From f3291a1a4e41ff6e9fc188aa7f9864e00967c490 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Thu, 19 Nov 2015 10:59:03 -0800 Subject: Fix SELinux option parsing. --- src/lib/Bcfg2/Client/Tools/POSIX/__init__.py | 2 +- src/lib/Bcfg2/Client/Tools/POSIX/base.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py index c27c7559d..41bff751d 100644 --- a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py +++ b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py @@ -14,7 +14,7 @@ from Bcfg2.Client.Tools.POSIX.base import POSIXTool class POSIX(Bcfg2.Client.Tools.Tool): """POSIX File support code.""" - options = Bcfg2.Client.Tools.Tool.options + [ + options = Bcfg2.Client.Tools.Tool.options + POSIXTool.options + [ Bcfg2.Options.PathOption( cf=('paranoid', 'path'), default='/var/cache/bcfg2', dest='paranoid_path', diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/base.py b/src/lib/Bcfg2/Client/Tools/POSIX/base.py index 488920989..b1e754408 100644 --- a/src/lib/Bcfg2/Client/Tools/POSIX/base.py +++ b/src/lib/Bcfg2/Client/Tools/POSIX/base.py @@ -303,7 +303,7 @@ class POSIXTool(Bcfg2.Client.Tools.Tool): # no context listed return True secontext = selinux.lgetfilecon(path)[1].split(":")[2] - if secontext in Bcfg2.Options.setup.posix_secontext_ignore: + if secontext in Bcfg2.Options.setup.secontext_ignore: return True try: if context == '__default__': -- cgit v1.2.3-1-g7c22 From 8199191538593b6b24db2dc5c37c038aacd0ea0c Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Thu, 19 Nov 2015 10:59:48 -0800 Subject: Mock out selinux.lgetfilecon --- .../TestClient/TestTools/TestPOSIX/Testbase.py | 24 +++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py index ea4ca3f5f..065a26f05 100644 --- a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py +++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py @@ -481,11 +481,16 @@ class TestPOSIXTool(TestTool): @skipUnless(HAS_SELINUX, "SELinux not found, skipping") @patchIf(HAS_SELINUX, "selinux.restorecon") + @patchIf(HAS_SELINUX, "selinux.lgetfilecon") @patchIf(HAS_SELINUX, "selinux.lsetfilecon") - def test_set_secontext(self, mock_lsetfilecon, mock_restorecon): + def test_set_secontext(self, mock_lsetfilecon, mock_lgetfilecon, + mock_restorecon): + Bcfg2.Options.setup.secontext_ignore = ['dosfs_t'] ptool = self.get_obj() entry = lxml.etree.Element("Path", name="/etc/foo", type="file") + mock_lgetfilecon.return_value = (0, "system_u:object_r:foo_t") + # disable selinux for the initial test Bcfg2.Client.Tools.POSIX.base.HAS_SELINUX = False self.assertTrue(ptool._set_secontext(entry)) @@ -495,29 +500,46 @@ class TestPOSIXTool(TestTool): self.assertTrue(ptool._set_secontext(entry)) self.assertFalse(mock_restorecon.called) self.assertFalse(mock_lsetfilecon.called) + self.assertFalse(mock_lgetfilecon.called) mock_restorecon.reset_mock() mock_lsetfilecon.reset_mock() + mock_lgetfilecon.reset_mock() entry.set("secontext", "__default__") self.assertTrue(ptool._set_secontext(entry)) mock_restorecon.assert_called_with(entry.get("name")) + mock_lgetfilecon.assert_called_once_with(entry.get("name")) self.assertFalse(mock_lsetfilecon.called) mock_restorecon.reset_mock() mock_lsetfilecon.reset_mock() + mock_lgetfilecon.reset_mock() mock_lsetfilecon.return_value = 0 entry.set("secontext", "foo_t") self.assertTrue(ptool._set_secontext(entry)) self.assertFalse(mock_restorecon.called) + mock_lgetfilecon.assert_called_once_with(entry.get("name")) mock_lsetfilecon.assert_called_with(entry.get("name"), "foo_t") mock_restorecon.reset_mock() mock_lsetfilecon.reset_mock() + mock_lgetfilecon.reset_mock() mock_lsetfilecon.return_value = 1 self.assertFalse(ptool._set_secontext(entry)) self.assertFalse(mock_restorecon.called) + mock_lgetfilecon.assert_called_once_with(entry.get("name")) mock_lsetfilecon.assert_called_with(entry.get("name"), "foo_t") + # ignored filesystem + mock_restorecon.reset_mock() + mock_lsetfilecon.reset_mock() + mock_lgetfilecon.reset_mock() + mock_lgetfilecon.return_value = (0, "system_u:object_r:dosfs_t") + self.assertTrue(ptool._set_secontext(entry)) + self.assertFalse(mock_restorecon.called) + self.assertFalse(mock_lsetfilecon.called) + mock_lgetfilecon.assert_called_once_with(entry.get("name")) + @patch("grp.getgrnam") def test_norm_gid(self, mock_getgrnam): ptool = self.get_obj() -- cgit v1.2.3-1-g7c22 From 09da95213441569103749a2759cc7ed445edc66d Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Thu, 19 Nov 2015 11:56:55 -0800 Subject: Set secontext attribute to a full ucontext value, as the bcfg2 server will generate --- testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py index 065a26f05..bbe04a1a3 100644 --- a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py +++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Testbase.py @@ -708,7 +708,7 @@ class TestPOSIXTool(TestTool): ptool._gather_data = Mock() entry = lxml.etree.Element("Path", name="/test", type="file", group="group", owner="user", mode="664", - secontext='etc_t') + secontext='unconfined_u:object_r:etc_t:s0') # _verify_metadata() mutates the entry, so we keep a backup so we # can start fresh every time orig_entry = copy.deepcopy(entry) -- cgit v1.2.3-1-g7c22