diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.23/Makefile
--- nsapolicycoreutils/Makefile 2007-07-16 14:20:43.000000000 -0400
+++ policycoreutils-2.0.23/Makefile 2007-08-22 16:29:22.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
all install relabel clean indent:
@for subdir in $(SUBDIRS); do \
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.23/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.23/restorecond/restorecond.c 2007-08-22 16:29:22.000000000 -0400
@@ -210,9 +210,10 @@
}
if (fsetfilecon(fd, scontext) < 0) {
- syslog(LOG_ERR,
- "set context %s->%s failed:'%s'\n",
- filename, scontext, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR,
+ "set context %s->%s failed:'%s'\n",
+ filename, scontext, strerror(errno));
if (retcontext >= 0)
free(prev_context);
free(scontext);
@@ -225,8 +226,9 @@
if (retcontext >= 0)
free(prev_context);
} else {
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
- filename, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+ filename, strerror(errno));
}
free(scontext);
close(fd);
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.23/scripts/genhomedircon
--- nsapolicycoreutils/scripts/genhomedircon 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-2.0.23/scripts/genhomedircon 2007-08-23 10:08:04.000000000 -0400
@@ -0,0 +1,404 @@
+#! /usr/bin/python -E
+# Copyright (C) 2004 Tresys Technology, LLC
+# see file 'COPYING' for use and warranty information
+#
+# genhomedircon - this script is used to generate file context
+# configuration entries for user home directories based on their
+# default prefixes and is run when building the policy. Specifically, we
+# replace HOME_ROOT, HOME_DIR, and ROLE macros in .fc files with
+# generic and user-specific values.
+#
+# Based off original script by Dan Walsh, <dwalsh@redhat.com>
+#
+# ASSUMPTIONS:
+#
+# The file CONTEXTDIR/files/homedir_template exists. This file is used to
+# set up the home directory context for each real user.
+#
+# If a user is not listed in CONTEXTDIR/seusers, he will default to user_u, prefix user
+#
+# "Real" users (as opposed to system users) are those whose UID is greater than
+# or equal STARTING_UID (usually 500) and whose login is not a member of
+# EXCLUDE_LOGINS. Users who are explicitly defined in CONTEXTDIR/seusers
+# are always "real" (including root, in the default configuration).
+#
+#
+
+import sys, os, pwd, string, getopt, re
+from semanage import *;
+import selinux
+import gettext
+gettext.install('policycoreutils')
+
+def grep(file, var):
+ ret = ""
+ fd = open(file, 'r')
+
+ for i in fd.readlines():
+ if re.search(var, i, 0) != None:
+ ret = i
+ break
+ fd.close()
+ return ret
+
+def findval(file, var, delim = ""):
+ val = ""
+ try:
+ fd = open(file, 'r')
+ for i in fd.readlines():
+ if i.startswith(var) == 1:
+ if delim == "":
+ val = i.split()[1]
+ else:
+ val = i.split(delim)[1]
+ val = val.split("#")[0]
+ val = val.strip()
+ fd.close()
+ except:
+ val = ""
+ return val
+
+def getStartingUID():
+ starting_uid = sys.maxint
+ uid_min = findval("/etc/login.defs", "UID_MIN")
+ if uid_min != "":
+ uid_min = uid_min.split("#")[0]
+ uid_min = uid_min.strip()
+ if int(uid_min) < starting_uid:
+ starting_uid = int(uid_min)
+
+ uid_min = findval("/etc/libuser.conf", "LU_UIDNUMBER", "=")
+ if uid_min != "":
+ uid_min = uid_min.split("#")[0]
+ uid_min = uid_min.strip()
+ if int(uid_min) < starting_uid:
+ starting_uid = int(uid_min)
+
+ if starting_uid == sys.maxint:
+ starting_uid = 500
+ return starting_uid
+
+def getDefaultHomeDir():
+ ret = []
+ homedir = findval("/etc/default/useradd", "HOME", "=")
+ if homedir != "" and not homedir in ret:
+ ret.append(homedir)
+
+ homedir = findval("/etc/libuser.conf", "LU_HOMEDIRECTORY", "=")
+ if homedir != "" and not homedir in ret:
+ ret.append(homedir)
+
+ if ret == []:
+ ret.append("/home")
+
+ # Add /export/home if it exists
+ # Some customers use this for automounted homedirs
+ if os.path.exists("/export/home"):
+ ret.append("/export/home")
+
+ return ret
+
+def getSELinuxType(directory):
+ val = findval(directory+"/config", "SELINUXTYPE", "=")
+ if val != "":
+ return val
+ return "targeted"
+
+def usage(rc=0, error = ""):
+ if error != "":
+ sys.stderr.write("%s\n" % error)
+ rc = 1
+ sys.stderr.write("Usage: %s [ -d selinuxdir ] [-n | --nopasswd] [-t selinuxtype ]\n" % sys.argv[0])
+ sys.stderr.flush()
+ sys.exit(rc)
+
+def warning(warning = ""):
+ sys.stderr.write("%s\n" % warning)
+ sys.stderr.flush()
+
+def errorExit(error):
+ sys.stderr.write("%s exiting for: " % sys.argv[0])
+ sys.stderr.write("%s\n" % error)
+ sys.stderr.flush()
+ sys.exit(1)
+
+class selinuxConfig:
+ def __init__(self, selinuxdir = "/etc/selinux", type = "targeted", usepwd = 1):
+ self.semanageHandle = semanage_handle_create()
+ self.semanaged = semanage_is_managed(self.semanageHandle)
+ if self.semanaged:
+ rc = semanage_connect(self.semanageHandle)
+ if rc:
+ errorExit("Unable to connect to semanage")
+ (status, self.ulist) = semanage_user_list(self.semanageHandle)
+ self.type = type
+ self.selinuxdir = selinuxdir +"/"
+ self.contextdir = "/contexts"
+ self.filecontextdir = self.contextdir+"/files"
+ self.usepwd = usepwd
+ self.default_user = "user_u"
+ self.default_prefix = "user"
+ self.users = self.getUsers()
+ fd = open(self.getFileContextFile())
+ self.fclines=[]
+ for i in fd.readlines():
+ try:
+ regex = i.split()[0]
+ #match a trailing .+
+ regex = re.sub("\.+$", "", regex)
+ regex = re.sub("\.\*$", "", regex)
+ regex = re.sub("\(\/\.\*\)\?", "", regex)
+ regex = regex + "/*$"
+ self.fclines.append(re.compile(regex))
+ except:
+ continue
+
+ fd.close()
+
+ def getFileContextDir(self):
+ return self.selinuxdir+self.type+self.filecontextdir
+
+ def getFileContextFile(self):
+ return self.getFileContextDir()+"/file_contexts"
+
+ def getContextDir(self):
+ return self.selinuxdir+self.type+self.contextdir
+
+ def getHomeDirTemplate(self):
+ return self.getFileContextDir()+"/homedir_template"
+
+ def getHomeRootContext(self, homedir):
+ ret = ""
+ fd = open(self.getHomeDirTemplate(), 'r')
+
+ for i in fd.readlines():
+ if i.find("HOME_ROOT") == 0:
+ i = i.replace("HOME_ROOT", homedir)
+ ret += i
+ fd.close()
+ if ret == "":
+ errorExit("No Home Root Context Found")
+ return ret
+
+ def heading(self):
+ ret = "\n#\n#\n# User-specific file contexts, generated via %s\n" % sys.argv[0]
+ if self.semanaged:
+ ret += "# use semanage command to manage system users in order to change the file_context\n#\n#\n"
+ else:
+ ret += "# edit %s to change file_context\n#\n#\n" % (self.selinuxdir+self.type+"/seusers")
+ return ret
+
+ def get_default_prefix(self, name):
+ for user in self.ulist:
+ if semanage_user_get_name(user) == name:
+ return semanage_user_get_prefix(user)
+ return name
+
+ def get_old_prefix(self, user):
+ rc = grep(self.selinuxdir+self.type+"/users/system.users", "^user %s" % user)
+ if rc == "":
+ rc = grep(self.selinuxdir+self.type+"/users/local.users", "^user %s" % user)
+ if rc != "":
+ user = rc.split()
+ prefix = user[3]
+ if prefix == "{":
+ prefix = user[4]
+ if len(prefix) > 2 and (prefix[-2:] == "_r" or prefix[-2:] == "_u"):
+ prefix = prefix[:-2]
+ return prefix
+
+ def adduser(self, udict, user, seuser, prefix):
+ if seuser == self.default_user or user == "__default__" or user == "system_u":
+ return
+ # !!! chooses first prefix in the list to use in the file context !!!
+ try:
+ home = pwd.getpwnam(user)[5]
+ if home == "/":
+ # Probably install so hard code to /root
+ if user == "root":
+ home = "/root"
+ else:
+ return
+ except KeyError:
+ if user == "root":
+ home = "/root"
+ else:
+ sys.stderr.write("The user \"%s\" is not present in the passwd file, skipping...\n" % user)
+ return
+ prefs = {}
+ prefs["seuser"] = seuser
+ prefs["prefix"] = prefix
+ prefs["home"] = home
+ udict[user] = prefs
+
+ def setDefaultUser(self, user, prefix):
+ self.default_user = user
+ self.default_prefix = prefix
+
+ def getUsers(self):
+ udict = {}
+ if self.semanaged:
+ (status, list) = semanage_seuser_list(self.semanageHandle)
+ for seuser in list:
+ user = []
+ seusername = semanage_seuser_get_sename(seuser)
+ prefix = self.get_default_prefix(seusername)
+ if semanage_seuser_get_name(seuser) == "__default__":
+ self.setDefaultUser(seusername, prefix)
+
+ self.adduser(udict, semanage_seuser_get_name(seuser), seusername, prefix)
+
+ else:
+ try:
+ fd = open(self.selinuxdir+self.type+"/seusers")
+ for u in fd.readlines():
+ u = u.strip()
+ if len(u) == 0 or u[0] == "#":
+ continue
+ user = u.split(":")
+ if len(user) < 2:
+ continue
+
+ prefix = self.get_old_prefix(user[1])
+ self.adduser(udict, user[0], user[1], prefix)
+ fd.close()
+ except IOError, error:
+ # Must be install so force add of root
+ self.adduser(udict, "root", "root", "root")
+
+ return udict
+
+ def getHomeDirContext(self, user, seuser, home, prefix):
+ ret = "\n\n#\n# Home Context for user %s\n#\n\n" % user
+ fd = open(self.getHomeDirTemplate(), 'r')
+ for i in fd.readlines():
+ if i.startswith("HOME_DIR") == 1:
+ i = i.replace("HOME_DIR", home)
+ i = i.replace("ROLE", prefix)
+ i = i.replace("system_u", seuser)
+ # Validate if the generated context exists. Some user types may not exist
+ scon = i.split()[-1]
+ if selinux.is_selinux_enabled() < 1 or selinux.security_check_context(scon) == 0:
+ ret = ret+i
+ fd.close()
+ return ret
+
+ def getUserContext(self, user, sel_user, prefix):
+ ret = ""
+ fd = open(self.getHomeDirTemplate(), 'r')
+ for i in fd.readlines():
+ if i.find("USER") > 0:
+ i = i.replace("USER", user)
+ i = i.replace("ROLE", prefix)
+ i = i.replace("system_u", sel_user)
+ ret = ret+i
+ fd.close()
+ return ret
+
+ def genHomeDirContext(self):
+ ret = ""
+ # Fill in HOME and prefix for users that are defined
+ for u in self.users.keys():
+ ret += self.getHomeDirContext (u, self.users[u]["seuser"], self.users[u]["home"], self.users[u]["prefix"])
+ ret += self.getUserContext (u, self.users[u]["seuser"], self.users[u]["prefix"])
+ return ret+"\n"
+
+ def checkExists(self, home):
+ for i in self.fclines:
+ try:
+ if i.match(home):
+ return 1
+ except:
+ continue
+ return 0
+
+ def getHomeDirs(self):
+ homedirs = getDefaultHomeDir()
+ starting_uid = getStartingUID()
+ if self.usepwd == 0:
+ return homedirs
+ ulist = pwd.getpwall()
+ for u in ulist:
+ if u[2] >= starting_uid and \
+ u[6] in VALID_SHELLS and \
+ u[5] != "/" and \
+ string.count(u[5], "/") > 1:
+ homedir = u[5][:string.rfind(u[5], "/")]
+ if not homedir in homedirs:
+ if self.checkExists(homedir) == 1:
+ warning("%s homedir %s or its parent directory conflicts with a\ndefined context in %s,\n%s will not create a new context. This usually indicates an incorrectly defined system account. If it is a system account please make sure its login shell is /sbin/nologin." % (u[0], u[5], self.getFileContextFile(), sys.argv[0]))
+ else:
+ homedirs.append(homedir)
+
+ homedirs.sort()
+ return homedirs
+
+ def genoutput(self):
+ ret = self.heading()
+ for h in self.getHomeDirs():
+ ret += self.getHomeDirContext (self.default_user, self.default_user, h+'/[^/]*', self.default_prefix)
+ ret += self.getHomeRootContext(h)
+ ret += self.getUserContext(".*", self.default_user, self.default_prefix) + "\n"
+ ret += self.genHomeDirContext()
+ return ret
+
+ def printout(self):
+ print self.genoutput()
+
+ def write(self):
+ fd = open(self.getFileContextDir()+"/file_contexts.homedirs", "w")
+ fd.write(self.genoutput())
+ fd.close()
+
+if os.getuid() > 0 or os.geteuid() > 0:
+ print _("You must be root to run %s.") % sys.argv[0]
+ sys.exit(1)
+
+try:
+ fd = open("/etc/shells", 'r')
+ VALID_SHELLS = fd.read().split("\n")
+ fd.close()
+ if "/sbin/nologin" in VALID_SHELLS:
+ VALID_SHELLS.remove("/sbin/nologin")
+ if "" in VALID_SHELLS:
+ VALID_SHELLS.remove("")
+except:
+ VALID_SHELLS = ['/bin/sh', '/bin/bash', '/bin/ash', '/bin/bsh', '/bin/ksh', '/usr/bin/ksh', '/usr/bin/pdksh', '/bin/tcsh', '/bin/csh', '/bin/zsh']
+
+#
+# This script will generate home dir file context
+# based off the homedir_template file, entries in the password file, and
+#
+try:
+ usepwd = 1
+ directory = "/etc/selinux"
+ type = None
+ gopts, cmds = getopt.getopt(sys.argv[1:], 'hnd:t:', ['help',
+ 'type=',
+ 'nopasswd',
+ 'dir='])
+ for o,a in gopts:
+ if o == '--type' or o == "-t":
+ type = a
+ if o == '--nopasswd' or o == "-n":
+ usepwd = 0
+ if o == '--dir' or o == "-d":
+ directory = a
+ if o == '--help' or o == "-h":
+ usage()
+except getopt.error, error:
+ errorExit(_("Options Error %s ") % error)
+
+if type == None:
+ type = getSELinuxType(directory)
+
+if len(cmds) != 0:
+ usage(1)
+
+selconf = selinuxConfig(directory, type, usepwd)
+try:
+ selconf.write()
+except IOError, error:
+ sys.stderr.write("%s: %s\n" % ( sys.argv[0], error ))
+ sys.exit(1)
+
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon.8 policycoreutils-2.0.23/scripts/genhomedircon.8
--- nsapolicycoreutils/scripts/genhomedircon.8 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-2.0.23/scripts/genhomedircon.8 2007-08-20 19:16:35.000000000 -0400
@@ -0,0 +1,82 @@
+.\" Hey, Emacs! This is an -*- nroff -*- source file.
+.\" Copyright (c) 2005 Manoj Srivastava <srivasta@debian.org>
+.\"
+.\" This is free documentation; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License as
+.\" published by the Free Software Foundation; either version 2 of
+.\" the License, or (at your option) any later version.
+.\"
+.\" The GNU General Public License's references to "object code"
+.\" and "executables" are to be interpreted as the output of any
+.\" document formatting or typesetting system, including
+.\" intermediate and printed output.
+.\"
+.\" This manual is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public
+.\" License along with this manual; if not, write to the Free
+.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
+.\" USA.
+.\"
+.\"
+.TH GENHOMEDIRCON "8" "January 2005" "Security Enhanced Linux" ""
+.SH NAME
+genhomedircon \- generate SELinux file context configuration entries for user home directories
+.SH SYNOPSIS
+.B genhomedircon [ -d selinuxdir ] [-n | --nopasswd] [-t selinuxtype ] [-h]
+
+.SH OPTIONS
+.TP
+.B "\-h"
+Print a short usage message
+.TP
+.B "\-d selinuxdir (\-\-directory)"
+Directory where selinux files are installed defaults to /etc/selinux
+.TP
+.B
+\-n \-\-nopasswd
+Indicates to the utility not to read homedirectories out of the password database.
+.TP
+\-t selinuxtype (\-\-type)
+Indicates the selinux type of this install. Defaults to "targeted".
+.SH DESCRIPTION
+.PP
+This utility is used to generate file context configuration entries for
+user home directories based on their
+.B prefix
+entry in the the
+.B semanage user record.
+genhomedircon is run when building
+the policy. It is also run automaticaly when ever the
+.B semanage
+utility modifies
+.B user
+or
+.B login
+records.
+Specifically, we replace HOME_ROOT, HOME_DIR, and ROLE macros in the
+.I /etc/selinux/<<SELINUXTYPE>>/contexts/files/homedir_template
+file with generic and user-specific values. HOME_ROOT and HOME_DIR is replaced with each distinct location where login users homedirectories are located. Defaults to /home. ROLE is replaced based on the prefix entry in the
+.B user
+record.
+.PP
+genhomedircon searches through all password entires for all "login" user home directories, (as opposed
+to system users). Login users are those whose UID is greater than or equal
+.I STARTING_UID
+(default 500) and whose login shell is not "/sbin/nologin", or
+"/bin/false".
+.PP
+.SH AUTHOR
+This manual page was originally written by
+.I Manoj Srivastava <srivasta@debian.org>,
+for the Debian GNU/Linux system, based on the comments and the code
+in the utility, and then updated by Dan Walsh of Red Hat. The
+.B genhomedircon
+utility was originally written by
+.I Dan Walsh of Red Hat
+with some modifications by
+.I Tresys Technology, LLC.
+
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/Makefile policycoreutils-2.0.23/scripts/Makefile
--- nsapolicycoreutils/scripts/Makefile 2007-08-23 16:52:26.000000000 -0400
+++ policycoreutils-2.0.23/scripts/Makefile 2007-08-20 19:16:35.000000000 -0400
@@ -5,14 +5,18 @@
MANDIR ?= $(PREFIX)/share/man
LOCALEDIR ?= /usr/share/locale
-all: fixfiles
+TARGETS=genhomedircon
+
+all: $(TARGETS) fixfiles
install: all
-mkdir -p $(BINDIR)
+ install -m 755 $(TARGETS) $(SBINDIR)
install -m 755 chcat $(BINDIR)
install -m 755 fixfiles $(DESTDIR)/sbin
-mkdir -p $(MANDIR)/man8
install -m 644 fixfiles.8 $(MANDIR)/man8/
+ install -m 644 genhomedircon.8 $(MANDIR)/man8/
install -m 644 chcat.8 $(MANDIR)/man8/
clean:
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.23/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py 2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.23/semanage/seobject.py 2007-08-22 16:29:22.000000000 -0400
@@ -210,6 +210,7 @@
os.write(fd, self.out())
os.close(fd)
os.rename(newfilename, self.filename)
+ os.system("/sbin/service mcstrans reload > /dev/null")
class semanageRecords:
def __init__(self):
@@ -1024,14 +1025,31 @@
def __init__(self):
semanageRecords.__init__(self)
- def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ def createcon(self, target, seuser = "system_u"):
+ (rc, con) = semanage_context_create(self.sh)
+ if rc < 0:
+ raise ValueError(_("Could not create context for %s") % target)
if seuser == "":
seuser = "system_u"
+
+ rc = semanage_context_set_user(self.sh, con, seuser)
+ if rc < 0:
+ raise ValueError(_("Could not set user in file context for %s") % target)
+
+ rc = semanage_context_set_role(self.sh, con, "object_r")
+ if rc < 0:
+ raise ValueError(_("Could not set role in file context for %s") % target)
+
if is_mls_enabled == 1:
- if serange == "":
- serange = "s0"
- else:
- serange = untranslate(serange)
+ rc = semanage_context_set_mls(self.sh, con, "s0")
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+
+ return con
+
+ def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+ if is_mls_enabled == 1:
+ serange = untranslate(serange)
if type == "":
raise ValueError(_("SELinux Type is required"))
@@ -1051,33 +1069,23 @@
raise ValueError(_("Could not create file context for %s") % target)
rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
- (rc, con) = semanage_context_create(self.sh)
- if rc < 0:
- raise ValueError(_("Could not create context for %s") % target)
-
- rc = semanage_context_set_user(self.sh, con, seuser)
- if rc < 0:
- raise ValueError(_("Could not set user in file context for %s") % target)
-
- rc = semanage_context_set_role(self.sh, con, "object_r")
- if rc < 0:
- raise ValueError(_("Could not set role in file context for %s") % target)
-
- rc = semanage_context_set_type(self.sh, con, type)
- if rc < 0:
- raise ValueError(_("Could not set type in file context for %s") % target)
+ if type != "<<none>>":
+ con = self.createcon(target, seuser)
- if serange != "":
- rc = semanage_context_set_mls(self.sh, con, serange)
- if rc < 0:
- raise ValueError(_("Could not set mls fields in file context for %s") % target)
+ rc = semanage_context_set_type(self.sh, con, type)
+ if rc < 0:
+ raise ValueError(_("Could not set type in file context for %s") % target)
+
+ if serange != "":
+ rc = semanage_context_set_mls(self.sh, con, serange)
+ if rc < 0:
+ raise ValueError(_("Could not set mls fields in file context for %s") % target)
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
semanage_fcontext_set_type(fcontext, file_types[ftype])
- rc = semanage_fcontext_set_con(self.sh, fcontext, con)
- if rc < 0:
- raise ValueError(_("Could not set file context for %s") % target)
-
rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1090,7 +1098,8 @@
if rc < 0:
raise ValueError(_("Could not add file context for %s") % target)
- semanage_context_free(con)
+ if type != "<<none>>":
+ semanage_context_free(con)
semanage_fcontext_key_free(k)
semanage_fcontext_free(fcontext)
@@ -1112,16 +1121,29 @@
if rc < 0:
raise ValueError(_("Could not query file context for %s") % target)
- con = semanage_fcontext_get_con(fcontext)
+ if setype != "<<none>>":
+ con = semanage_fcontext_get_con(fcontext)
- if serange != "":
- semanage_context_set_mls(self.sh, con, untranslate(serange))
- if seuser != "":
- semanage_context_set_user(self.sh, con, seuser)
- if setype != "":
- semanage_context_set_type(self.sh, con, setype)
-
- rc = semanage_begin_transaction(self.sh)
+ if con == None:
+ con = self.createcon(target)
+
+ if serange != "":
+ semanage_context_set_mls(self.sh, con, untranslate(serange))
+ if seuser != "":
+ semanage_context_set_user(self.sh, con, seuser)
+
+ if setype != "":
+ semanage_context_set_type(self.sh, con, setype)
+
+ rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+ else:
+ rc = semanage_fcontext_set_con(self.sh, fcontext, None)
+ if rc < 0:
+ raise ValueError(_("Could not set file context for %s") % target)
+
+ rc = semanage_begin_transaction(self.sh)
if rc < 0:
raise ValueError(_("Could not start semanage transaction"))
@@ -1283,9 +1305,12 @@
raise ValueError(_("Could not list booleans"))
for boolean in self.blist:
- name = semanage_bool_get_name(boolean)
- value = semanage_bool_get_value(boolean)
- ddict[name] = value
+ value = []
+ name = semanage_bool_get_name(boolean)
+ value[0] = semanage_bool_get_value(boolean)
+ value[1] = selinux.security_get_boolean_pending(boolean)
+ value[2] = selinux.security_get_boolean_active(boolean)
+ ddict[name] = value
return ddict
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.23/semodule/semodule.8
--- nsapolicycoreutils/semodule/semodule.8 2007-07-16 14:20:42.000000000 -0400
+++ policycoreutils-2.0.23/semodule/semodule.8 2007-08-23 10:18:35.000000000 -0400
@@ -23,6 +23,9 @@
.B \-B, \-\-build
force a rebuild of policy (also reloads unless -n is used)
.TP
+.B \-D, \-\-disable_dontaudit
+Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
+.TP
.B \-i,\-\-install=MODULE_PKG
install/replace a module package
.TP
@@ -58,6 +61,10 @@
$ semodule -i httpd.pp
# List non-base modules.
$ semodule -l
+# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
+$ semodule -DB
+# Turn "dontaudit" rules back on.
+$ semodule -B
# Install or replace all non-base modules in the current directory.
$ semodule -i *.pp
# Install or replace all modules in the current directory.