Change in vdsm[master]: Moving getSELinuxEnforeMode to utils

ybronhei at redhat.com ybronhei at redhat.com
Fri Oct 24 12:42:15 UTC 2014


Yaniv Bronhaim has uploaded a new change for review.

Change subject: Moving getSELinuxEnforeMode to utils
......................................................................

Moving getSELinuxEnforeMode to utils

Change-Id: I801adfb0d8835ef9083f24ee5732219b8f719315
Signed-off-by: Yaniv Bronhaim <ybronhei at redhat.com>
---
A lib/vdsm/tool/configurators/sebool.py
M lib/vdsm/utils.py
M vdsm/caps.py
3 files changed, 112 insertions(+), 22 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/46/34446/1

diff --git a/lib/vdsm/tool/configurators/sebool.py b/lib/vdsm/tool/configurators/sebool.py
new file mode 100644
index 0000000..3b3a726
--- /dev/null
+++ b/lib/vdsm/tool/configurators/sebool.py
@@ -0,0 +1,90 @@
+# Copyright 2014 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+import seobject
+
+from .import \
+    CONFIGURED, \
+    ModuleConfigure, \
+    NOT_CONFIGURED
+
+from ... import utils
+
+
+class Configurator(ModuleConfigure):
+
+    SEBOOL_ENABLED = "on"
+    SEBOOL_DISABLED = "off"
+
+    VDSM_SEBOOL_LIST = [
+        "virt_use_fusefs",
+        "virt_use_nfs",
+        "virt_use_samba",
+        "virt_use_sanlock",
+        "sanlock_use_fusefs",
+        "sanlock_use_nfs",
+        "sanlock_use_samba",
+    ]
+
+    @property
+    def name(self):
+        return 'sebool'
+
+    def _setup_booleans(self, status):
+        sebool_obj = seobject.booleanRecords()
+        sebool_status = sebool_obj.get_all()
+
+        for sebool_variable in Configurator.VDSM_SEBOOL_LIST:
+            if status and not all(sebool_status[sebool_variable]):
+                sebool_obj.modify(sebool_variable, Configurator.SEBOOL_ENABLED)
+
+            if not status and any(sebool_status[sebool_variable]):
+                sebool_obj.modify(sebool_variable,
+                                  Configurator.SEBOOL_DISABLED)
+
+        sebool_obj.finish()
+
+    def isconfigured(self):
+        """
+        True all selinux booleans in the list above are set properly
+        """
+        ret = CONFIGURED
+
+        sebool_obj = seobject.booleanRecords()
+        sebool_status = sebool_obj.get_all()
+
+        for sebool_variable in Configurator.VDSM_SEBOOL_LIST:
+            if not all(sebool_status[sebool_variable]):
+                ret = NOT_CONFIGURED
+
+        return ret
+
+    def configure(self):
+        """
+        Configure selinux booleans (see list above)
+        """
+        if utils.getSELinuxEnforeMode > -1:
+            self._setup_booleans(True)
+
+    def removeConf(self):
+        """
+        Disabling selinux booleans (see list above)
+        """
+        if utils.getSELinuxEnforeMode > -1:
+            self._setup_booleans(False)
diff --git a/lib/vdsm/utils.py b/lib/vdsm/utils.py
index eb36440..d6a2fdb 100644
--- a/lib/vdsm/utils.py
+++ b/lib/vdsm/utils.py
@@ -1134,3 +1134,24 @@
     flags = fcntl.fcntl(fd, fcntl.F_GETFL)
     flags |= os.O_NONBLOCK
     fcntl.fcntl(fd, fcntl.F_SETFL, flags)
+
+
+def getSELinuxEnforceMode():
+    """
+    Returns the SELinux mode as reported by kernel.
+
+    1 = enforcing - SELinux security policy is enforced.
+    0 = permissive - SELinux prints warnings instead of enforcing.
+    -1 = disabled - No SELinux policy is loaded.
+    """
+    selinux_mnts = ['/sys/fs/selinux', '/selinux']
+    for mnt in selinux_mnts:
+        enforce_path = os.path.join(mnt, 'enforce')
+        if not os.path.exists(enforce_path):
+            continue
+
+        with open(enforce_path) as fileStream:
+            return int(fileStream.read().strip())
+
+    # Assume disabled if cannot find
+    return -1
diff --git a/vdsm/caps.py b/vdsm/caps.py
index fed4163..f6e4426 100644
--- a/vdsm/caps.py
+++ b/vdsm/caps.py
@@ -586,30 +586,9 @@
         return platform.machine()
 
 
-def _getSELinuxEnforceMode():
-    """
-    Returns the SELinux mode as reported by kernel.
-
-    1 = enforcing - SELinux security policy is enforced.
-    0 = permissive - SELinux prints warnings instead of enforcing.
-    -1 = disabled - No SELinux policy is loaded.
-    """
-    selinux_mnts = ['/sys/fs/selinux', '/selinux']
-    for mnt in selinux_mnts:
-        enforce_path = os.path.join(mnt, 'enforce')
-        if not os.path.exists(enforce_path):
-            continue
-
-        with open(enforce_path) as fileStream:
-            return int(fileStream.read().strip())
-
-    # Assume disabled if cannot find
-    return -1
-
-
 def _getSELinux():
     selinux = dict()
-    selinux['mode'] = str(_getSELinuxEnforceMode())
+    selinux['mode'] = str(utils.getSELinuxEnforceMode())
 
     return selinux
 


-- 
To view, visit http://gerrit.ovirt.org/34446
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I801adfb0d8835ef9083f24ee5732219b8f719315
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Yaniv Bronhaim <ybronhei at redhat.com>


More information about the vdsm-patches mailing list