Current File : //lib/python2.7/site-packages/salt/states/selinux.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l m Z d � Z d � Z d � Z d � Z
d � Z e d � Z
d
d d � Z d
� Z d � Z d d d d � Z d d d d d � Z e d � Z d d d d � Z d d d d � Z d S( u�
Management of SELinux rules
===========================
If SELinux is available for the running system, the mode can be managed and
booleans can be set.
.. code-block:: yaml
enforcing:
selinux.mode
samba_create_home_dirs:
selinux.boolean:
- value: True
- persist: True
nginx:
selinux.module:
- enabled: False
.. note::
Use of these states require that the :mod:`selinux <salt.modules.selinux>`
execution module is available.
i ( t absolute_importt unicode_literalst print_function( t sixc C@ s d t k r d St S( uL
Only make this state available if the selinux module is available.
u selinux.getenforceu selinux( t __salt__t False( ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt __virtual__" s c C@ s� t j | � j � } t | j d � | d k | d k g � rC d St | j d � | d k | d k g � rq d St | j d � g � r� d
Sd S( u1
Return a mode value that is predictable
u eu 1u onu Enforcingu pu 0u offu
Permissiveu du Disabledu unknown( R t text_typet lowert anyt
startswith( t mode( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt _refine_mode) s c C@ s9 t j | � j � } | d k r% d S| d
k r5 d Sd S( u@
Return a yes/no value, or None if the input is invalid
u 1u onu yesu trueu 0u offu nou false( u 1u onu yesu true( u 0u offu nou falseN( R R R t None( t value( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt
_refine_value; s c C@ s9 t j | � j � } | d k r% d S| d
k r5 d
Sd S( u]
Return a predictable value, or allow us to error out
.. versionadded:: 2016.3.0
u 1u onu yesu trueu enabledu 0u offu nou falseu disabledu unknown( u 1u onu yesu trueu enabled( u 0u offu nou falseu disabled( R R R ( t module_state( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt _refine_module_stateG s c C@ s� i | d 6t d 6d d 6i d 6} t | � } | d k rQ d j | � | d <| St d � } t d � } | | k r� | | k r� | | k r� | } n | | k r� t | d <d
j | � | d <| St d rd j | � | d <d | d <i | d
6| d 6| d <| S| t d | � } } | | k sJ| d k r�t d � | k r�t | d <d j | � | d <i | d
6| d 6| d <| Sd j | � | d <| S( u<
Verifies the mode SELinux is running in, can be set to enforcing,
permissive, or disabled
.. note::
A change to or from disabled mode requires a system reboot. You will
need to perform this yourself.
name
The mode to run SELinux in, permissive, enforcing, or disabled.
u nameu resultu u commentu changesu unknownu {0} is not an accepted modeu selinux.getenforceu selinux.getconfigu SELinux is already in {0} modeu testu( SELinux mode is set to be changed to {0}u oldu newu selinux.setenforceu Disabledu SELinux has been set to {0} modeu! Failed to set SELinux to {0} modeN( R R t formatR t Truet __opts__R
( t namet rett tmodeR t configt oldmode( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyR T s@
$
+
c C@ s� i | d 6t d 6d d 6i d 6} t d � } | | k r\ d j | � | d <t | d <| St | � } | d k r� d j | � | d <t | d <| S| | d | k } | | d
| k } | r� | r� | r� d | d <| Sn | r� d | d <| St d r"d | d <d
j | | � | d <| St d | | | � | d <| d r�d j | | � | d <| d j i i | | d d 6| d 6d 6� | r�| r�| d j i i | | d
d 6| d 6d
6� n | Sd j | | � | d <| S( u�
Set up an SELinux boolean
name
The name of the boolean to set
value
The value to set on the boolean
persist
Defaults to False, set persist to true to make the boolean apply on a
reboot
u nameu resultu u commentu changesu selinux.list_seboolu Boolean {0} is not availableu( {0} is not a valid value for the booleanu Stateu Defaultu Boolean is in the correct stateu testu' Boolean {0} is set to be changed to {1}u selinux.setseboolu Boolean {0} has been set to {1}u oldu newu$ Failed to set the boolean {0} to {1}N( R R R R R R
R t update( R R t persistR t boolst rvaluet statet default( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt boolean� sP
u Enabledu anyc
K@ s4 i | d 6t d 6d d 6i d 6} | j d t � r^ | j d t � r^ t | d <d | d <| S| j d t � r� | j d | � } t | � } | d s� | Sn | j d t � r� t | � St d
� } | | k r� d j | � | d <t | d <| St | � } | d k r1d
j | t � | d <t | d <| S| d k r~| | d } | | k s~d j | | � | d <t | d <| Sn t | | d � } | | k r�d j | � | d <| St d r�d | d <d j | | � | d <| St d | | � rd j | | � | d <| St | d <d j | | � | d <| S( u;
Enable/Disable and optionally force a specific version for an SELinux module
name
The name of the module to control
module_state
Should the module be enabled or disabled?
version
Defaults to no preference, set to a specified value if required.
Currently can only alert if the version is incorrect.
install
Setting to True installs module
source
Points to module source file, used only when install is True
remove
Setting to True removes module
.. versionadded:: 2016.3.0
u nameu resultu u commentu changesu installu removeu* Cannot install and remove at the same timeu sourceu selinux.list_semodu Module {0} is not availableu unknownu, {0} is not a valid state for the {1} module.u anyu Versionud Module version is {0} and does not match the desired version of {1} or you are using semodule >= 2.4u Enabledu" Module {0} is in the desired stateu testu& Module {0} is set to be toggled to {1}u selinux.setsemodu Module {0} has been set to {1}u# Failed to set the Module {0} to {1}N( R t getR t module_installt
module_removeR R R t moduleR R
(
R R t versiont optsR t module_patht modulest
rmodule_statet installed_versiont current_module_state( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyR$ � s`
$
c C@ sj i | d 6t d 6d d 6i d 6} t d | � rI d j | � | d <| St | d <d j | � | d <| S( u�
Installs custom SELinux module from given file
name
Path to file with module to install
.. versionadded:: 2016.11.6
u nameu resultu u commentu changesu selinux.install_semodu Module {0} has been installedu Failed to install module {0}( R R R R ( R R ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyR" s
c C@ s� i | d 6t d 6d d 6i d 6} t d � } | | k r\ d j | � | d <t | d <| St d | � r� d j | � | d <| St | d <d
j | � | d <| S( ut
Removes SELinux module
name
The name of the module to remove
.. versionadded:: 2016.11.6
u nameu resultu u commentu changesu selinux.list_semodu Module {0} is not availableu selinux.remove_semodu Module {0} has been removedu Failed to remove module {0}( R R R R ( R R R( ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyR# $ s
u ac C@ sn i | d 6t d 6i d 6d d 6} i } i } t d | � } t d d | d | d
| d | d | � } | s i i | d
6| d 6| 6} t d r� | j i d d 6� q2t d d | d | d
| d | d | � }
|
d d k r| j i d j |
� d 6� q2| j i t d 6� n| d | k rj| j i i | d d 6| 6� | j i i | d 6| 6� n8 | j i t d 6d j | � d j | | � d 6� | St d r�| j i d d 6� no t d d | d | d
| d | d | � } | d d k r | j i d j | � d 6� n | j i t d 6� | d rj| sH| rj| d j i | d 6| d 6� n | S( u"
.. versionadded:: 2017.7.0
Makes sure a SELinux policy for a given filespec (name), filetype
and SELinux context type is present.
name
filespec of the file or directory. Regex syntax is allowed.
sel_type
SELinux context type. There are many.
filetype
The SELinux filetype specification. Use one of [a, f, d, c, b,
s, l, p]. See also `man semanage-fcontext`. Defaults to 'a'
(all files).
sel_user
The SELinux user.
sel_level
The SELinux MLS range.
u nameu resultu changesu u commentu selinux.filetype_id_to_stringu selinux.fcontext_get_policyR t filetypet sel_typet sel_usert sel_levelu filetypeu sel_typeu testu selinux.fcontext_add_policyu retcodei u Error adding new rule: {0}u) SELinux policy for "{0}" already present u1 with specified filetype "{0}" and sel_type "{1}".u oldu newN( R R R R R
R R ( R R- R, R. R/ R t new_statet old_statet filetype_strt
current_statet add_rett
change_ret( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt fcontext_policy_present> s\ "
"c
C@ sh i | d 6t d 6i d 6d d 6} i } i } t d d | d | d | d
| d | � } | s� | j i t d 6d j | � d
j | | � d 6� | S| j i | | 6� | d j i | d 6| d 6� t d r� | j i d d 6� ny t d d | d | d | p| d d
| d | � } | d d k rP| j i d j | � d 6� n | j i t d 6� | S( u3
.. versionadded:: 2017.7.0
Makes sure an SELinux file context policy for a given filespec
(name), filetype and SELinux context type is absent.
name
filespec of the file or directory. Regex syntax is allowed.
filetype
The SELinux filetype specification. Use one of [a, f, d, c, b,
s, l, p]. See also `man semanage-fcontext`. Defaults to 'a'
(all files).
sel_type
The SELinux context type. There are many.
sel_user
The SELinux user.
sel_level
The SELinux MLS range.
u nameu resultu changesu u commentu selinux.fcontext_get_policyR R, R- R. R/ u( SELinux policy for "{0}" already absent u1 with specified filetype "{0}" and sel_type "{1}".u oldu newu testu selinux.fcontext_delete_policyu sel_typeu retcodei u Error removing policy: {0}N( R R R R R R R
(
R R, R- R. R/ R R0 R1 R3 t
remove_ret( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt fcontext_policy_absent� s< "
c C@ s� i | d 6t d 6i d 6d d 6} t d | | � } | d k ri | j i t d 6d j | � d 6� | St d r� | j i d d 6� nk t d | | � } | d
d k r� | j i | d 6� n1 | j i t d 6� | j i | j d � d 6� | S(
uz
.. versionadded:: 2017.7.0
Checks and makes sure the SELinux policies for a given filespec are
applied.
u nameu resultu changesu u commentu" selinux.fcontext_policy_is_appliedu7 SElinux policies are already applied for filespec "{0}"u testu selinux.fcontext_apply_policyu retcodei N( R R R R R R R
R! ( R t recursiveR t changes_textt apply_ret( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt fcontext_policy_applied� s "
c C@ s` i | d 6t d 6i d 6d d 6} t d d | d | d | d
| � } | r� | j i t d 6d j | � d j | | | � d 6� | St d
r� | j i d d 6� n� t d d | d | d | d
| d | � } | d d k r| j i d j | � d 6� nX | j i t d 6� t d d | d | d | d
| � } | d j i | d 6| d 6� | S( u
.. versionadded:: 2019.2.0
Makes sure an SELinux port policy for a given port, protocol and SELinux context type is present.
name
The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.
sel_type
The SELinux Type.
protocol
The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.
port
The port or port range. Required if name is not formatted.
sel_range
The SELinux MLS/MCS Security Range.
u nameu resultu changesu u commentu selinux.port_get_policyR R- t protocolt portu) SELinux policy for "{0}" already present u= with specified sel_type "{0}", protocol "{1}" and port "{2}".u testu selinux.port_add_policyt sel_rangeu retcodei u Error adding new policy: {0}u oldu newN( R R R R R R R
( R R- R= R> R? R R1 R4 R0 ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt port_policy_present� s< "
c C@ sT i | d 6t d 6i d 6d d 6} t d d | d | d | d
| � } | s� | j i t d 6d j | � d j | | | � d 6� | St d
r� | j i d d 6� n� t d d | d | d
| � } | d d k r� | j i d j | � d 6� nX | j i t d 6� t d d | d | d | d
| � } | d j i | d 6| d 6� | S( u4
.. versionadded:: 2019.2.0
Makes sure an SELinux port policy for a given port, protocol and SELinux context type is absent.
name
The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``.
sel_type
The SELinux Type. Optional; can be used in determining if policy is present,
ignored by ``semanage port --delete``.
protocol
The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted.
port
The port or port range. Required if name is not formatted.
u nameu resultu changesu u commentu selinux.port_get_policyR R- R= R> u( SELinux policy for "{0}" already absent u= with specified sel_type "{0}", protocol "{1}" and port "{2}".u testu selinux.port_delete_policyu retcodei u Error deleting policy: {0}u oldu newN( R R R R R R R
( R R- R= R> R R1 t
delete_retR0 ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt port_policy_absent s8 "
N( t __doc__t
__future__R R R t salt.extR R R R R R R R R$ R" R# R
R6 R8 R< R@ RB ( ( ( s7 /usr/lib/python2.7/site-packages/salt/states/selinux.pyt <module> s
4 :M Q; 7
Mini Shell