Menu
▾
▴
selinux-commits
|
From: <kma...@us...> - 2007-01-16 15:36:57
|
Revision: 2175
http://svn.sourceforge.net/selinux/?rev=2175&view=rev
Author: kmacmillan
Date: 2007-01-16 07:36:53 -0800 (Tue, 16 Jan 2007)
Log Message:
-----------
Author: Daniel J Walsh
Email: dw...@re...
Subject: translation patch for semanage
Date: Thu, 11 Jan 2007 09:09:42 -0500
This patch works around a unicode problem in python.
Signed-off-by: Karl MacMillan <kma...@me...>
Modified Paths:
--------------
trunk/policycoreutils/semanage/semanage
trunk/policycoreutils/semanage/seobject.py
Modified: trunk/policycoreutils/semanage/semanage
===================================================================
--- trunk/policycoreutils/semanage/semanage 2007-01-11 17:51:28 UTC (rev 2174)
+++ trunk/policycoreutils/semanage/semanage 2007-01-16 15:36:53 UTC (rev 2175)
@@ -23,12 +23,21 @@
import os, sys, getopt
import seobject
import selinux
+PROGNAME="policycoreutils"
+
import gettext
+gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
+gettext.textdomain(PROGNAME)
+import codecs
+import locale
+sys.stderr = codecs.getwriter(locale.getpreferredencoding())(sys.__stderr__, 'replace')
+sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.__stdout__, 'replace')
try:
- gettext.install('policycoreutils')
-except:
- pass
+ gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
+except IOError:
+ import __builtin__
+ __builtin__.__dict__['_'] = unicode
is_mls_enabled=selinux.is_selinux_mls_enabled()
Modified: trunk/policycoreutils/semanage/seobject.py
===================================================================
--- trunk/policycoreutils/semanage/seobject.py 2007-01-11 17:51:28 UTC (rev 2174)
+++ trunk/policycoreutils/semanage/seobject.py 2007-01-16 15:36:53 UTC (rev 2175)
@@ -23,13 +23,16 @@
import pwd, string, selinux, tempfile, os, re, sys
from semanage import *;
+PROGNAME="policycoreutils"
+
import gettext
-
+gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
+gettext.textdomain(PROGNAME)
try:
- t = gettext.translation('policycoreutils', '/usr/share/locale')
- _ = t.ugettext
-except:
- pass
+ gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
+except IOError:
+ import __builtin__
+ __builtin__.__dict__['_'] = unicode
is_mls_enabled = selinux.is_selinux_mls_enabled()
@@ -168,7 +171,7 @@
def list(self,heading = 1):
if heading:
- print "\n%-25s %s\n" % ("Level", "Translation")
+ print "\n%-25s %s\n" % (_("Level"), _("Translation"))
keys = self.ddict.keys()
keys.sort()
for k in keys:
@@ -288,10 +291,10 @@
raise ValueError(_("Could not add login mapping for %s") % name)
except ValueError, error:
- mylog.log(0, "add SELinux user mapping", name, sename, "", serange);
+ mylog.log(0, _("add SELinux user mapping"), name, sename, "", serange);
raise error
- mylog.log(1, "add SELinux user mapping", name, sename, "", serange);
+ mylog.log(1, _("add SELinux user mapping"), name, sename, "", serange);
semanage_seuser_key_free(k)
semanage_seuser_free(u)
@@ -403,12 +406,12 @@
keys.sort()
if is_mls_enabled == 1:
if heading:
- print "\n%-25s %-25s %-25s\n" % ("Login Name", "SELinux User", "MLS/MCS Range")
+ print "\n%-25s %-25s %-25s\n" % (_("Login Name"), _("SELinux User"), _("MLS/MCS Range"))
for k in keys:
print "%-25s %-25s %-25s" % (k, ddict[k][0], translate(ddict[k][1]))
else:
if heading:
- print "\n%-25s %-25s\n" % ("Login Name", "SELinux User")
+ print "\n%-25s %-25s\n" % (_("Login Name"), _("SELinux User"))
for k in keys:
print "%-25s %-25s" % (k, ddict[k][0])
@@ -617,13 +620,13 @@
keys.sort()
if is_mls_enabled == 1:
if heading:
- print "\n%-15s %-10s %-10s %-30s" % ("", "Labeling", "MLS/", "MLS/")
- print "%-15s %-10s %-10s %-30s %s\n" % ("SELinux User", "Prefix", "MCS Level", "MCS Range", "SELinux Roles")
+ print "\n%-15s %-10s %-10s %-30s" % ("", _("Labeling"), _("MLS/"), _("MLS/"))
+ print "%-15s %-10s %-10s %-30s %s\n" % (_("SELinux User"), _("Prefix"), _("MCS Level"), _("MCS Range"), _("SELinux Roles"))
for k in keys:
print "%-15s %-10s %-10s %-30s %s" % (k, ddict[k][0], translate(ddict[k][1]), translate(ddict[k][2]), ddict[k][3])
else:
if heading:
- print "%-15s %s\n" % ("SELinux User", "SELinux Roles")
+ print "%-15s %s\n" % (_("SELinux User"), _("SELinux Roles"))
for k in keys:
print "%-15s %s" % (k, ddict[k][3])
@@ -832,7 +835,7 @@
def list(self, heading = 1):
if heading:
- print "%-30s %-8s %s\n" % ("SELinux Port Type", "Proto", "Port Number")
+ print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number"))
ddict = self.get_all_by_type()
keys = ddict.keys()
keys.sort()
@@ -1002,7 +1005,7 @@
def list(self, heading = 1):
if heading:
- print "%-30s %s\n" % ("SELinux Interface", "Context")
+ print "%-30s %s\n" % (_("SELinux Interface"), _("Context"))
ddict = self.get_all()
keys = ddict.keys()
keys.sort()
@@ -1186,7 +1189,7 @@
def list(self, heading = 1):
if heading:
- print "%-50s %-18s %s\n" % ("SELinux fcontext", "type", "Context")
+ print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
fcon_list = self.get_all()
for fcon in fcon_list:
if len(fcon) > 3:
@@ -1284,7 +1287,7 @@
def list(self, heading = 1):
if heading:
- print "%-50s %-18s\n" % ("SELinux boolean", "value")
+ print "%-50s %-18s\n" % (_("SELinux boolean"), _("value"))
ddict = self.get_all()
keys = ddict.keys()
for k in keys:
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
|
From: <ssm...@us...> - 2007-10-05 13:43:24
|
Revision: 2632
http://selinux.svn.sourceforge.net/selinux/?rev=2632&view=rev
Author: ssmalley
Date: 2007-10-05 06:43:23 -0700 (Fri, 05 Oct 2007)
Log Message:
-----------
Author: Daniel J Walsh
Email: dw...@re...
Subject: policycoreutils patch for semanage/seobject.py
Date: Wed, 03 Oct 2007 11:31:22 -0400
Patch implements handling of booleans via semanage
Adds display of local list. So you can either show all booleans,
fcontext, ports or just your local modifications.
Implements a store command, so you can use semanage to manage
alternative stores.
Implements deleteall so you can remove all local customizations.
Add support for <<none>> as a context type for fcontext.
Modified Paths:
--------------
trunk/policycoreutils/semanage/semanage
trunk/policycoreutils/semanage/seobject.py
Modified: trunk/policycoreutils/semanage/semanage
===================================================================
--- trunk/policycoreutils/semanage/semanage 2007-10-05 13:42:48 UTC (rev 2631)
+++ trunk/policycoreutils/semanage/semanage 2007-10-05 13:43:23 UTC (rev 2632)
@@ -48,13 +48,14 @@
def usage(message = ""):
print _('\
-semanage {login|user|port|interface|fcontext|translation} -l [-n] \n\
+semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\
semanage login -{a|d|m} [-sr] login_name\n\
semanage user -{a|d|m} [-LrRP] selinux_name\n\
semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\
semanage interface -{a|d|m} [-tr] interface_spec\n\
semanage fcontext -{a|d|m} [-frst] file_spec\n\
semanage translation -{a|d|m} [-T] level\n\n\
+semanage boolean -{d|m} boolean\n\n\
\
Primary Options:\n\
\
@@ -62,10 +63,12 @@
-d, --delete Delete a OBJECT record NAME\n\
-m, --modify Modify a OBJECT record NAME\n\
-l, --list List the OBJECTS\n\n\
+ -C, --locallist List OBJECTS local customizations\n\n\
+ -D, --deleteall Remove all OBJECTS local customizations\n\
\
-h, --help Display this message\n\
- -n, --noheading Do not print heading when listing OBJECTS\n\n\
-\
+ -n, --noheading Do not print heading when listing OBJECTS\n\
+ -S, --store Select and alternate SELinux store to manage\n\n\
Object-specific Options (see above):\n\
-f, --ftype File Type of OBJECT \n\
"" (all files) \n\
@@ -98,7 +101,7 @@
def get_options():
valid_option={}
- valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading' ]
+ valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-C', '--locallist', '-D', '--deleteall', '-S', '--store' ]
valid_option["login"] = []
valid_option["login"] += valid_everyone + [ '-s', '--seuser', '-r', '--range']
valid_option["user"] = []
@@ -111,6 +114,8 @@
valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range']
valid_option["translation"] = []
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
+ valid_option["boolean"] = []
+ valid_option["boolean"] += valid_everyone
return valid_option
#
@@ -134,7 +139,10 @@
add = 0
modify = 0
delete = 0
+ deleteall = 0
list = 0
+ locallist = 0
+ store = ""
if len(sys.argv) < 3:
usage(_("Requires 2 or more arguments"))
@@ -146,16 +154,19 @@
args = sys.argv[2:]
gopts, cmds = getopt.getopt(args,
- 'adf:lhmnp:s:R:L:r:t:T:P:',
+ 'adf:lhmnp:s:CDR:L:r:t:T:P:S:',
['add',
'delete',
+ 'deleteall',
'ftype=',
'help',
'list',
'modify',
'noheading',
+ 'localist',
'proto=',
'seuser=',
+ 'store=',
'range=',
'level=',
'roles=',
@@ -177,6 +188,10 @@
if modify or add:
usage()
delete = 1
+ if o == "-D" or o == "--deleteall":
+ if modify:
+ usage()
+ deleteall = 1
if o == "-f" or o == "--ftype":
ftype=a
if o == "-h" or o == "--help":
@@ -185,11 +200,17 @@
if o == "-n" or o == "--noheading":
heading=0
+ if o == "-C" or o == "--locallist":
+ locallist=1
+
if o == "-m"or o == "--modify":
if delete or add:
usage()
modify = 1
+ if o == "-S" or o == '--store':
+ store = a
+
if o == "-r" or o == '--range':
if is_mls_enabled == 0:
errorExit(_("range not supported on Non MLS machines"))
@@ -222,32 +243,39 @@
setrans = a
if object == "login":
- OBJECT = seobject.loginRecords()
+ OBJECT = seobject.loginRecords(store)
if object == "user":
- OBJECT = seobject.seluserRecords()
+ OBJECT = seobject.seluserRecords(store)
if object == "port":
- OBJECT = seobject.portRecords()
+ OBJECT = seobject.portRecords(store)
if object == "interface":
- OBJECT = seobject.interfaceRecords()
+ OBJECT = seobject.interfaceRecords(store)
if object == "fcontext":
- OBJECT = seobject.fcontextRecords()
+ OBJECT = seobject.fcontextRecords(store)
+ if object == "boolean":
+ OBJECT = seobject.booleanRecords(store)
+
if object == "translation":
OBJECT = seobject.setransRecords()
if list:
- OBJECT.list(heading)
+ OBJECT.list(heading, locallist)
sys.exit(0);
+ if deleteall:
+ OBJECT.deleteall()
+ sys.exit(0);
+
if len(cmds) != 1:
usage()
+
+ target = cmds[0]
- target = cmds[0]
-
if add:
if object == "login":
OBJECT.add(target, seuser, serange)
@@ -274,6 +302,9 @@
sys.exit(0);
if modify:
+ if object == "boolean":
+ OBJECT.modify(target, value)
+
if object == "login":
OBJECT.modify(target, seuser, serange)
Modified: trunk/policycoreutils/semanage/seobject.py
===================================================================
--- trunk/policycoreutils/semanage/seobject.py 2007-10-05 13:42:48 UTC (rev 2631)
+++ trunk/policycoreutils/semanage/seobject.py 2007-10-05 13:43:23 UTC (rev 2632)
@@ -170,7 +170,7 @@
rec += "%s=%s\n" % (k, self.ddict[k])
return rec
- def list(self,heading = 1):
+ def list(self,heading = 1, locallist = 0):
if heading:
print "\n%-25s %s\n" % (_("Level"), _("Translation"))
keys = self.ddict.keys()
@@ -210,13 +210,17 @@
os.write(fd, self.out())
os.close(fd)
os.rename(newfilename, self.filename)
+ os.system("/sbin/service mcstrans reload > /dev/null")
class semanageRecords:
- def __init__(self):
+ def __init__(self, store):
self.sh = semanage_handle_create()
if not self.sh:
raise ValueError(_("Could not create semanage handle"))
+ if store != "":
+ semanage_select_store(self.sh, store, SEMANAGE_CON_DIRECT);
+
self.semanaged = semanage_is_managed(self.sh)
if not self.semanaged:
@@ -234,8 +238,8 @@
raise ValueError(_("Could not establish semanage connection"))
class loginRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
def add(self, name, sename, serange):
if is_mls_enabled == 1:
@@ -389,10 +393,12 @@
mylog.log(1,"delete SELinux user mapping", name);
semanage_seuser_key_free(k)
-
- def get_all(self):
+ def get_all(self, locallist = 0):
ddict = {}
- (rc, self.ulist) = semanage_seuser_list(self.sh)
+ if locallist:
+ (rc, self.ulist) = semanage_seuser_list_local(self.sh)
+ else:
+ (rc, self.ulist) = semanage_seuser_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list login mappings"))
@@ -401,8 +407,8 @@
ddict[name] = (semanage_seuser_get_sename(u), semanage_seuser_get_mlsrange(u))
return ddict
- def list(self,heading = 1):
- ddict = self.get_all()
+ def list(self,heading = 1, locallist = 0):
+ ddict = self.get_all(locallist)
keys = ddict.keys()
keys.sort()
if is_mls_enabled == 1:
@@ -417,8 +423,8 @@
print "%-25s %-25s" % (k, ddict[k][0])
class seluserRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
def add(self, name, roles, selevel, serange, prefix):
if is_mls_enabled == 1:
@@ -601,9 +607,12 @@
mylog.log(1,"delete SELinux user record", name)
semanage_user_key_free(k)
- def get_all(self):
+ def get_all(self, locallist = 0):
ddict = {}
- (rc, self.ulist) = semanage_user_list(self.sh)
+ if locallist:
+ (rc, self.ulist) = semanage_user_list_local(self.sh)
+ else:
+ (rc, self.ulist) = semanage_user_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list SELinux users"))
@@ -618,8 +627,8 @@
return ddict
- def list(self, heading = 1):
- ddict = self.get_all()
+ def list(self, heading = 1, locallist = 0):
+ ddict = self.get_all(locallist)
keys = ddict.keys()
keys.sort()
if is_mls_enabled == 1:
@@ -635,8 +644,8 @@
print "%-15s %s" % (k, ddict[k][3])
class portRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
def __genkey(self, port, proto):
if proto == "tcp":
@@ -795,9 +804,12 @@
semanage_port_key_free(k)
- def get_all(self):
+ def get_all(self, locallist = 0):
ddict = {}
- (rc, self.plist) = semanage_port_list(self.sh)
+ if locallist:
+ (rc, self.plist) = semanage_port_list_local(self.sh)
+ else:
+ (rc, self.plist) = semanage_port_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list ports"))
@@ -814,9 +826,12 @@
ddict[(low, high)] = (ctype, proto_str, level)
return ddict
- def get_all_by_type(self):
+ def get_all_by_type(self, locallist = 0):
ddict = {}
- (rc, self.plist) = semanage_port_list(self.sh)
+ if locallist:
+ (rc, self.plist) = semanage_port_list_local(self.sh)
+ else:
+ (rc, self.plist) = semanage_port_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list ports"))
@@ -837,10 +852,10 @@
ddict[(ctype,proto_str)].append("%d-%d" % (low, high))
return ddict
- def list(self, heading = 1):
+ def list(self, heading = 1, locallist = 0):
if heading:
print "%-30s %-8s %s\n" % (_("SELinux Port Type"), _("Proto"), _("Port Number"))
- ddict = self.get_all_by_type()
+ ddict = self.get_all_by_type(locallist)
keys = ddict.keys()
keys.sort()
for i in keys:
@@ -851,8 +866,8 @@
print rec
class interfaceRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
def add(self, interface, serange, ctype):
if is_mls_enabled == 1:
@@ -995,9 +1010,12 @@
semanage_iface_key_free(k)
- def get_all(self):
+ def get_all(self, locallist = 0):
ddict = {}
- (rc, self.ilist) = semanage_iface_list(self.sh)
+ if locallist:
+ (rc, self.ilist) = semanage_iface_list_local(self.sh)
+ else:
+ (rc, self.ilist) = semanage_iface_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list interfaces"))
@@ -1007,10 +1025,10 @@
return ddict
- def list(self, heading = 1):
+ def list(self, heading = 1, locallist = 0):
if heading:
print "%-30s %s\n" % (_("SELinux Interface"), _("Context"))
- ddict = self.get_all()
+ ddict = self.get_all(locallist)
keys = ddict.keys()
keys.sort()
if is_mls_enabled:
@@ -1021,17 +1039,34 @@
print "%-30s %s:%s:%s " % (k,ddict[k][0], ddict[k][1],ddict[k][2])
class fcontextRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
-
- def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
+
+ def createcon(self, target, seuser = "system_u"):
+ (rc, con) = semanage_context_create(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not create context for %s") % target)
if seuser == "":
seuser = "system_u"
+
+ rc = semanage_context_set_user(self.sh, con, seuser)
+ if rc < 0:
+ raise ValueError(_("Could not set user in file context for %s") % target)
+
+ rc = semanage_context_set_role(self.sh, con, "object_r")
+ if rc < 0:
+ raise ValueError(_("Could not set role in file context for %s") % target)
+
if is_mls_enabled == 1:
- if serange == "":
- serange = "s0"
- else:
- serange = untranslate(serange)
+ rc = semanage_context_set_mls(self.sh, con, "s0")
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+
+ return con
+
+ def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ if is_mls_enabled == 1:
+ serange = untranslate(serange)
if type == "":
raise ValueError(_("SELinux Type is required"))
@@ -1051,33 +1086,23 @@
raise ValueError(_("Could not create file context for %s") % target)
rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
- (rc, con) = semanage_context_create(self.sh)
- if rc < 0:
- raise ValueError(_("Could not create context for %s") % target)
+ if type != "<<none>>":
+ con = self.createcon(target, seuser)
- rc = semanage_context_set_user(self.sh, con, seuser)
- if rc < 0:
- raise ValueError(_("Could not set user in file context for %s") % target)
-
- rc = semanage_context_set_role(self.sh, con, "object_r")
- if rc < 0:
- raise ValueError(_("Could not set role in file context for %s") % target)
+ rc = semanage_context_set_type(self.sh, con, type)
+ if rc < 0:
+ raise ValueError(_("Could not set type in file context for %s") % target)
- rc = semanage_context_set_type(self.sh, con, type)
- if rc < 0:
- raise ValueError(_("Could not set type in file context for %s") % target)
+ if serange != "":
+ rc = semanage_context_set_mls(self.sh, con, serange)
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
- if serange != "":
- rc = semanage_context_set_mls(self.sh, con, serange)
- if rc < 0:
- raise ValueError(_("Could not set mls fields in file context for %s") % target)
-
semanage_fcontext_set_type(fcontext, file_types[ftype])
- rc = semanage_fcontext_set_con(self.sh, fcontext, con)
- if rc < 0:
- raise ValueError(_("Could not set file context for %s") % target)
-
rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1090,7 +1115,8 @@
if rc < 0:
raise ValueError(_("Could not add file context for %s") % target)
- semanage_context_free(con)
+ if type != "<<none>>":
+ semanage_context_free(con)
semanage_fcontext_key_free(k)
semanage_fcontext_free(fcontext)
@@ -1112,16 +1138,29 @@
if rc < 0:
raise ValueError(_("Could not query file context for %s") % target)
- con = semanage_fcontext_get_con(fcontext)
+ if setype != "<<none>>":
+ con = semanage_fcontext_get_con(fcontext)
- if serange != "":
- semanage_context_set_mls(self.sh, con, untranslate(serange))
- if seuser != "":
- semanage_context_set_user(self.sh, con, seuser)
- if setype != "":
- semanage_context_set_type(self.sh, con, setype)
+ if con == None:
+ con = self.createcon(target)
+
+ if serange != "":
+ semanage_context_set_mls(self.sh, con, untranslate(serange))
+ if seuser != "":
+ semanage_context_set_user(self.sh, con, seuser)
+
+ if setype != "":
+ semanage_context_set_type(self.sh, con, setype)
- rc = semanage_begin_transaction(self.sh)
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+ else:
+ rc = semanage_fcontext_set_con(self.sh, fcontext, None)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+
+ rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1167,17 +1206,20 @@
semanage_fcontext_key_free(k)
- def get_all(self):
+ def get_all(self, locallist = 0):
l = []
- (rc, self.flist) = semanage_fcontext_list(self.sh)
- if rc < 0:
- raise ValueError(_("Could not list file contexts"))
+ if locallist:
+ (rc, self.flist) = semanage_fcontext_list_local(self.sh)
+ else:
+ (rc, self.flist) = semanage_fcontext_list(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not list file contexts"))
- (rc, fclocal) = semanage_fcontext_list_local(self.sh)
- if rc < 0:
- raise ValueError(_("Could not list local file contexts"))
+ (rc, fclocal) = semanage_fcontext_list_local(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not list local file contexts"))
- self.flist += fclocal
+ self.flist += fclocal
for fcontext in self.flist:
expr = semanage_fcontext_get_expr(fcontext)
@@ -1191,10 +1233,10 @@
return l
- def list(self, heading = 1):
+ def list(self, heading = 1, locallist = 0 ):
if heading:
print "%-50s %-18s %s\n" % (_("SELinux fcontext"), _("type"), _("Context"))
- fcon_list = self.get_all()
+ fcon_list = self.get_all(locallist)
for fcon in fcon_list:
if len(fcon) > 3:
if is_mls_enabled:
@@ -1205,9 +1247,9 @@
print "%-50s %-18s <<None>>" % (fcon[0], fcon[1])
class booleanRecords(semanageRecords):
- def __init__(self):
- semanageRecords.__init__(self)
-
+ def __init__(self, store = ""):
+ semanageRecords.__init__(self, store)
+
def modify(self, name, value = ""):
if value == "":
raise ValueError(_("Requires value"))
@@ -1266,34 +1308,62 @@
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
- rc = semanage_fcontext_del_local(self.sh, k)
+ rc = semanage_bool_del_local(self.sh, k)
if rc < 0:
raise ValueError(_("Could not delete boolean %s") % name)
rc = semanage_commit(self.sh)
if rc < 0:
raise ValueError(_("Could not delete boolean %s") % name)
-
semanage_bool_key_free(k)
- def get_all(self):
+ def deleteall(self):
+ (rc, self.blist) = semanage_bool_list_local(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not list booleans"))
+
+ rc = semanage_begin_transaction(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not start semanage transaction"))
+
+ for boolean in self.blist:
+ name = semanage_bool_get_name(boolean)
+ (rc,k) = semanage_bool_key_create(self.sh, name)
+ if rc < 0:
+ raise ValueError(_("Could not create a key for %s") % name)
+
+ rc = semanage_bool_del_local(self.sh, k)
+ if rc < 0:
+ raise ValueError(_("Could not delete boolean %s") % name)
+ semanage_bool_key_free(k)
+
+ rc = semanage_commit(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not delete boolean %s") % name)
+ def get_all(self, locallist = 0):
ddict = {}
- (rc, self.blist) = semanage_bool_list(self.sh)
+ if locallist:
+ (rc, self.blist) = semanage_bool_list_local(self.sh)
+ else:
+ (rc, self.blist) = semanage_bool_list(self.sh)
if rc < 0:
raise ValueError(_("Could not list booleans"))
for boolean in self.blist:
- name = semanage_bool_get_name(boolean)
- value = semanage_bool_get_value(boolean)
- ddict[name] = value
+ value = []
+ name = semanage_bool_get_name(boolean)
+ value.append(semanage_bool_get_value(boolean))
+ value.append(selinux.security_get_boolean_pending(name))
+ value.append(selinux.security_get_boolean_active(name))
+ ddict[name] = value
return ddict
- def list(self, heading = 1):
+ def list(self, heading = 1, locallist = 0):
if heading:
- print "%-50s %-18s\n" % (_("SELinux boolean"), _("value"))
- ddict = self.get_all()
+ print "%-50s %7s %7s %7s\n" % (_("SELinux boolean"), _("value"), _("pending"), _("active") )
+ ddict = self.get_all(locallist)
keys = ddict.keys()
for k in keys:
if ddict[k]:
- print "%-50s %-18s " % (k[0], ddict[k][0])
+ print "%-50s %7d %7d %7d " % (k, ddict[k][0],ddict[k][1], ddict[k][2])
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
|
From: <ssm...@us...> - 2008-03-18 20:26:17
|
Revision: 2849
http://selinux.svn.sourceforge.net/selinux/?rev=2849&view=rev
Author: ssmalley
Date: 2008-03-18 13:25:27 -0700 (Tue, 18 Mar 2008)
Log Message:
-----------
Author: Caleb Case
Email: cc...@tr...
Subject: policycoreutils semanage --proto --protocol inconsistent flags
Date: Tue, 18 Mar 2008 10:31:16 -0400
semanage --help indicates two conflicting ways of using the port protocol flag:
# semanage --help | grep proto
semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range
-p, --proto Port protocol (tcp or udp)
That is --protocol and --proto.
The code paths are similarly conflicted with --protocol as the 'valid_option', but --proto as the flag actually used in getopt. This results in --protocol not being recognized:
# semanage port -t ftp_port_t -a --protocol tcp 12345
/usr/sbin/semanage: Options Error option --protocol not recognized
The port is not added in this case.
Using --proto instead results in a 'not valid for port objects' error, but the error is ignored and the port added:
# semanage port -t ftp_port_t -a --proto tcp 12345
--proto not valid for port objects
# semanage port -l | grep 12345
ftp_port_t tcp 12345, 21
The man pages for semanage are also inconsistent.
This patch resolves the inconsistency to use --proto.
Modified Paths:
--------------
trunk/policycoreutils/semanage/semanage
trunk/policycoreutils/semanage/semanage.8
Modified: trunk/policycoreutils/semanage/semanage
===================================================================
--- trunk/policycoreutils/semanage/semanage 2008-03-10 13:28:02 UTC (rev 2848)
+++ trunk/policycoreutils/semanage/semanage 2008-03-18 20:25:27 UTC (rev 2849)
@@ -47,7 +47,7 @@
semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\
semanage login -{a|d|m} [-sr] login_name\n\
semanage user -{a|d|m} [-LrRP] selinux_name\n\
-semanage port -{a|d|m} [-tr] [ -p protocol ] port | port_range\n\
+semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range\n\
semanage interface -{a|d|m} [-tr] interface_spec\n\
semanage fcontext -{a|d|m} [-frst] file_spec\n\
semanage translation -{a|d|m} [-T] level\n\n\
@@ -103,7 +103,7 @@
valid_option["user"] = []
valid_option["user"] += valid_everyone + [ '-L', '--level', '-r', '--range', '-R', '--roles', '-P', '--prefix' ]
valid_option["port"] = []
- valid_option["port"] += valid_everyone + [ '-t', '--type', '-r', '--range', '-p', '--protocol' ]
+ valid_option["port"] += valid_everyone + [ '-t', '--type', '-r', '--range', '-p', '--proto' ]
valid_option["interface"] = []
valid_option["interface"] += valid_everyone + [ '-t', '--type', '-r', '--range']
valid_option["fcontext"] = []
Modified: trunk/policycoreutils/semanage/semanage.8
===================================================================
--- trunk/policycoreutils/semanage/semanage.8 2008-03-10 13:28:02 UTC (rev 2848)
+++ trunk/policycoreutils/semanage/semanage.8 2008-03-18 20:25:27 UTC (rev 2849)
@@ -9,7 +9,7 @@
.br
.B semanage user \-{a|d|m} [\-LrRP] selinux_name
.br
-.B semanage port \-{a|d|m} [\-tr] [\-p protocol] port | port_range
+.B semanage port \-{a|d|m} [\-tr] [\-p proto] port | port_range
.br
.B semanage interface \-{a|d|m} [\-tr] interface_spec
.br
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
|
From: <mad...@us...> - 2008-07-02 19:52:53
|
Revision: 2921
http://selinux.svn.sourceforge.net/selinux/?rev=2921&view=rev
Author: madmethod
Date: 2008-07-02 12:52:51 -0700 (Wed, 02 Jul 2008)
Log Message:
-----------
Author: Daniel J Walsh
Email: dw...@re...
Subject: Re: This patch adds permissive to semanage
Date: Wed, 02 Jul 2008 15:25:23 -0400
> >>>>>>>>> Gives users the ability to set a domain as permissive
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>> semanage permissive -a http_t
> >>>>>>>>>
> >>>>>>>>> It created a policy module named permissive_httpd_t.pp with the
> >>>>>>>>> permissive call.
> >>>>>>>>>
> >>>>>>>> So, a really quick glance brings up a couple issues. First you have '-n', '--noheading' which aren't documented in the man page or elsewhere. Second (and more importantly) why are you executing semodule like that? libsemanage is the library that manages modules, and also the library used by semanage for everything else.
> >>>>>>>>
> >>>>>>>> I would prefer a more 'pure' approach where we keep a list of
> >>>>>>>> permissive types and inject them into the kernel policy after linking
> >>>>>>>> (like libsemanage does with users, ports, nodes, etc) but I understand
> >>>>>>>> that adding a whole new set of databases and interfaces is both
> >>>>>>>> annoying and time consuming so I'm fine with it working on modules,
> >>>>>>>> I'd just like to see it using libsemanage interfaces instead of
> >>>>>>>> calling semodule.
> >>>>>>> Why do you see direct use of the libsemanage interfaces as preferable to
> >>>>>>> invoking semodule (aside from performance, and this isn't really
> >>>>>>> performance critical)?
> >>>>>>>
> >>>>>>> I'm unclear on the tradeoff being made there, as composing small
> >>>>>>> programs together to perform more complex operation is the Unix (tm)
> >>>>>>> way ;)
> >>>>>>>
> >>>>>>> The advantage of just invoking semodule is that semodule is already a
> >>>>>>> well-tested program that performs that function well, does proper error
> >>>>>>> checking and handling of the various libsemanage calls, etc. And if we
> >>>>>>> later fix a bug or introduce new functionality there, we only have to do
> >>>>>>> it once vs. in multiple places.
> >>>>>>>
> >>>>>>> And the semanage permissive code already has to invoke a helper program
> >>>>>>> to compile the policy module from source to binary, at least today, so
> >>>>>>> it isn't much different to invoke semodule to install the binary module.
> >>>>>>>
> >>>>>>> Then there is the issue of being able to run the semodule stage of
> >>>>>>> processing in a separate domain, although at present semanage and
> >>>>>>> semodule operate in the same domain so it makes no difference at
> >>>>>>> present.
> >>>>>>>
> >>>>>> Maybe its just personal preference but I see using library interfaces
> >>>>>> as much more clean than invoking semodule and grepping. semanage
> >>>>>> already uses the library interfaces for everything else so this would
> >>>>>> be the one case where it doesn't. He already fixed it up to use the
> >>>>>> interfaces so its moot at this point.
> >>>>> Well, it doesn't have to be moot - we can always take the first
> >>>>> implementation if we think it best. But I'm not fundamentally opposed
> >>>>> to the latter approach, just wanted to explore the rationale. One thing
> >>>>> I would note however is that I see lack of complete error return
> >>>>> checking in the new code that would have been properly checked by
> >>>>> semodule...
> >>>>>
> >>>> I'll fix the error checking in the second patch if you are fine with it otherwise. I just think the library is there for a reason, if we didn't want client programs using it we should have just built it into the application code. Feel free to veto me here if my rationale is weak (as it likely is).
> >>>>
> >>>> Maybe deep down inside I'm just not a unix programmer ;)
> >>> Ok, that's fine with me.
> >>>
> >>> Maybe my own bias is just against python code compared to good olde C
> >>> programs!
> >>>
> >> Updated patch, unrelated things removed and error checking paths fixed up.
> >>
> >> -----
> >
> >> Index: policycoreutils/semanage/seobject.py
> >> ===================================================================
> >> --- policycoreutils/semanage/seobject.py (revision 2917)
> >> +++ policycoreutils/semanage/seobject.py (working copy)
> >> @@ -246,7 +248,108 @@
> > <snip>
> >> + def add(self, type):
> >> + name = "permissive_%s" % type
> >> + dirname = "/var/lib/selinux"
> >> + os.chdir(dirname)
> >
> > Not new to the updated patch, but this can fail.
> >
>
> *sigh* I updated the libsemanage error paths anyway. AFAIK the os
> functions will throw if they fail and since nothing is done inside the
> store until the transaction has started there isn't any state to clean
> up so I'm not sure how important it is to do checks here. If you look
> at sepolgen you'll see the same kinds of things (open being called and
> no check for error condition, etc).
Ok, fine. Then I guess you just need to fix the man page nit.
Acked-By: Joshua Brindle <me...@ma...>
Revision Links:
--------------
http://selinux.svn.sourceforge.net/selinux/?rev=2917&view=rev
Modified Paths:
--------------
trunk/policycoreutils/semanage/semanage
trunk/policycoreutils/semanage/semanage.8
trunk/policycoreutils/semanage/seobject.py
Modified: trunk/policycoreutils/semanage/semanage
===================================================================
--- trunk/policycoreutils/semanage/semanage 2008-07-02 14:35:42 UTC (rev 2920)
+++ trunk/policycoreutils/semanage/semanage 2008-07-02 19:52:51 UTC (rev 2921)
@@ -52,6 +52,7 @@
semanage fcontext -{a|d|m} [-frst] file_spec
semanage translation -{a|d|m} [-T] level
semanage boolean -{d|m} boolean
+semanage permissive -{d|a} type
Primary Options:
@@ -114,6 +115,8 @@
valid_option["translation"] += valid_everyone + [ '-T', '--trans' ]
valid_option["boolean"] = []
valid_option["boolean"] += valid_everyone + [ '--on', "--off", "-1", "-0" ]
+ valid_option["permissive"] = []
+ valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ]
return valid_option
#
@@ -268,6 +271,9 @@
if object == "translation":
OBJECT = seobject.setransRecords()
+ if object == "permissive":
+ OBJECT = seobject.permissiveRecords(store)
+
if list:
OBJECT.list(heading, locallist)
sys.exit(0);
@@ -304,6 +310,9 @@
if object == "fcontext":
OBJECT.add(target, setype, ftype, serange, seuser)
+ if object == "permissive":
+ OBJECT.add(target)
+
sys.exit(0);
if modify:
Modified: trunk/policycoreutils/semanage/semanage.8
===================================================================
--- trunk/policycoreutils/semanage/semanage.8 2008-07-02 14:35:42 UTC (rev 2920)
+++ trunk/policycoreutils/semanage/semanage.8 2008-07-02 19:52:51 UTC (rev 2921)
@@ -17,6 +17,8 @@
.br
.B semanage fcontext \-{a|d|m} [\-frst] file_spec
.br
+.B semanage permissive \-{a|d} type
+.br
.B semanage translation \-{a|d|m} [\-T] level
.P
@@ -101,10 +103,11 @@
$ semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
# Allow Apache to listen on port 81
$ semanage port -a -t http_port_t -p tcp 81
+# Change apache to a permissive domain
+$ semanage permissive -a httpd_t
.fi
.SH "AUTHOR"
This man page was written by Daniel Walsh <dw...@re...> and
Russell Coker <rc...@re...>.
Examples by Thomas Bleher <Tho...@gm...>.
-
Modified: trunk/policycoreutils/semanage/seobject.py
===================================================================
--- trunk/policycoreutils/semanage/seobject.py 2008-07-02 14:35:42 UTC (rev 2920)
+++ trunk/policycoreutils/semanage/seobject.py 2008-07-02 19:52:51 UTC (rev 2921)
@@ -1,5 +1,5 @@
#! /usr/bin/python -E
-# Copyright (C) 2005, 2006, 2007 Red Hat
+# Copyright (C) 2005, 2006, 2007, 2008 Red Hat
# see file 'COPYING' for use and warranty information
#
# semanage is a tool for managing SELinux configuration files
@@ -24,7 +24,9 @@
import pwd, string, selinux, tempfile, os, re, sys
from semanage import *;
PROGNAME="policycoreutils"
+import sepolgen.module as module
+import commands
import gettext
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
gettext.textdomain(PROGNAME)
@@ -246,7 +248,108 @@
os.close(fd)
os.rename(newfilename, self.filename)
os.system("/sbin/service mcstrans reload > /dev/null")
-
+
+class permissiveRecords:
+ def __init__(self, store):
+ self.store = store
+ self.sh = semanage_handle_create()
+ if not self.sh:
+ raise ValueError(_("Could not create semanage handle"))
+
+ if store != "":
+ semanage_select_store(self.sh, store, SEMANAGE_CON_DIRECT);
+
+ self.semanaged = semanage_is_managed(self.sh)
+
+ if not self.semanaged:
+ semanage_handle_destroy(self.sh)
+ raise ValueError(_("SELinux policy is not managed or store cannot be accessed."))
+
+ rc = semanage_access_check(self.sh)
+ if rc < SEMANAGE_CAN_READ:
+ semanage_handle_destroy(self.sh)
+ raise ValueError(_("Cannot read policy store."))
+
+ rc = semanage_connect(self.sh)
+ if rc < 0:
+ semanage_handle_destroy(self.sh)
+ raise ValueError(_("Could not establish semanage connection"))
+
+ def get_all(self):
+ l = []
+ (rc, mlist, number) = semanage_module_list(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not list SELinux modules"))
+
+ for i in range(number):
+ mod = semanage_module_list_nth(mlist, i)
+ name = semanage_module_get_name(mod)
+ if name and name.startswith("permissive_"):
+ l.append(name.split("permissive_")[1])
+ return l
+
+ def list(self,heading = 1, locallist = 0):
+ if heading:
+ print "\n%-25s\n" % (_("Permissive Types"))
+ for t in self.get_all():
+ print t
+
+
+ def add(self, type):
+ name = "permissive_%s" % type
+ dirname = "/var/lib/selinux"
+ os.chdir(dirname)
+ filename = "%s.te" % name
+ modtxt = """
+module %s 1.0;
+
+require {
+ type %s;
+}
+
+permissive %s;
+""" % (name, type, type)
+ fd = open(filename,'w')
+ fd.write(modtxt)
+ fd.close()
+ mc = module.ModuleCompiler()
+ mc.create_module_package(filename, 1)
+ fd = open("permissive_%s.pp" % type)
+ data = fd.read()
+ fd.close()
+
+ rc = semanage_module_install(self.sh, data, len(data));
+ if rc < 0:
+ raise ValueError(_("Could not set permissive domain %s (module installation failed)") % name)
+ rc = semanage_commit(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not set permissive domain %s (commit failed)") % name)
+ for root, dirs, files in os.walk("tmp", topdown=False):
+ for name in files:
+ os.remove(os.path.join(root, name))
+ for name in dirs:
+ os.rmdir(os.path.join(root, name))
+
+ if rc != 0:
+ raise ValueError(out)
+
+
+ def delete(self, name):
+ for n in name.split():
+ rc = semanage_module_remove(self.sh, "permissive_%s" % n)
+ if rc < 0:
+ raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name)
+ rc = semanage_commit(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name)
+
+
+ def deleteall(self):
+ l = self.get_all()
+ if len(l) > 0:
+ all = " ".join(l)
+ self.delete(all)
+
class semanageRecords:
def __init__(self, store):
self.sh = semanage_handle_create()
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
×
Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.
Thanks for helping keep SourceForge clean.
X