added selinux support

4 files changed, 160 insertions, 35 deletions

diff --git a/src/lib/Bcfg2/Server/Admin/Compare.py b/src/lib/Bcfg2/Server/Admin/Compare.py
index 050dd69f8..78b30120a 100644
--- a/src/lib/Bcfg2/Server/Admin/Compare.py
+++ b/src/lib/Bcfg2/Server/Admin/Compare.py
@@ -18,7 +18,8 @@ class Compare(Bcfg2.Server.Admin.Mode):
                                    'important', 'paranoid', 'sensitive',
                                    'dev_type', 'major', 'minor', 'prune',
                                    'encoding', 'empty', 'to', 'recursive',
-                                   'vcstype', 'sourceurl', 'revision'],
+                                   'vcstype', 'sourceurl', 'revision',
+                                   'secontext'],
                           'Package': ['name', 'type', 'version', 'simplefile',
                                       'verify'],
                           'Service': ['name', 'type', 'status', 'mode',
diff --git a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
index 6f76cf2db..0a369c841 100644
--- a/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
+++ b/src/lib/Bcfg2/Server/Lint/RequiredAttrs.py
@@ -1,50 +1,114 @@
-import os.path
+import os
+import re
 import lxml.etree
 import Bcfg2.Server.Lint
+import Bcfg2.Client.Tools.POSIX
+import Bcfg2.Client.Tools.VCS
 from Bcfg2.Server.Plugins.Packages import Apt, Yum
 
+# format verifying functions
+def is_filename(val):
+    return val.startswith("/") and len(val) > 1
+
+def is_selinux_type(val):
+    return re.match(r'^[a-z_]+_t', val)
+
+def is_selinux_user(val):
+    return re.match(r'^[a-z_]+_u', val)
+
+def is_octal_mode(val):
+    return re.match(r'[0-7]{3,4}', val)
+
+def is_username(val):
+    return re.match(r'^([a-z]\w{0,30}|\d+)$', val)
+
+def is_device_mode(val):
+    try:
+        # checking upper bound seems like a good way to discover some
+        # obscure OS with >8-bit device numbers
+        return int(val) > 0
+    except:
+        return False
+
 class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
     """ verify attributes for configuration entries (as defined in
     doc/server/configurationentries) """
     def __init__(self, *args, **kwargs):
         Bcfg2.Server.Lint.ServerPlugin.__init__(self, *args, **kwargs)
-        self.required_attrs = {
-            'Path': {
-                'device': ['name', 'owner', 'group', 'dev_type'],
-                'directory': ['name', 'owner', 'group', 'perms'],
-                'file': ['name', 'owner', 'group', 'perms', '__text__'],
-                'hardlink': ['name', 'to'],
-                'symlink': ['name', 'to'],
-                'ignore': ['name'],
-                'nonexistent': ['name'],
-                'permissions': ['name', 'owner', 'group', 'perms'],
-                'vcs': ['vcstype', 'revision', 'sourceurl']},
-            'Service': {
-                'chkconfig': ['name'],
-                'deb': ['name'],
-                'rc-update': ['name'],
-                'smf': ['name', 'FMRI'],
-                'upstart': ['name']},
-            'Action': ['name', 'timing', 'when', 'status', 'command'],
-            'Package': ['name']}
+        self.required_attrs = dict(
+            Path=dict(
+                device=dict(name=is_filename, owner=is_username,
+                            group=is_username,
+                            dev_type=lambda v: \
+                                v in Bcfg2.Client.Tools.POSIX.device_map),
+                directory=dict(name=is_filename, owner=is_username,
+                               group=is_username, perms=is_octal_mode),
+                file=dict(name=is_filename, owner=is_username,
+                          group=is_username, perms=is_octal_mode,
+                          __text__=None),
+                hardlink=dict(name=is_filename, to=is_filename),
+                symlink=dict(name=is_filename, to=is_filename),
+                ignore=dict(name=is_filename),
+                nonexistent=dict(name=is_filename),
+                permissions=dict(name=is_filename, owner=is_username,
+                                 group=is_username, perms=is_octal_mode),
+                vcs=dict(vcstype=lambda v: (v != 'Path' and
+                                            hasattr(Bcfg2.Client.Tools.VCS,
+                                                    "Install%s" % v)),
+                         revision=None, sourceurl=None)),
+            Service={
+                "chkconfig": dict(name=None),
+                "deb": dict(name=None),
+                "rc-update": dict(name=None),
+                "smf": dict(name=None, FMRI=None),
+                "upstart": dict(name=None)},
+            Action={None: dict(name=None,
+                               timing=lambda v: v in ['pre', 'post', 'both'],
+                               when=lambda v: v in ['modified', 'always'],
+                               status=lambda v: v in ['ignore', 'check'],
+                               command=None)},
+            Package={None: dict(name=None)},
+            SELinux=dict(
+                boolean=dict(name=None,
+                             value=lambda v: v in ['on', 'off']),
+                module=dict(name=None, __text__=None),
+                port=dict(name=lambda v: re.match(r'^\d+(-\d+)?/(tcp|udp)', v),
+                          selinuxtype=is_selinux_type),
+                fcontext=dict(name=None, selinuxtype=is_selinux_type),
+                node=dict(name=lambda v: "/" in v,
+                          selinuxtype=is_selinux_type,
+                          proto=lambda v: v in ['ipv6', 'ipv4']),
+                login=dict(name=is_username,
+                           selinuxuser=is_selinux_user),
+                user=dict(name=is_selinux_user,
+                          roles=lambda v: all(is_selinux_user(u)
+                                              for u in " ".split(v)),
+                          prefix=None),
+                interface=dict(name=None, selinuxtype=is_selinux_type),
+                permissive=dict(name=is_selinux_type))
+            )
 
     def Run(self):
+        print "checking packages\n"
         self.check_packages()
         if "Defaults" in self.core.plugins:
             self.logger.info("Defaults plugin enabled; skipping required "
                              "attribute checks")
         else:
+            print "checking rules\n"
             self.check_rules()
+            print "checking bundles\n"
             self.check_bundles()
+        print 'done running RequiredAttrs'
 
     @classmethod
     def Errors(cls):
         return {"unknown-entry-type":"error",
                 "unknown-entry-tag":"error",
                 "required-attrs-missing":"error",
+                "required-attr-format":"error",
                 "extra-attrs":"warning"}
 
-
     def check_packages(self):
         """ check package sources for Source entries with missing attrs """
         if 'Packages' in self.core.plugins:
@@ -85,6 +149,7 @@ class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
         """ check bundles for BoundPath entries with missing attrs """
         if 'Bundler' in self.core.plugins:
             for bundle in self.core.plugins['Bundler'].entries.values():
+                print "checking bundle %s" % bundle.name
                 try:
                     xdata = lxml.etree.XML(bundle.data)
                 except (lxml.etree.XMLSyntaxError, AttributeError):
@@ -103,43 +168,52 @@ class RequiredAttrs(Bcfg2.Server.Lint.ServerPlugin):
             if tag not in self.required_attrs:
                 self.LintError("unknown-entry-tag",
                                "Unknown entry tag '%s': %s" %
-                               (entry.tag, self.RenderXML(entry)))
+                               (tag, self.RenderXML(entry)))
 
             if isinstance(self.required_attrs[tag], dict):
                 etype = entry.get('type')
                 if etype in self.required_attrs[tag]:
-                    required_attrs = set(self.required_attrs[tag][etype] +
-                                         ['type'])
+                    required_attrs = self.required_attrs[tag][etype] 
                 else:
                     self.LintError("unknown-entry-type",
                                    "Unknown %s type %s: %s" %
                                    (tag, etype, self.RenderXML(entry)))
                     return
             else:
-                required_attrs = set(self.required_attrs[tag])
+                required_attrs = self.required_attrs[tag]
             attrs = set(entry.attrib.keys())
 
             if 'dev_type' in required_attrs:
                 dev_type = entry.get('dev_type')
                 if dev_type in ['block', 'char']:
                     # check if major/minor are specified
-                    required_attrs |= set(['major', 'minor'])
+                    required_attrs['major'] = is_device_mode
+                    required_attrs['minor'] = is_device_mode
 
             if '__text__' in required_attrs:
-                required_attrs.remove('__text__')
+                del required_attrs['__text__']
                 if (not entry.text and
                     not entry.get('empty', 'false').lower() == 'true'):
                     self.LintError("required-attrs-missing",
                                    "Text missing for %s %s in %s: %s" %
-                                   (entry.tag, name, filename,
+                                   (tag, name, filename,
                                     self.RenderXML(entry)))
 
-            if not attrs.issuperset(required_attrs):
+            if not attrs.issuperset(required_attrs.keys()):
                 self.LintError("required-attrs-missing",
                                "The following required attribute(s) are "
                                "missing for %s %s in %s: %s\n%s" %
-                               (entry.tag, name, filename,
+                               (tag, name, filename,
                                 ", ".join([attr
                                            for attr in
                                            required_attrs.difference(attrs)]),
                                 self.RenderXML(entry)))
+
+            for attr, fmt in required_attrs.items():
+                if fmt and attr in attrs and not fmt(entry.attrib[attr]):
+                    self.LintError("required-attr-format",
+                                   "The %s attribute of %s %s in %s is "
+                                   "malformed\n%s" %
+                                   (attr, tag, name, filename,
+                                    self.RenderXML(entry)))
+                    
diff --git a/src/lib/Bcfg2/Server/Plugin.py b/src/lib/Bcfg2/Server/Plugin.py
index 98e6e6f51..d035b83d4 100644
--- a/src/lib/Bcfg2/Server/Plugin.py
+++ b/src/lib/Bcfg2/Server/Plugin.py
@@ -32,8 +32,9 @@ encoding = encparse['encoding']
 # grab default metadata info from bcfg2.conf
 opts = {'owner': Bcfg2.Options.MDATA_OWNER,
         'group': Bcfg2.Options.MDATA_GROUP,
-        'important': Bcfg2.Options.MDATA_IMPORTANT,
         'perms': Bcfg2.Options.MDATA_PERMS,
+        'secontext': Bcfg2.Options.MDATA_SECONTEXT,
+        'important': Bcfg2.Options.MDATA_IMPORTANT,
         'paranoid': Bcfg2.Options.MDATA_PARANOID,
         'sensitive': Bcfg2.Options.MDATA_SENSITIVE}
 mdata_setup = Bcfg2.Options.OptionParser(opts)
@@ -52,6 +53,7 @@ info_regex = re.compile( \
     'owner:(\s)*(?P<owner>\S+)|' +
     'paranoid:(\s)*(?P<paranoid>\S+)|' +
     'perms:(\s)*(?P<perms>\w+)|' +
+    'secontext:(\s)*(?P<secontext>\S+)|' +
     'sensitive:(\s)*(?P<sensitive>\S+)|')
 
 def bind_info(entry, metadata, infoxml=None, default=default_file_metadata):
@@ -1162,13 +1164,14 @@ class GroupSpool(Plugin, Generator):
     filename_pattern = ""
     es_child_cls = object
     es_cls = EntrySet
+    entry_type = 'Path'
 
     def __init__(self, core, datastore):
         Plugin.__init__(self, core, datastore)
         Generator.__init__(self)
         if self.data[-1] == '/':
             self.data = self.data[:-1]
-        self.Entries['Path'] = {}
+        self.Entries[self.entry_type] = {}
         self.entries = {}
         self.handles = {}
         self.AddDirectoryMonitor('')
@@ -1185,7 +1188,8 @@ class GroupSpool(Plugin, Generator):
                                               dirpath,
                                               self.es_child_cls,
                                               self.encoding)
-            self.Entries['Path'][ident] = self.entries[ident].bind_entry
+            self.Entries[self.entry_type][ident] = \
+                self.entries[ident].bind_entry
         if not posixpath.isdir(epath):
             # do not pass through directory events
             self.entries[ident].handle_event(event)
@@ -1231,7 +1235,7 @@ class GroupSpool(Plugin, Generator):
             if fbase in self.entries:
                 # a directory was deleted
                 del self.entries[fbase]
-                del self.Entries['Path'][fbase]
+                del self.Entries[self.entry_type][fbase]
             elif ident in self.entries:
                 self.entries[ident].handle_event(event)
             elif ident not in self.entries:
diff --git a/src/lib/Bcfg2/Server/Plugins/SEModules.py b/src/lib/Bcfg2/Server/Plugins/SEModules.py
new file mode 100644
index 000000000..2059baf60
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Plugins/SEModules.py
@@ -0,0 +1,46 @@
+import os
+import logging
+import binascii
+import posixpath
+
+import Bcfg2.Server.Plugin
+logger = logging.getLogger(__name__)
+
+class SEModuleData(Bcfg2.Server.Plugin.SpecificData):
+    def bind_entry(self, entry, _):
+        entry.set('encoding', 'base64')
+        entry.text = binascii.b2a_base64(self.data)
+
+
+class SEModules(Bcfg2.Server.Plugin.GroupSpool):
+    """ Handle SELinux 'module' entries """
+    name = 'SEModules'
+    __author__ = 'chris.a.st.pierre@gmail.com'
+    es_cls = Bcfg2.Server.Plugin.EntrySet
+    es_child_cls = SEModuleData
+    entry_type = 'SELinux'
+    experimental = True
+
+    def _get_module_name(self, entry):
+        """ GroupSpool stores entries as /foo.pp, but we want people
+        to be able to specify module entries as name='foo' or
+        name='foo.pp', so we put this abstraction in between """
+        if entry.get("name").endswith(".pp"):
+            name = entry.get("name")
+        else:
+            name = entry.get("name") + ".pp"
+        return "/" + name
+
+    def HandlesEntry(self, entry, metadata):
+        if entry.tag in self.Entries and entry.get('type') == 'module':
+            return self._get_module_name(entry) in self.Entries[entry.tag]
+        return Bcfg2.Server.Plugin.GroupSpool.HandlesEntry(self, entry,
+                                                           metadata)
+
+    def HandleEntry(self, entry, metadata):
+        entry.set("name", self._get_module_name(entry))
+        return self.Entries[entry.tag][name](entry, metadata)
+
+    def add_entry(self, event):
+        self.filename_pattern = os.path.basename(event.filename)
+        Bcfg2.Server.Plugin.GroupSpool.add_entry(self, event)