IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

NSS: Force restore of SELinux context

Browse Source 
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
This commit is contained in:
Christian Heimes
2018-02-08 16:57:11 +01:00
parent 492e3c9b1e
commit 66a32d8931
3 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ipaplatform/base/tasks.py
View File

@@ -34,13 +34,11 @@ logger = logging.getLogger(__name__)
class BaseTaskNamespace(object): class BaseTaskNamespace(object):
def restore_context(self, filepath): def restore_context(self, filepath, force=False):
""" """Restore SELinux security context on the given filepath.
Restore SELinux security context on the given filepath.
No return value expected. No return value expected.
""" """
raise NotImplementedError() raise NotImplementedError()
def backup_hostname(self, fstore, statestore): def backup_hostname(self, fstore, statestore):

20
ipaplatform/redhat/tasks.py
View File

@@ -103,21 +103,27 @@ class IPAVersion(object):
class RedHatTaskNamespace(BaseTaskNamespace): class RedHatTaskNamespace(BaseTaskNamespace):
def restore_context(self, filepath, restorecon=paths.SBIN_RESTORECON): def restore_context(self, filepath, force=False):
""" """Restore SELinux security context on the given filepath.
restore security context on the file path
SELinux equivalent is /path/to/restorecon <filepath> SELinux equivalent is /path/to/restorecon <filepath>
restorecon's return values are not reliable so we have to restorecon's return values are not reliable so we have to
ignore them (BZ #739604). ignore them (BZ #739604).
ipautil.run() will do the logging. ipautil.run() will do the logging.
""" """
restorecon = paths.SBIN_RESTORECON
if not selinux_enabled(): if not selinux_enabled() or not os.path.exists(restorecon):
return return
if (os.path.exists(restorecon)): # Force reset of context to match file_context for customizable
ipautil.run([restorecon, filepath], raiseonerr=False) # files, and the default file context, changing the user, role,
# range portion as well as the type.
args = [restorecon]
if force:
args.append('-F')
args.append(filepath)
ipautil.run(args, raiseonerr=False)
def check_selinux_status(self, restorecon=paths.RESTORECON): def check_selinux_status(self, restorecon=paths.RESTORECON):
""" """

14
ipapython/certdb.py
View File

@@ -32,7 +32,6 @@ import shutil
import cryptography.x509 import cryptography.x509
from ipaplatform.constants import constants
from ipaplatform.paths import paths from ipaplatform.paths import paths
from ipaplatform.tasks import tasks from ipaplatform.tasks import tasks
from ipapython.dn import DN from ipapython.dn import DN
@@ -388,15 +387,16 @@ class NSSDatabase(object):
# Finally fix up perms # Finally fix up perms
os.chown(self.secdir, uid, gid) os.chown(self.secdir, uid, gid)
os.chmod(self.secdir, dirmode) os.chmod(self.secdir, dirmode)
tasks.restore_context(self.secdir, force=True)
for filename in self.filenames: for filename in self.filenames:
path = os.path.join(self.secdir, filename) if os.path.exists(filename):
if os.path.exists(path): os.chown(filename, uid, gid)
os.chown(path, uid, gid) if filename == self.pwd_file:
if path == self.pwd_file:
new_mode = pwdfilemode new_mode = pwdfilemode
else: else:
new_mode = filemode new_mode = filemode
os.chmod(path, new_mode) os.chmod(filename, new_mode)
tasks.restore_context(filename, force=True)
def convert_db(self, rename_old=True): def convert_db(self, rename_old=True):
"""Convert DBM database format to SQL database format """Convert DBM database format to SQL database format
@@ -438,7 +438,7 @@ class NSSDatabase(object):
oldstat = os.stat(oldname) oldstat = os.stat(oldname)
os.chmod(newname, stat.S_IMODE(oldstat.st_mode)) os.chmod(newname, stat.S_IMODE(oldstat.st_mode))
os.chown(newname, oldstat.st_uid, oldstat.st_gid) os.chown(newname, oldstat.st_uid, oldstat.st_gid)
tasks.restore_context(newname) tasks.restore_context(newname, force=True)
self._set_filenames('sql') self._set_filenames('sql')
self.list_certs() # self-test self.list_certs() # self-test