat/chcat
> @@ -4,7 +4,7 @@
>  #
>  #    chcat is a script that allows you modify the Security label on a file
>  #
> -#`   Author: Daniel Walsh <dwalsh@redhat.com>
> +#    Author: Daniel Walsh <dwalsh@redhat.com>
>  #
>  #    This program is free software; you can redistribute it and/or
>  #    modify it under the terms of the GNU General Public License as
> @@ -26,7 +26,6 @@ import subprocess
>  import sys
>  import os
>  import pwd
> -import string
>  import getopt
>  import selinux
>  import seobject
> @@ -41,7 +40,7 @@ try:
>                      localedir="/usr/share/locale",
>                      codeset='utf-8',
>                      **kwargs)
> -except:
> +except ImportError:
>      try:
>          import builtins
>          builtins.__dict__['_'] = str
> @@ -101,7 +100,7 @@ def chcat_user_add(newcat, users):
>              cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
>          try:
>              subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -        except subprocess.CalledProcessError as e:
> +        except subprocess.CalledProcessError:
>              errors += 1
>  
>      return errors
> @@ -141,7 +140,7 @@ def chcat_add(orig, newcat, objects, login_ind):
>          cmd = ["chcon", "-l", "%s:%s" % (sensitivity, cat_string), f]
>          try:
>              subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -        except subprocess.CalledProcessError as e:
> +        except subprocess.CalledProcessError:
>              errors += 1
>      return errors
>  
> @@ -183,7 +182,7 @@ def chcat_user_remove(newcat, users):
>  
>          try:
>              subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -        except subprocess.CalledProcessError as e:
> +        except subprocess.CalledProcessError:
>              errors += 1
>  
>      return errors
> @@ -231,7 +230,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
>          cmd = ["chcon", "-l", new_serange, f]
>          try:
>              subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -        except subprocess.CalledProcessError as e:
> +        except subprocess.CalledProcessError:
>              errors += 1
>      return errors
>  
> @@ -259,7 +258,7 @@ def chcat_user_replace(newcat, users):
>              cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
>          try:
>              subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -        except subprocess.CalledProcessError as e:
> +        except subprocess.CalledProcessError:
>              errors += 1
>      return errors
>  
> @@ -268,6 +267,7 @@ def chcat_replace(newcat, objects, login_ind):
>      if login_ind == 1:
>          return chcat_user_replace(newcat, objects)
>      errors = 0
> +    # newcat[0] is the sensitivity level, newcat[1:] are the categories
>      if len(newcat) == 1:
>          new_serange = newcat[0]
>      else:
> @@ -278,7 +278,7 @@ def chcat_replace(newcat, objects, login_ind):
>      cmd = ["chcon", "-l", new_serange] + objects
>      try:
>          subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> -    except subprocess.CalledProcessError as e:
> +    except subprocess.CalledProcessError:
>          errors += 1
>  
>      return errors
> @@ -382,7 +382,7 @@ def listusercats(users):
>      if len(users) == 0:
>          try:
>              users.append(os.getlogin())
> -        except:
> +        except OSError:
>              users.append(pwd.getpwuid(os.getuid()).pw_name)
>  
>      verify_users(users)
> @@ -399,6 +399,7 @@ def error(msg):
>      print("%s: %s" % (sys.argv[0], msg))
>      sys.exit(1)
>  
> +
>  if __name__ == '__main__':
>      if selinux.is_selinux_mls_enabled() != 1:
>          error("Requires a mls enabled system")
> @@ -433,7 +434,7 @@ if __name__ == '__main__':
>      except getopt.error as error:
>          errorExit(_("Options Error %s ") % error.msg)
>  
> -    except ValueError as e:
> +    except ValueError:
>          usage()
>  
>      if delete_ind:

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
  2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
@ 2018-12-11  9:56   ` Petr Lautrbach
  2018-12-12  9:38     ` Petr Lautrbach
  0 siblings, 1 reply; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-11  9:56 UTC (permalink / raw)
  To: selinux; +Cc: Nicolas Iooss

Nicolas Iooss <nicolas.iooss@m4x.org> writes:

> Using Vagrant with fedora/28-cloud-base image, SELinux logins are
> configured this way:
>
>     # semanage login -l
>     Login Name           SELinux User         MLS/MCS Range        Service
>
>     __default__          unconfined_u         s0-s0:c0.c1023       *
>     root                 unconfined_u         s0-s0:c0.c1023       *
>     vagrant              unconfined_u         s0-s0:c0.c1023       *
>
> Using "chcat -l +c42 vagrant" successfully adds the category to user
> vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
> semanage login -l returns:
>
>     vagrant              unconfined_u         s0-s0:c0.c1023,c42   *
>
> This issue is caused by expandCats(), which refuses to return a list of
> more than 25 categories. This causes chcat_user_remove() to work with
> cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
> it not been able to remove 'c42' from the list.
>
> Fix this issue by splitting the list of categories before calling
> expandCats().
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>

Acked-by: Petr Lautrbach <plautrba@redhat.com>

> ---
>  python/chcat/chcat | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/python/chcat/chcat b/python/chcat/chcat
> index 73f757258807..5bef0073b7a4 100755
> --- a/python/chcat/chcat
> +++ b/python/chcat/chcat
> @@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
>          if len(serange) > 1:
>              top = serange[1].split(":")
>              if len(top) > 1:
> -                cats.append(top[1])
> -                cats = expandCats(cats)
> +                cats = expandCats(top[1].split(','))
>  
>          for i in newcat[1:]:
>              if i not in cats:
> @@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
>          if len(serange) > 1:
>              top = serange[1].split(":")
>              if len(top) > 1:
> -                cats.append(top[1])
> -                cats = expandCats(cats)
> +                cats = expandCats(top[1].split(','))
>  
>          for i in newcat[1:]:
>              if i in cats:

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
  2018-12-11  9:56   ` Petr Lautrbach
@ 2018-12-12  9:38     ` Petr Lautrbach
  0 siblings, 0 replies; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-12  9:38 UTC (permalink / raw)
  To: selinux; +Cc: Nicolas Iooss

Petr Lautrbach <plautrba@redhat.com> writes:

> Nicolas Iooss <nicolas.iooss@m4x.org> writes:
>
>> Using Vagrant with fedora/28-cloud-base image, SELinux logins are
>> configured this way:
>>
>>     # semanage login -l
>>     Login Name           SELinux User         MLS/MCS Range        Service
>>
>>     __default__          unconfined_u         s0-s0:c0.c1023       *
>>     root                 unconfined_u         s0-s0:c0.c1023       *
>>     vagrant              unconfined_u         s0-s0:c0.c1023       *
>>
>> Using "chcat -l +c42 vagrant" successfully adds the category to user
>> vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
>> semanage login -l returns:
>>
>>     vagrant              unconfined_u         s0-s0:c0.c1023,c42   *
>>
>> This issue is caused by expandCats(), which refuses to return a list of
>> more than 25 categories. This causes chcat_user_remove() to work with
>> cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
>> it not been able to remove 'c42' from the list.
>>
>> Fix this issue by splitting the list of categories before calling
>> expandCats().
>>
>> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>

All 3 chcat patches merged. Thanks!


>
>> ---
>>  python/chcat/chcat | 6 ++----
>>  1 file changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/python/chcat/chcat b/python/chcat/chcat
>> index 73f757258807..5bef0073b7a4 100755
>> --- a/python/chcat/chcat
>> +++ b/python/chcat/chcat
>> @@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
>>          if len(serange) > 1:
>>              top = serange[1].split(":")
>>              if len(top) > 1:
>> -                cats.append(top[1])
>> -                cats = expandCats(cats)
>> +                cats = expandCats(top[1].split(','))
>>  
>>          for i in newcat[1:]:
>>              if i not in cats:
>> @@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
>>          if len(serange) > 1:
>>              top = serange[1].split(":")
>>              if len(top) > 1:
>> -                cats.append(top[1])
>> -                cats = expandCats(cats)
>> +                cats = expandCats(top[1].split(','))
>>  
>>          for i in newcat[1:]:
>>              if i in cats:

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
2018-12-11  9:56   ` Petr Lautrbach
2018-12-12  9:38     ` Petr Lautrbach
2018-12-11  9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox