On 4/22/09 9:50 PM, "Daniel J Walsh" <dwalsh@xxxxxxxxxx> wrote:
> On 04/22/2009 06:03 PM, Chad Sellers wrote:
>> On 4/1/09 10:10 AM, "Daniel J Walsh"<dwalsh@xxxxxxxxxx> wrote:
>>
>>> Multiple patches to policycoreutils.
>>>
>>> First added /root/.ssh and /root/.ssh/* to allow people to place keys
>>> in /root directory and have them labeled by restorcond
>>>
>>> Fix transaction handling in semanage so you can update multiple records
>>> simultaniously.
>>>
>>> Clean up permissive domains creation in semanage so it does not leave
>>> crap in /var/lib/selinux
>>>
>>> diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui
>>> --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf
>>> policycoreutils-2.0.62/restorecond/restorecond.conf
>>> --- nsapolicycoreutils/restorecond/restorecond.conf 2009-02-18
>>> 16:44:47.000000000 -0500
>>> +++ policycoreutils-2.0.62/restorecond/restorecond.conf 2009-02-23
>>> 11:32:21.000000000 -0500
>>> @@ -5,3 +5,7 @@
>>> /var/run/utmp
>>> /var/log/wtmp
>>> ~/*
>>> +/root/.ssh
>>> +/root/.ssh/*
>>> +
>>> +
>>> diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui
>>> --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles
>>> policycoreutils-2.0.62/scripts/fixfiles
>>> --- nsapolicycoreutils/scripts/fixfiles 2009-02-18 16:44:47.000000000
>>> -0500
>>> +++ policycoreutils-2.0.62/scripts/fixfiles 2009-02-19 10:07:49.000000000
>>> -0500
>>> @@ -122,7 +122,7 @@
>>> fi
>>> if [ ! -z "$RPMFILES" ]; then
>>> for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
>>> - rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1>>
>>> $LOGFILE
>>> + rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f -
>>> 2>&1>>
>>> $LOGFILE
>>> done
>>> exit $?
>>> fi
>> Not sure I understand this one, and it didn't seem to be mentioned in your
>> comment. You're changing fixfiles to relabel recursively when it's fixing
>> files from an rpm? Wouldn't an rpm already list all the files it owned?
>>
>> <snip due to previously ack'd patch>
>>> @@ -303,6 +308,12 @@
>>> if rc< 0:
>>> raise ValueError(_("Could not commit semanage
>>> transaction"))
>>>
>>> + def finish(self):
>>> + if not self.transaction:
>>> + raise ValueError(_("Semanage transaction not in
>>> progress"))
>>> + self.transaction = False
>>> + self.commit()
>>> +
>>> class permissiveRecords(semanageRecords):
>>> def __init__(self, store):
>>> semanageRecords.__init__(self, store)
>>> @@ -328,6 +339,7 @@
>>>
>>>
>>> def add(self, type):
>>> + import glob
>>> name = "permissive_%s" % type
>>> dirname = "/var/lib/selinux"
>>> os.chdir(dirname)
>>> @@ -351,16 +363,19 @@
>>> fd.close()
>>>
>>> rc = semanage_module_install(self.sh, data, len(data));
>>> - if rc< 0:
>>> - raise ValueError(_("Could not set permissive domain %s (module
>>> installation failed)") % name)
>>> -
>>> - self.commit()
>>> + if rc>= 0:
>>> + self.commit()
>>>
>>> for root, dirs, files in os.walk("tmp", topdown=False):
>>> for name in files:
>>> os.remove(os.path.join(root, name))
>>> for name in dirs:
>>> os.rmdir(os.path.join(root, name))
>>> + os.removedirs("tmp")
>>> + for i in glob.glob("permissive_%s.*" % type):
>>> + os.remove(i)
>>> + if rc< 0:
>>> + raise ValueError(_("Could not set permissive domain %s (module
>>> installation failed)") % name)
>>>
>>> def delete(self, name):
>>> for n in name.split():
>>
>> Other than that one thing, this looks fine to me.
>>
>> Thanks,
>> Chad
>>
>>
>> --
>> This message was distributed to subscribers of the selinux mailing list.
>> If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
>> the words "unsubscribe selinux" without quotes as the message.
> If a package owned a directory like /var/lib/libvirt/images, when it is
> relabeling we would want it to relabel not only the directory but the
> contents of the directory
Makes sense.
Acked-by: Chad Sellers <csellers@xxxxxxxxxx>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
