File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/selinux.cpython-310.pyc
Back
o ;jD` � @ s� d Z ddlZddlZddlm mZ ddlZddlZddl Zddl Zddl m Z m Z dddddd d d d �Zd d� Zejdd� �Zdd� Zdd� Zdd� Zdd� ZdIdd�ZdId d �Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Z d(d)� Z d*d+� Z d,d-� Z d.d/� Z d0d1� Z!dJd3d4�Z" dKd5d6�Z# dKd7d8�Z$ dKd9d:�Z% dKd;d<�Z&dId=d>�Z'dId?d@�Z(dLdAdB�Z)dKdCdD�Z*dMdEdF�Z+ dKdGdH�Z,dS )Na� Execute calls on selinux .. note:: This module requires the ``semanage``, ``setsebool``, and ``semodule`` commands to be available on the minion. On RHEL-based distributions, ensure that the ``policycoreutils`` and ``policycoreutils-python`` packages are installed. If not on a Fedora or RHEL-based distribution, consult the selinux documentation for your distribution to ensure that the proper packages are installed. � N)�CommandExecutionError�SaltInvocationErrorz all filesz regular file� directoryzcharacter devicez block device�socketz symbolic linkz named pipe)�a�f�d�c�b�s�l�pc C s@ d} | D ]}t jj�|�sd|d f S qtd dkr dS dS )zg Check if the os is Linux, and then if selinux is running in permissive or enforcing mode. )Zsemanage� setseboolZsemoduleFz is not in the pathZkernel�LinuxZselinux)Fz1Module only works on Linux with selinux installed)�salt�utils�path�whichZ __grains__)Z required_cmds�cmd� r �H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/selinux.py� __virtual__# s � r c C sR z dD ]} t j�| �rt j�t j�| d��r| W S qW dS ty( Y dS w )z� Return the location of the SELinux VFS directory CLI Example: .. code-block:: bash salt '*' selinux.selinux_fs_path )z/sys/fs/selinuxz/selinux�enforceN)�osr �isdir�isfile�join�AttributeError)r r r r �selinux_fs_path6 s � �r c C s� t � } | du r dS z<tj�| d�}tjj�|d��"}tjj� |� � �� � dkr1 W d � W dS W d � W dS 1 s>w Y W dS t t fyQ Y dS w )z� Return the mode selinux is running in CLI Example: .. code-block:: bash salt '*' selinux.getenforce N�Disabledr �r�0Z PermissiveZ Enforcing)r r r r r r �files�fopen� stringutils� to_unicode�readline�strip�OSErrorr )Z_selinux_fs_pathr �_fpr r r � getenforceN s �(��r* c C s� zGd} t jj�| d��2}|D ]%}t jj�|�}|�� �d�r3|�d�d � � �� W d � W S qW d � W dS 1 s@w Y W dS t t fyS Y dS w )z� Return the selinux mode from the config file CLI Example: .. code-block:: bash salt '*' selinux.getconfig �/etc/selinux/configr zSELINUX=�=� N) r r r" r# r$ r% r' � startswith�split� capitalizer( r )�configr) �liner r r � getconfigf s" �� ����r3 c C s t | t�r+| �� dkrd} d}n-| �� dkrd} d}n"| �� dkr&d} d}nd| � �S t | t�r8| r5d} nd} nd| � �S t� dkr�tj�t� d�}z$t j j � |d ��}|� t j j�| �� W d � n1 shw Y W n ty� } z d }t|�|���d }~ww d }zit j j � |d �� }|�� }W d � n1 s�w Y z7t j j � |d �� }t�dd| d |�}|� t j j�|�� W d � n 1 s�w Y W W t� S W W t� S ty� } z d}t|�|���d }~ww t�y } z d}t|�|���d }~ww )z� Set the SELinux enforcing mode CLI Example: .. code-block:: bash salt '*' selinux.setenforce enforcing Z enforcing�1Z permissiver! �disabledz Invalid mode r r �wNz)Could not write SELinux enforce file: {0}r+ r z\nSELINUX=.*\nz SELINUX=� z(Could not write SELinux config file: {0}z'Could not read SELinux config file: {0})� isinstance�str�lower�intr* r r r r r r r" r# �writer$ Zto_strr( r �format�read�re�sub) �modeZ modestringr r) �exc�msgr1 Z_cfZconfr r r � setenforce| sf ���� � � � �����rD c C � t � �| i �S )z� Return the information on a specific selinux boolean CLI Example: .. code-block:: bash salt '*' selinux.getsebool virt_use_usb )� list_sebool�get)�booleanr r r � getsebool� s rI Fc C s8 |r d| � d|� �}nd| � d|� �}t d |dd� S )z� Set the value for a boolean CLI Example: .. code-block:: bash salt '*' selinux.setsebool virt_use_usb off � setsebool -P � � setsebool � cmd.retcodeF�Z python_shell��__salt__)rH �value�persistr r r r r � s r c C sT t | t�si S |r d}nd}| �� D ]\}}|� d|� d|� �}qtd |dd� S )z� Set the value of multiple booleans CLI Example: .. code-block:: bash salt '*' selinux.setsebools '{virt_use_usb: on, squid_use_tproxy: off}' rJ rL rK r, rM FrN )r8 �dict�itemsrP )�pairsrR r rH rQ r r r � setsebools� s rV c C sv t d d��� } i }| dd� D ](}|�� sq|�� }|d dd� |d dd� d�|dd� �d �||d < q|S ) z� Return a structure listing all of the selinux booleans on the system and what state they are in CLI Example: .. code-block:: bash salt '*' selinux.list_sebool �cmd.runzsemanage boolean -lr- N� ���rK � )�StateZDefaultZ Descriptionr )rP � splitlinesr' r/ r )Zbdata�retr2 �compsr r r rF � s �rF c C rE )z� Return the information on a specific selinux module CLI Example: .. code-block:: bash salt '*' selinux.getsemod mysql .. versionadded:: 2016.3.0 )� list_semodrG )�moduler r r �getsemod s ra c C s< |� � dkr d| � �}n |� � dkrd| � �}td |� S )z� Enable or disable an SELinux module. CLI Example: .. code-block:: bash salt '*' selinux.setsemod nagios Enabled .. versionadded:: 2016.3.0 �enabledz semodule -e r5 z semodule -d rM )r: rP )r` �stater r r r �setsemod s rd c C s2 | � d�dkr td | �} d| � �}td |� S )z� Install custom SELinux module from file CLI Example: .. code-block:: bash salt '*' selinux.install_semod [salt://]path/to/module.pp .. versionadded:: 2016.11.6 zsalt://r z cp.cache_filez semodule -i rM )�findrP )Z module_pathr r r r � install_semod$ s rf c C s d| � �}t d |� S )z� Remove SELinux module CLI Example: .. code-block:: bash salt '*' selinux.remove_semod module_name .. versionadded:: 2016.11.6 z semodule -r rM rO )r` r r r r � remove_semod6 s rg c C s t d d��� } d}| D ] }|�� �d�rd}q |dkrOt d d��� }i }|D ]$}|�� s/q(|�� }t|�dkrCdd d �||d < q(d d d �||d < q(|S t d d ��� }i }|D ](}|�� sbq[|�� }t|�dkrxd|d d �||d < q[d |d d �||d < q[|S )z� Return a structure listing all of the selinux modules on the system and what state they are in CLI Example: .. code-block:: bash salt '*' selinux.list_semod .. versionadded:: 2016.3.0 rW z semodule -h� �full�newzsemodule -lfullrZ FN)ZEnabled�Versionr- Tz semodule -lrX r )rP r\ r' r. r/ �len)ZhelptextZsemodule_versionr2 Zmdatar] r^ r r r r_ F s6 � � r_ c C s | t vr td| � ���dS )z� .. versionadded:: 2017.7.0 Checks if the given filetype is a valid SELinux filetype specification. Throws an SaltInvocationError if it isn't. zInvalid filetype given: T)�_SELINUX_FILETYPESr ��filetyper r r �_validate_filetyper s rp c C sT d}t �|| �}|st �||� d|� ��}|s td�| ||���|�d�|�d�fS )a .. versionadded:: 2019.2.0 Validates and parses the protocol and port/port range from the name if both protocol and port are not provided. If the name is in a valid format, the protocol and port are ignored if provided Examples: tcp/8080 or udp/20-21 z ^(tcp|udp)\/(([\d]+)\-?[\d]+)$�/zRInvalid name "{}" format and protocol and port not provided or invalid: "{}" "{}".r- � )r? �matchr r= �group)�name�protocol�portZprotocol_port_patternZ name_partsr r r �_parse_protocol_port~ s �rx c C s dj di | ��S )zc .. versionadded:: 2017.7.0 Converts an SELinux file context from a dict to a string. z,{sel_user}:{sel_role}:{sel_type}:{sel_level}Nr )r= )�contextr r r �_context_dict_to_string� s rz c C sJ t �d| �s td��| �dd�}i }tg d��D ] \}}|| ||< q|S )z_ .. versionadded:: 2017.7.0 Converts an SELinux file context from string to dict. z[^:]+:[^:]+:[^:]+:[^:]+$zTInvalid SELinux context string: {0}. Expected "sel_user:sel_role:sel_type:sel_level"�:rX )�sel_user�sel_role�sel_type� sel_level)r? rs r r/ � enumerate)ry Z context_listr] �indexrQ r r r �_context_string_to_dict� s � r� r c C s t | � t�| d�S )z� .. versionadded:: 2017.7.0 Translates SELinux filetype single-letter representation to a more human-readable version (which is also used in `semanage fcontext -l`). �error)rp rm rG rn r r r �filetype_id_to_string� s r� c C s� |rt |� d}d}||t�| �|pdd|pd|pdd�}|du r#dnt|�|d< dd jdi |�� }td |d d �} | d krAdS t�djdi dt�| �i��| �} | �d��� | �d��� d�} | � t | �d��� �� | S )a� .. versionadded:: 2017.7.0 Returns the current entry in the SELinux policy list as a dictionary. Returns None if no exact match was found. Returned keys are: * filespec (the name supplied and matched) * filetype (the descriptive name of the filetype supplied) * sel_user, sel_role, sel_type, sel_level (the selinux context) For a more in-depth explanation of the selinux context, go to https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/chap-Security-Enhanced_Linux-SELinux_Contexts.html name filespec of the file or directory. Regex syntax is allowed. filetype The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also `man semanage-fcontext`. Defaults to 'a' (all files). CLI Example: .. code-block:: bash salt '*' selinux.fcontext_get_policy my-policy �[ ]+z[ | ]*z[^:]+)�spacerZospacer�filespecr| r} r~ r Nz [[:alpha:] ]+ro z semanage fcontext -l | grep -E z]'^{filespec}{spacer}{filetype}{spacer}{sel_user}:{sel_role}:{sel_type}:{sel_level}{ospacer}$'� cmd.shellT�Zignore_retcoderh z ^({filespec}) +([a-z ]+) (.*)$r� r- rr )r� ro rX r ) rp r? �escaper� r= rP rs rt r' �updater� ) ru ro r~ r| r � re_spacerZre_optional_spacer� cmd_kwargsr �current_entry_text�partsr] r r r �fcontext_get_policy� s@ � ����� �r� c C � t d| ||||�S )a� .. versionadded:: 2019.2.0 Adds the SELinux policy for a given filespec and other optional parameters. Returns the result of the call to semanage. Note that you don't have to remove an entry before setting a new one for a given filespec and filetype, as adding one with semanage automatically overwrites a previously configured SELinux context. name filespec of the file or directory. Regex syntax is allowed. file_type The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also ``man semanage-fcontext``. Defaults to 'a' (all files). sel_type SELinux context type. There are many. sel_user SELinux user. Use ``semanage login -l`` to determine which ones are available to you. sel_level The MLS range of the SELinux context. CLI Example: .. code-block:: bash salt '*' selinux.fcontext_add_policy my-policy �add�� _fcontext_add_or_delete_policy�ru ro r~ r| r r r r �fcontext_add_policy � & �r� c C r� )a� .. versionadded:: 2019.2.0 Deletes the SELinux policy for a given filespec and other optional parameters. Returns the result of the call to semanage. Note that you don't have to remove an entry before setting a new one for a given filespec and filetype, as adding one with semanage automatically overwrites a previously configured SELinux context. name filespec of the file or directory. Regex syntax is allowed. file_type The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also ``man semanage-fcontext``. Defaults to 'a' (all files). sel_type SELinux context type. There are many. sel_user SELinux user. Use ``semanage login -l`` to determine which ones are available to you. sel_level The MLS range of the SELinux context. CLI Example: .. code-block:: bash salt '*' selinux.fcontext_delete_policy my-policy �deleter� r� r r r �fcontext_delete_policy. r� r� c C s� | dvr t d| � d���d| kr)t�|�}d|� d�}td |dd �}|d kr)d } d | � �}|d urA|dkrAt|� |d|� �7 }|d urL|d|� �7 }|d urW|d|� �7 }|d urb|d|� �7 }|dt�|� 7 }td |�S )z� .. versionadded:: 2019.2.0 Performs the action as called from ``fcontext_add_policy`` or ``fcontext_delete_policy``. Returns the result of the call to semanage. �r� r� �/Actions supported are "add" and "delete", not "�".r� z semanage fcontext -l | grep -E 'z 'r� Tr� rh �modifyzsemanage fcontext --Nr z --ftype � --type z --seuser � --range rK � cmd.run_all)r r? r� rP rp ) �actionru ro r~ r| r r� r r� r r r r� Y s, � r� c C s0 d}|r|d7 }|t �| �7 }td |��d�S )a� .. versionadded:: 2017.7.0 Returns an empty string if the SELinux policy for a given filespec is applied, returns string with differences in policy and actual situation otherwise. name filespec of the file or directory. Regex syntax is allowed. CLI Example: .. code-block:: bash salt '*' selinux.fcontext_policy_is_applied my-policy zrestorecon -n -v �-R r� �stdout)r? r� rP rG )ru � recursiver r r r �fcontext_policy_is_applied� s r� c C s> i }t | |�}d}|r|d7 }|t�| �7 }td |�}|�|� |d dkr�g }|�d�r7t�d|tj�}n|�d�rEt�d |tj�}n d |d< d |d < |S |rX|�d i i� |D ]B}|d }t|d �} t|d �} i } | � � D ]\} } | � | �| kr�| �| | i� qr| D ]} | | = | | = q�|d �|| | d�i� qZ|S )a� .. versionadded:: 2017.7.0 Applies SElinux policies to filespec using `restorecon [-R] filespec`. Returns dict with changes if successful, the output of the restorecon command otherwise. name filespec of the file or directory. Regex syntax is allowed. recursive Recursively apply SELinux policies. CLI Example: .. code-block:: bash salt '*' selinux.fcontext_apply_policy my-policy zrestorecon -v -F r� r� �retcoder z Would relabelz%Would relabel (.*) from (.*) to (.*)$zrestorecon resetz)restorecon reset (.*) context (.*)->(.*)$r- z.Unrecognized response from restorecon command.r� Zchangesrr )�oldrj ) r� r? r� rP r� r. �findall�Mr� rT rG )ru r� r] Z changes_textr Z apply_retZ changes_list�itemr� r� rj Z intersect�keyrQ r r r �fcontext_apply_policy� sJ � � �r� c C s� t | ||�\}}d}|r|nd}||||d�}ddjdi |�� }td |dd�}|d kr/d S t�d |�} | �d ��� | �d ��� | �d��� d�S )a .. versionadded:: 2019.2.0 Returns the current entry in the SELinux policy list as a dictionary. Returns None if no exact match was found. Returned keys are: * sel_type (the selinux type) * proto (the protocol) * port (the port(s) and/or port range(s)) name The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``. sel_type The SELinux Type. protocol The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted. port The port or port range. Required if name is not formatted. CLI Example: .. code-block:: bash salt '*' selinux.port_get_policy tcp/80 salt '*' selinux.port_get_policy foobar protocol=tcp port=80 r� z\w+)r� r~ rv rw zsemanage port -l | grep -E z<'^{sel_type}{spacer}{protocol}{spacer}((.*)*)[ ]{port}($|,)'r� Tr� rh Nz ^(\w+)[ ]+(\w+)[ ]+([\d\-, ]+)r- rr rX )r~ rv rw r )rx r= rP r? rs rt r' ) ru r~ rv rw r� Z re_sel_typer� r Z port_policyr� r r r �port_get_policy� s, ���� �r� c C r� )a� .. versionadded:: 2019.2.0 Adds the SELinux policy for a given protocol and port. Returns the result of the call to semanage. name The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``. sel_type The SELinux Type. Required. protocol The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted. port The port or port range. Required if name is not formatted. sel_range The SELinux MLS/MCS Security Range. CLI Example: .. code-block:: bash salt '*' selinux.port_add_policy add tcp/8080 http_port_t salt '*' selinux.port_add_policy add foobar http_port_t protocol=tcp port=8091 r� ��_port_add_or_delete_policy)ru r~ rv rw � sel_ranger r r �port_add_policy s r� c C s t d| d||d�S )aX .. versionadded:: 2019.2.0 Deletes the SELinux policy for a given protocol and port. Returns the result of the call to semanage. name The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``. protocol The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted. port The port or port range. Required if name is not formatted. CLI Example: .. code-block:: bash salt '*' selinux.port_delete_policy tcp/8080 salt '*' selinux.port_delete_policy foobar protocol=tcp port=8091 r� Nr� )ru rv rw r r r �port_delete_policy/ s r� c C s� | dvr t d| � d���| dkr|st d��t|||�\}}d| � d|� �}|r/|d|� �7 }|r8|d |� �7 }|d |� �7 }td |�S ) z� .. versionadded:: 2019.2.0 Performs the action as called from ``port_add_policy`` or ``port_delete_policy``. Returns the result of the call to semanage. r� r� r� r� z(SELinux Type is required to add a policyzsemanage port --z --proto r� r� rK r� )r rx rP )r� ru r~ rv rw r� r r r r r� J s � r� )F)r )NNNN)NNN)NN)-�__doc__r r? Zsalt.utils.decoratorsr Z decoratorsZsalt.utils.filesr Zsalt.utils.pathZsalt.utils.stringutilsZsalt.utils.versionsZsalt.exceptionsr r rm r Zmemoizer r* r3 rD rI r rV rF ra rd rf rg r_ rp rx rz r� r� r� r� r� r� r� r� r� r� r� r� r r r r �<module> sj � : , �H �, �, � ' ; ; ! �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings