Chad Sellers wrote:
On 4/22/09 9:50 PM, "Daniel J Walsh" <dwalsh@xxxxxxxxxx> wrote:
On 04/22/2009 06:03 PM, Chad Sellers wrote:
On 4/1/09 10:10 AM, "Daniel J Walsh"<dwalsh@xxxxxxxxxx> wrote:
Multiple patches to policycoreutils.
First added /root/.ssh and /root/.ssh/* to allow people to place keys
in /root directory and have them labeled by restorcond
Fix transaction handling in semanage so you can update multiple records
simultaniously.
Clean up permissive domains creation in semanage so it does not leave
crap in /var/lib/selinux
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui
--exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf
policycoreutils-2.0.62/restorecond/restorecond.conf
--- nsapolicycoreutils/restorecond/restorecond.conf 2009-02-18
16:44:47.000000000 -0500
+++ policycoreutils-2.0.62/restorecond/restorecond.conf 2009-02-23
11:32:21.000000000 -0500
@@ -5,3 +5,7 @@
/var/run/utmp
/var/log/wtmp
~/*
+/root/.ssh
+/root/.ssh/*
+
+
diff --exclude-from=exclude --exclude=sepolgen-1.0.16 --exclude=gui
--exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles
policycoreutils-2.0.62/scripts/fixfiles
--- nsapolicycoreutils/scripts/fixfiles 2009-02-18 16:44:47.000000000
-0500
+++ policycoreutils-2.0.62/scripts/fixfiles 2009-02-19 10:07:49.000000000
-0500
@@ -122,7 +122,7 @@
fi
if [ ! -z "$RPMFILES" ]; then
for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
- rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -i -f - 2>&1>>
$LOGFILE
+ rpmlist $i | ${RESTORECON} ${OUTFILES} ${FORCEFLAG} $* -R -i -f -
2>&1>>
$LOGFILE
done
exit $?
fi
Not sure I understand this one, and it didn't seem to be mentioned in your
comment. You're changing fixfiles to relabel recursively when it's fixing
files from an rpm? Wouldn't an rpm already list all the files it owned?
<snip due to previously ack'd patch>
@@ -303,6 +308,12 @@
if rc< 0:
raise ValueError(_("Could not commit semanage
transaction"))
+ def finish(self):
+ if not self.transaction:
+ raise ValueError(_("Semanage transaction not in
progress"))
+ self.transaction = False
+ self.commit()
+
class permissiveRecords(semanageRecords):
def __init__(self, store):
semanageRecords.__init__(self, store)
@@ -328,6 +339,7 @@
def add(self, type):
+ import glob
name = "permissive_%s" % type
dirname = "/var/lib/selinux"
os.chdir(dirname)
@@ -351,16 +363,19 @@
fd.close()
rc = semanage_module_install(self.sh, data, len(data));
- if rc< 0:
- raise ValueError(_("Could not set permissive domain %s (module
installation failed)") % name)
-
- self.commit()
+ if rc>= 0:
+ self.commit()
for root, dirs, files in os.walk("tmp", topdown=False):
for name in files:
os.remove(os.path.join(root, name))
for name in dirs:
os.rmdir(os.path.join(root, name))
+ os.removedirs("tmp")
+ for i in glob.glob("permissive_%s.*" % type):
+ os.remove(i)
+ if rc< 0:
+ raise ValueError(_("Could not set permissive domain %s (module
installation failed)") % name)
def delete(self, name):
for n in name.split():
Other than that one thing, this looks fine to me.
Thanks,
Chad
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
If a package owned a directory like /var/lib/libvirt/images, when it is
relabeling we would want it to relabel not only the directory but the
contents of the directory
Makes sense.
Acked-by: Chad Sellers <csellers@xxxxxxxxxx>
Merged in policycoreutils-2.0.63
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
