def selinux_is_label_valid(label): """ Check if the passed label is an actually valid selinux context label Returns False if selinux support is not present """ return bool(have_selinux() and (not hasattr(selinux, "context_new") or selinux.context_new(label)))
def selinux_role(self): """Setup proper selinux role. this must be called at beginning of process to adjust proper roles for selinux. it will re-execute the process with same arguments. This has similar effect of: # chcon -t rpm_exec_t executable.py We must do this dynamic as this class is to be used at bootstrap stage, so we cannot put any persistent selinux policy changes, and have no clue if filesystem where we put scripts supports extended attributes, or if we have proper role for chcon. """ try: import selinux except ImportError: with self.transaction(): self.install(['libselinux-python']) if self.buildTransaction(): self.processTransaction() # # on fedora-18 for example # the selinux core is updated # so we fail resolving symbols # solution is re-execute the process # after installation. # self._sink.reexec() os.execv(sys.executable, [sys.executable] + sys.argv) os._exit(1) if selinux.is_selinux_enabled(): rc, ctx = selinux.getcon() if rc != 0: raise Exception(_('Cannot get selinux context')) ctx1 = selinux.context_new(ctx) if not ctx1: raise Exception(_('Cannot create selinux context')) if selinux.context_type_get(ctx1) != 'rpm_t': if selinux.context_type_set(ctx1, 'rpm_t') != 0: raise Exception( _('Cannot set type within selinux context')) if selinux.context_role_set(ctx1, 'system_r') != 0: raise Exception( _('Cannot set role within selinux context')) if selinux.context_user_set(ctx1, 'unconfined_u') != 0: raise Exception( _('Cannot set user within selinux context')) if selinux.setexeccon(selinux.context_str(ctx1)) != 0: raise Exception(_('Cannot set selinux exec context')) self._sink.reexec() os.execv(sys.executable, [sys.executable] + sys.argv) os._exit(1)
def selinux_role(self): """Setup proper selinux role. this must be called at beginning of process to adjust proper roles for selinux. it will re-execute the process with same arguments. This has similar effect of: # chcon -t rpm_exec_t executable.py We must do this dynamic as this class is to be used at bootstrap stage, so we cannot put any persistent selinux policy changes, and have no clue if filesystem where we put scripts supports extended attributes, or if we have proper role for chcon. """ try: import selinux except ImportError: with self.transaction(): self.install(['libselinux-python']) if self.buildTransaction(): self.processTransaction() # # on fedora-18 for example # the selinux core is updated # so we fail resolving symbols # solution is re-execute the process # after installation. # self._sink.reexec() os.execv(sys.executable, [sys.executable] + sys.argv) os._exit(1) if selinux.is_selinux_enabled(): rc, ctx = selinux.getcon() if rc != 0: raise Exception(_('Cannot get selinux context')) ctx1 = selinux.context_new(ctx) if not ctx1: raise Exception(_('Cannot create selinux context')) if selinux.context_role_get(ctx1) != 'system_r': if selinux.context_role_set(ctx1, 'system_r') != 0: raise Exception( _('Cannot set role within selinux context') ) if selinux.setexeccon(selinux.context_str(ctx1)) != 0: raise Exception( _('Cannot set selinux exec context') ) self._sink.reexec() os.execv(sys.executable, [sys.executable] + sys.argv) os._exit(1)