rpms/policycoreutils/devel policycoreutils-rhat.patch, 1.460, 1.461 policycoreutils.spec, 1.666, 1.667
Daniel J Walsh
dwalsh at fedoraproject.org
Mon Dec 21 21:56:28 UTC 2009
- Previous message: rpms/shared-color-targets/devel import.log, NONE, 1.1 shared-color-targets.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Next message: rpms/shared-color-targets/F-12 import.log, NONE, 1.1 shared-color-targets.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/pkgs/rpms/policycoreutils/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10165
Modified Files:
policycoreutils-rhat.patch policycoreutils.spec
Log Message:
* Fri Dec 18 2009 Dan Walsh <dwalsh at redhat.com> 2.0.78-7
- Fixes to sandbox man page
policycoreutils-rhat.patch:
Makefile | 2
audit2allow/audit2allow | 59 +--
restorecond/Makefile | 24 +
restorecond/org.selinux.Restorecond.service | 3
restorecond/restorecond.8 | 15
restorecond/restorecond.c | 429 +++++-----------------------
restorecond/restorecond.conf | 5
restorecond/restorecond.desktop | 7
restorecond/restorecond.h | 19 +
restorecond/restorecond.init | 5
restorecond/restorecond_user.conf | 2
restorecond/user.c | 239 +++++++++++++++
restorecond/watch.c | 260 ++++++++++++++++
sandbox/Makefile | 31 ++
sandbox/deliverables/README | 32 ++
sandbox/deliverables/basicwrapper | 4
sandbox/deliverables/run-in-sandbox.py | 49 +++
sandbox/deliverables/sandbox | 216 ++++++++++++++
sandbox/sandbox | 318 ++++++++++++++++++++
sandbox/sandbox.8 | 50 +++
sandbox/sandboxX.sh | 16 +
sandbox/seunshare.c | 265 +++++++++++++++++
semanage/semanage | 122 ++++++-
semanage/seobject.py | 397 ++++++++++++++++++++-----
semodule/semodule.8 | 6
semodule/semodule.c | 53 +++
setfiles/restore.c | 73 ++++
setfiles/restore.h | 3
setfiles/restorecon.8 | 7
setfiles/setfiles.8 | 3
setfiles/setfiles.c | 73 ----
31 files changed, 2206 insertions(+), 581 deletions(-)
Index: policycoreutils-rhat.patch
===================================================================
RCS file: /cvs/pkgs/rpms/policycoreutils/devel/policycoreutils-rhat.patch,v
retrieving revision 1.460
retrieving revision 1.461
diff -u -p -r1.460 -r1.461
--- policycoreutils-rhat.patch 16 Dec 2009 13:21:58 -0000 1.460
+++ policycoreutils-rhat.patch 21 Dec 2009 21:56:27 -0000 1.461
@@ -1681,12 +1681,33 @@ diff --exclude-from=exclude --exclude=se
+relabel:
diff --exclude-from=exclude --exclude=sepolgen-1.0.19 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/sandbox policycoreutils-2.0.78/sandbox/sandbox
--- nsapolicycoreutils/sandbox/sandbox 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.78/sandbox/sandbox 2009-12-14 09:35:48.000000000 -0500
-@@ -0,0 +1,272 @@
-+#!/usr/bin/python -E
++++ policycoreutils-2.0.78/sandbox/sandbox 2009-12-17 13:50:15.000000000 -0500
+@@ -0,0 +1,318 @@
++#! /usr/bin/python -E
++# Authors: Dan Walsh <dwalsh at redhat.com>
++# Authors: Josh Cogliati
++#
++# Copyright (C) 2009 Red Hat
++# see file 'COPYING' for use and warranty information
++#
++# This program is free software; you can redistribute it and/or
++# modify it under the terms of the GNU General Public License as
++# published by the Free Software Foundation; version 2 only
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
++#
++
+import os, sys, getopt, socket, random, fcntl, shutil, re
+import selinux
+import signal
++from tempfile import mkdtemp
+
+PROGNAME = "policycoreutils"
+
@@ -1819,7 +1840,7 @@ diff --exclude-from=exclude --exclude=se
+
+ def usage(message = ""):
+ text = _("""
-+sandbox [-h] [-X] [-M][-I includefile ] [[-i file ] ...] [ -t type ] command
++sandbox [-h] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [[-i file ] ...] [ -t type ] command
+""")
+ error_exit("%s\n%s" % (message, text))
+
@@ -1827,13 +1848,19 @@ diff --exclude-from=exclude --exclude=se
+ X_ind = False
+ home_and_temp = False
+ level=None
++ newhomedir = None
++ newtmpdir = None
++ existing_home = False
++ existing_temp = False
+ try:
-+ gopts, cmds = getopt.getopt(sys.argv[1:], "l:i:ht:XI:M",
++ gopts, cmds = getopt.getopt(sys.argv[1:], "l:i:ht:XI:MH:T:",
+ ["help",
+ "include=",
+ "includefile=",
+ "type=",
+ "mount",
++ "homedir=",
++ "tmpdir=",
+ "level="
+ ])
+ for o, a in gopts:
@@ -1866,12 +1893,20 @@ diff --exclude-from=exclude --exclude=se
+ if o == "-M" or o == "--mount":
+ home_and_temp = True
+
++ if o == "-H" or o == "--homedir":
++ existing_home = True
++ newhomedir = a
++ if o == "-T" or o == "--tmpdir":
++ existing_temp = True
++ newtempdir = a
+ if o == "-h" or o == "--help":
+ usage(_("Usage"));
+
+ if len(cmds) == 0:
+ usage(_("Command required"))
+
++ if (existing_home or existing_temp) and not home_and_temp:
++ usage(_("-M required when specifying home directory or temp directory"))
+ execcon, filecon = gen_context(setype, level)
+ rc = -1
+
@@ -1883,20 +1918,34 @@ diff --exclude-from=exclude --exclude=se
+ break
+
+ try:
-+ newhomedir = None
-+ newtmpdir = None
+ if home_and_temp:
+ if not os.path.exists("/usr/sbin/seunshare"):
+ raise ValueError("""/usr/sbin/seunshare required for sandbox -M, to install you need to execute
+#yum install /usr/sbin/seunshare""")
+ import warnings
+ warnings.simplefilter("ignore")
-+ newhomedir = os.tempnam(".", ".sandbox%s")
-+ os.mkdir(newhomedir)
-+ newtmpdir = os.tempnam("/tmp", ".sandbox")
-+ os.mkdir(newtmpdir)
-+ chcon = ("/usr/bin/chcon %s %s %s" % (filecon, newhomedir, newtmpdir)).split()
-+ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++ if existing_home:
++ if not os.path.isdir(newhomedir):
++ raise IOError("Home directory "+newhomedir+" not found")
++ if not level:
++ chcon = ("/usr/bin/chcon -R %s %s" % (filecon, newhomedir)).split()
++ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++ else:
++ newhomedir = mkdtemp(dir=".", prefix=".sandbox")
++ chcon = ("/usr/bin/chcon %s %s" % (filecon, newhomedir)).split()
++ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++
++ if existing_temp:
++ if not os.path.isdir(newtempdir):
++ raise IOError("Temp directory "+newtempdir+" not found")
++ if not level:
++ chcon = ("/usr/bin/chcon -R %s %s" % (filecon, newtmpdir)).split()
++ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++ else:
++ newtmpdir = mkdtemp(dir="/tmp", prefix=".sandbox")
++ chcon = ("/usr/bin/chcon %s %s" % (filecon, newtmpdir)).split()
++ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++
+ warnings.resetwarnings()
+ paths = []
+ for i in cmds:
@@ -1907,22 +1956,19 @@ diff --exclude-from=exclude --exclude=se
+ paths.append(i)
+
+ copyfiles(newhomedir, newtmpdir, init_files + paths)
-+ execfile = newhomedir + "/.sandboxrc"
-+ fd = open(execfile, "w+")
-+ fd.write("""#! /bin/sh
++ if X_ind:
++ execfile = newhomedir + "/.sandboxrc"
++ fd = open(execfile, "w+")
++ fd.write("""#! /bin/sh
+%s
+""" % " ".join(paths))
-+ fd.close()
-+ os.chmod(execfile, 0700)
-+ if X_ind:
++ fd.close()
++ os.chmod(execfile, 0700)
+ cmds = ("/usr/sbin/seunshare -t %s -h %s -- %s /usr/share/sandbox/sandboxX.sh" % (newtmpdir, newhomedir, execcon)).split()
+ rc = os.spawnvp(os.P_WAIT, cmds[0], cmds)
+ else:
+ cmds = ("/usr/sbin/seunshare -t %s -h %s -- %s " % (newtmpdir, newhomedir, execcon)).split()+cmds
+ rc = os.spawnvp(os.P_WAIT, cmds[0], cmds)
-+ selinux.setexeccon(execcon)
-+ rc = os.spawnvp(os.P_WAIT, cmds[0], cmds)
-+ selinux.setexeccon(None)
+ for i in paths:
+ if i not in X_FILES:
+ continue
@@ -1935,9 +1981,9 @@ diff --exclude-from=exclude --exclude=se
+ selinux.setexeccon(None)
+ finally:
+ if home_and_temp:
-+ if newhomedir:
++ if newhomedir and not existing_home:
+ shutil.rmtree(newhomedir)
-+ if newtmpdir:
++ if newtmpdir and not existing_temp:
+ shutil.rmtree(newtmpdir)
+
+ except getopt.GetoptError, error:
@@ -1957,26 +2003,28 @@ diff --exclude-from=exclude --exclude=se
+
diff --exclude-from=exclude --exclude=sepolgen-1.0.19 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/sandbox.8 policycoreutils-2.0.78/sandbox/sandbox.8
--- nsapolicycoreutils/sandbox/sandbox.8 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.78/sandbox/sandbox.8 2009-12-14 09:37:40.000000000 -0500
-@@ -0,0 +1,39 @@
++++ policycoreutils-2.0.78/sandbox/sandbox.8 2009-12-18 07:37:35.000000000 -0500
+@@ -0,0 +1,50 @@
+.TH SANDBOX "8" "May 2009" "chcat" "User Commands"
+.SH NAME
+sandbox \- Run cmd under an SELinux sandbox
+.SH SYNOPSIS
+.B sandbox
-+[-M] [-X] [-I includefile ] [[-i file ]...] [ -t type ] cmd
++[-l level ] [[-M | -X] -H homedir -T tmpdir ] [-I includefile ] [[-i file ]...] [ -t type ] cmd
+.br
+.SH DESCRIPTION
+.PP
+Run the
+.I cmd
-+application within a tightly confined SELinux domain. The default sandbox domain only allows applications the ability to read and write stdin, stdout and any other file descriptors handed to it. It is not allowed to open any other files.
++application within a tightly confined SELinux domain. The default sandbox domain only allows applications the ability to read and write stdin, stdout and any other file descriptors handed to it. It is not allowed to open any other files. The -M option will mount an alternate homedir and tmpdir to be used by the sandbox.
+
+If you have the
+.I policycoreutils-sandbox
-+package installed, you can use the -X option.
++package installed, you can use the -X option and the -M option.
+.B sandbox -X
+allows you to run sandboxed X applications. These applications will start up their own X Server and create a temporary homedir and /tmp. The default policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Any file specified on the command line will be copied into the sandbox.
++
++If directories are specified with -H or -T the directory will have its context modified with chcon(1) unless a level is specified with -l. If the MLS/MCS security level is specified, the directories need to have a matching label.
+.PP
+.TP
+\fB\-t type\fR
@@ -1988,12 +2036,21 @@ diff --exclude-from=exclude --exclude=se
+\fB\-I inputfile\fR
+Copy all files listed in inputfile into the appropriate temporary sandbox direcories.
+.TP
++\fB\-l\fR
++Specify the MLS/MCS Security Level to run the sandbox in. Defaults to random.
++.TP
+\fB\-X\fR
+Create an X based Sandbox for gui apps, temporary files for $HOME and /tmp, seconday Xserver, defaults to sandbox_x_t
+.TP
+\fB\-M\fR
+Create a Sandbox with temporary files for $HOME and /tmp, defaults to sandbox_t
+.TP
++\fB\-H\ homedir
++Use alternate homedir to mount. Defaults to temporary. Requires -X or -M.
++.TP
++\fB\-T\ tmpdir
++Use alternate tempdir to mount. Defaults to temporary. Requires -X or -M.
++.PP
+.SH "SEE ALSO"
+.TP
+runcon(1)
Index: policycoreutils.spec
===================================================================
RCS file: /cvs/pkgs/rpms/policycoreutils/devel/policycoreutils.spec,v
retrieving revision 1.666
retrieving revision 1.667
diff -u -p -r1.666 -r1.667
--- policycoreutils.spec 17 Dec 2009 13:24:23 -0000 1.666
+++ policycoreutils.spec 21 Dec 2009 21:56:28 -0000 1.667
@@ -6,7 +6,7 @@
Summary: SELinux policy core utilities
Name: policycoreutils
Version: 2.0.78
-Release: 6%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
@@ -108,6 +108,7 @@ Requires: audit-libs-python >= %{libaud
Requires: /usr/bin/make
Requires(pre): python >= 2.6
Obsoletes: policycoreutils < 2.0.61-2
+Requires: setools-libs-python
%description python
The policycoreutils-python package contains the management tools use to manage an SELinux environment.
@@ -189,7 +190,7 @@ Group: System Environment/Base
Requires: policycoreutils-python = %{version}-%{release}
Requires: gnome-python2-gnome, pygtk2, pygtk2-libglade, gnome-python2-canvas
Requires: usermode-gtk
-Requires: setools-console setools-libs-python
+Requires: setools-console
Requires: selinux-policy
Requires: python >= 2.6
BuildRequires: desktop-file-utils
@@ -296,6 +297,9 @@ fi
exit 0
%changelog
+* Fri Dec 18 2009 Dan Walsh <dwalsh at redhat.com> 2.0.78-7
+- Fixes to sandbox man page
+
* Thu Dec 17 2009 Dan Walsh <dwalsh at redhat.com> 2.0.78-6
- Add setools-libs-python to requires for gui
- Previous message: rpms/shared-color-targets/devel import.log, NONE, 1.1 shared-color-targets.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Next message: rpms/shared-color-targets/F-12 import.log, NONE, 1.1 shared-color-targets.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list