Change in vdsm[master]: Moving getSELinuxEnforeMode to utils
ybronhei at redhat.com
ybronhei at redhat.com
Fri Oct 24 12:42:15 UTC 2014
Yaniv Bronhaim has uploaded a new change for review.
Change subject: Moving getSELinuxEnforeMode to utils
......................................................................
Moving getSELinuxEnforeMode to utils
Change-Id: I801adfb0d8835ef9083f24ee5732219b8f719315
Signed-off-by: Yaniv Bronhaim <ybronhei at redhat.com>
---
A lib/vdsm/tool/configurators/sebool.py
M lib/vdsm/utils.py
M vdsm/caps.py
3 files changed, 112 insertions(+), 22 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/46/34446/1
diff --git a/lib/vdsm/tool/configurators/sebool.py b/lib/vdsm/tool/configurators/sebool.py
new file mode 100644
index 0000000..3b3a726
--- /dev/null
+++ b/lib/vdsm/tool/configurators/sebool.py
@@ -0,0 +1,90 @@
+# Copyright 2014 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+import seobject
+
+from .import \
+ CONFIGURED, \
+ ModuleConfigure, \
+ NOT_CONFIGURED
+
+from ... import utils
+
+
+class Configurator(ModuleConfigure):
+
+ SEBOOL_ENABLED = "on"
+ SEBOOL_DISABLED = "off"
+
+ VDSM_SEBOOL_LIST = [
+ "virt_use_fusefs",
+ "virt_use_nfs",
+ "virt_use_samba",
+ "virt_use_sanlock",
+ "sanlock_use_fusefs",
+ "sanlock_use_nfs",
+ "sanlock_use_samba",
+ ]
+
+ @property
+ def name(self):
+ return 'sebool'
+
+ def _setup_booleans(self, status):
+ sebool_obj = seobject.booleanRecords()
+ sebool_status = sebool_obj.get_all()
+
+ for sebool_variable in Configurator.VDSM_SEBOOL_LIST:
+ if status and not all(sebool_status[sebool_variable]):
+ sebool_obj.modify(sebool_variable, Configurator.SEBOOL_ENABLED)
+
+ if not status and any(sebool_status[sebool_variable]):
+ sebool_obj.modify(sebool_variable,
+ Configurator.SEBOOL_DISABLED)
+
+ sebool_obj.finish()
+
+ def isconfigured(self):
+ """
+ True all selinux booleans in the list above are set properly
+ """
+ ret = CONFIGURED
+
+ sebool_obj = seobject.booleanRecords()
+ sebool_status = sebool_obj.get_all()
+
+ for sebool_variable in Configurator.VDSM_SEBOOL_LIST:
+ if not all(sebool_status[sebool_variable]):
+ ret = NOT_CONFIGURED
+
+ return ret
+
+ def configure(self):
+ """
+ Configure selinux booleans (see list above)
+ """
+ if utils.getSELinuxEnforeMode > -1:
+ self._setup_booleans(True)
+
+ def removeConf(self):
+ """
+ Disabling selinux booleans (see list above)
+ """
+ if utils.getSELinuxEnforeMode > -1:
+ self._setup_booleans(False)
diff --git a/lib/vdsm/utils.py b/lib/vdsm/utils.py
index eb36440..d6a2fdb 100644
--- a/lib/vdsm/utils.py
+++ b/lib/vdsm/utils.py
@@ -1134,3 +1134,24 @@
flags = fcntl.fcntl(fd, fcntl.F_GETFL)
flags |= os.O_NONBLOCK
fcntl.fcntl(fd, fcntl.F_SETFL, flags)
+
+
+def getSELinuxEnforceMode():
+ """
+ Returns the SELinux mode as reported by kernel.
+
+ 1 = enforcing - SELinux security policy is enforced.
+ 0 = permissive - SELinux prints warnings instead of enforcing.
+ -1 = disabled - No SELinux policy is loaded.
+ """
+ selinux_mnts = ['/sys/fs/selinux', '/selinux']
+ for mnt in selinux_mnts:
+ enforce_path = os.path.join(mnt, 'enforce')
+ if not os.path.exists(enforce_path):
+ continue
+
+ with open(enforce_path) as fileStream:
+ return int(fileStream.read().strip())
+
+ # Assume disabled if cannot find
+ return -1
diff --git a/vdsm/caps.py b/vdsm/caps.py
index fed4163..f6e4426 100644
--- a/vdsm/caps.py
+++ b/vdsm/caps.py
@@ -586,30 +586,9 @@
return platform.machine()
-def _getSELinuxEnforceMode():
- """
- Returns the SELinux mode as reported by kernel.
-
- 1 = enforcing - SELinux security policy is enforced.
- 0 = permissive - SELinux prints warnings instead of enforcing.
- -1 = disabled - No SELinux policy is loaded.
- """
- selinux_mnts = ['/sys/fs/selinux', '/selinux']
- for mnt in selinux_mnts:
- enforce_path = os.path.join(mnt, 'enforce')
- if not os.path.exists(enforce_path):
- continue
-
- with open(enforce_path) as fileStream:
- return int(fileStream.read().strip())
-
- # Assume disabled if cannot find
- return -1
-
-
def _getSELinux():
selinux = dict()
- selinux['mode'] = str(_getSELinuxEnforceMode())
+ selinux['mode'] = str(utils.getSELinuxEnforceMode())
return selinux
--
To view, visit http://gerrit.ovirt.org/34446
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I801adfb0d8835ef9083f24ee5732219b8f719315
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Yaniv Bronhaim <ybronhei at redhat.com>
More information about the vdsm-patches
mailing list