63 lines
2.2 KiB
Diff
63 lines
2.2 KiB
Diff
From f39c0ac63749c1c5c140f1b1ad65d5e536bbe894 Mon Sep 17 00:00:00 2001
|
|
From: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
Date: Sun, 9 Dec 2018 15:23:23 +0100
|
|
Subject: [PATCH 091/170] python/chcat: fix removing categories on users with
|
|
Fedora default setup
|
|
|
|
Using Vagrant with fedora/28-cloud-base image, SELinux logins are
|
|
configured this way:
|
|
|
|
# semanage login -l
|
|
Login Name SELinux User MLS/MCS Range Service
|
|
|
|
__default__ unconfined_u s0-s0:c0.c1023 *
|
|
root unconfined_u s0-s0:c0.c1023 *
|
|
vagrant unconfined_u s0-s0:c0.c1023 *
|
|
|
|
Using "chcat -l +c42 vagrant" successfully adds the category to user
|
|
vagrant, but "chcat -l -- -c42 vagrant" fails to remove it.
|
|
semanage login -l returns:
|
|
|
|
vagrant unconfined_u s0-s0:c0.c1023,c42 *
|
|
|
|
This issue is caused by expandCats(), which refuses to return a list of
|
|
more than 25 categories. This causes chcat_user_remove() to work with
|
|
cats=['c0.c1023,c42'] instead of cats=['c0.c102','c42'], which leads to
|
|
it not been able to remove 'c42' from the list.
|
|
|
|
Fix this issue by splitting the list of categories before calling
|
|
expandCats().
|
|
|
|
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
---
|
|
python/chcat/chcat | 6 ++----
|
|
1 file changed, 2 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/selinux-python-2.8/chcat/chcat b/selinux-python-2.8/chcat/chcat
|
|
index 73f75725..5bef0073 100755
|
|
--- a/selinux-python-2.8/chcat/chcat
|
|
+++ b/selinux-python-2.8/chcat/chcat
|
|
@@ -82,8 +82,7 @@ def chcat_user_add(newcat, users):
|
|
if len(serange) > 1:
|
|
top = serange[1].split(":")
|
|
if len(top) > 1:
|
|
- cats.append(top[1])
|
|
- cats = expandCats(cats)
|
|
+ cats = expandCats(top[1].split(','))
|
|
|
|
for i in newcat[1:]:
|
|
if i not in cats:
|
|
@@ -163,8 +162,7 @@ def chcat_user_remove(newcat, users):
|
|
if len(serange) > 1:
|
|
top = serange[1].split(":")
|
|
if len(top) > 1:
|
|
- cats.append(top[1])
|
|
- cats = expandCats(cats)
|
|
+ cats = expandCats(top[1].split(','))
|
|
|
|
for i in newcat[1:]:
|
|
if i in cats:
|
|
--
|
|
2.19.1
|
|
|