Changeset 654dcb897e49908a958dae55cf29793412c4b390

Timestamp:

03/06/10 16:56:24 (5 months ago)

Author:

Joshua Brindle <method@manicmethod.com>

Committer:

Joshua Brindle <method@manicmethod.com> 1267916184 -0500

Parent:

[660f70f4c4c169214da8ac670fbecfb37ce3d2d5]

Message:

Last attempt at upstreaming semodule_disable patch.

This patch allows you to disable/Enable policy modules.

It never seems to get upstreamed. :⁽

Signed-off-by: Joshua Brindle <method@manicmethod.com>

Files:

• libsemanage/include/semanage/modules.h (modified) (2 diffs)
• libsemanage/src/direct_api.c (modified) (7 diffs)
• libsemanage/src/libsemanage.map (modified) (1 diff)
• libsemanage/src/module_internal.h (modified) (1 diff)
• libsemanage/src/modules.c (modified) (2 diffs)
• libsemanage/src/modules.h (modified) (1 diff)
• libsemanage/src/policy.h (modified) (1 diff)
• libsemanage/src/semanage_store.c (modified) (6 diffs)
• libsemanage/src/semanage_store.h (modified) (1 diff)
• policycoreutils/semodule/semodule.8 (modified) (1 diff)
• policycoreutils/semodule/semodule.c (modified) (8 diffs)

libsemanage/include/semanage/modules.h

@@ -41 +41 @@
-int semanage_module_install_base_file(semanage_handle_t *,
-                                      const char *module_name);
+int semanage_module_enable(semanage_handle_t *, char *module_name);
+int semanage_module_disable(semanage_handle_t *, char *module_name);
-int semanage_module_remove(semanage_handle_t *, char *module_name);
-
-/* semanage_module_info is for getting information on installed
-
+, and enabled/disabled flag
-typedef struct semanage_module_info semanage_module_info_t;
-
@@ -54 +56 @@
-const char *semanage_module_get_name(semanage_module_info_t *);
-const char *semanage_module_get_version(semanage_module_info_t *);
+int semanage_module_get_enabled(semanage_module_info_t *);
-
-#endif

libsemanage/src/direct_api.c

@@ -67 +67 @@
-                                        size_t data_len);
-static int semanage_direct_install_base_file(semanage_handle_t * sh, const char *module_name);
+static int semanage_direct_enable(semanage_handle_t * sh, char *module_name);
+static int semanage_direct_disable(semanage_handle_t * sh, char *module_name);
-static int semanage_direct_remove(semanage_handle_t * sh, char *module_name);
-static int semanage_direct_list(semanage_handle_t * sh,
@@ -84 +86 @@
-        .install_base = semanage_direct_install_base,
-        .install_base_file = semanage_direct_install_base_file,
+        .enable = semanage_direct_enable,
+        .disable = semanage_direct_disable,
-        .remove = semanage_direct_remove,
-        .list = semanage_direct_list
@@ -349 +353 @@
-                return -1;
-        }
-", module_path, *module_name
+%s", module_path, *module_name, DISABLESTR
-                ERR(sh, "Out of memory!");
-                return -1;
-        }
+
+        if (access(*filename, F_OK) == -1) {
+                char *ptr = *filename;
+                int len = strlen(ptr) - strlen(DISABLESTR);
+                if (len > 0) ptr[len]='\0';
+        }
+
-        return 0;
-}
@@ -1274 +1285 @@
-}
-
-Remov
-remov
-remov
+Enabl
+enabl
+enabl
-{
-        int i, retval = -1;
@@ -1295 +1306 @@
-                base++;
-                if (memcmp(module_name, base, name_len) == 0 &&
+                    strcmp(base + name_len + 3, DISABLESTR) == 0) {
+                        int len = strlen(module_filenames[i]) - strlen(DISABLESTR);
+                        char *enabled_name = calloc(1, len+1);
+                        if (!enabled_name) {
+                                ERR(sh, "Could not allocate memory");
+                                retval = -1;
+                                goto cleanup;
+                        }
+
+                        strncpy(enabled_name, module_filenames[i],len);
+
+                        if (rename(module_filenames[i], enabled_name) == -1) {
+                                ERR(sh, "Could not enable module file %s.",
+                                    enabled_name);
+                                retval = -2;
+                        }
+                        retval = 0;
+                        free(enabled_name);
+                        goto cleanup;
+                }
+        }
+        ERR(sh, "Module %s was not found.", module_name);
+        retval = -2;            /* module not found */
+      cleanup:
+        for (i = 0; module_filenames != NULL && i < num_mod_files; i++) {
+                free(module_filenames[i]);
+        }
+        free(module_filenames);
+        return retval;
+}
+
+/* Enables a module from the sandbox.  Returns 0 on success, -1 if out
+ * of memory, -2 if module not found or could not be enabled. */
+static int semanage_direct_disable(semanage_handle_t * sh, char *module_name)
+{
+        int i, retval = -1;
+        char **module_filenames = NULL;
+        int num_mod_files;
+        size_t name_len = strlen(module_name);
+        if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) ==
+            -1) {
+                return -1;
+        }
+        for (i = 0; i < num_mod_files; i++) {
+                char *base = strrchr(module_filenames[i], '/');
+                if (base == NULL) {
+                        ERR(sh, "Could not read module names.");
+                        retval = -2;
+                        goto cleanup;
+                }
+                base++;
+                if (memcmp(module_name, base, name_len) == 0 &&
-                    strcmp(base + name_len, ".pp") == 0) {
+                        char disabled_name[PATH_MAX];
+                        if (snprintf(disabled_name, PATH_MAX, "%s%s", 
+                                     module_filenames[i], DISABLESTR) == PATH_MAX) {
+                                ERR(sh, "Could not disable module file %s.",
+                                    module_filenames[i]);
+                                retval = -2;
+                                goto cleanup;
+                        }
+                        if (rename(module_filenames[i], disabled_name) == -1) {
+                                ERR(sh, "Could not disable module file %s.",
+                                    module_filenames[i]);
+                                retval = -2;
+                        }
+                        retval = 0;
+                        goto cleanup;
+                }
+        }
+        ERR(sh, "Module %s was not found.", module_name);
+        retval = -2;            /* module not found */
+      cleanup:
+        for (i = 0; module_filenames != NULL && i < num_mod_files; i++) {
+                free(module_filenames[i]);
+        }
+        free(module_filenames);
+        return retval;
+}
+
+/* Removes a module from the sandbox.  Returns 0 on success, -1 if out
+ * of memory, -2 if module not found or could not be removed. */
+static int semanage_direct_remove(semanage_handle_t * sh, char *module_name)
+{
+        int i, retval = -1;
+        char **module_filenames = NULL;
+        int num_mod_files;
+        size_t name_len = strlen(module_name);
+        if (semanage_get_modules_names(sh, &module_filenames, &num_mod_files) ==
+            -1) {
+                return -1;
+        }
+        for (i = 0; i < num_mod_files; i++) {
+                char *base = strrchr(module_filenames[i], '/');
+                if (base == NULL) {
+                        ERR(sh, "Could not read module names.");
+                        retval = -2;
+                        goto cleanup;
+                }
+                base++;
+                if (memcmp(module_name, base, name_len) == 0) {
-                        if (unlink(module_filenames[i]) == -1) {
-                                ERR(sh, "Could not remove module file %s.",
@@ -1370 +1481 @@
-                ssize_t size;
-                char *data = NULL;
+                int enabled = semanage_module_enabled(module_filenames[i]);
-
-                if ((size = bunzip(sh, fp, &data)) > 0) {
@@ -1390 +1502 @@
-                        (*modinfo)[*num_modules].name = name;
-                        (*modinfo)[*num_modules].version = version;
+                        (*modinfo)[*num_modules].enabled = enabled;
-                        (*num_modules)++;
-                } else {

libsemanage/src/libsemanage.map

@@ -7 +7 @@
-          semanage_module_upgrade; semanage_module_upgrade_file;
-          semanage_module_install_base; semanage_module_install_base_file;
+          semanage_module_enable;
+          semanage_module_disable;
-          semanage_module_remove;
-          semanage_module_list; semanage_module_info_datum_destroy;
-          semanage_module_list_nth; semanage_module_get_name;
-          semanage_module_get_version; semanage_select_store;
+          semanage_module_get_enabled;
-          semanage_reload_policy; semanage_set_reload; semanage_set_rebuild;
-          semanage_user_*; semanage_bool_*; semanage_seuser_*;

libsemanage/src/module_internal.h

@@ -7 +7 @@
-hidden_proto(semanage_module_get_name)
-    hidden_proto(semanage_module_get_version)
+    hidden_proto(semanage_module_get_enabled)
-    hidden_proto(semanage_module_info_datum_destroy)
-    hidden_proto(semanage_module_list_nth)

libsemanage/src/modules.c

@@ -155 +155 @@
-}
-
+int semanage_module_enable(semanage_handle_t * sh, char *module_name)
+{
+        if (sh->funcs->enable == NULL) {
+                ERR(sh, "No enable function defined for this connection type.");
+                return -1;
+        } else if (!sh->is_connected) {
+                ERR(sh, "Not connected.");
+                return -1;
+        } else if (!sh->is_in_transaction) {
+                if (semanage_begin_transaction(sh) < 0) {
+                        return -1;
+                }
+        }
+        sh->modules_modified = 1;
+        return sh->funcs->enable(sh, module_name);
+}
+
+int semanage_module_disable(semanage_handle_t * sh, char *module_name)
+{
+        if (sh->funcs->disable == NULL) {
+                ERR(sh, "No disable function defined for this connection type.");
+                return -1;
+        } else if (!sh->is_connected) {
+                ERR(sh, "Not connected.");
+                return -1;
+        } else if (!sh->is_in_transaction) {
+                if (semanage_begin_transaction(sh) < 0) {
+                        return -1;
+                }
+        }
+        sh->modules_modified = 1;
+        return sh->funcs->disable(sh, module_name);
+}
+
-int semanage_module_remove(semanage_handle_t * sh, char *module_name)
-{
@@ -210 +244 @@
-hidden_def(semanage_module_get_name)
-
+int semanage_module_get_enabled(semanage_module_info_t * modinfo)
+{
+        return modinfo->enabled;
+}
+
+hidden_def(semanage_module_get_enabled)
+
-const char *semanage_module_get_version(semanage_module_info_t * modinfo)
-{

libsemanage/src/modules.h

@@ -27 +27 @@
-        char *name;             /* Key */
-        char *version;
+        int enabled;
-};
-

libsemanage/src/policy.h

@@ -59 +59 @@
-        int (*upgrade_file) (struct semanage_handle *, const char *);
-
+        /* Enable a policy module */
+        int (*enable) (struct semanage_handle *, char *);
+
+        /* Disable a policy module */
+        int (*disable) (struct semanage_handle *, char *);
+
-        /* Remove a policy module */
-        int (*remove) (struct semanage_handle *, char *);

libsemanage/src/semanage_store.c

@@ -57 +57 @@
-
-#include "debug.h"
+
+const char *DISABLESTR=".disabled";
-
-#define SEMANAGE_CONF_FILE "semanage.conf"
@@ -434 +436 @@
-}
-
+int semanage_module_enabled(const char *file) {
+        int len = strlen(file) - strlen(DISABLESTR);
+        return (len < 0 || strcmp(&file[len], DISABLESTR) != 0);
+}
+
+static int semanage_modulename_select(const struct dirent *d)
+{
+        if (d->d_name[0] == '.'
+            && (d->d_name[1] == '\0'
+                || (d->d_name[1] == '.' && d->d_name[2] == '\0')))
+                return 0;
+
+        return semanage_module_enabled(d->d_name);
+}
+
-/* Copies a file from src to dst.  If dst already exists then
- * overwrite it.  Returns 0 on success, -1 on error. */
@@ -600 +617 @@
-}
-
-
-
-
-
-
-
-
-
-
+
+
-{
-        const char *modules_path;
@@ -623 +633 @@
-        *len = 0;
-        if ((num_files = scandir(modules_path, &namelist,
-semanage_filename_select
+filter
-                ERR(sh, "Error while scanning directory %s.", modules_path);
-                goto cleanup;
@@ -662 +672 @@
-        free(namelist);
-        return retval;
+}
+
+/* Scans the modules directory for the current semanage handler.  This
+ * might be the active directory or sandbox, depending upon if the
+ * handler has a transaction lock.  Allocates and fills in *filenames
+ * with an array of module filenames; length of array is stored in
+ * *len.  The caller is responsible for free()ing *filenames and its
+ * individual elements.  Upon success returns 0, -1 on error.
+ */
+int semanage_get_modules_names(semanage_handle_t * sh, char ***filenames,
+                               int *len)
+{
+        return semanage_get_modules_names_filter(sh, filenames,
+                                                 len, semanage_filename_select);
+}
+
+/* Scans the modules directory for the current semanage handler.  This
+ * might be the active directory or sandbox, depending upon if the
+ * handler has a transaction lock.  Allocates and fills in *filenames
+ * with an array of module filenames; length of array is stored in
+ * *len.  The caller is responsible for free()ing *filenames and its
+ * individual elements.  Upon success returns 0, -1 on error.
+ */
+int semanage_get_active_modules_names(semanage_handle_t * sh, char ***filenames,
+                               int *len)
+{
+        return semanage_get_modules_names_filter(sh, filenames,
+                                                 len, semanage_modulename_select);
-}
-
@@ -1586 +1624 @@
-
-        /* get list of modules and load them */
-
+active_
-            -1 || semanage_load_module(sh, base_filename, base) == -1) {
-                goto cleanup;

libsemanage/src/semanage_store.h

@@ -129 +129 @@
-                     char **sorted_buf, size_t * sorted_buf_len);
-
+extern const char *DISABLESTR;
+
-#endif

policycoreutils/semodule/semodule.8

@@ -35 +35 @@
-.B  \-b,\-\-base=MODULE_PKG   
-install/replace base module package
+.TP
+.B  \-d,\-\-disable=MODULE_NAME
+disable existing module
+.TP
+.B  \-e,\-\-enable=MODULE_NAME
+enable existing module
-.TP
-.B  \-r,\-\-remove=MODULE_NAME

policycoreutils/semodule/semodule.c

@@ -23 +23 @@
-#include <semanage/modules.h>
-
-
+ENABLE_M, DISABLE_M, 
-        LIST_M, RELOAD
-};
-/* list of modes in which one ought to commit afterwards */
-static const int do_commit[] = {
-
+ 1, 1,
-        0, 0
-};
@@ -105 +105 @@
-        printf("  -B, --build               build and reload policy\n");
-        printf("  -i,--install=MODULE_PKG   install a new module\n");
-s or install module to a newer version
+ existing module
-        printf("  -b,--base=MODULE_PKG      install new base module\n");
-
+
+
+
-        printf
-            ("  -l,--list-modules         display list of installed modules\n");
@@ -153 +155 @@
-                {"list-modules", 0, NULL, 'l'},
-                {"verbose", 0, NULL, 'v'},
+                {"enable", required_argument, NULL, 'e'},
+                {"disable", required_argument, NULL, 'd'},
-                {"remove", required_argument, NULL, 'r'},
-                {"upgrade", required_argument, NULL, 'u'},
@@ -167 +171 @@
-        create_store = 0;
-        while ((i =
-
+e:d:
-                            NULL)) != -1) {
-                switch (i) {
@@ -185 +189 @@
-                case 'v':
-                        verbose = 1;
+                        break;
+                case 'e':
+                        set_mode(ENABLE_M, optarg);
+                        break;
+                case 'd':
+                        set_mode(DISABLE_M, optarg);
-                        break;
-                case 'r':
@@ -239 +249 @@
-                } else if (commands && commands[num_commands - 1].mode == REMOVE_M) {
-                        mode = REMOVE_M;
+                } else if (commands && commands[num_commands - 1].mode == ENABLE_M) {
+                        mode = ENABLE_M;
+                } else if (commands && commands[num_commands - 1].mode == DISABLE_M) {
+                        mode = DISABLE_M;
-                } else {
-                        fprintf(stderr, "unknown additional arguments:\n");
@@ -351 +365 @@
-                                result =
-                                    semanage_module_install_base_file(sh, mode_arg);
+                                break;
+                        }
+                case ENABLE_M:{
+                                if (verbose) {
+                                        printf
+                                            ("Attempting to enable module '%s':\n",
+                                             mode_arg);
+                                }
+                                result = semanage_module_enable(sh, mode_arg);
+                                if ( result == -2 ) { 
+                                        continue;
+                                }
+                                break;
+                        }
+                case DISABLE_M:{
+                                if (verbose) {
+                                        printf
+                                            ("Attempting to disable module '%s':\n",
+                                             mode_arg);
+                                }
+                                result = semanage_module_disable(sh, mode_arg);
+                                if ( result == -2 ) { 
+                                        continue;
+                                }
-                                break;
-                        }
@@ -383 +421 @@
-                                                    semanage_module_list_nth
-                                                    (modinfo, j);
-
+t%s\
-                                                       semanage_module_get_name
-                                                       (m),
-                                                       semanage_module_get_version
-
+
+
-                                                semanage_module_info_datum_destroy
-                                                    (m);