ansible/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
Code Releases Activity

Merge pull request #251 from sfromm/selinux

Browse source 
Selinux -- more fun
This commit is contained in:
Michael DeHaan 2012-04-26 16:20:49 -07:00
commit b6bdb22341
1 changed files with 46 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
library/file
View file

@ -66,30 +66,64 @@ def add_path_info(kwargs):
kwargs['state'] = 'file'
else:
kwargs['state'] = 'directory'
if HAVE_SELINUX:
if HAVE_SELINUX and selinux_enabled():
kwargs['secontext'] = ':'.join(selinux_context(path))
else:
kwargs['state'] = 'absent'
return kwargs
# Detect whether using selinux that is MLS-aware.
# While this means you can set the level/range with
# selinux.lsetfilecon(), it may or may not mean that you
# will get the selevel as part of the context returned
# by selinux.lgetfilecon().
def selinux_mls_enabled():
if not HAVE_SELINUX:
return False
if selinux.is_selinux_mls_enabled() == 1:
debug('selinux mls is enabled')
return True
else:
debug('selinux mls is disabled')
return False
def selinux_enabled():
if not HAVE_SELINUX:
return False
if selinux.is_selinux_enabled() == 1:
debug('selinux is enabled')
return True
else:
debug('selinux is disabled')
return False
# Determine whether we need a placeholder for selevel/mls
def selinux_initial_context():
context = [None, None, None]
if selinux_mls_enabled():
context.append(None)
return context
# If selinux fails to find a default, return an array of None
def selinux_default_context(path, mode=0):
context = [None, None, None, None]
if not HAVE_SELINUX:
context = selinux_initial_context()
if not HAVE_SELINUX or not selinux_enabled():
return context
try:
ret = selinux.matchpathcon(path, mode)
except OSError:
debug("no default context available")
return context
if ret[0] == -1:
debug("no default context available")
return context
context = ret[1].split(':')
debug("got default secontext=%s" % ret[1])
return context
def selinux_context(path):
context = [None, None, None, None]
if not HAVE_SELINUX:
context = selinux_initial_context()
if not HAVE_SELINUX or not selinux_enabled():
return context
try:
ret = selinux.lgetfilecon(path)
@ -101,14 +135,6 @@ def selinux_context(path):
debug("got current secontext=%s" % ret[1])
return context
# Detect whether using selinux that is selevel-aware
# FWIW, rhel5 is not selevel-aware.
def selinux_has_selevel(path):
r = True
if len(selinux_context(path)) == 3:
r = False
return r
# ===========================================
argfile = sys.argv[1]
@ -146,7 +172,7 @@ setype = params.get('setype', None)
selevel = params.get('serange', 's0')
context = params.get('context', None)
secontext = [seuser, serole, setype]
if selinux_has_selevel(path):
if selinux_mls_enabled():
secontext.append(selevel)
if context is not None:
@ -182,14 +208,16 @@ def user_and_group(filename):
return (user, group)
def set_context_if_different(path, context, changed):
if not HAVE_SELINUX:
if not HAVE_SELINUX or not selinux_enabled():
return changed
cur_context = selinux_context(path)
new_context = list(cur_context)
for i in range(len(context)):
debug("current secontext is %s" % ':'.join(cur_context))
# Iterate over the current context instead of the
# argument context, which may have selevel.
for i in range(len(cur_context)):
if context[i] is not None and context[i] != cur_context[i]:
new_context[i] = context[i]
debug("current secontext is %s" % ':'.join(cur_context))
debug("new secontext is %s" % ':'.join(new_context))
if cur_context != new_context:
try: