Compare commits
No commits in common. 'c9' and 'c8' have entirely different histories.
@ -1,7 +1,13 @@
|
||||
SOURCES/selinux-3.5.tar.gz
|
||||
SOURCES/selinux-gui.zip
|
||||
SOURCES/selinux-policycoreutils.zip
|
||||
SOURCES/selinux-python.zip
|
||||
SOURCES/selinux-sandbox.zip
|
||||
SOURCES/gui-po.tgz
|
||||
SOURCES/policycoreutils-2.9.tar.gz
|
||||
SOURCES/policycoreutils-po.tgz
|
||||
SOURCES/python-po.tgz
|
||||
SOURCES/restorecond-2.9.tar.gz
|
||||
SOURCES/sandbox-po.tgz
|
||||
SOURCES/selinux-dbus-2.9.tar.gz
|
||||
SOURCES/selinux-gui-2.9.tar.gz
|
||||
SOURCES/selinux-python-2.9.tar.gz
|
||||
SOURCES/selinux-sandbox-2.9.tar.gz
|
||||
SOURCES/semodule-utils-2.9.tar.gz
|
||||
SOURCES/sepolicy-icons.tgz
|
||||
SOURCES/system-config-selinux.png
|
||||
|
||||
@ -1,7 +1,13 @@
|
||||
28e8c0a58e01436b1c931559da3844d5774f8186 SOURCES/selinux-3.5.tar.gz
|
||||
c2957ae26fcabe856439915bc03fb7d25c91b724 SOURCES/selinux-gui.zip
|
||||
8aec9d92a940e35756c4cf66891db7b070e00c5c SOURCES/selinux-policycoreutils.zip
|
||||
6a9a8a86bf4b66b484533e5a5b91acd9f2ba4ed1 SOURCES/selinux-python.zip
|
||||
c9b684345b0b6940afd38d8679e2838ad7ef5ffe SOURCES/selinux-sandbox.zip
|
||||
3f355f8cbfdf7be6f9a8190153090af95d2c7358 SOURCES/gui-po.tgz
|
||||
6e64d9a38fb516738023eb429eef29af5383f443 SOURCES/policycoreutils-2.9.tar.gz
|
||||
51122ae6029657bf762d72bff94bab38890fd1e7 SOURCES/policycoreutils-po.tgz
|
||||
c503e61733af54159d5950bbd9fa8080771ee938 SOURCES/python-po.tgz
|
||||
0a34ef54394972870203832c8ce52d4405bd5330 SOURCES/restorecond-2.9.tar.gz
|
||||
7df1784ab0c6b0823943571d733b856d10a87f76 SOURCES/sandbox-po.tgz
|
||||
8645509cdfc433278c2e4d29ee8f511625c7edcc SOURCES/selinux-dbus-2.9.tar.gz
|
||||
5c155ae47692389d9fabaa154195e7f978f2a3f0 SOURCES/selinux-gui-2.9.tar.gz
|
||||
660e1ab824ef80f7a69f0b70f61e231957fd398e SOURCES/selinux-python-2.9.tar.gz
|
||||
0e208cad193021ad17a445b76b72af3fef8db999 SOURCES/selinux-sandbox-2.9.tar.gz
|
||||
a4414223e60bb664ada4824e54f8d36ab208d599 SOURCES/semodule-utils-2.9.tar.gz
|
||||
d849fa76cc3ef4a26047d8a69fef3a55d2f3097f SOURCES/sepolicy-icons.tgz
|
||||
611a5d497efaddd45ec0dcc3e9b2e5b0f81ebc41 SOURCES/system-config-selinux.png
|
||||
|
||||
@ -0,0 +1,43 @@
|
||||
From c778509dd0ed3b184d720032f31971f975e42973 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 5 Mar 2019 17:38:55 +0100
|
||||
Subject: [PATCH] gui: Install polgengui.py to /usr/bin/selinux-polgengui
|
||||
|
||||
polgengui.py is a standalone gui tool which should be in /usr/bin with other
|
||||
tools.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
gui/Makefile | 2 +-
|
||||
gui/modulesPage.py | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/gui/Makefile b/gui/Makefile
|
||||
index c2f982de..b2375fbf 100644
|
||||
--- a/gui/Makefile
|
||||
+++ b/gui/Makefile
|
||||
@@ -31,7 +31,7 @@ install: all
|
||||
-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||
install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
|
||||
install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
|
||||
- install -m 755 polgengui.py $(DESTDIR)$(SHAREDIR)
|
||||
+ install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
|
||||
install -m 644 $(TARGETS) $(DESTDIR)$(SHAREDIR)
|
||||
install -m 644 system-config-selinux.8 $(DESTDIR)$(MANDIR)/man8
|
||||
install -m 644 selinux-polgengui.8 $(DESTDIR)$(MANDIR)/man8
|
||||
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||
index 34c5d9e3..cb856b2d 100644
|
||||
--- a/gui/modulesPage.py
|
||||
+++ b/gui/modulesPage.py
|
||||
@@ -118,7 +118,7 @@ class modulesPage(semanagePage):
|
||||
|
||||
def new_module(self, args):
|
||||
try:
|
||||
- Popen(["/usr/share/system-config-selinux/polgengui.py"])
|
||||
+ Popen(["selinux-polgengui"])
|
||||
except ValueError as e:
|
||||
self.error(e.args[0])
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
From 04b632e6de14ec0336e14988bf4c2bd581f7308e Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 5 Mar 2019 17:25:00 +0100
|
||||
Subject: [PATCH] gui: Install .desktop files to /usr/share/applications by
|
||||
default
|
||||
|
||||
/usr/share/applications is a standard directory for .desktop files.
|
||||
Installation path can be changed using DESKTOPDIR variable in installation
|
||||
phase, e.g.
|
||||
|
||||
make DESKTOPDIR=/usr/local/share/applications install
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
gui/Makefile | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/gui/Makefile b/gui/Makefile
|
||||
index b2375fbf..ca965c94 100644
|
||||
--- a/gui/Makefile
|
||||
+++ b/gui/Makefile
|
||||
@@ -5,6 +5,7 @@ BINDIR ?= $(PREFIX)/bin
|
||||
SHAREDIR ?= $(PREFIX)/share/system-config-selinux
|
||||
DATADIR ?= $(PREFIX)/share
|
||||
MANDIR ?= $(PREFIX)/share/man
|
||||
+DESKTOPDIR ?= $(PREFIX)/share/applications
|
||||
|
||||
TARGETS= \
|
||||
booleansPage.py \
|
||||
@@ -29,6 +30,7 @@ install: all
|
||||
-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
|
||||
-mkdir -p $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
|
||||
-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||
+ -mkdir -p $(DESTDIR)$(DESKTOPDIR)
|
||||
install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
|
||||
install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
|
||||
install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
|
||||
@@ -44,7 +46,7 @@ install: all
|
||||
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/pixmaps
|
||||
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
|
||||
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/system-config-selinux
|
||||
- install -m 644 *.desktop $(DESTDIR)$(DATADIR)/system-config-selinux
|
||||
+ install -m 644 *.desktop $(DESTDIR)$(DESKTOPDIR)
|
||||
-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
|
||||
install -m 644 sepolicy_256.png $(DESTDIR)$(DATADIR)/pixmaps/sepolicy.png
|
||||
for i in 16 22 32 48 256; do \
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,28 +1,27 @@
|
||||
From f21d5f9316094015c81339d25d69d3dc7150bd8a Mon Sep 17 00:00:00 2001
|
||||
From 9847a26b7f8358432ee4c7019efb3cbad0c162b0 Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||
Date: Mon, 12 May 2014 14:11:22 +0200
|
||||
Subject: [PATCH] If there is no executable we don't want to print a part of
|
||||
STANDARD FILE CONTEXT
|
||||
Content-type: text/plain
|
||||
|
||||
---
|
||||
python/sepolicy/sepolicy/manpage.py | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||
index 7d90ffb5a22f..11809dcede43 100755
|
||||
index 24e311a3..46092be0 100755
|
||||
--- a/python/sepolicy/sepolicy/manpage.py
|
||||
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||
@@ -737,7 +737,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||
@@ -793,7 +793,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||
.PP
|
||||
""" % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
|
||||
|
||||
- self.fd.write(r"""
|
||||
+ if flist_non_exec:
|
||||
+ self.fd.write(r"""
|
||||
+ self.fd.write(r"""
|
||||
.PP
|
||||
.B STANDARD FILE CONTEXT
|
||||
|
||||
--
|
||||
2.39.1
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,169 @@
|
||||
From b2993d464e05291020dbf60fc2948ac152eb0003 Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||
Date: Thu, 19 Feb 2015 17:45:15 +0100
|
||||
Subject: [PATCH] Simplication of sepolicy-manpage web functionality.
|
||||
system_release is no longer hardcoded and it creates only index.html and html
|
||||
man pages in the directory for the system release.
|
||||
|
||||
---
|
||||
python/sepolicy/sepolicy/__init__.py | 25 +++--------
|
||||
python/sepolicy/sepolicy/manpage.py | 65 +++-------------------------
|
||||
2 files changed, 13 insertions(+), 77 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||
index 6aed31bd..88a2b8f6 100644
|
||||
--- a/python/sepolicy/sepolicy/__init__.py
|
||||
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||
@@ -1209,27 +1209,14 @@ def boolean_desc(boolean):
|
||||
|
||||
|
||||
def get_os_version():
|
||||
- os_version = ""
|
||||
- pkg_name = "selinux-policy"
|
||||
+ system_release = ""
|
||||
try:
|
||||
- try:
|
||||
- from commands import getstatusoutput
|
||||
- except ImportError:
|
||||
- from subprocess import getstatusoutput
|
||||
- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name)
|
||||
- if rc == 0:
|
||||
- os_version = output.split(".")[-2]
|
||||
- except:
|
||||
- os_version = ""
|
||||
-
|
||||
- if os_version[0:2] == "fc":
|
||||
- os_version = "Fedora" + os_version[2:]
|
||||
- elif os_version[0:2] == "el":
|
||||
- os_version = "RHEL" + os_version[2:]
|
||||
- else:
|
||||
- os_version = ""
|
||||
+ with open('/etc/system-release') as f:
|
||||
+ system_release = f.readline()
|
||||
+ except IOError:
|
||||
+ system_release = "Misc"
|
||||
|
||||
- return os_version
|
||||
+ return system_release
|
||||
|
||||
|
||||
def reinit():
|
||||
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||
index 46092be0..d60acfaf 100755
|
||||
--- a/python/sepolicy/sepolicy/manpage.py
|
||||
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||
@@ -149,10 +149,6 @@ def prettyprint(f, trim):
|
||||
manpage_domains = []
|
||||
manpage_roles = []
|
||||
|
||||
-fedora_releases = ["Fedora17", "Fedora18"]
|
||||
-rhel_releases = ["RHEL6", "RHEL7"]
|
||||
-
|
||||
-
|
||||
def get_alphabet_manpages(manpage_list):
|
||||
alphabet_manpages = dict.fromkeys(string.ascii_letters, [])
|
||||
for i in string.ascii_letters:
|
||||
@@ -182,7 +178,7 @@ def convert_manpage_to_html(html_manpage, manpage):
|
||||
class HTMLManPages:
|
||||
|
||||
"""
|
||||
- Generate a HHTML Manpages on an given SELinux domains
|
||||
+ Generate a HTML Manpages on an given SELinux domains
|
||||
"""
|
||||
|
||||
def __init__(self, manpage_roles, manpage_domains, path, os_version):
|
||||
@@ -190,9 +186,9 @@ class HTMLManPages:
|
||||
self.manpage_domains = get_alphabet_manpages(manpage_domains)
|
||||
self.os_version = os_version
|
||||
self.old_path = path + "/"
|
||||
- self.new_path = self.old_path + self.os_version + "/"
|
||||
+ self.new_path = self.old_path
|
||||
|
||||
- if self.os_version in fedora_releases or self.os_version in rhel_releases:
|
||||
+ if self.os_version:
|
||||
self.__gen_html_manpages()
|
||||
else:
|
||||
print("SELinux HTML man pages can not be generated for this %s" % os_version)
|
||||
@@ -201,7 +197,6 @@ class HTMLManPages:
|
||||
def __gen_html_manpages(self):
|
||||
self._write_html_manpage()
|
||||
self._gen_index()
|
||||
- self._gen_body()
|
||||
self._gen_css()
|
||||
|
||||
def _write_html_manpage(self):
|
||||
@@ -219,67 +214,21 @@ class HTMLManPages:
|
||||
convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r)
|
||||
|
||||
def _gen_index(self):
|
||||
- index = self.old_path + "index.html"
|
||||
- fd = open(index, 'w')
|
||||
- fd.write("""
|
||||
-<html>
|
||||
-<head>
|
||||
- <link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||
- <title>SELinux man pages online</title>
|
||||
-</head>
|
||||
-<body>
|
||||
-<h1>SELinux man pages</h1>
|
||||
-<br></br>
|
||||
-Fedora or Red Hat Enterprise Linux Man Pages.</h2>
|
||||
-<br></br>
|
||||
-<hr>
|
||||
-<h3>Fedora</h3>
|
||||
-<table><tr>
|
||||
-<td valign="middle">
|
||||
-</td>
|
||||
-</tr></table>
|
||||
-<pre>
|
||||
-""")
|
||||
- for f in fedora_releases:
|
||||
- fd.write("""
|
||||
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (f, f, f, f))
|
||||
-
|
||||
- fd.write("""
|
||||
-</pre>
|
||||
-<hr>
|
||||
-<h3>RHEL</h3>
|
||||
-<table><tr>
|
||||
-<td valign="middle">
|
||||
-</td>
|
||||
-</tr></table>
|
||||
-<pre>
|
||||
-""")
|
||||
- for r in rhel_releases:
|
||||
- fd.write("""
|
||||
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (r, r, r, r))
|
||||
-
|
||||
- fd.write("""
|
||||
-</pre>
|
||||
- """)
|
||||
- fd.close()
|
||||
- print("%s has been created" % index)
|
||||
-
|
||||
- def _gen_body(self):
|
||||
html = self.new_path + self.os_version + ".html"
|
||||
fd = open(html, 'w')
|
||||
fd.write("""
|
||||
<html>
|
||||
<head>
|
||||
- <link rel=stylesheet type="text/css" href="../style.css" title="style">
|
||||
- <title>Linux man-pages online for Fedora18</title>
|
||||
+ <link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||
+ <title>SELinux man pages online</title>
|
||||
</head>
|
||||
<body>
|
||||
-<h1>SELinux man pages for Fedora18</h1>
|
||||
+<h1>SELinux man pages for %s</h1>
|
||||
<hr>
|
||||
<table><tr>
|
||||
<td valign="middle">
|
||||
<h3>SELinux roles</h3>
|
||||
-""")
|
||||
+""" % self.os_version)
|
||||
for letter in self.manpage_roles:
|
||||
if len(self.manpage_roles[letter]):
|
||||
fd.write("""
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,26 @@
|
||||
From bfcb599d9424ef6ffcd250931c89675b451edd00 Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||
Date: Fri, 20 Feb 2015 16:42:01 +0100
|
||||
Subject: [PATCH] We want to remove the trailing newline for
|
||||
/etc/system_release.
|
||||
|
||||
---
|
||||
python/sepolicy/sepolicy/__init__.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||
index 88a2b8f6..0c66f4d5 100644
|
||||
--- a/python/sepolicy/sepolicy/__init__.py
|
||||
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||
@@ -1212,7 +1212,7 @@ def get_os_version():
|
||||
system_release = ""
|
||||
try:
|
||||
with open('/etc/system-release') as f:
|
||||
- system_release = f.readline()
|
||||
+ system_release = f.readline().rstrip()
|
||||
except IOError:
|
||||
system_release = "Misc"
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,25 @@
|
||||
From 4ea504acce6389c3e28134c4b8e6bf9072c295ce Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||
Date: Fri, 20 Feb 2015 16:42:53 +0100
|
||||
Subject: [PATCH] Fix title in manpage.py to not contain 'online'.
|
||||
|
||||
---
|
||||
python/sepolicy/sepolicy/manpage.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||
index d60acfaf..de8184d8 100755
|
||||
--- a/python/sepolicy/sepolicy/manpage.py
|
||||
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||
@@ -220,7 +220,7 @@ class HTMLManPages:
|
||||
<html>
|
||||
<head>
|
||||
<link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||
- <title>SELinux man pages online</title>
|
||||
+ <title>SELinux man pages</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>SELinux man pages for %s</h1>
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,75 +0,0 @@
|
||||
From 09ad91e1fb8640e48cef895ead49d9c770016915 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 4 May 2023 14:04:47 +0200
|
||||
Subject: [PATCH] python/chcat: Improve man pages
|
||||
Content-type: text/plain
|
||||
|
||||
- Explain applying range/list of categories
|
||||
- "-d" removes all categories of given file/user
|
||||
- Add examples
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
python/chcat/chcat.8 | 23 ++++++++++++++++-------
|
||||
1 file changed, 16 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/python/chcat/chcat.8 b/python/chcat/chcat.8
|
||||
index d095a2558d3a..3e1f7ca23361 100644
|
||||
--- a/python/chcat/chcat.8
|
||||
+++ b/python/chcat/chcat.8
|
||||
@@ -1,6 +1,6 @@
|
||||
.TH CHCAT "8" "September 2005" "chcat" "User Commands"
|
||||
.SH NAME
|
||||
-chcat \- change file SELinux security category
|
||||
+chcat \- change SELinux security categories of files/users
|
||||
.SH SYNOPSIS
|
||||
.B chcat
|
||||
\fIcategory file\fR...
|
||||
@@ -25,23 +25,33 @@ chcat \- change file SELinux security category
|
||||
.br
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
-Change/Remove the security \fIcategory\fR for each \fIfile\fR or \fIuser\fR.
|
||||
-.PP
|
||||
-Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR.
|
||||
+Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR (only a single category can be specified at a time). Or specify the desired list/range of categories to be applied (replacing the existing categories).
|
||||
.PP
|
||||
.B
|
||||
Note:
|
||||
-When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead.
|
||||
+When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead.
|
||||
|
||||
.TP
|
||||
\fB\-d\fR
|
||||
-delete the category from each FILE/USER.
|
||||
+delete all categories from given FILE/USER.
|
||||
.TP
|
||||
\fB\-L\fR
|
||||
list available categories.
|
||||
.TP
|
||||
\fB\-l\fR
|
||||
Tells chcat to operate on users instead of files.
|
||||
+
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Replace categories of user "test" with c0.c6
|
||||
+# chcat -l c0.c6 test
|
||||
+Add category c1023 to user "test"
|
||||
+# chcat -l +c1023 test
|
||||
+Remove category c5 from file "file"
|
||||
+# chcat -- -c5 file
|
||||
+Remove all categories from file "file"
|
||||
+# chcat -d file
|
||||
+
|
||||
.SH "SEE ALSO"
|
||||
.TP
|
||||
chcon(1), selinux(8), semanage(8)
|
||||
@@ -52,4 +62,3 @@ When operating on files this script wraps the chcon command.
|
||||
/etc/selinux/{SELINUXTYPE}/setrans.conf
|
||||
.br
|
||||
/etc/selinux/{SELINUXTYPE}/seusers
|
||||
-
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,80 +0,0 @@
|
||||
From b67240b8663c3df471e8ce06b087ec7fb8b9d57c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 4 May 2023 14:04:48 +0200
|
||||
Subject: [PATCH] python/audit2allow: Add missing options to man page
|
||||
Content-type: text/plain
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/audit2allow/audit2allow.1 | 24 +++++++++++++++++++-----
|
||||
1 file changed, 19 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/python/audit2allow/audit2allow.1 b/python/audit2allow/audit2allow.1
|
||||
index 04ec32398011..c31021d39489 100644
|
||||
--- a/python/audit2allow/audit2allow.1
|
||||
+++ b/python/audit2allow/audit2allow.1
|
||||
@@ -40,10 +40,10 @@
|
||||
Read input from audit and message log, conflicts with \-i
|
||||
.TP
|
||||
.B "\-b" | "\-\-boot"
|
||||
-Read input from audit messages since last boot conflicts with \-i
|
||||
+Read input from audit messages since last boot, conflicts with \-i
|
||||
.TP
|
||||
.B "\-d" | "\-\-dmesg"
|
||||
-Read input from output of
|
||||
+Read input from output of
|
||||
.I /bin/dmesg.
|
||||
Note that all audit messages are not available via dmesg when
|
||||
auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead.
|
||||
@@ -51,15 +51,22 @@ auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead.
|
||||
.B "\-D" | "\-\-dontaudit"
|
||||
Generate dontaudit rules (Default: allow)
|
||||
.TP
|
||||
+.B "\-e" | "\-\-explain"
|
||||
+Fully explain generated output
|
||||
+.TP
|
||||
.B "\-h" | "\-\-help"
|
||||
Print a short usage message
|
||||
.TP
|
||||
.B "\-i <inputfile>" | "\-\-input <inputfile>"
|
||||
-read input from
|
||||
+Read input from
|
||||
.I <inputfile>
|
||||
.TP
|
||||
+.B "\-\-interface-info=<interface_info_file>"
|
||||
+Read interface information from
|
||||
+.I <interface_info_file>
|
||||
+.TP
|
||||
.B "\-l" | "\-\-lastreload"
|
||||
-read input only after last policy reload
|
||||
+Read input only after last policy reload
|
||||
.TP
|
||||
.B "\-m <modulename>" | "\-\-module <modulename>"
|
||||
Generate module/require output <modulename>
|
||||
@@ -70,8 +77,12 @@ Generate loadable module package, conflicts with \-o
|
||||
.B "\-p <policyfile>" | "\-\-policy <policyfile>"
|
||||
Policy file to use for analysis
|
||||
.TP
|
||||
+.B "\-\-perm-map <perm_map_file>"
|
||||
+Read permission map from
|
||||
+.I <perm_map_file>
|
||||
+.TP
|
||||
.B "\-o <outputfile>" | "\-\-output <outputfile>"
|
||||
-append output to
|
||||
+Append output to
|
||||
.I <outputfile>
|
||||
.TP
|
||||
.B "\-r" | "\-\-requires"
|
||||
@@ -85,6 +96,9 @@ This is the default behavior.
|
||||
Generate reference policy using installed macros.
|
||||
This attempts to match denials against interfaces and may be inaccurate.
|
||||
.TP
|
||||
+.B "\-t <type_regex>" | "\-\-type=<type_regex>"
|
||||
+Only process messages with a type that matches this regex
|
||||
+.TP
|
||||
.B "\-x" | "\-\-xperms"
|
||||
Generate extended permission access vector rules
|
||||
.TP
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,465 +0,0 @@
|
||||
From 4ebc1057f6e5494909045bbcc7ea8896bd32a094 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 4 May 2023 14:04:49 +0200
|
||||
Subject: [PATCH] python/semanage: Improve man pages
|
||||
Content-type: text/plain
|
||||
|
||||
- Add missing options
|
||||
- Add more examples
|
||||
- Note special cases
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/semanage-boolean.8 | 9 ++++++---
|
||||
python/semanage/semanage-dontaudit.8 | 8 +++++---
|
||||
python/semanage/semanage-export.8 | 10 +++++++++-
|
||||
python/semanage/semanage-fcontext.8 | 17 +++++++++++------
|
||||
python/semanage/semanage-ibendport.8 | 6 ++++--
|
||||
python/semanage/semanage-ibpkey.8 | 6 ++++--
|
||||
python/semanage/semanage-import.8 | 10 +++++++++-
|
||||
python/semanage/semanage-interface.8 | 8 ++++++--
|
||||
python/semanage/semanage-login.8 | 14 ++++++++------
|
||||
python/semanage/semanage-module.8 | 15 ++++++++++-----
|
||||
python/semanage/semanage-node.8 | 16 +++++++++++++---
|
||||
python/semanage/semanage-permissive.8 | 8 +++++---
|
||||
python/semanage/semanage-port.8 | 10 ++++++----
|
||||
python/semanage/semanage-user.8 | 8 +++++---
|
||||
14 files changed, 101 insertions(+), 44 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage-boolean.8 b/python/semanage/semanage-boolean.8
|
||||
index 1282d10626ff..3b664023d3fe 100644
|
||||
--- a/python/semanage/semanage-boolean.8
|
||||
+++ b/python/semanage/semanage-boolean.8
|
||||
@@ -7,11 +7,14 @@ semanage\-boolean \- SELinux Policy Management boolean tool
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.
|
||||
+from policy sources.
|
||||
+.B semanage boolean
|
||||
+command controls the settings of booleans in SELinux policy. Booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain.
|
||||
+
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -45,7 +48,7 @@ Disable the boolean
|
||||
|
||||
.SH EXAMPLE
|
||||
.nf
|
||||
-Turn on the apache can send mail boolean
|
||||
+Turn on the "apache can send mail" boolean (persistent version of #setsebool httpd_can_sendmail on)
|
||||
# semanage boolean \-m \-\-on httpd_can_sendmail
|
||||
|
||||
List customized booleans
|
||||
diff --git a/python/semanage/semanage-dontaudit.8 b/python/semanage/semanage-dontaudit.8
|
||||
index 81accc6f83de..51d1f4b6b0e0 100644
|
||||
--- a/python/semanage/semanage-dontaudit.8
|
||||
+++ b/python/semanage/semanage-dontaudit.8
|
||||
@@ -7,13 +7,15 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause
|
||||
-confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Some times dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turning off dontaudit rules with this command to see if the kernel is blocking an access.
|
||||
+from policy sources.
|
||||
+.B semanage dontaudit
|
||||
+toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause
|
||||
+confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Sometimes dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turn off dontaudit rules with this command to see if the kernel is blocking an access.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-S STORE, \-\-store STORE
|
||||
Select an alternate SELinux Policy Store to manage
|
||||
diff --git a/python/semanage/semanage-export.8 b/python/semanage/semanage-export.8
|
||||
index d422683bd5c8..5198479306df 100644
|
||||
--- a/python/semanage/semanage-export.8
|
||||
+++ b/python/semanage/semanage-export.8
|
||||
@@ -7,7 +7,15 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
|
||||
+from policy sources.
|
||||
+.B semanage import
|
||||
+and
|
||||
+.B export
|
||||
+can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using
|
||||
+.B semanage export
|
||||
+start with
|
||||
+.I <command> -D
|
||||
+for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
|
||||
index 1ebf085faed8..3e327d88d146 100644
|
||||
--- a/python/semanage/semanage-fcontext.8
|
||||
+++ b/python/semanage/semanage-fcontext.8
|
||||
@@ -8,8 +8,10 @@ semanage\-fcontext \- SELinux Policy Management file context tool
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage fcontext is used to manage the default
|
||||
-file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.
|
||||
+from policy sources.
|
||||
+.B semanage fcontext
|
||||
+is used to manage the default file system labeling on an SELinux system.
|
||||
+This command maps file paths using regular expressions to SELinux labels.
|
||||
|
||||
FILE_SPEC may contain either a fully qualified path,
|
||||
or a Perl compatible regular expression (PCRE),
|
||||
@@ -32,7 +34,7 @@ to avoid unintentionally impacting other parts of the filesystem.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -82,12 +84,13 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
|
||||
|
||||
.SH EXAMPLE
|
||||
.nf
|
||||
-.I remember to run restorecon after you set the file context
|
||||
-Add file-context for everything under /web
|
||||
+.I Remember to run restorecon after you set the file context
|
||||
+Add file-context httpd_sys_content_t for everything under /web
|
||||
# semanage fcontext \-a \-t httpd_sys_content_t "/web(/.*)?"
|
||||
# restorecon \-R \-v /web
|
||||
|
||||
Substitute /home1 with /home when setting file context
|
||||
+i.e. label everything under /home1 the same way /home is labeled
|
||||
# semanage fcontext \-a \-e /home /home1
|
||||
# restorecon \-R \-v /home1
|
||||
|
||||
@@ -99,7 +102,9 @@ execute the following commands.
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR selinux (8),
|
||||
-.BR semanage (8)
|
||||
+.BR semanage (8),
|
||||
+.BR restorecon (8),
|
||||
+.BR selabel_file (5)
|
||||
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
diff --git a/python/semanage/semanage-ibendport.8 b/python/semanage/semanage-ibendport.8
|
||||
index 0a29eae18031..53fe4ee8512a 100644
|
||||
--- a/python/semanage/semanage-ibendport.8
|
||||
+++ b/python/semanage/semanage-ibendport.8
|
||||
@@ -5,12 +5,14 @@
|
||||
.B semanage ibendport [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-z IBDEV_NAME \-r RANGE port | \-\-delete \-z IBDEV_NAME port | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-z IBDEV_NAME \-r RANGE port ]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions.
|
||||
+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
|
||||
+.B semanage ibendport
|
||||
+controls the ibendport number to ibendport type definitions.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
diff --git a/python/semanage/semanage-ibpkey.8 b/python/semanage/semanage-ibpkey.8
|
||||
index 51f455abaeab..6cc5e02fbcb6 100644
|
||||
--- a/python/semanage/semanage-ibpkey.8
|
||||
+++ b/python/semanage/semanage-ibpkey.8
|
||||
@@ -5,12 +5,14 @@
|
||||
.B semanage ibpkey [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range | \-\-delete \-x SUBNET_PREFIX ibpkey_name | ibpkey_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range ]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions.
|
||||
+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
|
||||
+.B semanage ibpkey
|
||||
+controls the ibpkey number to ibpkey type definitions.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
diff --git a/python/semanage/semanage-import.8 b/python/semanage/semanage-import.8
|
||||
index 4a9b3e765f34..041e9ab052fb 100644
|
||||
--- a/python/semanage/semanage-import.8
|
||||
+++ b/python/semanage/semanage-import.8
|
||||
@@ -7,7 +7,15 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
|
||||
+from policy sources.
|
||||
+.B semanage import
|
||||
+and
|
||||
+.B export
|
||||
+can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using
|
||||
+.B semanage export
|
||||
+start with
|
||||
+.I <command> -D
|
||||
+for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
diff --git a/python/semanage/semanage-interface.8 b/python/semanage/semanage-interface.8
|
||||
index d9d526dc7391..080db70b6ec2 100644
|
||||
--- a/python/semanage/semanage-interface.8
|
||||
+++ b/python/semanage/semanage-interface.8
|
||||
@@ -7,12 +7,14 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage interface controls the labels assigned to network interfaces.
|
||||
+from policy sources.
|
||||
+.B semanage interface
|
||||
+controls the labels assigned to network interfaces.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -54,6 +56,8 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
|
||||
.nf
|
||||
list all interface definitions
|
||||
# semanage interface \-l
|
||||
+Assign type netif_t and MLS/MCS range s0:c0.c1023 to interface eth0
|
||||
+# semanage interface \-a \-t netif_t \-r s0:c0.c1023 eth0
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR selinux (8),
|
||||
diff --git a/python/semanage/semanage-login.8 b/python/semanage/semanage-login.8
|
||||
index f451bdc65d53..9076a1edcedb 100644
|
||||
--- a/python/semanage/semanage-login.8
|
||||
+++ b/python/semanage/semanage-login.8
|
||||
@@ -7,12 +7,14 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.
|
||||
+from policy sources.
|
||||
+.B semanage login
|
||||
+controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -52,11 +54,11 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma
|
||||
|
||||
.SH EXAMPLE
|
||||
.nf
|
||||
-Modify the default user on the system to the guest_u user
|
||||
+Set the default SELinux user on the system to guest_u
|
||||
# semanage login \-m \-s guest_u __default__
|
||||
-Assign gijoe user on an MLS machine a range and to the staff_u user
|
||||
-# semanage login \-a \-s staff_u \-rSystemLow-Secret gijoe
|
||||
-Assign all users in the engineering group to the staff_u user
|
||||
+Map user gijoe to SELinux user staff_u and assign MLS range SystemLow\-Secret
|
||||
+# semanage login \-a \-s staff_u \-rSystemLow\-Secret gijoe
|
||||
+Map all users in the engineering group to SELinux user staff_u
|
||||
# semanage login \-a \-s staff_u %engineering
|
||||
|
||||
.SH "SEE ALSO"
|
||||
diff --git a/python/semanage/semanage-module.8 b/python/semanage/semanage-module.8
|
||||
index e00571672565..6913b0cd47d9 100644
|
||||
--- a/python/semanage/semanage-module.8
|
||||
+++ b/python/semanage/semanage-module.8
|
||||
@@ -5,12 +5,14 @@
|
||||
.B semanage module [\-h] [\-n] [\-N] [\-S STORE] (\-a | \-r | \-e | \-d | \-\-extract | \-\-list [\-C] | \-\-deleteall) [module_name]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables SELinux Policy modules.
|
||||
+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
|
||||
+.B semanage module
|
||||
+installs, removes, disables, or enables SELinux Policy modules.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -22,11 +24,14 @@ Do not reload policy after commit
|
||||
Select an alternate SELinux Policy Store to manage
|
||||
.TP
|
||||
.I \-a, \-\-add
|
||||
-Install specified module
|
||||
+Install specified module. Accepts both binary policy files (.pp) and CIL source files
|
||||
.TP
|
||||
.I \-r, \-\-remove
|
||||
Remove specified module
|
||||
.TP
|
||||
+.I \-D, \-\-deleteall
|
||||
+Remove all local customizations related to modules
|
||||
+.TP
|
||||
.I \-d \-\-disable
|
||||
Disable specified module
|
||||
.TP
|
||||
@@ -48,8 +53,8 @@ List all modules
|
||||
# semanage module \-l
|
||||
Disable unconfined module
|
||||
# semanage module \-\-disable unconfined
|
||||
-Install custom apache policy module
|
||||
-# semanage module \-a myapache
|
||||
+Install custom apache policy module (same as #semodule -i myapache.pp)
|
||||
+# semanage module \-a myapache.pp
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR selinux (8),
|
||||
diff --git a/python/semanage/semanage-node.8 b/python/semanage/semanage-node.8
|
||||
index a0098221c85b..c78d6c3eaf76 100644
|
||||
--- a/python/semanage/semanage-node.8
|
||||
+++ b/python/semanage/semanage-node.8
|
||||
@@ -7,12 +7,14 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage controls the ipaddress to node type definitions.
|
||||
+from policy sources.
|
||||
+.B semanage node
|
||||
+controls the IP address to node type definitions.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -54,5 +56,13 @@ SELinux type for the object
|
||||
MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0.
|
||||
.TP
|
||||
.I \-p PROTO, \-\-proto PROTO
|
||||
-
|
||||
Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6).
|
||||
+
|
||||
+.SH "EXAMPLE"
|
||||
+.nf
|
||||
+Apply type node_t to ipv4 node 127.0.0.2
|
||||
+# semanage node \-a \-t node_t \-p ipv4 \-M 255.255.255.255 127.0.0.2
|
||||
+
|
||||
+.SH "SEE ALSO"
|
||||
+.BR selinux (8),
|
||||
+.BR semanage (8)
|
||||
diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
|
||||
index 5c3364fa54f8..0414a850082a 100644
|
||||
--- a/python/semanage/semanage-permissive.8
|
||||
+++ b/python/semanage/semanage-permissive.8
|
||||
@@ -5,12 +5,14 @@
|
||||
.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module.
|
||||
+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
|
||||
+.B semanage permissive
|
||||
+adds or removes a SELinux Policy permissive module. Please note that this command can make any domain permissive, but can only remove the permissive property from domains where it was added by semanage permissive ("semanage permissive -d" can only be used on types listed as "Customized Permissive Types" by "semanage permissive -l").
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-a, \-\-add
|
||||
Add a record of the specified object type
|
||||
@@ -38,7 +40,7 @@ Select an alternate SELinux Policy Store to manage
|
||||
|
||||
.SH EXAMPLE
|
||||
.nf
|
||||
-List all permissive modules
|
||||
+List all permissive domains ("Builtin Permissive Types" where set by the system policy, or a custom policy module)
|
||||
# semanage permissive \-l
|
||||
Make httpd_t (Web Server) a permissive domain
|
||||
# semanage permissive \-a httpd_t
|
||||
diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8
|
||||
index 12ec14c2cb33..c6048660ca21 100644
|
||||
--- a/python/semanage/semanage-port.8
|
||||
+++ b/python/semanage/semanage-port.8
|
||||
@@ -5,12 +5,14 @@
|
||||
.B semanage port [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range | \-\-delete \-p PROTOCOL port_name | port_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range ]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage port controls the port number to port type definitions.
|
||||
+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.
|
||||
+.B semanage port
|
||||
+controls the port number to port type definitions.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -55,9 +57,9 @@ Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version
|
||||
.nf
|
||||
List all port definitions
|
||||
# semanage port \-l
|
||||
-Allow Apache to listen on tcp port 81
|
||||
+Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t, which apache is allowed to listen on)
|
||||
# semanage port \-a \-t http_port_t \-p tcp 81
|
||||
-Allow sshd to listen on tcp port 8991
|
||||
+Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on)
|
||||
# semanage port \-a \-t ssh_port_t \-p tcp 8991
|
||||
|
||||
.SH "SEE ALSO"
|
||||
diff --git a/python/semanage/semanage-user.8 b/python/semanage/semanage-user.8
|
||||
index 23fec698e042..50d50bea7af8 100644
|
||||
--- a/python/semanage/semanage-user.8
|
||||
+++ b/python/semanage/semanage-user.8
|
||||
@@ -7,12 +7,14 @@
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of
|
||||
SELinux policy without requiring modification to or recompilation
|
||||
-from policy sources. semanage user controls the mapping between an SELinux User and the roles and MLS/MCS levels.
|
||||
+from policy sources.
|
||||
+.B semanage user
|
||||
+controls the mapping between an SELinux User and the roles and MLS/MCS levels.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
-show this help message and exit
|
||||
+Show this help message and exit
|
||||
.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
@@ -59,7 +61,7 @@ List SELinux users
|
||||
# semanage user \-l
|
||||
Modify groups for staff_u user
|
||||
# semanage user \-m \-R "system_r unconfined_r staff_r" staff_u
|
||||
-Add level for TopSecret Users
|
||||
+Assign user topsecret_u role staff_r and range s0\-TopSecret
|
||||
# semanage user \-a \-R "staff_r" \-rs0\-TopSecret topsecret_u
|
||||
|
||||
.SH "SEE ALSO"
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,53 @@
|
||||
From e54db76a3bff8e911ddd7c7ce834c024d634d9e1 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 28 Feb 2017 21:29:46 +0100
|
||||
Subject: [PATCH] sepolicy: Another small optimization for mcs types
|
||||
|
||||
---
|
||||
python/sepolicy/sepolicy/manpage.py | 16 +++++++++++-----
|
||||
1 file changed, 11 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||
index f8a94fc0..67d39301 100755
|
||||
--- a/python/sepolicy/sepolicy/manpage.py
|
||||
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||
@@ -142,6 +142,15 @@ def _gen_entry_types():
|
||||
entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
|
||||
return entry_types
|
||||
|
||||
+mcs_constrained_types = None
|
||||
+
|
||||
+def _gen_mcs_constrained_types():
|
||||
+ global mcs_constrained_types
|
||||
+ if mcs_constrained_types is None:
|
||||
+ mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
||||
+ return mcs_constrained_types
|
||||
+
|
||||
+
|
||||
types = None
|
||||
|
||||
def _gen_types():
|
||||
@@ -390,6 +399,7 @@ class ManPage:
|
||||
self.types = _gen_types()
|
||||
self.exec_types = _gen_exec_types()
|
||||
self.entry_types = _gen_entry_types()
|
||||
+ self.mcs_constrained_types = _gen_mcs_constrained_types()
|
||||
|
||||
if self.source_files:
|
||||
self.fcpath = self.root + "file_contexts"
|
||||
@@ -944,11 +954,7 @@ All executeables with the default executable label, usually stored in /usr/bin a
|
||||
%s""" % ", ".join(paths))
|
||||
|
||||
def _mcs_types(self):
|
||||
- try:
|
||||
- mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
||||
- except StopIteration:
|
||||
- return
|
||||
- if self.type not in mcs_constrained_type['types']:
|
||||
+ if self.type not in self.mcs_constrained_types['types']:
|
||||
return
|
||||
self.fd.write ("""
|
||||
.SH "MCS Constrained"
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,515 @@
|
||||
From 4015e9299bfda622e9d407cdbcc536000688aa8f Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 6 Aug 2018 13:23:00 +0200
|
||||
Subject: [PATCH] Move po/ translation files into the right sub-directories
|
||||
|
||||
When policycoreutils was split into policycoreutils/ python/ gui/ and sandbox/
|
||||
sub-directories, po/ translation files stayed in policycoreutils/.
|
||||
|
||||
This commit split original policycoreutils/po directory into
|
||||
policycoreutils/po
|
||||
python/po
|
||||
gui/po
|
||||
sandbox/po
|
||||
|
||||
See https://github.com/fedora-selinux/selinux/issues/43
|
||||
---
|
||||
gui/Makefile | 3 ++
|
||||
gui/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++
|
||||
gui/po/POTFILES | 17 ++++++++
|
||||
policycoreutils/po/Makefile | 70 ++-----------------------------
|
||||
policycoreutils/po/POTFILES | 9 ++++
|
||||
python/Makefile | 2 +-
|
||||
python/po/Makefile | 83 +++++++++++++++++++++++++++++++++++++
|
||||
python/po/POTFILES | 10 +++++
|
||||
sandbox/Makefile | 2 +
|
||||
sandbox/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++
|
||||
sandbox/po/POTFILES | 1 +
|
||||
11 files changed, 293 insertions(+), 68 deletions(-)
|
||||
create mode 100644 gui/po/Makefile
|
||||
create mode 100644 gui/po/POTFILES
|
||||
create mode 100644 policycoreutils/po/POTFILES
|
||||
create mode 100644 python/po/Makefile
|
||||
create mode 100644 python/po/POTFILES
|
||||
create mode 100644 sandbox/po/Makefile
|
||||
create mode 100644 sandbox/po/POTFILES
|
||||
|
||||
diff --git a/gui/Makefile b/gui/Makefile
|
||||
index ca965c94..5a5bf6dc 100644
|
||||
--- a/gui/Makefile
|
||||
+++ b/gui/Makefile
|
||||
@@ -22,6 +22,7 @@ system-config-selinux.ui \
|
||||
usersPage.py
|
||||
|
||||
all: $(TARGETS) system-config-selinux.py polgengui.py
|
||||
+ (cd po && $(MAKE) $@)
|
||||
|
||||
install: all
|
||||
-mkdir -p $(DESTDIR)$(MANDIR)/man8
|
||||
@@ -54,6 +55,8 @@ install: all
|
||||
install -m 644 sepolicy_$${i}.png $(DESTDIR)$(DATADIR)/icons/hicolor/$${i}x$${i}/apps/sepolicy.png; \
|
||||
done
|
||||
install -m 644 org.selinux.config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||
+ (cd po && $(MAKE) $@)
|
||||
+
|
||||
clean:
|
||||
|
||||
indent:
|
||||
diff --git a/gui/po/Makefile b/gui/po/Makefile
|
||||
new file mode 100644
|
||||
index 00000000..a0f5439f
|
||||
--- /dev/null
|
||||
+++ b/gui/po/Makefile
|
||||
@@ -0,0 +1,82 @@
|
||||
+#
|
||||
+# Makefile for the PO files (translation) catalog
|
||||
+#
|
||||
+
|
||||
+PREFIX ?= /usr
|
||||
+
|
||||
+# What is this package?
|
||||
+NLSPACKAGE = gui
|
||||
+POTFILE = $(NLSPACKAGE).pot
|
||||
+INSTALL = /usr/bin/install -c -p
|
||||
+INSTALL_DATA = $(INSTALL) -m 644
|
||||
+INSTALL_DIR = /usr/bin/install -d
|
||||
+
|
||||
+# destination directory
|
||||
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||
+
|
||||
+# PO catalog handling
|
||||
+MSGMERGE = msgmerge
|
||||
+MSGMERGE_FLAGS = -q
|
||||
+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE)
|
||||
+MSGFMT = msgfmt
|
||||
+
|
||||
+# All possible linguas
|
||||
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||
+
|
||||
+# Only the files matching what the user has set in LINGUAS
|
||||
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||
+
|
||||
+# if no valid LINGUAS, build all languages
|
||||
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||
+
|
||||
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||
+POTFILES = $(shell cat POTFILES)
|
||||
+
|
||||
+#default:: clean
|
||||
+
|
||||
+all:: $(MOFILES)
|
||||
+
|
||||
+$(POTFILE): $(POTFILES)
|
||||
+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||
+ rm -f $(NLSPACKAGE).po; \
|
||||
+ else \
|
||||
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||
+ fi; \
|
||||
+
|
||||
+
|
||||
+refresh-po: Makefile
|
||||
+ for cat in $(POFILES); do \
|
||||
+ lang=`basename $$cat .po`; \
|
||||
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||
+ mv -f $$lang.pot $$lang.po ; \
|
||||
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||
+ else \
|
||||
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||
+ rm -f $$lang.pot ; \
|
||||
+ fi \
|
||||
+ done
|
||||
+
|
||||
+clean:
|
||||
+ @rm -fv *mo *~ .depend
|
||||
+ @rm -rf tmp
|
||||
+
|
||||
+install: $(MOFILES)
|
||||
+ @for n in $(MOFILES); do \
|
||||
+ l=`basename $$n .mo`; \
|
||||
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||
+ done
|
||||
+
|
||||
+%.mo: %.po
|
||||
+ $(MSGFMT) -o $@ $<
|
||||
+report:
|
||||
+ @for cat in $(wildcard *.po); do \
|
||||
+ echo -n "$$cat: "; \
|
||||
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||
+ done
|
||||
+
|
||||
+.PHONY: missing depend
|
||||
+
|
||||
+relabel:
|
||||
diff --git a/gui/po/POTFILES b/gui/po/POTFILES
|
||||
new file mode 100644
|
||||
index 00000000..1795c5c1
|
||||
--- /dev/null
|
||||
+++ b/gui/po/POTFILES
|
||||
@@ -0,0 +1,17 @@
|
||||
+../booleansPage.py
|
||||
+../domainsPage.py
|
||||
+../fcontextPage.py
|
||||
+../loginsPage.py
|
||||
+../modulesPage.py
|
||||
+../org.selinux.config.policy
|
||||
+../polgengui.py
|
||||
+../polgen.ui
|
||||
+../portsPage.py
|
||||
+../selinux-polgengui.desktop
|
||||
+../semanagePage.py
|
||||
+../sepolicy.desktop
|
||||
+../statusPage.py
|
||||
+../system-config-selinux.desktop
|
||||
+../system-config-selinux.py
|
||||
+../system-config-selinux.ui
|
||||
+../usersPage.py
|
||||
diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile
|
||||
index 575e1431..18bc1dff 100644
|
||||
--- a/policycoreutils/po/Makefile
|
||||
+++ b/policycoreutils/po/Makefile
|
||||
@@ -3,7 +3,6 @@
|
||||
#
|
||||
|
||||
PREFIX ?= /usr
|
||||
-TOP = ../..
|
||||
|
||||
# What is this package?
|
||||
NLSPACKAGE = policycoreutils
|
||||
@@ -32,74 +31,13 @@ USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||
|
||||
POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||
MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||
-POTFILES = \
|
||||
- ../run_init/open_init_pty.c \
|
||||
- ../run_init/run_init.c \
|
||||
- ../semodule_link/semodule_link.c \
|
||||
- ../audit2allow/audit2allow \
|
||||
- ../semanage/seobject.py \
|
||||
- ../setsebool/setsebool.c \
|
||||
- ../newrole/newrole.c \
|
||||
- ../load_policy/load_policy.c \
|
||||
- ../sestatus/sestatus.c \
|
||||
- ../semodule/semodule.c \
|
||||
- ../setfiles/setfiles.c \
|
||||
- ../semodule_package/semodule_package.c \
|
||||
- ../semodule_deps/semodule_deps.c \
|
||||
- ../semodule_expand/semodule_expand.c \
|
||||
- ../scripts/chcat \
|
||||
- ../scripts/fixfiles \
|
||||
- ../restorecond/stringslist.c \
|
||||
- ../restorecond/restorecond.h \
|
||||
- ../restorecond/utmpwatcher.h \
|
||||
- ../restorecond/stringslist.h \
|
||||
- ../restorecond/restorecond.c \
|
||||
- ../restorecond/utmpwatcher.c \
|
||||
- ../gui/booleansPage.py \
|
||||
- ../gui/fcontextPage.py \
|
||||
- ../gui/loginsPage.py \
|
||||
- ../gui/mappingsPage.py \
|
||||
- ../gui/modulesPage.py \
|
||||
- ../gui/polgen.glade \
|
||||
- ../gui/polgengui.py \
|
||||
- ../gui/portsPage.py \
|
||||
- ../gui/semanagePage.py \
|
||||
- ../gui/statusPage.py \
|
||||
- ../gui/system-config-selinux.glade \
|
||||
- ../gui/system-config-selinux.py \
|
||||
- ../gui/usersPage.py \
|
||||
- ../secon/secon.c \
|
||||
- booleans.py \
|
||||
- ../sepolicy/sepolicy.py \
|
||||
- ../sepolicy/sepolicy/communicate.py \
|
||||
- ../sepolicy/sepolicy/__init__.py \
|
||||
- ../sepolicy/sepolicy/network.py \
|
||||
- ../sepolicy/sepolicy/generate.py \
|
||||
- ../sepolicy/sepolicy/sepolicy.glade \
|
||||
- ../sepolicy/sepolicy/gui.py \
|
||||
- ../sepolicy/sepolicy/manpage.py \
|
||||
- ../sepolicy/sepolicy/transition.py \
|
||||
- ../sepolicy/sepolicy/templates/executable.py \
|
||||
- ../sepolicy/sepolicy/templates/__init__.py \
|
||||
- ../sepolicy/sepolicy/templates/network.py \
|
||||
- ../sepolicy/sepolicy/templates/rw.py \
|
||||
- ../sepolicy/sepolicy/templates/script.py \
|
||||
- ../sepolicy/sepolicy/templates/semodule.py \
|
||||
- ../sepolicy/sepolicy/templates/tmp.py \
|
||||
- ../sepolicy/sepolicy/templates/user.py \
|
||||
- ../sepolicy/sepolicy/templates/var_lib.py \
|
||||
- ../sepolicy/sepolicy/templates/var_log.py \
|
||||
- ../sepolicy/sepolicy/templates/var_run.py \
|
||||
- ../sepolicy/sepolicy/templates/var_spool.py
|
||||
+POTFILES = $(shell cat POTFILES)
|
||||
|
||||
#default:: clean
|
||||
|
||||
-all:: $(MOFILES)
|
||||
+all:: $(POTFILE) $(MOFILES)
|
||||
|
||||
-booleans.py:
|
||||
- sepolicy booleans -a > booleans.py
|
||||
-
|
||||
-$(POTFILE): $(POTFILES) booleans.py
|
||||
+$(POTFILE): $(POTFILES)
|
||||
$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||
@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||
rm -f $(NLSPACKAGE).po; \
|
||||
@@ -107,8 +45,6 @@ $(POTFILE): $(POTFILES) booleans.py
|
||||
mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||
fi; \
|
||||
|
||||
-update-po: Makefile $(POTFILE) refresh-po
|
||||
- @rm -f booleans.py
|
||||
|
||||
refresh-po: Makefile
|
||||
for cat in $(POFILES); do \
|
||||
diff --git a/policycoreutils/po/POTFILES b/policycoreutils/po/POTFILES
|
||||
new file mode 100644
|
||||
index 00000000..12237dc6
|
||||
--- /dev/null
|
||||
+++ b/policycoreutils/po/POTFILES
|
||||
@@ -0,0 +1,9 @@
|
||||
+../run_init/open_init_pty.c
|
||||
+../run_init/run_init.c
|
||||
+../setsebool/setsebool.c
|
||||
+../newrole/newrole.c
|
||||
+../load_policy/load_policy.c
|
||||
+../sestatus/sestatus.c
|
||||
+../semodule/semodule.c
|
||||
+../setfiles/setfiles.c
|
||||
+../secon/secon.c
|
||||
diff --git a/python/Makefile b/python/Makefile
|
||||
index 9b66d52f..00312dbd 100644
|
||||
--- a/python/Makefile
|
||||
+++ b/python/Makefile
|
||||
@@ -1,4 +1,4 @@
|
||||
-SUBDIRS = sepolicy audit2allow semanage sepolgen chcat
|
||||
+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po
|
||||
|
||||
all install relabel clean indent test:
|
||||
@for subdir in $(SUBDIRS); do \
|
||||
diff --git a/python/po/Makefile b/python/po/Makefile
|
||||
new file mode 100644
|
||||
index 00000000..4e052d5a
|
||||
--- /dev/null
|
||||
+++ b/python/po/Makefile
|
||||
@@ -0,0 +1,83 @@
|
||||
+#
|
||||
+# Makefile for the PO files (translation) catalog
|
||||
+#
|
||||
+
|
||||
+PREFIX ?= /usr
|
||||
+
|
||||
+# What is this package?
|
||||
+NLSPACKAGE = python
|
||||
+POTFILE = $(NLSPACKAGE).pot
|
||||
+INSTALL = /usr/bin/install -c -p
|
||||
+INSTALL_DATA = $(INSTALL) -m 644
|
||||
+INSTALL_DIR = /usr/bin/install -d
|
||||
+
|
||||
+# destination directory
|
||||
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||
+
|
||||
+# PO catalog handling
|
||||
+MSGMERGE = msgmerge
|
||||
+MSGMERGE_FLAGS = -q
|
||||
+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE)
|
||||
+MSGFMT = msgfmt
|
||||
+
|
||||
+# All possible linguas
|
||||
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||
+
|
||||
+# Only the files matching what the user has set in LINGUAS
|
||||
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||
+
|
||||
+# if no valid LINGUAS, build all languages
|
||||
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||
+
|
||||
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||
+POTFILES = $(shell cat POTFILES)
|
||||
+
|
||||
+#default:: clean
|
||||
+
|
||||
+all:: $(MOFILES)
|
||||
+
|
||||
+$(POTFILE): $(POTFILES)
|
||||
+ $(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)
|
||||
+ $(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade
|
||||
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||
+ rm -f $(NLSPACKAGE).po; \
|
||||
+ else \
|
||||
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||
+ fi; \
|
||||
+
|
||||
+
|
||||
+refresh-po: Makefile
|
||||
+ for cat in $(POFILES); do \
|
||||
+ lang=`basename $$cat .po`; \
|
||||
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||
+ mv -f $$lang.pot $$lang.po ; \
|
||||
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||
+ else \
|
||||
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||
+ rm -f $$lang.pot ; \
|
||||
+ fi \
|
||||
+ done
|
||||
+
|
||||
+clean:
|
||||
+ @rm -fv *mo *~ .depend
|
||||
+ @rm -rf tmp
|
||||
+
|
||||
+install: $(MOFILES)
|
||||
+ @for n in $(MOFILES); do \
|
||||
+ l=`basename $$n .mo`; \
|
||||
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||
+ done
|
||||
+
|
||||
+%.mo: %.po
|
||||
+ $(MSGFMT) -o $@ $<
|
||||
+report:
|
||||
+ @for cat in $(wildcard *.po); do \
|
||||
+ echo -n "$$cat: "; \
|
||||
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||
+ done
|
||||
+
|
||||
+.PHONY: missing depend
|
||||
+
|
||||
+relabel:
|
||||
diff --git a/python/po/POTFILES b/python/po/POTFILES
|
||||
new file mode 100644
|
||||
index 00000000..128eb870
|
||||
--- /dev/null
|
||||
+++ b/python/po/POTFILES
|
||||
@@ -0,0 +1,10 @@
|
||||
+../audit2allow/audit2allow
|
||||
+../chcat/chcat
|
||||
+../semanage/semanage
|
||||
+../semanage/seobject.py
|
||||
+../sepolgen/src/sepolgen/interfaces.py
|
||||
+../sepolicy/sepolicy/generate.py
|
||||
+../sepolicy/sepolicy/gui.py
|
||||
+../sepolicy/sepolicy/__init__.py
|
||||
+../sepolicy/sepolicy/interface.py
|
||||
+../sepolicy/sepolicy.py
|
||||
diff --git a/sandbox/Makefile b/sandbox/Makefile
|
||||
index 9da5e58d..b817824e 100644
|
||||
--- a/sandbox/Makefile
|
||||
+++ b/sandbox/Makefile
|
||||
@@ -13,6 +13,7 @@ override LDLIBS += -lselinux -lcap-ng
|
||||
SEUNSHARE_OBJS = seunshare.o
|
||||
|
||||
all: sandbox seunshare sandboxX.sh start
|
||||
+ (cd po && $(MAKE) $@)
|
||||
|
||||
seunshare: $(SEUNSHARE_OBJS)
|
||||
|
||||
@@ -39,6 +40,7 @@ install: all
|
||||
install -m 755 start $(DESTDIR)$(SHAREDIR)
|
||||
-mkdir -p $(DESTDIR)$(SYSCONFDIR)
|
||||
install -m 644 sandbox.conf $(DESTDIR)$(SYSCONFDIR)/sandbox
|
||||
+ (cd po && $(MAKE) $@)
|
||||
|
||||
test:
|
||||
@$(PYTHON) test_sandbox.py -v
|
||||
diff --git a/sandbox/po/Makefile b/sandbox/po/Makefile
|
||||
new file mode 100644
|
||||
index 00000000..0556bbe9
|
||||
--- /dev/null
|
||||
+++ b/sandbox/po/Makefile
|
||||
@@ -0,0 +1,82 @@
|
||||
+#
|
||||
+# Makefile for the PO files (translation) catalog
|
||||
+#
|
||||
+
|
||||
+PREFIX ?= /usr
|
||||
+
|
||||
+# What is this package?
|
||||
+NLSPACKAGE = sandbox
|
||||
+POTFILE = $(NLSPACKAGE).pot
|
||||
+INSTALL = /usr/bin/install -c -p
|
||||
+INSTALL_DATA = $(INSTALL) -m 644
|
||||
+INSTALL_DIR = /usr/bin/install -d
|
||||
+
|
||||
+# destination directory
|
||||
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||
+
|
||||
+# PO catalog handling
|
||||
+MSGMERGE = msgmerge
|
||||
+MSGMERGE_FLAGS = -q
|
||||
+XGETTEXT = xgettext -L Python --default-domain=$(NLSPACKAGE)
|
||||
+MSGFMT = msgfmt
|
||||
+
|
||||
+# All possible linguas
|
||||
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||
+
|
||||
+# Only the files matching what the user has set in LINGUAS
|
||||
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||
+
|
||||
+# if no valid LINGUAS, build all languages
|
||||
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||
+
|
||||
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||
+POTFILES = $(shell cat POTFILES)
|
||||
+
|
||||
+#default:: clean
|
||||
+
|
||||
+all:: $(POTFILE) $(MOFILES)
|
||||
+
|
||||
+$(POTFILE): $(POTFILES)
|
||||
+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||
+ rm -f $(NLSPACKAGE).po; \
|
||||
+ else \
|
||||
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||
+ fi; \
|
||||
+
|
||||
+
|
||||
+refresh-po: Makefile
|
||||
+ for cat in $(POFILES); do \
|
||||
+ lang=`basename $$cat .po`; \
|
||||
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||
+ mv -f $$lang.pot $$lang.po ; \
|
||||
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||
+ else \
|
||||
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||
+ rm -f $$lang.pot ; \
|
||||
+ fi \
|
||||
+ done
|
||||
+
|
||||
+clean:
|
||||
+ @rm -fv *mo *~ .depend
|
||||
+ @rm -rf tmp
|
||||
+
|
||||
+install: $(MOFILES)
|
||||
+ @for n in $(MOFILES); do \
|
||||
+ l=`basename $$n .mo`; \
|
||||
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||
+ done
|
||||
+
|
||||
+%.mo: %.po
|
||||
+ $(MSGFMT) -o $@ $<
|
||||
+report:
|
||||
+ @for cat in $(wildcard *.po); do \
|
||||
+ echo -n "$$cat: "; \
|
||||
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||
+ done
|
||||
+
|
||||
+.PHONY: missing depend
|
||||
+
|
||||
+relabel:
|
||||
diff --git a/sandbox/po/POTFILES b/sandbox/po/POTFILES
|
||||
new file mode 100644
|
||||
index 00000000..deff3f2f
|
||||
--- /dev/null
|
||||
+++ b/sandbox/po/POTFILES
|
||||
@@ -0,0 +1 @@
|
||||
+../sandbox
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From 52da97653bd64bcc603ab7e0b5c08cb687b833ab Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 4 May 2023 14:04:50 +0200
|
||||
Subject: [PATCH] python/audit2allow: Remove unused "debug" option
|
||||
Content-type: text/plain
|
||||
|
||||
The option is not referenced anywhere in the code and I couldn't figure
|
||||
out its purpose from the description.
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/audit2allow/audit2allow | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
|
||||
index eafeea88aa21..5587a2dbb006 100644
|
||||
--- a/python/audit2allow/audit2allow
|
||||
+++ b/python/audit2allow/audit2allow
|
||||
@@ -88,8 +88,6 @@ class AuditToPolicy:
|
||||
parser.add_option("--interface-info", dest="interface_info", help="file name of interface information")
|
||||
parser.add_option("-x", "--xperms", action="store_true", dest="xperms",
|
||||
default=False, help="generate extended permission rules")
|
||||
- parser.add_option("--debug", dest="debug", action="store_true", default=False,
|
||||
- help="leave generated modules for -M")
|
||||
parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=(os.path.basename(sys.argv[0]) == "audit2why"),
|
||||
help="Translates SELinux audit messages into a description of why the access was denied")
|
||||
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,306 @@
|
||||
From 57cd23e11e1a700802a5955e84a0a7e04c30ec73 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 6 Aug 2018 13:37:07 +0200
|
||||
Subject: [PATCH] Use correct gettext domains in python/ gui/ sandbox/
|
||||
|
||||
https://github.com/fedora-selinux/selinux/issues/43
|
||||
---
|
||||
gui/booleansPage.py | 2 +-
|
||||
gui/domainsPage.py | 2 +-
|
||||
gui/fcontextPage.py | 2 +-
|
||||
gui/loginsPage.py | 2 +-
|
||||
gui/modulesPage.py | 2 +-
|
||||
gui/polgengui.py | 2 +-
|
||||
gui/portsPage.py | 2 +-
|
||||
gui/semanagePage.py | 2 +-
|
||||
gui/statusPage.py | 2 +-
|
||||
gui/system-config-selinux.py | 2 +-
|
||||
gui/usersPage.py | 2 +-
|
||||
python/chcat/chcat | 2 +-
|
||||
python/semanage/semanage | 2 +-
|
||||
python/semanage/seobject.py | 2 +-
|
||||
python/sepolgen/src/sepolgen/sepolgeni18n.py | 2 +-
|
||||
python/sepolicy/sepolicy.py | 2 +-
|
||||
python/sepolicy/sepolicy/__init__.py | 2 +-
|
||||
python/sepolicy/sepolicy/generate.py | 2 +-
|
||||
python/sepolicy/sepolicy/gui.py | 2 +-
|
||||
python/sepolicy/sepolicy/interface.py | 2 +-
|
||||
sandbox/sandbox | 2 +-
|
||||
21 files changed, 21 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/gui/booleansPage.py b/gui/booleansPage.py
|
||||
index 7849bea2..dd12b6d6 100644
|
||||
--- a/gui/booleansPage.py
|
||||
+++ b/gui/booleansPage.py
|
||||
@@ -38,7 +38,7 @@ DISABLED = 2
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/domainsPage.py b/gui/domainsPage.py
|
||||
index bad5140d..6bbe4de5 100644
|
||||
--- a/gui/domainsPage.py
|
||||
+++ b/gui/domainsPage.py
|
||||
@@ -30,7 +30,7 @@ from semanagePage import *
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
|
||||
index 370bbee4..e424366d 100644
|
||||
--- a/gui/fcontextPage.py
|
||||
+++ b/gui/fcontextPage.py
|
||||
@@ -47,7 +47,7 @@ class context:
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/loginsPage.py b/gui/loginsPage.py
|
||||
index b67eb8bc..cbfb0cc2 100644
|
||||
--- a/gui/loginsPage.py
|
||||
+++ b/gui/loginsPage.py
|
||||
@@ -29,7 +29,7 @@ from semanagePage import *
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||
index cb856b2d..26ac5404 100644
|
||||
--- a/gui/modulesPage.py
|
||||
+++ b/gui/modulesPage.py
|
||||
@@ -30,7 +30,7 @@ from semanagePage import *
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/polgengui.py b/gui/polgengui.py
|
||||
index b1cc9937..46a1bd2c 100644
|
||||
--- a/gui/polgengui.py
|
||||
+++ b/gui/polgengui.py
|
||||
@@ -63,7 +63,7 @@ def get_all_modules():
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/portsPage.py b/gui/portsPage.py
|
||||
index 30f58383..a537ecc8 100644
|
||||
--- a/gui/portsPage.py
|
||||
+++ b/gui/portsPage.py
|
||||
@@ -35,7 +35,7 @@ from semanagePage import *
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/semanagePage.py b/gui/semanagePage.py
|
||||
index 4127804f..5361d69c 100644
|
||||
--- a/gui/semanagePage.py
|
||||
+++ b/gui/semanagePage.py
|
||||
@@ -22,7 +22,7 @@ from gi.repository import Gdk, Gtk
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/statusPage.py b/gui/statusPage.py
|
||||
index 766854b1..a8f079b9 100644
|
||||
--- a/gui/statusPage.py
|
||||
+++ b/gui/statusPage.py
|
||||
@@ -35,7 +35,7 @@ RELABELFILE = "/.autorelabel"
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
|
||||
index c42301b6..1e0d5eb1 100644
|
||||
--- a/gui/system-config-selinux.py
|
||||
+++ b/gui/system-config-selinux.py
|
||||
@@ -45,7 +45,7 @@ import selinux
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/gui/usersPage.py b/gui/usersPage.py
|
||||
index 26794ed5..d15d4c5a 100644
|
||||
--- a/gui/usersPage.py
|
||||
+++ b/gui/usersPage.py
|
||||
@@ -29,7 +29,7 @@ from semanagePage import *
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-gui"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
||||
index ba398684..df2509f2 100755
|
||||
--- a/python/chcat/chcat
|
||||
+++ b/python/chcat/chcat
|
||||
@@ -30,7 +30,7 @@ import getopt
|
||||
import selinux
|
||||
import seobject
|
||||
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 144cc000..56db3e0d 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -27,7 +27,7 @@ import traceback
|
||||
import argparse
|
||||
import seobject
|
||||
import sys
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 13fdf531..b90b1070 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -29,7 +29,7 @@ import sys
|
||||
import stat
|
||||
import socket
|
||||
from semanage import *
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
import sepolicy
|
||||
import setools
|
||||
from IPy import IP
|
||||
diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||
index 998c4356..56ebd807 100644
|
||||
--- a/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||
+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||
@@ -19,7 +19,7 @@
|
||||
|
||||
try:
|
||||
import gettext
|
||||
- t = gettext.translation( 'yumex' )
|
||||
+ t = gettext.translation( 'selinux-python' )
|
||||
_ = t.gettext
|
||||
except:
|
||||
def _(str):
|
||||
diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
|
||||
index 1934cd86..8bd6a579 100755
|
||||
--- a/python/sepolicy/sepolicy.py
|
||||
+++ b/python/sepolicy/sepolicy.py
|
||||
@@ -27,7 +27,7 @@ import selinux
|
||||
import sepolicy
|
||||
from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text
|
||||
import argparse
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||
index 0c66f4d5..b6ca57c3 100644
|
||||
--- a/python/sepolicy/sepolicy/__init__.py
|
||||
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||
@@ -13,7 +13,7 @@ import os
|
||||
import re
|
||||
import gzip
|
||||
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||
index 019e7836..7175d36b 100644
|
||||
--- a/python/sepolicy/sepolicy/generate.py
|
||||
+++ b/python/sepolicy/sepolicy/generate.py
|
||||
@@ -49,7 +49,7 @@ import sepolgen.defaults as defaults
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py
|
||||
index 00fd7a11..805cee67 100644
|
||||
--- a/python/sepolicy/sepolicy/gui.py
|
||||
+++ b/python/sepolicy/sepolicy/gui.py
|
||||
@@ -41,7 +41,7 @@ import os
|
||||
import re
|
||||
import unicodedata
|
||||
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py
|
||||
index 583091ae..e2b8d23b 100644
|
||||
--- a/python/sepolicy/sepolicy/interface.py
|
||||
+++ b/python/sepolicy/sepolicy/interface.py
|
||||
@@ -30,7 +30,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us
|
||||
##
|
||||
## I18N
|
||||
##
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||
index 1dec07ac..a12403b3 100644
|
||||
--- a/sandbox/sandbox
|
||||
+++ b/sandbox/sandbox
|
||||
@@ -37,7 +37,7 @@ import sepolicy
|
||||
|
||||
SEUNSHARE = "/usr/sbin/seunshare"
|
||||
SANDBOXSH = "/usr/share/sandbox/sandboxX.sh"
|
||||
-PROGNAME = "policycoreutils"
|
||||
+PROGNAME = "selinux-sandbox"
|
||||
try:
|
||||
import gettext
|
||||
kwargs = {}
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,309 +0,0 @@
|
||||
From b580a630378623df1c87c5fab1ffd63a41b3501e Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 1 Jun 2023 16:39:11 +0200
|
||||
Subject: [PATCH] policycoreutils: Add examples to man pages
|
||||
Content-type: text/plain
|
||||
|
||||
While at it, remove trailing whitespaces.
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
policycoreutils/scripts/fixfiles.8 | 34 +++++++++++++--------
|
||||
policycoreutils/secon/secon.1 | 12 ++++++--
|
||||
policycoreutils/semodule/semodule.8 | 14 ++++-----
|
||||
policycoreutils/setfiles/restorecon.8 | 9 ++++++
|
||||
policycoreutils/setfiles/restorecon_xattr.8 | 7 +++++
|
||||
policycoreutils/setfiles/setfiles.8 | 9 ++++++
|
||||
policycoreutils/setsebool/setsebool.8 | 16 +++++++---
|
||||
7 files changed, 74 insertions(+), 27 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
|
||||
index 9a317d9181e2..928b82004b1a 100644
|
||||
--- a/policycoreutils/scripts/fixfiles.8
|
||||
+++ b/policycoreutils/scripts/fixfiles.8
|
||||
@@ -14,7 +14,7 @@ fixfiles \- fix file SELinux security contexts.
|
||||
.B fixfiles
|
||||
.I [\-v] [\-F] [\-B | \-N time ] [\-T nthreads] { check | restore | verify }
|
||||
|
||||
-.B fixfiles
|
||||
+.B fixfiles
|
||||
.I [\-v] [\-F] [\-T nthreads] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify }
|
||||
|
||||
.B fixfiles
|
||||
@@ -31,7 +31,7 @@ This manual page describes the
|
||||
script.
|
||||
.P
|
||||
This script is primarily used to correct the security context
|
||||
-database (extended attributes) on filesystems.
|
||||
+database (extended attributes) on filesystems.
|
||||
.P
|
||||
It can also be run at any time to relabel when adding support for
|
||||
new policy, or just check whether the file contexts are all
|
||||
@@ -41,29 +41,29 @@ option. You can use the \-R flag to use rpmpackages as an alternative.
|
||||
The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories
|
||||
excluded from relabeling.
|
||||
.P
|
||||
-.B fixfiles onboot
|
||||
+.B fixfiles onboot
|
||||
will setup the machine to relabel on the next reboot.
|
||||
|
||||
.SH "OPTIONS"
|
||||
-.TP
|
||||
+.TP
|
||||
.B \-B
|
||||
If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today.
|
||||
.TP
|
||||
.B \-F
|
||||
Force reset of context to match file_context for customizable files
|
||||
|
||||
-.TP
|
||||
+.TP
|
||||
.B \-f
|
||||
Clear /tmp directory with out prompt for removal.
|
||||
|
||||
-.TP
|
||||
+.TP
|
||||
.B \-R rpmpackagename[,rpmpackagename...]
|
||||
Use the rpm database to discover all files within the specified packages and restore the file contexts.
|
||||
.TP
|
||||
.B \-C PREVIOUS_FILECONTEXT
|
||||
Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.
|
||||
|
||||
-.TP
|
||||
+.TP
|
||||
.B \-N time
|
||||
Only act on files created after the specified date. Date must be specified in
|
||||
"YYYY\-MM\-DD HH:MM" format. Date field will be passed to find \-\-newermt command.
|
||||
@@ -83,19 +83,28 @@ Use parallel relabeling, see
|
||||
|
||||
.SH "ARGUMENTS"
|
||||
One of:
|
||||
-.TP
|
||||
+.TP
|
||||
.B check | verify
|
||||
print any incorrect file context labels, showing old and new context, but do not change them.
|
||||
-.TP
|
||||
+.TP
|
||||
.B restore
|
||||
change any incorrect file context labels.
|
||||
-.TP
|
||||
+.TP
|
||||
.B relabel
|
||||
Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file.
|
||||
-.TP
|
||||
-.B [[dir/file] ... ]
|
||||
+.TP
|
||||
+.B [[dir/file] ... ]
|
||||
List of files or directories trees that you wish to check file context on.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Relabel the whole filesystem, except paths listed in /etc/selinux/fixfiles_exclude_dirs
|
||||
+# fixfiles relabel
|
||||
+Schedule the machine to relabel on the next boot and force relabeling of customizable types
|
||||
+# fixfiles -F onboot
|
||||
+Check labeling of all files from the samba package (while not changing any labels)
|
||||
+# fixfiles -R samba check
|
||||
+
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Richard Hally <rhally@mindspring.com>.
|
||||
The script was written by Dan Walsh <dwalsh@redhat.com>
|
||||
@@ -103,4 +112,3 @@ The script was written by Dan Walsh <dwalsh@redhat.com>
|
||||
.SH "SEE ALSO"
|
||||
.BR setfiles (8),
|
||||
.BR restorecon (8)
|
||||
-
|
||||
diff --git a/policycoreutils/secon/secon.1 b/policycoreutils/secon/secon.1
|
||||
index 501b5cb8c410..c0e8b05a6b66 100644
|
||||
--- a/policycoreutils/secon/secon.1
|
||||
+++ b/policycoreutils/secon/secon.1
|
||||
@@ -107,16 +107,24 @@ then the context will be read from stdin.
|
||||
.br
|
||||
If there is no argument,
|
||||
.B secon
|
||||
-will try reading a context from stdin, if that is not a tty, otherwise
|
||||
+will try reading a context from stdin, if that is not a tty, otherwise
|
||||
.B secon
|
||||
will act as though \fB\-\-self\fR had been passed.
|
||||
.PP
|
||||
If none of \fB\-\-user\fR, \fB\-\-role\fR, \fB\-\-type\fR, \fB\-\-level\fR or
|
||||
\fB\-\-mls\-range\fR is passed.
|
||||
Then all of them will be output.
|
||||
+
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Show SElinux context of the init process
|
||||
+# secon --pid 1
|
||||
+Parse the type portion of given security context
|
||||
+# secon -t system_u:object_r:httpd_sys_rw_content_t:s0
|
||||
+
|
||||
.PP
|
||||
.SH SEE ALSO
|
||||
.BR chcon (1)
|
||||
.SH AUTHORS
|
||||
.nf
|
||||
-James Antill (james.antill@redhat.com)
|
||||
+James Antill (james.antill@redhat.com)
|
||||
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||
index c56e580f27b8..01757b005e4a 100644
|
||||
--- a/policycoreutils/semodule/semodule.8
|
||||
+++ b/policycoreutils/semodule/semodule.8
|
||||
@@ -1,5 +1,5 @@
|
||||
.TH SEMODULE "8" "Nov 2005" "Security Enhanced Linux" NSA
|
||||
-.SH NAME
|
||||
+.SH NAME
|
||||
semodule \- Manage SELinux policy modules.
|
||||
|
||||
.SH SYNOPSIS
|
||||
@@ -8,7 +8,7 @@ semodule \- Manage SELinux policy modules.
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
semodule is the tool used to manage SELinux policy modules,
|
||||
-including installing, upgrading, listing and removing modules.
|
||||
+including installing, upgrading, listing and removing modules.
|
||||
semodule may also be used to force a rebuild of policy from the
|
||||
module store and/or to force a reload of policy without performing
|
||||
any other transaction. semodule acts on module packages created
|
||||
@@ -39,7 +39,7 @@ install/replace a module package
|
||||
.B \-u,\-\-upgrade=MODULE_PKG
|
||||
deprecated, alias for --install
|
||||
.TP
|
||||
-.B \-b,\-\-base=MODULE_PKG
|
||||
+.B \-b,\-\-base=MODULE_PKG
|
||||
deprecated, alias for --install
|
||||
.TP
|
||||
.B \-r,\-\-remove=MODULE_NAME
|
||||
@@ -77,7 +77,7 @@ name of the store to operate on
|
||||
.B \-n,\-\-noreload,\-N
|
||||
do not reload policy after commit
|
||||
.TP
|
||||
-.B \-h,\-\-help
|
||||
+.B \-h,\-\-help
|
||||
prints help message and quit
|
||||
.TP
|
||||
.B \-P,\-\-preserve_tunables
|
||||
@@ -92,7 +92,7 @@ Use an alternate path for the policy root
|
||||
.B \-S,\-\-store-path
|
||||
Use an alternate path for the policy store root
|
||||
.TP
|
||||
-.B \-v,\-\-verbose
|
||||
+.B \-v,\-\-verbose
|
||||
be verbose
|
||||
.TP
|
||||
.B \-c,\-\-cil
|
||||
@@ -131,8 +131,6 @@ $ semodule \-B
|
||||
$ semodule \-d alsa
|
||||
# Install a module at a specific priority.
|
||||
$ semodule \-X 100 \-i alsa.pp
|
||||
-# List all modules.
|
||||
-$ semodule \-\-list=full
|
||||
# Set an alternate path for the policy root
|
||||
$ semodule \-B \-p "/tmp"
|
||||
# Set an alternate path for the policy store root
|
||||
@@ -143,6 +141,8 @@ $ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark
|
||||
# Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
|
||||
$ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
|
||||
$ semodule -l -m | grep localmodule
|
||||
+# Translate binary module file into CIL (useful for debugging installation errors)
|
||||
+$ /usr/libexec/selinux/hll/pp alsa.pp > alsa.cil
|
||||
.fi
|
||||
|
||||
.SH SEE ALSO
|
||||
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
|
||||
index dbd55ce7c512..6160aced5922 100644
|
||||
--- a/policycoreutils/setfiles/restorecon.8
|
||||
+++ b/policycoreutils/setfiles/restorecon.8
|
||||
@@ -224,6 +224,15 @@ and provided the
|
||||
option is NOT set and recursive mode is set, files will be relabeled as
|
||||
required with the digests then being updated provided there are no errors.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Fix labeling of /var/www/ including all sub-directories and list all context changes
|
||||
+# restorecon -rv /var/www/
|
||||
+List mislabeled files in user home directory and what the correct label should be
|
||||
+# restorecon -nvr ~
|
||||
+Fix labeling of files listed in file_list file, ignoring any that do not exist
|
||||
+# restorecon -vif file_list
|
||||
+
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||
Some of the content of this man page was taken from the setfiles
|
||||
diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8
|
||||
index 4b1ce304d995..09bfd8c40ab4 100644
|
||||
--- a/policycoreutils/setfiles/restorecon_xattr.8
|
||||
+++ b/policycoreutils/setfiles/restorecon_xattr.8
|
||||
@@ -112,6 +112,13 @@ If the option is not specified, then the default file_contexts will be used.
|
||||
.br
|
||||
the pathname of the directory tree to be searched.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+List all paths that where assigned a checksum by "restorecon/setfiles -D"
|
||||
+# restorecon_xattr -r /
|
||||
+Remove all non-matching checksums
|
||||
+# restorecon_xattr -rd /
|
||||
+
|
||||
.SH "SEE ALSO"
|
||||
.BR restorecon (8),
|
||||
.BR setfiles (8)
|
||||
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||
index 36fe6b369548..6071d9ba3d38 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.8
|
||||
+++ b/policycoreutils/setfiles/setfiles.8
|
||||
@@ -289,6 +289,15 @@ and provided the
|
||||
option is NOT set, files will be relabeled as required with the digests then
|
||||
being updated provided there are no errors.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Fix labeling of /var/www/ including all sub-directories, using targeted policy file context definitions and list all context changes
|
||||
+# setfiles -v /etc/selinux/targeted/contexts/files/file_contexts /var/www/
|
||||
+List mislabeled files in user home directory and what the label should be based on targeted policy file context definitions
|
||||
+# setfiles -nv /etc/selinux/targeted/contexts/files/file_contexts ~
|
||||
+Fix labeling of files listed in file_list file, ignoring any that do not exist
|
||||
+# setfiles -vif file_list /etc/selinux/targeted/contexts/files/file_contexts
|
||||
+
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Russell Coker <russell@coker.com.au>.
|
||||
The program was written by Stephen Smalley <sds@tycho.nsa.gov>
|
||||
diff --git a/policycoreutils/setsebool/setsebool.8 b/policycoreutils/setsebool/setsebool.8
|
||||
index 52936f5a0ffb..f54664fb5c2a 100644
|
||||
--- a/policycoreutils/setsebool/setsebool.8
|
||||
+++ b/policycoreutils/setsebool/setsebool.8
|
||||
@@ -7,13 +7,13 @@ setsebool \- set SELinux boolean value
|
||||
.I "[ \-PNV ] boolean value | bool1=val1 bool2=val2 ..."
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-.B setsebool
|
||||
-sets the current state of a particular SELinux boolean or a list of booleans
|
||||
-to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it.
|
||||
+.B setsebool
|
||||
+sets the current state of a particular SELinux boolean or a list of booleans
|
||||
+to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it.
|
||||
|
||||
Without the \-P option, only the current boolean value is
|
||||
-affected; the boot-time default settings
|
||||
-are not changed.
|
||||
+affected; the boot-time default settings
|
||||
+are not changed.
|
||||
|
||||
If the \-P option is given, all pending values are written to
|
||||
the policy file on disk. So they will be persistent across reboots.
|
||||
@@ -22,6 +22,12 @@ If the \-N option is given, the policy on disk is not reloaded into the kernel.
|
||||
|
||||
If the \-V option is given, verbose error messages will be printed from semanage libraries.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Enable container_use_devices boolean (will return to persistent value after reboot)
|
||||
+# setsebool container_use_devices 1
|
||||
+Persistently enable samba_create_home_dirs and samba_enable_home_dirs booleans
|
||||
+# setsebool -P samba_create_home_dirs=on samba_enable_home_dirs=on
|
||||
|
||||
.SH AUTHOR
|
||||
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||
--
|
||||
2.41.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,391 +0,0 @@
|
||||
From 72420ec0eb2ca8cf4cc9099dcd495695eeab308b Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 1 Jun 2023 16:39:12 +0200
|
||||
Subject: [PATCH] python/sepolicy: Improve man pages
|
||||
Content-type: text/plain
|
||||
|
||||
- Add missing options
|
||||
- Add examples
|
||||
- Emphasize keywords
|
||||
- Remove trailing whitespaces
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy-booleans.8 | 15 +++++++++---
|
||||
python/sepolicy/sepolicy-communicate.8 | 14 ++++++++---
|
||||
python/sepolicy/sepolicy-generate.8 | 34 ++++++++++++--------------
|
||||
python/sepolicy/sepolicy-gui.8 | 4 +--
|
||||
python/sepolicy/sepolicy-interface.8 | 18 +++++++++++---
|
||||
python/sepolicy/sepolicy-manpage.8 | 25 ++++++++++++++-----
|
||||
python/sepolicy/sepolicy-network.8 | 17 ++++++-------
|
||||
python/sepolicy/sepolicy-transition.8 | 19 +++++++++-----
|
||||
8 files changed, 96 insertions(+), 50 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy-booleans.8 b/python/sepolicy/sepolicy-booleans.8
|
||||
index f8d8b56d5d4d..7f4b18e75ac8 100644
|
||||
--- a/python/sepolicy/sepolicy-booleans.8
|
||||
+++ b/python/sepolicy/sepolicy-booleans.8
|
||||
@@ -8,12 +8,16 @@ sepolicy-booleans \- Query SELinux Policy to see description of booleans
|
||||
.B sepolicy booleans [\-h] [ \-a | \-b booleanname ... ]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-sepolicy booleans will show all booleans and their descriptions, or you can
|
||||
-choose individual booleans to display
|
||||
+.B sepolicy booleans
|
||||
+will show all booleans and their descriptions, or you can
|
||||
+choose individual booleans to display.
|
||||
+Please make sure that selinux-policy-devel is present in your system since it contains boolean descriptions extracted from the policy source code. Otherwise
|
||||
+.B sepolicy booleans
|
||||
+will only show descriptions generated based on boolean names.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
.I \-a, \-\-all
|
||||
@@ -22,6 +26,11 @@ Display all boolean descriptions
|
||||
.I \-b, \-\-boolean
|
||||
boolean to get description
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+List descriptions of samba_create_home_dirs and samba_enable_home_dirs booleans
|
||||
+# sepolicy booleans -b samba_create_home_dirs samba_enable_home_dirs
|
||||
+
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy-communicate.8 b/python/sepolicy/sepolicy-communicate.8
|
||||
index 050aa475eef1..5ecf6eff0f6b 100644
|
||||
--- a/python/sepolicy/sepolicy-communicate.8
|
||||
+++ b/python/sepolicy/sepolicy-communicate.8
|
||||
@@ -8,7 +8,9 @@ sepolicy-communicate \- Generate a report showing if two SELinux Policy Domains
|
||||
.B sepolicy communicate [\-h] \-s SOURCE \-t TARGET [\-c TCLASS] [\-S SOURCEACCESS] [\-T TARGETACCESS]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-Use sepolicy communicate to examine SELinux Policy to if a source SELinux Domain can communicate with a target SELinux Domain.
|
||||
+Use
|
||||
+.B sepolicy communicate
|
||||
+to examine SELinux Policy and determine if a source SELinux Domain can communicate with a target SELinux Domain.
|
||||
The default command looks to see if there are any file types that the source domain can write, which the target domain can read.
|
||||
|
||||
.SH "OPTIONS"
|
||||
@@ -16,7 +18,7 @@ The default command looks to see if there are any file types that the source dom
|
||||
.I \-c, \-\-class
|
||||
Specify the SELinux class which the source domain will attempt to communicate with the target domain. (Default file)
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
.I \-s, \-\-source
|
||||
@@ -31,9 +33,15 @@ Specify the target SELinux domain type.
|
||||
.I \-T, \-\-targetaccess
|
||||
Specify the list of accesses used by the target SELinux domain type to receive communications from the source domain. Default Open, Read.
|
||||
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+List types that can be used to communicate between samba daemon and apache server
|
||||
+# sepolicy communicate -s httpd_t -t smbd_t
|
||||
+Consider a type to be accessible by the source domain when it can be opened and appended to (as opposed to opened and written to)
|
||||
+# sepolicy communicate -s httpd_t -t smbd_t -S open,append
|
||||
+
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
|
||||
.SH "SEE ALSO"
|
||||
sepolicy(8), selinux(8)
|
||||
-
|
||||
diff --git a/python/sepolicy/sepolicy-generate.8 b/python/sepolicy/sepolicy-generate.8
|
||||
index 0c5f998f5412..72d0e8e41b6e 100644
|
||||
--- a/python/sepolicy/sepolicy-generate.8
|
||||
+++ b/python/sepolicy/sepolicy-generate.8
|
||||
@@ -57,32 +57,29 @@ path. \fBsepolicy generate\fP will use the rpm payload of the
|
||||
application along with \fBnm \-D APPLICATION\fP to help it generate
|
||||
types and policy rules for your policy files.
|
||||
|
||||
-.B Type Enforcing File NAME.te
|
||||
+.B NAME.te
|
||||
.br
|
||||
-This file can be used to define all the types rules for a particular domain.
|
||||
+This file can be used to define all the types enforcement rules for a particular domain.
|
||||
|
||||
.I Note:
|
||||
-Policy generated by \fBsepolicy generate\fP will automatically add a permissive DOMAIN to your te file. When you are satisfied that your policy works, you need to remove the permissive line from the te file to run your domain in enforcing mode.
|
||||
+Policy generated by \fBsepolicy generate\fP will automatically add a \fIpermissive DOMAIN\fP to your \fB.te\fP file. When you are satisfied that your policy works, you need to remove the permissive line from the \fB.te\fP file to run your domain in enforcing mode.
|
||||
|
||||
-.B Interface File NAME.if
|
||||
+.B NAME.if
|
||||
.br
|
||||
-This file defines the interfaces for the types generated in the te file, which can be used by other policy domains.
|
||||
+This file defines the interfaces for the types generated in the \fB.te\fP file, which can be used by other policy domains.
|
||||
|
||||
-.B File Context NAME.fc
|
||||
+.B NAME.fc
|
||||
.br
|
||||
-This file defines the default file context for the system, it takes the file types created in the te file and associates
|
||||
+This file defines the default file context for the system, it takes the file types created in the \fB.te\fP file and associates
|
||||
file paths to the types. Tools like restorecon and RPM will use these paths to put down labels.
|
||||
|
||||
-.B RPM Spec File NAME_selinux.spec
|
||||
+.B NAME_selinux.spec
|
||||
.br
|
||||
-This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page.
|
||||
+This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page.
|
||||
|
||||
-.B Shell File NAME.sh
|
||||
+.B NAME.sh
|
||||
.br
|
||||
-This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and
|
||||
-compile and build an RPM suitable to be installed on other machines
|
||||
-
|
||||
-If a generate is possible, this tool will print out all generate paths from the source domain to the target domain
|
||||
+This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
@@ -97,10 +94,11 @@ Specify alternate name of policy. The policy will default to the executable or n
|
||||
.TP
|
||||
.I \-p, \-\-path
|
||||
Specify the directory to store the created policy files. (Default to current working directory )
|
||||
+.TP
|
||||
optional arguments:
|
||||
.TP
|
||||
.I \-r, \-\-role
|
||||
-Enter role(s) to which this admin user will transition.
|
||||
+Enter role(s) to which this admin user will transition
|
||||
.TP
|
||||
.I \-t, \-\-type
|
||||
Enter type(s) for which you will generate new definition and rule(s)
|
||||
@@ -109,12 +107,12 @@ Enter type(s) for which you will generate new definition and rule(s)
|
||||
SELinux user(s) which will transition to this domain
|
||||
.TP
|
||||
.I \-w, \-\-writepath
|
||||
-Path(s) which the confined processes need to write
|
||||
+Path(s) which the confined processes need to write to
|
||||
.TP
|
||||
.I \-a, \-\-admin
|
||||
Domain(s) which the confined admin will administrate
|
||||
.TP
|
||||
-.I \-\-admin_user
|
||||
+.I \-\-admin_user
|
||||
Generate Policy for Administrator Login User Role
|
||||
.TP
|
||||
.I \-\-application
|
||||
@@ -142,7 +140,7 @@ Generate Policy for Internet Services Daemon
|
||||
Generate Policy for Standard Init Daemon (Default)
|
||||
.TP
|
||||
.I \-\-newtype
|
||||
-Generate new policy for new types to add to an existing policy.
|
||||
+Generate new policy for new types to add to an existing policy
|
||||
.TP
|
||||
.I \-\-sandbox
|
||||
Generate Policy for Sandbox
|
||||
diff --git a/python/sepolicy/sepolicy-gui.8 b/python/sepolicy/sepolicy-gui.8
|
||||
index ed744cdb914e..65b69faba144 100644
|
||||
--- a/python/sepolicy/sepolicy-gui.8
|
||||
+++ b/python/sepolicy/sepolicy-gui.8
|
||||
@@ -11,7 +11,7 @@ Common options
|
||||
.br
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-Use \fBsepolicy gui\fP to run a the graphical user interface, which
|
||||
+Use \fBsepolicy gui\fP to run the graphical user interface, which
|
||||
allows you to explore how SELinux confines different process domains.
|
||||
|
||||
.SH "OPTIONS"
|
||||
@@ -20,7 +20,7 @@ allows you to explore how SELinux confines different process domains.
|
||||
Display help message
|
||||
.TP
|
||||
.I \-d, \-\-domain
|
||||
-Initialize gui to the selected domain.
|
||||
+Initialize gui to the selected domain
|
||||
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
diff --git a/python/sepolicy/sepolicy-interface.8 b/python/sepolicy/sepolicy-interface.8
|
||||
index 3e74ea627a79..a70a930629ea 100644
|
||||
--- a/python/sepolicy/sepolicy-interface.8
|
||||
+++ b/python/sepolicy/sepolicy-interface.8
|
||||
@@ -5,10 +5,10 @@ sepolicy-interface \- Print interface information based on the installed SELinux
|
||||
.SH "SYNOPSIS"
|
||||
|
||||
.br
|
||||
-.B sepolicy interface [\-h] [\-c] [\-v] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]]
|
||||
+.B sepolicy interface [\-h] [\-c] [\-v] [\-f FILE] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-Use sepolicy interface to print interfaces information based on SELinux Policy.
|
||||
+Use \fBsepolicy interface\fP to print interface information based on SELinux Policy.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
@@ -18,7 +18,7 @@ List all domains with admin interface
|
||||
.I \-c, \-\-compile
|
||||
Test compile of interfaces
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
.I \-i, \-\-interface
|
||||
@@ -32,6 +32,18 @@ List all domains with SELinux user role interface
|
||||
.TP
|
||||
.I \-v, \-\-verbose
|
||||
Display extended information about the interface including parameters and description if available.
|
||||
+.TP
|
||||
+.I \-f, \-\-file
|
||||
+Interface file to be explored
|
||||
+
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Show description of given interface
|
||||
+# sepolicy interface -vi samba_rw_config
|
||||
+List interfaces in given interface file and show their description
|
||||
+# sepolicy interface -f my_policy.if -lv
|
||||
+Run compile test for all interfaces in given file
|
||||
+# sepolicy interface -f my_policy.if -lc
|
||||
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
diff --git a/python/sepolicy/sepolicy-manpage.8 b/python/sepolicy/sepolicy-manpage.8
|
||||
index c05c94305633..4991f645ba38 100644
|
||||
--- a/python/sepolicy/sepolicy-manpage.8
|
||||
+++ b/python/sepolicy/sepolicy-manpage.8
|
||||
@@ -8,27 +8,40 @@ sepolicy-manpage \- Generate a man page based on the installed SELinux Policy
|
||||
.B sepolicy manpage [\-w] [\-h] [\-p PATH ] [\-r ROOTDIR ] [\-a | \-d ]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-Use sepolicy manpage to generate manpages based on SELinux Policy.
|
||||
+Use \fBsepolicy manpage\fP to generate manpages based on SELinux Policy.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
-.I \-a, \-\-all
|
||||
+.I \-a, \-\-all
|
||||
Generate Man Pages for All Domains
|
||||
.TP
|
||||
-.I \-d, \-\-domain
|
||||
+.I \-d, \-\-domain
|
||||
Generate a Man Page for the specified domain. (Supports multiple commands)
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
+.I \-o, \-\-os
|
||||
+Specify the name of the OS to be used in the man page (only affects HTML man pages)
|
||||
+.TP
|
||||
.I \-p, \-\-path
|
||||
Specify the directory to store the created man pages. (Default to /tmp)
|
||||
.TP
|
||||
.I \-r, \-\-root
|
||||
-Specify alternate root directory to generate man pages from. (Default to /)
|
||||
+Specify alternative root directory to generate man pages from. (Default to /)
|
||||
+.TP
|
||||
+.I \-\-source_files
|
||||
+Use file_contexts and policy.xml files from the specified root directory (the alternative root needs to include both files)
|
||||
.TP
|
||||
.I \-w, \-\-web
|
||||
-Generate an additional HTML man pages for the specified domain(s).
|
||||
+Generate an additional HTML man pages for the specified domain(s)
|
||||
+
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+Generate man pages for all available domains
|
||||
+# sepolicy manpage -a
|
||||
+Generate an HTML man page for domain alsa_t, setting the OS name to "My_distro"
|
||||
+# sepolicy manpage -o My_distro -d alsa_t -w
|
||||
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
diff --git a/python/sepolicy/sepolicy-network.8 b/python/sepolicy/sepolicy-network.8
|
||||
index dcddec756774..6faf60ab7a44 100644
|
||||
--- a/python/sepolicy/sepolicy-network.8
|
||||
+++ b/python/sepolicy/sepolicy-network.8
|
||||
@@ -8,27 +8,27 @@ sepolicy-network \- Examine the SELinux Policy and generate a network report
|
||||
.B sepolicy network [\-h] (\-l | \-a application [application ...] | \-p PORT [PORT ...] | \-t TYPE [TYPE ...] | \-d DOMAIN [DOMAIN ...])
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-Use sepolicy network to examine SELinux Policy and generate network reports.
|
||||
+Use \fBsepolicy network\fP to examine SELinux Policy and generate network reports.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-a, \-\-application
|
||||
-Generate a report listing the ports to which the specified init application is allowed to connect and or bind.
|
||||
+Generate a report listing the ports to which the specified init application is allowed to connect and or bind
|
||||
.TP
|
||||
-.I \-d, \-\-domain
|
||||
-Generate a report listing the ports to which the specified domain is allowed to connect and or bind.
|
||||
+.I \-d, \-\-domain
|
||||
+Generate a report listing the ports to which the specified domain is allowed to connect and or bind
|
||||
.TP
|
||||
-.I \-l, \-\-list
|
||||
+.I \-l, \-\-list
|
||||
List all Network Port Types defined in SELinux Policy
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
.I \-t, \-\-type
|
||||
-Generate a report listing the port numbers associate with the specified SELinux port type.
|
||||
+Generate a report listing the port numbers associate with the specified SELinux port type
|
||||
.TP
|
||||
.I \-p, \-\-port
|
||||
-Generate a report listing the SELinux port types associate with the specified port number.
|
||||
+Generate a report listing the SELinux port types associate with the specified port number
|
||||
|
||||
.SH "EXAMPLES"
|
||||
|
||||
@@ -88,4 +88,3 @@ This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
|
||||
.SH "SEE ALSO"
|
||||
sepolicy(8), selinux(8), semanage(8)
|
||||
-
|
||||
diff --git a/python/sepolicy/sepolicy-transition.8 b/python/sepolicy/sepolicy-transition.8
|
||||
index 897f0c4c418e..9f9ff5a52165 100644
|
||||
--- a/python/sepolicy/sepolicy-transition.8
|
||||
+++ b/python/sepolicy/sepolicy-transition.8
|
||||
@@ -11,21 +11,28 @@ sepolicy-transition \- Examine the SELinux Policy and generate a process transit
|
||||
.B sepolicy transition [\-h] \-s SOURCE \-t TARGET
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
-sepolicy transition will show all domains that a give SELinux source domain can transition to, including the entrypoint.
|
||||
+\fBsepolicy transition\fP will show all domains that a given SELinux source domain can transition to, including the entrypoint.
|
||||
|
||||
-If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the
|
||||
-paths. If a transition is possible, this tool will print out all transition paths from the source domain to the target domain
|
||||
+If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the
|
||||
+paths.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
-.I \-h, \-\-help
|
||||
+.I \-h, \-\-help
|
||||
Display help message
|
||||
.TP
|
||||
.I \-s, \-\-source
|
||||
-Specify the source SELinux domain type.
|
||||
+Specify the source SELinux domain type
|
||||
.TP
|
||||
.I \-t, \-\-target
|
||||
-Specify the target SELinux domain type.
|
||||
+Specify the target SELinux domain type
|
||||
+
|
||||
+.SH EXAMPLE
|
||||
+.nf
|
||||
+List all domain transition paths from init_t to httpd_t
|
||||
+# sepolicy transition -s init_t -t httpd_t
|
||||
+List all transitions available from samba domain, including entry points and booleans controlling each transition
|
||||
+# sepolicy transition -s smbd_t
|
||||
|
||||
.SH "AUTHOR"
|
||||
This man page was written by Daniel Walsh <dwalsh@redhat.com>
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,30 @@
|
||||
From c8fbb8042852c18775c001999ce949e9b591e381 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 21 Mar 2018 08:51:31 +0100
|
||||
Subject: [PATCH] policycoreutils/setfiles: Improve description of -d switch
|
||||
|
||||
The "-q" switch is becoming obsolete (completely unused in fedora) and
|
||||
debug output ("-d" switch) makes sense in any scenario. Therefore both
|
||||
options can be specified at once.
|
||||
|
||||
Resolves: rhbz#1271327
|
||||
---
|
||||
policycoreutils/setfiles/setfiles.8 | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||
index ccaaf4de..a8a76c86 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.8
|
||||
+++ b/policycoreutils/setfiles/setfiles.8
|
||||
@@ -57,7 +57,7 @@ check the validity of the contexts against the specified binary policy.
|
||||
.TP
|
||||
.B \-d
|
||||
show what specification matched each file (do not abort validation
|
||||
-after ABORT_ON_ERRORS errors).
|
||||
+after ABORT_ON_ERRORS errors). Not affected by "\-q"
|
||||
.TP
|
||||
.BI \-e \ directory
|
||||
directory to exclude (repeat option for more than one directory).
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,94 +0,0 @@
|
||||
From cf06052cc5fece8ec1ae655aecf941420385bf4d Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 1 Jun 2023 18:34:30 +0200
|
||||
Subject: [PATCH] python/sepolicy: Fix template for confined user policy
|
||||
modules
|
||||
Content-type: text/plain
|
||||
|
||||
The following commit
|
||||
https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490
|
||||
changed the userdom_base_user_template, which now requires a role
|
||||
corresponding to the user being created to be defined outside of the
|
||||
template.
|
||||
Similar change was also done to fedora-selinux/selinux-policy
|
||||
https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f
|
||||
|
||||
Although I believe the template should define the role (just as it
|
||||
defines the new user), that will require extensive changes to refpolicy.
|
||||
In the meantime the role needs to be defined separately.
|
||||
|
||||
Fixes:
|
||||
# sepolicy generate --term_user -n newuser
|
||||
Created the following files:
|
||||
/root/a/test/newuser.te # Type Enforcement file
|
||||
/root/a/test/newuser.if # Interface file
|
||||
/root/a/test/newuser.fc # File Contexts file
|
||||
/root/a/test/newuser_selinux.spec # Spec file
|
||||
/root/a/test/newuser.sh # Setup Script
|
||||
|
||||
# ./newuser.sh
|
||||
Building and Loading Policy
|
||||
+ make -f /usr/share/selinux/devel/Makefile newuser.pp
|
||||
Compiling targeted newuser module
|
||||
Creating targeted newuser.pp policy package
|
||||
rm tmp/newuser.mod tmp/newuser.mod.fc
|
||||
+ /usr/sbin/semodule -i newuser.pp
|
||||
Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8
|
||||
Failed to resolve AST
|
||||
/usr/sbin/semodule: Failed!
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/templates/user.py | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py
|
||||
index 1ff9d2ce8e75..7081fbaec496 100644
|
||||
--- a/python/sepolicy/sepolicy/templates/user.py
|
||||
+++ b/python/sepolicy/sepolicy/templates/user.py
|
||||
@@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
+role TEMPLATETYPE_r;
|
||||
+
|
||||
userdom_unpriv_user_template(TEMPLATETYPE)
|
||||
"""
|
||||
|
||||
@@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0)
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
+role TEMPLATETYPE_r;
|
||||
+
|
||||
userdom_admin_user_template(TEMPLATETYPE)
|
||||
"""
|
||||
|
||||
@@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
+role TEMPLATETYPE_r;
|
||||
|
||||
userdom_restricted_user_template(TEMPLATETYPE)
|
||||
"""
|
||||
@@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0)
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
+role TEMPLATETYPE_r;
|
||||
|
||||
userdom_restricted_xwindows_user_template(TEMPLATETYPE)
|
||||
"""
|
||||
@@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false)
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
+role TEMPLATETYPE_r;
|
||||
|
||||
userdom_base_user_template(TEMPLATETYPE)
|
||||
"""
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
From 1af71ea06bbb57082a627854ec77134428f8fb15 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 30 May 2023 09:07:28 +0200
|
||||
Subject: [PATCH] python/sepolicy: Fix spec file dependencies
|
||||
Content-type: text/plain
|
||||
|
||||
semanage is part of policycoreutils-python-utils package, selinuxenabled
|
||||
is part of libselinux-utils (required by ^^^) and restorecon/load_policy
|
||||
are part of policycoreutils (also required by policycoreutils-python-utils).
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/templates/spec.py | 12 +++++++-----
|
||||
1 file changed, 7 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/templates/spec.py b/python/sepolicy/sepolicy/templates/spec.py
|
||||
index 16a22081b44b..cb3b2f63005b 100644
|
||||
--- a/python/sepolicy/sepolicy/templates/spec.py
|
||||
+++ b/python/sepolicy/sepolicy/templates/spec.py
|
||||
@@ -11,18 +11,20 @@ Version: 1.0
|
||||
Release: 1%{?dist}
|
||||
Summary: SELinux policy module for MODULENAME
|
||||
|
||||
-Group: System Environment/Base
|
||||
-License: GPLv2+
|
||||
+Group: System Environment/Base
|
||||
+License: GPLv2+
|
||||
# This is an example. You will need to change it.
|
||||
+# For a complete guide on packaging your policy
|
||||
+# see https://fedoraproject.org/wiki/SELinux/IndependentPolicy
|
||||
URL: http://HOSTNAME
|
||||
Source0: MODULENAME.pp
|
||||
Source1: MODULENAME.if
|
||||
Source2: DOMAINNAME_selinux.8
|
||||
Source3: DOMAINNAME_u
|
||||
|
||||
-Requires: policycoreutils, libselinux-utils
|
||||
-Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils
|
||||
-Requires(postun): policycoreutils
|
||||
+Requires: policycoreutils-python-utils, libselinux-utils
|
||||
+Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils-python-utils
|
||||
+Requires(postun): policycoreutils-python-utils
|
||||
"""
|
||||
|
||||
mid_section="""\
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,455 +0,0 @@
|
||||
From 9bef6943871822d82a3428dda13a871e1848acad Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Tue, 16 May 2023 15:45:05 +0200
|
||||
Subject: [PATCH] python: improve format strings for proper localization
|
||||
Content-type: text/plain
|
||||
|
||||
If a string contains more than one unnamed argument it's hard for
|
||||
translators to proper localize as they don't know which value is
|
||||
represented by a unnamed argument. It also blocks them to use a
|
||||
different order of arguments which would make better sense in other
|
||||
languages.
|
||||
|
||||
Fixes:
|
||||
|
||||
$ xgettext --default-domain=python -L Python --keyword=_ --keyword=N_ ../audit2allow/audit2allow ../chcat/chcat ../semanage/semanage ../semanage/seobject.py ../sepolgen/src/sepolgen/interfaces.py ../sepolicy/sepolicy/generate.py ../sepolicy/sepolicy/gui.py ../sepolicy/sepolicy/__init__.py ../sepolicy/sepolicy/interface.py ../sepolicy/sepolicy.py
|
||||
../chcat/chcat:220: warning: 'msgid' format string with unnamed arguments cannot be properly localized:
|
||||
The translator cannot reorder the arguments.
|
||||
Please consider using a format string with named arguments,
|
||||
and a mapping instead of a tuple for the arguments.
|
||||
../semanage/seobject.py:1178: warning: 'msgid' format string with unnamed arguments cannot be properly localized:
|
||||
The translator cannot reorder the arguments.
|
||||
Please consider using a format string with named arguments,
|
||||
and a mapping instead of a tuple for the arguments.
|
||||
...
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/chcat/chcat | 6 +-
|
||||
python/semanage/seobject.py | 130 ++++++++++++++++++------------------
|
||||
2 files changed, 68 insertions(+), 68 deletions(-)
|
||||
|
||||
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
||||
index 68718ec5f102..c4f592291821 100755
|
||||
--- a/python/chcat/chcat
|
||||
+++ b/python/chcat/chcat
|
||||
@@ -125,7 +125,7 @@ def chcat_add(orig, newcat, objects, login_ind):
|
||||
|
||||
if len(clist) > 1:
|
||||
if cat in clist[1:]:
|
||||
- print(_("%s is already in %s") % (f, orig))
|
||||
+ print(_("{target} is already in {category}").format(target=f, category=orig))
|
||||
continue
|
||||
clist.append(cat)
|
||||
cats = clist[1:]
|
||||
@@ -207,7 +207,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
|
||||
|
||||
if len(clist) > 1:
|
||||
if cat not in clist[1:]:
|
||||
- print(_("%s is not in %s") % (f, orig))
|
||||
+ print(_("{target} is not in {category}").format(target=f, category=orig))
|
||||
continue
|
||||
clist.remove(cat)
|
||||
if len(clist) > 1:
|
||||
@@ -217,7 +217,7 @@ def chcat_remove(orig, newcat, objects, login_ind):
|
||||
else:
|
||||
cat = ""
|
||||
else:
|
||||
- print(_("%s is not in %s") % (f, orig))
|
||||
+ print(_("{target} is not in {category}").format(target=f, category=orig))
|
||||
continue
|
||||
|
||||
if len(cat) == 0:
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index d82da4942987..2b1eb44ce8a3 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -843,7 +843,7 @@ class seluserRecords(semanageRecords):
|
||||
for r in roles:
|
||||
rc = semanage_user_add_role(self.sh, u, r)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not add role %s for %s") % (r, name))
|
||||
+ raise ValueError(_("Could not add role {role} for {name}").format(role=r, name=name))
|
||||
|
||||
if is_mls_enabled == 1:
|
||||
rc = semanage_user_set_mlsrange(self.sh, u, serange)
|
||||
@@ -855,7 +855,7 @@ class seluserRecords(semanageRecords):
|
||||
raise ValueError(_("Could not set MLS level for %s") % name)
|
||||
rc = semanage_user_set_prefix(self.sh, u, prefix)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix))
|
||||
+ raise ValueError(_("Could not add prefix {prefix} for {role}").format(role=r, prefix=prefix))
|
||||
(rc, key) = semanage_user_key_extract(self.sh, u)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not extract key for %s") % name)
|
||||
@@ -1088,7 +1088,7 @@ class portRecords(semanageRecords):
|
||||
|
||||
(rc, k) = semanage_port_key_create(self.sh, low, high, proto_d)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not create a key for {proto}/{port}").format(proto=proto, port=port))
|
||||
return (k, proto_d, low, high)
|
||||
|
||||
def __add(self, port, proto, serange, type):
|
||||
@@ -1110,44 +1110,44 @@ class portRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_port_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
||||
+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port))
|
||||
if exists:
|
||||
- raise ValueError(_("Port %s/%s already defined") % (proto, port))
|
||||
+ raise ValueError(_("Port {proto}/{port} already defined").format(proto=proto, port=port))
|
||||
|
||||
(rc, p) = semanage_port_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create port for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not create port for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
semanage_port_set_proto(p, proto_d)
|
||||
semanage_port_set_range(p, low, high)
|
||||
(rc, con) = semanage_context_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not create context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_context_set_user(self.sh, con, "system_u")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set user in port context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not set user in port context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_context_set_role(self.sh, con, "object_r")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set role in port context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not set role in port context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_context_set_type(self.sh, con, type)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set type in port context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not set type in port context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
if (is_mls_enabled == 1) and (serange != ""):
|
||||
rc = semanage_context_set_mls(self.sh, con, serange)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set mls fields in port context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not set mls fields in port context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_port_set_con(self.sh, p, con)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set port context for %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not set port context for {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_port_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not add port %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not add port {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
semanage_context_free(con)
|
||||
semanage_port_key_free(k)
|
||||
@@ -1175,13 +1175,13 @@ class portRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_port_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
||||
+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port))
|
||||
if not exists:
|
||||
- raise ValueError(_("Port %s/%s is not defined") % (proto, port))
|
||||
+ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port))
|
||||
|
||||
(rc, p) = semanage_port_query(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not query port %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not query port {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
con = semanage_port_get_con(p)
|
||||
|
||||
@@ -1195,7 +1195,7 @@ class portRecords(semanageRecords):
|
||||
|
||||
rc = semanage_port_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not modify port %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not modify port {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
semanage_port_key_free(k)
|
||||
semanage_port_free(p)
|
||||
@@ -1241,19 +1241,19 @@ class portRecords(semanageRecords):
|
||||
(k, proto_d, low, high) = self.__genkey(port, proto)
|
||||
(rc, exists) = semanage_port_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
||||
+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port))
|
||||
if not exists:
|
||||
- raise ValueError(_("Port %s/%s is not defined") % (proto, port))
|
||||
+ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port))
|
||||
|
||||
(rc, exists) = semanage_port_exists_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
||||
+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port))
|
||||
if not exists:
|
||||
- raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port))
|
||||
+ raise ValueError(_("Port {proto}/{port} is defined in policy, cannot be deleted").format(proto=proto, port=port))
|
||||
|
||||
rc = semanage_port_del_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not delete port %s/%s") % (proto, port))
|
||||
+ raise ValueError(_("Could not delete port {proto}/{port}").format(proto=proto, port=port))
|
||||
|
||||
semanage_port_key_free(k)
|
||||
|
||||
@@ -1362,7 +1362,7 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
(rc, k) = semanage_ibpkey_key_create(self.sh, subnet_prefix, low, high)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not create a key for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
return (k, subnet_prefix, low, high)
|
||||
|
||||
def __add(self, pkey, subnet_prefix, serange, type):
|
||||
@@ -1384,44 +1384,44 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_ibpkey_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").formnat(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
if exists:
|
||||
- raise ValueError(_("ibpkey %s/%s already defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} already defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
(rc, p) = semanage_ibpkey_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create ibpkey for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not create ibpkey for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
semanage_ibpkey_set_subnet_prefix(self.sh, p, subnet_prefix)
|
||||
semanage_ibpkey_set_range(p, low, high)
|
||||
(rc, con) = semanage_context_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not create context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_context_set_user(self.sh, con, "system_u")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set user in ibpkey context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not set user in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_context_set_role(self.sh, con, "object_r")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set role in ibpkey context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not set role in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_context_set_type(self.sh, con, type)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set type in ibpkey context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not set type in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
if (is_mls_enabled == 1) and (serange != ""):
|
||||
rc = semanage_context_set_mls(self.sh, con, serange)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set mls fields in ibpkey context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not set mls fields in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_ibpkey_set_con(self.sh, p, con)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set ibpkey context for %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not set ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_ibpkey_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not add ibpkey %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not add ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
semanage_context_free(con)
|
||||
semanage_ibpkey_key_free(k)
|
||||
@@ -1448,13 +1448,13 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_ibpkey_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
(rc, p) = semanage_ibpkey_query(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not query ibpkey %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not query ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
con = semanage_ibpkey_get_con(p)
|
||||
|
||||
@@ -1465,7 +1465,7 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
rc = semanage_ibpkey_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not modify ibpkey %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not modify ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
semanage_ibpkey_key_free(k)
|
||||
semanage_ibpkey_free(p)
|
||||
@@ -1502,19 +1502,19 @@ class ibpkeyRecords(semanageRecords):
|
||||
(k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix)
|
||||
(rc, exists) = semanage_ibpkey_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
(rc, exists) = semanage_ibpkey_exists_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibpkey %s/%s is defined in policy, cannot be deleted") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deleted").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
rc = semanage_ibpkey_del_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not delete ibpkey %s/%s") % (subnet_prefix, pkey))
|
||||
+ raise ValueError(_("Could not delete ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
|
||||
semanage_ibpkey_key_free(k)
|
||||
|
||||
@@ -1617,7 +1617,7 @@ class ibendportRecords(semanageRecords):
|
||||
|
||||
(rc, k) = semanage_ibendport_key_create(self.sh, ibdev_name, port)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for ibendport %s/%s") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not create a key for ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
return (k, ibdev_name, port)
|
||||
|
||||
def __add(self, ibendport, ibdev_name, serange, type):
|
||||
@@ -1638,44 +1638,44 @@ class ibendportRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_ibendport_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{port} is defined").format(ibdev_name=ibdev_name, port=port))
|
||||
if exists:
|
||||
- raise ValueError(_("ibendport %s/%s already defined") % (ibdev_name, port))
|
||||
+ raise ValueError(_("ibendport {ibdev_name}/{port} already defined").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
(rc, p) = semanage_ibendport_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create ibendport for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not create ibendport for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
semanage_ibendport_set_ibdev_name(self.sh, p, ibdev_name)
|
||||
semanage_ibendport_set_port(p, port)
|
||||
(rc, con) = semanage_context_create(self.sh)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not create context for {ibendport}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_context_set_user(self.sh, con, "system_u")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set user in ibendport context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not set user in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_context_set_role(self.sh, con, "object_r")
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set role in ibendport context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not set role in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_context_set_type(self.sh, con, type)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set type in ibendport context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not set type in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
if (is_mls_enabled == 1) and (serange != ""):
|
||||
rc = semanage_context_set_mls(self.sh, con, serange)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set mls fields in ibendport context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not set mls fields in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_ibendport_set_con(self.sh, p, con)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not set ibendport context for %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not set ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_ibendport_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not add ibendport %s/%s") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not add ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
semanage_context_free(con)
|
||||
semanage_ibendport_key_free(k)
|
||||
@@ -1702,13 +1702,13 @@ class ibendportRecords(semanageRecords):
|
||||
|
||||
(rc, exists) = semanage_ibendport_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
(rc, p) = semanage_ibendport_query(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not query ibendport %s/%s") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not query ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
con = semanage_ibendport_get_con(p)
|
||||
|
||||
@@ -1719,7 +1719,7 @@ class ibendportRecords(semanageRecords):
|
||||
|
||||
rc = semanage_ibendport_modify_local(self.sh, k, p)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not modify ibendport %s/%s") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not modify ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
semanage_ibendport_key_free(k)
|
||||
semanage_ibendport_free(p)
|
||||
@@ -1741,11 +1741,11 @@ class ibendportRecords(semanageRecords):
|
||||
port = semanage_ibendport_get_port(ibendport)
|
||||
(k, ibdev_name, port) = self.__genkey(str(port), ibdev_name)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not create a key for %s/%d") % (ibdevname, port))
|
||||
+ raise ValueError(_("Could not create a key for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
|
||||
rc = semanage_ibendport_del_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not delete the ibendport %s/%d") % (ibdev_name, port))
|
||||
+ raise ValueError(_("Could not delete the ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port))
|
||||
semanage_ibendport_key_free(k)
|
||||
|
||||
self.commit()
|
||||
@@ -1754,19 +1754,19 @@ class ibendportRecords(semanageRecords):
|
||||
(k, ibdev_name, port) = self.__genkey(ibendport, ibdev_name)
|
||||
(rc, exists) = semanage_ibendport_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
(rc, exists) = semanage_ibendport_exists_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
if not exists:
|
||||
- raise ValueError(_("ibendport %s/%s is defined in policy, cannot be deleted") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deleted").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
rc = semanage_ibendport_del_local(self.sh, k)
|
||||
if rc < 0:
|
||||
- raise ValueError(_("Could not delete ibendport %s/%s") % (ibdev_name, ibendport))
|
||||
+ raise ValueError(_("Could not delete ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport))
|
||||
|
||||
semanage_ibendport_key_free(k)
|
||||
|
||||
@@ -2765,7 +2765,7 @@ class booleanRecords(semanageRecords):
|
||||
try:
|
||||
boolname, val = b.split("=")
|
||||
except ValueError:
|
||||
- raise ValueError(_("Bad format %s: Record %s" % (name, b)))
|
||||
+ raise ValueError(_("Bad format {filename}: Record {record}").format(filename=name, record=b))
|
||||
self.__mod(boolname.strip(), val.strip())
|
||||
fd.close()
|
||||
else:
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,24 @@
|
||||
From f8602180d042e95947fe0bbd35d261771b347705 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 8 Nov 2018 09:20:58 +0100
|
||||
Subject: [PATCH] semodule-utils: Fix RESOURCE_LEAK coverity scan defects
|
||||
|
||||
---
|
||||
semodule-utils/semodule_package/semodule_package.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/semodule-utils/semodule_package/semodule_package.c b/semodule-utils/semodule_package/semodule_package.c
|
||||
index 3515234e..7b75b3fd 100644
|
||||
--- a/semodule-utils/semodule_package/semodule_package.c
|
||||
+++ b/semodule-utils/semodule_package/semodule_package.c
|
||||
@@ -74,6 +74,7 @@ static int file_to_data(const char *path, char **data, size_t * len)
|
||||
}
|
||||
if (!sb.st_size) {
|
||||
*len = 0;
|
||||
+ close(fd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,148 +0,0 @@
|
||||
From 9001fe7d0d4007b5dac28422f46a9a605efefc0a Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Wed, 17 May 2023 12:18:54 +0200
|
||||
Subject: [PATCH] python: Drop hard formating from localized strings
|
||||
Content-type: text/plain
|
||||
|
||||
It confuses translators and new lines are dropped by parser module anyway.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/audit2allow/audit2allow | 14 ++++++--
|
||||
python/semanage/semanage | 60 +++++++++++++---------------------
|
||||
2 files changed, 34 insertions(+), 40 deletions(-)
|
||||
|
||||
diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
|
||||
index 5587a2dbb006..35b0b151ac86 100644
|
||||
--- a/python/audit2allow/audit2allow
|
||||
+++ b/python/audit2allow/audit2allow
|
||||
@@ -234,9 +234,17 @@ class AuditToPolicy:
|
||||
print(e)
|
||||
sys.exit(1)
|
||||
|
||||
- sys.stdout.write(_("******************** IMPORTANT ***********************\n"))
|
||||
- sys.stdout.write((_("To make this policy package active, execute:" +
|
||||
- "\n\nsemodule -i %s\n\n") % packagename))
|
||||
+ sys.stdout.write(
|
||||
+"""******************** {important} ***********************
|
||||
+{text}
|
||||
+
|
||||
+semodule -i {packagename}
|
||||
+
|
||||
+""".format(
|
||||
+ important=_("IMPORTANT"),
|
||||
+ text=_("To make this policy package active, execute:"),
|
||||
+ packagename=packagename
|
||||
+))
|
||||
|
||||
def __output_audit2why(self):
|
||||
import selinux
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index e0bd98a95c77..4fdb490f7df4 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -238,30 +238,22 @@ def parser_add_level(parser, name):
|
||||
|
||||
|
||||
def parser_add_range(parser, name):
|
||||
- parser.add_argument('-r', '--range', default='',
|
||||
- help=_('''
|
||||
-MLS/MCS Security Range (MLS/MCS Systems only)
|
||||
-SELinux Range for SELinux login mapping
|
||||
-defaults to the SELinux user record range.
|
||||
-SELinux Range for SELinux user defaults to s0.
|
||||
-'''))
|
||||
+ parser.add_argument('-r', '--range', default='', help=_(
|
||||
+ "MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. \
|
||||
+SELinux Range for SELinux user defaults to s0."
|
||||
+ ))
|
||||
|
||||
|
||||
def parser_add_proto(parser, name):
|
||||
- parser.add_argument('-p', '--proto', help=_('''
|
||||
- Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol
|
||||
- version for the specified node (ipv4|ipv6).
|
||||
-'''))
|
||||
+ parser.add_argument('-p', '--proto', help=_(
|
||||
+ "Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6)."
|
||||
+ ))
|
||||
|
||||
def parser_add_subnet_prefix(parser, name):
|
||||
- parser.add_argument('-x', '--subnet_prefix', help=_('''
|
||||
- Subnet prefix for the specified infiniband ibpkey.
|
||||
-'''))
|
||||
+ parser.add_argument('-x', '--subnet_prefix', help=_('Subnet prefix for the specified infiniband ibpkey.'))
|
||||
|
||||
def parser_add_ibdev_name(parser, name):
|
||||
- parser.add_argument('-z', '--ibdev_name', help=_('''
|
||||
- Name for the specified infiniband end port.
|
||||
-'''))
|
||||
+ parser.add_argument('-z', '--ibdev_name', help=_("Name for the specified infiniband end port."))
|
||||
|
||||
def parser_add_modify(parser, name):
|
||||
parser.add_argument('-m', '--modify', dest='action', action='store_const', const='modify', help=_("Modify a record of the %s object type") % name)
|
||||
@@ -348,15 +340,6 @@ def handleFcontext(args):
|
||||
|
||||
|
||||
def setupFcontextParser(subparsers):
|
||||
- ftype_help = '''
|
||||
-File Type. This is used with fcontext. Requires a file type
|
||||
-as shown in the mode field by ls, e.g. use d to match only
|
||||
-directories or f to match only regular files. The following
|
||||
-file type options can be passed:
|
||||
-f (regular file),d (directory),c (character device),
|
||||
-b (block device),s (socket),l (symbolic link),p (named pipe)
|
||||
-If you do not specify a file type, the file type will default to "all files".
|
||||
-'''
|
||||
generate_usage = generate_custom_usage(usage_fcontext, usage_fcontext_dict)
|
||||
fcontextParser = subparsers.add_parser('fcontext', usage=generate_usage, help=_("Manage file context mapping definitions"))
|
||||
parser_add_locallist(fcontextParser, "fcontext")
|
||||
@@ -372,11 +355,16 @@ If you do not specify a file type, the file type will default to "all files".
|
||||
parser_add_extract(fcontext_action, "fcontext")
|
||||
parser_add_deleteall(fcontext_action, "fcontext")
|
||||
|
||||
- fcontextParser.add_argument('-e', '--equal', help=_('''Substitute target path with sourcepath when generating default
|
||||
- label. This is used with fcontext. Requires source and target
|
||||
- path arguments. The context labeling for the target subtree is
|
||||
- made equivalent to that defined for the source.'''))
|
||||
- fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_(ftype_help))
|
||||
+ fcontextParser.add_argument('-e', '--equal', help=_(
|
||||
+ 'Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target \
|
||||
+path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.'
|
||||
+ ))
|
||||
+ fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_(
|
||||
+ 'File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use d to match only \
|
||||
+directories or f to match only regular files. The following file type options can be passed: f (regular file), d (directory), \
|
||||
+c (character device), b (block device), s (socket), l (symbolic link), p (named pipe). \
|
||||
+If you do not specify a file type, the file type will default to "all files".'
|
||||
+ ))
|
||||
parser_add_seuser(fcontextParser, "fcontext")
|
||||
parser_add_type(fcontextParser, "fcontext")
|
||||
parser_add_range(fcontextParser, "fcontext")
|
||||
@@ -426,9 +414,7 @@ def setupUserParser(subparsers):
|
||||
parser_add_range(userParser, "user")
|
||||
userParser.add_argument('-R', '--roles', default=[],
|
||||
action=CheckRole,
|
||||
- help=_('''
|
||||
-SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times.
|
||||
-'''))
|
||||
+ help=_("SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times."))
|
||||
userParser.add_argument('-P', '--prefix', default="user", help=argparse.SUPPRESS)
|
||||
userParser.add_argument('selinux_name', nargs='?', default=None, help=_('selinux_name'))
|
||||
userParser.set_defaults(func=handleUser)
|
||||
@@ -901,9 +887,9 @@ def setupImportParser(subparsers):
|
||||
def createCommandParser():
|
||||
commandParser = seParser(prog='semanage',
|
||||
formatter_class=argparse.ArgumentDefaultsHelpFormatter,
|
||||
- description='''semanage is used to configure certain elements
|
||||
- of SELinux policy with-out requiring modification
|
||||
- to or recompilation from policy source.''')
|
||||
+ description=_(
|
||||
+ "semanage is used to configure certain elements of SELinux policy with-out requiring modification or recompilation from policy source."
|
||||
+ ))
|
||||
|
||||
#To add a new subcommand define the parser for it in a function above and call it here.
|
||||
subparsers = commandParser.add_subparsers(dest='subcommand')
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,45 @@
|
||||
From b2512e2a92a33360639a3459039cdf2e685655a8 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 3 Dec 2018 14:40:09 +0100
|
||||
Subject: [PATCH] python: Use ipaddress instead of IPy
|
||||
|
||||
ipaddress module was added in python 3.3 and this allows us to drop python3-IPy
|
||||
---
|
||||
python/semanage/seobject.py | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index b90b1070..58497e3b 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -32,7 +32,7 @@ from semanage import *
|
||||
PROGNAME = "selinux-python"
|
||||
import sepolicy
|
||||
import setools
|
||||
-from IPy import IP
|
||||
+import ipaddress
|
||||
|
||||
try:
|
||||
import gettext
|
||||
@@ -1851,13 +1851,13 @@ class nodeRecords(semanageRecords):
|
||||
|
||||
# verify valid comination
|
||||
if len(mask) == 0 or mask[0] == "/":
|
||||
- i = IP(addr + mask)
|
||||
- newaddr = i.strNormal(0)
|
||||
- newmask = str(i.netmask())
|
||||
- if newmask == "0.0.0.0" and i.version() == 6:
|
||||
+ i = ipaddress.ip_network(addr + mask)
|
||||
+ newaddr = str(i.network_address)
|
||||
+ newmask = str(i.netmask)
|
||||
+ if newmask == "0.0.0.0" and i.version == 6:
|
||||
newmask = "::"
|
||||
|
||||
- protocol = "ipv%d" % i.version()
|
||||
+ protocol = "ipv%d" % i.version
|
||||
|
||||
try:
|
||||
newprotocol = self.protocol.index(protocol)
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -1,32 +0,0 @@
|
||||
From 0387db55278c10e04a7a507d2e1a6d028d5de0bf Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Wed, 17 May 2023 13:09:58 +0200
|
||||
Subject: [PATCH] semanage: Drop unnecessary import from seobject
|
||||
Content-type: text/plain
|
||||
|
||||
sepolgen.module is not used for permissive domains
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/semanage/seobject.py | 5 -----
|
||||
1 file changed, 5 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 2b1eb44ce8a3..361205d11c10 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -504,11 +504,6 @@ class permissiveRecords(semanageRecords):
|
||||
print(t)
|
||||
|
||||
def add(self, type):
|
||||
- try:
|
||||
- import sepolgen.module as module
|
||||
- except ImportError:
|
||||
- raise ValueError(_("The sepolgen python module is required to setup permissive domains.\nIn some distributions it is included in the policycoreutils-devel package.\n# yum install policycoreutils-devel\nOr similar for your distro."))
|
||||
-
|
||||
name = "permissive_%s" % type
|
||||
modtxt = "(typepermissive %s)" % type
|
||||
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,93 @@
|
||||
From 5938d18536f4c0a76521d1f0721e981e6570b012 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 4 Apr 2019 23:02:56 +0200
|
||||
Subject: [PATCH] python/semanage: Do not traceback when the default policy is
|
||||
not available
|
||||
|
||||
"import seobject" causes "import sepolicy" which crashes when the system policy
|
||||
is not available. It's better to provide an error message instead.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 37 +++++++++++++++++++++----------------
|
||||
1 file changed, 21 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 56db3e0d..4c766ae3 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -25,7 +25,6 @@
|
||||
|
||||
import traceback
|
||||
import argparse
|
||||
-import seobject
|
||||
import sys
|
||||
PROGNAME = "selinux-python"
|
||||
try:
|
||||
@@ -129,21 +128,6 @@ class SetImportFile(argparse.Action):
|
||||
sys.exit(1)
|
||||
setattr(namespace, self.dest, values)
|
||||
|
||||
-# define dictonary for seobject OBEJCTS
|
||||
-object_dict = {
|
||||
- 'login': seobject.loginRecords,
|
||||
- 'user': seobject.seluserRecords,
|
||||
- 'port': seobject.portRecords,
|
||||
- 'module': seobject.moduleRecords,
|
||||
- 'interface': seobject.interfaceRecords,
|
||||
- 'node': seobject.nodeRecords,
|
||||
- 'fcontext': seobject.fcontextRecords,
|
||||
- 'boolean': seobject.booleanRecords,
|
||||
- 'permissive': seobject.permissiveRecords,
|
||||
- 'dontaudit': seobject.dontauditClass,
|
||||
- 'ibpkey': seobject.ibpkeyRecords,
|
||||
- 'ibendport': seobject.ibendportRecords
|
||||
-}
|
||||
|
||||
def generate_custom_usage(usage_text, usage_dict):
|
||||
# generate custom usage from given text and dictonary
|
||||
@@ -608,6 +592,7 @@ def setupInterfaceParser(subparsers):
|
||||
|
||||
|
||||
def handleModule(args):
|
||||
+ import seobject
|
||||
OBJECT = seobject.moduleRecords(args)
|
||||
if args.action_add:
|
||||
OBJECT.add(args.action_add[0], args.priority)
|
||||
@@ -846,6 +831,7 @@ def mkargv(line):
|
||||
|
||||
|
||||
def handleImport(args):
|
||||
+ import seobject
|
||||
trans = seobject.semanageRecords(args)
|
||||
trans.start()
|
||||
|
||||
@@ -887,6 +873,25 @@ def createCommandParser():
|
||||
#To add a new subcommand define the parser for it in a function above and call it here.
|
||||
subparsers = commandParser.add_subparsers(dest='subcommand')
|
||||
subparsers.required = True
|
||||
+
|
||||
+ import seobject
|
||||
+ # define dictonary for seobject OBEJCTS
|
||||
+ global object_dict
|
||||
+ object_dict = {
|
||||
+ 'login': seobject.loginRecords,
|
||||
+ 'user': seobject.seluserRecords,
|
||||
+ 'port': seobject.portRecords,
|
||||
+ 'module': seobject.moduleRecords,
|
||||
+ 'interface': seobject.interfaceRecords,
|
||||
+ 'node': seobject.nodeRecords,
|
||||
+ 'fcontext': seobject.fcontextRecords,
|
||||
+ 'boolean': seobject.booleanRecords,
|
||||
+ 'permissive': seobject.permissiveRecords,
|
||||
+ 'dontaudit': seobject.dontauditClass,
|
||||
+ 'ibpkey': seobject.ibpkeyRecords,
|
||||
+ 'ibendport': seobject.ibendportRecords
|
||||
+ }
|
||||
+
|
||||
setupImportParser(subparsers)
|
||||
setupExportParser(subparsers)
|
||||
setupLoginParser(subparsers)
|
||||
--
|
||||
2.21.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,108 @@
|
||||
From 99582e3bf63475b7af5793bb9230e88d847dc7c8 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 2 Jul 2019 17:11:32 +0200
|
||||
Subject: [PATCH] policycoreutils/fixfiles: Fix [-B] [-F] onboot
|
||||
|
||||
Commit 6e289bb7bf3d ("policycoreutils: fixfiles: remove bad modes of "relabel"
|
||||
command") added "$RESTORE_MODE" != DEFAULT test when onboot is used. It makes
|
||||
`fixfiles -B onboot` to show usage instead of updating /.autorelabel
|
||||
|
||||
The code is restructured to handle -B for different modes correctly.
|
||||
|
||||
Fixes:
|
||||
# fixfiles -B onboot
|
||||
Usage: /usr/sbin/fixfiles [-v] [-F] [-f] relabel
|
||||
...
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
policycoreutils/scripts/fixfiles | 29 +++++++++++++++--------------
|
||||
1 file changed, 15 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||
index 53d28c7b..9dd44213 100755
|
||||
--- a/policycoreutils/scripts/fixfiles
|
||||
+++ b/policycoreutils/scripts/fixfiles
|
||||
@@ -112,7 +112,7 @@ VERBOSE="-p"
|
||||
FORCEFLAG=""
|
||||
RPMFILES=""
|
||||
PREFC=""
|
||||
-RESTORE_MODE="DEFAULT"
|
||||
+RESTORE_MODE=""
|
||||
SETFILES=/sbin/setfiles
|
||||
RESTORECON=/sbin/restorecon
|
||||
FILESYSTEMSRW=`get_rw_labeled_mounts`
|
||||
@@ -214,16 +214,17 @@ restore () {
|
||||
OPTION=$1
|
||||
shift
|
||||
|
||||
-case "$RESTORE_MODE" in
|
||||
- PREFC)
|
||||
- diff_filecontext $*
|
||||
- return
|
||||
- ;;
|
||||
- BOOTTIME)
|
||||
+# [-B | -N time ]
|
||||
+if [ -z "$BOOTTIME" ]; then
|
||||
newer $BOOTTIME $*
|
||||
return
|
||||
- ;;
|
||||
-esac
|
||||
+fi
|
||||
+
|
||||
+# -C PREVIOUS_FILECONTEXT
|
||||
+if [ "$RESTORE_MODE" == PREFC ]; then
|
||||
+ diff_filecontext $*
|
||||
+ return
|
||||
+fi
|
||||
|
||||
[ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
|
||||
|
||||
@@ -239,7 +240,7 @@ case "$RESTORE_MODE" in
|
||||
FILEPATH)
|
||||
${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -R -- "$FILEPATH"
|
||||
;;
|
||||
- DEFAULT)
|
||||
+ *)
|
||||
if [ -n "${FILESYSTEMSRW}" ]; then
|
||||
LogReadOnly
|
||||
echo "${OPTION}ing `echo ${FILESYSTEMSRW}`"
|
||||
@@ -272,7 +273,7 @@ fullrelabel() {
|
||||
|
||||
|
||||
relabel() {
|
||||
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||
+ if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
@@ -306,7 +307,7 @@ case "$1" in
|
||||
verify) restore Verify -n;;
|
||||
relabel) relabel;;
|
||||
onboot)
|
||||
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||
+ if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
@@ -344,7 +345,7 @@ if [ $# -eq 0 ]; then
|
||||
fi
|
||||
|
||||
set_restore_mode() {
|
||||
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||
+ if [ -n "$RESTORE_MODE" ]; then
|
||||
# can't specify two different modes
|
||||
usage
|
||||
exit 1
|
||||
@@ -357,7 +358,7 @@ while getopts "N:BC:FfR:l:v" i; do
|
||||
case "$i" in
|
||||
B)
|
||||
BOOTTIME=`/bin/who -b | awk '{print $3}'`
|
||||
- set_restore_mode BOOTTIME
|
||||
+ set_restore_mode DEFAULT
|
||||
;;
|
||||
N)
|
||||
BOOTTIME=$OPTARG
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,33 @@
|
||||
From 9bcf8ad7b9b6d8d761f7d097196b2b9bc114fa0a Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 2 Jul 2019 17:12:07 +0200
|
||||
Subject: [PATCH] policycoreutils/fixfiles: Force full relabel when SELinux is
|
||||
disabled
|
||||
|
||||
The previous check used getfilecon to check whether / slash contains a label,
|
||||
but getfilecon fails only when SELinux is disabled. Therefore it's better to
|
||||
check this using selinuxenabled.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
policycoreutils/scripts/fixfiles | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||
index 9dd44213..a9d27d13 100755
|
||||
--- a/policycoreutils/scripts/fixfiles
|
||||
+++ b/policycoreutils/scripts/fixfiles
|
||||
@@ -314,8 +314,8 @@ case "$1" in
|
||||
> /.autorelabel || exit $?
|
||||
[ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel
|
||||
[ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel
|
||||
- # Force full relabel if / does not have a label on it
|
||||
- getfilecon / > /dev/null 2>&1 || echo -F >/.autorelabel
|
||||
+ # Force full relabel if SELinux is not enabled
|
||||
+ selinuxenabled || echo -F > /.autorelabel
|
||||
echo "System will relabel on next boot"
|
||||
;;
|
||||
*)
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
From 7383f8fbab82826de21d3013a43680867642e49e Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 21 Aug 2019 17:43:25 +0200
|
||||
Subject: [PATCH] policycoreutils/fixfiles: Fix unbound variable problem
|
||||
|
||||
Fix a typo introduced in commit d3f8b2c3cd909 ("policycoreutils/fixfiles: Fix
|
||||
[-B] [-F] onboot"), which broke "fixfiles relabel":
|
||||
|
||||
#fixfiles relabel
|
||||
/sbin/fixfiles: line 151: $1: unbound variable
|
||||
|
||||
Resolves: rhbz#1743213
|
||||
---
|
||||
policycoreutils/scripts/fixfiles | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||
index a9d27d13..df0042aa 100755
|
||||
--- a/policycoreutils/scripts/fixfiles
|
||||
+++ b/policycoreutils/scripts/fixfiles
|
||||
@@ -215,7 +215,7 @@ OPTION=$1
|
||||
shift
|
||||
|
||||
# [-B | -N time ]
|
||||
-if [ -z "$BOOTTIME" ]; then
|
||||
+if [ -n "$BOOTTIME" ]; then
|
||||
newer $BOOTTIME $*
|
||||
return
|
||||
fi
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,38 @@
|
||||
From f6c67c02f25d3a8971dcc5667121236fab85dd65 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 29 Aug 2019 08:58:20 +0200
|
||||
Subject: [PATCH] gui: Fix remove module in system-config-selinux
|
||||
|
||||
When a user tried to remove a policy module with priority other than 400 via
|
||||
GUI, it failed with a message:
|
||||
|
||||
libsemanage.semanage_direct_remove_key: Unable to remove module somemodule at priority 400. (No such file or directory).
|
||||
|
||||
This is fixed by calling "semodule -x PRIORITY -r NAME" instead of
|
||||
"semodule -r NAME".
|
||||
|
||||
From Jono Hein <fredwacko40@hotmail.com>
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
gui/modulesPage.py | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||
index 26ac5404..35a0129b 100644
|
||||
--- a/gui/modulesPage.py
|
||||
+++ b/gui/modulesPage.py
|
||||
@@ -125,9 +125,10 @@ class modulesPage(semanagePage):
|
||||
def delete(self):
|
||||
store, iter = self.view.get_selection().get_selected()
|
||||
module = store.get_value(iter, 0)
|
||||
+ priority = store.get_value(iter, 1)
|
||||
try:
|
||||
self.wait()
|
||||
- status, output = getstatusoutput("semodule -r %s" % module)
|
||||
+ status, output = getstatusoutput("semodule -X %s -r %s" % (priority, module))
|
||||
self.ready()
|
||||
if status != 0:
|
||||
self.error(output)
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,30 @@
|
||||
From c2e942fc452bff06cc5ed9017afe169c6941f4e4 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 3 Sep 2019 15:17:27 +0200
|
||||
Subject: [PATCH] python/semanage: Do not use default s0 range in "semanage
|
||||
login -a"
|
||||
|
||||
Using the "s0" default means that new login mappings are always added with "s0"
|
||||
range instead of the range of SELinux user.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 4c766ae3..fa78afce 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -221,7 +221,7 @@ def parser_add_level(parser, name):
|
||||
|
||||
|
||||
def parser_add_range(parser, name):
|
||||
- parser.add_argument('-r', '--range', default="s0",
|
||||
+ parser.add_argument('-r', '--range', default='',
|
||||
help=_('''
|
||||
MLS/MCS Security Range (MLS/MCS Systems only)
|
||||
SELinux Range for SELinux login mapping
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,33 @@
|
||||
From 4733a594c5df14f64293d19f16498e68dc5e3a98 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 24 Sep 2019 08:41:30 +0200
|
||||
Subject: [PATCH] policycoreutils/fixfiles: Fix "verify" option
|
||||
|
||||
"restorecon -n" (used in the "restore" function) has to be used with
|
||||
"-v" to display the files whose labels would be changed.
|
||||
|
||||
Fixes:
|
||||
Fixfiles verify does not report misslabelled files unless "-v" option is
|
||||
used.
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
policycoreutils/scripts/fixfiles | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||
index df0042aa..be19e56c 100755
|
||||
--- a/policycoreutils/scripts/fixfiles
|
||||
+++ b/policycoreutils/scripts/fixfiles
|
||||
@@ -304,7 +304,7 @@ process() {
|
||||
case "$1" in
|
||||
restore) restore Relabel;;
|
||||
check) VERBOSE="-v"; restore Check -n;;
|
||||
- verify) restore Verify -n;;
|
||||
+ verify) VERBOSE="-v"; restore Verify -n;;
|
||||
relabel) relabel;;
|
||||
onboot)
|
||||
if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,102 @@
|
||||
From 0803fcb2c014b2cedf8f4d92b80fc382916477ee Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Fri, 27 Sep 2019 16:13:47 +0200
|
||||
Subject: [PATCH] python/semanage: Improve handling of "permissive" statements
|
||||
|
||||
- Add "customized" method to permissiveRecords which is than used for
|
||||
"semanage permissive --extract" and "semanage export"
|
||||
- Enable "semanage permissive --deleteall" (already implemented)
|
||||
- Add "permissive" to the list of modules exported using
|
||||
"semanage export"
|
||||
- Update "semanage permissive" man page
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 11 ++++++++---
|
||||
python/semanage/semanage-permissive.8 | 8 +++++++-
|
||||
python/semanage/seobject.py | 3 +++
|
||||
3 files changed, 18 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index fa78afce..b2bd9df9 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -722,6 +722,11 @@ def handlePermissive(args):
|
||||
|
||||
if args.action == "list":
|
||||
OBJECT.list(args.noheading)
|
||||
+ elif args.action == "deleteall":
|
||||
+ OBJECT.deleteall()
|
||||
+ elif args.action == "extract":
|
||||
+ for i in OBJECT.customized():
|
||||
+ print("permissive %s" % str(i))
|
||||
elif args.type is not None:
|
||||
if args.action == "add":
|
||||
OBJECT.add(args.type)
|
||||
@@ -737,9 +742,9 @@ def setupPermissiveParser(subparsers):
|
||||
pgroup = permissiveParser.add_mutually_exclusive_group(required=True)
|
||||
parser_add_add(pgroup, "permissive")
|
||||
parser_add_delete(pgroup, "permissive")
|
||||
+ parser_add_deleteall(pgroup, "permissive")
|
||||
+ parser_add_extract(pgroup, "permissive")
|
||||
parser_add_list(pgroup, "permissive")
|
||||
- #TODO: probably should be also added => need to implement own option handling
|
||||
- #parser_add_deleteall(pgroup)
|
||||
|
||||
parser_add_noheading(permissiveParser, "permissive")
|
||||
parser_add_noreload(permissiveParser, "permissive")
|
||||
@@ -763,7 +768,7 @@ def setupDontauditParser(subparsers):
|
||||
|
||||
|
||||
def handleExport(args):
|
||||
- manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey"]
|
||||
+ manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey", "permissive"]
|
||||
for i in manageditems:
|
||||
print("%s -D" % i)
|
||||
for i in manageditems:
|
||||
diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
|
||||
index 1999a451..5c3364fa 100644
|
||||
--- a/python/semanage/semanage-permissive.8
|
||||
+++ b/python/semanage/semanage-permissive.8
|
||||
@@ -2,7 +2,7 @@
|
||||
.SH "NAME"
|
||||
.B semanage\-permissive \- SELinux Policy Management permissive mapping tool
|
||||
.SH "SYNOPSIS"
|
||||
-.B semanage permissive [\-h] (\-a | \-d | \-l) [\-n] [\-N] [\-S STORE] [type]
|
||||
+.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module.
|
||||
@@ -18,9 +18,15 @@ Add a record of the specified object type
|
||||
.I \-d, \-\-delete
|
||||
Delete a record of the specified object type
|
||||
.TP
|
||||
+.I \-D, \-\-deleteall
|
||||
+Remove all local customizations of permissive domains
|
||||
+.TP
|
||||
.I \-l, \-\-list
|
||||
List records of the specified object type
|
||||
.TP
|
||||
+.I \-E, \-\-extract
|
||||
+Extract customizable commands, for use within a transaction
|
||||
+.TP
|
||||
.I \-n, \-\-noheading
|
||||
Do not print heading when listing the specified object type
|
||||
.TP
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 58497e3b..3959abc8 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -478,6 +478,9 @@ class permissiveRecords(semanageRecords):
|
||||
l.append(name.split("permissive_")[1])
|
||||
return l
|
||||
|
||||
+ def customized(self):
|
||||
+ return ["-a %s" % x for x in sorted(self.get_all())]
|
||||
+
|
||||
def list(self, heading=1, locallist=0):
|
||||
all = [y["name"] for y in [x for x in sepolicy.info(sepolicy.TYPE) if x["permissive"]]]
|
||||
if len(all) == 0:
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,41 @@
|
||||
From 7cc31c4799dd94ed516a39d853744bd1ffb6dc69 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 30 Sep 2019 09:49:04 +0200
|
||||
Subject: [PATCH] python/semanage: fix moduleRecords.customized()
|
||||
|
||||
Return value of "customized" has to be iterable.
|
||||
|
||||
Fixes:
|
||||
"semanage export" with no modules in the system (eg. monolithic policy)
|
||||
crashes:
|
||||
|
||||
Traceback (most recent call last):
|
||||
File "/usr/sbin/semanage", line 970, in <module>
|
||||
do_parser()
|
||||
File "/usr/sbin/semanage", line 949, in do_parser
|
||||
args.func(args)
|
||||
File "/usr/sbin/semanage", line 771, in handleExport
|
||||
for c in OBJECT.customized():
|
||||
TypeError: 'NoneType' object is not iterable
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/seobject.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 3959abc8..16edacaa 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -380,7 +380,7 @@ class moduleRecords(semanageRecords):
|
||||
def customized(self):
|
||||
all = self.get_all()
|
||||
if len(all) == 0:
|
||||
- return
|
||||
+ return []
|
||||
return ["-d %s" % x[0] for x in [t for t in all if t[1] == 0]]
|
||||
|
||||
def list(self, heading=1, locallist=0):
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,45 @@
|
||||
From 7cbfcec89a6972f9c700687ed3cef25ff0846461 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 8 Oct 2019 14:22:13 +0200
|
||||
Subject: [PATCH] python/semanage: Add support for DCCP and SCTP protocols
|
||||
|
||||
Fixes:
|
||||
# semanage port -a -p sctp -t port_t 1234
|
||||
ValueError: Protocol udp or tcp is required
|
||||
# semanage port -d -p sctp -t port_t 1234
|
||||
ValueError: Protocol udp or tcp is required
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/seobject.py | 14 ++++++++------
|
||||
1 file changed, 8 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 16edacaa..70ebfd08 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -1058,13 +1058,15 @@ class portRecords(semanageRecords):
|
||||
pass
|
||||
|
||||
def __genkey(self, port, proto):
|
||||
- if proto == "tcp":
|
||||
- proto_d = SEMANAGE_PROTO_TCP
|
||||
+ protocols = {"tcp": SEMANAGE_PROTO_TCP,
|
||||
+ "udp": SEMANAGE_PROTO_UDP,
|
||||
+ "sctp": SEMANAGE_PROTO_SCTP,
|
||||
+ "dccp": SEMANAGE_PROTO_DCCP}
|
||||
+
|
||||
+ if proto in protocols.keys():
|
||||
+ proto_d = protocols[proto]
|
||||
else:
|
||||
- if proto == "udp":
|
||||
- proto_d = SEMANAGE_PROTO_UDP
|
||||
- else:
|
||||
- raise ValueError(_("Protocol udp or tcp is required"))
|
||||
+ raise ValueError(_("Protocol has to be one of udp, tcp, dccp or sctp"))
|
||||
if port == "":
|
||||
raise ValueError(_("Port is required"))
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,40 @@
|
||||
From 6e5ccf2dd3329b400b70b7806b9c6128c5c50995 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Fri, 15 Nov 2019 09:15:49 +0100
|
||||
Subject: [PATCH] dbus: Fix FileNotFoundError in org.selinux.relabel_on_boot
|
||||
|
||||
When org.selinux.relabel_on_boot(0) was called twice, it failed with
|
||||
FileNotFoundError.
|
||||
|
||||
Fixes:
|
||||
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:1
|
||||
method return sender=:1.53 -> dest=:1.54 reply_serial=2
|
||||
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
|
||||
method return sender=:1.53 -> dest=:1.55 reply_serial=2
|
||||
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
|
||||
Error org.freedesktop.DBus.Python.FileNotFoundError: FileNotFoundError: [Errno 2] No such file or directory: '/.autorelabel'
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
dbus/selinux_server.py | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
|
||||
index b9debc071485..be4f4557a9fa 100644
|
||||
--- a/dbus/selinux_server.py
|
||||
+++ b/dbus/selinux_server.py
|
||||
@@ -85,7 +85,10 @@ class selinux_server(slip.dbus.service.Object):
|
||||
fd = open("/.autorelabel", "w")
|
||||
fd.close()
|
||||
else:
|
||||
- os.unlink("/.autorelabel")
|
||||
+ try:
|
||||
+ os.unlink("/.autorelabel")
|
||||
+ except FileNotFoundError:
|
||||
+ pass
|
||||
|
||||
def write_selinux_config(self, enforcing=None, policy=None):
|
||||
path = selinux.selinux_path() + "config"
|
||||
--
|
||||
2.23.0
|
||||
|
||||
@ -0,0 +1,200 @@
|
||||
From 76371721bafed56efcb7a83b3fa3285383ede5b7 Mon Sep 17 00:00:00 2001
|
||||
From: Baichuan Kong <kongbaichuan@huawei.com>
|
||||
Date: Thu, 14 Nov 2019 10:48:07 +0800
|
||||
Subject: [PATCH] restorecond: Fix redundant console log output error
|
||||
|
||||
When starting restorecond without any option the following redundant
|
||||
console log is outputed:
|
||||
|
||||
/dev/log 100.0%
|
||||
/var/volatile/run/syslogd.pid 100.0%
|
||||
...
|
||||
|
||||
This is caused by two global variables of same name r_opts. When
|
||||
executes r_opts = opts in restore_init(), it originally intends
|
||||
to assign the address of struct r_opts in "restorecond.c" to the
|
||||
pointer *r_opts in "restore.c".
|
||||
|
||||
However, the address is assigned to the struct r_opts and covers
|
||||
the value of low eight bytes in it. That causes unexpected value
|
||||
of member varibale 'nochange' and 'verbose' in struct r_opts, thus
|
||||
affects value of 'restorecon_flags' and executes unexpected operations
|
||||
when restorecon the files such as the redundant console log output or
|
||||
file label nochange.
|
||||
|
||||
Cause restorecond/restore.c is copied from policycoreutils/setfiles,
|
||||
which share the same pattern. It also has potential risk to generate
|
||||
same problems, So fix it in case.
|
||||
|
||||
Signed-off-by: Baichuan Kong <kongbaichuan@huawei.com>
|
||||
|
||||
(cherry-picked from SElinuxProject
|
||||
commit ad2208ec220f55877a4d31084be2b4d6413ee082)
|
||||
|
||||
Resolves: rhbz#1626468
|
||||
---
|
||||
policycoreutils/setfiles/restore.c | 42 ++++++++++++++----------------
|
||||
restorecond/restore.c | 40 +++++++++++++---------------
|
||||
2 files changed, 37 insertions(+), 45 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
|
||||
index 9dea5656..d3335d1a 100644
|
||||
--- a/policycoreutils/setfiles/restore.c
|
||||
+++ b/policycoreutils/setfiles/restore.c
|
||||
@@ -17,40 +17,37 @@
|
||||
char **exclude_list;
|
||||
int exclude_count;
|
||||
|
||||
-struct restore_opts *r_opts;
|
||||
-
|
||||
void restore_init(struct restore_opts *opts)
|
||||
{
|
||||
int rc;
|
||||
|
||||
- r_opts = opts;
|
||||
struct selinux_opt selinux_opts[] = {
|
||||
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
||||
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
||||
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
||||
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
||||
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
||||
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
||||
};
|
||||
|
||||
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||
- if (!r_opts->hnd) {
|
||||
- perror(r_opts->selabel_opt_path);
|
||||
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||
+ if (!opts->hnd) {
|
||||
+ perror(opts->selabel_opt_path);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- r_opts->restorecon_flags = 0;
|
||||
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
||||
- r_opts->progress | r_opts->set_specctx |
|
||||
- r_opts->add_assoc | r_opts->ignore_digest |
|
||||
- r_opts->recurse | r_opts->userealpath |
|
||||
- r_opts->xdev | r_opts->abort_on_error |
|
||||
- r_opts->syslog_changes | r_opts->log_matches |
|
||||
- r_opts->ignore_noent | r_opts->ignore_mounts |
|
||||
- r_opts->mass_relabel;
|
||||
+ opts->restorecon_flags = 0;
|
||||
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
||||
+ opts->progress | opts->set_specctx |
|
||||
+ opts->add_assoc | opts->ignore_digest |
|
||||
+ opts->recurse | opts->userealpath |
|
||||
+ opts->xdev | opts->abort_on_error |
|
||||
+ opts->syslog_changes | opts->log_matches |
|
||||
+ opts->ignore_noent | opts->ignore_mounts |
|
||||
+ opts->mass_relabel;
|
||||
|
||||
/* Use setfiles, restorecon and restorecond own handles */
|
||||
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
||||
+ selinux_restorecon_set_sehandle(opts->hnd);
|
||||
|
||||
- if (r_opts->rootpath) {
|
||||
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
||||
+ if (opts->rootpath) {
|
||||
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
||||
if (rc) {
|
||||
fprintf(stderr,
|
||||
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
||||
@@ -81,7 +78,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||
size_t i = 0;
|
||||
int len, rc, errors;
|
||||
|
||||
- r_opts = opts;
|
||||
memset(&globbuf, 0, sizeof(globbuf));
|
||||
|
||||
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
||||
@@ -96,7 +92,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
||||
continue;
|
||||
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
||||
- r_opts->restorecon_flags);
|
||||
+ opts->restorecon_flags);
|
||||
if (rc < 0)
|
||||
errors = rc;
|
||||
}
|
||||
diff --git a/restorecond/restore.c b/restorecond/restore.c
|
||||
index f6e30001..b93b5fdb 100644
|
||||
--- a/restorecond/restore.c
|
||||
+++ b/restorecond/restore.c
|
||||
@@ -12,39 +12,36 @@
|
||||
char **exclude_list;
|
||||
int exclude_count;
|
||||
|
||||
-struct restore_opts *r_opts;
|
||||
-
|
||||
void restore_init(struct restore_opts *opts)
|
||||
{
|
||||
int rc;
|
||||
|
||||
- r_opts = opts;
|
||||
struct selinux_opt selinux_opts[] = {
|
||||
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
||||
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
||||
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
||||
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
||||
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
||||
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
||||
};
|
||||
|
||||
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||
- if (!r_opts->hnd) {
|
||||
- perror(r_opts->selabel_opt_path);
|
||||
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||
+ if (!opts->hnd) {
|
||||
+ perror(opts->selabel_opt_path);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- r_opts->restorecon_flags = 0;
|
||||
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
||||
- r_opts->progress | r_opts->set_specctx |
|
||||
- r_opts->add_assoc | r_opts->ignore_digest |
|
||||
- r_opts->recurse | r_opts->userealpath |
|
||||
- r_opts->xdev | r_opts->abort_on_error |
|
||||
- r_opts->syslog_changes | r_opts->log_matches |
|
||||
- r_opts->ignore_noent | r_opts->ignore_mounts;
|
||||
+ opts->restorecon_flags = 0;
|
||||
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
||||
+ opts->progress | opts->set_specctx |
|
||||
+ opts->add_assoc | opts->ignore_digest |
|
||||
+ opts->recurse | opts->userealpath |
|
||||
+ opts->xdev | opts->abort_on_error |
|
||||
+ opts->syslog_changes | opts->log_matches |
|
||||
+ opts->ignore_noent | opts->ignore_mounts;
|
||||
|
||||
/* Use setfiles, restorecon and restorecond own handles */
|
||||
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
||||
+ selinux_restorecon_set_sehandle(opts->hnd);
|
||||
|
||||
- if (r_opts->rootpath) {
|
||||
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
||||
+ if (opts->rootpath) {
|
||||
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
||||
if (rc) {
|
||||
fprintf(stderr,
|
||||
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
||||
@@ -75,7 +72,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||
size_t i = 0;
|
||||
int len, rc, errors;
|
||||
|
||||
- r_opts = opts;
|
||||
memset(&globbuf, 0, sizeof(globbuf));
|
||||
|
||||
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
||||
@@ -90,7 +86,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
||||
continue;
|
||||
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
||||
- r_opts->restorecon_flags);
|
||||
+ opts->restorecon_flags);
|
||||
if (rc < 0)
|
||||
errors = rc;
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,55 @@
|
||||
From 0bed778c53a4f93b1b092b3db33e8c36aabfa39d Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 5 Jan 2021 17:00:21 +0100
|
||||
Subject: [PATCH] python/semanage: empty stdout before exiting on
|
||||
BrokenPipeError
|
||||
|
||||
Empty stdout buffer before exiting when BrokenPipeError is
|
||||
encountered. Otherwise python will flush the bufer during exit, which
|
||||
may trigger the exception again.
|
||||
https://docs.python.org/3/library/signal.html#note-on-sigpipe
|
||||
|
||||
Fixes:
|
||||
#semanage fcontext -l | egrep -q -e '^/home'
|
||||
BrokenPipeError: [Errno 32] Broken pipe
|
||||
Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='UTF-8'>
|
||||
BrokenPipeError: [Errno 32] Broken pipe
|
||||
|
||||
Note that the error above only appears occasionally (usually only the
|
||||
first line is printed).
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||
---
|
||||
python/semanage/semanage | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index b2bd9df9..1abe3536 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -26,6 +26,7 @@
|
||||
import traceback
|
||||
import argparse
|
||||
import sys
|
||||
+import os
|
||||
PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
@@ -953,6 +954,13 @@ def do_parser():
|
||||
args = commandParser.parse_args(make_args(sys.argv))
|
||||
args.func(args)
|
||||
sys.exit(0)
|
||||
+ except BrokenPipeError as e:
|
||||
+ sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
|
||||
+ # Python flushes standard streams on exit; redirect remaining output
|
||||
+ # to devnull to avoid another BrokenPipeError at shutdown
|
||||
+ devnull = os.open(os.devnull, os.O_WRONLY)
|
||||
+ os.dup2(devnull, sys.stdout.fileno())
|
||||
+ sys.exit(1)
|
||||
except IOError as e:
|
||||
sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
|
||||
sys.exit(1)
|
||||
--
|
||||
2.29.2
|
||||
|
||||
@ -0,0 +1,41 @@
|
||||
From 4b0e627d42f9a8e09dcd064a6ae897f4c2e9cf6c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 6 Jan 2021 10:00:07 +0100
|
||||
Subject: [PATCH] python/semanage: Sort imports in alphabetical order
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 1abe3536..781e8645 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -23,10 +23,12 @@
|
||||
#
|
||||
#
|
||||
|
||||
-import traceback
|
||||
import argparse
|
||||
-import sys
|
||||
import os
|
||||
+import re
|
||||
+import sys
|
||||
+import traceback
|
||||
+
|
||||
PROGNAME = "selinux-python"
|
||||
try:
|
||||
import gettext
|
||||
@@ -786,8 +788,6 @@ def setupExportParser(subparsers):
|
||||
exportParser.add_argument('-f', '--output_file', dest='output_file', action=SetExportFile, help=_('Output file'))
|
||||
exportParser.set_defaults(func=handleExport)
|
||||
|
||||
-import re
|
||||
-
|
||||
|
||||
def mkargv(line):
|
||||
dquote = "\""
|
||||
--
|
||||
2.29.2
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
From e0a1cdb6181bcf3a23fe63b8e67fd5020e81d05e Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Fri, 22 Jan 2021 16:25:52 +0100
|
||||
Subject: [PATCH] python/sepolgen: allow any policy statement in if(n)def
|
||||
|
||||
"ifdef/ifndef" statements can be used to conditionally define
|
||||
an interface, but this syntax is not recognised by sepolgen-ifgen.
|
||||
Fix sepolgen-ifgen to allow any policy statement inside an
|
||||
"ifdef/ifndef" statement.
|
||||
|
||||
Fixes:
|
||||
$ cat <<EOF > i.if
|
||||
ifndef(`apache_manage_pid_files',`
|
||||
interface(`apache_manage_pid_files',`
|
||||
manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
|
||||
')
|
||||
')
|
||||
|
||||
#sepolgen-ifgen --interface=i.if
|
||||
i.if: Syntax error on line 2 interface [type=INTERFACE]
|
||||
i.if: Syntax error on line 4 ' [type=SQUOTE]
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
[OM: s/fidef/ifdef/]
|
||||
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
---
|
||||
python/sepolgen/src/sepolgen/refparser.py | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
|
||||
index f506dc3a..5d77e2a3 100644
|
||||
--- a/python/sepolgen/src/sepolgen/refparser.py
|
||||
+++ b/python/sepolgen/src/sepolgen/refparser.py
|
||||
@@ -431,9 +431,9 @@ def p_ifelse(p):
|
||||
|
||||
|
||||
def p_ifdef(p):
|
||||
- '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||
- | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||
- | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||
+ '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||
+ | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||
+ | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||
'''
|
||||
x = refpolicy.IfDef(p[4])
|
||||
if p[1] == 'ifdef':
|
||||
--
|
||||
2.29.2
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
From 53ccdd55adfbec60fb4277286f2ad94660838504 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Wed, 13 Jan 2021 22:09:47 +0100
|
||||
Subject: [PATCH] setfiles: Do not abort on labeling error
|
||||
|
||||
Commit 602347c7422e ("policycoreutils: setfiles - Modify to use
|
||||
selinux_restorecon") changed behavior of setfiles. Original
|
||||
implementation skipped files which it couldn't set context to while the
|
||||
new implementation aborts on them. setfiles should abort only if it
|
||||
can't validate a context from spec_file.
|
||||
|
||||
Reproducer:
|
||||
|
||||
# mkdir -p r/1 r/2 r/3
|
||||
# touch r/1/1 r/2/1
|
||||
# chattr +i r/2/1
|
||||
# touch r/3/1
|
||||
# setfiles -r r -v /etc/selinux/targeted/contexts/files/file_contexts r
|
||||
Relabeled r from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:root_t:s0
|
||||
Relabeled r/2 from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:default_t:s0
|
||||
setfiles: Could not set context for r/2/1: Operation not permitted
|
||||
|
||||
r/3 and r/1 are not relabeled.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
policycoreutils/setfiles/setfiles.c | 4 +---
|
||||
1 file changed, 1 insertion(+), 3 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||
index bc83c27b4c06..68eab45aa2b4 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.c
|
||||
+++ b/policycoreutils/setfiles/setfiles.c
|
||||
@@ -182,6 +182,7 @@ int main(int argc, char **argv)
|
||||
policyfile = NULL;
|
||||
nerr = 0;
|
||||
|
||||
+ r_opts.abort_on_error = 0;
|
||||
r_opts.progname = strdup(argv[0]);
|
||||
if (!r_opts.progname) {
|
||||
fprintf(stderr, "%s: Out of memory!\n", argv[0]);
|
||||
@@ -194,7 +195,6 @@ int main(int argc, char **argv)
|
||||
* setfiles:
|
||||
* Recursive descent,
|
||||
* Does not expand paths via realpath,
|
||||
- * Aborts on errors during the file tree walk,
|
||||
* Try to track inode associations for conflict detection,
|
||||
* Does not follow mounts (sets SELINUX_RESTORECON_XDEV),
|
||||
* Validates all file contexts at init time.
|
||||
@@ -202,7 +202,6 @@ int main(int argc, char **argv)
|
||||
iamrestorecon = 0;
|
||||
r_opts.recurse = SELINUX_RESTORECON_RECURSE;
|
||||
r_opts.userealpath = 0; /* SELINUX_RESTORECON_REALPATH */
|
||||
- r_opts.abort_on_error = SELINUX_RESTORECON_ABORT_ON_ERROR;
|
||||
r_opts.add_assoc = SELINUX_RESTORECON_ADD_ASSOC;
|
||||
/* FTS_PHYSICAL and FTS_NOCHDIR are always set by selinux_restorecon(3) */
|
||||
r_opts.xdev = SELINUX_RESTORECON_XDEV;
|
||||
@@ -226,7 +225,6 @@ int main(int argc, char **argv)
|
||||
iamrestorecon = 1;
|
||||
r_opts.recurse = 0;
|
||||
r_opts.userealpath = SELINUX_RESTORECON_REALPATH;
|
||||
- r_opts.abort_on_error = 0;
|
||||
r_opts.add_assoc = 0;
|
||||
r_opts.xdev = 0;
|
||||
r_opts.ignore_mounts = 0;
|
||||
--
|
||||
2.30.0
|
||||
|
||||
@ -0,0 +1,110 @@
|
||||
From 2f135022f4372dc34198c48cfd67b91044e6dfd7 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Wed, 13 Jan 2021 22:09:48 +0100
|
||||
Subject: [PATCH] setfiles: drop ABORT_ON_ERRORS and related code
|
||||
|
||||
`setfiles -d` doesn't have any impact on number of errors before it
|
||||
aborts. It always aborts on first invalid context in spec file.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
policycoreutils/setfiles/Makefile | 3 ---
|
||||
policycoreutils/setfiles/ru/setfiles.8 | 2 +-
|
||||
policycoreutils/setfiles/setfiles.8 | 3 +--
|
||||
policycoreutils/setfiles/setfiles.c | 18 ------------------
|
||||
4 files changed, 2 insertions(+), 24 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile
|
||||
index bc5a8db789a5..a3bbbe116b7f 100644
|
||||
--- a/policycoreutils/setfiles/Makefile
|
||||
+++ b/policycoreutils/setfiles/Makefile
|
||||
@@ -5,8 +5,6 @@ SBINDIR ?= /sbin
|
||||
MANDIR = $(PREFIX)/share/man
|
||||
AUDITH ?= $(shell test -f /usr/include/libaudit.h && echo y)
|
||||
|
||||
-ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }')
|
||||
-
|
||||
CFLAGS ?= -g -Werror -Wall -W
|
||||
override LDLIBS += -lselinux -lsepol
|
||||
|
||||
@@ -26,7 +24,6 @@ restorecon_xattr: restorecon_xattr.o restore.o
|
||||
|
||||
man:
|
||||
@cp -af setfiles.8 setfiles.8.man
|
||||
- @sed -i "s/ABORT_ON_ERRORS/$(ABORT_ON_ERRORS)/g" setfiles.8.man
|
||||
|
||||
install: all
|
||||
[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
|
||||
diff --git a/policycoreutils/setfiles/ru/setfiles.8 b/policycoreutils/setfiles/ru/setfiles.8
|
||||
index 27815a3f1eee..910101452625 100644
|
||||
--- a/policycoreutils/setfiles/ru/setfiles.8
|
||||
+++ b/policycoreutils/setfiles/ru/setfiles.8
|
||||
@@ -47,7 +47,7 @@ setfiles \- установить SELinux-контексты безопаснос
|
||||
проверить действительность контекстов относительно указанной двоичной политики.
|
||||
.TP
|
||||
.B \-d
|
||||
-показать, какая спецификация соответствует каждому из файлов (не прекращать проверку после получения ошибок ABORT_ON_ERRORS).
|
||||
+показать, какая спецификация соответствует каждому из файлов.
|
||||
.TP
|
||||
.BI \-e \ directory
|
||||
исключить каталог (чтобы исключить более одного каталога, этот параметр необходимо использовать соответствующее количество раз).
|
||||
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||
index a8a76c860dac..b7d3cefb96ff 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.8
|
||||
+++ b/policycoreutils/setfiles/setfiles.8
|
||||
@@ -56,8 +56,7 @@ option will force a replacement of the entire context.
|
||||
check the validity of the contexts against the specified binary policy.
|
||||
.TP
|
||||
.B \-d
|
||||
-show what specification matched each file (do not abort validation
|
||||
-after ABORT_ON_ERRORS errors). Not affected by "\-q"
|
||||
+show what specification matched each file. Not affected by "\-q"
|
||||
.TP
|
||||
.BI \-e \ directory
|
||||
directory to exclude (repeat option for more than one directory).
|
||||
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||
index 68eab45aa2b4..bcbdfbfe53e2 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.c
|
||||
+++ b/policycoreutils/setfiles/setfiles.c
|
||||
@@ -23,14 +23,6 @@ static int nerr;
|
||||
|
||||
#define STAT_BLOCK_SIZE 1
|
||||
|
||||
-/* setfiles will abort its operation after reaching the
|
||||
- * following number of errors (e.g. invalid contexts),
|
||||
- * unless it is used in "debug" mode (-d option).
|
||||
- */
|
||||
-#ifndef ABORT_ON_ERRORS
|
||||
-#define ABORT_ON_ERRORS 10
|
||||
-#endif
|
||||
-
|
||||
#define SETFILES "setfiles"
|
||||
#define RESTORECON "restorecon"
|
||||
static int iamrestorecon;
|
||||
@@ -57,15 +49,6 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
-void inc_err(void)
|
||||
-{
|
||||
- nerr++;
|
||||
- if (nerr > ABORT_ON_ERRORS - 1 && !r_opts.debug) {
|
||||
- fprintf(stderr, "Exiting after %d errors.\n", ABORT_ON_ERRORS);
|
||||
- exit(-1);
|
||||
- }
|
||||
-}
|
||||
-
|
||||
void set_rootpath(const char *arg)
|
||||
{
|
||||
if (strlen(arg) == 1 && strncmp(arg, "/", 1) == 0) {
|
||||
@@ -98,7 +81,6 @@ int canoncon(char **contextp)
|
||||
*contextp = tmpcon;
|
||||
} else if (errno != ENOENT) {
|
||||
rc = -1;
|
||||
- inc_err();
|
||||
}
|
||||
|
||||
return rc;
|
||||
--
|
||||
2.30.0
|
||||
|
||||
@ -0,0 +1,44 @@
|
||||
From a691da617a2d3c864786ff2742d9a9f87ecc7d05 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 1 Feb 2021 15:24:32 +0100
|
||||
Subject: [PATCH] policycoreutils/setfiles: Drop unused nerr variable
|
||||
|
||||
Suggested-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
policycoreutils/setfiles/setfiles.c | 5 -----
|
||||
1 file changed, 5 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||
index bcbdfbfe53e2..82d0aaa75893 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.c
|
||||
+++ b/policycoreutils/setfiles/setfiles.c
|
||||
@@ -19,7 +19,6 @@ static int warn_no_match;
|
||||
static int null_terminated;
|
||||
static int request_digest;
|
||||
static struct restore_opts r_opts;
|
||||
-static int nerr;
|
||||
|
||||
#define STAT_BLOCK_SIZE 1
|
||||
|
||||
@@ -162,7 +161,6 @@ int main(int argc, char **argv)
|
||||
warn_no_match = 0;
|
||||
request_digest = 0;
|
||||
policyfile = NULL;
|
||||
- nerr = 0;
|
||||
|
||||
r_opts.abort_on_error = 0;
|
||||
r_opts.progname = strdup(argv[0]);
|
||||
@@ -417,9 +415,6 @@ int main(int argc, char **argv)
|
||||
r_opts.selabel_opt_digest = (request_digest ? (char *)1 : NULL);
|
||||
r_opts.selabel_opt_path = altpath;
|
||||
|
||||
- if (nerr)
|
||||
- exit(-1);
|
||||
-
|
||||
restore_init(&r_opts);
|
||||
|
||||
if (use_input_file) {
|
||||
--
|
||||
2.30.0
|
||||
|
||||
@ -0,0 +1,62 @@
|
||||
From c556c6ad0b94cf3ba4b441a1a0930f2468434227 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 10 Feb 2021 18:05:29 +0100
|
||||
Subject: [PATCH] selinux(8,5): Describe fcontext regular expressions
|
||||
|
||||
Describe which type of regular expression is used in file context
|
||||
definitions and which flags are in effect.
|
||||
|
||||
Explain how local file context modifications are processed.
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 2 +-
|
||||
python/semanage/semanage-fcontext.8 | 18 ++++++++++++++++++
|
||||
2 files changed, 19 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 781e8645..ebb93ea5 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -366,7 +366,7 @@ If you do not specify a file type, the file type will default to "all files".
|
||||
parser_add_seuser(fcontextParser, "fcontext")
|
||||
parser_add_type(fcontextParser, "fcontext")
|
||||
parser_add_range(fcontextParser, "fcontext")
|
||||
- fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('file_spec'))
|
||||
+ fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
|
||||
fcontextParser.set_defaults(func=handleFcontext)
|
||||
|
||||
|
||||
diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
|
||||
index 561123af..49635ba7 100644
|
||||
--- a/python/semanage/semanage-fcontext.8
|
||||
+++ b/python/semanage/semanage-fcontext.8
|
||||
@@ -11,6 +11,24 @@ SELinux policy without requiring modification to or recompilation
|
||||
from policy sources. semanage fcontext is used to manage the default
|
||||
file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.
|
||||
|
||||
+FILE_SPEC may contain either a fully qualified path,
|
||||
+or a Perl compatible regular expression (PCRE),
|
||||
+describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL,
|
||||
+which causes a wildcard '.' to match anything, including a new line.
|
||||
+Strings representing paths are processed as bytes (as opposed to Unicode),
|
||||
+meaning that non-ASCII characters are not matched by a single wildcard.
|
||||
+
|
||||
+Note, that file context definitions specified using 'semanage fcontext'
|
||||
+(i.e. local file context modifications stored in file_contexts.local)
|
||||
+have higher priority than those specified in policy modules.
|
||||
+This means that whenever a match for given file path is found in
|
||||
+file_contexts.local, no other file context definitions are considered.
|
||||
+Entries in file_contexts.local are processed from most recent one to the oldest,
|
||||
+with first match being used (as opposed to the most specific match,
|
||||
+which is used when matching other file context definitions).
|
||||
+All regular expressions should therefore be as specific as possible,
|
||||
+to avoid unintentionally impacting other parts of the filesystem.
|
||||
+
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
.I \-h, \-\-help
|
||||
--
|
||||
2.29.2
|
||||
|
||||
@ -0,0 +1,69 @@
|
||||
From d10e773c014a12b17fefd9caef0bd02528d75d18 Mon Sep 17 00:00:00 2001
|
||||
From: Antoine Tenart <antoine.tenart@bootlin.com>
|
||||
Date: Tue, 7 Jul 2020 16:35:01 +0200
|
||||
Subject: [PATCH] policycoreutils: setfiles: do not restrict checks against a
|
||||
binary policy
|
||||
|
||||
The -c option allows to check the validity of contexts against a
|
||||
specified binary policy. Its use is restricted: no pathname can be used
|
||||
when a binary policy is given to setfiles. It's not clear if this is
|
||||
intentional as the built-in help and the man page are not stating the
|
||||
same thing about this (the man page document -c as a normal option,
|
||||
while the built-in help shows it is restricted).
|
||||
|
||||
When generating full system images later used with SELinux in enforcing
|
||||
mode, the extended attributed of files have to be set by the build
|
||||
machine. The issue is setfiles always checks the contexts against a
|
||||
policy (ctx_validate = 1) and using an external binary policy is not
|
||||
currently possible when using a pathname. This ends up in setfiles
|
||||
failing early as the contexts of the target image are not always
|
||||
compatible with the ones of the build machine.
|
||||
|
||||
This patch reworks a check on optind only made when -c is used, that
|
||||
enforced the use of a single argument to allow 1+ arguments, allowing to
|
||||
use setfiles with an external binary policy and pathnames. The following
|
||||
command is then allowed, as already documented in the man page:
|
||||
|
||||
$ setfiles -m -r target/ -c policy.32 file_contexts target/
|
||||
|
||||
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
|
||||
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
|
||||
|
||||
(cherry-picked from SElinuxProject
|
||||
commit: c94e542c98da2f26863c1cbd9d7ad9bc5cca6aff )
|
||||
---
|
||||
policycoreutils/setfiles/setfiles.c | 11 +++++------
|
||||
1 file changed, 5 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||
index 82d0aaa7..4fd3d756 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.c
|
||||
+++ b/policycoreutils/setfiles/setfiles.c
|
||||
@@ -39,11 +39,10 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
||||
name, name);
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n"
|
||||
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n"
|
||||
- "usage: %s -s [-diIDlmnpqvFW] spec_file\n"
|
||||
- "usage: %s -c policyfile spec_file\n",
|
||||
- name, name, name, name);
|
||||
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
|
||||
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
|
||||
+ "usage: %s -s [-diIDlmnpqvFW] spec_file\n",
|
||||
+ name, name, name);
|
||||
}
|
||||
exit(-1);
|
||||
}
|
||||
@@ -376,7 +375,7 @@ int main(int argc, char **argv)
|
||||
|
||||
if (!iamrestorecon) {
|
||||
if (policyfile) {
|
||||
- if (optind != (argc - 1))
|
||||
+ if (optind > (argc - 1))
|
||||
usage(argv[0]);
|
||||
} else if (use_input_file) {
|
||||
if (optind != (argc - 1)) {
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -0,0 +1,674 @@
|
||||
From e748832819b781507903838483376d308c90ca79 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 16 Nov 2021 14:27:11 +0100
|
||||
Subject: [PATCH] semodule: add -m | --checksum option
|
||||
|
||||
Since cil doesn't store module name and module version in module itself,
|
||||
there's no simple way how to compare that installed module is the same
|
||||
version as the module which is supposed to be installed. Even though the
|
||||
version was not used by semodule itself, it was apparently used by some
|
||||
team.
|
||||
|
||||
With `semodule -l --checksum` users get SHA256 hashes of modules and
|
||||
could compare them with their files which is faster than installing
|
||||
modules again and again.
|
||||
|
||||
E.g.
|
||||
|
||||
# time (
|
||||
semodule -l --checksum | grep localmodule
|
||||
/usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
|
||||
)
|
||||
localmodule db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd
|
||||
db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd -
|
||||
|
||||
real 0m0.876s
|
||||
user 0m0.849s
|
||||
sys 0m0.028s
|
||||
|
||||
vs
|
||||
|
||||
# time semodule -i localmodule.pp
|
||||
|
||||
real 0m6.147s
|
||||
user 0m5.800s
|
||||
sys 0m0.231s
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
policycoreutils/semodule/Makefile | 2 +-
|
||||
policycoreutils/semodule/semodule.8 | 6 +
|
||||
policycoreutils/semodule/semodule.c | 95 ++++++++-
|
||||
policycoreutils/semodule/sha256.c | 294 ++++++++++++++++++++++++++++
|
||||
policycoreutils/semodule/sha256.h | 89 +++++++++
|
||||
5 files changed, 480 insertions(+), 6 deletions(-)
|
||||
create mode 100644 policycoreutils/semodule/sha256.c
|
||||
create mode 100644 policycoreutils/semodule/sha256.h
|
||||
|
||||
diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
|
||||
index 73801e487a76..9875ac383280 100644
|
||||
--- a/policycoreutils/semodule/Makefile
|
||||
+++ b/policycoreutils/semodule/Makefile
|
||||
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
|
||||
|
||||
CFLAGS ?= -Werror -Wall -W
|
||||
override LDLIBS += -lsepol -lselinux -lsemanage
|
||||
-SEMODULE_OBJS = semodule.o
|
||||
+SEMODULE_OBJS = semodule.o sha256.o
|
||||
|
||||
all: semodule genhomedircon
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||
index 18d4f708661c..3a2fb21c2481 100644
|
||||
--- a/policycoreutils/semodule/semodule.8
|
||||
+++ b/policycoreutils/semodule/semodule.8
|
||||
@@ -95,6 +95,9 @@ only modules listed in \-\-extract after this option.
|
||||
.B \-H,\-\-hll
|
||||
Extract module as an HLL file. This only affects the \-\-extract option and
|
||||
only modules listed in \-\-extract after this option.
|
||||
+.TP
|
||||
+.B \-m,\-\-checksum
|
||||
+Add SHA256 checksum of modules to the list output.
|
||||
|
||||
.SH EXAMPLE
|
||||
.nf
|
||||
@@ -130,6 +133,9 @@ $ semodule \-B \-S "/tmp/var/lib/selinux"
|
||||
# Write the HLL version of puppet and the CIL version of wireshark
|
||||
# modules at priority 400 to the current working directory
|
||||
$ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark
|
||||
+# Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
|
||||
+$ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
|
||||
+$ semodule -l -m | grep localmodule
|
||||
.fi
|
||||
|
||||
.SH SEE ALSO
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index a76797f505cd..300a97d735cc 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -24,6 +24,8 @@
|
||||
|
||||
#include <semanage/modules.h>
|
||||
|
||||
+#include "sha256.h"
|
||||
+
|
||||
enum client_modes {
|
||||
NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
|
||||
LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
|
||||
@@ -56,6 +58,7 @@ static semanage_handle_t *sh = NULL;
|
||||
static char *store;
|
||||
static char *store_root;
|
||||
int extract_cil = 0;
|
||||
+static int checksum = 0;
|
||||
|
||||
extern char *optarg;
|
||||
extern int optind;
|
||||
@@ -146,6 +149,7 @@ static void usage(char *progname)
|
||||
printf(" -S,--store-path use an alternate path for the policy store root\n");
|
||||
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||
+ printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||
}
|
||||
|
||||
/* Sets the global mode variable to new_mode, but only if no other
|
||||
@@ -199,6 +203,7 @@ static void parse_command_line(int argc, char **argv)
|
||||
{"disable", required_argument, NULL, 'd'},
|
||||
{"path", required_argument, NULL, 'p'},
|
||||
{"store-path", required_argument, NULL, 'S'},
|
||||
+ {"checksum", 0, NULL, 'm'},
|
||||
{NULL, 0, NULL, 0}
|
||||
};
|
||||
int extract_selected = 0;
|
||||
@@ -209,7 +214,7 @@ static void parse_command_line(int argc, char **argv)
|
||||
no_reload = 0;
|
||||
priority = 400;
|
||||
while ((i =
|
||||
- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cH", opts,
|
||||
+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
|
||||
NULL)) != -1) {
|
||||
switch (i) {
|
||||
case 'b':
|
||||
@@ -286,6 +291,9 @@ static void parse_command_line(int argc, char **argv)
|
||||
case 'd':
|
||||
set_mode(DISABLE_M, optarg);
|
||||
break;
|
||||
+ case 'm':
|
||||
+ checksum = 1;
|
||||
+ break;
|
||||
case '?':
|
||||
default:{
|
||||
usage(argv[0]);
|
||||
@@ -337,6 +345,61 @@ static void parse_command_line(int argc, char **argv)
|
||||
}
|
||||
}
|
||||
|
||||
+/* Get module checksum */
|
||||
+static char *hash_module_data(const char *module_name, const int prio) {
|
||||
+ semanage_module_info_t *extract_info = NULL;
|
||||
+ semanage_module_key_t *modkey = NULL;
|
||||
+ Sha256Context context;
|
||||
+ uint8_t sha256_hash[SHA256_HASH_SIZE];
|
||||
+ char *sha256_buf = NULL;
|
||||
+ void *data;
|
||||
+ size_t data_len = 0, i;
|
||||
+ int result;
|
||||
+
|
||||
+ result = semanage_module_key_create(sh, &modkey);
|
||||
+ if (result != 0) {
|
||||
+ goto cleanup_extract;
|
||||
+ }
|
||||
+
|
||||
+ result = semanage_module_key_set_name(sh, modkey, module_name);
|
||||
+ if (result != 0) {
|
||||
+ goto cleanup_extract;
|
||||
+ }
|
||||
+
|
||||
+ result = semanage_module_key_set_priority(sh, modkey, prio);
|
||||
+ if (result != 0) {
|
||||
+ goto cleanup_extract;
|
||||
+ }
|
||||
+
|
||||
+ result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
|
||||
+ &extract_info);
|
||||
+ if (result != 0) {
|
||||
+ goto cleanup_extract;
|
||||
+ }
|
||||
+
|
||||
+ Sha256Initialise(&context);
|
||||
+ Sha256Update(&context, data, data_len);
|
||||
+
|
||||
+ Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
|
||||
+
|
||||
+ sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
|
||||
+
|
||||
+ if (sha256_buf == NULL)
|
||||
+ goto cleanup_extract;
|
||||
+
|
||||
+ for (i = 0; i < SHA256_HASH_SIZE; i++) {
|
||||
+ sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
|
||||
+ }
|
||||
+ sha256_buf[i * 2] = 0;
|
||||
+
|
||||
+cleanup_extract:
|
||||
+ semanage_module_info_destroy(sh, extract_info);
|
||||
+ free(extract_info);
|
||||
+ semanage_module_key_destroy(sh, modkey);
|
||||
+ free(modkey);
|
||||
+ return sha256_buf;
|
||||
+}
|
||||
+
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int i, commit = 0;
|
||||
@@ -544,6 +607,8 @@ cleanup_extract:
|
||||
int modinfos_len = 0;
|
||||
semanage_module_info_t *m = NULL;
|
||||
int j = 0;
|
||||
+ char *module_checksum = NULL;
|
||||
+ uint16_t pri = 0;
|
||||
|
||||
if (verbose) {
|
||||
printf
|
||||
@@ -568,7 +633,18 @@ cleanup_extract:
|
||||
result = semanage_module_info_get_name(sh, m, &name);
|
||||
if (result != 0) goto cleanup_list;
|
||||
|
||||
- printf("%s\n", name);
|
||||
+ result = semanage_module_info_get_priority(sh, m, &pri);
|
||||
+ if (result != 0) goto cleanup_list;
|
||||
+
|
||||
+ printf("%s", name);
|
||||
+ if (checksum) {
|
||||
+ module_checksum = hash_module_data(name, pri);
|
||||
+ if (module_checksum) {
|
||||
+ printf(" %s", module_checksum);
|
||||
+ free(module_checksum);
|
||||
+ }
|
||||
+ }
|
||||
+ printf("\n");
|
||||
}
|
||||
}
|
||||
else if (strcmp(mode_arg, "full") == 0) {
|
||||
@@ -583,11 +659,12 @@ cleanup_extract:
|
||||
}
|
||||
|
||||
/* calculate column widths */
|
||||
- size_t column[4] = { 0, 0, 0, 0 };
|
||||
+ size_t column[5] = { 0, 0, 0, 0, 0 };
|
||||
|
||||
/* fixed width columns */
|
||||
column[0] = sizeof("000") - 1;
|
||||
column[3] = sizeof("disabled") - 1;
|
||||
+ column[4] = 64; /* SHA256_HASH_SIZE * 2 */
|
||||
|
||||
/* variable width columns */
|
||||
const char *tmp = NULL;
|
||||
@@ -610,7 +687,6 @@ cleanup_extract:
|
||||
|
||||
/* print out each module */
|
||||
for (j = 0; j < modinfos_len; j++) {
|
||||
- uint16_t pri = 0;
|
||||
const char *name = NULL;
|
||||
int enabled = 0;
|
||||
const char *lang_ext = NULL;
|
||||
@@ -629,11 +705,20 @@ cleanup_extract:
|
||||
result = semanage_module_info_get_lang_ext(sh, m, &lang_ext);
|
||||
if (result != 0) goto cleanup_list;
|
||||
|
||||
- printf("%0*u %-*s %-*s %-*s\n",
|
||||
+ printf("%0*u %-*s %-*s %-*s",
|
||||
(int)column[0], pri,
|
||||
(int)column[1], name,
|
||||
(int)column[2], lang_ext,
|
||||
(int)column[3], enabled ? "" : "disabled");
|
||||
+ if (checksum) {
|
||||
+ module_checksum = hash_module_data(name, pri);
|
||||
+ if (module_checksum) {
|
||||
+ printf(" %-*s", (int)column[4], module_checksum);
|
||||
+ free(module_checksum);
|
||||
+ }
|
||||
+ }
|
||||
+ printf("\n");
|
||||
+
|
||||
}
|
||||
}
|
||||
else {
|
||||
diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
|
||||
new file mode 100644
|
||||
index 000000000000..fe2aeef07f53
|
||||
--- /dev/null
|
||||
+++ b/policycoreutils/semodule/sha256.c
|
||||
@@ -0,0 +1,294 @@
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// WjCryptLib_Sha256
|
||||
+//
|
||||
+// Implementation of SHA256 hash function.
|
||||
+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||
+// Modified by WaterJuice retaining Public Domain license.
|
||||
+//
|
||||
+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// IMPORTS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+#include "sha256.h"
|
||||
+#include <memory.h>
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// MACROS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
|
||||
+
|
||||
+#define MIN(x, y) ( ((x)<(y))?(x):(y) )
|
||||
+
|
||||
+#define STORE32H(x, y) \
|
||||
+ { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \
|
||||
+ (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
|
||||
+
|
||||
+#define LOAD32H(x, y) \
|
||||
+ { x = ((uint32_t)((y)[0] & 255)<<24) | \
|
||||
+ ((uint32_t)((y)[1] & 255)<<16) | \
|
||||
+ ((uint32_t)((y)[2] & 255)<<8) | \
|
||||
+ ((uint32_t)((y)[3] & 255)); }
|
||||
+
|
||||
+#define STORE64H(x, y) \
|
||||
+ { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \
|
||||
+ (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \
|
||||
+ (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \
|
||||
+ (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// CONSTANTS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+// The K array
|
||||
+static const uint32_t K[64] = {
|
||||
+ 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
|
||||
+ 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
|
||||
+ 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
|
||||
+ 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
|
||||
+ 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
|
||||
+ 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
|
||||
+ 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
|
||||
+ 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
|
||||
+ 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
|
||||
+ 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
|
||||
+ 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
|
||||
+ 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
|
||||
+ 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
|
||||
+};
|
||||
+
|
||||
+#define BLOCK_SIZE 64
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// INTERNAL FUNCTIONS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+// Various logical functions
|
||||
+#define Ch( x, y, z ) (z ^ (x & (y ^ z)))
|
||||
+#define Maj( x, y, z ) (((x | y) & z) | (x & y))
|
||||
+#define S( x, n ) ror((x),(n))
|
||||
+#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n))
|
||||
+#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
||||
+#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
||||
+#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
||||
+#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
||||
+
|
||||
+#define Sha256Round( a, b, c, d, e, f, g, h, i ) \
|
||||
+ t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
|
||||
+ t1 = Sigma0(a) + Maj(a, b, c); \
|
||||
+ d += t0; \
|
||||
+ h = t0 + t1;
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// TransformFunction
|
||||
+//
|
||||
+// Compress 512-bits
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+static
|
||||
+void
|
||||
+ TransformFunction
|
||||
+ (
|
||||
+ Sha256Context* Context,
|
||||
+ uint8_t const* Buffer
|
||||
+ )
|
||||
+{
|
||||
+ uint32_t S[8];
|
||||
+ uint32_t W[64];
|
||||
+ uint32_t t0;
|
||||
+ uint32_t t1;
|
||||
+ uint32_t t;
|
||||
+ int i;
|
||||
+
|
||||
+ // Copy state into S
|
||||
+ for( i=0; i<8; i++ )
|
||||
+ {
|
||||
+ S[i] = Context->state[i];
|
||||
+ }
|
||||
+
|
||||
+ // Copy the state into 512-bits into W[0..15]
|
||||
+ for( i=0; i<16; i++ )
|
||||
+ {
|
||||
+ LOAD32H( W[i], Buffer + (4*i) );
|
||||
+ }
|
||||
+
|
||||
+ // Fill W[16..63]
|
||||
+ for( i=16; i<64; i++ )
|
||||
+ {
|
||||
+ W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
|
||||
+ }
|
||||
+
|
||||
+ // Compress
|
||||
+ for( i=0; i<64; i++ )
|
||||
+ {
|
||||
+ Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
|
||||
+ t = S[7];
|
||||
+ S[7] = S[6];
|
||||
+ S[6] = S[5];
|
||||
+ S[5] = S[4];
|
||||
+ S[4] = S[3];
|
||||
+ S[3] = S[2];
|
||||
+ S[2] = S[1];
|
||||
+ S[1] = S[0];
|
||||
+ S[0] = t;
|
||||
+ }
|
||||
+
|
||||
+ // Feedback
|
||||
+ for( i=0; i<8; i++ )
|
||||
+ {
|
||||
+ Context->state[i] = Context->state[i] + S[i];
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// PUBLIC FUNCTIONS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Initialise
|
||||
+//
|
||||
+// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Initialise
|
||||
+ (
|
||||
+ Sha256Context* Context // [out]
|
||||
+ )
|
||||
+{
|
||||
+ Context->curlen = 0;
|
||||
+ Context->length = 0;
|
||||
+ Context->state[0] = 0x6A09E667UL;
|
||||
+ Context->state[1] = 0xBB67AE85UL;
|
||||
+ Context->state[2] = 0x3C6EF372UL;
|
||||
+ Context->state[3] = 0xA54FF53AUL;
|
||||
+ Context->state[4] = 0x510E527FUL;
|
||||
+ Context->state[5] = 0x9B05688CUL;
|
||||
+ Context->state[6] = 0x1F83D9ABUL;
|
||||
+ Context->state[7] = 0x5BE0CD19UL;
|
||||
+}
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Update
|
||||
+//
|
||||
+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||
+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Update
|
||||
+ (
|
||||
+ Sha256Context* Context, // [in out]
|
||||
+ void const* Buffer, // [in]
|
||||
+ uint32_t BufferSize // [in]
|
||||
+ )
|
||||
+{
|
||||
+ uint32_t n;
|
||||
+
|
||||
+ if( Context->curlen > sizeof(Context->buf) )
|
||||
+ {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ while( BufferSize > 0 )
|
||||
+ {
|
||||
+ if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
|
||||
+ {
|
||||
+ TransformFunction( Context, (uint8_t*)Buffer );
|
||||
+ Context->length += BLOCK_SIZE * 8;
|
||||
+ Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
|
||||
+ BufferSize -= BLOCK_SIZE;
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
|
||||
+ memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
|
||||
+ Context->curlen += n;
|
||||
+ Buffer = (uint8_t*)Buffer + n;
|
||||
+ BufferSize -= n;
|
||||
+ if( Context->curlen == BLOCK_SIZE )
|
||||
+ {
|
||||
+ TransformFunction( Context, Context->buf );
|
||||
+ Context->length += 8*BLOCK_SIZE;
|
||||
+ Context->curlen = 0;
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Finalise
|
||||
+//
|
||||
+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||
+// calling this, Sha256Initialised must be used to reuse the context.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Finalise
|
||||
+ (
|
||||
+ Sha256Context* Context, // [in out]
|
||||
+ SHA256_HASH* Digest // [out]
|
||||
+ )
|
||||
+{
|
||||
+ int i;
|
||||
+
|
||||
+ if( Context->curlen >= sizeof(Context->buf) )
|
||||
+ {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ // Increase the length of the message
|
||||
+ Context->length += Context->curlen * 8;
|
||||
+
|
||||
+ // Append the '1' bit
|
||||
+ Context->buf[Context->curlen++] = (uint8_t)0x80;
|
||||
+
|
||||
+ // if the length is currently above 56 bytes we append zeros
|
||||
+ // then compress. Then we can fall back to padding zeros and length
|
||||
+ // encoding like normal.
|
||||
+ if( Context->curlen > 56 )
|
||||
+ {
|
||||
+ while( Context->curlen < 64 )
|
||||
+ {
|
||||
+ Context->buf[Context->curlen++] = (uint8_t)0;
|
||||
+ }
|
||||
+ TransformFunction(Context, Context->buf);
|
||||
+ Context->curlen = 0;
|
||||
+ }
|
||||
+
|
||||
+ // Pad up to 56 bytes of zeroes
|
||||
+ while( Context->curlen < 56 )
|
||||
+ {
|
||||
+ Context->buf[Context->curlen++] = (uint8_t)0;
|
||||
+ }
|
||||
+
|
||||
+ // Store length
|
||||
+ STORE64H( Context->length, Context->buf+56 );
|
||||
+ TransformFunction( Context, Context->buf );
|
||||
+
|
||||
+ // Copy output
|
||||
+ for( i=0; i<8; i++ )
|
||||
+ {
|
||||
+ STORE32H( Context->state[i], Digest->bytes+(4*i) );
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Calculate
|
||||
+//
|
||||
+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||
+// buffer.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Calculate
|
||||
+ (
|
||||
+ void const* Buffer, // [in]
|
||||
+ uint32_t BufferSize, // [in]
|
||||
+ SHA256_HASH* Digest // [in]
|
||||
+ )
|
||||
+{
|
||||
+ Sha256Context context;
|
||||
+
|
||||
+ Sha256Initialise( &context );
|
||||
+ Sha256Update( &context, Buffer, BufferSize );
|
||||
+ Sha256Finalise( &context, Digest );
|
||||
+}
|
||||
diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
|
||||
new file mode 100644
|
||||
index 000000000000..406ed869cd82
|
||||
--- /dev/null
|
||||
+++ b/policycoreutils/semodule/sha256.h
|
||||
@@ -0,0 +1,89 @@
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// WjCryptLib_Sha256
|
||||
+//
|
||||
+// Implementation of SHA256 hash function.
|
||||
+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||
+// Modified by WaterJuice retaining Public Domain license.
|
||||
+//
|
||||
+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+#pragma once
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// IMPORTS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+#include <stdint.h>
|
||||
+#include <stdio.h>
|
||||
+
|
||||
+typedef struct
|
||||
+{
|
||||
+ uint64_t length;
|
||||
+ uint32_t state[8];
|
||||
+ uint32_t curlen;
|
||||
+ uint8_t buf[64];
|
||||
+} Sha256Context;
|
||||
+
|
||||
+#define SHA256_HASH_SIZE ( 256 / 8 )
|
||||
+
|
||||
+typedef struct
|
||||
+{
|
||||
+ uint8_t bytes [SHA256_HASH_SIZE];
|
||||
+} SHA256_HASH;
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// PUBLIC FUNCTIONS
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Initialise
|
||||
+//
|
||||
+// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Initialise
|
||||
+ (
|
||||
+ Sha256Context* Context // [out]
|
||||
+ );
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Update
|
||||
+//
|
||||
+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||
+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Update
|
||||
+ (
|
||||
+ Sha256Context* Context, // [in out]
|
||||
+ void const* Buffer, // [in]
|
||||
+ uint32_t BufferSize // [in]
|
||||
+ );
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Finalise
|
||||
+//
|
||||
+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||
+// calling this, Sha256Initialised must be used to reuse the context.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Finalise
|
||||
+ (
|
||||
+ Sha256Context* Context, // [in out]
|
||||
+ SHA256_HASH* Digest // [out]
|
||||
+ );
|
||||
+
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+// Sha256Calculate
|
||||
+//
|
||||
+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||
+// buffer.
|
||||
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
+void
|
||||
+ Sha256Calculate
|
||||
+ (
|
||||
+ void const* Buffer, // [in]
|
||||
+ uint32_t BufferSize, // [in]
|
||||
+ SHA256_HASH* Digest // [in]
|
||||
+ );
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -0,0 +1,29 @@
|
||||
From 14084bad4f5bcfdb769ba39c9a6f12e4787ab909 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 16 Nov 2021 16:11:22 +0100
|
||||
Subject: [PATCH] semodule: Fix lang_ext column index
|
||||
|
||||
lang_ext is 3. column - index number 2.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
policycoreutils/semodule/semodule.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index 300a97d735cc..c677cc4f1d81 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -682,7 +682,7 @@ cleanup_extract:
|
||||
if (result != 0) goto cleanup_list;
|
||||
|
||||
size = strlen(tmp);
|
||||
- if (size > column[3]) column[3] = size;
|
||||
+ if (size > column[2]) column[2] = size;
|
||||
}
|
||||
|
||||
/* print out each module */
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
From 61f05b6d26063e1ebdc06609c29a067d44579b41 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Tue, 23 Nov 2021 17:38:51 +0100
|
||||
Subject: [PATCH] semodule: Don't forget to munmap() data
|
||||
|
||||
semanage_module_extract() mmap()'s the module raw data but it leaves on
|
||||
the caller to munmap() them.
|
||||
|
||||
Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
policycoreutils/semodule/semodule.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index c677cc4f1d81..dc227058b073 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -393,6 +393,9 @@ static char *hash_module_data(const char *module_name, const int prio) {
|
||||
sha256_buf[i * 2] = 0;
|
||||
|
||||
cleanup_extract:
|
||||
+ if (data_len > 0) {
|
||||
+ munmap(data, data_len);
|
||||
+ }
|
||||
semanage_module_info_destroy(sh, extract_info);
|
||||
free(extract_info);
|
||||
semanage_module_key_destroy(sh, modkey);
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -0,0 +1,41 @@
|
||||
From 69da6239d8505a9d6ca547187f71a351df17f157 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 10 Jan 2022 18:35:27 +0100
|
||||
Subject: [PATCH] policycoreutils: Improve error message when selabel_open
|
||||
fails
|
||||
|
||||
When selabel_open fails to locate file_context files and
|
||||
selabel_opt_path is not specified (e.g. when the policy type is
|
||||
missconfigured in /etc/selinux/config), perror only prints
|
||||
"No such file or directory".
|
||||
This can be confusing in case of "restorecon" since it's
|
||||
not apparent that the issue is in policy store.
|
||||
|
||||
Before:
|
||||
\# restorecon -v /tmp/foo.txt
|
||||
No such file or directory
|
||||
After:
|
||||
\# restorecon -v /tmp/foo.txt
|
||||
/etc/selinux/yolo/contexts/files/file_contexts: No such file or directory
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
policycoreutils/setfiles/restore.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
|
||||
index d3335d1a..ba2668b3 100644
|
||||
--- a/policycoreutils/setfiles/restore.c
|
||||
+++ b/policycoreutils/setfiles/restore.c
|
||||
@@ -29,7 +29,7 @@ void restore_init(struct restore_opts *opts)
|
||||
|
||||
opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||
if (!opts->hnd) {
|
||||
- perror(opts->selabel_opt_path);
|
||||
+ perror(opts->selabel_opt_path ? opts->selabel_opt_path : selinux_file_context_path());
|
||||
exit(1);
|
||||
}
|
||||
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -0,0 +1,539 @@
|
||||
From 066007029b3dd250305d7fac0bfd53aa1e4543cf Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Date: Thu, 3 Feb 2022 17:53:23 +0100
|
||||
Subject: [PATCH] semodule,libsemanage: move module hashing into libsemanage
|
||||
|
||||
The main goal of this move is to have the SHA-256 implementation under
|
||||
libsemanage, since upcoming patches will make use of SHA-256 for a
|
||||
different (but similar) purpose in libsemanage. Having the hashing code
|
||||
in libsemanage will reduce code duplication and allow for easier hash
|
||||
algorithm upgrade in the future.
|
||||
|
||||
Note that libselinux currently also contains a hash function
|
||||
implementation (for yet another different purpose). This patch doesn't
|
||||
make any effort to address that duplicity yet.
|
||||
|
||||
This patch also changes the format of the hash string printed by
|
||||
semodule to include the name of the hash. The intent is to avoid
|
||||
ambiguity and potential collisions when the algorithm is potentially
|
||||
changed in the future.
|
||||
|
||||
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
---
|
||||
policycoreutils/semodule/Makefile | 2 +-
|
||||
policycoreutils/semodule/semodule.c | 53 ++---
|
||||
policycoreutils/semodule/sha256.c | 294 ----------------------------
|
||||
policycoreutils/semodule/sha256.h | 89 ---------
|
||||
4 files changed, 17 insertions(+), 421 deletions(-)
|
||||
delete mode 100644 policycoreutils/semodule/sha256.c
|
||||
delete mode 100644 policycoreutils/semodule/sha256.h
|
||||
|
||||
diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
|
||||
index 9875ac38..73801e48 100644
|
||||
--- a/policycoreutils/semodule/Makefile
|
||||
+++ b/policycoreutils/semodule/Makefile
|
||||
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
|
||||
|
||||
CFLAGS ?= -Werror -Wall -W
|
||||
override LDLIBS += -lsepol -lselinux -lsemanage
|
||||
-SEMODULE_OBJS = semodule.o sha256.o
|
||||
+SEMODULE_OBJS = semodule.o
|
||||
|
||||
all: semodule genhomedircon
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index dc227058..243b1add 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -24,8 +24,6 @@
|
||||
|
||||
#include <semanage/modules.h>
|
||||
|
||||
-#include "sha256.h"
|
||||
-
|
||||
enum client_modes {
|
||||
NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
|
||||
LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
|
||||
@@ -347,60 +345,38 @@ static void parse_command_line(int argc, char **argv)
|
||||
|
||||
/* Get module checksum */
|
||||
static char *hash_module_data(const char *module_name, const int prio) {
|
||||
- semanage_module_info_t *extract_info = NULL;
|
||||
semanage_module_key_t *modkey = NULL;
|
||||
- Sha256Context context;
|
||||
- uint8_t sha256_hash[SHA256_HASH_SIZE];
|
||||
- char *sha256_buf = NULL;
|
||||
- void *data;
|
||||
- size_t data_len = 0, i;
|
||||
+ char *hash_str = NULL;
|
||||
+ void *hash = NULL;
|
||||
+ size_t hash_len = 0;
|
||||
int result;
|
||||
|
||||
result = semanage_module_key_create(sh, &modkey);
|
||||
if (result != 0) {
|
||||
- goto cleanup_extract;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
result = semanage_module_key_set_name(sh, modkey, module_name);
|
||||
if (result != 0) {
|
||||
- goto cleanup_extract;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
result = semanage_module_key_set_priority(sh, modkey, prio);
|
||||
if (result != 0) {
|
||||
- goto cleanup_extract;
|
||||
+ goto cleanup;
|
||||
}
|
||||
|
||||
- result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
|
||||
- &extract_info);
|
||||
+ result = semanage_module_compute_checksum(sh, modkey, 1, &hash_str,
|
||||
+ &hash_len);
|
||||
if (result != 0) {
|
||||
- goto cleanup_extract;
|
||||
- }
|
||||
-
|
||||
- Sha256Initialise(&context);
|
||||
- Sha256Update(&context, data, data_len);
|
||||
-
|
||||
- Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
|
||||
-
|
||||
- sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
|
||||
-
|
||||
- if (sha256_buf == NULL)
|
||||
- goto cleanup_extract;
|
||||
-
|
||||
- for (i = 0; i < SHA256_HASH_SIZE; i++) {
|
||||
- sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
|
||||
+ goto cleanup;
|
||||
}
|
||||
- sha256_buf[i * 2] = 0;
|
||||
|
||||
-cleanup_extract:
|
||||
- if (data_len > 0) {
|
||||
- munmap(data, data_len);
|
||||
- }
|
||||
- semanage_module_info_destroy(sh, extract_info);
|
||||
- free(extract_info);
|
||||
+cleanup:
|
||||
+ free(hash);
|
||||
semanage_module_key_destroy(sh, modkey);
|
||||
free(modkey);
|
||||
- return sha256_buf;
|
||||
+ return hash_str;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
@@ -667,7 +643,10 @@ cleanup_extract:
|
||||
/* fixed width columns */
|
||||
column[0] = sizeof("000") - 1;
|
||||
column[3] = sizeof("disabled") - 1;
|
||||
- column[4] = 64; /* SHA256_HASH_SIZE * 2 */
|
||||
+
|
||||
+ result = semanage_module_compute_checksum(sh, NULL, 0, NULL,
|
||||
+ &column[4]);
|
||||
+ if (result != 0) goto cleanup_list;
|
||||
|
||||
/* variable width columns */
|
||||
const char *tmp = NULL;
|
||||
diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
|
||||
deleted file mode 100644
|
||||
index fe2aeef0..00000000
|
||||
--- a/policycoreutils/semodule/sha256.c
|
||||
+++ /dev/null
|
||||
@@ -1,294 +0,0 @@
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// WjCryptLib_Sha256
|
||||
-//
|
||||
-// Implementation of SHA256 hash function.
|
||||
-// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||
-// Modified by WaterJuice retaining Public Domain license.
|
||||
-//
|
||||
-// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// IMPORTS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-#include "sha256.h"
|
||||
-#include <memory.h>
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// MACROS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
|
||||
-
|
||||
-#define MIN(x, y) ( ((x)<(y))?(x):(y) )
|
||||
-
|
||||
-#define STORE32H(x, y) \
|
||||
- { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \
|
||||
- (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
|
||||
-
|
||||
-#define LOAD32H(x, y) \
|
||||
- { x = ((uint32_t)((y)[0] & 255)<<24) | \
|
||||
- ((uint32_t)((y)[1] & 255)<<16) | \
|
||||
- ((uint32_t)((y)[2] & 255)<<8) | \
|
||||
- ((uint32_t)((y)[3] & 255)); }
|
||||
-
|
||||
-#define STORE64H(x, y) \
|
||||
- { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \
|
||||
- (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \
|
||||
- (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \
|
||||
- (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// CONSTANTS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-// The K array
|
||||
-static const uint32_t K[64] = {
|
||||
- 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
|
||||
- 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
|
||||
- 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
|
||||
- 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
|
||||
- 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
|
||||
- 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
|
||||
- 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
|
||||
- 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
|
||||
- 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
|
||||
- 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
|
||||
- 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
|
||||
- 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
|
||||
- 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
|
||||
-};
|
||||
-
|
||||
-#define BLOCK_SIZE 64
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// INTERNAL FUNCTIONS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-// Various logical functions
|
||||
-#define Ch( x, y, z ) (z ^ (x & (y ^ z)))
|
||||
-#define Maj( x, y, z ) (((x | y) & z) | (x & y))
|
||||
-#define S( x, n ) ror((x),(n))
|
||||
-#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n))
|
||||
-#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
||||
-#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
||||
-#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
||||
-#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
||||
-
|
||||
-#define Sha256Round( a, b, c, d, e, f, g, h, i ) \
|
||||
- t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
|
||||
- t1 = Sigma0(a) + Maj(a, b, c); \
|
||||
- d += t0; \
|
||||
- h = t0 + t1;
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// TransformFunction
|
||||
-//
|
||||
-// Compress 512-bits
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-static
|
||||
-void
|
||||
- TransformFunction
|
||||
- (
|
||||
- Sha256Context* Context,
|
||||
- uint8_t const* Buffer
|
||||
- )
|
||||
-{
|
||||
- uint32_t S[8];
|
||||
- uint32_t W[64];
|
||||
- uint32_t t0;
|
||||
- uint32_t t1;
|
||||
- uint32_t t;
|
||||
- int i;
|
||||
-
|
||||
- // Copy state into S
|
||||
- for( i=0; i<8; i++ )
|
||||
- {
|
||||
- S[i] = Context->state[i];
|
||||
- }
|
||||
-
|
||||
- // Copy the state into 512-bits into W[0..15]
|
||||
- for( i=0; i<16; i++ )
|
||||
- {
|
||||
- LOAD32H( W[i], Buffer + (4*i) );
|
||||
- }
|
||||
-
|
||||
- // Fill W[16..63]
|
||||
- for( i=16; i<64; i++ )
|
||||
- {
|
||||
- W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
|
||||
- }
|
||||
-
|
||||
- // Compress
|
||||
- for( i=0; i<64; i++ )
|
||||
- {
|
||||
- Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
|
||||
- t = S[7];
|
||||
- S[7] = S[6];
|
||||
- S[6] = S[5];
|
||||
- S[5] = S[4];
|
||||
- S[4] = S[3];
|
||||
- S[3] = S[2];
|
||||
- S[2] = S[1];
|
||||
- S[1] = S[0];
|
||||
- S[0] = t;
|
||||
- }
|
||||
-
|
||||
- // Feedback
|
||||
- for( i=0; i<8; i++ )
|
||||
- {
|
||||
- Context->state[i] = Context->state[i] + S[i];
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// PUBLIC FUNCTIONS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Initialise
|
||||
-//
|
||||
-// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Initialise
|
||||
- (
|
||||
- Sha256Context* Context // [out]
|
||||
- )
|
||||
-{
|
||||
- Context->curlen = 0;
|
||||
- Context->length = 0;
|
||||
- Context->state[0] = 0x6A09E667UL;
|
||||
- Context->state[1] = 0xBB67AE85UL;
|
||||
- Context->state[2] = 0x3C6EF372UL;
|
||||
- Context->state[3] = 0xA54FF53AUL;
|
||||
- Context->state[4] = 0x510E527FUL;
|
||||
- Context->state[5] = 0x9B05688CUL;
|
||||
- Context->state[6] = 0x1F83D9ABUL;
|
||||
- Context->state[7] = 0x5BE0CD19UL;
|
||||
-}
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Update
|
||||
-//
|
||||
-// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||
-// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Update
|
||||
- (
|
||||
- Sha256Context* Context, // [in out]
|
||||
- void const* Buffer, // [in]
|
||||
- uint32_t BufferSize // [in]
|
||||
- )
|
||||
-{
|
||||
- uint32_t n;
|
||||
-
|
||||
- if( Context->curlen > sizeof(Context->buf) )
|
||||
- {
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- while( BufferSize > 0 )
|
||||
- {
|
||||
- if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
|
||||
- {
|
||||
- TransformFunction( Context, (uint8_t*)Buffer );
|
||||
- Context->length += BLOCK_SIZE * 8;
|
||||
- Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
|
||||
- BufferSize -= BLOCK_SIZE;
|
||||
- }
|
||||
- else
|
||||
- {
|
||||
- n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
|
||||
- memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
|
||||
- Context->curlen += n;
|
||||
- Buffer = (uint8_t*)Buffer + n;
|
||||
- BufferSize -= n;
|
||||
- if( Context->curlen == BLOCK_SIZE )
|
||||
- {
|
||||
- TransformFunction( Context, Context->buf );
|
||||
- Context->length += 8*BLOCK_SIZE;
|
||||
- Context->curlen = 0;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Finalise
|
||||
-//
|
||||
-// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||
-// calling this, Sha256Initialised must be used to reuse the context.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Finalise
|
||||
- (
|
||||
- Sha256Context* Context, // [in out]
|
||||
- SHA256_HASH* Digest // [out]
|
||||
- )
|
||||
-{
|
||||
- int i;
|
||||
-
|
||||
- if( Context->curlen >= sizeof(Context->buf) )
|
||||
- {
|
||||
- return;
|
||||
- }
|
||||
-
|
||||
- // Increase the length of the message
|
||||
- Context->length += Context->curlen * 8;
|
||||
-
|
||||
- // Append the '1' bit
|
||||
- Context->buf[Context->curlen++] = (uint8_t)0x80;
|
||||
-
|
||||
- // if the length is currently above 56 bytes we append zeros
|
||||
- // then compress. Then we can fall back to padding zeros and length
|
||||
- // encoding like normal.
|
||||
- if( Context->curlen > 56 )
|
||||
- {
|
||||
- while( Context->curlen < 64 )
|
||||
- {
|
||||
- Context->buf[Context->curlen++] = (uint8_t)0;
|
||||
- }
|
||||
- TransformFunction(Context, Context->buf);
|
||||
- Context->curlen = 0;
|
||||
- }
|
||||
-
|
||||
- // Pad up to 56 bytes of zeroes
|
||||
- while( Context->curlen < 56 )
|
||||
- {
|
||||
- Context->buf[Context->curlen++] = (uint8_t)0;
|
||||
- }
|
||||
-
|
||||
- // Store length
|
||||
- STORE64H( Context->length, Context->buf+56 );
|
||||
- TransformFunction( Context, Context->buf );
|
||||
-
|
||||
- // Copy output
|
||||
- for( i=0; i<8; i++ )
|
||||
- {
|
||||
- STORE32H( Context->state[i], Digest->bytes+(4*i) );
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Calculate
|
||||
-//
|
||||
-// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||
-// buffer.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Calculate
|
||||
- (
|
||||
- void const* Buffer, // [in]
|
||||
- uint32_t BufferSize, // [in]
|
||||
- SHA256_HASH* Digest // [in]
|
||||
- )
|
||||
-{
|
||||
- Sha256Context context;
|
||||
-
|
||||
- Sha256Initialise( &context );
|
||||
- Sha256Update( &context, Buffer, BufferSize );
|
||||
- Sha256Finalise( &context, Digest );
|
||||
-}
|
||||
diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
|
||||
deleted file mode 100644
|
||||
index 406ed869..00000000
|
||||
--- a/policycoreutils/semodule/sha256.h
|
||||
+++ /dev/null
|
||||
@@ -1,89 +0,0 @@
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// WjCryptLib_Sha256
|
||||
-//
|
||||
-// Implementation of SHA256 hash function.
|
||||
-// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||
-// Modified by WaterJuice retaining Public Domain license.
|
||||
-//
|
||||
-// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-#pragma once
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// IMPORTS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-#include <stdint.h>
|
||||
-#include <stdio.h>
|
||||
-
|
||||
-typedef struct
|
||||
-{
|
||||
- uint64_t length;
|
||||
- uint32_t state[8];
|
||||
- uint32_t curlen;
|
||||
- uint8_t buf[64];
|
||||
-} Sha256Context;
|
||||
-
|
||||
-#define SHA256_HASH_SIZE ( 256 / 8 )
|
||||
-
|
||||
-typedef struct
|
||||
-{
|
||||
- uint8_t bytes [SHA256_HASH_SIZE];
|
||||
-} SHA256_HASH;
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// PUBLIC FUNCTIONS
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Initialise
|
||||
-//
|
||||
-// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Initialise
|
||||
- (
|
||||
- Sha256Context* Context // [out]
|
||||
- );
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Update
|
||||
-//
|
||||
-// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||
-// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Update
|
||||
- (
|
||||
- Sha256Context* Context, // [in out]
|
||||
- void const* Buffer, // [in]
|
||||
- uint32_t BufferSize // [in]
|
||||
- );
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Finalise
|
||||
-//
|
||||
-// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||
-// calling this, Sha256Initialised must be used to reuse the context.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Finalise
|
||||
- (
|
||||
- Sha256Context* Context, // [in out]
|
||||
- SHA256_HASH* Digest // [out]
|
||||
- );
|
||||
-
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-// Sha256Calculate
|
||||
-//
|
||||
-// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||
-// buffer.
|
||||
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
-void
|
||||
- Sha256Calculate
|
||||
- (
|
||||
- void const* Buffer, // [in]
|
||||
- uint32_t BufferSize, // [in]
|
||||
- SHA256_HASH* Digest // [in]
|
||||
- );
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -0,0 +1,144 @@
|
||||
From e3fc737e43561ecadcb977ce4c9a1db44be636ae Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Date: Thu, 3 Feb 2022 17:53:27 +0100
|
||||
Subject: [PATCH] semodule: add command-line option to detect module changes
|
||||
|
||||
Add a new command-line option "--rebuild-if-modules-changed" to control
|
||||
the newly introduced check_ext_changes libsemanage flag.
|
||||
|
||||
For example, running `semodule --rebuild-if-modules-changed` will ensure
|
||||
that any externally added/removed modules (e.g. by an RPM transaction)
|
||||
are reflected in the compiled policy, while skipping the most expensive
|
||||
part of the rebuild if no module change was deteceted since the last
|
||||
libsemanage transaction.
|
||||
|
||||
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
---
|
||||
policycoreutils/semodule/semodule.8 | 7 +++++++
|
||||
policycoreutils/semodule/semodule.c | 32 ++++++++++++++++++++++-------
|
||||
2 files changed, 32 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||
index 3a2fb21c..d1735d21 100644
|
||||
--- a/policycoreutils/semodule/semodule.8
|
||||
+++ b/policycoreutils/semodule/semodule.8
|
||||
@@ -23,6 +23,13 @@ force a reload of policy
|
||||
.B \-B, \-\-build
|
||||
force a rebuild of policy (also reloads unless \-n is used)
|
||||
.TP
|
||||
+.B \-\-rebuild-if-modules-changed
|
||||
+Force a rebuild of the policy if any changes to module content are detected
|
||||
+(by comparing with checksum from the last transaction). One can use this
|
||||
+instead of \-B to ensure that any changes to the module store done by an
|
||||
+external tool (e.g. a package manager) are applied, while automatically
|
||||
+skipping the rebuild if there are no new changes.
|
||||
+.TP
|
||||
.B \-D, \-\-disable_dontaudit
|
||||
Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
|
||||
.TP
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index 243b1add..22a42a75 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -46,6 +46,7 @@ static int verbose;
|
||||
static int reload;
|
||||
static int no_reload;
|
||||
static int build;
|
||||
+static int check_ext_changes;
|
||||
static int disable_dontaudit;
|
||||
static int preserve_tunables;
|
||||
static int ignore_module_cache;
|
||||
@@ -148,6 +149,9 @@ static void usage(char *progname)
|
||||
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||
printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||
+ printf(" --rebuild-if-modules-changed\n"
|
||||
+ " force policy rebuild if module content changed since\n"
|
||||
+ " last rebuild (based on checksum)\n");
|
||||
}
|
||||
|
||||
/* Sets the global mode variable to new_mode, but only if no other
|
||||
@@ -179,6 +183,7 @@ static void set_mode(enum client_modes new_mode, char *arg)
|
||||
static void parse_command_line(int argc, char **argv)
|
||||
{
|
||||
static struct option opts[] = {
|
||||
+ {"rebuild-if-modules-changed", 0, NULL, '\0'},
|
||||
{"store", required_argument, NULL, 's'},
|
||||
{"base", required_argument, NULL, 'b'},
|
||||
{"help", 0, NULL, 'h'},
|
||||
@@ -206,15 +211,26 @@ static void parse_command_line(int argc, char **argv)
|
||||
};
|
||||
int extract_selected = 0;
|
||||
int cil_hll_set = 0;
|
||||
- int i;
|
||||
+ int i, longind;
|
||||
verbose = 0;
|
||||
reload = 0;
|
||||
no_reload = 0;
|
||||
+ check_ext_changes = 0;
|
||||
priority = 400;
|
||||
while ((i =
|
||||
- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
|
||||
- NULL)) != -1) {
|
||||
+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm",
|
||||
+ opts, &longind)) != -1) {
|
||||
switch (i) {
|
||||
+ case '\0':
|
||||
+ switch(longind) {
|
||||
+ case 0: /* --rebuild-if-modules-changed */
|
||||
+ check_ext_changes = 1;
|
||||
+ break;
|
||||
+ default:
|
||||
+ usage(argv[0]);
|
||||
+ exit(1);
|
||||
+ }
|
||||
+ break;
|
||||
case 'b':
|
||||
fprintf(stderr, "The --base option is deprecated. Use --install instead.\n");
|
||||
set_mode(INSTALL_M, optarg);
|
||||
@@ -299,13 +315,13 @@ static void parse_command_line(int argc, char **argv)
|
||||
}
|
||||
}
|
||||
}
|
||||
- if ((build || reload) && num_commands) {
|
||||
+ if ((build || reload || check_ext_changes) && num_commands) {
|
||||
fprintf(stderr,
|
||||
"build or reload should not be used with other commands\n");
|
||||
usage(argv[0]);
|
||||
exit(1);
|
||||
}
|
||||
- if (num_commands == 0 && reload == 0 && build == 0) {
|
||||
+ if (num_commands == 0 && reload == 0 && build == 0 && check_ext_changes == 0) {
|
||||
fprintf(stderr, "At least one mode must be specified.\n");
|
||||
usage(argv[0]);
|
||||
exit(1);
|
||||
@@ -392,7 +408,7 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
parse_command_line(argc, argv);
|
||||
|
||||
- if (build)
|
||||
+ if (build || check_ext_changes)
|
||||
commit = 1;
|
||||
|
||||
sh = semanage_handle_create();
|
||||
@@ -431,7 +447,7 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
}
|
||||
|
||||
- if (build) {
|
||||
+ if (build || check_ext_changes) {
|
||||
if ((result = semanage_begin_transaction(sh)) < 0) {
|
||||
fprintf(stderr, "%s: Could not begin transaction: %s\n",
|
||||
argv[0], errno ? strerror(errno) : "");
|
||||
@@ -805,6 +821,8 @@ cleanup_disable:
|
||||
semanage_set_reload(sh, 0);
|
||||
if (build)
|
||||
semanage_set_rebuild(sh, 1);
|
||||
+ if (check_ext_changes)
|
||||
+ semanage_set_check_ext_changes(sh, 1);
|
||||
if (disable_dontaudit)
|
||||
semanage_set_disable_dontaudit(sh, 1);
|
||||
else if (build)
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@ -0,0 +1,64 @@
|
||||
From 09c944561c76146b1fc11e99e95b6a674366cddf Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 30 May 2022 14:20:21 +0200
|
||||
Subject: [PATCH] python: Split "semanage import" into two transactions
|
||||
|
||||
First transaction applies all deletion operations, so that there are no
|
||||
collisions when applying the rest of the changes.
|
||||
|
||||
Fixes:
|
||||
# semanage port -a -t http_cache_port_t -r s0 -p tcp 3024
|
||||
# semanage export | semanage import
|
||||
ValueError: Port tcp/3024 already defined
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/semanage | 21 +++++++++++++++++++--
|
||||
1 file changed, 19 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index ebb93ea5..b8842d28 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -841,10 +841,29 @@ def handleImport(args):
|
||||
trans = seobject.semanageRecords(args)
|
||||
trans.start()
|
||||
|
||||
+ deleteCommands = []
|
||||
+ commands = []
|
||||
+ # separate commands for deletion from the rest so they can be
|
||||
+ # applied in a separate transaction
|
||||
for l in sys.stdin.readlines():
|
||||
if len(l.strip()) == 0:
|
||||
continue
|
||||
+ if "-d" in l or "-D" in l:
|
||||
+ deleteCommands.append(l)
|
||||
+ else:
|
||||
+ commands.append(l)
|
||||
+
|
||||
+ if deleteCommands:
|
||||
+ importHelper(deleteCommands)
|
||||
+ trans.finish()
|
||||
+ trans.start()
|
||||
+
|
||||
+ importHelper(commands)
|
||||
+ trans.finish()
|
||||
|
||||
+
|
||||
+def importHelper(commands):
|
||||
+ for l in commands:
|
||||
try:
|
||||
commandParser = createCommandParser()
|
||||
args = commandParser.parse_args(mkargv(l))
|
||||
@@ -858,8 +877,6 @@ def handleImport(args):
|
||||
except KeyboardInterrupt:
|
||||
sys.exit(0)
|
||||
|
||||
- trans.finish()
|
||||
-
|
||||
|
||||
def setupImportParser(subparsers):
|
||||
importParser = subparsers.add_parser('import', help=_('Import local customizations'))
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@ -0,0 +1,81 @@
|
||||
From c0ca652dce6b1d5d11e697cc3a4695d87944f9ad Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Date: Wed, 8 Jun 2022 19:09:54 +0200
|
||||
Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh
|
||||
|
||||
After the last commit this option's name and description no longer
|
||||
matches the semantic, so give it a new one and update the descriptions.
|
||||
The old name is still recognized and aliased to the new one for
|
||||
backwards compatibility.
|
||||
|
||||
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||
---
|
||||
policycoreutils/semodule/semodule.8 | 12 ++++++------
|
||||
policycoreutils/semodule/semodule.c | 13 ++++++++++---
|
||||
2 files changed, 16 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||
index d1735d21..c56e580f 100644
|
||||
--- a/policycoreutils/semodule/semodule.8
|
||||
+++ b/policycoreutils/semodule/semodule.8
|
||||
@@ -23,12 +23,12 @@ force a reload of policy
|
||||
.B \-B, \-\-build
|
||||
force a rebuild of policy (also reloads unless \-n is used)
|
||||
.TP
|
||||
-.B \-\-rebuild-if-modules-changed
|
||||
-Force a rebuild of the policy if any changes to module content are detected
|
||||
-(by comparing with checksum from the last transaction). One can use this
|
||||
-instead of \-B to ensure that any changes to the module store done by an
|
||||
-external tool (e.g. a package manager) are applied, while automatically
|
||||
-skipping the rebuild if there are no new changes.
|
||||
+.B \-\-refresh
|
||||
+Like \-\-build, but reuses existing linked policy if no changes to module
|
||||
+files are detected (by comparing with checksum from the last transaction).
|
||||
+One can use this instead of \-B to ensure that any changes to the module
|
||||
+store done by an external tool (e.g. a package manager) are applied, while
|
||||
+automatically skipping the module re-linking if there are no module changes.
|
||||
.TP
|
||||
.B \-D, \-\-disable_dontaudit
|
||||
Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
|
||||
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||
index 22a42a75..324ec9fb 100644
|
||||
--- a/policycoreutils/semodule/semodule.c
|
||||
+++ b/policycoreutils/semodule/semodule.c
|
||||
@@ -149,9 +149,12 @@ static void usage(char *progname)
|
||||
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||
printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||
- printf(" --rebuild-if-modules-changed\n"
|
||||
- " force policy rebuild if module content changed since\n"
|
||||
- " last rebuild (based on checksum)\n");
|
||||
+ printf(" --refresh like --build, but reuses existing linked policy if no\n"
|
||||
+ " changes to module files are detected (via checksum)\n");
|
||||
+ printf("Deprecated options:\n");
|
||||
+ printf(" -b,--base same as --install\n");
|
||||
+ printf(" --rebuild-if-modules-changed\n"
|
||||
+ " same as --refresh\n");
|
||||
}
|
||||
|
||||
/* Sets the global mode variable to new_mode, but only if no other
|
||||
@@ -184,6 +187,7 @@ static void parse_command_line(int argc, char **argv)
|
||||
{
|
||||
static struct option opts[] = {
|
||||
{"rebuild-if-modules-changed", 0, NULL, '\0'},
|
||||
+ {"refresh", 0, NULL, '\0'},
|
||||
{"store", required_argument, NULL, 's'},
|
||||
{"base", required_argument, NULL, 'b'},
|
||||
{"help", 0, NULL, 'h'},
|
||||
@@ -224,6 +228,9 @@ static void parse_command_line(int argc, char **argv)
|
||||
case '\0':
|
||||
switch(longind) {
|
||||
case 0: /* --rebuild-if-modules-changed */
|
||||
+ fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n");
|
||||
+ /* fallthrough */
|
||||
+ case 1: /* --refresh */
|
||||
check_ext_changes = 1;
|
||||
break;
|
||||
default:
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@ -0,0 +1,79 @@
|
||||
From 72c7e9123980b003a21d51e2805529a3e90b2460 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Thu, 13 Oct 2022 17:33:18 +0200
|
||||
Subject: [PATCH] python: Harden tools against "rogue" modules
|
||||
|
||||
Python scripts present in "/usr/sbin" override regular modules.
|
||||
Make sure /usr/sbin is not present in PYTHONPATH.
|
||||
|
||||
Fixes:
|
||||
#cat > /usr/sbin/audit.py <<EOF
|
||||
import sys
|
||||
print("BAD GUY!", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
EOF
|
||||
#semanage boolean -l
|
||||
BAD GUY!
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/audit2allow/audit2allow | 2 +-
|
||||
python/audit2allow/sepolgen-ifgen | 2 +-
|
||||
python/chcat/chcat | 2 +-
|
||||
python/semanage/semanage | 2 +-
|
||||
python/sepolicy/sepolicy.py | 2 +-
|
||||
5 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
|
||||
index 09b06f66..eafeea88 100644
|
||||
--- a/python/audit2allow/audit2allow
|
||||
+++ b/python/audit2allow/audit2allow
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
# Authors: Dan Walsh <dwalsh@redhat.com>
|
||||
#
|
||||
diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen
|
||||
index be2d093b..f25f8af1 100644
|
||||
--- a/python/audit2allow/sepolgen-ifgen
|
||||
+++ b/python/audit2allow/sepolgen-ifgen
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
#
|
||||
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
#
|
||||
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
||||
index df2509f2..5671cec6 100755
|
||||
--- a/python/chcat/chcat
|
||||
+++ b/python/chcat/chcat
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
# Copyright (C) 2005 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index b8842d28..1f170f60 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
# Copyright (C) 2012-2013 Red Hat
|
||||
# AUTHOR: Miroslav Grepl <mgrepl@redhat.com>
|
||||
# AUTHOR: David Quigley <selinux@davequigley.com>
|
||||
diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
|
||||
index 8bd6a579..0c1d9641 100755
|
||||
--- a/python/sepolicy/sepolicy.py
|
||||
+++ b/python/sepolicy/sepolicy.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
# Copyright (C) 2012 Red Hat
|
||||
# AUTHOR: Dan Walsh <dwalsh@redhat.com>
|
||||
# see file 'COPYING' for use and warranty information
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,65 @@
|
||||
From f33e40265d192e5d725e7b82e5f14f603e1fba48 Mon Sep 17 00:00:00 2001
|
||||
From: James Carter <jwcart2@gmail.com>
|
||||
Date: Wed, 19 Oct 2022 14:20:11 -0400
|
||||
Subject: [PATCH] python: Do not query the local database if the fcontext is
|
||||
non-local
|
||||
|
||||
Vit Mojzis reports that an error message is produced when modifying
|
||||
a non-local fcontext.
|
||||
|
||||
He gives the following example:
|
||||
# semanage fcontext -f f -m -t passwd_file_t /etc/security/opasswd
|
||||
libsemanage.dbase_llist_query: could not query record value (No such file or directory).
|
||||
|
||||
When modifying an fcontext, the non-local database is checked for the
|
||||
key and then, if it is not found there, the local database is checked.
|
||||
If the key doesn't exist, then an error is raised. If the key exists
|
||||
then the local database is queried first and, if that fails, the non-
|
||||
local database is queried.
|
||||
|
||||
The error is from querying the local database when the fcontext is in
|
||||
the non-local database.
|
||||
|
||||
Instead, if the fcontext is in the non-local database, just query
|
||||
the non-local database. Only query the local database if the
|
||||
fcontext was found in it.
|
||||
|
||||
Reported-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Signed-off-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
python/semanage/seobject.py | 15 +++++++++------
|
||||
1 file changed, 9 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 70ebfd08..0e923a0d 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -2490,16 +2490,19 @@ class fcontextRecords(semanageRecords):
|
||||
(rc, exists) = semanage_fcontext_exists(self.sh, k)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
- if not exists:
|
||||
+ if exists:
|
||||
+ try:
|
||||
+ (rc, fcontext) = semanage_fcontext_query(self.sh, k)
|
||||
+ except OSError:
|
||||
+ raise ValueError(_("Could not query file context for %s") % target)
|
||||
+ else:
|
||||
(rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
if not exists:
|
||||
raise ValueError(_("File context for %s is not defined") % target)
|
||||
-
|
||||
- try:
|
||||
- (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
|
||||
- except OSError:
|
||||
try:
|
||||
- (rc, fcontext) = semanage_fcontext_query(self.sh, k)
|
||||
+ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
|
||||
except OSError:
|
||||
raise ValueError(_("Could not query file context for %s") % target)
|
||||
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,112 @@
|
||||
From f3ddbd8220d9646072c9a4c9ed37f2dff998a53c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 10 Jan 2023 11:37:26 +0100
|
||||
Subject: [PATCH] python/sepolicy: add missing booleans to man pages
|
||||
|
||||
get_bools should return a list of booleans that can affect given type,
|
||||
but it did not handle non trivial conditional statements properly
|
||||
(returning the whole conditional statement instead of a list of booleans
|
||||
in the statement).
|
||||
|
||||
e.g. for
|
||||
allow httpd_t spamc_t:process transition; [ httpd_can_check_spam && httpd_can_sendmail ]:True
|
||||
get_bools used to return [("httpd_can_check_spam && httpd_can_sendmail", False)] instead of
|
||||
[("httpd_can_check_spam", False), ("httpd_can_sendmail", False)]
|
||||
|
||||
- rename "boolean" in sepolicy rule dictionary to "booleans" to suggest
|
||||
it can contain multiple values and make sure it is populated correctly
|
||||
- add "conditional" key to the rule dictionary to accommodate
|
||||
get_conditionals, which requires the whole conditional statement
|
||||
- extend get_bools search to dontaudit rules so that it covers booleans
|
||||
like httpd_dontaudit_search_dirs
|
||||
|
||||
Note: get_bools uses security_get_boolean_active to get the boolean
|
||||
value, but the value is later used to represent the default.
|
||||
Not ideal, but I'm not aware of a way to get the actual defaults.
|
||||
|
||||
Fixes:
|
||||
"sepolicy manpage" generates man pages that are missing booleans
|
||||
which are included in non trivial conditional expressions
|
||||
e.g. httpd_selinux(8) does not include httpd_can_check_spam,
|
||||
httpd_tmp_exec, httpd_unified, or httpd_use_gpg
|
||||
|
||||
This fix, however, also adds some not strictly related booleans
|
||||
to some man pages. e.g. use_nfs_home_dirs and
|
||||
use_samba_home_dirs are added to httpd_selinux(8)
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: Jason Zaman <jason@perfinion.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/__init__.py | 21 +++++++++++++--------
|
||||
1 file changed, 13 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||
index b6ca57c3..0f51174d 100644
|
||||
--- a/python/sepolicy/sepolicy/__init__.py
|
||||
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||
@@ -324,7 +324,12 @@ def _setools_rule_to_dict(rule):
|
||||
pass
|
||||
|
||||
try:
|
||||
- d['boolean'] = [(str(rule.conditional), enabled)]
|
||||
+ d['booleans'] = [(str(b), b.state) for b in rule.conditional.booleans]
|
||||
+ except AttributeError:
|
||||
+ pass
|
||||
+
|
||||
+ try:
|
||||
+ d['conditional'] = str(rule.conditional)
|
||||
except AttributeError:
|
||||
pass
|
||||
|
||||
@@ -426,12 +431,12 @@ def get_conditionals(src, dest, tclass, perm):
|
||||
x['source'] in src_list and
|
||||
x['target'] in dest_list and
|
||||
set(perm).issubset(x[PERMS]) and
|
||||
- 'boolean' in x,
|
||||
+ 'conditional' in x,
|
||||
get_all_allow_rules()))
|
||||
|
||||
try:
|
||||
for i in allows:
|
||||
- tdict.update({'source': i['source'], 'boolean': i['boolean']})
|
||||
+ tdict.update({'source': i['source'], 'conditional': (i['conditional'], i['enabled'])})
|
||||
if tdict not in tlist:
|
||||
tlist.append(tdict)
|
||||
tdict = {}
|
||||
@@ -445,10 +450,10 @@ def get_conditionals_format_text(cond):
|
||||
|
||||
enabled = False
|
||||
for x in cond:
|
||||
- if x['boolean'][0][1]:
|
||||
+ if x['conditional'][1]:
|
||||
enabled = True
|
||||
break
|
||||
- return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['boolean'][0][0], x['boolean'][0][1]), cond))))
|
||||
+ return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['conditional'][0], x['conditional'][1]), cond))))
|
||||
|
||||
|
||||
def get_types_from_attribute(attribute):
|
||||
@@ -703,9 +708,9 @@ def get_boolean_rules(setype, boolean):
|
||||
boollist = []
|
||||
permlist = search([ALLOW], {'source': setype})
|
||||
for p in permlist:
|
||||
- if "boolean" in p:
|
||||
+ if "booleans" in p:
|
||||
try:
|
||||
- for b in p["boolean"]:
|
||||
+ for b in p["booleans"]:
|
||||
if boolean in b:
|
||||
boollist.append(p)
|
||||
except:
|
||||
@@ -1124,7 +1129,7 @@ def get_bools(setype):
|
||||
bools = []
|
||||
domainbools = []
|
||||
domainname, short_name = gen_short_name(setype)
|
||||
- for i in map(lambda x: x['boolean'], filter(lambda x: 'boolean' in x and x['source'] == setype, get_all_allow_rules())):
|
||||
+ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
|
||||
for b in i:
|
||||
if not isinstance(b, tuple):
|
||||
continue
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
From 25373db5cac520b85350db91b8a7ed0737d3316c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 24 Jan 2023 21:05:05 +0100
|
||||
Subject: [PATCH] python/sepolicy: Cache conditional rule queries
|
||||
|
||||
Commit 7506771e4b630fe0ab853f96574e039055cb72eb
|
||||
"add missing booleans to man pages" dramatically slowed down
|
||||
"sepolicy manpage -a" by removing caching of setools rule query.
|
||||
Re-add said caching and update the query to only return conditional
|
||||
rules.
|
||||
|
||||
Before commit 7506771e:
|
||||
#time sepolicy manpage -a
|
||||
real 1m43.153s
|
||||
# time sepolicy manpage -d httpd_t
|
||||
real 0m4.493s
|
||||
|
||||
After commit 7506771e:
|
||||
#time sepolicy manpage -a
|
||||
real 1h56m43.153s
|
||||
# time sepolicy manpage -d httpd_t
|
||||
real 0m8.352s
|
||||
|
||||
After this commit:
|
||||
#time sepolicy manpage -a
|
||||
real 1m41.074s
|
||||
# time sepolicy manpage -d httpd_t
|
||||
real 0m7.358s
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/__init__.py | 11 ++++++++++-
|
||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||
index 0f51174d..f48231e9 100644
|
||||
--- a/python/sepolicy/sepolicy/__init__.py
|
||||
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||
@@ -114,6 +114,7 @@ all_attributes = None
|
||||
booleans = None
|
||||
booleans_dict = None
|
||||
all_allow_rules = None
|
||||
+all_bool_rules = None
|
||||
all_transitions = None
|
||||
|
||||
|
||||
@@ -1119,6 +1120,14 @@ def get_all_allow_rules():
|
||||
all_allow_rules = search([ALLOW])
|
||||
return all_allow_rules
|
||||
|
||||
+def get_all_bool_rules():
|
||||
+ global all_bool_rules
|
||||
+ if not all_bool_rules:
|
||||
+ q = setools.TERuleQuery(_pol, boolean=".*", boolean_regex=True,
|
||||
+ ruletype=[ALLOW, DONTAUDIT])
|
||||
+ all_bool_rules = [_setools_rule_to_dict(x) for x in q.results()]
|
||||
+ return all_bool_rules
|
||||
+
|
||||
def get_all_transitions():
|
||||
global all_transitions
|
||||
if not all_transitions:
|
||||
@@ -1129,7 +1138,7 @@ def get_bools(setype):
|
||||
bools = []
|
||||
domainbools = []
|
||||
domainname, short_name = gen_short_name(setype)
|
||||
- for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
|
||||
+ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, get_all_bool_rules())):
|
||||
for b in i:
|
||||
if not isinstance(b, tuple):
|
||||
continue
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,98 @@
|
||||
From 7aef364bc6607953a34cb9e8fe9ea51c88379a5c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 6 Dec 2023 15:31:51 +0100
|
||||
Subject: [PATCH] python: Harden more tools against "rogue" modules
|
||||
|
||||
Python scripts present in the same directory as the tool
|
||||
override regular modules.
|
||||
|
||||
Fixes:
|
||||
#cat > /usr/bin/signal.py <<EOF
|
||||
import sys
|
||||
print("BAD GUY!", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
EOF
|
||||
#sandbox date
|
||||
BAD GUY!
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
dbus/selinux_server.py | 2 +-
|
||||
gui/polgengui.py | 2 +-
|
||||
gui/system-config-selinux.py | 6 +++---
|
||||
sandbox/sandbox | 2 +-
|
||||
sandbox/start | 2 +-
|
||||
5 files changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
|
||||
index 97bf91ba..eae38de5 100644
|
||||
--- a/dbus/selinux_server.py
|
||||
+++ b/dbus/selinux_server.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3
|
||||
+#!/usr/bin/python3 -EsI
|
||||
|
||||
import dbus
|
||||
import dbus.service
|
||||
diff --git a/gui/polgengui.py b/gui/polgengui.py
|
||||
index 46a1bd2c..0402e82c 100644
|
||||
--- a/gui/polgengui.py
|
||||
+++ b/gui/polgengui.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
#
|
||||
# polgengui.py - GUI for SELinux Config tool in system-config-selinux
|
||||
#
|
||||
diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
|
||||
index 1e0d5eb1..c344c076 100644
|
||||
--- a/gui/system-config-selinux.py
|
||||
+++ b/gui/system-config-selinux.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
#
|
||||
# system-config-selinux.py - GUI for SELinux Config tool in system-config-selinux
|
||||
#
|
||||
@@ -32,6 +32,8 @@ except RuntimeError as e:
|
||||
print("This is a graphical application and requires DISPLAY to be set.")
|
||||
sys.exit(1)
|
||||
|
||||
+sys.path.append('/usr/share/system-config-selinux')
|
||||
+
|
||||
from gi.repository import GObject
|
||||
import statusPage
|
||||
import booleansPage
|
||||
@@ -65,8 +67,6 @@ except:
|
||||
|
||||
version = "1.0"
|
||||
|
||||
-sys.path.append('/usr/share/system-config-selinux')
|
||||
-
|
||||
|
||||
##
|
||||
## Pull in the Glade file
|
||||
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||
index 707959a6..e276e594 100644
|
||||
--- a/sandbox/sandbox
|
||||
+++ b/sandbox/sandbox
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
# Authors: Dan Walsh <dwalsh@redhat.com>
|
||||
# Authors: Thomas Liu <tliu@fedoraproject.org>
|
||||
# Authors: Josh Cogliati
|
||||
diff --git a/sandbox/start b/sandbox/start
|
||||
index 4ed3cb5c..3c1a1783 100644
|
||||
--- a/sandbox/start
|
||||
+++ b/sandbox/start
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python3 -Es
|
||||
+#!/usr/bin/python3 -EsI
|
||||
try:
|
||||
from subprocess import getstatusoutput
|
||||
except ImportError:
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,95 @@
|
||||
From ea93da38a16eb44307b522f8a26f2d8f967fcc01 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Wed, 22 Nov 2023 12:29:43 +0100
|
||||
Subject: [PATCH] sepolicy: port to dnf4 python API
|
||||
|
||||
yum module is not available since RHEL 7.
|
||||
|
||||
Drop -systemd related code as it's obsoleted these days - only 2
|
||||
packages ship their .service in -systemd subpackage
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/generate.py | 56 +++++++++++++---------------
|
||||
1 file changed, 25 insertions(+), 31 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||
index 93caedee..c841a499 100644
|
||||
--- a/python/sepolicy/sepolicy/generate.py
|
||||
+++ b/python/sepolicy/sepolicy/generate.py
|
||||
@@ -1265,24 +1265,20 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||
return fcfile
|
||||
|
||||
def __extract_rpms(self):
|
||||
- import yum
|
||||
- yb = yum.YumBase()
|
||||
- yb.setCacheDir()
|
||||
-
|
||||
- for pkg in yb.rpmdb.searchProvides(self.program):
|
||||
- self.rpms.append(pkg.name)
|
||||
- for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist:
|
||||
- for b in self.DEFAULT_DIRS:
|
||||
- if b == "/etc":
|
||||
- continue
|
||||
- if fname.startswith(b):
|
||||
- if os.path.isfile(fname):
|
||||
- self.add_file(fname)
|
||||
- else:
|
||||
- self.add_dir(fname)
|
||||
+ import dnf
|
||||
+
|
||||
+ with dnf.Base() as base:
|
||||
+ base.read_all_repos()
|
||||
+ base.fill_sack(load_system_repo=True)
|
||||
+
|
||||
+ query = base.sack.query()
|
||||
|
||||
- for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]):
|
||||
- for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist:
|
||||
+ pq = query.available()
|
||||
+ pq = pq.filter(file=self.program)
|
||||
+
|
||||
+ for pkg in pq:
|
||||
+ self.rpms.append(pkg.name)
|
||||
+ for fname in pkg.files:
|
||||
for b in self.DEFAULT_DIRS:
|
||||
if b == "/etc":
|
||||
continue
|
||||
@@ -1291,20 +1287,18 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||
self.add_file(fname)
|
||||
else:
|
||||
self.add_dir(fname)
|
||||
-
|
||||
- # some packages have own systemd subpackage
|
||||
- # tor-systemd for example
|
||||
- binary_name = self.program.split("/")[-1]
|
||||
- for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]):
|
||||
- for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist:
|
||||
- for b in self.DEFAULT_DIRS:
|
||||
- if b == "/etc":
|
||||
- continue
|
||||
- if fname.startswith(b):
|
||||
- if os.path.isfile(fname):
|
||||
- self.add_file(fname)
|
||||
- else:
|
||||
- self.add_dir(fname)
|
||||
+ sq = query.available()
|
||||
+ sq = sq.filter(provides=pkg.source_name)
|
||||
+ for bpkg in sq:
|
||||
+ for fname in bpkg.files:
|
||||
+ for b in self.DEFAULT_DIRS:
|
||||
+ if b == "/etc":
|
||||
+ continue
|
||||
+ if fname.startswith(b):
|
||||
+ if os.path.isfile(fname):
|
||||
+ self.add_file(fname)
|
||||
+ else:
|
||||
+ self.add_dir(fname)
|
||||
|
||||
def gen_writeable(self):
|
||||
try:
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,64 @@
|
||||
From b6fa6e77d5d40a5c1b5f4be95500aa1a05147e5b Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 7 Feb 2024 15:46:23 +0100
|
||||
Subject: [PATCH] python/semanage: Do not sort local fcontext definitions
|
||||
|
||||
Entries in file_contexts.local are processed from the most recent one to
|
||||
the oldest, with first match being used. Therefore it is important to
|
||||
preserve their order when listing (semanage fcontext -lC) and exporting
|
||||
(semanage export).
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
gui/fcontextPage.py | 6 +++++-
|
||||
python/semanage/seobject.py | 9 +++++++--
|
||||
2 files changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
|
||||
index e424366d..01a403a2 100644
|
||||
--- a/gui/fcontextPage.py
|
||||
+++ b/gui/fcontextPage.py
|
||||
@@ -125,7 +125,11 @@ class fcontextPage(semanagePage):
|
||||
self.fcontext = seobject.fcontextRecords()
|
||||
self.store.clear()
|
||||
fcon_dict = self.fcontext.get_all(self.local)
|
||||
- for k in sorted(fcon_dict.keys()):
|
||||
+ if self.local:
|
||||
+ fkeys = fcon_dict.keys()
|
||||
+ else:
|
||||
+ fkeys = sorted(fcon_dict.keys())
|
||||
+ for k in fkeys:
|
||||
if not self.match(fcon_dict, k, filter):
|
||||
continue
|
||||
iter = self.store.append()
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 0e923a0d..dd915a69 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -2644,7 +2644,7 @@ class fcontextRecords(semanageRecords):
|
||||
def customized(self):
|
||||
l = []
|
||||
fcon_dict = self.get_all(True)
|
||||
- for k in sorted(fcon_dict.keys()):
|
||||
+ for k in fcon_dict.keys():
|
||||
if fcon_dict[k]:
|
||||
if fcon_dict[k][3]:
|
||||
l.append("-a -f %s -t %s -r '%s' '%s'" % (file_type_str_to_option[k[1]], fcon_dict[k][2], fcon_dict[k][3], k[0]))
|
||||
@@ -2661,7 +2661,12 @@ class fcontextRecords(semanageRecords):
|
||||
if len(fcon_dict) != 0:
|
||||
if heading:
|
||||
print("%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context")))
|
||||
- for k in sorted(fcon_dict.keys()):
|
||||
+ # do not sort local customizations since they are evaluated based on the order they where added in
|
||||
+ if locallist:
|
||||
+ fkeys = fcon_dict.keys()
|
||||
+ else:
|
||||
+ fkeys = sorted(fcon_dict.keys())
|
||||
+ for k in fkeys:
|
||||
if fcon_dict[k]:
|
||||
if is_mls_enabled:
|
||||
print("%-50s %-18s %s:%s:%s:%s " % (k[0], k[1], fcon_dict[k][0], fcon_dict[k][1], fcon_dict[k][2], translate(fcon_dict[k][3], False)))
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -0,0 +1,396 @@
|
||||
From 108a7d43dd8fa4f5cb682f9df9c15304fa4eddea Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 14 Feb 2024 13:08:40 +0100
|
||||
Subject: [PATCH] python/semanage: Allow modifying records on "add"
|
||||
|
||||
When trying to add a record with a key that already exists, modify
|
||||
the existing record instead.
|
||||
|
||||
Also, fix "semanage -m -e" (add_equal was called instead of
|
||||
modify_equal), which meant that existing local equivalency couldn't be
|
||||
modified (though a user could remove it and add a modified
|
||||
equivalency).
|
||||
|
||||
Fixes:
|
||||
https://github.com/SELinuxProject/selinux/issues/412
|
||||
When a port or login definition present in the policy is modified
|
||||
using "semanage port -m", "semanage export" exports the command as
|
||||
"port -a" instead of "port -m". This results in "semanage import"
|
||||
failing (port already defined). The same is true for port, user,
|
||||
login, ibpkey, ibendport, node, interface and fcontext.
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
python/semanage/semanage | 2 +-
|
||||
python/semanage/seobject.py | 208 +++++++++++++++++++++++++-----------
|
||||
2 files changed, 147 insertions(+), 63 deletions(-)
|
||||
|
||||
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||
index 1f170f60..f55751b6 100644
|
||||
--- a/python/semanage/semanage
|
||||
+++ b/python/semanage/semanage
|
||||
@@ -316,7 +316,7 @@ def handleFcontext(args):
|
||||
OBJECT.add(args.file_spec, args.type, args.ftype, args.range, args.seuser)
|
||||
if args.action == "modify":
|
||||
if args.equal:
|
||||
- OBJECT.add_equal(args.file_spec, args.equal)
|
||||
+ OBJECT.modify_equal(args.file_spec, args.equal)
|
||||
else:
|
||||
OBJECT.modify(args.file_spec, args.type, args.ftype, args.range, args.seuser)
|
||||
if args.action == "delete":
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index dd915a69..f6c559a7 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -560,11 +560,6 @@ class loginRecords(semanageRecords):
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc, exists) = semanage_seuser_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
- if exists:
|
||||
- raise ValueError(_("Login mapping for %s is already defined") % name)
|
||||
if name[0] == '%':
|
||||
try:
|
||||
grp.getgrnam(name[1:])
|
||||
@@ -603,11 +598,29 @@ class loginRecords(semanageRecords):
|
||||
def add(self, name, sename, serange):
|
||||
try:
|
||||
self.begin()
|
||||
- self.__add(name, sename, serange)
|
||||
+ # Add a new mapping, or modify an existing one
|
||||
+ if self.__exists(name):
|
||||
+ print(_("Login mapping for %s is already defined, modifying instead") % name)
|
||||
+ self.__modify(name, sename, serange)
|
||||
+ else:
|
||||
+ self.__add(name, sename, serange)
|
||||
self.commit()
|
||||
except ValueError as error:
|
||||
raise error
|
||||
|
||||
+ # check if login mapping for given user exists
|
||||
+ def __exists(self, name):
|
||||
+ (rc, k) = semanage_seuser_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
+
|
||||
+ (rc, exists) = semanage_seuser_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if login mapping for %s is defined") % name)
|
||||
+ semanage_seuser_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, name, sename="", serange=""):
|
||||
rec, self.oldsename, self.oldserange = selinux.getseuserbyname(name)
|
||||
if sename == "" and serange == "":
|
||||
@@ -824,12 +837,6 @@ class seluserRecords(semanageRecords):
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create a key for %s") % name)
|
||||
|
||||
- (rc, exists) = semanage_user_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
- if exists:
|
||||
- raise ValueError(_("SELinux user %s is already defined") % name)
|
||||
-
|
||||
(rc, u) = semanage_user_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create SELinux user for %s") % name)
|
||||
@@ -869,12 +876,28 @@ class seluserRecords(semanageRecords):
|
||||
def add(self, name, roles, selevel, serange, prefix):
|
||||
try:
|
||||
self.begin()
|
||||
- self.__add(name, roles, selevel, serange, prefix)
|
||||
+ if self.__exists(name):
|
||||
+ print(_("SELinux user %s is already defined, modifying instead") % name)
|
||||
+ self.__modify(name, roles, selevel, serange, prefix)
|
||||
+ else:
|
||||
+ self.__add(name, roles, selevel, serange, prefix)
|
||||
self.commit()
|
||||
except ValueError as error:
|
||||
self.mylog.commit(0)
|
||||
raise error
|
||||
|
||||
+ def __exists(self, name):
|
||||
+ (rc, k) = semanage_user_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
+
|
||||
+ (rc, exists) = semanage_user_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if SELinux user %s is defined") % name)
|
||||
+ semanage_user_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, name, roles=[], selevel="", serange="", prefix=""):
|
||||
oldserole = ""
|
||||
oldserange = ""
|
||||
@@ -1102,12 +1125,6 @@ class portRecords(semanageRecords):
|
||||
|
||||
(k, proto_d, low, high) = self.__genkey(port, proto)
|
||||
|
||||
- (rc, exists) = semanage_port_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
|
||||
- if exists:
|
||||
- raise ValueError(_("Port %s/%s already defined") % (proto, port))
|
||||
-
|
||||
(rc, p) = semanage_port_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create port for %s/%s") % (proto, port))
|
||||
@@ -1151,9 +1168,23 @@ class portRecords(semanageRecords):
|
||||
|
||||
def add(self, port, proto, serange, type):
|
||||
self.begin()
|
||||
- self.__add(port, proto, serange, type)
|
||||
+ if self.__exists(port, proto):
|
||||
+ print(_("Port {proto}/{port} already defined, modifying instead").format(proto=proto, port=port))
|
||||
+ self.__modify(port, proto, serange, type)
|
||||
+ else:
|
||||
+ self.__add(port, proto, serange, type)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, port, proto):
|
||||
+ (k, proto_d, low, high) = self.__genkey(port, proto)
|
||||
+
|
||||
+ (rc, exists) = semanage_port_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port))
|
||||
+ semanage_port_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, port, proto, serange, setype):
|
||||
if serange == "" and setype == "":
|
||||
if is_mls_enabled == 1:
|
||||
@@ -1376,12 +1407,6 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
(k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix)
|
||||
|
||||
- (rc, exists) = semanage_ibpkey_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey))
|
||||
- if exists:
|
||||
- raise ValueError(_("ibpkey %s/%s already defined") % (subnet_prefix, pkey))
|
||||
-
|
||||
(rc, p) = semanage_ibpkey_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create ibpkey for %s/%s") % (subnet_prefix, pkey))
|
||||
@@ -1423,9 +1448,23 @@ class ibpkeyRecords(semanageRecords):
|
||||
|
||||
def add(self, pkey, subnet_prefix, serange, type):
|
||||
self.begin()
|
||||
- self.__add(pkey, subnet_prefix, serange, type)
|
||||
+ if self.__exists(pkey, subnet_prefix):
|
||||
+ print(_("ibpkey {subnet_prefix}/{pkey} already defined, modifying instead").format(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
+ self.__modify(pkey, subnet_prefix, serange, type)
|
||||
+ else:
|
||||
+ self.__add(pkey, subnet_prefix, serange, type)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, pkey, subnet_prefix):
|
||||
+ (k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix)
|
||||
+
|
||||
+ (rc, exists) = semanage_ibpkey_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").formnat(subnet_prefix=subnet_prefix, pkey=pkey))
|
||||
+ semanage_ibpkey_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, pkey, subnet_prefix, serange, setype):
|
||||
if serange == "" and setype == "":
|
||||
if is_mls_enabled == 1:
|
||||
@@ -1630,12 +1669,6 @@ class ibendportRecords(semanageRecords):
|
||||
raise ValueError(_("Type %s is invalid, must be an ibendport type") % type)
|
||||
(k, ibendport, port) = self.__genkey(ibendport, ibdev_name)
|
||||
|
||||
- (rc, exists) = semanage_ibendport_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, port))
|
||||
- if exists:
|
||||
- raise ValueError(_("ibendport %s/%s already defined") % (ibdev_name, port))
|
||||
-
|
||||
(rc, p) = semanage_ibendport_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create ibendport for %s/%s") % (ibdev_name, port))
|
||||
@@ -1677,9 +1710,23 @@ class ibendportRecords(semanageRecords):
|
||||
|
||||
def add(self, ibendport, ibdev_name, serange, type):
|
||||
self.begin()
|
||||
- self.__add(ibendport, ibdev_name, serange, type)
|
||||
+ if self.__exists(ibendport, ibdev_name):
|
||||
+ print(_("ibendport {ibdev_name}/{port} already defined, modifying instead").format(ibdev_name=ibdev_name, port=port))
|
||||
+ self.__modify(ibendport, ibdev_name, serange, type)
|
||||
+ else:
|
||||
+ self.__add(ibendport, ibdev_name, serange, type)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, ibendport, ibdev_name):
|
||||
+ (k, ibendport, port) = self.__genkey(ibendport, ibdev_name)
|
||||
+
|
||||
+ (rc, exists) = semanage_ibendport_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{port} is defined").format(ibdev_name=ibdev_name, port=port))
|
||||
+ semanage_ibendport_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, ibendport, ibdev_name, serange, setype):
|
||||
if serange == "" and setype == "":
|
||||
if is_mls_enabled == 1:
|
||||
@@ -1891,12 +1938,6 @@ class nodeRecords(semanageRecords):
|
||||
(rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create key for %s") % addr)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if addr %s is defined") % addr)
|
||||
-
|
||||
- (rc, exists) = semanage_node_exists(self.sh, k)
|
||||
- if exists:
|
||||
- raise ValueError(_("Addr %s already defined") % addr)
|
||||
|
||||
(rc, node) = semanage_node_create(self.sh)
|
||||
if rc < 0:
|
||||
@@ -1945,9 +1986,27 @@ class nodeRecords(semanageRecords):
|
||||
|
||||
def add(self, addr, mask, proto, serange, ctype):
|
||||
self.begin()
|
||||
- self.__add(addr, mask, proto, serange, ctype)
|
||||
+ if self.__exists(addr, mask, proto):
|
||||
+ print(_("Addr %s already defined, modifying instead") % addr)
|
||||
+ self.__modify(addr, mask, proto, serange, ctype)
|
||||
+ else:
|
||||
+ self.__add(addr, mask, proto, serange, ctype)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, addr, mask, proto):
|
||||
+ addr, mask, proto = self.validate(addr, mask, proto)
|
||||
+
|
||||
+ (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create key for %s") % addr)
|
||||
+
|
||||
+ (rc, exists) = semanage_node_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if addr %s is defined") % addr)
|
||||
+ semanage_node_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, addr, mask, proto, serange, setype):
|
||||
addr, mask, proto = self.validate(addr, mask, proto)
|
||||
|
||||
@@ -2102,12 +2161,6 @@ class interfaceRecords(semanageRecords):
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create key for %s") % interface)
|
||||
|
||||
- (rc, exists) = semanage_iface_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if interface %s is defined") % interface)
|
||||
- if exists:
|
||||
- raise ValueError(_("Interface %s already defined") % interface)
|
||||
-
|
||||
(rc, iface) = semanage_iface_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create interface for %s") % interface)
|
||||
@@ -2154,9 +2207,25 @@ class interfaceRecords(semanageRecords):
|
||||
|
||||
def add(self, interface, serange, ctype):
|
||||
self.begin()
|
||||
- self.__add(interface, serange, ctype)
|
||||
+ if self.__exists(interface):
|
||||
+ print(_("Interface %s already defined, modifying instead") % interface)
|
||||
+ self.__modify(interface, serange, ctype)
|
||||
+ else:
|
||||
+ self.__add(interface, serange, ctype)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, interface):
|
||||
+ (rc, k) = semanage_iface_key_create(self.sh, interface)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create key for %s") % interface)
|
||||
+
|
||||
+ (rc, exists) = semanage_iface_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if interface %s is defined") % interface)
|
||||
+ semanage_iface_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, interface, serange, setype):
|
||||
if serange == "" and setype == "":
|
||||
raise ValueError(_("Requires setype or serange"))
|
||||
@@ -2344,7 +2413,13 @@ class fcontextRecords(semanageRecords):
|
||||
raise ValueError(_("Substitute %s is not valid. Substitute is not allowed to end with '/'") % substitute)
|
||||
|
||||
if target in self.equiv.keys():
|
||||
- raise ValueError(_("Equivalence class for %s already exists") % target)
|
||||
+ print(_("Equivalence class for %s already exists, modifying instead") % target)
|
||||
+ self.equiv[target] = substitute
|
||||
+ self.equal_ind = True
|
||||
+ self.mylog.log_change("resrc=fcontext op=modify-equal %s %s" % (audit.audit_encode_nv_string("sglob", target, 0), audit.audit_encode_nv_string("tglob", substitute, 0)))
|
||||
+ self.commit()
|
||||
+ return
|
||||
+
|
||||
self.validate(target)
|
||||
|
||||
for fdict in (self.equiv, self.equiv_dist):
|
||||
@@ -2420,18 +2495,6 @@ class fcontextRecords(semanageRecords):
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create key for %s") % target)
|
||||
|
||||
- (rc, exists) = semanage_fcontext_exists(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
-
|
||||
- if not exists:
|
||||
- (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
||||
- if rc < 0:
|
||||
- raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
-
|
||||
- if exists:
|
||||
- raise ValueError(_("File context for %s already defined") % target)
|
||||
-
|
||||
(rc, fcontext) = semanage_fcontext_create(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not create file context for %s") % target)
|
||||
@@ -2470,9 +2533,30 @@ class fcontextRecords(semanageRecords):
|
||||
|
||||
def add(self, target, type, ftype="", serange="", seuser="system_u"):
|
||||
self.begin()
|
||||
- self.__add(target, type, ftype, serange, seuser)
|
||||
+ if self.__exists(target, ftype):
|
||||
+ print(_("File context for %s already defined, modifying instead") % target)
|
||||
+ self.__modify(target, type, ftype, serange, seuser)
|
||||
+ else:
|
||||
+ self.__add(target, type, ftype, serange, seuser)
|
||||
self.commit()
|
||||
|
||||
+ def __exists(self, target, ftype):
|
||||
+ (rc, k) = semanage_fcontext_key_create(self.sh, target, file_types[ftype])
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create key for %s") % target)
|
||||
+
|
||||
+ (rc, exists) = semanage_fcontext_exists(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
+
|
||||
+ if not exists:
|
||||
+ (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||
+ semanage_fcontext_key_free(k)
|
||||
+
|
||||
+ return exists
|
||||
+
|
||||
def __modify(self, target, setype, ftype, serange, seuser):
|
||||
if serange == "" and setype == "" and seuser == "":
|
||||
raise ValueError(_("Requires setype, serange or seuser"))
|
||||
--
|
||||
2.43.0
|
||||
|
||||
Loading…
Reference in new issue