mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-12 17:15:00 +00:00
d92388a8b0
libsepol.so symlink is usually part of the development package, try to load the library directly instead.
288 lines
7.8 KiB
Python
Executable File
288 lines
7.8 KiB
Python
Executable File
#!/usr/bin/python -E
|
|
|
|
|
|
from __future__ import print_function
|
|
import os
|
|
import errno
|
|
import shutil
|
|
import sys
|
|
from optparse import OptionParser
|
|
|
|
import ctypes
|
|
|
|
sepol = ctypes.cdll.LoadLibrary('libsepol.so.1')
|
|
|
|
try:
|
|
import selinux
|
|
import semanage
|
|
except:
|
|
print("You must install libselinux-python and libsemanage-python before running this tool", file=sys.stderr)
|
|
exit(1)
|
|
|
|
|
|
def copy_file(src, dst):
|
|
if DEBUG:
|
|
print("copying %s to %s" % (src, dst))
|
|
try:
|
|
shutil.copy(src, dst)
|
|
except OSError as the_err:
|
|
(err, strerr) = the_err.args
|
|
print("Could not copy %s to %s, %s" %(src, dst, strerr), file=sys.stderr)
|
|
exit(1)
|
|
|
|
|
|
def create_dir(dst, mode):
|
|
if DEBUG: print("Making directory %s" % dst)
|
|
try:
|
|
os.makedirs(dst, mode)
|
|
except OSError as the_err:
|
|
(err, stderr) = the_err.args
|
|
if err == errno.EEXIST:
|
|
pass
|
|
else:
|
|
print("Error creating %s" % dst, file=sys.stderr)
|
|
exit(1)
|
|
|
|
|
|
def create_file(dst):
|
|
if DEBUG: print("Making file %s" % dst)
|
|
try:
|
|
open(dst, 'a').close()
|
|
except OSError as the_err:
|
|
(err, stderr) = the_err.args
|
|
print("Error creating %s" % dst, file=sys.stderr)
|
|
exit(1)
|
|
|
|
|
|
def copy_module(store, name, base):
|
|
if DEBUG: print("Install module %s" % name)
|
|
(file, ext) = os.path.splitext(name)
|
|
if ext != ".pp":
|
|
# Stray non-pp file in modules directory, skip
|
|
print("warning: %s has invalid extension, skipping" % name, file=sys.stderr)
|
|
return
|
|
try:
|
|
if base:
|
|
root = oldstore_path(store)
|
|
else:
|
|
root = oldmodules_path(store)
|
|
|
|
bottomdir = bottomdir_path(store)
|
|
|
|
os.mkdir("%s/%s" % (bottomdir, file))
|
|
|
|
copy_file(os.path.join(root, name), "%s/%s/hll" % (bottomdir, file))
|
|
|
|
# This is the ext file that will eventually be used to choose a compiler
|
|
efile = open("%s/%s/lang_ext" % (bottomdir, file), "w+", 0o600)
|
|
efile.write("pp")
|
|
efile.close()
|
|
|
|
except:
|
|
print("Error installing module %s" % name, file=sys.stderr)
|
|
exit(1)
|
|
|
|
|
|
def disable_module(file, name, disabledmodules):
|
|
if DEBUG: print("Disabling %s" % name)
|
|
(disabledname, disabledext) = os.path.splitext(file)
|
|
create_file("%s/%s" % (disabledmodules, disabledname))
|
|
|
|
def migrate_store(store):
|
|
|
|
oldstore = oldstore_path(store);
|
|
oldmodules = oldmodules_path(store);
|
|
disabledmodules = disabledmodules_path(store);
|
|
newstore = newstore_path(store);
|
|
newmodules = newmodules_path(store);
|
|
bottomdir = bottomdir_path(store);
|
|
|
|
print("Migrating from %s to %s" % (oldstore, newstore))
|
|
|
|
# Build up new directory structure
|
|
create_dir("%s/%s" % (newroot_path(), store), 0o755)
|
|
create_dir(newstore, 0o700)
|
|
create_dir(newmodules, 0o700)
|
|
create_dir(bottomdir, 0o700)
|
|
create_dir(disabledmodules, 0o700)
|
|
|
|
# Special case for base since it was in a different location
|
|
copy_module(store, "base.pp", 1)
|
|
|
|
# Dir structure built, start copying files
|
|
for root, dirs, files in os.walk(oldstore):
|
|
if root == oldstore:
|
|
# This is the top level directory, need to move
|
|
for name in files:
|
|
# Check to see if it is in TOPPATHS and copy if so
|
|
if name in TOPPATHS:
|
|
if name == "seusers":
|
|
newname = "seusers.local"
|
|
else:
|
|
newname = name
|
|
copy_file(os.path.join(root, name), os.path.join(newstore, newname))
|
|
|
|
elif root == oldmodules:
|
|
# This should be the modules directory
|
|
for name in files:
|
|
(file, ext) = os.path.splitext(name)
|
|
if name == "base.pp":
|
|
print("Error installing module %s, name conflicts with base" % name, file=sys.stderr)
|
|
exit(1)
|
|
elif ext == ".disabled":
|
|
disable_module(file, name, disabledmodules)
|
|
else:
|
|
copy_module(store, name, 0)
|
|
|
|
def rebuild_policy():
|
|
# Ok, the modules are loaded, lets try to rebuild the policy
|
|
print("Attempting to rebuild policy from %s" % newroot_path())
|
|
|
|
curstore = selinux.selinux_getpolicytype()[1]
|
|
|
|
handle = semanage.semanage_handle_create()
|
|
if not handle:
|
|
print("Could not create semanage handle", file=sys.stderr)
|
|
exit(1)
|
|
|
|
semanage.semanage_select_store(handle, curstore, semanage.SEMANAGE_CON_DIRECT)
|
|
|
|
if not semanage.semanage_is_managed(handle):
|
|
semanage.semanage_handle_destroy(handle)
|
|
print("SELinux policy is not managed or store cannot be accessed.", file=sys.stderr)
|
|
exit(1)
|
|
|
|
rc = semanage.semanage_access_check(handle)
|
|
if rc < semanage.SEMANAGE_CAN_WRITE:
|
|
semanage.semanage_handle_destroy(handle)
|
|
print("Cannot write to policy store.", file=sys.stderr)
|
|
exit(1)
|
|
|
|
rc = semanage.semanage_connect(handle)
|
|
if rc < 0:
|
|
semanage.semanage_handle_destroy(handle)
|
|
print("Could not establish semanage connection", file=sys.stderr)
|
|
exit(1)
|
|
|
|
semanage.semanage_set_rebuild(handle, 1)
|
|
|
|
rc = semanage.semanage_begin_transaction(handle)
|
|
if rc < 0:
|
|
semanage.semanage_handle_destroy(handle)
|
|
print("Could not begin transaction", file=sys.stderr)
|
|
exit(1)
|
|
|
|
rc = semanage.semanage_commit(handle)
|
|
if rc < 0:
|
|
print("Could not commit transaction", file=sys.stderr)
|
|
|
|
semanage.semanage_handle_destroy(handle)
|
|
|
|
|
|
def oldroot_path():
|
|
return "%s/etc/selinux" % ROOT
|
|
|
|
def oldstore_path(store):
|
|
return "%s/%s/modules/active" % (oldroot_path(), store)
|
|
|
|
def oldmodules_path(store):
|
|
return "%s/modules" % oldstore_path(store)
|
|
|
|
def disabledmodules_path(store):
|
|
return "%s/disabled" % newmodules_path(store)
|
|
|
|
def newroot_path():
|
|
return "%s%s" % (ROOT, PATH)
|
|
|
|
def newstore_path(store):
|
|
return "%s/%s/active" % (newroot_path(), store)
|
|
|
|
def newmodules_path(store):
|
|
return "%s/modules" % newstore_path(store)
|
|
|
|
def bottomdir_path(store):
|
|
return "%s/%s" % (newmodules_path(store), PRIORITY)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
parser = OptionParser()
|
|
parser.add_option("-p", "--priority", dest="priority", default="100",
|
|
help="Set priority of modules in new store (default: 100)")
|
|
parser.add_option("-s", "--store", dest="store", default=None,
|
|
help="Store to read from and write to")
|
|
parser.add_option("-d", "--debug", dest="debug", action="store_true", default=False,
|
|
help="Output debug information")
|
|
parser.add_option("-c", "--clean", dest="clean", action="store_true", default=False,
|
|
help="Clean old modules directory after migrate (default: no)")
|
|
parser.add_option("-n", "--norebuild", dest="norebuild", action="store_true", default=False,
|
|
help="Disable rebuilding policy after migration (default: no)")
|
|
parser.add_option("-P", "--path", dest="path",
|
|
help="Set path for the policy store (default: /var/lib/selinux)")
|
|
parser.add_option("-r", "--root", dest="root",
|
|
help="Set an alternative root for the migration (default: /)")
|
|
|
|
(options, args) = parser.parse_args()
|
|
|
|
DEBUG = options.debug
|
|
PRIORITY = options.priority
|
|
TYPE = options.store
|
|
CLEAN = options.clean
|
|
NOREBUILD = options.norebuild
|
|
PATH = options.path
|
|
if PATH is None:
|
|
PATH = "/var/lib/selinux"
|
|
|
|
ROOT = options.root
|
|
if ROOT is None:
|
|
ROOT = ""
|
|
|
|
# List of paths that go in the active 'root'
|
|
TOPPATHS = [
|
|
"commit_num",
|
|
"ports.local",
|
|
"interfaces.local",
|
|
"nodes.local",
|
|
"booleans.local",
|
|
"file_contexts.local",
|
|
"seusers",
|
|
"users.local",
|
|
"users_extra",
|
|
"users_extra.local",
|
|
"disable_dontaudit",
|
|
"preserve_tunables",
|
|
"policy.kern",
|
|
"file_contexts",
|
|
"homedir_template"]
|
|
|
|
|
|
create_dir(newroot_path(), 0o755)
|
|
|
|
stores = None
|
|
if TYPE is not None:
|
|
stores = [TYPE]
|
|
else:
|
|
stores = os.listdir(oldroot_path())
|
|
|
|
# find stores in oldroot and migrate them to newroot if necessary
|
|
for store in stores:
|
|
if not os.path.isdir(oldmodules_path(store)):
|
|
# already migrated or not an selinux store
|
|
continue
|
|
|
|
if os.path.isdir(newstore_path(store)):
|
|
# store has already been migrated, but old modules dir still exits
|
|
print("warning: Policy type %s has already been migrated, but modules still exist in the old store. Skipping store." % store, file=sys.stderr)
|
|
continue
|
|
|
|
migrate_store(store)
|
|
|
|
if CLEAN is True:
|
|
def remove_error(function, path, execinfo):
|
|
print("warning: Unable to remove old store modules directory %s. Cleaning failed." % oldmodules_path(store), file=sys.stderr)
|
|
shutil.rmtree(oldmodules_path(store), onerror=remove_error)
|
|
|
|
if NOREBUILD is False:
|
|
rebuild_policy()
|
|
|