Commit Graph

47 Commits

Author SHA1 Message Date
Stephen Smalley
48dc232627 Move policycoreutils/{sepolicy,audit2allow,semanage,scripts/chcat*} and sepolgen to python.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-16 11:19:50 -05:00
Petr Lautrbach
e069f16f54 policycoreutils: 'fixfiles check' should not change anything
-n was not being passed down to restorecon properly in the code path
for -C and -N

Patch-by: Dan Callaghan <dcallagh@redhat.com>
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-08-09 15:55:26 -04:00
Petr Lautrbach
2e60a2c80e policycoreutils: Don't use subprocess.getstatusoutput() in Python 2 code
The commit 7574a50f tried to improve compatibility with Python 3. It changed
the code to use subprocess.getstatusoutput() instead of
commands.getstatusoutput(). Unfortunately subprocess.getstatusoutput() is not
available in Python 2. This patch changes how getstatusoutput() is imported so
the code works on Python 2 and Python 3.

Fixes:
$ chcat -d something
Traceback (most recent call last):
  File "/usr/bin/chcat", line 432, in <module>
    sys.exit(chcat_replace(["s0"], cmds, login_ind))
  File "/usr/bin/chcat", line 271, in chcat_replace
    rc = subprocess.getstatusoutput(cmd)
AttributeError: 'module' object has no attribute 'getstatusoutput'

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-08-09 15:55:02 -04:00
Jason Zaman
af59544e5f policycoreutils: gettext compat for py2 and 3
Install gettext the same way everywhere and have fallbacks to use
str/unicode depending on python version.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2016-08-05 12:57:08 -04:00
Petr Lautrbach
44d8b89a08 policycoreutils: remove typos from chcat --help
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2016-05-16 16:30:01 -04:00
Laurent Bigonville
7d8f5ce9b8 policycoreutils/chcat: Add a fallback in case os.getlogin() returns nothing
Some teminal emulators (like the latest version of gnome-terminal) are
not setting entries in the utmp file, this leads getlogin() to return an
empty string.

Fallback to the name of the user running the chcat process.
2015-12-17 08:56:01 -05:00
Jason Zaman
789d0ebbf9 policycoreutils: Fix PEP8 issues
When trying to get policycoreutils working in python3, I kept running
into TabErrors:

    Traceback (most recent call last):
      File "/usr/lib/python-exec/python3.3/semanage", line 27, in <module>
        import seobject
      File "/usr/lib64/python3.3/site-packages/seobject.py", line 154
        context = "%s%s" % (filler, raw)
                                       ^
    TabError: inconsistent use of tabs and spaces in indentation

Python3 is a lot stricter than python2 regarding whitespace and looks like
previous commits mixed the two.  When fixing this, I took the chance to fix
other PEP8 style issues at the same time.

This commit was made using:
$ file $(find . -type f) | grep -i python | sed 's/:.*$//' > pyfiles
$ autopep8 --in-place --ignore=E501,E265 $(cat pyfiles)

The ignore E501 is long lines since there are many that would be wrapped
otherwise, and E265 is block comments that start with ## instead of just #.

Signed-off-by: Jason Zaman <jason@perfinion.com>
2015-07-24 16:07:13 +08:00
Michal Srb
7574a50f18 policycoreutils/scripts: improve compatibility with Python 3
- __builtin__ module has been renamed to "builtins" in Python 3
- use reserved word `as` in try-except
- replace print statement with print function
- migrate from commands to subprocess
- fix formatting

Signed-off-by: Michal Srb <msrb@redhat.com>
2015-07-22 09:20:44 -04:00
Laurent Bigonville
2e93833b1b Minor manpages improvements 2013-11-06 09:36:33 -05:00
Dan Walsh
91d0de4adf genhomedircon is no longer a script, but a link to semodule 2013-10-24 13:58:39 -04:00
Dan Walsh
2910ca2185 Lots of fixes for fixfiles
Fix check for seclabel flag.
Restorecon commands should always use FORCEFLAG command if passed in.
Found a bug in handling of regex difference
All restorecon commands should use the exclude file path call.
Only cleanup /tmp on a Full Relabel, not a Check.
Set BOOTIME flag in /.autorelabel file, so that we can only relabel
files created since this time.  Should speed up relabel.
2013-10-24 13:58:39 -04:00
Dan Walsh
2540b20096 Laurent Bigonville patch to fix various minor manpage issues and correct section numbering. 2013-10-24 13:58:37 -04:00
Dan Walsh
1730f7ca36 policycoreutils: fixfiles: relabel only after specific date
Turn verbose on for full relabel

Add check to see if / has a label, if not then force a full relabel.

Add ability to record OPTIONS into the the /.autorelabel file.

fixfiles -F onboot
writes out /.autorelabel with -F

fixfiles -B onboot
writes on /autorelaebl with -N BOOTDATE recorded.

The goal is to allow boot up sequence that sees /.autorelabel to hand any
options store in it, to fixfiles restore

OPTIONS=`cat /.autorelabel`
fixfiles $OPTIONS restore

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-05 20:14:49 -05:00
Dan Walsh
6697e4db8b policycoreutils: genhomedircon generation to allow spec file to pass in SEMODULE_PATH
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-05 20:14:49 -05:00
Eric Paris
3e4ab5e506 policycoreutils: genhomedircon: regenerate genhomedircon more often
The semodule_path file, inside scripts, which is used to tell the
Makefile where genhomedircon should point to find semodule, was not
being updated.  This patch makes sure we update this file every time
something builds, thus genhomedircon doesn't point to some wild out of
data file location.

Signed-off-by: Eric Paris <eparis@redhat.com>
2013-02-05 20:14:48 -05:00
John Reiser
960d6ee879 policycoreutils: setfiles: estimate percent progress
This patch started with work from John Reiser patch to estimate the
percent progress for restorecon/setfiles.

It has a lot of changes since then, to make it only happen on full
relabel, overwrite itself, shows 10ths of %, and does a lot better and
more useful job of estimation.  We get all of the inodes on all mounted
FS.  Since the number of inodes is not fixed and only an estimate I added
5% to the inode number, and forced the number to never go over 100.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2013-02-01 12:08:51 -05:00
Guido Trentalancia
46ce32a6ee policycoreutils: genhomedircon: dynamically create genhomedircon
It dynamically creates the policycoreutils "genhomedircon"
script during the build process in order not to hard-code
the full path to the semodule executable, as in general the
latter could reside in non-standard SBINDIR/USRSBINDIR
locations.

It might not be very stylish or it might appear cumbersome,
but at least the script should not break as easily as the
current static one.

The patch also edits the Makefile for the scripts so that
LOCALEDIR correctly uses $(PREFIX) rather than an absolute
path.

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 21:15:41 -04:00
Dan Walsh
cef1d08d1e policycoreutils: fixfiles: tell restorecon to ignore missing paths
Restorecon should default to ignore missing files.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-09-12 12:16:17 -04:00
Dan Walsh
69d418551e policycoreutils: scripts: Don't syslog setfiles changes on a fixfiles restore
Fixfiles restore is called by auditrelabel, and was happening early in
the boot process, before the syslog system was up and running.  A bug
in systemd was causing relabels to take forever, while it waited for
the syslog's to complete.  This was fixed, but I still see no reason
to write thousands/millions of lines to syslog on a badly mislabled
machine and wanted this featured turned off.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-09-12 12:16:02 -04:00
Guido Trentalancia
f6b82ec701 policycoreutils: setfiles/restorecon minor improvements
- improves the manual page for both setfiles and restorecon (formatting
  including alphabetical re-ordering of options, undocumented options,
  references and a few cosmetic changes);
- de-hardcodes a couple of constants in the source files and makes a
  dynamic use of them to create the manual pages after the compilation
  and prior to the installation: more specifically the constants are the
  number of errors for the setfiles' validation process abort condition
  and the sensitivity of the progress meter for both programs (uses
  external programs grep and awk);
- improves the usage message for both programs and introduces a -h
  (aliased with currently existing -?) option where not already
  available;
- print out the usage message for restorecon when it is called without
  arguments;
- white-space/tab conversion to get proper indentation towards the end
  of the main source file.

[eparis add .gitignore]

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 12:16:00 -04:00
Guido Trentalancia
876f5faede policycoreutils: genhomedircon: manual page improvements
The following patch aims to improve the manual page (section 8) for the
"genhomedircon" script (policycoreutils).

- remove probably redundant GNU licence notice;
- try to further clarify the functionality made available by the
  "genhomedircon" script as well as all the configurable options that
  control its execution and affect its behavior;
- extend the references section (SEE ALSO).

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
2012-09-12 12:16:00 -04:00
Manoj Srivastava
c124df61ae policycoreutils: Only run setfiles if we found read-write filesystems to run it on
Only run setfiles if we have a R/W filesystem

Signed-off-by: Laurent Bigonville <bigon@debian.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:14 -04:00
Dan Walsh
a56e91742f policycoreutils: scripts: Update Makefiles to handle /usrmove
Move everything into /usr/* and just put links from /*.  The whole /usr
thing hasn't really worked in all situations for a long long time.  Just
accept that fact and move along.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-03-28 14:52:13 -04:00
Eric Paris
1c15c8b537 policycoreutils: fixfiles: label /root but not /var/lib/BackupPC
This patch removes /root from the excluded dirs.

This also adds /var/lib/BackupPC to list of directories to ignore
labeling.  Mainly because this directory tends to be Huge and causes a
huge spike in the amount of time it takes to relabel.  Especially if
there is a relabel caused by a policy update.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-11-02 16:22:05 -04:00
Eric Paris
468bff0952 tree: Makefiles: syntax, convert all ${VAR} to $(VAR)
This is purely personal preference.  Most of the Makefiles use $() for
Makefile variables, but a couple of places use ${}.  Since this obscured
some later Makefile changes I figured I'd just make them all the same up
front.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-11-02 15:37:08 -04:00
Dan Walsh
5bd734dd73 policycoreutils: fixfiles: do not hard code types
We had a number of places where fixfiles would search for or set hard
coded types.  If policy used something other than tmp_t var_t file_t or
unlabeled_t we would go wrong.  This patch does 2 things.  It uses the
kernel provided selinuxfs interfaces to determine the label on unlabeled
and unknown files and it uses the --reference option with chcon to set
new labels.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 11:25:22 -04:00
Eric Paris
35f4e6a870 policycoreutils: fixfiles: stop trying to be smart about filesystems
The type of a filesystem (ext*, btrfs, etc) really doesn't matter when
it comes to the ability to set labels.  Stop trying to be smart and just
call restorecon.  It will either work or it won't and out heuristic
isn't helping.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 11:25:22 -04:00
Eric Paris
1da72eea26 policycoreutils: fixfiles: use new kernel seclabel option
The kernel now outputs a mount option called 'seclabel' which indicates
if the filesystem supposed security labeling.  Use that instead of
having to update some hard coded list of acceptable filesystems (that
may or may not be acceptable depending on if they were compiled with
security xattrs)

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-15 11:25:20 -04:00
Eric Paris
e2769ff670 policycoreutils: fixfiles: pipe everything to cat before sending to LOGFILE
We do this so we can eliminate foolish avcs about restorecon trying to
write to a random directory.  We allow apps to communicate with fds
globably.  So this allows the access no AVC's I am happy

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-11 23:35:52 -04:00
Eric Paris
275560b2a3 policycoreutils: fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs
Introduce a new file /etc/selinux/fixfiles_exclude_dirs which contains a
list of directories which should not be relabeled.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-11 23:35:52 -04:00
Eric Paris
2d0c192355 policycoreutils: fixfiles: do not try to only label known filesystems
In the old fixfiles we had to make sure we only attempted to relabel
files that were on file systems that supported extended attributes.
With the new restorecon, we no longer need this.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
593154505a policycoreutils: fixfiles clean up /var/run and /var/lib/debug
clean up /var/run and /var/lib/debug just like we do for /tmp and
/var/tmp since they can easily get unlabeled files.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
2bd5fd1642 policycoreutils: fixfiles delete tmp sockets and pipes rather than relabel then
We cannot reasonably relabel pipes and sockets in /tmp to tmp_t so just
delete them instead of trying to put and unuable label.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
6084f72aaf policycoreutils: fixfile use find -delete instead of pipe to rm
fixfiles uses a find command then than pipes that to rm -f.  Just use
the find delete predicate instead of causing all of those extra calls to
rm.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
da484b88d5 policycoreutils: chcat man page typo
Fix the page to point to the the seusers file, not the seuser file.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
6a1c070ea6 policycoreutils: add man page for genhomedircon
Nothing special, just a man page to say what it's about.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:37 -04:00
Eric Paris
0b8af757b6 policycoreutils: Don't add user site directory to sys.path
SELinux pythons applications should not allow the user to change the
sys.path

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-08-03 18:02:36 -04:00
Daniel J Walsh
70849975f8 This patch removes OUTPUT from fixfiles which was never used and was broken
Patches come from

Moray.Henderson@ict.om.org

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:44:16 -05:00
Daniel J Walsh
0e84ca614a Small fixes for chcat in policycoreutils
chcat can generate oserror exception so need to catch and add chcat to the Makefile.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:14:40 -05:00
Daniel J Walsh
73a1f3a8f3 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Fixfiles has a bug when looking at btrfs file systems.
Date: Thu, 09 Jul 2009 16:06:58 -0400

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-07-30 21:52:30 -04:00
Daniel J Walsh
5467587bcc Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: chcat fixes
Date: Thu, 21 May 2009 08:13:26 -0400

On 05/20/2009 04:05 PM, Chad Sellers wrote:
> On 5/20/09 3:00 PM, "Daniel J Walsh"<dwalsh@redhat.com>  wrote:
>
>> Expansion of categores is still broken.  Here is a patch to fix.
>>
> This message appears to be missing a patch.
>
> Thanks,
> Chad
>

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-06-22 11:26:00 -04:00
Daniel J Walsh
323a16ff37 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Add btrfs to fixfiles.
Date: Wed, 20 May 2009 15:02:33 -0400

Hopefully the last time we will ever need to update.  Once patch gets
out with kernel support to tell me which file systems support xattr, we
can remove this hack.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-06-19 11:12:57 -04:00
Daniel J Walsh
b6a1a954f5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: patch to policycoreutils
Date: Wed, 01 Apr 2009 10:10:43 -0400

Multiple patches to policycoreutils.

First added /root/.ssh and /root/.ssh/*  to allow people to place keys
in /root directory and have them labeled by restorcond

<snipdue to previously ack'd patch>

Clean up permissive domains creation in semanage so it does not leave
crap in /var/lib/selinux

---
Also have fixfiles operate recursively when in RPM mode, per:

Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Re: patch to policycoreutils
Date: Wed, 22 Apr 2009 21:50:48 -0400

If a package owned a directory like /var/lib/libvirt/images, when it is
relabeling we would want it to relabel not only the directory but the
contents of the directory

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-04-10 19:17:47 -04:00
Joshua Brindle
f77e475fd8 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Add btrfs to fixfiles
Date: Tue, 17 Feb 2009 11:42:11 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hopefully will convert to seclabel when it is available.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkma6OMACgkQrlYvE4MpobNegwCfSBpm7O9wIKK+O89gC+Lwx+PV
rmsAn12IADGzhFu4thYK5qakacviWwfZ
=PtIL
-----END PGP SIGNATURE-----

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-02-17 11:43:11 -05:00
Joshua Brindle
8b092bade5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: chcat patch.
Date: Fri, 07 Nov 2008 09:39:32 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Prevent chcat from expanding number of categories above max size of
command line.  Arbitrarily picked 25.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkUUyQACgkQrlYvE4MpobMDDwCg0DMLERlnHZyVmORa9de9f5tf
fQsAoJZpO646H5CFuXZuW6htHpPfHz/z
=4OcI
-----END PGP SIGNATURE-----

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-01-12 10:19:59 -05:00
Joshua Brindle
95e4b5c3cc Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: fixfiles fixes
Date: Mon, 08 Sep 2008 15:03:35 -0400

[root@misterfreeze selinux]# cat patch
--- nsapolicycoreutils/scripts/fixfiles 2008-08-28 09:34:24.000000000 -0400
+++ policycoreutils-2.0.55/scripts/fixfiles     2008-09-08 14:08:57.000000000 -0400
@@ -139,14 +139,14 @@
 LogReadOnly
 ${SETFILES} -q ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
 rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
-find /tmp -context "*:file_t*" -exec chcon -t tmp_t {} \;
-find /var/tmp -context "*:file_t*" -exec chcon -t tmp_t {} \;
+find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
+find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 exit $?
 }

 fullrelabel() {
     logit "Cleaning out /tmp"
-    rm -rf /tmp/.??* /tmp/*
+    find /tmp/ -mindepth 1 -print0 | xargs -0 /bin/rm -f
     LogReadOnly
     restore
 }

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2008-09-07 18:40:28 -04:00
Joshua Brindle
13cd4c8960 initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00