From: Petr Lautrbach <plautrba@redhat.com>
To: selinux@vger.kernel.org
Cc: Nicolas Iooss <nicolas.iooss@m4x.org>
Subject: Re: [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup
Date: Wed, 12 Dec 2018 10:38:52 +0100 [thread overview]
Message-ID: <pjdy38vccer.fsf@redhat.com> (raw)
In-Reply-To: <pjd8t0we697.fsf@redhat.com> (Petr Lautrbach's message of "Tue, 11 Dec 2018 10:56:36 +0100")
Petr Lautrbach <plautrba@redhat.com> writes:
> Nicolas Iooss <nicolas.iooss@m4x.org> writes:
>
>> Using Vagrant with fedora/28-cloud-base image, SELinux logins are
>> configured this way:
>>
>> # semanage login -l
>> Login Name SELinux User MLS/MCS Range Service
>>
>> __default__ unconfined_u s0-s0:c0.c1023 *
>> root unconfined_u s0-s0:c0.c1023 *
>> vagrant unconfined_u s0-s0:c0.c1023 *
>>
>> Using "chcat -l +c42 vagrant" successfully adds the category to user
>> vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
>> semanage login -l returns:
>>
>> vagrant unconfined_u s0-s0:c0.c1023,c42 *
>>
>> This issue is caused by expandCats(), which refuses to return a list of
>> more than 25 categories. This causes chcat_user_remove() to work with
>> cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
>> it not been able to remove 'c42' from the list.
>>
>> Fix this issue by splitting the list of categories before calling
>> expandCats().
>>
>> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>
All 3 chcat patches merged. Thanks!
>
>> ---
>> python/chcat/chcat | 6 ++----
>> 1 file changed, 2 insertions(+), 4 deletions(-)
>>
>> diff --git a/python/chcat/chcat b/python/chcat/chcat
>> index 73f757258807..5bef0073b7a4 100755
>> --- a/python/chcat/chcat
>> +++ b/python/chcat/chcat
>> @@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
>> if len(serange) > 1:
>> top = serange[1].split(":")
>> if len(top) > 1:
>> - cats.append(top[1])
>> - cats = expandCats(cats)
>> + cats = expandCats(top[1].split(','))
>>
>> for i in newcat[1:]:
>> if i not in cats:
>> @@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
>> if len(serange) > 1:
>> top = serange[1].split(":")
>> if len(top) > 1:
>> - cats.append(top[1])
>> - cats = expandCats(cats)
>> + cats = expandCats(top[1].split(','))
>>
>> for i in newcat[1:]:
>> if i in cats:
next prev parent reply other threads:[~2018-12-12 9:38 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-09 14:23 [PATCH 1/2] python/chcat: improve the code readability Nicolas Iooss
2018-12-09 14:23 ` [PATCH 2/2] python/chcat: fix removing categories on users with Fedora default setup Nicolas Iooss
2018-12-11 9:56 ` Petr Lautrbach
2018-12-12 9:38 ` Petr Lautrbach [this message]
2018-12-11 9:55 ` [PATCH 1/2] python/chcat: improve the code readability Petr Lautrbach
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=pjdy38vccer.fsf@redhat.com \
--to=plautrba@redhat.com \
--cc=nicolas.iooss@m4x.org \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).