|
 |
709a1f |
From 0803fcb2c014b2cedf8f4d92b80fc382916477ee Mon Sep 17 00:00:00 2001
|
|
|
709a1f |
From: Vit Mojzis <vmojzis@redhat.com>
|
|
|
709a1f |
Date: Fri, 27 Sep 2019 16:13:47 +0200
|
|
|
709a1f |
Subject: [PATCH] python/semanage: Improve handling of "permissive" statements
|
|
|
709a1f |
|
|
|
709a1f |
- Add "customized" method to permissiveRecords which is than used for
|
|
|
709a1f |
"semanage permissive --extract" and "semanage export"
|
|
|
709a1f |
- Enable "semanage permissive --deleteall" (already implemented)
|
|
|
709a1f |
- Add "permissive" to the list of modules exported using
|
|
|
709a1f |
"semanage export"
|
|
|
709a1f |
- Update "semanage permissive" man page
|
|
|
709a1f |
|
|
|
709a1f |
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
|
|
709a1f |
---
|
|
|
709a1f |
python/semanage/semanage | 11 ++++++++---
|
|
|
709a1f |
python/semanage/semanage-permissive.8 | 8 +++++++-
|
|
|
709a1f |
python/semanage/seobject.py | 3 +++
|
|
|
709a1f |
3 files changed, 18 insertions(+), 4 deletions(-)
|
|
|
709a1f |
|
|
|
709a1f |
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
|
|
709a1f |
index fa78afce..b2bd9df9 100644
|
|
|
709a1f |
--- a/python/semanage/semanage
|
|
|
709a1f |
+++ b/python/semanage/semanage
|
|
|
709a1f |
@@ -722,6 +722,11 @@ def handlePermissive(args):
|
|
|
709a1f |
|
|
|
709a1f |
if args.action == "list":
|
|
|
709a1f |
OBJECT.list(args.noheading)
|
|
|
709a1f |
+ elif args.action == "deleteall":
|
|
|
709a1f |
+ OBJECT.deleteall()
|
|
|
709a1f |
+ elif args.action == "extract":
|
|
|
709a1f |
+ for i in OBJECT.customized():
|
|
|
709a1f |
+ print("permissive %s" % str(i))
|
|
|
709a1f |
elif args.type is not None:
|
|
|
709a1f |
if args.action == "add":
|
|
|
709a1f |
OBJECT.add(args.type)
|
|
|
709a1f |
@@ -737,9 +742,9 @@ def setupPermissiveParser(subparsers):
|
|
|
709a1f |
pgroup = permissiveParser.add_mutually_exclusive_group(required=True)
|
|
|
709a1f |
parser_add_add(pgroup, "permissive")
|
|
|
709a1f |
parser_add_delete(pgroup, "permissive")
|
|
|
709a1f |
+ parser_add_deleteall(pgroup, "permissive")
|
|
|
709a1f |
+ parser_add_extract(pgroup, "permissive")
|
|
|
709a1f |
parser_add_list(pgroup, "permissive")
|
|
|
709a1f |
- #TODO: probably should be also added => need to implement own option handling
|
|
|
709a1f |
- #parser_add_deleteall(pgroup)
|
|
|
709a1f |
|
|
|
709a1f |
parser_add_noheading(permissiveParser, "permissive")
|
|
|
709a1f |
parser_add_noreload(permissiveParser, "permissive")
|
|
|
709a1f |
@@ -763,7 +768,7 @@ def setupDontauditParser(subparsers):
|
|
|
709a1f |
|
|
|
709a1f |
|
|
|
709a1f |
def handleExport(args):
|
|
|
709a1f |
- manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey"]
|
|
|
709a1f |
+ manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey", "permissive"]
|
|
|
709a1f |
for i in manageditems:
|
|
|
709a1f |
print("%s -D" % i)
|
|
|
709a1f |
for i in manageditems:
|
|
|
709a1f |
diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
|
|
|
709a1f |
index 1999a451..5c3364fa 100644
|
|
|
709a1f |
--- a/python/semanage/semanage-permissive.8
|
|
|
709a1f |
+++ b/python/semanage/semanage-permissive.8
|
|
|
709a1f |
@@ -2,7 +2,7 @@
|
|
|
709a1f |
.SH "NAME"
|
|
|
709a1f |
.B semanage\-permissive \- SELinux Policy Management permissive mapping tool
|
|
|
709a1f |
.SH "SYNOPSIS"
|
|
|
709a1f |
-.B semanage permissive [\-h] (\-a | \-d | \-l) [\-n] [\-N] [\-S STORE] [type]
|
|
|
709a1f |
+.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
|
|
|
709a1f |
|
|
|
709a1f |
.SH "DESCRIPTION"
|
|
|
709a1f |
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module.
|
|
|
709a1f |
@@ -18,9 +18,15 @@ Add a record of the specified object type
|
|
|
709a1f |
.I \-d, \-\-delete
|
|
|
709a1f |
Delete a record of the specified object type
|
|
|
709a1f |
.TP
|
|
|
709a1f |
+.I \-D, \-\-deleteall
|
|
|
709a1f |
+Remove all local customizations of permissive domains
|
|
|
709a1f |
+.TP
|
|
|
709a1f |
.I \-l, \-\-list
|
|
|
709a1f |
List records of the specified object type
|
|
|
709a1f |
.TP
|
|
|
709a1f |
+.I \-E, \-\-extract
|
|
|
709a1f |
+Extract customizable commands, for use within a transaction
|
|
|
709a1f |
+.TP
|
|
|
709a1f |
.I \-n, \-\-noheading
|
|
|
709a1f |
Do not print heading when listing the specified object type
|
|
|
709a1f |
.TP
|
|
|
709a1f |
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
|
|
709a1f |
index 58497e3b..3959abc8 100644
|
|
|
709a1f |
--- a/python/semanage/seobject.py
|
|
|
709a1f |
+++ b/python/semanage/seobject.py
|
|
|
709a1f |
@@ -478,6 +478,9 @@ class permissiveRecords(semanageRecords):
|
|
|
709a1f |
l.append(name.split("permissive_")[1])
|
|
|
709a1f |
return l
|
|
|
709a1f |
|
|
|
709a1f |
+ def customized(self):
|
|
|
709a1f |
+ return ["-a %s" % x for x in sorted(self.get_all())]
|
|
|
709a1f |
+
|
|
|
709a1f |
def list(self, heading=1, locallist=0):
|
|
|
709a1f |
all = [y["name"] for y in [x for x in sepolicy.info(sepolicy.TYPE) if x["permissive"]]]
|
|
|
709a1f |
if len(all) == 0:
|
|
|
709a1f |
--
|
|
|
709a1f |
2.21.0
|
|
|
709a1f |
|