SELinux Archive on
 help / color / Atom feed
* [PATCH] python/semanage: Improve handling of "permissive" statements
@ 2019-09-27 14:13 Vit Mojzis
  0 siblings, 0 replies; only message in thread
From: Vit Mojzis @ 2019-09-27 14:13 UTC (permalink / raw)
  To: selinux

- Add "customized" method to permissiveRecords which is than used for
  "semanage permissive --extract" and "semanage export"
- Enable "semanage permissive --deleteall" (already implemented)
- Add "permissive" to the list of modules exported using
  "semanage export"
- Update "semanage permissive" man page

Signed-off-by: Vit Mojzis <>
 python/semanage/semanage              | 11 ++++++++---
 python/semanage/semanage-permissive.8 |  8 +++++++-
 python/semanage/           |  3 +++
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/python/semanage/semanage b/python/semanage/semanage
index f4266cef..864f9212 100644
--- a/python/semanage/semanage
+++ b/python/semanage/semanage
@@ -737,6 +737,11 @@ def handlePermissive(args):
     if args.action == "list":
+    elif args.action == "deleteall":
+        OBJECT.deleteall()
+    elif args.action == "extract":
+        for i in OBJECT.customized():
+            print("permissive %s" % str(i))
     elif args.type is not None:
         if args.action == "add":
@@ -752,9 +757,9 @@ def setupPermissiveParser(subparsers):
     pgroup = permissiveParser.add_mutually_exclusive_group(required=True)
     parser_add_add(pgroup, "permissive")
     parser_add_delete(pgroup, "permissive")
+    parser_add_deleteall(pgroup, "permissive")
+    parser_add_extract(pgroup, "permissive")
     parser_add_list(pgroup, "permissive")
-    #TODO: probably should be also added => need to implement own option handling
-    #parser_add_deleteall(pgroup)
     parser_add_noheading(permissiveParser, "permissive")
     parser_add_noreload(permissiveParser, "permissive")
@@ -778,7 +783,7 @@ def setupDontauditParser(subparsers):
 def handleExport(args):
-    manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey"]
+    manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey", "permissive"]
     for i in manageditems:
         print("%s -D" % i)
     for i in manageditems:
diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
index 1999a451..5c3364fa 100644
--- a/python/semanage/semanage-permissive.8
+++ b/python/semanage/semanage-permissive.8
@@ -2,7 +2,7 @@
 .B semanage\-permissive \- SELinux Policy Management permissive mapping tool
-.B semanage permissive [\-h] (\-a | \-d | \-l) [\-n] [\-N] [\-S STORE] [type]
+.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
 semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.  semanage permissive adds or removes a SELinux Policy permissive module.
@@ -18,9 +18,15 @@ Add a record of the specified object type
 .I   \-d, \-\-delete
 Delete a record of the specified object type
+.I   \-D, \-\-deleteall
+Remove all local customizations of permissive domains
 .I   \-l, \-\-list
 List records of the specified object type
+.I   \-E, \-\-extract
+Extract customizable commands, for use within a transaction
 .I   \-n, \-\-noheading
 Do not print heading when listing the specified object type
diff --git a/python/semanage/ b/python/semanage/
index 8586567b..5e9e3eb5 100644
--- a/python/semanage/
+++ b/python/semanage/
@@ -478,6 +478,9 @@ class permissiveRecords(semanageRecords):
         return l
+    def customized(self):
+        return ["-a %s" % x for x in sorted(self.get_all())]
     def list(self, heading=1, locallist=0):
         all = [y["name"] for y in [x for x in if x["permissive"]]]
         if len(all) == 0:

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-27 14:13 [PATCH] python/semanage: Improve handling of "permissive" statements Vit Mojzis

SELinux Archive on

Archives are clonable:
	git clone --mirror selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ \
	public-inbox-index selinux

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone