* [PATCH 1/2] python/chcat: improve the code readability
@ 2018-12-09 14:23 Nicolas Iooss
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
2018-12-11 9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
0 siblings, 2 replies; 5+ messages in thread
From: Nicolas Iooss @ 2018-12-09 14:23 UTC (permalink / raw)
To: selinux
flake8 reports many warnings for chcat:
chcat:7:1: E265 block comment should start with '# '
chcat:29:1: F401 'string' imported but unused
chcat:44:1: E722 do not use bare 'except'
chcat:104:9: F841 local variable 'e' is assigned to but never used
chcat:144:9: F841 local variable 'e' is assigned to but never used
chcat:186:9: F841 local variable 'e' is assigned to but never used
chcat:234:9: F841 local variable 'e' is assigned to but never used
chcat:262:9: F841 local variable 'e' is assigned to but never used
chcat:281:5: F841 local variable 'e' is assigned to but never used
chcat:385:9: E722 do not use bare 'except'
chcat:402:1: E305 expected 2 blank lines after class or function definition, found 1
chcat:436:5: F841 local variable 'e' is assigned to but never used
Fix all of them.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
This patch needs to be applied after "python/chcat: use check_call instead of getstatusoutput",
https://lore.kernel.org/selinux/CAJfZ7=k+dNFE7AOO_FJhSMZP7WdvkJf3zbfqeY6kSkabOm+Uag@mail.gmail.com/T/#e720d3de77d336300faf6cc3d8a2940b70c9a169a
python/chcat/chcat | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/python/chcat/chcat b/python/chcat/chcat
index 1de92306e963..73f757258807 100755
--- a/python/chcat/chcat
+++ b/python/chcat/chcat
@@ -4,7 +4,7 @@
#
# chcat is a script that allows you modify the Security label on a file
#
-#` Author: Daniel Walsh <dwalsh@redhat.com>
+# Author: Daniel Walsh <dwalsh@redhat.com>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
@@ -26,7 +26,6 @@ import subprocess
import sys
import os
import pwd
-import string
import getopt
import selinux
import seobject
@@ -41,7 +40,7 @@ try:
localedir="/usr/share/locale",
codeset='utf-8',
**kwargs)
-except:
+except ImportError:
try:
import builtins
builtins.__dict__['_'] = str
@@ -101,7 +100,7 @@ def chcat_user_add(newcat, users):
cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -141,7 +140,7 @@ def chcat_add(orig, newcat, objects, login_ind):
cmd = ["chcon", "-l", "%s:%s" % (sensitivity, cat_string), f]
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -183,7 +182,7 @@ def chcat_user_remove(newcat, users):
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -231,7 +230,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
cmd = ["chcon", "-l", new_serange, f]
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -259,7 +258,7 @@ def chcat_user_replace(newcat, users):
cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -268,6 +267,7 @@ def chcat_replace(newcat, objects, login_ind):
if login_ind == 1:
return chcat_user_replace(newcat, objects)
errors = 0
+ # newcat[0] is the sensitivity level, newcat[1:] are the categories
if len(newcat) == 1:
new_serange = newcat[0]
else:
@@ -278,7 +278,7 @@ def chcat_replace(newcat, objects, login_ind):
cmd = ["chcon", "-l", new_serange] + objects
try:
subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
- except subprocess.CalledProcessError as e:
+ except subprocess.CalledProcessError:
errors += 1
return errors
@@ -382,7 +382,7 @@ def listusercats(users):
if len(users) == 0:
try:
users.append(os.getlogin())
- except:
+ except OSError:
users.append(pwd.getpwuid(os.getuid()).pw_name)
verify_users(users)
@@ -399,6 +399,7 @@ def error(msg):
print("%s: %s" % (sys.argv[0], msg))
sys.exit(1)
+
if __name__ == '__main__':
if selinux.is_selinux_mls_enabled() != 1:
error("Requires a mls enabled system")
@@ -433,7 +434,7 @@ if __name__ == '__main__':
except getopt.error as error:
errorExit(_("Options Error %s ") % error.msg)
- except ValueError as e:
+ except ValueError:
usage()
if delete_ind:
--
2.19.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
@ 2018-12-09 14:23 ` Nicolas Iooss
2018-12-11 9:56 ` Petr Lautrbach
2018-12-11 9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
1 sibling, 1 reply; 5+ messages in thread
From: Nicolas Iooss @ 2018-12-09 14:23 UTC (permalink / raw)
To: selinux
Using Vagrant with fedora/28-cloud-base image, SELinux logins are
configured this way:
# semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
vagrant unconfined_u s0-s0:c0.c1023 *
Using "chcat -l +c42 vagrant" successfully adds the category to user
vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
semanage login -l returns:
vagrant unconfined_u s0-s0:c0.c1023,c42 *
This issue is caused by expandCats(), which refuses to return a list of
more than 25 categories. This causes chcat_user_remove() to work with
cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
it not been able to remove 'c42' from the list.
Fix this issue by splitting the list of categories before calling
expandCats().
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
python/chcat/chcat | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/python/chcat/chcat b/python/chcat/chcat
index 73f757258807..5bef0073b7a4 100755
--- a/python/chcat/chcat
+++ b/python/chcat/chcat
@@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
if len(serange) > 1:
top = serange[1].split(":")
if len(top) > 1:
- cats.append(top[1])
- cats = expandCats(cats)
+ cats = expandCats(top[1].split(','))
for i in newcat[1:]:
if i not in cats:
@@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
if len(serange) > 1:
top = serange[1].split(":")
if len(top) > 1:
- cats.append(top[1])
- cats = expandCats(cats)
+ cats = expandCats(top[1].split(','))
for i in newcat[1:]:
if i in cats:
--
2.19.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
@ 2018-12-11 9:56 ` Petr Lautrbach
2018-12-12 9:38 ` Petr Lautrbach
0 siblings, 1 reply; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-11 9:56 UTC (permalink / raw)
To: selinux; +Cc: Nicolas Iooss
Nicolas Iooss <nicolas.iooss@m4x.org> writes:
> Using Vagrant with fedora/28-cloud-base image, SELinux logins are
> configured this way:
>
> # semanage login -l
> Login Name SELinux User MLS/MCS Range Service
>
> __default__ unconfined_u s0-s0:c0.c1023 *
> root unconfined_u s0-s0:c0.c1023 *
> vagrant unconfined_u s0-s0:c0.c1023 *
>
> Using "chcat -l +c42 vagrant" successfully adds the category to user
> vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
> semanage login -l returns:
>
> vagrant unconfined_u s0-s0:c0.c1023,c42 *
>
> This issue is caused by expandCats(), which refuses to return a list of
> more than 25 categories. This causes chcat_user_remove() to work with
> cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
> it not been able to remove 'c42' from the list.
>
> Fix this issue by splitting the list of categories before calling
> expandCats().
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
> ---
> python/chcat/chcat | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/python/chcat/chcat b/python/chcat/chcat
> index 73f757258807..5bef0073b7a4 100755
> --- a/python/chcat/chcat
> +++ b/python/chcat/chcat
> @@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
> if len(serange) > 1:
> top = serange[1].split(":")
> if len(top) > 1:
> - cats.append(top[1])
> - cats = expandCats(cats)
> + cats = expandCats(top[1].split(','))
>
> for i in newcat[1:]:
> if i not in cats:
> @@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
> if len(serange) > 1:
> top = serange[1].split(":")
> if len(top) > 1:
> - cats.append(top[1])
> - cats = expandCats(cats)
> + cats = expandCats(top[1].split(','))
>
> for i in newcat[1:]:
> if i in cats:
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
2018-12-11 9:56 ` Petr Lautrbach
@ 2018-12-12 9:38 ` Petr Lautrbach
0 siblings, 0 replies; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-12 9:38 UTC (permalink / raw)
To: selinux; +Cc: Nicolas Iooss
Petr Lautrbach <plautrba@redhat.com> writes:
> Nicolas Iooss <nicolas.iooss@m4x.org> writes:
>
>> Using Vagrant with fedora/28-cloud-base image, SELinux logins are
>> configured this way:
>>
>> # semanage login -l
>> Login Name SELinux User MLS/MCS Range Service
>>
>> __default__ unconfined_u s0-s0:c0.c1023 *
>> root unconfined_u s0-s0:c0.c1023 *
>> vagrant unconfined_u s0-s0:c0.c1023 *
>>
>> Using "chcat -l +c42 vagrant" successfully adds the category to user
>> vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
>> semanage login -l returns:
>>
>> vagrant unconfined_u s0-s0:c0.c1023,c42 *
>>
>> This issue is caused by expandCats(), which refuses to return a list of
>> more than 25 categories. This causes chcat_user_remove() to work with
>> cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
>> it not been able to remove 'c42' from the list.
>>
>> Fix this issue by splitting the list of categories before calling
>> expandCats().
>>
>> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>
All 3 chcat patches merged. Thanks!
>
>> ---
>> python/chcat/chcat | 6 ++----
>> 1 file changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/python/chcat/chcat b/python/chcat/chcat
>> index 73f757258807..5bef0073b7a4 100755
>> --- a/python/chcat/chcat
>> +++ b/python/chcat/chcat
>> @@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
>> if len(serange) > 1:
>> top = serange[1].split(":")
>> if len(top) > 1:
>> - cats.append(top[1])
>> - cats = expandCats(cats)
>> + cats = expandCats(top[1].split(','))
>>
>> for i in newcat[1:]:
>> if i not in cats:
>> @@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
>> if len(serange) > 1:
>> top = serange[1].split(":")
>> if len(top) > 1:
>> - cats.append(top[1])
>> - cats = expandCats(cats)
>> + cats = expandCats(top[1].split(','))
>>
>> for i in newcat[1:]:
>> if i in cats:
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/2] python/chcat: improve the code readability
2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
@ 2018-12-11 9:55 ` Petr Lautrbach
1 sibling, 0 replies; 5+ messages in thread
From: Petr Lautrbach @ 2018-12-11 9:55 UTC (permalink / raw)
To: selinux; +Cc: Nicolas Iooss
Nicolas Iooss <nicolas.iooss@m4x.org> writes:
> flake8 reports many warnings for chcat:
>
> chcat:7:1: E265 block comment should start with '# '
> chcat:29:1: F401 'string' imported but unused
> chcat:44:1: E722 do not use bare 'except'
> chcat:104:9: F841 local variable 'e' is assigned to but never used
> chcat:144:9: F841 local variable 'e' is assigned to but never used
> chcat:186:9: F841 local variable 'e' is assigned to but never used
> chcat:234:9: F841 local variable 'e' is assigned to but never used
> chcat:262:9: F841 local variable 'e' is assigned to but never used
> chcat:281:5: F841 local variable 'e' is assigned to but never used
> chcat:385:9: E722 do not use bare 'except'
> chcat:402:1: E305 expected 2 blank lines after class or function definition, found 1
> chcat:436:5: F841 local variable 'e' is assigned to but never used
>
> Fix all of them.
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
> ---
> This patch needs to be applied after "python/chcat: use check_call instead of getstatusoutput",
> https://lore.kernel.org/selinux/CAJfZ7=k+dNFE7AOO_FJhSMZP7WdvkJf3zbfqeY6kSkabOm+Uag@mail.gmail.com/T/#e720d3de77d336300faf6cc3d8a2940b70c9a169a
>
> python/chcat/chcat | 23 ++++++++++++-----------
> 1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/python/chcat/chcat b/python/chcat/chcat
> index 1de92306e963..73f757258807 100755
> --- a/python/chcat/chcat
> +++ b/python/chcat/chcat
> @@ -4,7 +4,7 @@
> #
> # chcat is a script that allows you modify the Security label on a file
> #
> -#` Author: Daniel Walsh <dwalsh@redhat.com>
> +# Author: Daniel Walsh <dwalsh@redhat.com>
> #
> # This program is free software; you can redistribute it and/or
> # modify it under the terms of the GNU General Public License as
> @@ -26,7 +26,6 @@ import subprocess
> import sys
> import os
> import pwd
> -import string
> import getopt
> import selinux
> import seobject
> @@ -41,7 +40,7 @@ try:
> localedir="/usr/share/locale",
> codeset='utf-8',
> **kwargs)
> -except:
> +except ImportError:
> try:
> import builtins
> builtins.__dict__['_'] = str
> @@ -101,7 +100,7 @@ def chcat_user_add(newcat, users):
> cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
>
> return errors
> @@ -141,7 +140,7 @@ def chcat_add(orig, newcat, objects, login_ind):
> cmd = ["chcon", "-l", "%s:%s" % (sensitivity, cat_string), f]
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
> return errors
>
> @@ -183,7 +182,7 @@ def chcat_user_remove(newcat, users):
>
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
>
> return errors
> @@ -231,7 +230,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
> cmd = ["chcon", "-l", new_serange, f]
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
> return errors
>
> @@ -259,7 +258,7 @@ def chcat_user_replace(newcat, users):
> cmd = ["semanage", "login", "-m", "-r", new_serange, "-s", user[0], u]
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
> return errors
>
> @@ -268,6 +267,7 @@ def chcat_replace(newcat, objects, login_ind):
> if login_ind == 1:
> return chcat_user_replace(newcat, objects)
> errors = 0
> + # newcat[0] is the sensitivity level, newcat[1:] are the categories
> if len(newcat) == 1:
> new_serange = newcat[0]
> else:
> @@ -278,7 +278,7 @@ def chcat_replace(newcat, objects, login_ind):
> cmd = ["chcon", "-l", new_serange] + objects
> try:
> subprocess.check_call(cmd, stderr=subprocess.STDOUT, shell=False)
> - except subprocess.CalledProcessError as e:
> + except subprocess.CalledProcessError:
> errors += 1
>
> return errors
> @@ -382,7 +382,7 @@ def listusercats(users):
> if len(users) == 0:
> try:
> users.append(os.getlogin())
> - except:
> + except OSError:
> users.append(pwd.getpwuid(os.getuid()).pw_name)
>
> verify_users(users)
> @@ -399,6 +399,7 @@ def error(msg):
> print("%s: %s" % (sys.argv[0], msg))
> sys.exit(1)
>
> +
> if __name__ == '__main__':
> if selinux.is_selinux_mls_enabled() != 1:
> error("Requires a mls enabled system")
> @@ -433,7 +434,7 @@ if __name__ == '__main__':
> except getopt.error as error:
> errorExit(_("Options Error %s ") % error.msg)
>
> - except ValueError as e:
> + except ValueError:
> usage()
>
> if delete_ind:
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-12-12 9:38 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
2018-12-11 9:56 ` Petr Lautrbach
2018-12-12 9:38 ` Petr Lautrbach
2018-12-11 9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).