RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-04-04 23:49:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

policycoreutils: semanage: option to not load new policy into kernel after changes

Browse Source 
Add -N, --noreload option to semanage to prevent reloading policy into
the kernel after a change.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Dan Walsh 2012-05-08 08:37:45 -04:00 committed by Eric Paris
parent cf87e75d45
commit e5962bb179
3 changed files with 55 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
policycoreutils/semanage/semanage
View File

@ -41,6 +41,7 @@ except IOError:
if __name__ == '__main__': if __name__ == '__main__':
manageditems=[ "boolean", "login", "user", "port", "interface", "node", "fcontext"] manageditems=[ "boolean", "login", "user", "port", "interface", "node", "fcontext"]
action = False action = False
load = True
def set_action(option): def set_action(option):
global action global action
if action: if action:
@ -52,16 +53,16 @@ if __name__ == '__main__':
semanage [ -S store ] -i [ input_file | - ] semanage [ -S store ] -i [ input_file | - ]
semanage [ -S store ] -o [ output_file | - ] semanage [ -S store ] -o [ output_file | - ]
semanage login -{a|d|m|l|D|E} [-nsr] login_name | %groupname semanage login -{a|d|m|l|D|E} [-Nnsr] login_name | %groupname
semanage user -{a|d|m|l|D|E} [-LnrRP] selinux_name semanage user -{a|d|m|l|D|E} [-LNnrRP] selinux_name
semanage port -{a|d|m|l|D|E} [-ntr] [ -p proto ] port | port_range semanage port -{a|d|m|l|D|E} [-Nntr] [ -p proto ] port | port_range
semanage interface -{a|d|m|l|D|E} [-ntr] interface_spec semanage interface -{a|d|m|l|D|E} [-Nntr] interface_spec
semanage module -{a|d|m} [--enable|--disable] module semanage module -{a|d|m} [--enable|--disable] [-N] module
semanage node -{a|d|m|l|D|E} [-ntr] [ -p protocol ] [-M netmask] addr semanage node -{a|d|m|l|D|E} [-Nntr] [ -p protocol ] [-M netmask] addr
semanage fcontext -{a|d|m|l|D|E} [-efnrst] file_spec semanage fcontext -{a|d|m|l|D|E} [-Nefnrst] file_spec
semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file semanage boolean -{d|m} [--on|--off|-1|-0] [-N] -F boolean | boolean_file
semanage permissive -{d|a|l} [-n] type semanage permissive -{d|a|l} [-Nn] type
semanage dontaudit [ on | off ] semanage dontaudit [ on | off ] [-N]
Primary Options: Primary Options:
@ -94,6 +95,7 @@ Object-specific Options (see above):
-F, --file Treat target as an input file for command, change multiple settings -F, --file Treat target as an input file for command, change multiple settings
-p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6) -p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6)
-M, --mask Netmask -M, --mask Netmask
-N, --noreload Do not reload policy after commit
-e, --equal Substitue source path for dest path when labeling -e, --equal Substitue source path for dest path when labeling
-P, --prefix Prefix for home directory labeling -P, --prefix Prefix for home directory labeling
-L, --level Default SELinux Level (MLS/MCS Systems only) -L, --level Default SELinux Level (MLS/MCS Systems only)
@ -115,26 +117,26 @@ Object-specific Options (see above):
def get_options(): def get_options():
valid_option={} valid_option={}
valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-S', '--store' ] valid_everyone=[ '-a', '--add', '-d', '--delete', '-m', '--modify', '-l', '--list', '-h', '--help', '-n', '--noheading', '-S', '--store' ]
valid_local=[ '-E', '--extract', '-C', '--locallist', '-D', '--deleteall'] valid_local=[ '-E', '--extract', '-C', '--locallist', '-D', '--deleteall', '-N', '--noreload']
valid_option["login"] = [] valid_option["login"] = []
valid_option["login"] += valid_everyone + valid_local + [ '-s', '--seuser', '-r', '--range'] valid_option["login"] += valid_everyone + valid_local + [ '-s', '--seuser', '-r', '--range']
valid_option["user"] = [] valid_option["user"] = []
valid_option["user"] += valid_everyone + valid_local + [ '-L', '--level', '-r', '--range', '-R', '--roles', '-P', '--prefix' ] valid_option["user"] += valid_everyone + valid_local + [ '-L', '--level', '-r', '--range', '-R', '--roles', '-P', '--prefix', '-N', '--noreload' ]
valid_option["port"] = [] valid_option["port"] = []
valid_option["port"] += valid_everyone + valid_local + [ '-t', '--type', '-r', '--range', '-p', '--proto' ] valid_option["port"] += valid_everyone + valid_local + [ '-t', '--type', '-r', '--range', '-p', '--proto' , '-N', '--noreload' ]
valid_option["interface"] = [] valid_option["interface"] = []
valid_option["interface"] += valid_everyone + valid_local + [ '-t', '--type', '-r', '--range'] valid_option["interface"] += valid_everyone + valid_local + [ '-t', '--type', '-r', '--range', '-N', '--noreload' ]
valid_option["node"] = [] valid_option["node"] = []
valid_option["node"] += valid_everyone + valid_local + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol'] valid_option["node"] += valid_everyone + valid_local + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol', '-N', '--noreload' ]
valid_option["module"] = [] valid_option["module"] = []
valid_option["module"] += valid_everyone + [ '--enable', '--disable'] valid_option["module"] += valid_everyone + [ '--enable', '--disable', '-N', '--noreload' ]
valid_option["fcontext"] = [] valid_option["fcontext"] = []
valid_option["fcontext"] += valid_everyone + valid_local + [ '-e', '--equal', '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] valid_option["fcontext"] += valid_everyone + valid_local + [ '-e', '--equal', '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range', '-N', '--noreload' ]
valid_option["dontaudit"] = [ '-S', '--store' ] valid_option["dontaudit"] = [ '-S', '--store' ]
valid_option["boolean"] = [] valid_option["boolean"] = []
valid_option["boolean"] += valid_everyone + valid_local + [ '--on', "--off", "-1", "-0", "-F", "--file"] valid_option["boolean"] += valid_everyone + valid_local + [ '--on', "--off", "-1", "-0", "-F", "--file", '-N', '--noreload' ]
valid_option["permissive"] = [] valid_option["permissive"] = []
valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' ] valid_option["permissive"] += [ '-a', '--add', '-d', '--delete', '-l', '--list', '-h', '--help', '-n', '--noheading', '-D', '--deleteall' , '-N', '--noreload' ]
return valid_option return valid_option
def mkargv(line): def mkargv(line):
@ -185,6 +187,7 @@ Object-specific Options (see above):
def process_args(argv): def process_args(argv):
global action global action
global load
action = False action = False
serange = "" serange = ""
port = "" port = ""
@ -222,7 +225,7 @@ Object-specific Options (see above):
try: try:
gopts, cmds = getopt.getopt(args, gopts, cmds = getopt.getopt(args,
'01adEe:f:i:lhmnp:s:FCDR:L:r:t:P:S:M:', '01adEe:f:i:lhmNnp:s:FCDR:L:r:t:P:S:M:',
['add', ['add',
'delete', 'delete',
'deleteall', 'deleteall',
@ -237,6 +240,7 @@ Object-specific Options (see above):
'list', 'list',
'modify', 'modify',
'noheading', 'noheading',
'noreload',
'off', 'off',
'on', 'on',
'proto=', 'proto=',
@ -296,6 +300,9 @@ Object-specific Options (see above):
if o == "-n" or o == "--noheading": if o == "-n" or o == "--noheading":
heading = False heading = False
if o == "-N" or o == "--noreload":
load = False
if o == "-C" or o == "--locallist": if o == "-C" or o == "--locallist":
locallist = True locallist = True
@ -380,6 +387,7 @@ Object-specific Options (see above):
OBJECT.list(heading, locallist) OBJECT.list(heading, locallist)
return return
OBJECT.set_reload(load)
if deleteall: if deleteall:
OBJECT.deleteall() OBJECT.deleteall()
return return
@ -504,7 +512,7 @@ Object-specific Options (see above):
usage(_("Requires 2 or more arguments")) usage(_("Requires 2 or more arguments"))
gopts, cmds = getopt.getopt(sys.argv[1:], gopts, cmds = getopt.getopt(sys.argv[1:],
'01adf:i:lhmno:p:s:FCDR:L:r:t:P:S:', '01adf:i:lhmno:p:s:NFCDR:L:r:t:P:S:',
['add', ['add',
'delete', 'delete',
'deleteall', 'deleteall',
@ -515,6 +523,7 @@ Object-specific Options (see above):
'list', 'list',
'modify', 'modify',
'noheading', 'noheading',
'noreload',
'off', 'off',
'on', 'on',
'output=', 'output=',
@ -534,6 +543,8 @@ Object-specific Options (see above):
input = a input = a
if o == "-o" or o == '--output': if o == "-o" or o == '--output':
output = a output = a
if o == "-N" or o == "--noreload":
load = False
if output != None: if output != None:
if output != "-": if output != "-":
@ -552,6 +563,7 @@ Object-specific Options (see above):
trans.start() trans.start()
for l in fd.readlines(): for l in fd.readlines():
process_args(mkargv(l)) process_args(mkargv(l))
trans.set_reload(load)
trans.finish() trans.finish()
else: else:
process_args(sys.argv[1:]) process_args(sys.argv[1:])

27
policycoreutils/semanage/semanage.8
View File

@ -14,58 +14,58 @@ Input local customizations
Manage booleans. Booleans allow the administrator to modify the confinement of Manage booleans. Booleans allow the administrator to modify the confinement of
processes based on his configuration. processes based on his configuration.
.br .br
.B semanage boolean [\-S store] \-{d|m|l|D} [\-n] [\-\-on|\-\-off|\-\1|\-0] -F boolean | boolean_file .B semanage boolean [\-S store] \-{d|m|l|D} [\-nN] [\-\-on|\-\-off|\-\1|\-0] -F boolean | boolean_file
Manage SELinux confined users (Roles and levels for an SELinux user) Manage SELinux confined users (Roles and levels for an SELinux user)
.br .br
.B semanage user [\-S store] \-{a|d|m|l|D} [\-LnPrR] selinux_name .B semanage user [\-S store] \-{a|d|m|l|D} [\-LnNPrR] selinux_name
Manage login mappings between linux users and SELinux confined users. Manage login mappings between linux users and SELinux confined users.
.br .br
.B semanage login [\-S store] \-{a|d|m|l|D} [\-nrs] login_name | %groupname .B semanage login [\-S store] \-{a|d|m|l|D} [\-nNrs] login_name | %groupname
Manage policy modules. Manage policy modules.
.br .br
.B semanage module [\-S store] \-{a|d|l} [-m [--enable | --disable] ] module_name .B semanage module [\-S store] \-{a|d|l} [-m [--enable | --disable] ] [\-N] module_name
Manage network port type definitions Manage network port type definitions
.br .br
.B semanage port [\-S store] \-{a|d|m|l|D} [\-nrt] [\-p proto] port | port_range .B semanage port [\-S store] \-{a|d|m|l|D} [\-nNrt] [\-p proto] port | port_range
.br .br
Manage network interface type definitions Manage network interface type definitions
.br .br
.B semanage interface [\-S store] \-{a|d|m|l|D} [\-nrt] interface_spec .B semanage interface [\-S store] \-{a|d|m|l|D} [\-nNrt] interface_spec
Manage network node type definitions Manage network node type definitions
.br .br
.B semanage node [\-S store] -{a|d|m|l|D} [-nrt] [ -p protocol ] [-M netmask] address .B semanage node [\-S store] -{a|d|m|l|D} [-nNrt] [ -p protocol ] [-M netmask] address
.br .br
Manage file context mapping definitions Manage file context mapping definitions
.br .br
.B semanage fcontext [\-S store] \-{l} [\-Cn] .B semanage fcontext [\-S store] \-{l} [\-Cn]
.br .br
.B semanage fcontext [\-S store] \-D .B semanage fcontext [\-S store] \-D [\-N]
.br .br
.B semanage fcontext [\-S store] \-{a|d|m} [\-frst] file_spec .B semanage fcontext [\-S store] \-{a|d|m} [\-Nfrst] file_spec
.br .br
.B semanage fcontext [\-S store] \-{a|d|m} \-e replacement target .B semanage fcontext [\-S store] \-{a|d|m} \-e replacement target
.br .br
Manage processes type enforcement mode Manage processes type enforcement mode
.br .br
.B semanage permissive [\-S store] \-{a|d|l|D} [\-n] type .B semanage permissive [\-S store] \-{a|d|l|D} [\-nN] type
.br .br
Disable/Enable dontaudit rules in policy Disable/Enable dontaudit rules in policy
.br .br
.B semanage dontaudit [\-S store] [ on | off ] .B semanage dontaudit [\-N] [\-S store] [ on | off ]
.P .P
Execute multiple commands within a single transaction. Execute multiple commands within a single transaction.
.br .br
.B semanage [\-S store] \-i command-file .B semanage [\-S store] [\-N] \-i command-file
.br .br
.SH "DESCRIPTION" .SH "DESCRIPTION"
@ -143,6 +143,9 @@ Network Mask
.I \-n, \-\-noheading .I \-n, \-\-noheading
Do not print heading when listing OBJECTS. Do not print heading when listing OBJECTS.
.TP .TP
.B \-N,\-\-noreload
do not reload policy after commit
.TP
.I \-p, \-\-proto .I \-p, \-\-proto
Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6). Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6).
.TP .TP

7
policycoreutils/semanage/seobject.py
View File

@ -203,7 +203,7 @@ class semanageRecords:
store = None store = None
def __init__(self, store): def __init__(self, store):
global handle global handle
self.load = True
self.sh = self.get_handle(store) self.sh = self.get_handle(store)
rc, localstore = selinux.selinux_getpolicytype() rc, localstore = selinux.selinux_getpolicytype()
@ -212,6 +212,9 @@ class semanageRecords:
else: else:
self.mylog = nulllogger() self.mylog = nulllogger()
def set_reload(self, load):
self.load = load
def get_handle(self, store): def get_handle(self, store):
global is_mls_enabled global is_mls_enabled
@ -269,6 +272,8 @@ class semanageRecords:
def commit(self): def commit(self):
if semanageRecords.transaction: if semanageRecords.transaction:
return return
semanage_set_reload(self.sh, self.load)
rc = semanage_commit(self.sh) rc = semanage_commit(self.sh)
if rc < 0: if rc < 0:
self.mylog.commit(0) self.mylog.commit(0)