On 11/17/2016 01:41 PM, Steve Huston wrote:
In the last few days I've upgraded a couple test systems to RHEL 7.3,
and with that came a new version of policycoreutils (named 2.5-9.el7,
up from 2.2.5-20). I found where some time ago the 'semodule' command
was modified to remove the version information from the output, which
has an unintended side effect of breaking my puppet modules that
maintain local selinux modules and verify the version running is equal
to the one in the manifest. The comment in the checkin (e599a4)
states that CIL does not have a concept of versions, so it's being
removed.
My question is, what is a good way to determine that the module that
is installed and running matches the one in a specific .te file? I
could of course tell puppet to trigger a rebuild of the .pp file if
the .te has been modified, but it seems without rebuilding and/or
reinstalling every puppet run there's no good way to verify that the
version in memory is the one I've intended.
One way is to install new versions of the module with different and higher
priorities. The highest priority module with a given name will be loaded.
To install with a priority use -X, so "semodule -X 401 -i my_module.pp"
will install my_module with priority 401. If you later change the module, you
can install it at a higher priority (like 402). The command "semodule -lfull"
will list all of the modules with their priority being given first, so the
module above will appear as "400 my_module pp". You can then check if the
priority is the same as your latest version. You can remove the old module at
the lower priority with "semodule -X 400 -r my_module" (after the module at
priority 401 is install.)
Another way would be to calculate the sha1sum of the compressed pp or cil file
in the policy store and compare it to a known value. So something like "sha1sum
/var/lib/selinux/targeted/active/modules/400/my_module/hll" will give you the
sha1sum of the compressed pp file (policy package is a high level language from
CIL's point of view).
I hope this helps.
--
James Carter <jwcart2@xxxxxxxxxxxxx>
National Security Agency
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
