Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing Listpolicycoreutils patch
From: Daniel J Walsh <dwalsh_at_redhat.com>
Date: Fri, 01 Aug 2008 07:43:28 -0400
Adds support for boolean files, name/value pairs as input and output. Allows you to set a large amount of booleans at once. Add support from groupname in semanage login. This will allow you to associate groups of Linux Users with an SELinux user. Uses same syntax as sudo. Requires patch to libselinux. Cleanup of semanage variables. Change use of 1/0 to True/False.
Remove bad use of raise(out)
iEYEARECAAYFAkiS9t8ACgkQrlYvE4MpobN0/gCgsoXMR/oDibFEw3SNFxwQlhrY
gZIAn1wMYnPg+o2ixNVQsWYBOw1NN4Pd
diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.53/Makefile --- nsapolicycoreutils/Makefile 2008-06-12 23:25:24.000000000 -0400 +++ policycoreutils-2.0.53/Makefile 2008-07-29 16:25:16.000000000 -0400 @@ -1,4 +1,4 @@ -SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po +SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.53/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2008-06-12 23:25:21.000000000 -0400 +++ policycoreutils-2.0.53/restorecond/restorecond.c 2008-07-29 16:25:16.000000000 -0400 semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] -semanage login -{a|d|m} [-sr] login_name +semanage login -{a|d|m} [-sr] login_name | %groupname semanage user -{a|d|m} [-LrRP] selinux_name semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range semanage interface -{a|d|m} [-tr] interface_spec semanage fcontext -{a|d|m} [-frst] file_spec semanage translation -{a|d|m} [-T] level -semanage boolean -{d|m} boolean +semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file semanage permissive -{d|a} type
Primary Options:
-l (symbolic link) -p (named pipe) + -F, --file Treat target as an input file for command, change multiple settings -p, --proto Port protocol (tcp or udp) -P, --prefix Prefix for home directory labeling -L, --level Default SELinux Level (MLS/MCS Systems only) @@ -317,7 +325,7 @@ if modify: if object == "boolean": - OBJECT.modify(target, value) + OBJECT.modify(target, value, use_file) if object == "login": OBJECT.modify(target, seuser, serange) diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage.8 policycoreutils-2.0.53/semanage/semanage.8 --- nsapolicycoreutils/semanage/semanage.8 2008-07-02 17:19:15.000000000 -0400 +++ policycoreutils-2.0.53/semanage/semanage.8 2008-08-01 07:05:54.000000000 -0400 @@ -3,11 +3,11 @@ semanage \- SELinux Policy Management tool .SH "SYNOPSIS" -.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|lC|D} [\-n] +.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|D} [\-n] [\-S store] .br -.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] boolean +.B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] -F boolean | boolean_file .br -.B semanage login \-{a|d|m} [\-sr] login_name +.B semanage login \-{a|d|m} [\-sr] login_name | %groupname .br .B semanage user \-{a|d|m} [\-LrRP] selinux_name .br @@ -54,6 +54,11 @@ File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use -d to match only directories or -- to match only regular files. .TP +.I \-F, \-\-file +Set multiple records from the input file. When used with the \-l \-\-list, it will output the current settings to stdout in the proper format. + +Currently booleans only. +.TP .I \-h, \-\-help display this message .TP @@ -87,6 +92,9 @@ .I \-s, \-\-seuser SELinux user name .TP +.I \-S, \-\-store +Select and alternate SELinux store to manage +.TP .I \-t, \-\-type SELinux Type for the object .TP @@ -99,6 +107,8 @@ $ semanage user -l # Allow joe to login as staff_u $ semanage login -a -s staff_u joe +# Allow the group clerks to login as user_u +$ semanage login -a -s user_u %clerks # Add file-context for everything under /web (used by restorecon) $ semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" # Allow Apache to listen on port 81 diff --exclude-from=exclude --exclude=sepolgen-1.0.13 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.53/semanage/seobject.py --- nsapolicycoreutils/semanage/seobject.py 2008-07-29 09:15:39.000000000 -0400 +++ policycoreutils-2.0.53/semanage/seobject.py 2008-08-01 07:24:34.000000000 -0400 @@ -21,7 +21,7 @@ # #
-import pwd, string, selinux, tempfile, os, re, sys
+import pwd, grp, string, selinux, tempfile, os, re, sys
from semanage import *;
for name in dirs: os.rmdir(os.path.join(root, name)) - if rc != 0: - raise ValueError(out)- - def delete(self, name): for n in name.split(): rc = semanage_module_remove(self.sh, "permissive_%s" % n) if rc < 0: raise ValueError(_("Could not remove permissive domain %s (remove failed)") % name) - rc = semanage_commit(self.sh) - if rc < 0: - raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name) + rc = semanage_commit(self.sh) + if rc < 0: + raise ValueError(_("Could not remove permissive domain %s (commit failed)") % name) - def deleteall(self): l = self.get_all() if len(l) > 0: @@ -1447,54 +1448,72 @@ class booleanRecords(semanageRecords): def __init__(self, store = ""): semanageRecords.__init__(self, store) + self.dict={} + self.dict["TRUE"] = 1 + self.dict["FALSE"] = 0 + self.dict["ON"] = 1 + self.dict["OFF"] = 0 + self.dict["1"] = 1 + self.dict["0"] = 0 - def modify(self, name, value = ""): - if value == "": - raise ValueError(_("Requires value")) - - (rc,k) = semanage_bool_key_create(self.sh, name) - if rc < 0: - raise ValueError(_("Could not create a key for %s") % name) - - (rc,exists) = semanage_bool_exists(self.sh, k) - if rc < 0: - raise ValueError(_("Could not check if boolean %s is defined") % name) - if not exists: - raise ValueError(_("Boolean %s is not defined") % name) - - (rc,b) = semanage_bool_query(self.sh, k) - if rc < 0: - raise ValueError(_("Could not query file context %s") % name) + def __mod(self, name, value): + (rc,k) = semanage_bool_key_create(self.sh, name) + if rc < 0: + raise ValueError(_("Could not create a key for %s") % name) + (rc,exists) = semanage_bool_exists(self.sh, k) + if rc < 0: + raise ValueError(_("Could not check if boolean %s is defined") % name) + if not exists: + raise ValueError(_("Boolean %s is not defined") % name) + + (rc,b) = semanage_bool_query(self.sh, k) + if rc < 0: + raise ValueError(_("Could not query file context %s") % name) - if value != "": - nvalue = int(value) - semanage_bool_set_value(b, nvalue) + if value.upper() in self.dict: + semanage_bool_set_value(b, self.dict[value.upper()]) else: - raise ValueError(_("You must specify a value")) + raise ValueError(_("You must specify one of the following values: %s") % ", ".join(self.dict.keys()) ) + + rc = semanage_bool_set_active(self.sh, k, b) + if rc < 0: + raise ValueError(_("Could not set active value of boolean %s") % name) + rc = semanage_bool_modify_local(self.sh, k, b) + if rc < 0: + raise ValueError(_("Could not modify boolean %s") % name) + semanage_bool_key_free(k) + semanage_bool_free(b) + def modify(self, name, value=None, use_file=False): + rc = semanage_begin_transaction(self.sh) if rc < 0: raise ValueError(_("Could not start semanage transaction")) - - rc = semanage_bool_set_active(self.sh, k, b) - if rc < 0: - raise ValueError(_("Could not set active value of boolean %s") % name) - rc = semanage_bool_modify_local(self.sh, k, b) - if rc < 0: - raise ValueError(_("Could not modify boolean %s") % name) + if use_file: + fd = open(name) + for b in fd.read().split("\n"): + b = b.strip() + if len(b) == 0: + continue + + try: + boolname, val = b.split("=") + except ValueError, e: + raise ValueError(_("Bad format %s: Record %s" % ( name, b) )) + self.__mod(boolname.strip(), val.strip()) + fd.close() + else: + self.__mod(name, value) rc = semanage_commit(self.sh) if rc < 0: raise ValueError(_("Could not modify boolean %s") % name) - semanage_bool_key_free(k) - semanage_bool_free(b) - def delete(self, name): - (rc,k) = semanage_bool_key_create(self.sh, name) - if rc < 0: - raise ValueError(_("Could not create a key for %s") % name) + (rc,k) = semanage_bool_key_create(self.sh, name) + if rc < 0: + raise ValueError(_("Could not create a key for %s") % name) (rc,exists) = semanage_bool_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if boolean %s is defined") % name) -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Fri 1 Aug 2008 - 07:44:13 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |