1:57 p.m.
I've given a few talks on SELinux over the past year and I've spoken to
a bunch of people on google+ about SELinux and one topic keeps coming
up. Many people find semanage to be large and convoluted with the help
text being way to large to sort through. The latter part of the
complaint is easy to address. The code for argument parsing in semanage
(last time I checked) doesn't use things like argparse. If we switched
it over to argparse we could get per sub-command help messages that
would be more useful to people when they messed up a sub-command. Would
anyone be opposed if I spent the time to migrate semanage argument
parsing and help messages over to argparse or a similar library?
The second problem some people have is that semanage is a multiplexed
command. I'm not sure what the right way to approach this is. If we look
at other applications which are multiplexers we get a few examples.
Busybox is the first example and covers most of the discussion. The two
ways of invoking busybox is either busybox command_name arguments or
command_name arguments where command_name is a symlink to the busybox
binary. If we chose the latter way of handling it we would need to
decide on one of two ways of naming the sub-commands. The first method
would be to come up with a naming convention for the subcommands to
avoid collisions like selogin for semanage login or seusers for semanage
users etc. The second method would be to do what git use to do which is
prepend the tool name onto the subcommand. For example
semanage-fcontext, semanage-login, semanage-users etc... If we chose
this route then we'd need to investigate what git's reason for moving
away from it was and decide if it applies to our situation as well.
If we convert over to argparse for argument parsing it should be
trivial to do some processing on argv[0] to extract out a subcommand
from a name and use the correct routines. I'm not sure that solving the
second problem gets us substantial gains or if having help messages that
are specific to each subcommand will help users more.
Does anyone have any thoughts about this?
6:40 p.m.
On Wed, Dec 12, 2012 at 2:57 PM, David Quigley <selinux(a)davequigley.com> wrote:
I've given a few talks on SELinux over the past year and I've
spoken to a
bunch of people on google+ about SELinux and one topic keeps coming up. Many
people find semanage to be large and convoluted with the help text being way
to large to sort through. The latter part of the complaint is easy to
address. The code for argument parsing in semanage (last time I checked)
doesn't use things like argparse. If we switched it over to argparse we
could get per sub-command help messages that would be more useful to people
when they messed up a sub-command. Would anyone be opposed if I spent the
time to migrate semanage argument parsing and help messages over to argparse
or a similar library?
I'm not sure that's even possible. For example, my all-time favourite
"quirk" of semanage is:
semanage fcontext -d --ftype -d /some/dir
The first -d is the flag, while the second -d is actually a value
passed to --ftype. I'm not sure if argparse will do the right job
parsing this -- my brain certainly doesn't. :)
Best,
--
Konstantin Ryabitsev
LinuxFoundation.org
Montréal, Québec
9:03 p.m.
On 12/12/2012 7:40 PM, Konstantin Ryabitsev wrote:
On Wed, Dec 12, 2012 at 2:57 PM, David Quigley
<selinux(a)davequigley.com> wrote:
> I've given a few talks on SELinux over the past year and I've spoken to a
> bunch of people on google+ about SELinux and one topic keeps coming up. Many
> people find semanage to be large and convoluted with the help text being way
> to large to sort through. The latter part of the complaint is easy to
> address. The code for argument parsing in semanage (last time I checked)
> doesn't use things like argparse. If we switched it over to argparse we
> could get per sub-command help messages that would be more useful to people
> when they messed up a sub-command. Would anyone be opposed if I spent the
> time to migrate semanage argument parsing and help messages over to argparse
> or a similar library?
I'm not sure that's even possible. For example, my all-time favourite
"quirk" of semanage is:
semanage fcontext -d --ftype -d /some/dir
The first -d is the flag, while the second -d is actually a value
passed to --ftype. I'm not sure if argparse will do the right job
parsing this -- my brain certainly doesn't. :)
Best,
--
Konstantin Ryabitsev
LinuxFoundation.org
Montréal, Québec
I'm actually going to try to pull together just the parsers without any
backend functionality to see how feasible this is and how it looks. If
we like how it looks and its possible we can move forward with it. I
think that since --ftype is a longarg that argparse might be able to
handle it. If not then some manipulation of things might be in order
(like making an = between --ftype and the -d).
Dave
5:19 a.m.
On 12/13/2012 04:03 AM, Dave Quigley wrote:
On 12/12/2012 7:40 PM, Konstantin Ryabitsev wrote:
> On Wed, Dec 12, 2012 at 2:57 PM, David Quigley
> <selinux(a)davequigley.com> wrote:
>> I've given a few talks on SELinux over the past year and I've spoken
>> to a
>> bunch of people on google+ about SELinux and one topic keeps coming
>> up. Many
>> people find semanage to be large and convoluted with the help text
>> being way
>> to large to sort through. The latter part of the complaint is easy to
>> address. The code for argument parsing in semanage (last time I
>> checked)
>> doesn't use things like argparse. If we switched it over to argparse we
>> could get per sub-command help messages that would be more useful to
>> people
>> when they messed up a sub-command. Would anyone be opposed if I
>> spent the
>> time to migrate semanage argument parsing and help messages over to
>> argparse
>> or a similar library?
>
> I'm not sure that's even possible. For example, my all-time favourite
> "quirk" of semanage is:
>
> semanage fcontext -d --ftype -d /some/dir
>
> The first -d is the flag, while the second -d is actually a value
> passed to --ftype. I'm not sure if argparse will do the right job
> parsing this -- my brain certainly doesn't. :)
>
> Best,
> --
> Konstantin Ryabitsev
> LinuxFoundation.org
> Montréal, Québec
>
I'm actually going to try to pull together just the parsers without
any backend functionality to see how feasible this is and how it
looks. If we like how it looks and its possible we can move forward
with it. I think that since --ftype is a longarg that argparse might
be able to handle it. If not then some manipulation of things might be
in order (like making an = between --ftype and the -d).
Dave
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
Hi,
basically I have it on my TODO list to re-write "semanage" to use
argparse. But I did some work on it and it is not so easy. But we can
work together to make this working.
Regards,
Miroslav
9:30 a.m.
On 12/13/2012 6:19 AM, Miroslav Grepl wrote:
On 12/13/2012 04:03 AM, Dave Quigley wrote:
> On 12/12/2012 7:40 PM, Konstantin Ryabitsev wrote:
>> On Wed, Dec 12, 2012 at 2:57 PM, David Quigley
>> <selinux(a)davequigley.com> wrote:
>>> I've given a few talks on SELinux over the past year and I've spoken
>>> to a
>>> bunch of people on google+ about SELinux and one topic keeps coming
>>> up. Many
>>> people find semanage to be large and convoluted with the help text
>>> being way
>>> to large to sort through. The latter part of the complaint is easy to
>>> address. The code for argument parsing in semanage (last time I
>>> checked)
>>> doesn't use things like argparse. If we switched it over to argparse we
>>> could get per sub-command help messages that would be more useful to
>>> people
>>> when they messed up a sub-command. Would anyone be opposed if I
>>> spent the
>>> time to migrate semanage argument parsing and help messages over to
>>> argparse
>>> or a similar library?
>>
>> I'm not sure that's even possible. For example, my all-time favourite
>> "quirk" of semanage is:
>>
>> semanage fcontext -d --ftype -d /some/dir
>>
>> The first -d is the flag, while the second -d is actually a value
>> passed to --ftype. I'm not sure if argparse will do the right job
>> parsing this -- my brain certainly doesn't. :)
>>
>> Best,
>> --
>> Konstantin Ryabitsev
>> LinuxFoundation.org
>> Montréal, Québec
>>
>
> I'm actually going to try to pull together just the parsers without
> any backend functionality to see how feasible this is and how it
> looks. If we like how it looks and its possible we can move forward
> with it. I think that since --ftype is a longarg that argparse might
> be able to handle it. If not then some manipulation of things might be
> in order (like making an = between --ftype and the -d).
>
> Dave
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
Hi,
basically I have it on my TODO list to re-write "semanage" to use
argparse. But I did some work on it and it is not so easy. But we can
work together to make this working.
Regards,
Miroslav
I started just the top level subcommand code last night which is the
trivial part. Tonight I'll try to implement individual subcommand
parsers for each of the commands. Hopefully once I start doing those
I'll be able to get an idea of where the problems are. There is a lot of
flexibility in what you can do with argparse but sometimes they decided
just not to extend certain functionality to subparsers. I think it will
probably require extensive use of groups and mutually_exclusive_groups
and all of the argument features to get it working but will make the
code cleaner and easy to extend. If you'd like I can work on the parsers
and giving you namespace objects and then you can take those and massage
the arguments into whats needed for you to pass into the seobject classes.
Dave
Dave
9:41 a.m.
On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley <selinux(a)davequigley.com> wrote:
I'm actually going to try to pull together just the parsers
without any
backend functionality to see how feasible this is and how it looks. If we
like how it looks and its possible we can move forward with it. I think that
since --ftype is a longarg that argparse might be able to handle it. If not
then some manipulation of things might be in order (like making an = between
--ftype and the -d).
Note that --ftype can be also written as -f. So, really, if you want
to be fully backwards-compatible, you'll need to correctly parse the
following:
semanage fcontext -d -f -d /some/dir
--
Konstantin Ryabitsev
LinuxFoundation.org
Montréal, Québec
1:13 p.m.
On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
<selinux(a)davequigley.com> wrote:
> I'm actually going to try to pull together just the parsers without
> any
> backend functionality to see how feasible this is and how it looks.
> If we
> like how it looks and its possible we can move forward with it. I
> think that
> since --ftype is a longarg that argparse might be able to handle it.
> If not
> then some manipulation of things might be in order (like making an =
> between
> --ftype and the -d).
Note that --ftype can be also written as -f. So, really, if you want
to be fully backwards-compatible, you'll need to correctly parse the
following:
semanage fcontext -d -f -d /some/dir
--
Konstantin Ryabitsev
LinuxFoundation.org
Montréal, Québec
Which brings up a good question. Is there a test suite we can use to
ensure that the new interface matches the old interface? A regression
suite for semanage would be very useful in this case. We could start
with everything failing and rebuild the interface one at a time untill
everything passes again.
5:30 p.m.
On 12/13/2012 14:13, David Quigley wrote:
On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
> <selinux(a)davequigley.com> wrote:
>> I'm actually going to try to pull together just the parsers without
>> any
>> backend functionality to see how feasible this is and how it looks.
>> If we
>> like how it looks and its possible we can move forward with it. I
>> think that
>> since --ftype is a longarg that argparse might be able to handle
>> it. If not
>> then some manipulation of things might be in order (like making an
>> = between
>> --ftype and the -d).
>
> Note that --ftype can be also written as -f. So, really, if you want
> to be fully backwards-compatible, you'll need to correctly parse the
> following:
>
> semanage fcontext -d -f -d /some/dir
>
> --
> Konstantin Ryabitsev
> LinuxFoundation.org
> Montréal, Québec
Which brings up a good question. Is there a test suite we can use to
ensure that the new interface matches the old interface? A regression
suite for semanage would be very useful in this case. We could start
with everything failing and rebuild the interface one at a time
untill
everything passes again.
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
I Haven't typed in all of the help info yet but the link is to a
pastbin with the usage information for the semanage login subcommand. I
just need to get it to react that way when there are 0 arguments passed
in as well. Right now it will print this when you type semanage login -h
or --help. I want it to print this on semanage login with no arguments
as well.
http://pastebin.com/KTtNk0rC
6:10 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/13/2012 06:30 PM, David Quigley wrote:
On 12/13/2012 14:13, David Quigley wrote:
> On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
>> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
>> <selinux(a)davequigley.com> wrote:
>>> I'm actually going to try to pull together just the parsers without
>>> any backend functionality to see how feasible this is and how it
>>> looks. If we like how it looks and its possible we can move forward
>>> with it. I think that since --ftype is a longarg that argparse might
>>> be able to handle it. If not then some manipulation of things might
>>> be in order (like making an = between --ftype and the -d).
>>
>> Note that --ftype can be also written as -f. So, really, if you want to
>> be fully backwards-compatible, you'll need to correctly parse the
>> following:
>>
>> semanage fcontext -d -f -d /some/dir
>>
>> -- Konstantin Ryabitsev LinuxFoundation.org Montréal, Québec
>
>
> Which brings up a good question. Is there a test suite we can use to
> ensure that the new interface matches the old interface? A regression
> suite for semanage would be very useful in this case. We could start with
> everything failing and rebuild the interface one at a time untill
> everything passes again. -- selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
I Haven't typed in all of the help info yet but the link is to a pastbin
with the usage information for the semanage login subcommand. I just need
to get it to react that way when there are 0 arguments passed in as well.
Right now it will print this when you type semanage login -h or --help. I
want it to print this on semanage login with no arguments as well.
http://pastebin.com/KTtNk0rC -- selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
I love it. This has been on my long list of cleanups for a while, but we
never seem to get to it. I looked at this a while ago, and at the time the
hardest problem I saw was the fact that semanage without arguments was
difficult to do.
Output local customizations
semanage [ -S store ] -o [ output_file | - ]
Input local customizations
semanage [ -S store ] -i [ input_file | - ]
argparser does not allow "optional arguments" like this.
A cleanup of the man page would also be great. The new sepolicy tool suite is
using argparse and separate man pages for each subcommand, and I really like it.
I think bash-completion eliminates the need for semanage-fcontext Since you
can do.
semanage <tab><tab>
boolean fcontext login node port
dontaudit interface module permissive user
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iEYEARECAAYFAlDLFz0ACgkQrlYvE4MpobPeuQCggV+uI4VQRgfxV6ahibLQAaV6
FwYAoLr/skXi3auZzRp6uvt64jReTgzV
=kd2u
-----END PGP SIGNATURE-----
10:48 a.m.
On 12/14/2012 07:10, Daniel J Walsh wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/13/2012 06:30 PM, David Quigley wrote:
> On 12/13/2012 14:13, David Quigley wrote:
>> On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
>>> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
>>> <selinux(a)davequigley.com> wrote:
>>>> I'm actually going to try to pull together just the parsers
>>>> without
>>>> any backend functionality to see how feasible this is and how it
>>>> looks. If we like how it looks and its possible we can move
>>>> forward
>>>> with it. I think that since --ftype is a longarg that argparse
>>>> might
>>>> be able to handle it. If not then some manipulation of things
>>>> might
>>>> be in order (like making an = between --ftype and the -d).
>>>
>>> Note that --ftype can be also written as -f. So, really, if you
>>> want to
>>> be fully backwards-compatible, you'll need to correctly parse the
>>> following:
>>>
>>> semanage fcontext -d -f -d /some/dir
>>>
>>> -- Konstantin Ryabitsev LinuxFoundation.org Montréal, Québec
>>
>>
>> Which brings up a good question. Is there a test suite we can use
>> to
>> ensure that the new interface matches the old interface? A
>> regression
>> suite for semanage would be very useful in this case. We could
>> start with
>> everything failing and rebuild the interface one at a time untill
>> everything passes again. -- selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
> I Haven't typed in all of the help info yet but the link is to a
> pastbin
> with the usage information for the semanage login subcommand. I just
> need
> to get it to react that way when there are 0 arguments passed in as
> well.
> Right now it will print this when you type semanage login -h or
> --help. I
> want it to print this on semanage login with no arguments as well.
>
> http://pastebin.com/KTtNk0rC -- selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
I love it. This has been on my long list of cleanups for a while,
but we
never seem to get to it. I looked at this a while ago, and at the
time the
hardest problem I saw was the fact that semanage without arguments
was
difficult to do.
Output local customizations
semanage [ -S store ] -o [ output_file | - ]
Input local customizations
semanage [ -S store ] -i [ input_file | - ]
argparser does not allow "optional arguments" like this.
I agree that I'm not sure how possible it is to do that. It might be a
good idea to change from semanage -i inputfile or semanage -o outputfile
into semanage backup and semanage restore. Semantically those words make
sense as a subcommand and makes it clear as to what it is actually
doing. Its also easy to implement them.
A cleanup of the man page would also be great. The new sepolicy tool
suite is
using argparse and separate man pages for each subcommand, and I
really like it.
Yea I agree that a manpage for semanage-port semanage-fcontext etc is
the way to go.
I think bash-completion eliminates the need for semanage-fcontext
Since you
can do.
semanage <tab><tab>
boolean fcontext login node port
dontaudit interface module permissive user
I agree. It wasn't clear to me if doing this had any real benefit. If
we didn't have bash completion it might have but now that we do I don't
see a need for it.
Dave
10:57 a.m.
On 12/14/2012 11:48, David Quigley wrote:
On 12/14/2012 07:10, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 12/13/2012 06:30 PM, David Quigley wrote:
>> On 12/13/2012 14:13, David Quigley wrote:
>>> On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
>>>> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
>>>> <selinux(a)davequigley.com> wrote:
>>>>> I'm actually going to try to pull together just the parsers
>>>>> without
>>>>> any backend functionality to see how feasible this is and how it
>>>>> looks. If we like how it looks and its possible we can move
>>>>> forward
>>>>> with it. I think that since --ftype is a longarg that argparse
>>>>> might
>>>>> be able to handle it. If not then some manipulation of things
>>>>> might
>>>>> be in order (like making an = between --ftype and the -d).
>>>>
>>>> Note that --ftype can be also written as -f. So, really, if you
>>>> want to
>>>> be fully backwards-compatible, you'll need to correctly parse the
>>>> following:
>>>>
>>>> semanage fcontext -d -f -d /some/dir
>>>>
>>>> -- Konstantin Ryabitsev LinuxFoundation.org Montréal, Québec
>>>
>>>
>>> Which brings up a good question. Is there a test suite we can use
>>> to
>>> ensure that the new interface matches the old interface? A
>>> regression
>>> suite for semanage would be very useful in this case. We could
>>> start with
>>> everything failing and rebuild the interface one at a time untill
>>> everything passes again. -- selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> I Haven't typed in all of the help info yet but the link is to a
>> pastbin
>> with the usage information for the semanage login subcommand. I
>> just need
>> to get it to react that way when there are 0 arguments passed in as
>> well.
>> Right now it will print this when you type semanage login -h or
>> --help. I
>> want it to print this on semanage login with no arguments as well.
>>
>> http://pastebin.com/KTtNk0rC -- selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> I love it. This has been on my long list of cleanups for a while,
> but we
> never seem to get to it. I looked at this a while ago, and at the
> time the
> hardest problem I saw was the fact that semanage without arguments
> was
> difficult to do.
>
> Output local customizations
> semanage [ -S store ] -o [ output_file | - ]
>
> Input local customizations
> semanage [ -S store ] -i [ input_file | - ]
>
> argparser does not allow "optional arguments" like this.
I agree that I'm not sure how possible it is to do that. It might be
a good idea to change from semanage -i inputfile or semanage -o
outputfile into semanage backup and semanage restore. Semantically
those words make sense as a subcommand and makes it clear as to what
it is actually doing. Its also easy to implement them.
Actually maybe import and export would be better.
2:21 p.m.
On 12/14/2012 05:48 PM, David Quigley wrote:
On 12/14/2012 07:10, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 12/13/2012 06:30 PM, David Quigley wrote:
>> On 12/13/2012 14:13, David Quigley wrote:
>>> On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
>>>> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
>>>> <selinux(a)davequigley.com> wrote:
>>>>> I'm actually going to try to pull together just the parsers
without
>>>>> any backend functionality to see how feasible this is and how it
>>>>> looks. If we like how it looks and its possible we can move forward
>>>>> with it. I think that since --ftype is a longarg that argparse might
>>>>> be able to handle it. If not then some manipulation of things might
>>>>> be in order (like making an = between --ftype and the -d).
>>>>
>>>> Note that --ftype can be also written as -f. So, really, if you
>>>> want to
>>>> be fully backwards-compatible, you'll need to correctly parse the
>>>> following:
>>>>
>>>> semanage fcontext -d -f -d /some/dir
>>>>
>>>> -- Konstantin Ryabitsev LinuxFoundation.org Montréal, Québec
>>>
>>>
>>> Which brings up a good question. Is there a test suite we can use to
>>> ensure that the new interface matches the old interface? A regression
>>> suite for semanage would be very useful in this case. We could
>>> start with
>>> everything failing and rebuild the interface one at a time untill
>>> everything passes again. -- selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>>
>> I Haven't typed in all of the help info yet but the link is to a
>> pastbin
>> with the usage information for the semanage login subcommand. I just
>> need
>> to get it to react that way when there are 0 arguments passed in as
>> well.
>> Right now it will print this when you type semanage login -h or
>> --help. I
>> want it to print this on semanage login with no arguments as well.
>>
>> http://pastebin.com/KTtNk0rC -- selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> I love it. This has been on my long list of cleanups for a while,
> but we
> never seem to get to it. I looked at this a while ago, and at the
> time the
> hardest problem I saw was the fact that semanage without arguments was
> difficult to do.
>
> Output local customizations
> semanage [ -S store ] -o [ output_file | - ]
>
> Input local customizations
> semanage [ -S store ] -i [ input_file | - ]
>
> argparser does not allow "optional arguments" like this.
I agree that I'm not sure how possible it is to do that. It might be a
good idea to change from semanage -i inputfile or semanage -o
outputfile into semanage backup and semanage restore. Semantically
those words make sense as a subcommand and makes it clear as to what
it is actually doing. Its also easy to implement them.
>
> A cleanup of the man page would also be great. The new sepolicy tool
> suite is
> using argparse and separate man pages for each subcommand, and I
> really like it.
Yea I agree that a manpage for semanage-port semanage-fcontext etc is
the way to go.
>
> I think bash-completion eliminates the need for semanage-fcontext
> Since you
> can do.
>
> semanage <tab><tab>
> boolean fcontext login node port
> dontaudit interface module permissive user
>
I agree. It wasn't clear to me if doing this had any real benefit. If
we didn't have bash completion it might have but now that we do I
don't see a need for it.
Dave
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
I agree with all.
Basically it can be done with some news in semanage
commands. Basically I wanted to keep the same format when I was doing
some work on this. A lot of "semanage" commands are used in install,
rpm, setup scripts.
2:23 p.m.
I just wanna say that you are pretty awesome, Daniel, to further the community in all the
ways you do.
Much thanks!
R,
-Joe
________________________________
From: Daniel J Walsh <dwalsh(a)redhat.com>
To: David Quigley <selinux(a)davequigley.com>
Cc: selinux(a)lists.fedoraproject.org
Sent: Friday, December 14, 2012 7:10 AM
Subject: Re: Cleaning up semanage
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/13/2012 06:30 PM, David Quigley wrote:
> On 12/13/2012 14:13, David Quigley wrote:
>> On 12/13/2012 10:41, Konstantin Ryabitsev wrote:
>>> On Wed, Dec 12, 2012 at 10:03 PM, Dave Quigley
>>> <selinux(a)davequigley.com> wrote:
>>>> I'm actually going to try to pull together just the parsers without
>>>> any backend functionality to see how feasible this is and how it
>>>> looks. If we like how it looks and its possible we can move forward
>>>> with it. I think that since --ftype is a longarg that argparse might
>>>> be able to handle it. If not then some manipulation of things might
>>>> be in order (like making an = between --ftype and the -d).
>>>
>>> Note that --ftype can be also written as -f. So, really, if you want to
>>> be fully backwards-compatible, you'll need to correctly parse the
>>> following:
>>>
>>> semanage fcontext -d -f -d /some/dir
>>>
>>> -- Konstantin Ryabitsev LinuxFoundation.org Montréal, Québec
>>
>>
>> Which brings up a good question. Is there a test suite we can use to
>> ensure that the new interface matches the old interface? A regression
>> suite for semanage would be very useful in this case. We could start with
>> everything failing and rebuild the interface one at a time untill
>> everything passes again. -- selinux mailing list
>> selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
> I Haven't typed in all of the help info yet but the link is to a pastbin
> with the usage information for the semanage login subcommand. I just need
> to get it to react that way when there are 0 arguments passed in as well.
> Right now it will print this when you type semanage login -h or --help. I
> want it to print this on semanage login with no arguments as well.
>
> http://pastebin.com/KTtNk0rC -- selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
I love it. This has been on my long list of cleanups for a while, but we
never seem to get to it. I looked at this a while ago, and at the time the
hardest problem I saw was the fact that semanage without arguments was
difficult to do.
Output local customizations
semanage [ -S store ] -o [ output_file | - ]
Input local customizations
semanage [ -S store ] -i [ input_file | - ]
argparser does not allow "optional arguments" like this.
A cleanup of the man page would also be great. The new sepolicy tool suite is
using argparse and separate man pages for each subcommand, and I really like it.
I think bash-completion eliminates the need for semanage-fcontext Since you
can do.
semanage <tab><tab>
boolean fcontext login node port
dontaudit interface module permissive user
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iEYEARECAAYFAlDLFz0ACgkQrlYvE4MpobPeuQCggV+uI4VQRgfxV6ahibLQAaV6
FwYAoLr/skXi3auZzRp6uvt64jReTgzV
=kd2u
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
4142
days inactive
4146
days old
selinux@lists.fedoraproject.org
12 comments
5 participants
participants (5)
-
Daniel J Walsh -
David Quigley -
Joe Wulf -
Konstantin Ryabitsev -
Miroslav Grepl