rpms/policycoreutils/F-13 policycoreutils-rhat.patch, 1.497, 1.498 policycoreutils.spec, 1.709, 1.710
Daniel J Walsh
dwalsh at fedoraproject.org
Wed May 19 17:59:29 UTC 2010
Author: dwalsh
Update of /cvs/extras/rpms/policycoreutils/F-13
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv10159
Modified Files:
policycoreutils-rhat.patch policycoreutils.spec
Log Message:
* Wed May 19 2010 Dan Walsh <dwalsh at redhat.com> 2.0.82-19
- Fixes from upstream for sandbox command
policycoreutils-rhat.patch:
Makefile | 2
README | 32 -
audit2allow/Makefile | 1
audit2allow/audit2allow | 53 --
audit2allow/audit2allow.1 | 3
audit2allow/sepolgen-ifgen | 89 ---
newrole/newrole.c | 3
restorecond/Makefile | 24
restorecond/org.selinux.Restorecond.service | 3
restorecond/restorecond.8 | 15
restorecond/restorecond.c | 429 +++--------------
restorecond/restorecond.conf | 5
restorecond/restorecond.desktop | 7
restorecond/restorecond.h | 19
restorecond/restorecond.init | 7
restorecond/restorecond_user.conf | 2
restorecond/user.c | 239 +++++++++
restorecond/watch.c | 260 ++++++++++
sandbox/Makefile | 41 +
sandbox/deliverables/README | 32 +
sandbox/deliverables/basicwrapper | 4
sandbox/deliverables/run-in-sandbox.py | 49 +
sandbox/sandbox | 430 +++++++++++++++++
sandbox/sandbox.8 | 57 ++
sandbox/sandbox.config | 2
sandbox/sandbox.init | 74 ++
sandbox/sandboxX.sh | 15
sandbox/seunshare.c | 304 ++++++++++++
sandbox/test.txt | 1
sandbox/test_sandbox.py | 98 +++
scripts/fixfiles | 46 -
semanage/default_encoding/Makefile | 8
semanage/default_encoding/default_encoding.c | 59 ++
semanage/default_encoding/policycoreutils/__init__.py | 17
semanage/default_encoding/setup.py | 38 +
semanage/semanage | 162 +++++-
semanage/semanage.8 | 128 ++++-
semanage/seobject.py | 451 ++++++++++++++----
sepolgen-ifgen/Makefile | 26 +
sepolgen-ifgen/sepolgen-ifgen | 131 +++++
sepolgen-ifgen/sepolgen-ifgen-attr-helper.c | 230 +++++++++
setfiles/restore.c | 109 +++-
setfiles/restore.h | 4
setfiles/restorecon.8 | 7
setfiles/setfiles.8 | 3
setfiles/setfiles.c | 78 ---
46 files changed, 3013 insertions(+), 784 deletions(-)
Index: policycoreutils-rhat.patch
===================================================================
RCS file: /cvs/extras/rpms/policycoreutils/F-13/policycoreutils-rhat.patch,v
retrieving revision 1.497
retrieving revision 1.498
diff -u -p -r1.497 -r1.498
--- policycoreutils-rhat.patch 14 May 2010 13:03:01 -0000 1.497
+++ policycoreutils-rhat.patch 19 May 2010 17:59:27 -0000 1.498
@@ -231,7 +231,7 @@ diff --exclude-from=exclude --exclude=se
-if __name__ == "__main__":
- sys.exit(main())
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.82/Makefile
---- nsapolicycoreutils/Makefile 2008-08-28 09:34:24.000000000 -0400
+--- nsapolicycoreutils/Makefile 2010-05-19 12:52:37.000000000 -0400
+++ policycoreutils-2.0.82/Makefile 2010-04-28 17:12:19.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
@@ -252,6 +252,42 @@ diff --exclude-from=exclude --exclude=se
#ifdef NAMESPACE_PRIV
if (transition_to_caller_uid())
goto err_close_pam_session;
+diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/README policycoreutils-2.0.82/README
+--- nsapolicycoreutils/README 2010-05-19 11:49:14.000000000 -0400
++++ policycoreutils-2.0.82/README 1969-12-31 19:00:00.000000000 -0500
+@@ -1,32 +0,0 @@
+-Files:
+-run-in-sandbox.py:
+- adds the run in sandbox extension to nautilus
+- copy to .nautilus/python-extensions
+- yum install nautilus-python
+-
+-sandbox:
+- adds support for file checking, This was working I don't know why it didn't at that presentation
+- adds support for file relabeling, This is/was also working.
+-
+-basicwrapper:
+- This is pretty much the most basic condor wrapper you can create, it requires the -f option in sandbox. Also I can't make this work, maybe the grid team will have more luck.
+-
+-Other:
+-Xguest Live cd:
+- There's a tutorial on live cds here: http://www.ibm.com/developerworks/library/l-fedora-livecd/index.html?ca=dgr-lnxw16FedoraLiveCD
+- It looks like David Zeuthen is head guy in the live cd department, he might be worth talking to.
+-
+-System-config-selinux:
+- wiki: fedorahosted.org/system-config-selinux
+- realeases: fedorahosted.org/releases/s/y/system-config-selinux/ includes a spec,srpm, and tarball of current version
+- The project is technically owned by Roman Rakus (rrakus at redhat.com) I've sent him an email asking him to make you a git contributor.
+- I'll continue making updates to this and make sure it gets into the repos.
+-
+-Assuming I don't get to keep my RedHat email you can contact me:
+-email: chris.pardy at gmail.com
+-phone: 1-207-838-7119
+-
+-I'll probably continue to be on the #fedora-selinux and #selinux irc channels
+-
+-Thanks for a great summer.
+-Chris Pardy
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/Makefile policycoreutils-2.0.82/restorecond/Makefile
--- nsapolicycoreutils/restorecond/Makefile 2009-08-20 15:49:21.000000000 -0400
+++ policycoreutils-2.0.82/restorecond/Makefile 2010-04-28 17:12:19.000000000 -0400
@@ -1547,226 +1583,6 @@ diff --exclude-from=exclude --exclude=se
+ def get_background_items(self, window, file):
+ return
+
-diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/deliverables/sandbox policycoreutils-2.0.82/sandbox/deliverables/sandbox
---- nsapolicycoreutils/sandbox/deliverables/sandbox 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.82/sandbox/deliverables/sandbox 2010-04-28 17:12:19.000000000 -0400
-@@ -0,0 +1,216 @@
-+#!/usr/bin/python -E
-+import os, sys, getopt, socket, random, fcntl, shutil
-+import selinux
-+
-+PROGNAME = "policycoreutils"
-+
-+import gettext
-+gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
-+gettext.textdomain(PROGNAME)
-+
-+try:
-+ gettext.install(PROGNAME,
-+ localedir = "/usr/share/locale",
-+ unicode=False,
-+ codeset = 'utf-8')
-+except IOError:
-+ import __builtin__
-+ __builtin__.__dict__['_'] = unicode
-+
-+
-+DEFAULT_TYPE = "sandbox_t"
-+DEFAULT_X_TYPE = "sandbox_x_t"
-+
-+X_FILES = {}
-+OLD_FCONTEXTS = {}
-+
-+random.seed(None)
-+
-+def error_exit(msg):
-+ sys.stderr.write("%s: " % sys.argv[0])
-+ sys.stderr.write("%s\n" % msg)
-+ sys.stderr.flush()
-+ sys.exit(1)
-+
-+def reserve(mcs):
-+ sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-+ sock.bind("\0%s" % mcs)
-+ fcntl.fcntl(sock.fileno(), fcntl.F_SETFD, fcntl.FD_CLOEXEC)
-+
-+def gen_context(setype):
-+ while True:
-+ i1 = random.randrange(0, 1024)
-+ i2 = random.randrange(0, 1024)
-+ if i1 == i2:
-+ continue
-+ if i1 > i2:
-+ tmp = i1
-+ i1 = i2
-+ i2 = tmp
-+ mcs = "s0:c%d,c%d" % (i1, i2)
-+ reserve(mcs)
-+ try:
-+ reserve(mcs)
-+ except:
-+ continue
-+ break
-+ con = selinux.getcon()[1].split(":")
-+
-+ execcon = "%s:%s:%s:%s" % (con[0], con[1], setype, mcs)
-+
-+ filecon = "%s:%s:%s:%s" % (con[0],
-+ "object_r",
-+ "%s_file_t" % setype[:-2],
-+ mcs)
-+ return execcon, filecon
-+
-+def copyfile(file, dir, dest):
-+ import re
-+ if file.startswith(dir):
-+ dname = os.path.dirname(file)
-+ bname = os.path.basename(file)
-+ if dname == dir:
-+ dest = dest + "/" + bname
-+ else:
-+ newdir = re.sub(dir, dest, dname)
-+ os.makedirs(newdir)
-+ dest = newdir + "/" + bname
-+
-+ if os.path.isdir(file):
-+ shutil.copytree(file, dest)
-+ else:
-+ shutil.copy2(file, dest)
-+ X_FILES[dest] = os.path.getmtime(dest)
-+
-+def copyfiles(newhomedir, newtmpdir, files):
-+ import pwd
-+ homedir=pwd.getpwuid(os.getuid()).pw_dir
-+
-+ for f in files:
-+ copyfile(f,homedir, newhomedir)
-+ copyfile(f,"/tmp", newtmpdir)
-+
-+def uncopyfile(newhomedir,file):
-+ import pwd
-+ homedir=pwd.getpwuid(os.getuid()).pw_dir
-+ copyfile(file,newhomedir,homedir)
-+
-+if __name__ == '__main__':
-+ if selinux.is_selinux_enabled() != 1:
-+ error_exit("Requires an SELinux enabled system")
-+
-+ init_files = []
-+
-+ def usage(message = ""):
-+ text = _("""
-+sandbox [-h] [-I includefile ] [[-i file ] ...] [[-f file] ...][ -t type ] command
-+""")
-+ error_exit("%s\n%s" % (message, text))
-+
-+ setype = DEFAULT_TYPE
-+ X_ind = False
-+ try:
-+ gopts, cmds = getopt.getopt(sys.argv[1:], "i:ht:XI:f:",
-+ ["help",
-+ "include=",
-+ "includefile=",
-+ "type="
-+ "file="
-+ ])
-+ for o, a in gopts:
-+ if o == "-t" or o == "--type":
-+ setype = a
-+
-+ if o == "-i" or o == "--include":
-+ rp = os.path.realpath(a)
-+ if rp not in init_files:
-+ init_files.append(rp)
-+
-+ if o == "-f" or o == "--file":
-+ rp = os.path.realpath(a)
-+ OLD_FCONTEXTS[a] = selinux.getfilecon(rp)[1]
-+
-+ if o == "-I" or o == "--includefile":
-+ fd = open(a, "r")
-+ for i in fd.read().split("\n"):
-+ if os.path.exists(i):
-+ rp = os.path.realpath(i)
-+ if rp not in init_files:
-+ init_files.append(rp)
-+
-+ fd.close
-+
-+ if o == "-X":
-+ if DEFAULT_TYPE == setype:
-+ setype = DEFAULT_X_TYPE
-+ X_ind = True
-+
-+ if o == "-h" or o == "--help":
-+ usage(_("Usage"));
-+
-+ if len(cmds) == 0:
-+ usage(_("Command required"))
-+
-+ execcon, filecon = gen_context(setype)
-+ rc = -1
-+
-+ if cmds[0][0] != "/" and cmds[0][:2] != "./" and cmds[0][:3] != "../":
-+ for i in os.environ["PATH"].split(':'):
-+ f = "%s/%s" % (i, cmds[0])
-+ if os.access(f, os.X_OK):
-+ cmds[0] = f
-+ break
-+
-+ try:
-+ if X_ind:
-+ import warnings
-+ warnings.simplefilter("ignore")
-+ newhomedir = os.tempnam(".", ".sandbox%s")
-+ os.mkdir(newhomedir)
-+ selinux.setfilecon(newhomedir, filecon)
-+ newtmpdir = os.tempnam("/tmp", ".sandbox")
-+ os.mkdir(newtmpdir)
-+ selinux.setfilecon(newtmpdir, filecon)
-+ warnings.resetwarnings()
-+ copyfiles(newhomedir, newtmpdir, init_files + cmds)
-+ execfile = newhomedir + "/.sandboxrc"
-+ fd = open(execfile, "w+")
-+ fd.write("""#! /bin/sh
-+%s
-+""" % " ".join(cmds))
-+ fd.close()
-+ os.chmod(execfile, 0700)
-+
-+ cmds = ("/usr/sbin/seunshare -t %s -h %s -- %s /usr/share/sandbox/sandboxX.sh" % (newtmpdir, newhomedir, execcon)).split()
-+ rc = os.spawnvp(os.P_WAIT, cmds[0], cmds)
-+ for i in X_FILES.keys():
-+ if os.path.getmtime(i) > X_FILES[i]:
-+ yn = raw_input("do you want to save your changes to the file %s (Y/N): " % os.path.basename(i)).lower()
-+ if yn.startswith('y'):
-+ uncopyfile(newhomedir,i)
-+ else:
-+ for i in OLD_FCONTEXTS.keys():
-+ selinux.setfilecon(i,filecon)
-+ selinux.setexeccon(execcon)
-+ rc = os.spawnvp(os.P_WAIT, cmds[0], cmds)
-+ selinux.setexeccon(None)
-+ for i in OLD_FCONTEXTS.keys():
-+ selinux.setfilecon(i,OLD_FCONTEXTS[i])
-+ finally:
-+ if X_ind:
-+ shutil.rmtree(newhomedir)
-+ shutil.rmtree(newtmpdir)
-+
-+ except getopt.GetoptError, error:
-+ usage(_("Options Error %s ") % error.msg)
-+ except OSError, error:
-+ error_exit(error.args[1])
-+ except ValueError, error:
-+ error_exit(error.args[0])
-+ except KeyError, error:
-+ error_exit(_("Invalid value %s") % error.args[0])
-+ except IOError, error:
-+ error_exit(error.args[1])
-+
-+ sys.exit(rc)
-+
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/Makefile policycoreutils-2.0.82/sandbox/Makefile
--- nsapolicycoreutils/sandbox/Makefile 1969-12-31 19:00:00.000000000 -0500
+++ policycoreutils-2.0.82/sandbox/Makefile 2010-04-28 17:12:19.000000000 -0400
@@ -1814,8 +1630,8 @@ diff --exclude-from=exclude --exclude=se
+relabel:
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/sandbox policycoreutils-2.0.82/sandbox/sandbox
--- nsapolicycoreutils/sandbox/sandbox 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.82/sandbox/sandbox 2010-05-13 08:55:59.000000000 -0400
-@@ -0,0 +1,421 @@
++++ policycoreutils-2.0.82/sandbox/sandbox 2010-05-19 13:57:42.000000000 -0400
+@@ -0,0 +1,430 @@
+#! /usr/bin/python -E
+# Authors: Dan Walsh <dwalsh at redhat.com>
+# Authors: Josh Cogliati
@@ -1862,7 +1678,7 @@ diff --exclude-from=exclude --exclude=se
+
+DEFAULT_TYPE = "sandbox_t"
+DEFAULT_X_TYPE = "sandbox_x_t"
-+X_FILES = {}
++SAVE_FILES = {}
+
+random.seed(None)
+
@@ -1882,6 +1698,14 @@ diff --exclude-from=exclude --exclude=se
+ sys.stderr.flush()
+ sys.exit(1)
+
++def chcon(path, context, recursive=False):
++ """ Restore SELinux context on a given path """
++ mode = os.lstat(path)[stat.ST_MODE]
++ lsetfilecon(path, context)
++ if recursive:
++ os.path.walk(path, lambda arg, dirname, fnames:
++ map(chcon, [os.path.join(dirname, fname)
++ for fname in fnames]), context)
+def copyfile(file, dir, dest):
+ import re
+ if file.startswith(dir):
@@ -1902,9 +1726,9 @@ diff --exclude-from=exclude --exclude=se
+ shutil.copy2(file, dest)
+ except shutil.Error, elist:
+ for e in elist:
-+ print e[1]
++ sys.stderr.write(e[1])
+
-+ X_FILES[file] = (dest, os.path.getmtime(dest))
++ SAVE_FILES[file] = (dest, os.path.getmtime(dest))
+
+def savefile(new, orig, X_ind):
+ copy = False
@@ -1942,7 +1766,6 @@ diff --exclude-from=exclude --exclude=se
+ tmp = i1
+ i1 = i2
+ i2 = tmp
-+ level = "s0:c%d,c%d" % (i1, i2)
+ level = "s0:c%d,c%d" % (i1, i2)
+ try:
+ reserve(level)
@@ -1966,6 +1789,7 @@ diff --exclude-from=exclude --exclude=se
+ SYSLOG = "/var/log/messages"
+
+ def __init__(self):
++ self.setype = DEFAULT_TYPE
+ self.__options = None
+ self.__cmds = None
+ self.__init_files = []
@@ -1981,10 +1805,13 @@ diff --exclude-from=exclude --exclude=se
+ self.usage(_("Homedir and tempdir required for level mounts"))
+
+ if not os.path.exists("/usr/sbin/seunshare"):
-+ raise ValueError("""
-+/usr/sbin/seunshare required for sandbox -M, to install you need to execute
-+#yum install /usr/sbin/seunshare
-+""")
++ raise ValueError(_("""
++/usr/sbin/seunshare is required for the action you want to perform.
++Install seunshare by executing:
++
++# yum install /usr/sbin/seunshare
++
++"""))
+
+ def __mount_callback(self, option, opt, value, parser):
+ self.__mount = True
@@ -2010,9 +1837,10 @@ diff --exclude-from=exclude --exclude=se
+ def __includefile(self, option, opt, value, parser):
+ fd = open(value, "r")
+ for i in fd.readlines():
-+ rp = os.path.realpath(os.path.expanduser(i[:-1]))
-+ if rp not in self.__init_files and os.path.exists(rp):
-+ self.__init_files.append(rp)
++ try:
++ self.__include(option, opt, i[:-1], parser)
++ except IOError, e:
++ sys.stderr.write(e)
+ fd.close()
+
+ def __copyfiles(self):
@@ -2059,60 +1887,62 @@ diff --exclude-from=exclude --exclude=se
+ parser.add_option("-i", "--include",
+ action="callback", callback=self.__include,
+ type="string",
-+ help="include file in sandbox")
++ help=_("include file in sandbox"))
+ parser.add_option("-I", "--includefile", action="callback", callback=self.__includefile,
+ type="string",
-+ help="include contents of file in sandbox")
-+ parser.add_option("-t", "--type", dest="setype", action="store", default=DEFAULT_TYPE,
-+ help="Run sandbox with SELinux type")
++ help=_("read list of files to include in sandbox from INCLUDEFILE"))
++ parser.add_option("-t", "--type", dest="setype", action="store", default=None,
++ help=_("run sandbox with SELinux type"))
+ parser.add_option("-M", "--mount",
+ action="callback", callback=self.__mount_callback,
-+ help="Mount new home and tmp Dir")
++ help=_("mount new home and/or tmp directory"))
+
+ parser.add_option("-S", "--session", action="store_true", dest="session",
-+ default=False, help="Run complete desktop session within sandbox")
++ default=False, help=_("run complete desktop session within sandbox"))
+
+ parser.add_option("-X", dest="X_ind",
+ action="callback", callback=self.__x_callback,
-+ default=False, help="Run X sandbox")
++ default=False, help=_("run X application within a sandbox"))
+
+ parser.add_option("-H", "--homedir",
+ action="callback", callback=self.__validdir,
+ type="string",
+ dest="homedir",
-+ help="Alternate homedir to use for mounting")
++ help=_("alternate home directory to use for mounting"))
+
+ parser.add_option("-T", "--tmpdir", dest="tmpdir",
+ type="string",
+ action="callback", callback=self.__validdir,
-+ help="Alternate tempdir to use for mounting")
++ help=_("alternate /tmp directory to use for mounting"))
+
+ parser.add_option("-W", "--windowmanager", dest="wm",
+ type="string",
+ default="/usr/bin/matchbox-window-manager -use_titlebar no",
-+ help="Alternate window maanger")
++ help=_("alternate window manager"))
+
+ parser.add_option("-l", "--level", dest="level",
-+ help="MCS/MLS Level for the sandbox")
++ help=_("MCS/MLS level for the sandbox"))
+
+ self.__parser=parser
+
+ self.__options, cmds = parser.parse_args()
+
+ if self.__options.X_ind:
-+ if DEFAULT_TYPE == self.__options.setype:
-+ self.__options.setype = DEFAULT_X_TYPE
++ self.setype = DEFAULT_X_TYPE
++
++ if self.__options.setype:
++ self.setype = self.__options.setype
+
+ if self.__mount:
+ self.__validate_mount()
+
+ if self.__options.session:
-+ if self.__options.setype in (DEFAULT_TYPE, DEFAULT_X_TYPE):
-+ self.__options.setype = selinux.getcon()[1].split(":")[2]
++ if not self.__options.setype:
++ self.setype = selinux.getcon()[1].split(":")[2]
+ if not self.__options.homedir or not self.__options.tmpdir:
-+ self.usage(_("Homedir and tempdir required for session"))
++ self.usage(_("You must specify a Homedir and tempdir when setting up a session sandbox"))
+ if len(cmds) > 0:
-+ self.usage(_("Commands not allowed in a session"))
++ self.usage(_("Commands are not allowed in a session sandbox"))
+ self.__options.X_ind = True
+ self.__homedir = self.__options.homedir
+ self.__tmpdir = self.__options.tmpdir
@@ -2139,9 +1969,9 @@ diff --exclude-from=exclude --exclude=se
+ level = gen_mcs()
+
+ con = selinux.getcon()[1].split(":")
-+ self.__execcon = "%s:%s:%s:%s" % (con[0], con[1], self.__options.setype, level)
++ self.__execcon = "%s:%s:%s:%s" % (con[0], con[1], self.setype, level)
+ self.__filecon = "%s:%s:%s:%s" % (con[0], "object_r",
-+ "%s_file_t" % self.__options.setype[:-2],
++ "%s_file_t" % self.setype[:-2],
+ level)
+ def __setup_dir(self):
+ if self.__options.level or self.__options.session:
@@ -2150,24 +1980,19 @@ diff --exclude-from=exclude --exclude=se
+ if not os.path.exists(sandboxdir):
+ os.mkdir(sandboxdir)
+
-+ import warnings
-+ warnings.simplefilter("ignore")
+ if self.__options.homedir:
-+ chcon = ("/usr/bin/chcon -R %s %s" % (self.__filecon, self.__options.homedir)).split()
-+ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++ chcon(self.__options.homedir, self.__filecon, True)
+ self.__homedir = self.__options.homedir
+ else:
+ selinux.setfscreatecon(self.__filecon)
+ self.__homedir = mkdtemp(dir=sandboxdir, prefix=".sandbox")
+
+ if self.__options.tmpdir:
-+ chcon = ("/usr/bin/chcon -R %s %s" % (self.__filecon, self.__options.tmpdir)).split()
-+ rc = os.spawnvp(os.P_WAIT, chcon[0], chcon)
++ chcon(self.__options.homedir, self.__filecon, True)
+ self.__tmpdir = self.__options.tmpdir
+ else:
+ selinux.setfscreatecon(self.__filecon)
+ self.__tmpdir = mkdtemp(dir="/tmp", prefix=".sandbox")
-+ warnings.resetwarnings()
+ selinux.setfscreatecon(None)
+ self.__copyfiles()
+
@@ -2181,12 +2006,12 @@ diff --exclude-from=exclude --exclude=se
+
+ self.__setup_sandboxrc(self.__options.wm)
+
-+ cmds = ("/usr/sbin/seunshare -t %s -h %s -- %s /usr/share/sandbox/sandboxX.sh" % (self.__tmpdir, self.__homedir, self.__execcon)).split()
++ cmds = ('/usr/sbin/seunshare -t "%s" -h "%s" -- %s /usr/share/sandbox/sandboxX.sh' % (self.__tmpdir, self.__homedir, self.__execcon)).split()
+ rc = subprocess.Popen(cmds).wait()
+ return rc
+
+ if self.__mount:
-+ cmds = ("/usr/sbin/seunshare -t %s -h %s -- %s " % (self.__tmpdir, self.__homedir, self.__execcon)).split()+self.__paths
++ cmds = ('/usr/sbin/seunshare -t "%s" -h "%s" -- %s ' % (self.__tmpdir, self.__homedir, self.__execcon)).split()+self.__paths
+ rc = subprocess.Popen(cmds).wait()
+ return rc
+
@@ -2197,9 +2022,9 @@ diff --exclude-from=exclude --exclude=se
+
+ finally:
+ for i in self.__paths:
-+ if i not in X_FILES:
++ if i not in SAVE_FILES:
+ continue
-+ (dest, mtime) = X_FILES[i]
++ (dest, mtime) = SAVE_FILES[i]
+ if os.path.getmtime(dest) > mtime:
+ savefile(dest, i, self.__options.X_ind)
+
@@ -2239,7 +2064,7 @@ diff --exclude-from=exclude --exclude=se
+ sys.exit(rc)
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/sandbox.8 policycoreutils-2.0.82/sandbox/sandbox.8
--- nsapolicycoreutils/sandbox/sandbox.8 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.82/sandbox/sandbox.8 2010-04-29 12:31:33.000000000 -0400
++++ policycoreutils-2.0.82/sandbox/sandbox.8 2010-05-19 10:15:43.000000000 -0400
@@ -0,0 +1,57 @@
+.TH SANDBOX "8" "May 2009" "chcat" "User Commands"
+.SH NAME
@@ -2259,31 +2084,31 @@ diff --exclude-from=exclude --exclude=se
+.I policycoreutils-sandbox
+package installed, you can use the -X option and the -M option.
+.B sandbox -X
-+allows you to run sandboxed X applications. These applications will start up their own X Server and create a temporary homedir and /tmp. The default policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Any file specified on the command line will be copied into the sandbox.
++allows you to run X applications within a sandbox. These applications will start up their own X Server and create a temporary home directory and /tmp. The default SELinux policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Files specified on the command that are in the home directory or /tmp will be copied into the sandbox directories.
+
-+If directories are specified with -H or -T the directory will have its context modified with chcon(1) unless a level is specified with -l. If the MLS/MCS security level is specified, the directories need to have a matching label.
++If directories are specified with -H or -T the directory will have its context modified with chcon(1) unless a level is specified with -l. If the MLS/MCS security level is specified, the user is responsible to set the correct labels.
+.PP
+.TP
+\fB\-H\ homedir
-+Use alternate homedir to mount. Defaults to temporary. Requires -X or -M.
++Use alternate homedir to mount over your home directory. Defaults to temporary. Requires -X or -M.
+.TP
+\fB\-i file\fR
-+Copy this file into the temporary sandbox appriate. Command can be repeated.
++Copy this file into the appropriate temporary sandbox directory. Command can be repeated.
+.TP
+\fB\-I inputfile\fR Copy all files listed in inputfile into the
-+appropriate temporary sandbox direcories.
++appropriate temporary sandbox directories.
+.TP
+\fB\-l\fR
-+Specify the MLS/MCS Security Level to run the sandbox in. Defaults to random.
++Specify the MLS/MCS Security Level to run the sandbox with. Defaults to random.
+.TP
+\fB\-M\fR
-+Create a Sandbox with temporary files for $HOME and /tmp, defaults to sandbox_t
++Create a Sandbox with temporary files for $HOME and /tmp.
+.TP
+\fB\-t type\fR
+Use alternate sandbox type, defaults to sandbox_t or sandbox_x_t for -X.
+.TP
+\fB\-T\ tmpdir
-+Use alternate tempdir to mount. Defaults to temporary. Requires -X or -M.
++Use alternate tempory directory to mount on /tmp. Defaults to tmpfs. Requires -X or -M.
+.TP
+\fB\-W windowmanager\fR
+Select alternative window manager to run within
@@ -2292,7 +2117,7 @@ diff --exclude-from=exclude --exclude=se
+.TP
+\fB\-X\fR
+Create an X based Sandbox for gui apps, temporary files for
-+$HOME and /tmp, seconday Xserver, defaults to sandbox_x_t
++$HOME and /tmp, secondary Xserver, defaults to sandbox_x_t
+.PP
+.SH "SEE ALSO"
+.TP
@@ -2306,8 +2131,8 @@ diff --exclude-from=exclude --exclude=se
+HOMEDIRS="/home"
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/sandbox.init policycoreutils-2.0.82/sandbox/sandbox.init
--- nsapolicycoreutils/sandbox/sandbox.init 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.82/sandbox/sandbox.init 2010-04-28 17:12:19.000000000 -0400
-@@ -0,0 +1,67 @@
++++ policycoreutils-2.0.82/sandbox/sandbox.init 2010-05-19 10:24:59.000000000 -0400
+@@ -0,0 +1,74 @@
+#!/bin/bash
+## BEGIN INIT INFO
+# Provides: sandbox
@@ -2320,10 +2145,17 @@ diff --exclude-from=exclude --exclude=se
+#
+# chkconfig: 345 1 99
+#
-+# Description: sandbox is using pam_namespace to share the /var/tmp, /tmp and
-+# /home/sandbox accounts. This script will setup the / mount
-+# point as shared and all of the subdirectories just these
-+# directories as unshared.
++# Description: sandbox and other apps that want to use pam_namespace
++# on /var/tmp, /tmp and home directories, requires this script
++# to be run at boot time.
++# This script sets up the / mount point and all of its
++# subdirectories as shared. The script sets up
++# /tmp, /var/tmp, /home and any homedirs listed in
++# /etc/sysconfig/sandbox and all of their subdirectories
++# as unshared.
++# All processes that use pam_namespace will see
++# modifications to the global mountspace, except for the
++# unshared directories.
+#
+
+# Source function library.
@@ -2338,6 +2170,7 @@ diff --exclude-from=exclude --exclude=se
+base=${0##*/}
+
+case "$1" in
++ restart)
+ start)
+ [ -f "$LOCKFILE" ] && exit 0
+
@@ -2352,8 +2185,7 @@ diff --exclude-from=exclude --exclude=se
+ mount --make-private $h
+ done
+
-+ RETVAL=$?
-+ exit $RETVAL
++ exit $?
+ ;;
+
+ status)
@@ -2371,7 +2203,7 @@ diff --exclude-from=exclude --exclude=se
+ ;;
+
+ *)
-+ echo $"Usage: $0 {start|stop}"
++ echo $"Usage: $0 {start|stop|status|restart}"
+ exit 3
+ ;;
+esac
@@ -2396,8 +2228,8 @@ diff --exclude-from=exclude --exclude=se
+exit 0
diff --exclude-from=exclude --exclude=sepolgen-1.0.23 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/sandbox/seunshare.c policycoreutils-2.0.82/sandbox/seunshare.c
--- nsapolicycoreutils/sandbox/seunshare.c 1969-12-31 19:00:00.000000000 -0500
-+++ policycoreutils-2.0.82/sandbox/seunshare.c 2010-05-11 15:50:09.000000000 -0400
-@@ -0,0 +1,288 @@
++++ policycoreutils-2.0.82/sandbox/seunshare.c 2010-05-19 11:01:58.000000000 -0400
+@@ -0,0 +1,304 @@
+#include <signal.h>
+#include <sys/types.h>
+#include <sys/wait.h>
@@ -2423,6 +2255,14 @@ diff --exclude-from=exclude --exclude=se
+#include <sys/stat.h>
+#include <unistd.h>
+
++#ifdef USE_NLS
++#include <locale.h> /* for setlocale() */
++#include <libintl.h> /* for gettext() */
++#define _(msgid) gettext (msgid)
++#else
++#define _(msgid) (msgid)
++#endif
++
+/**
+ * This function will drop all capabilities
+ * Returns zero on success, non-zero otherwise
@@ -2435,16 +2275,14 @@ diff --exclude-from=exclude --exclude=se
+ return -1;
+ /* Change uid */
+ if (setresuid(uid, uid, uid)) {
-+ fprintf(stderr, "Error changing uid, aborting.\n");
++ fprintf(stderr, _("Error changing uid, aborting.\n"));
+ return -1;
+ }
+ return capng_apply(CAPNG_SELECT_BOTH);
+}
+
+#define DEFAULT_PATH "/usr/bin:/bin"
-+#define TRUE 1
-+#define FALSE 0
-+static int verbose = FALSE;
++static int verbose = 0;
+
+/**
+ * Take care of any signal setup
@@ -2469,20 +2307,22 @@ diff --exclude-from=exclude --exclude=se
+
+ return 0;
+}
-+#define USAGE_STRING "USAGE: seunshare [ -v ] [ -t tmpdir ] [ -h homedir ] -- CONTEXT executable [args] "
-+
-+
+
++/**
++ * This function makes sure the mounted directory is owned by the user executing
++ * seunshare.
++ * If so, it returns 0. If it can not figure this out or they are different, it returns -1.
++ */
+static int verify_mount(const char *mntdir, struct passwd *pwd) {
+ struct stat sb;
+ if (stat(mntdir, &sb) == -1) {
-+ fprintf(stderr, "Invalid mount point %s: %s\n", mntdir, strerror(errno));
++ fprintf(stderr, _("Invalid mount point %s: %s\n"), mntdir, strerror(errno));
+ return -1;
+ }
+ if (sb.st_uid != pwd->pw_uid) {
+ errno = EPERM;
+ syslog(LOG_AUTHPRIV | LOG_ALERT, "%s attempted to mount an invalid directory, %s", pwd->pw_name, mntdir);
-+ perror("Invalid mount point, reporting to administrator");
++ perror(_("Invalid mount point, reporting to administrator"));
+ return -1;
+ }
+ return 0;
@@ -2490,15 +2330,15 @@ diff --exclude-from=exclude --exclude=se
+
+/**
+ * This function checks to see if the shell is known in /etc/shells.
-+ * If so, it returns 1. On error or illegal shell, it returns 0.
++ * If so, it returns 0. On error or illegal shell, it returns -1.
+ */
+static int verify_shell(const char *shell_name)
+{
-+ int found = 0;
++ int rc = -1;
+ const char *buf;
+
+ if (!(shell_name && shell_name[0]))
-+ return found;
++ return rc;
+
+ while ((buf = getusershell()) != NULL) {
+ /* ignore comments */
@@ -2507,28 +2347,29 @@ diff --exclude-from=exclude --exclude=se
+
+ /* check the shell skipping newline char */
+ if (!strcmp(shell_name, buf)) {
-+ found = 1;
++ rc = 1;
+ break;
+ }
+ }
+ endusershell();
-+ return found;
++ return rc;
+}
++
+static int seunshare_mount(const char *src, const char *dst, struct passwd *pwd) {
+ if (verbose)
+ printf("Mount %s on %s\n", src, dst);
+ if (mount(dst, dst, NULL, MS_BIND, NULL) < 0) {
-+ fprintf(stderr, "Failed to mount %s on %s: %s\n", dst, dst, strerror(errno));
++ fprintf(stderr, _("Failed to mount %s on %s: %s\n"), dst, dst, strerror(errno));
+ return -1;
+ }
+
+ if (mount(dst, dst, NULL, MS_PRIVATE, NULL) < 0) {
-+ fprintf(stderr, "Failed to make %s private: %s\n", dst, strerror(errno));
++ fprintf(stderr, _("Failed to make %s private: %s\n"), dst, strerror(errno));
+ return -1;
+ }
+
+ if (mount(src, dst, NULL, MS_BIND, NULL) < 0) {
-+ fprintf(stderr, "Failed to mount %s on %s: %s\n", src, dst, strerror(errno));
++ fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno));
+ return -1;
+ }
+
@@ -2536,6 +2377,8 @@ diff --exclude-from=exclude --exclude=se
+ return -1;
+}
+
++#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -t tmpdir ] [ -h homedir ] -- CONTEXT executable [args] ")
++
+int main(int argc, char **argv) {
+ int rc;
+ int status = -1;
@@ -2557,18 +2400,18 @@ diff --exclude-from=exclude --exclude=se
+ uid_t uid = getuid();
+
+ if (!uid) {
-+ fprintf(stderr, "Must not be root");
++ fprintf(stderr, _("Must not be root"));
+ return -1;
+ }
+
+ struct passwd *pwd=getpwuid(uid);
+ if (!pwd) {
-+ perror("getpwduid failed");
++ perror(_("getpwduid failed"));
+ return -1;
+ }
+
-+ if (verify_shell(pwd->pw_shell) == 0) {
-+ fprintf(stderr, "Error! Shell is not valid.\n");
++ if (verify_shell(pwd->pw_shell) < 0) {
++ fprintf(stderr, _("Error! Shell is not valid.\n"));
+ return -1;
+ }
+
@@ -2589,7 +2432,7 @@ diff --exclude-from=exclude --exclude=se
+ if (verify_mount(pwd->pw_dir, pwd) < 0) return -1;
+ break;
+ case 'v':
-+ verbose = TRUE;
++ verbose = 1;
+ break;
+ default:
+ fprintf(stderr, "%s\n", USAGE_STRING);
@@ -2598,13 +2441,13 @@ diff --exclude-from=exclude --exclude=se
+ }
+
+ if (! homedir_s && ! tmpdir_s) {
-+ fprintf(stderr, "Error: tmpdir and/or homedir required \n"
++ fprintf(stderr, _("Error: tmpdir and/or homedir required \n"),
+ "%s\n", USAGE_STRING);
+ return -1;
+ }
+
+ if (argc - optind < 2) {
-+ fprintf(stderr, "Error: executable required \n"
++ fprintf(stderr, _("Error: context and executable required \n"),
+ "%s\n", USAGE_STRING);
+ return -1;
+ }
@@ -2615,7 +2458,7 @@ diff --exclude-from=exclude --exclude=se
+ return -1;
+
+ if (unshare(CLONE_NEWNS) < 0) {
-+ perror("Failed to unshare");
++ perror(_("Failed to unshare"));
+ return -1;
+ }
+
@@ -2633,11 +2476,16 @@ diff --exclude-from=exclude --exclude=se
+ }
+
+ if (drop_capabilities(uid)) {
-+ perror("Failed to drop all capabilities");
++ perror(_("Failed to drop all capabilities"));
+ return -1;
+ }
+
+ int child = fork();
++ if (child == -1) {
++ perror(_("Unable to fork"));
++ return -1;
++ }
++
+ if (!child) {
+ char *display=NULL;
+ /* Construct a new environment */
@@ -2645,19 +2493,19 @@ diff --exclude-from=exclude --exclude=se
+ if (d) {
+ display = strdup(d);
+ if (!display) {
-+ perror("Out of memory");
++ perror(_("Out of memory"));
+ exit(-1);
+ }
+ }
+
+ if ((rc = clearenv())) {
-+ perror("Unable to clear environment");
++ perror(_("Unable to clear environment"));
+ free(display);
+ exit(-1);
+ }
+
+ if (setexeccon(scontext)) {
-+ fprintf(stderr, "Could not set exec context to %s.\n",
++ fprintf(stderr, _("Could not set exec context to %s.\n"),
+ scontext);
+ free(display);
+ exit(-1);
@@ -2672,7 +2520,7 @@ diff --exclude-from=exclude --exclude=se
+ rc |= setenv("PATH", DEFAULT_PATH, 1);
+
+ if (chdir(pwd->pw_dir)) {
-+ perror("Failed to change dir to homedir");
++ perror(_("Failed to change dir to homedir"));
+ exit(-1);
+ }
+ setsid();
Index: policycoreutils.spec
===================================================================
RCS file: /cvs/extras/rpms/policycoreutils/F-13/policycoreutils.spec,v
retrieving revision 1.709
retrieving revision 1.710
diff -u -p -r1.709 -r1.710
--- policycoreutils.spec 14 May 2010 13:03:04 -0000 1.709
+++ policycoreutils.spec 19 May 2010 17:59:29 -0000 1.710
@@ -7,7 +7,7 @@
Summary: SELinux policy core utilities
Name: policycoreutils
Version: 2.0.82
-Release: 18%{?dist}
+Release: 19%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
@@ -307,6 +307,9 @@ fi
exit 0
%changelog
+* Wed May 19 2010 Dan Walsh <dwalsh at redhat.com> 2.0.82-19
+- Fixes from upstream for sandbox command
+
* Thu May 13 2010 Dan Walsh <dwalsh at redhat.com> 2.0.82-18
- Fix sandbox error handling on copyfile
- Fix desktop files
More information about the scm-commits
mailing list