From be5899527891e889a2daa51c1b780b8d55f8ef33 Mon Sep 17 00:00:00 2001
From: Stephen Fromm <sfromm@gmail.com>
Date: Sat, 21 Apr 2012 23:27:34 -0700
Subject: [PATCH] Add context=default option to file module

This adjusts behavior of file module such that removal of se* option
does not revert the file's selinux context to the default.  In order to
go back to the default context according to the policy, you can use the
context=default option.
---
 library/file | 45 ++++++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 21 deletions(-)

diff --git a/library/file b/library/file
index 90d6892601..e0ebbecb17 100755
--- a/library/file
+++ b/library/file
@@ -72,6 +72,21 @@ def add_path_info(kwargs):
         kwargs['state'] = 'absent'
     return kwargs 
  
+# If selinux fails to find a default, return an array of None
+def selinux_default_context(path, mode=0):
+    context = [None, None, None, None]
+    if not HAVE_SELINUX:
+        return context
+    try:
+        ret = selinux.matchpathcon(path, mode)
+    except OSError:
+        return context
+    if ret[0] == -1:
+        return context
+    context = ret[1].split(':')
+    debug("got default secontext=%s" % ret[1])
+    return context
+
 # ===========================================
 
 argfile = sys.argv[1]
@@ -107,8 +122,16 @@ seuser    = params.get('seuser', None)
 serole    = params.get('serole', None)
 setype    = params.get('setype', None)
 selevel   = params.get('serange', 's0')
+context   = params.get('context', None)
 secontext = [seuser, serole, setype, selevel]
 
+if context is not None:
+    if context != 'default':
+        fail_json(msg='invalid context: %s' % context)
+    if seuser is not None or serole is not None or setype is not None:
+        fail_json(msg='cannot define context=default and seuser, serole or setype')
+    secontext = selinux_default_context(path)
+
 if state not in [ 'file', 'directory', 'link', 'absent']:
     fail_json(msg='invalid state: %s' % state)
 
@@ -148,34 +171,14 @@ def selinux_context(path):
     debug("got current secontext=%s" % ret[1])
     return context
 
-# If selinux fails to find a default, return an array of None
-def selinux_default_context(path, mode=0):
-    context = [None, None, None, None]
-    print >>sys.stderr, path
-    if not HAVE_SELINUX:
-        return context
-    try:
-        ret = selinux.matchpathcon(path, mode)
-    except OSError:
-        return context
-    if ret[0] == -1:
-        return context
-    context = ret[1].split(':')
-    debug("got default secontext=%s" % ret[1])
-    return context
-
 def set_context_if_different(path, context, changed):
     if not HAVE_SELINUX:
         return changed
     cur_context = selinux_context(path)
-    new_context = selinux_default_context(path)
+    new_context = list(cur_context)
     for i in range(len(context)):
         if context[i] is not None and context[i] != cur_context[i]:
-            debug('new context was %s' % new_context[i])
             new_context[i] = context[i]
-            debug('new context is %s' % new_context[i])
-        elif new_context[i] is None:
-            new_context[i] = cur_context[i]
     debug("current secontext is %s" % ':'.join(cur_context))
     debug("new secontext is %s" % ':'.join(new_context))
     if cur_context != new_context: