RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

semanage_migrate_store: Python3 support 

Mainly used the 2to3 conversion tool. Also added in a __future__
import so that the script continues to work on Python 2.

Tested on 2.7, 3.3, 3.4. Should work on 2.6 too but untested.

Signed-off-by: Jason Zaman <jason@perfinion.com>
Acked-by: Steve Lawrence <slawrence@tresys.com>
This commit is contained in:
Jason Zaman 2014-11-20 00:18:59 +04:00 committed by Steve Lawrence
parent 7a09af2123
commit 877acdb31f
1 changed files with 45 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
libsemanage/utils/semanage_migrate_store
View File

@ -1,6 +1,7 @@
#!/usr/bin/python -E #!/usr/bin/python -E
from __future__ import print_function
import os import os
import errno import errno
import shutil import shutil
@ -16,7 +17,7 @@ try:
import selinux import selinux
import semanage import semanage
except: except:
print >> sys.stderr, "You must install libselinux-python and libsemanage-python before running this tool" print("You must install libselinux-python and libsemanage-python before running this tool", file=sys.stderr)
exit(1) exit(1)
@ -25,69 +26,72 @@ except:
# For some reason this function doesn't exist in libselinux :\ # For some reason this function doesn't exist in libselinux :\
def copy_with_context(src, dst): def copy_with_context(src, dst):
if DEBUG: if DEBUG:
print "copying %s to %s" % (src, dst) print("copying %s to %s" % (src, dst))
try: try:
con = selinux.lgetfilecon_raw(src)[1] con = selinux.lgetfilecon_raw(src)[1]
except: except:
print >> sys.stderr, "Could not get file context of %s" % src print("Could not get file context of %s" % src, file=sys.stderr)
exit(1) exit(1)
try: try:
selinux.setfscreatecon_raw(con) selinux.setfscreatecon_raw(con)
except: except:
print >> sys.stderr, "Could not set fs create context: %s" %con print("Could not set fs create context: %s" %con, file=sys.stderr)
exit(1) exit(1)
try: try:
shutil.copy2(src, dst) shutil.copy2(src, dst)
except OSError as (err, strerr): except OSError as the_err:
print >> sys.stderr, "Could not copy %s to %s, %s" %(src, dst, strerr) (err, strerr) = the_err.args
print("Could not copy %s to %s, %s" %(src, dst, strerr), file=sys.stderr)
exit(1) exit(1)
try: try:
selinux.setfscreatecon_raw(None) selinux.setfscreatecon_raw(None)
except: except:
print >> sys.stderr, "Could not reset fs create context. May need to relabel system." print("Could not reset fs create context. May need to relabel system.", file=sys.stderr)
def create_dir_from(src, dst, mode): def create_dir_from(src, dst, mode):
if DEBUG: print "Making directory %s" % dst if DEBUG: print("Making directory %s" % dst)
try: try:
con = selinux.lgetfilecon_raw(src)[1] con = selinux.lgetfilecon_raw(src)[1]
selinux.setfscreatecon_raw(con) selinux.setfscreatecon_raw(con)
os.makedirs(dst, mode) os.makedirs(dst, mode)
except OSError as (err, stderr): except OSError as the_err:
(err, stderr) = the_err.args
if err == errno.EEXIST: if err == errno.EEXIST:
pass pass
else: else:
print >> sys.stderr, "Error creating %s" % dst print("Error creating %s" % dst, file=sys.stderr)
exit(1) exit(1)
try: try:
selinux.setfscreatecon_raw(None) selinux.setfscreatecon_raw(None)
except: except:
print >> sys.stderr, "Could not reset fs create context. May need to relabel system." print("Could not reset fs create context. May need to relabel system.", file=sys.stderr)
def create_file_from(src, dst): def create_file_from(src, dst):
if DEBUG: print "Making file %s" % dst if DEBUG: print("Making file %s" % dst)
try: try:
con = selinux.lgetfilecon_raw(src)[1] con = selinux.lgetfilecon_raw(src)[1]
selinux.setfscreatecon_raw(con) selinux.setfscreatecon_raw(con)
open(dst, 'a').close() open(dst, 'a').close()
except OSError as (err, stderr): except OSError as the_err:
print >> sys.stderr, "Error creating %s" % dst (err, stderr) = the_err.args
print("Error creating %s" % dst, file=sys.stderr)
exit(1) exit(1)
try: try:
selinux.setfscreatecon_raw(None) selinux.setfscreatecon_raw(None)
except: except:
print >> sys.stderr, "Could not reset fs create context. May need to relabel system." print("Could not reset fs create context. May need to relabel system.", file=sys.stderr)
def copy_module(store, name, con, base): def copy_module(store, name, con, base):
if DEBUG: print "Install module %s" % name if DEBUG: print("Install module %s" % name)
(file, ext) = os.path.splitext(name) (file, ext) = os.path.splitext(name)
if ext != ".pp": if ext != ".pp":
# Stray non-pp file in modules directory, skip # Stray non-pp file in modules directory, skip
print >> sys.stderr, "warning: %s has invalid extension, skipping" % name print("warning: %s has invalid extension, skipping" % name, file=sys.stderr)
return return
try: try:
selinux.setfscreatecon_raw(con) selinux.setfscreatecon_raw(con)
@ -104,21 +108,21 @@ def copy_module(store, name, con, base):
copy_with_context(os.path.join(root, name), "%s/%s/hll" % (bottomdir, file)) copy_with_context(os.path.join(root, name), "%s/%s/hll" % (bottomdir, file))
# This is the ext file that will eventually be used to choose a compiler # This is the ext file that will eventually be used to choose a compiler
efile = open("%s/%s/lang_ext" % (bottomdir, file), "w+", 0600) efile = open("%s/%s/lang_ext" % (bottomdir, file), "w+", 0o600)
efile.write("pp") efile.write("pp")
efile.close() efile.close()
except: except:
print >> sys.stderr, "Error installing module %s" % name print("Error installing module %s" % name, file=sys.stderr)
exit(1) exit(1)
try: try:
selinux.setfscreatecon_raw(None) selinux.setfscreatecon_raw(None)
except: except:
print >> sys.stderr, "Could not reset fs create context. May need to relabel system." print("Could not reset fs create context. May need to relabel system.", file=sys.stderr)
def disable_module(file, root, name, disabledmodules): def disable_module(file, root, name, disabledmodules):
if DEBUG: print "Disabling %s" % name if DEBUG: print("Disabling %s" % name)
(disabledname, disabledext) = os.path.splitext(file) (disabledname, disabledext) = os.path.splitext(file)
create_file_from(os.path.join(root, name), "%s/%s" % (disabledmodules, disabledname)) create_file_from(os.path.join(root, name), "%s/%s" % (disabledmodules, disabledname))
@ -131,14 +135,14 @@ def migrate_store(store):
newmodules = newmodules_path(store); newmodules = newmodules_path(store);
bottomdir = bottomdir_path(store); bottomdir = bottomdir_path(store);
print "Migrating from %s to %s" % (oldstore, newstore) print("Migrating from %s to %s" % (oldstore, newstore))
# Build up new directory structure # Build up new directory structure
create_dir_from(selinux.selinux_policy_root(), "%s/%s" % (newroot_path(), store), 0755) create_dir_from(selinux.selinux_policy_root(), "%s/%s" % (newroot_path(), store), 0o755)
create_dir_from(oldmodules, newstore, 0700) create_dir_from(oldmodules, newstore, 0o700)
create_dir_from(oldstore, newmodules, 0700) create_dir_from(oldstore, newmodules, 0o700)
create_dir_from(oldstore, bottomdir, 0700) create_dir_from(oldstore, bottomdir, 0o700)
create_dir_from(oldstore, disabledmodules, 0700) create_dir_from(oldstore, disabledmodules, 0o700)
# use whatever the file context of bottomdir is for the module directories # use whatever the file context of bottomdir is for the module directories
con = selinux.lgetfilecon_raw(bottomdir)[1] con = selinux.lgetfilecon_raw(bottomdir)[1]
@ -164,7 +168,7 @@ def migrate_store(store):
for name in files: for name in files:
(file, ext) = os.path.splitext(name) (file, ext) = os.path.splitext(name)
if name == "base.pp": if name == "base.pp":
print >> sys.stderr, "Error installing module %s, name conflicts with base" % name print("Error installing module %s, name conflicts with base" % name, file=sys.stderr)
exit(1) exit(1)
elif ext == ".disabled": elif ext == ".disabled":
disable_module(file, root, name, disabledmodules) disable_module(file, root, name, disabledmodules)
@ -173,32 +177,32 @@ def migrate_store(store):
def rebuild_policy(): def rebuild_policy():
# Ok, the modules are loaded, lets try to rebuild the policy # Ok, the modules are loaded, lets try to rebuild the policy
print "Attempting to rebuild policy from %s" % newroot_path() print("Attempting to rebuild policy from %s" % newroot_path())
curstore = selinux.selinux_getpolicytype()[1] curstore = selinux.selinux_getpolicytype()[1]
handle = semanage.semanage_handle_create() handle = semanage.semanage_handle_create()
if not handle: if not handle:
print >> sys.stderr, "Could not create semanage handle" print("Could not create semanage handle", file=sys.stderr)
exit(1) exit(1)
semanage.semanage_select_store(handle, curstore, semanage.SEMANAGE_CON_DIRECT) semanage.semanage_select_store(handle, curstore, semanage.SEMANAGE_CON_DIRECT)
if not semanage.semanage_is_managed(handle): if not semanage.semanage_is_managed(handle):
semanage.semanage_handle_destroy(handle) semanage.semanage_handle_destroy(handle)
print >> sys.stderr, "SELinux policy is not managed or store cannot be accessed." print("SELinux policy is not managed or store cannot be accessed.", file=sys.stderr)
exit(1) exit(1)
rc = semanage.semanage_access_check(handle) rc = semanage.semanage_access_check(handle)
if rc < semanage.SEMANAGE_CAN_WRITE: if rc < semanage.SEMANAGE_CAN_WRITE:
semanage.semanage_handle_destroy(handle) semanage.semanage_handle_destroy(handle)
print >> sys.stderr, "Cannot write to policy store." print("Cannot write to policy store.", file=sys.stderr)
exit(1) exit(1)
rc = semanage.semanage_connect(handle) rc = semanage.semanage_connect(handle)
if rc < 0: if rc < 0:
semanage.semanage_handle_destroy(handle) semanage.semanage_handle_destroy(handle)
print >> sys.stderr, "Could not establish semanage connection" print("Could not establish semanage connection", file=sys.stderr)
exit(1) exit(1)
semanage.semanage_set_rebuild(handle, 1) semanage.semanage_set_rebuild(handle, 1)
@ -206,12 +210,12 @@ def rebuild_policy():
rc = semanage.semanage_begin_transaction(handle) rc = semanage.semanage_begin_transaction(handle)
if rc < 0: if rc < 0:
semanage.semanage_handle_destroy(handle) semanage.semanage_handle_destroy(handle)
print >> sys.stderr, "Could not begin transaction" print("Could not begin transaction", file=sys.stderr)
exit(1) exit(1)
rc = semanage.semanage_commit(handle) rc = semanage.semanage_commit(handle)
if rc < 0: if rc < 0:
print >> sys.stderr, "Could not commit transaction" print("Could not commit transaction", file=sys.stderr)
semanage.semanage_handle_destroy(handle) semanage.semanage_handle_destroy(handle)
@ -283,7 +287,7 @@ if __name__ == "__main__":
"preserve_tunables" ] "preserve_tunables" ]
create_dir_from(oldroot_path(), newroot_path(), 0755) create_dir_from(oldroot_path(), newroot_path(), 0o755)
stores = None stores = None
if TYPE is not None: if TYPE is not None:
@ -299,14 +303,14 @@ if __name__ == "__main__":
if os.path.isdir(newstore_path(store)): if os.path.isdir(newstore_path(store)):
# store has already been migrated, but old modules dir still exits # store has already been migrated, but old modules dir still exits
print >> sys.stderr, "warning: Policy type %s has already been migrated, but modules still exist in the old store. Skipping store." % store print("warning: Policy type %s has already been migrated, but modules still exist in the old store. Skipping store." % store, file=sys.stderr)
continue continue
migrate_store(store) migrate_store(store)
if CLEAN is True: if CLEAN is True:
def remove_error(function, path, execinfo): def remove_error(function, path, execinfo):
print >> sys.stderr, "warning: Unable to remove old store modules directory %s. Cleaning failed." % oldmodules_path(store) print("warning: Unable to remove old store modules directory %s. Cleaning failed." % oldmodules_path(store), file=sys.stderr)
shutil.rmtree(oldmodules_path(store), onerror=remove_error) shutil.rmtree(oldmodules_path(store), onerror=remove_error)
if NOREBUILD is False: if NOREBUILD is False: