Discussion:
[PATCH] python/semanage: Do not try to reload policy when SELinux is disabled
Petr Lautrbach
2017-11-02 13:19:30 UTC
Permalink
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload in this case
doesn't make sense, we should probably try to avoid that.

Fixes:
$ sudo umount /sys/fs/selinux

$ sudo semanage fcontext -a --type=postfix_local_tmp_t /var/opt/01789667
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.31, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.31: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory).
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.31, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.31: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory

Signed-off-by: Petr Lautrbach <***@redhat.com>
---
python/semanage/seobject.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
@@ -241,7 +241,7 @@ class semanageRecords:

def __init__(self, store):
global handle
- self.load = True
+ self.load = selinux.is_selinux_enabled()
self.sh = self.get_handle(store)

rc, localstore = selinux.selinux_getpolicytype()
@@ -251,7 +251,7 @@ class semanageRecords:
self.mylog = nulllogger()

def set_reload(self, load):
- self.load = load
+ self.load = selinux.is_selinux_enabled() and load

def get_handle(self, store):
global is_mls_enabled
--
2.14.3
Stephen Smalley
2017-11-02 13:52:25 UTC
Permalink
Post by Petr Lautrbach
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload in this case
doesn't make sense, we should probably try to avoid that.
I haven't looked closely at this yet, but I know libsemanage itself
internally sets ->do_reload to false if is_selinux_enabled() is 0 (or
-1), so why is it that seobject.py is manually deciding whether to
reload policy?
Post by Petr Lautrbach
$ sudo umount /sys/fs/selinux
$ sudo semanage fcontext -a --type=postfix_local_tmp_t
/var/opt/01789667
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory
---
 python/semanage/seobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/python/semanage/seobject.py
b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
 
         global handle
-        self.load = True
+        self.load = selinux.is_selinux_enabled()
         self.sh = self.get_handle(store)
 
         rc, localstore = selinux.selinux_getpolicytype()
             self.mylog = nulllogger()
 
-        self.load = load
+        self.load = selinux.is_selinux_enabled() and load
 
         global is_mls_enabled
Jason Zaman
2017-11-02 14:05:04 UTC
Permalink
Post by Stephen Smalley
Post by Petr Lautrbach
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload in this case
doesn't make sense, we should probably try to avoid that.
I haven't looked closely at this yet, but I know libsemanage itself
internally sets ->do_reload to false if is_selinux_enabled() is 0 (or
-1), so why is it that seobject.py is manually deciding whether to
reload policy?
seobject.py is like a pile of hacks now, im not surprised its bad. We
really need to kill it completely (ie use setools directly instead of the
annoying wrappers in seobject). I keep meaning to go through and
port over the consumers of it slowly but -ENOTIME :(.

-- Jason
Post by Stephen Smalley
Post by Petr Lautrbach
$ sudo umount /sys/fs/selinux
$ sudo semanage fcontext -a --type=postfix_local_tmp_t
/var/opt/01789667
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory
---
 python/semanage/seobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/python/semanage/seobject.py
b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
 
         global handle
-        self.load = True
+        self.load = selinux.is_selinux_enabled()
         self.sh = self.get_handle(store)
 
         rc, localstore = selinux.selinux_getpolicytype()
             self.mylog = nulllogger()
 
-        self.load = load
+        self.load = selinux.is_selinux_enabled() and load
 
         global is_mls_enabled
Petr Lautrbach
2017-11-02 14:17:17 UTC
Permalink
Post by Stephen Smalley
Post by Petr Lautrbach
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload in this case
doesn't make sense, we should probably try to avoid that.
I haven't looked closely at this yet, but I know libsemanage itself
internally sets ->do_reload to false if is_selinux_enabled() is 0 (or
-1), so why is it that seobject.py is manually deciding whether to
reload policy?
semanageRecords.commit() method calls semanage_set_reload(self.sh, self.load)
and this overrides the default value set in semanage_handle_create()

the flow something like this:

seobject: __init__(self, store):
self.sh = self.get_handle(store)

semanage: semanageRecords.get_handle()
handle = semanage_handle_create()

libsemanage: semanage_handle_create()
sh->do_reload = (is_selinux_enabled() > 0);

seobject: commit()
semanage_set_reload(self.sh, self.load)

Looking into this, the check if SELinux is enabled could be moved to
libsemanage: semanage_set_reload() and maybe with WARN message in case
that it doesn't set a new value.
Post by Stephen Smalley
Post by Petr Lautrbach
$ sudo umount /sys/fs/selinux
$ sudo semanage fcontext -a --type=postfix_local_tmp_t
/var/opt/01789667
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory
---
 python/semanage/seobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/python/semanage/seobject.py
b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
 
         global handle
-        self.load = True
+        self.load = selinux.is_selinux_enabled()
         self.sh = self.get_handle(store)
 
         rc, localstore = selinux.selinux_getpolicytype()
             self.mylog = nulllogger()
 
-        self.load = load
+        self.load = selinux.is_selinux_enabled() and load
 
         global is_mls_enabled
Stephen Smalley
2017-11-02 14:48:31 UTC
Permalink
Post by Petr Lautrbach
Post by Stephen Smalley
Post by Petr Lautrbach
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload
in
this case
doesn't make sense, we should probably try to avoid that.
I haven't looked closely at this yet, but I know libsemanage itself
internally sets ->do_reload to false if is_selinux_enabled() is 0 (or
-1), so why is it that seobject.py is manually deciding whether to
reload policy?
semanageRecords.commit() method calls semanage_set_reload(self.sh, self.load)
and this overrides the default value set in semanage_handle_create()
    self.sh = self.get_handle(store)
semanage: semanageRecords.get_handle()
    handle = semanage_handle_create()
libsemanage: semanage_handle_create()
    sh->do_reload = (is_selinux_enabled() > 0);
seobject: commit()
    semanage_set_reload(self.sh, self.load)
Looking into this, the check if SELinux is enabled could be moved to
libsemanage: semanage_set_reload() and maybe with WARN message in case
that it doesn't set a new value.
Hmm...why does seobject.py call semanage_set_reload() at all except in
the case where it is explicitly called with -N and wants to forcibly
suppress policy reload? If we can avoid making the call except in that
case, then we don't need to change libsemanage at all.
Post by Petr Lautrbach
Post by Stephen Smalley
Post by Petr Lautrbach
$ sudo umount /sys/fs/selinux
$ sudo semanage fcontext -a --type=postfix_local_tmp_t
/var/opt/01789667
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or
directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or
directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory
---
 python/semanage/seobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/python/semanage/seobject.py
b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
 
         global handle
-        self.load = True
+        self.load = selinux.is_selinux_enabled()
         self.sh = self.get_handle(store)
 
         rc, localstore = selinux.selinux_getpolicytype()
             self.mylog = nulllogger()
 
-        self.load = load
+        self.load = selinux.is_selinux_enabled() and load
 
         global is_mls_enabled
Petr Lautrbach
2017-11-03 08:22:11 UTC
Permalink
Post by Stephen Smalley
Post by Petr Lautrbach
Post by Stephen Smalley
Post by Petr Lautrbach
When SELinux is disabled, semanage without -N fails with a quite complicated
error message when it tries to reload a new policy. Since reload
in
this case
doesn't make sense, we should probably try to avoid that.
I haven't looked closely at this yet, but I know libsemanage itself
internally sets ->do_reload to false if is_selinux_enabled() is 0 (or
-1), so why is it that seobject.py is manually deciding whether to
reload policy?
semanageRecords.commit() method calls semanage_set_reload(self.sh, self.load)
and this overrides the default value set in semanage_handle_create()
    self.sh = self.get_handle(store)
semanage: semanageRecords.get_handle()
    handle = semanage_handle_create()
libsemanage: semanage_handle_create()
    sh->do_reload = (is_selinux_enabled() > 0);
seobject: commit()
    semanage_set_reload(self.sh, self.load)
Looking into this, the check if SELinux is enabled could be moved to
libsemanage: semanage_set_reload() and maybe with WARN message in case
that it doesn't set a new value.
Hmm...why does seobject.py call semanage_set_reload() at all except in
the case where it is explicitly called with -N and wants to forcibly
suppress policy reload? If we can avoid making the call except in that
case, then we don't need to change libsemanage at all.
I'll prepare another patch based on your comments and sugestions.

Thanks,

Petr
Post by Stephen Smalley
Post by Petr Lautrbach
Post by Stephen Smalley
Post by Petr Lautrbach
$ sudo umount /sys/fs/selinux
$ sudo semanage fcontext -a --type=postfix_local_tmp_t
/var/opt/01789667
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
SELinux:  Could not downgrade policy file
/etc/selinux/targeted/policy/policy.31, searching for an older
version.
SELinux:  Could not open policy file <=
/etc/selinux/targeted/policy/policy.31:  No such file or directory
/sbin/load_policy:  Can't load policy:  No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code
2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory
---
 python/semanage/seobject.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/python/semanage/seobject.py
b/python/semanage/seobject.py
index 1385315f..37f2b8c6 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
 
         global handle
-        self.load = True
+        self.load = selinux.is_selinux_enabled()
         self.sh = self.get_handle(store)
 
         rc, localstore = selinux.selinux_getpolicytype()
             self.mylog = nulllogger()
 
-        self.load = load
+        self.load = selinux.is_selinux_enabled() and load
 
         global is_mls_enabled
Petr Lautrbach
2017-11-06 15:00:38 UTC
Permalink
Signed-off-by: Petr Lautrbach <***@redhat.com>
---
python/semanage/semanage | 74 +++++++++---------------------------------------
1 file changed, 14 insertions(+), 60 deletions(-)

diff --git a/python/semanage/semanage b/python/semanage/semanage
index 313537c5..8acfc855 100644
--- a/python/semanage/semanage
+++ b/python/semanage/semanage
@@ -134,67 +134,21 @@ class SetImportFile(argparse.Action):
sys.exit(1)
setattr(namespace, self.dest, values)

-# functions for OBJECT initialization
-
-
-def login_ini():
- OBJECT = seobject.loginRecords(store)
- return OBJECT
-
-
-def user_ini():
- OBJECT = seobject.seluserRecords(store)
- return OBJECT
-
-
-def port_ini():
- OBJECT = seobject.portRecords(store)
- return OBJECT
-
-def ibpkey_ini():
- OBJECT = seobject.ibpkeyRecords(store)
- return OBJECT
-
-def ibendport_ini():
- OBJECT = seobject.ibendportRecords(store)
- return OBJECT
-
-def module_ini():
- OBJECT = seobject.moduleRecords(store)
- return OBJECT
-
-
-def interface_ini():
- OBJECT = seobject.interfaceRecords(store)
- return OBJECT
-
-
-def node_ini():
- OBJECT = seobject.nodeRecords(store)
- return OBJECT
-
-
-def fcontext_ini():
- OBJECT = seobject.fcontextRecords(store)
- return OBJECT
-
-
-def boolean_ini():
- OBJECT = seobject.booleanRecords(store)
- return OBJECT
-
-
-def permissive_ini():
- OBJECT = seobject.permissiveRecords(store)
- return OBJECT
-
-
-def dontaudit_ini():
- OBJECT = seobject.dontauditClass(store)
- return OBJECT
-
# define dictonary for seobject OBEJCTS
-object_dict = {'login': login_ini, 'user': user_ini, 'port': port_ini, 'module': module_ini, 'interface': interface_ini, 'node': node_ini, 'fcontext': fcontext_ini, 'boolean': boolean_ini, 'permissive': permissive_ini, 'dontaudit': dontaudit_ini, 'ibpkey': ibpkey_ini, 'ibendport': ibendport_ini}
+object_dict = {
+ 'login': seobject.loginRecords,
+ 'user': seobject.seluserRecords,
+ 'port': seobject.portRecords,
+ 'module': seobject.moduleRecords,
+ 'interface': seobject.interfaceRecords,
+ 'node': seobject.nodeRecords,
+ 'fcontext': seobject.fcontextRecords,
+ 'boolean': seobject.booleanRecords,
+ 'permissive': seobject.permissiveRecords,
+ 'dontaudit': seobject.dontauditClass,
+ 'ibpkey': seobject.ibpkeyRecords,
+ 'ibendport': seobject.ibendportRecords
+}

def generate_custom_usage(usage_text, usage_dict):
# generate custom usage from given text and dictonary
--
2.14.3
Petr Lautrbach
2017-11-06 15:00:40 UTC
Permalink
We want to call semanage_set_reload() only if -N option is used.

Fixes:

$ sudo umount /sys/fs/selinux

$ sudo semanage fcontext -a --type=postfix_local_tmp_t /var/opt/01789667
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.31, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.31: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory).
SELinux: Could not downgrade policy file /etc/selinux/targeted/policy/policy.31, searching for an older version.
SELinux: Could not open policy file <= /etc/selinux/targeted/policy/policy.31: No such file or directory
/sbin/load_policy: Can't load policy: No such file or directory
libsemanage.semanage_reload_policy: load_policy returned error code 2. (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory

Signed-off-by: Petr Lautrbach <***@redhat.com>
---
python/semanage/semanage | 15 +--------------
python/semanage/seobject.py | 11 ++++++-----
2 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/python/semanage/semanage b/python/semanage/semanage
index bcac20b2..8d8a0860 100644
--- a/python/semanage/semanage
+++ b/python/semanage/semanage
@@ -183,7 +183,6 @@ def handleLogin(args):
handle_opts(args, login_args, args.action)

OBJECT = object_dict['login'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.login, args.seuser, args.range)
@@ -213,7 +212,7 @@ def parser_add_noheading(parser, name):


def parser_add_noreload(parser, name):
- parser.add_argument('-N', '--noreload', action='store_false', default=True, help=_('Do not reload policy after commit'))
+ parser.add_argument('-N', '--noreload', action='store_true', default=False, help=_('Do not reload policy after commit'))


def parser_add_locallist(parser, name):
@@ -317,7 +316,6 @@ def handleFcontext(args):
handle_opts(args, fcontext_args, args.action)

OBJECT = object_dict['fcontext'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
if args.equal:
@@ -386,7 +384,6 @@ def handleUser(args):
handle_opts(args, user_args, args.action)

OBJECT = object_dict['user'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.selinux_name, args.roles, args.level, args.range, args.prefix)
@@ -437,7 +434,6 @@ def handlePort(args):
handle_opts(args, port_args, args.action)

OBJECT = object_dict['port'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.port, args.proto, args.range, args.type)
@@ -483,7 +479,6 @@ def handlePkey(args):
handle_opts(args, ibpkey_args, args.action)

OBJECT = object_dict['ibpkey'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.ibpkey, args.subnet_prefix, args.range, args.type)
@@ -527,7 +522,6 @@ def handleIbendport(args):
handle_opts(args, ibendport_args, args.action)

OBJECT = object_dict['ibendport'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.ibendport, args.ibdev_name, args.range, args.type)
@@ -571,7 +565,6 @@ def handleInterface(args):
handle_opts(args, interface_args, args.action)

OBJECT = object_dict['interface'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.interface, args.range, args.type)
@@ -611,7 +604,6 @@ def setupInterfaceParser(subparsers):

def handleModule(args):
OBJECT = seobject.moduleRecords(args)
- OBJECT.set_reload(args.noreload)
if args.action == "add":
OBJECT.add(args.module_name, args.priority)
if args.action == "enable":
@@ -654,7 +646,6 @@ def handleNode(args):
handle_opts(args, node_args, args.action)

OBJECT = object_dict['node'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "add":
OBJECT.add(args.node, args.netmask, args.proto, args.range, args.type)
@@ -701,7 +692,6 @@ def handleBoolean(args):
handle_opts(args, boolean_args, args.action)

OBJECT = object_dict['boolean'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "modify":
if args.boolean:
@@ -740,7 +730,6 @@ def setupBooleanParser(subparsers):

def handlePermissive(args):
OBJECT = object_dict['permissive'](args)
- OBJECT.set_reload(args.noreload)

if args.action is "list":
OBJECT.list(args.noheading)
@@ -775,7 +764,6 @@ def setupPermissiveParser(subparsers):

def handleDontaudit(args):
OBJECT = object_dict['dontaudit'](args)
- OBJECT.set_reload(args.noreload)
OBJECT.toggle(args.action)


@@ -876,7 +864,6 @@ def handleImport(args):
except KeyboardInterrupt:
sys.exit(0)

- trans.set_reload(args.noreload)
trans.finish()


diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
index 00246fdd..228c8ae9 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
@@ -242,8 +242,11 @@ class semanageRecords:

def __init__(self, args):
global handle
- self.load = True
self.args = args
+ try:
+ self.noreload = args.noreload
+ except:
+ self.noreload = False
self.sh = self.get_handle(args.store)

rc, localstore = selinux.selinux_getpolicytype()
@@ -252,9 +255,6 @@ class semanageRecords:
else:
self.mylog = nulllogger()

- def set_reload(self, load):
- self.load = load
-
def get_handle(self, store):
global is_mls_enabled

@@ -314,7 +314,8 @@ class semanageRecords:
if semanageRecords.transaction:
return

- semanage_set_reload(self.sh, self.load)
+ if self.noreload:
+ semanage_set_reload(self.sh, 0)
rc = semanage_commit(self.sh)
if rc < 0:
self.mylog.commit(0)
--
2.14.3
Petr Lautrbach
2017-11-06 15:00:39 UTC
Permalink
In order to do that we need to propagate args into seobject objects and
use args.store to get a store name.

Signed-off-by: Petr Lautrbach <***@redhat.com>
---
python/semanage/semanage | 40 +++++++++++------------------
python/semanage/seobject.py | 62 +++++++++++++++++++++++----------------------
2 files changed, 47 insertions(+), 55 deletions(-)

diff --git a/python/semanage/semanage b/python/semanage/semanage
index 8acfc855..bcac20b2 100644
--- a/python/semanage/semanage
+++ b/python/semanage/semanage
@@ -89,16 +89,6 @@ class CheckRole(argparse.Action):
newval.append(v)
setattr(namespace, self.dest, newval)

-store = ''
-
-
-class SetStore(argparse.Action):
-
- def __call__(self, parser, namespace, values, option_string=None):
- global store
- store = values
- setattr(namespace, self.dest, values)
-

class seParser(argparse.ArgumentParser):

@@ -192,7 +182,7 @@ def handleLogin(args):

handle_opts(args, login_args, args.action)

- OBJECT = object_dict['login']()
+ OBJECT = object_dict['login'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -211,7 +201,7 @@ def handleLogin(args):


def parser_add_store(parser, name):
- parser.add_argument('-S', '--store', action=SetStore, help=_("Select an alternate SELinux Policy Store to manage"))
+ parser.add_argument('-S', '--store', default='', help=_("Select an alternate SELinux Policy Store to manage"))


def parser_add_priority(parser, name):
@@ -326,7 +316,7 @@ def handleFcontext(args):
else:
handle_opts(args, fcontext_args, args.action)

- OBJECT = object_dict['fcontext']()
+ OBJECT = object_dict['fcontext'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -395,7 +385,7 @@ def handleUser(args):

handle_opts(args, user_args, args.action)

- OBJECT = object_dict['user']()
+ OBJECT = object_dict['user'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -446,7 +436,7 @@ def handlePort(args):

handle_opts(args, port_args, args.action)

- OBJECT = object_dict['port']()
+ OBJECT = object_dict['port'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -492,7 +482,7 @@ def handlePkey(args):

handle_opts(args, ibpkey_args, args.action)

- OBJECT = object_dict['ibpkey']()
+ OBJECT = object_dict['ibpkey'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -536,7 +526,7 @@ def handleIbendport(args):

handle_opts(args, ibendport_args, args.action)

- OBJECT = object_dict['ibendport']()
+ OBJECT = object_dict['ibendport'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -580,7 +570,7 @@ def handleInterface(args):

handle_opts(args, interface_args, args.action)

- OBJECT = object_dict['interface']()
+ OBJECT = object_dict['interface'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -620,7 +610,7 @@ def setupInterfaceParser(subparsers):


def handleModule(args):
- OBJECT = seobject.moduleRecords(store)
+ OBJECT = seobject.moduleRecords(args)
OBJECT.set_reload(args.noreload)
if args.action == "add":
OBJECT.add(args.module_name, args.priority)
@@ -663,7 +653,7 @@ def handleNode(args):
node_args = {'list': [('node', 'type', 'proto', 'netmask'), ('')], 'add': [('locallist'), ('type', 'node', 'proto', 'netmask')], 'modify': [('locallist'), ('node', 'netmask', 'proto')], 'delete': [('locallist'), ('node', 'netmask', 'prototype')], 'extract': [('locallist', 'node', 'type', 'proto', 'netmask'), ('')], 'deleteall': [('locallist'), ('')]}
handle_opts(args, node_args, args.action)

- OBJECT = object_dict['node']()
+ OBJECT = object_dict['node'](args)
OBJECT.set_reload(args.noreload)

if args.action is "add":
@@ -710,7 +700,7 @@ def handleBoolean(args):

handle_opts(args, boolean_args, args.action)

- OBJECT = object_dict['boolean']()
+ OBJECT = object_dict['boolean'](args)
OBJECT.set_reload(args.noreload)

if args.action is "modify":
@@ -749,7 +739,7 @@ def setupBooleanParser(subparsers):


def handlePermissive(args):
- OBJECT = object_dict['permissive']()
+ OBJECT = object_dict['permissive'](args)
OBJECT.set_reload(args.noreload)

if args.action is "list":
@@ -784,7 +774,7 @@ def setupPermissiveParser(subparsers):


def handleDontaudit(args):
- OBJECT = object_dict['dontaudit']()
+ OBJECT = object_dict['dontaudit'](args)
OBJECT.set_reload(args.noreload)
OBJECT.toggle(args.action)

@@ -802,7 +792,7 @@ def handleExport(args):
for i in manageditems:
print("%s -D" % i)
for i in manageditems:
- OBJECT = object_dict[i]()
+ OBJECT = object_dict[i](args)
for c in OBJECT.customized():
print("%s %s" % (i, str(c)))

@@ -866,7 +856,7 @@ def mkargv(line):


def handleImport(args):
- trans = seobject.semanageRecords(store)
+ trans = seobject.semanageRecords(args)
trans.start()

for l in sys.stdin.readlines():
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
index 1385315f..00246fdd 100644
--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
@@ -238,14 +238,16 @@ class semanageRecords:
transaction = False
handle = None
store = None
+ args = None

- def __init__(self, store):
+ def __init__(self, args):
global handle
self.load = True
- self.sh = self.get_handle(store)
+ self.args = args
+ self.sh = self.get_handle(args.store)

rc, localstore = selinux.selinux_getpolicytype()
- if store == "" or store == localstore:
+ if args.store == "" or args.store == localstore:
self.mylog = logger()
else:
self.mylog = nulllogger()
@@ -328,8 +330,8 @@ class semanageRecords:

class moduleRecords(semanageRecords):

- def __init__(self, store):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def get_all(self):
l = []
@@ -440,8 +442,8 @@ class moduleRecords(semanageRecords):

class dontauditClass(semanageRecords):

- def __init__(self, store):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def toggle(self, dontaudit):
if dontaudit not in ["on", "off"]:
@@ -453,8 +455,8 @@ class dontauditClass(semanageRecords):

class permissiveRecords(semanageRecords):

- def __init__(self, store):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def get_all(self):
l = []
@@ -522,8 +524,8 @@ class permissiveRecords(semanageRecords):

class loginRecords(semanageRecords):

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)
self.oldsename = None
self.oldserange = None
self.sename = None
@@ -534,7 +536,7 @@ class loginRecords(semanageRecords):
if sename == "":
sename = "user_u"

- userrec = seluserRecords()
+ userrec = seluserRecords(self.args)
range, (rc, oldserole) = userrec.get(self.oldsename)
range, (rc, serole) = userrec.get(sename)

@@ -603,7 +605,7 @@ class loginRecords(semanageRecords):
if sename == "" and serange == "":
raise ValueError(_("Requires seuser or serange"))

- userrec = seluserRecords()
+ userrec = seluserRecords(self.args)
range, (rc, oldserole) = userrec.get(self.oldsename)

if sename != "":
@@ -660,7 +662,7 @@ class loginRecords(semanageRecords):

def __delete(self, name):
rec, self.oldsename, self.oldserange = selinux.getseuserbyname(name)
- userrec = seluserRecords()
+ userrec = seluserRecords(self.args)
range, (rc, oldserole) = userrec.get(self.oldsename)

(rc, k) = semanage_seuser_key_create(self.sh, name)
@@ -779,8 +781,8 @@ class loginRecords(semanageRecords):

class seluserRecords(semanageRecords):

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def get(self, name):
(rc, k) = semanage_user_key_create(self.sh, name)
@@ -1042,8 +1044,8 @@ class portRecords(semanageRecords):
except RuntimeError:
valid_types = []

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def __genkey(self, port, proto):
if proto == "tcp":
@@ -1317,8 +1319,8 @@ class ibpkeyRecords(semanageRecords):
except:
valid_types = []

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def __genkey(self, pkey, subnet_prefix):
if subnet_prefix == "":
@@ -1572,8 +1574,8 @@ class ibendportRecords(semanageRecords):
except:
valid_types = []

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def __genkey(self, ibendport, ibdev_name):
if ibdev_name == "":
@@ -1810,8 +1812,8 @@ class nodeRecords(semanageRecords):
except RuntimeError:
valid_types = []

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)
self.protocol = ["ipv4", "ipv6"]

def validate(self, addr, mask, protocol):
@@ -2046,8 +2048,8 @@ class nodeRecords(semanageRecords):

class interfaceRecords(semanageRecords):

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)

def __add(self, interface, serange, ctype):
if is_mls_enabled == 1:
@@ -2243,8 +2245,8 @@ class fcontextRecords(semanageRecords):
except RuntimeError:
valid_types = []

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)
self.equiv = {}
self.equiv_dist = {}
self.equal_ind = False
@@ -2632,8 +2634,8 @@ class fcontextRecords(semanageRecords):

class booleanRecords(semanageRecords):

- def __init__(self, store=""):
- semanageRecords.__init__(self, store)
+ def __init__(self, args):
+ semanageRecords.__init__(self, args)
self.dict = {}
self.dict["TRUE"] = 1
self.dict["FALSE"] = 0
--
2.14.3
Jason Zaman
2017-11-08 06:59:33 UTC
Permalink
First two patches do a little cleanup and try to re factorize the code
used for seobject object initialization.
The 3rd patch changes the behavior in order to call
semanage_set_reload() only if -N is used.
all looks good to me,
merged :)

Loading...