Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:lafenghu
libsemanage
libsemanage-rhat.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libsemanage-rhat.patch of Package libsemanage
diff --exclude-from=exclude -N -u -r nsalibsemanage/include/semanage/modules.h libsemanage-2.0.43/include/semanage/modules.h --- nsalibsemanage/include/semanage/modules.h 2009-01-13 08:45:35.000000000 -0500 +++ libsemanage-2.0.43/include/semanage/modules.h 2009-12-16 16:07:43.000000000 -0500 @@ -40,10 +40,12 @@ char *module_data, size_t data_len); int semanage_module_install_base_file(semanage_handle_t *, const char *module_name); +int semanage_module_enable(semanage_handle_t *, char *module_name); +int semanage_module_disable(semanage_handle_t *, char *module_name); int semanage_module_remove(semanage_handle_t *, char *module_name); /* semanage_module_info is for getting information on installed - modules, only name and version at this time */ + modules, only name and version, and enabled/disabled flag at this time */ typedef struct semanage_module_info semanage_module_info_t; int semanage_module_list(semanage_handle_t *, @@ -53,5 +55,6 @@ int n); const char *semanage_module_get_name(semanage_module_info_t *); const char *semanage_module_get_version(semanage_module_info_t *); +int semanage_module_get_enabled(semanage_module_info_t *); #endif diff --exclude-from=exclude -N -u -r nsalibsemanage/src/direct_api.c libsemanage-2.0.43/src/direct_api.c --- nsalibsemanage/src/direct_api.c 2009-09-17 08:59:43.000000000 -0400 +++ libsemanage-2.0.43/src/direct_api.c 2009-12-16 16:07:43.000000000 -0500 @@ -66,6 +66,8 @@ static int semanage_direct_install_base(semanage_handle_t * sh, char *base_data, size_t data_len); static int semanage_direct_install_base_file(semanage_handle_t * sh, const char *module_name); +static int semanage_direct_enable(semanage_handle_t * sh, char *module_name); +static int semanage_direct_disable(semanage_handle_t * sh, char *module_name); static int semanage_direct_remove(semanage_handle_t * sh, char *module_name); static int semanage_direct_list(semanage_handle_t * sh, semanage_module_info_t ** modinfo, @@ -83,6 +85,8 @@ .upgrade_file = semanage_direct_upgrade_file, .install_base = semanage_direct_install_base, .install_base_file = semanage_direct_install_base_file, + .enable = semanage_direct_enable, + .disable = semanage_direct_disable, .remove = semanage_direct_remove, .list = semanage_direct_list }; @@ -348,10 +352,17 @@ semanage_path(SEMANAGE_TMP, SEMANAGE_MODULES)) == NULL) { return -1; } - if (asprintf(filename, "%s/%s.pp", module_path, *module_name) == -1) { + if (asprintf(filename, "%s/%s.pp%s", module_path, *module_name, DISABLESTR) == -1) { ERR(sh, "Out of memory!"); return -1; } + + if (access(*filename, F_OK) == -1) { + char *ptr = *filename; + int len = strlen(ptr) - strlen(DISABLESTR); + if (len > 0) ptr[len]='\0'; + } + return 0; } @@ -1273,6 +1284,107 @@ return retval; } +/* Enables a module from the sandbox. Returns 0 on success, -1 if out + * of memory, -2 if module not found or could not be enabled. */ +static int semanage_direct_enable(semanage_handle_t * sh, char *module_name) +{ + int i, retval = -1; + char **module_filenames = NULL; + int num_mod_files; + size_t name_len = strlen(module_name); + if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) == + -1) { + return -1; + } + for (i = 0; i < num_mod_files; i++) { + char *base = strrchr(module_filenames[i], '/'); + if (base == NULL) { + ERR(sh, "Could not read module names."); + retval = -2; + goto cleanup; + } + base++; + if (memcmp(module_name, base, name_len) == 0 && + strcmp(base + name_len + 3, DISABLESTR) == 0) { + int len = strlen(module_filenames[i]) - strlen(DISABLESTR); + char *enabled_name = calloc(1, len+1); + if (!enabled_name) { + ERR(sh, "Could not allocate memory"); + retval = -1; + goto cleanup; + } + + strncpy(enabled_name, module_filenames[i],len); + + if (rename(module_filenames[i], enabled_name) == -1) { + ERR(sh, "Could not enable module file %s.", + enabled_name); + retval = -2; + } + retval = 0; + free(enabled_name); + goto cleanup; + } + } + ERR(sh, "Module %s was not found.", module_name); + retval = -2; /* module not found */ + cleanup: + for (i = 0; module_filenames != NULL && i < num_mod_files; i++) { + free(module_filenames[i]); + } + free(module_filenames); + return retval; +} + +/* Enables a module from the sandbox. Returns 0 on success, -1 if out + * of memory, -2 if module not found or could not be enabled. */ +static int semanage_direct_disable(semanage_handle_t * sh, char *module_name) +{ + int i, retval = -1; + char **module_filenames = NULL; + int num_mod_files; + size_t name_len = strlen(module_name); + if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) == + -1) { + return -1; + } + for (i = 0; i < num_mod_files; i++) { + char *base = strrchr(module_filenames[i], '/'); + if (base == NULL) { + ERR(sh, "Could not read module names."); + retval = -2; + goto cleanup; + } + base++; + if (memcmp(module_name, base, name_len) == 0 && + strcmp(base + name_len, ".pp") == 0) { + char disabled_name[PATH_MAX]; + if (snprintf(disabled_name, PATH_MAX, "%s%s", + module_filenames[i], DISABLESTR) == PATH_MAX) { + ERR(sh, "Could not disable module file %s.", + module_filenames[i]); + retval = -2; + goto cleanup; + } + if (rename(module_filenames[i], disabled_name) == -1) { + ERR(sh, "Could not disable module file %s.", + module_filenames[i]); + retval = -2; + } + retval = 0; + goto cleanup; + } + } + ERR(sh, "Module %s was not found.", module_name); + retval = -2; /* module not found */ + cleanup: + for (i = 0; module_filenames != NULL && i < num_mod_files; i++) { + free(module_filenames[i]); + } + free(module_filenames); + return retval; +} + /* Removes a module from the sandbox. Returns 0 on success, -1 if out * of memory, -2 if module not found or could not be removed. */ static int semanage_direct_remove(semanage_handle_t * sh, char *module_name) @@ -1293,8 +1405,7 @@ goto cleanup; } base++; - if (memcmp(module_name, base, name_len) == 0 && - strcmp(base + name_len, ".pp") == 0) { + if (memcmp(module_name, base, name_len) == 0) { if (unlink(module_filenames[i]) == -1) { ERR(sh, "Could not remove module file %s.", module_filenames[i]); @@ -1369,6 +1480,7 @@ } ssize_t size; char *data = NULL; + int enabled = semanage_module_enabled(module_filenames[i]); if ((size = bunzip(sh, fp, &data)) > 0) { fclose(fp); @@ -1393,6 +1505,7 @@ if (type == SEPOL_POLICY_MOD) { (*modinfo)[*num_modules].name = name; (*modinfo)[*num_modules].version = version; + (*modinfo)[*num_modules].enabled = enabled; (*num_modules)++; } else { /* file was not a module, so don't report it */ diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.43/src/genhomedircon.c --- nsalibsemanage/src/genhomedircon.c 2009-09-17 08:59:43.000000000 -0400 +++ libsemanage-2.0.43/src/genhomedircon.c 2009-12-16 16:07:43.000000000 -0500 @@ -310,6 +310,10 @@ } if (strcmp(pwbuf->pw_dir, "/") == 0) continue; + if (strcmp(pwbuf->pw_dir, "/root") == 0) { + continue; + } + if (semanage_str_count(pwbuf->pw_dir, '/') <= 1) continue; if (!(path = strdup(pwbuf->pw_dir))) { @@ -803,6 +807,9 @@ * /root */ continue; } + if (strcmp(pwent->pw_dir, "/root") == 0) { + continue; + } if (push_user_entry(&head, name, seuname, prefix, pwent->pw_dir) != STATUS_SUCCESS) { *errors = STATUS_ERR; diff --exclude-from=exclude -N -u -r nsalibsemanage/src/libsemanage.map libsemanage-2.0.43/src/libsemanage.map --- nsalibsemanage/src/libsemanage.map 2009-10-29 15:21:39.000000000 -0400 +++ libsemanage-2.0.43/src/libsemanage.map 2009-12-16 16:07:43.000000000 -0500 @@ -6,10 +6,13 @@ semanage_module_install; semanage_module_install_file; semanage_module_upgrade; semanage_module_upgrade_file; semanage_module_install_base; semanage_module_install_base_file; + semanage_module_enable; + semanage_module_disable; semanage_module_remove; semanage_module_list; semanage_module_info_datum_destroy; semanage_module_list_nth; semanage_module_get_name; semanage_module_get_version; semanage_select_store; + semanage_module_get_enabled; semanage_reload_policy; semanage_set_reload; semanage_set_rebuild; semanage_user_*; semanage_bool_*; semanage_seuser_*; semanage_iface_*; semanage_port_*; semanage_context_*; diff --exclude-from=exclude -N -u -r nsalibsemanage/src/Makefile libsemanage-2.0.43/src/Makefile --- nsalibsemanage/src/Makefile 2009-12-01 15:46:50.000000000 -0500 +++ libsemanage-2.0.43/src/Makefile 2009-12-16 16:07:47.000000000 -0500 @@ -47,7 +47,7 @@ LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo CFLAGS ?= -Wall -W -Wundef -Wshadow -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter -override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE +override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE -fPIC SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ diff --exclude-from=exclude -N -u -r nsalibsemanage/src/module_internal.h libsemanage-2.0.43/src/module_internal.h --- nsalibsemanage/src/module_internal.h 2008-08-28 09:34:24.000000000 -0400 +++ libsemanage-2.0.43/src/module_internal.h 2009-12-16 16:07:43.000000000 -0500 @@ -6,6 +6,7 @@ hidden_proto(semanage_module_get_name) hidden_proto(semanage_module_get_version) + hidden_proto(semanage_module_get_enabled) hidden_proto(semanage_module_info_datum_destroy) hidden_proto(semanage_module_list_nth) #endif diff --exclude-from=exclude -N -u -r nsalibsemanage/src/modules.c libsemanage-2.0.43/src/modules.c --- nsalibsemanage/src/modules.c 2009-09-17 08:59:43.000000000 -0400 +++ libsemanage-2.0.43/src/modules.c 2009-12-16 16:07:43.000000000 -0500 @@ -154,6 +154,40 @@ return sh->funcs->install_base_file(sh, module_name); } +int semanage_module_enable(semanage_handle_t * sh, char *module_name) +{ + if (sh->funcs->enable == NULL) { + ERR(sh, "No enable function defined for this connection type."); + return -1; + } else if (!sh->is_connected) { + ERR(sh, "Not connected."); + return -1; + } else if (!sh->is_in_transaction) { + if (semanage_begin_transaction(sh) < 0) { + return -1; + } + } + sh->modules_modified = 1; + return sh->funcs->enable(sh, module_name); +} + +int semanage_module_disable(semanage_handle_t * sh, char *module_name) +{ + if (sh->funcs->disable == NULL) { + ERR(sh, "No disable function defined for this connection type."); + return -1; + } else if (!sh->is_connected) { + ERR(sh, "Not connected."); + return -1; + } else if (!sh->is_in_transaction) { + if (semanage_begin_transaction(sh) < 0) { + return -1; + } + } + sh->modules_modified = 1; + return sh->funcs->disable(sh, module_name); +} + int semanage_module_remove(semanage_handle_t * sh, char *module_name) { if (sh->funcs->remove == NULL) { @@ -209,6 +243,13 @@ hidden_def(semanage_module_get_name) +int semanage_module_get_enabled(semanage_module_info_t * modinfo) +{ + return modinfo->enabled; +} + +hidden_def(semanage_module_get_enabled) + const char *semanage_module_get_version(semanage_module_info_t * modinfo) { return modinfo->version; diff --exclude-from=exclude -N -u -r nsalibsemanage/src/modules.h libsemanage-2.0.43/src/modules.h --- nsalibsemanage/src/modules.h 2008-08-28 09:34:24.000000000 -0400 +++ libsemanage-2.0.43/src/modules.h 2009-12-16 16:07:43.000000000 -0500 @@ -26,6 +26,7 @@ struct semanage_module_info { char *name; /* Key */ char *version; + int enabled; }; #endif diff --exclude-from=exclude -N -u -r nsalibsemanage/src/policy.h libsemanage-2.0.43/src/policy.h --- nsalibsemanage/src/policy.h 2009-01-13 08:45:35.000000000 -0500 +++ libsemanage-2.0.43/src/policy.h 2009-12-16 16:07:43.000000000 -0500 @@ -58,6 +58,12 @@ /* Upgrade a policy module */ int (*upgrade_file) (struct semanage_handle *, const char *); + /* Enable a policy module */ + int (*enable) (struct semanage_handle *, char *); + + /* Disable a policy module */ + int (*disable) (struct semanage_handle *, char *); + /* Remove a policy module */ int (*remove) (struct semanage_handle *, char *); diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.43/src/semanage.conf --- nsalibsemanage/src/semanage.conf 2008-08-28 09:34:24.000000000 -0400 +++ libsemanage-2.0.43/src/semanage.conf 2009-12-16 16:07:43.000000000 -0500 @@ -35,4 +35,4 @@ # given in <sepol/policydb.h>. Change this setting if a different # version is necessary. #policy-version = 19 - +expand-check=0 diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.c libsemanage-2.0.43/src/semanage_store.c --- nsalibsemanage/src/semanage_store.c 2009-10-29 15:21:39.000000000 -0400 +++ libsemanage-2.0.43/src/semanage_store.c 2009-12-16 16:07:43.000000000 -0500 @@ -57,6 +57,8 @@ #include "debug.h" +const char *DISABLESTR=".disabled"; + #define SEMANAGE_CONF_FILE "semanage.conf" /* relative path names to enum semanage_paths to special files and * directories for the module store */ @@ -433,6 +435,21 @@ return 1; } +int semanage_module_enabled(const char *file) { + int len = strlen(file) - strlen(DISABLESTR); + return (len < 0 || strcmp(&file[len], DISABLESTR) != 0); +} + +static int semanage_modulename_select(const struct dirent *d) +{ + if (d->d_name[0] == '.' + && (d->d_name[1] == '\0' + || (d->d_name[1] == '.' && d->d_name[2] == '\0'))) + return 0; + + return semanage_module_enabled(d->d_name); +} + /* Copies a file from src to dst. If dst already exists then * overwrite it. Returns 0 on success, -1 on error. */ static int semanage_copy_file(const char *src, const char *dst, mode_t mode) @@ -599,15 +616,8 @@ return -1; } -/* Scans the modules directory for the current semanage handler. This - * might be the active directory or sandbox, depending upon if the - * handler has a transaction lock. Allocates and fills in *filenames - * with an array of module filenames; length of array is stored in - * *len. The caller is responsible for free()ing *filenames and its - * individual elements. Upon success returns 0, -1 on error. - */ -int semanage_get_modules_names(semanage_handle_t * sh, char ***filenames, - int *len) +static int semanage_get_modules_names_filter(semanage_handle_t * sh, char ***filenames, + int *len, int (*filter)(const struct dirent *)) { const char *modules_path; struct dirent **namelist = NULL; @@ -622,7 +632,7 @@ *filenames = NULL; *len = 0; if ((num_files = scandir(modules_path, &namelist, - semanage_filename_select, alphasort)) == -1) { + filter, alphasort)) == -1) { ERR(sh, "Error while scanning directory %s.", modules_path); goto cleanup; } @@ -663,6 +673,34 @@ return retval; } +/* Scans the modules directory for the current semanage handler. This + * might be the active directory or sandbox, depending upon if the + * handler has a transaction lock. Allocates and fills in *filenames + * with an array of module filenames; length of array is stored in + * *len. The caller is responsible for free()ing *filenames and its + * individual elements. Upon success returns 0, -1 on error. + */ +int semanage_get_modules_names(semanage_handle_t * sh, char ***filenames, + int *len) +{ + return semanage_get_modules_names_filter(sh, filenames, + len, semanage_filename_select); +} + +/* Scans the modules directory for the current semanage handler. This + * might be the active directory or sandbox, depending upon if the + * handler has a transaction lock. Allocates and fills in *filenames + * with an array of module filenames; length of array is stored in + * *len. The caller is responsible for free()ing *filenames and its + * individual elements. Upon success returns 0, -1 on error. + */ +int semanage_get_active_modules_names(semanage_handle_t * sh, char ***filenames, + int *len) +{ + return semanage_get_modules_names_filter(sh, filenames, + len, semanage_modulename_select); +} + /******************* routines that run external programs *******************/ /* Appends a single character to a string. Returns a pointer to the @@ -1589,7 +1627,7 @@ } /* get list of modules and load them */ - if (semanage_get_modules_names(sh, &module_filenames, &num_modules) == + if (semanage_get_active_modules_names(sh, &module_filenames, &num_modules) == -1 || semanage_load_module(sh, base_filename, base) == -1) { goto cleanup; } diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.h libsemanage-2.0.43/src/semanage_store.h --- nsalibsemanage/src/semanage_store.h 2009-07-07 15:32:32.000000000 -0400 +++ libsemanage-2.0.43/src/semanage_store.h 2009-12-16 16:07:43.000000000 -0500 @@ -128,4 +128,6 @@ size_t buf_len, char **sorted_buf, size_t * sorted_buf_len); +extern const char *DISABLESTR; + #endif
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
