Commit Graph

71 Commits

Author SHA1 Message Date
Stephen Smalley
7b5699bfd7 Fix BINDIR/SBINDIR/... variables in Makefiles
As reported by Nicolas Iooss, there are still some inconsistencies
in the definitions and usage of Makefile variables related to bin
and sbin directories. Since we need to still support non-usrmerge
systems, we cannot completely synchronize them, but we can eliminate
unnecessary differences, remove unused variables, and drop the
USRSBINDIR variables.

Before:
$ find . -name Makefile -exec cat {} + |grep '^[A-Z_]*BINDIR' |sort -u
BINDIR=$(PREFIX)/bin
BINDIR ?= $(PREFIX)/bin
BINDIR ?= $(PREFIX)/sbin
SBINDIR ?= $(DESTDIR)/sbin
SBINDIR ?= $(PREFIX)/sbin
USRSBINDIR ?= $(PREFIX)/sbin

After:
$ find . -name Makefile -exec cat {} + | grep '^[A-Z_]*BINDIR' | sort -u
BINDIR ?= $(PREFIX)/bin
SBINDIR ?= $(DESTDIR)/sbin
SBINDIR ?= $(PREFIX)/sbin

This does not change the actual install location of any file.
It does drop the legacy symlink from /usr/sbin/load_policy to
/sbin/load_policy; packagers can create that separately if
desired.

Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-06-20 12:18:26 -04:00
Vit Mojzis
2608b4d666 policycoreutils/fixfiles: do not dereference link files in tmp
Files in /tmp, /var/tmp, /var/run and /var/lib/debug labeled as
unlabeled_t or undefined_t are relabeled to match corresponding
directory label. Stop dereferencing link files in these folders
in order not to accidentally change label of other files in the
system.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1458831

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2017-06-16 12:37:03 -04:00
Alan Jenkins
3db61481ad policycoreutils: fixfiles: use a consistent order for options to restorecon
It helps see the differences (hopefully there are only intended differences
now!).

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:57 -04:00
Alan Jenkins
c51b99acbc policycoreutils: fixfiles: don't ignore -F when run in -C mode
This was supposedly fixed in 2009.
http://selinux.fedoraproject.narkive.com/ZskMsNrx/fixfiles-f-option

`-F` was mentioned again in 2013 (commit 2910ca21).

It doesn't look like `-F -C` was fixed though.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:50 -04:00
Alan Jenkins
6e289bb7bf policycoreutils: fixfiles: remove bad modes of "relabel" command
* `fixfiles -B relabel` or `fixfiles -C previouscontext relabel` would
  skip the code that handles e.g. `/var/tmp`, which would be run by
  `fixfiles relabel`.  It would still remove all files in /tmp (subject to
  user confirmation).  This is confusing, undocumented, and unlikely to
  be intentional.

* `fixfiles relabel path1 path2` is the same, except it would only relabel
  the first path.

* `fixfiles -R ... relabel` was equivalent to `fixfiles -R ... restore`,
  again contradicting the man page.

Also `fixfiles onboot` would ignore paths, -C, or -R.

fixfiles is mostly for users, where it should be acceptable to remove these
non-sensical combinations.

`fixfiles -C` is used in selinux-policy rpm install scripts.  However I
believe the rpms used `fixfiles -C previouscontext restore`, and did not
either require user interaction or blow away /tmp without prompting.  So
they should still work fine.

With these combinations removed, we can remove the `exit` calls which were
seen in some of the (non-error) code paths in `restore()`.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:39 -04:00
Alan Jenkins
96d11a281e policycoreutils: fixfiles: un-document -R -a option
`fixfiles -R -a` is much less useful than it was made to sound, because -R
now works recursively.  Therefore `fixfiles -R -a` relabels every file on
the system, multiple times.  On my system it took over 5 times as long as
plain `fixfiles` (which takes about a minute).

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:31 -04:00
Alan Jenkins
3475893b6f policycoreutils: fixfiles: refactor into the set -u dialect
This commit allows the use of `set -u` to detect reads of unset variables.
But what I really liked was making the code more explicit about these
modes.  I hope that this is easier for a new reader to reason about.

`fixfiles restore` has accumulated five different modes it can run in.
Now use a single variable to indicate the mode, out-of-band of the
variables used for the individual modes.

Apparently `set -u` / `set -o nounset` doesn't work correctly with arrays.
If we ever need bash arrays, we can simply remove `set -u`.  The `set -u`
dialect is a strict subset.  See http://mywiki.wooledge.org/BashFAQ/112

Extra notes:

RESTORE_MODE was created because I couldn't bring myself to use an empty
FILEPATH, as a special case to indicate the default mode.  Arguments
to the script (paths) could be empty already, so it would mean I had to
work out how we behaved in that case and decide whether it was reasonable.

It turns out the `-B | -N time` mode is distinct and does not respect
paths.  So we can tell the user we're not going to do anything with the
paths they passed.  Make sure this distinction is shown in the usage error
message.

We already rejected the combination of `-R rpmpackage,... dir/file...`.
Being aware of the different modes just causes more bogus combinations
to be rejected.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:21 -04:00
Alan Jenkins
f499b02feb policycoreutils: fixfiles: if restorecon aborts, we should too
New users may try something like `fixfiles restore -v /dir/file` -
not realizing they are required to use `fixfiles -v restore /dir/file`.

Detect that `restorecon` aborts due to being run on the non-existent file
`-v`, and stop immediately.  This will show the error much more clearly,
instead of continuing to restore `/dir/file` *without* verbose messages.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:47:11 -04:00
Alan Jenkins
2aa88f7201 policycoreutils: fixfiles: usage errors are fatal
The idea is to print a usage error, then terminate with EXIT_FAILURE.

Don't print the usage error twice when run with no command.

Don't try to check for bogus extra arguments _after_
performing a long-running operation... particularly
if that operation terminates the script with EXIT_SUCCESS first.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:46:51 -04:00
Alan Jenkins
658800ef3d policycoreutils: fixfiles: syntax error
$ shellcheck fixfiles
...
In fixfiles line 94:
	  [[ "${i}" =~ "^[[:blank:]]*#" ]] && continue
                       ^-- SC2076: Don't quote rhs of =~, it'll match
                                   literally rather than as a regex.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:46:35 -04:00
Alan Jenkins
42f91ba291 policycoreutils: fixfiles: remove two unused variables
DIRS was suspicious because you can't store file names in a normal variable,
and it's not that common to use arrays in bash.  It's not actually used.

While we're here, there's another variable which is never used
and should just be removed.  (Pointed out by `shellcheck`.
It makes a couple of other points too, but I have more specific
patches I want to put those in).

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:46:23 -04:00
Alan Jenkins
ce2a7fb143 policycoreutils: fixfiles: tidy up usage(), manpage synopsis
Make sure usage() in fixfiles shows all the current options.
It's printed when there's a user error, so it needs to be
helpful!  (Excluding the deprecated option - see below).

manpage:

Remove the deprecated option `-l logfile`.

Add missing space in `restore|[-f] relabel`.

It's not clear why `-R rpmpackagename` was considered optional in the
second invocation.  (If the user omits it, they are just performing the
first invocation).  It desn't match usage() in fixfiles either.

Clean up bolding for `fixfiles onboot`.

Disable justification (troff "adjustment") in the synopsis.  We want the
common options in the different invocations to line up consistently.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-09 14:45:40 -04:00
Alan Jenkins
8e9c9a20cb policycoreutils: fixfiles: deprecate -l option
...and write log messages to standard output.

Some versions of fixfiles in 2004 created a logfile by default.
Apparently they also used `tee` to log to standard output at the same time.
We're also told that the logfile was implemented because there was too
much output generated for use on a tty, and it scrolled out of reach.

https://bugzilla.redhat.com/show_bug.cgi?id=131707

In the current version, none of these original reasons for `-l` remain.

The logfile is not created by default.  If no log file is specified,
messages are written to stdin [sic]... if and only stdin is a tty.  If
stdin is not a tty, the log defaults to /dev/null.

When a user runs fixfiles on a tty and finds there is too much output, she
is likely to try redirecting standard output and/or standard error using
the shell.  She will find this doesn't help, because fixfiles is writing
the verbose log messages to standard input.

I tried to fix the problem non-intrusively, by changing the default log
file to `/dev/stdout`.  Sadly, this breaks down where you have
`echo >>$LOGFILE "Log message"` inside a specific function, which is run
with output redirected in order to "return" a string value (captured
into a variable).  exclude_dirs_from_relabelling() was such a function.

I was trying to abstract over writing to both normal files and stdout, but
my abstraction "leaks" in a non-obvious way.

There is a simple solution.  We can write the log messages to standard
output.  When we are passed `-l` by a legacy script, we can redirect
standard output to the logfile.

This removes any distinctions between the logfile and "non-log" messages.
Some calls to restorecon were missing redirections to the log file.
"Cleaning out /tmp" was written to the log file, but "Cleaning out labels
on /tmp" was not.  There were no comments to explain these distinctions.
2017-05-05 13:27:18 -04:00
Alan Jenkins
48d425e7c6 policycoreutils: fixfiles: move logit call outside of redirected function
Move call to logit() outside a function which has its output redirected.
See next commit for explanation.

The logit calls are moved into a new function LogExcluded(), similar to
LogReadOnly().  I don't see a pretty way to resolve this, so I just went
for the most explicit approach I could think of.

Behaviour change: diff_filecontext will now log *all* excluded paths.
I think that approach is an improvement, because e.g. the fact that `-C`
mode excludes `/home` was not previouslly documented anywhere.
2017-05-05 13:27:13 -04:00
Alan Jenkins
55f220122f policycoreutils: fixfiles: fix logging about R/O filesystems
The LogReadOnly() call which warns the user about R/O filesystems, applies
to the `-B` mode (newer() function), and the `fixfiles check` mode
(no paths).

Make sure to print it for these modes, and these modes only.
2017-05-05 13:27:10 -04:00
Alan Jenkins
08df753962 policycoreutils: fixfiles: clarify exclude_dirs()
The usage of exclude_dirs() is non-obvious.

It turns out it is only used by the `-C` mode of fixfiles.  The other four
modes use the narrower list generated by exclude_dirs_from_relabelling().
Let's make this distinction more obvious.

(The purpose of the extra exclusions is not clear.  E.g. there's an
exclusion for /dev.  Whereas the `fixfiles check` mode explicitly tells you
that it's going to relabel /dev, without causing any problem.  Maybe that
part is out of date?  But without some explanation of the list, I don't
want to change anything!)
2017-05-05 13:27:05 -04:00
Alan Jenkins
aa62e3665c policycoreutils: fixfiles: remove (broken) redundant code
setfiles is now run with $exclude_dirs.
We shouldn't need to patch the file contexts as well.

This is fortunate, since the file context patching code was broken
(by the same commit which introduced the redundancy).  It takes the
list of directories to exclude from $tempdirs, but $tempdirs is
never set.

Also messages about skipping directories were printed twice.  Firstly when
exclude_dirs is generated, and secondly in the file context patching code.

Also TEMPFCFILE was only removed in one path out of several.
2017-05-05 13:27:02 -04:00
Alan Jenkins
b5610b0c6e Revert "policycoreutils: let output of fixfiles be redirected (as normal)"
This reverts commit ac7899fc3a,
which is not yet part of an officially tagged release
(or release candidate).

`LOGFILE=/proc/self/fd/1` was wrong.

`LOGFILE=$(tty)` was being relied on in one case (exclude_dirs),
to log messages from a function run specifically with stdout redirected
(captured into a variable).

Having `logit "message"` break inside redirected functions
is a nasty leaky abstraction.

This caused e.g. `fixfiles restore` to terminate early with the error

    skipping: No such file or directory

if the user had configured any excluded paths in
/etc/selinux/fixfiles_exclude_dirs
2017-05-05 13:26:57 -04:00
Alan Jenkins
5ed45797df policycoreutils: fixfiles: remove useless use of cat
Don't force output through a pipe - let them access the TTY.

When run interactively, this acts as a workaround for
"Output of fixfiles gets garbled?"
https://bugzilla.redhat.com/show_bug.cgi?id=1435894

E.g. it would also be useful if restorecon ever decides it doesn't want to
output backspace characters on non-TTY outputs.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-03-28 13:41:22 -04:00
Alan Jenkins
d0fafe035d policycoreutils: fixfiles: handle unexpected spaces in command
I accidently ran `fixfiles "a b"` during testing.  Let's fix this too.
Before:

   /sbin/fixfiles: line 394: [: a: binary operator expected

   Usage: ...

After:

    Usage: ...

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-03-28 13:41:07 -04:00
Alan Jenkins
8c662db964 policycoreutils: fixfiles should handle path arguments more robustly
E.g. `fixfiles restore -v /usr` - before:

Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
Progress and Verbose mutually exclusive
usage:  /sbin/restorecon [-iFnprRv0] [-e excludedir] pathname...
usage:  /sbin/restorecon [-iFnprRv0] [-e excludedir] -f filename
Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
229k

after:

Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
/sbin/restorecon:  lstat(-v) failed:  No such file or directory
Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
229k

This matches the usage shown in the manual page.  While we're in there,
we should handle spaces as well e.g `fixfiles restore "a b"`.  Before:

Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
/sbin/restorecon:  lstat(b) failed:  No such file or directory

After:

Warning: Skipping the following R/O filesystems:
/sys/fs/cgroup
/sbin/restorecon:  lstat(a b) failed:  No such file or directory

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-03-28 13:41:04 -04:00
Stephen Smalley
cfea39714c policycoreutils: remove deprecated -o option from fixfiles verify
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2017-01-27 09:53:30 -05:00
Alan Jenkins
ac7899fc3a policycoreutils: let output of fixfiles be redirected (as normal)
fixfiles was redirecting log output to `tty`.  This overrides user intent
e.g. when shell redirection is used.

Redirect it to stdout, using /proc.  `tty` equally depended on /proc.
We do not depend on /dev/stdout: it might not be present, if a rescue
system is booted with devtmpfs (no udev daemon).

By default, log messages were redirected into the void when not run from a
tty.  We consider this a bug, which is now fixed.

1. If calling scripts happen to require the old behaviour, they can easily
   write the same code themselves.

2. When fixfiles is run from Fedora's selinux-autorelabel.service,
   the calling script is specifically run from a tty.

   Also Fedora's calling script chooses to redirect stdout and stderr to
   /dev/null.  This redirection will now suceed, improving the transparency
   of the code.  The previous behaviour may be obtained by choosing not
   to redirect the progress messages of this long-running process to
   /dev/null.  A patch has been submitted to Fedora to suggest this novel
   approach:  https://bugzilla.redhat.com/show_bug.cgi?id=1415674

Complete disclosure:

* Remove unused variable LOGGER.
* Fix logfiles containing spaces.

Disclaimer:

1. "Log" output may contain escape sequences (backspace?) e.g. in
   `fixfiles -l log.txt restore`.  This is not the usual understanding
   of a log file.

2.  For some reason, not all informative messages are sent to `-l` e.g.
   the list of filesystems, and "cleaning up labels on /tmp".

3. `function logit` is retained, but the logfile is also written to
   outside this function.  Implementing support for the system log
   would require another function which accepts piped input.
   Also see point 1.

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-01-24 13:34:57 -05:00
Alan Jenkins
62f058980e policycoreutils, python: Fix bad manpage formatting in "SEE ALSO"
Fix missing and surplus commas.  Fix the following formatting errors:

    .BR selinux(8)

renders the the "(8)" in bold as well as the "selinux".  This is wrong.

    .B selinux
    (8)

renders with a space between "selinux" and "(8)", this is wrong.

    .B selinux (8)

commits both of the above mistakes.

    .BR selinux (8), apparmor (8)

omits the space separating "selinux(8)," and "apparmor(8)", this is wrong.
Correct all the above using the following markup:

    .BR selinux (8),
    .BR apparmor (8)

Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-01-12 14:59:31 -05:00
Stephen Smalley
48dc232627 Move policycoreutils/{sepolicy,audit2allow,semanage,scripts/chcat*} and sepolgen to python.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-16 11:19:50 -05:00
Petr Lautrbach
e069f16f54 policycoreutils: 'fixfiles check' should not change anything
-n was not being passed down to restorecon properly in the code path
for -C and -N

Patch-by: Dan Callaghan <dcallagh@redhat.com>
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-08-09 15:55:26 -04:00
Petr Lautrbach
2e60a2c80e policycoreutils: Don't use subprocess.getstatusoutput() in Python 2 code
The commit 7574a50f tried to improve compatibility with Python 3. It changed
the code to use subprocess.getstatusoutput() instead of
commands.getstatusoutput(). Unfortunately subprocess.getstatusoutput() is not
available in Python 2. This patch changes how getstatusoutput() is imported so
the code works on Python 2 and Python 3.

Fixes:
$ chcat -d something
Traceback (most recent call last):
  File "/usr/bin/chcat", line 432, in <module>
    sys.exit(chcat_replace(["s0"], cmds, login_ind))
  File "/usr/bin/chcat", line 271, in chcat_replace
    rc = subprocess.getstatusoutput(cmd)
AttributeError: 'module' object has no attribute 'getstatusoutput'

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-08-09 15:55:02 -04:00
Jason Zaman
af59544e5f policycoreutils: gettext compat for py2 and 3
Install gettext the same way everywhere and have fallbacks to use
str/unicode depending on python version.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-08-05 12:57:08 -04:00
Petr Lautrbach
44d8b89a08 policycoreutils: remove typos from chcat --help
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-05-16 16:30:01 -04:00
Laurent Bigonville
7d8f5ce9b8 policycoreutils/chcat: Add a fallback in case os.getlogin() returns nothing
Some teminal emulators (like the latest version of gnome-terminal) are
not setting entries in the utmp file, this leads getlogin() to return an
empty string.

Fallback to the name of the user running the chcat process.
2015-12-17 08:56:01 -05:00
Jason Zaman
789d0ebbf9 policycoreutils: Fix PEP8 issues
When trying to get policycoreutils working in python3, I kept running
into TabErrors:

    Traceback (most recent call last):
      File "/usr/lib/python-exec/python3.3/semanage", line 27, in <module>
        import seobject
      File "/usr/lib64/python3.3/site-packages/seobject.py", line 154
        context = "%s%s" % (filler, raw)
                                       ^
    TabError: inconsistent use of tabs and spaces in indentation

Python3 is a lot stricter than python2 regarding whitespace and looks like
previous commits mixed the two.  When fixing this, I took the chance to fix
other PEP8 style issues at the same time.

This commit was made using:
$ file $(find . -type f) | grep -i python | sed 's/:.*$//' > pyfiles
$ autopep8 --in-place --ignore=E501,E265 $(cat pyfiles)

The ignore E501 is long lines since there are many that would be wrapped
otherwise, and E265 is block comments that start with ## instead of just #.

Signed-off-by: Jason Zaman <jason@perfinion.com>
2015-07-24 16:07:13 +08:00
Michal Srb
7574a50f18 policycoreutils/scripts: improve compatibility with Python 3
- __builtin__ module has been renamed to "builtins" in Python 3
- use reserved word `as` in try-except
- replace print statement with print function
- migrate from commands to subprocess
- fix formatting

Signed-off-by: Michal Srb <msrb@redhat.com>
2015-07-22 09:20:44 -04:00
Laurent Bigonville
2e93833b1b Minor manpages improvements 2013-11-06 09:36:33 -05:00
Dan Walsh
91d0de4adf genhomedircon is no longer a script, but a link to semodule 2013-10-24 13:58:39 -04:00
Dan Walsh
2910ca2185 Lots of fixes for fixfiles
Fix check for seclabel flag.
Restorecon commands should always use FORCEFLAG command if passed in.
Found a bug in handling of regex difference
All restorecon commands should use the exclude file path call.
Only cleanup /tmp on a Full Relabel, not a Check.
Set BOOTIME flag in /.autorelabel file, so that we can only relabel
files created since this time.  Should speed up relabel.
2013-10-24 13:58:39 -04:00
Dan Walsh
2540b20096 Laurent Bigonville patch to fix various minor manpage issues and correct section numbering. 2013-10-24 13:58:37 -04:00
Dan Walsh
1730f7ca36 policycoreutils: fixfiles: relabel only after specific date
Turn verbose on for full relabel

Add check to see if / has a label, if not then force a full relabel.

Add ability to record OPTIONS into the the /.autorelabel file.

fixfiles -F onboot
writes out /.autorelabel with -F

fixfiles -B onboot
writes on /autorelaebl with -N BOOTDATE recorded.

The goal is to allow boot up sequence that sees /.autorelabel to hand any
options store in it, to fixfiles restore

OPTIONS=`cat /.autorelabel`
fixfiles $OPTIONS restore

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-05 20:14:49 -05:00
Dan Walsh
6697e4db8b policycoreutils: genhomedircon generation to allow spec file to pass in SEMODULE_PATH
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-05 20:14:49 -05:00
Eric Paris
3e4ab5e506 policycoreutils: genhomedircon: regenerate genhomedircon more often
The semodule_path file, inside scripts, which is used to tell the
Makefile where genhomedircon should point to find semodule, was not
being updated.  This patch makes sure we update this file every time
something builds, thus genhomedircon doesn't point to some wild out of
data file location.

Signed-off-by: Eric Paris <eparis@redhat.com>
2013-02-05 20:14:48 -05:00
John Reiser
960d6ee879 policycoreutils: setfiles: estimate percent progress
This patch started with work from John Reiser patch to estimate the
percent progress for restorecon/setfiles.

It has a lot of changes since then, to make it only happen on full
relabel, overwrite itself, shows 10ths of %, and does a lot better and
more useful job of estimation.  We get all of the inodes on all mounted
FS.  Since the number of inodes is not fixed and only an estimate I added
5% to the inode number, and forced the number to never go over 100.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:51 -05:00
Guido Trentalancia
46ce32a6ee policycoreutils: genhomedircon: dynamically create genhomedircon
It dynamically creates the policycoreutils "genhomedircon"
script during the build process in order not to hard-code
the full path to the semodule executable, as in general the
latter could reside in non-standard SBINDIR/USRSBINDIR
locations.

It might not be very stylish or it might appear cumbersome,
but at least the script should not break as easily as the
current static one.

The patch also edits the Makefile for the scripts so that
LOCALEDIR correctly uses $(PREFIX) rather than an absolute
path.

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 21:15:41 -04:00
Dan Walsh
cef1d08d1e policycoreutils: fixfiles: tell restorecon to ignore missing paths
Restorecon should default to ignore missing files.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-09-12 12:16:17 -04:00
Dan Walsh
69d418551e policycoreutils: scripts: Don't syslog setfiles changes on a fixfiles restore
Fixfiles restore is called by auditrelabel, and was happening early in
the boot process, before the syslog system was up and running.  A bug
in systemd was causing relabels to take forever, while it waited for
the syslog's to complete.  This was fixed, but I still see no reason
to write thousands/millions of lines to syslog on a badly mislabled
machine and wanted this featured turned off.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-09-12 12:16:02 -04:00
Guido Trentalancia
f6b82ec701 policycoreutils: setfiles/restorecon minor improvements
- improves the manual page for both setfiles and restorecon (formatting
  including alphabetical re-ordering of options, undocumented options,
  references and a few cosmetic changes);
- de-hardcodes a couple of constants in the source files and makes a
  dynamic use of them to create the manual pages after the compilation
  and prior to the installation: more specifically the constants are the
  number of errors for the setfiles' validation process abort condition
  and the sensitivity of the progress meter for both programs (uses
  external programs grep and awk);
- improves the usage message for both programs and introduces a -h
  (aliased with currently existing -?) option where not already
  available;
- print out the usage message for restorecon when it is called without
  arguments;
- white-space/tab conversion to get proper indentation towards the end
  of the main source file.

[eparis add .gitignore]

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 12:16:00 -04:00
Guido Trentalancia
876f5faede policycoreutils: genhomedircon: manual page improvements
The following patch aims to improve the manual page (section 8) for the
"genhomedircon" script (policycoreutils).

- remove probably redundant GNU licence notice;
- try to further clarify the functionality made available by the
  "genhomedircon" script as well as all the configurable options that
  control its execution and affect its behavior;
- extend the references section (SEE ALSO).

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 12:16:00 -04:00
Manoj Srivastava
c124df61ae policycoreutils: Only run setfiles if we found read-write filesystems to run it on
Only run setfiles if we have a R/W filesystem

Signed-off-by: Laurent Bigonville <bigon@debian.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:14 -04:00
Dan Walsh
a56e91742f policycoreutils: scripts: Update Makefiles to handle /usrmove
Move everything into /usr/* and just put links from /*.  The whole /usr
thing hasn't really worked in all situations for a long long time.  Just
accept that fact and move along.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Eric Paris
1c15c8b537 policycoreutils: fixfiles: label /root but not /var/lib/BackupPC
This patch removes /root from the excluded dirs.

This also adds /var/lib/BackupPC to list of directories to ignore
labeling.  Mainly because this directory tends to be Huge and causes a
huge spike in the amount of time it takes to relabel.  Especially if
there is a relabel caused by a policy update.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-11-02 16:22:05 -04:00
Eric Paris
468bff0952 tree: Makefiles: syntax, convert all ${VAR} to $(VAR)
This is purely personal preference.  Most of the Makefiles use $() for
Makefile variables, but a couple of places use ${}.  Since this obscured
some later Makefile changes I figured I'd just make them all the same up
front.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-11-02 15:37:08 -04:00
Dan Walsh
5bd734dd73 policycoreutils: fixfiles: do not hard code types
We had a number of places where fixfiles would search for or set hard
coded types.  If policy used something other than tmp_t var_t file_t or
unlabeled_t we would go wrong.  This patch does 2 things.  It uses the
kernel provided selinuxfs interfaces to determine the label on unlabeled
and unknown files and it uses the --reference option with chcon to set
new labels.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 11:25:22 -04:00