File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/selinux.cpython-310.pyc
Back
o ;j�I � @ s� d Z dd� Zdd� Zdd� Zdd� Zd d � Zd"d d �Zd#dd�Zdd� Zdd� Z d$dd�Z d%dd�Z d"d d �Z d&d d �Z d&d d!�ZdS )'a� Management of SELinux rules =========================== If SELinux is available for the running system, the mode can be managed and booleans can be set. .. code-block:: yaml enforcing: selinux.mode samba_create_home_dirs: selinux.boolean: - value: True - persist: True nginx: selinux.module: - enabled: False .. note:: Use of these states require that the :mod:`selinux <salt.modules.selinux>` execution module is available. c C s dt v rdS dS )zL Only make this state available if the selinux module is available. �selinux.getenforceZselinux)Fz"selinux module could not be loaded��__salt__� r r �G/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/selinux.py� __virtual__ s r c C sd t | ��� } t| �d�| dk| dkg�rdS t| �d�| dk| dkg�r&dS t| �d �g�r0d S d S ) z1 Return a mode value that is predictable �e�1�onZ Enforcing�p�0�offZ Permissive�d�Disabled�unknown)�str�lower�any� startswith)�moder r r � _refine_mode% s r c C �( t | ��� } | dv r dS | dv rdS dS )z@ Return a yes/no value, or None if the input is invalid )r r �yes�truer )r r �no�falser N�r r )�valuer r r � _refine_value3 s r c C r )z] Return a predictable value, or allow us to error out .. versionadded:: 2016.3.0 )r r r r �enabledr )r r r r �disabledr r r )� module_stater r r �_refine_module_state? s r! c C s" | ddi d�}t | �}|dkr| � d�|d< |S td � }td � }||kr0||kr0||kr0|}||krBd |d < d |� d �|d< |S td rZd|� �|d< d|d < ||d�|d< |S |td |�}}||ksr|dkr�td � |kr�d |d < d|� d �|d< ||d�|d< |S d|� d �|d< |S )a< Verifies the mode SELinux is running in, can be set to enforcing, permissive, or disabled .. note:: A change to or from disabled mode requires a system reboot. You will need to perform this yourself. name The mode to run SELinux in, permissive, enforcing, or disabled. F� ��name�result�comment�changesr z is not an accepted moder& r zselinux.getconfigTr% zSELinux is already in z mode�testz%SELinux mode is set to be changed to N��old�newr' zselinux.setenforcer zSELinux has been set to zFailed to set SELinux to )r r �__opts__)r$ �retZtmoder ZconfigZoldmoder r r r L s6 r Fc C sl | ddi d�}t d � }| |vr d| � d�|d< d|d < |S t|�}|d u r3|� d �|d< d|d < |S || d |k}|| d |k}|rP|rO|rOd|d< |S n|rXd|d< |S td rld |d < d| � d|� �|d< |S t d | ||�|d < |d r�d| � d|� �|d< |d �d || d |d�i� |r�|s�|d �d || d |d�i� |S d| � d|� �|d< |S )z� Set up an SELinux boolean name The name of the boolean to set value The value to set on the boolean persist Defaults to False, set persist to true to make the boolean apply on a reboot Tr" r# zselinux.list_seboolzBoolean � is not availabler& Fr% Nz% is not a valid value for the boolean�StateZDefaultz Boolean is in the correct stater( z is set to be changed to zselinux.setsebool� has been set to r' r) zFailed to set the boolean � to )r r r, �update)r$ r Zpersistr- ZboolsZrvalue�state�defaultr r r �boolean| sH � �r5 �Enabledr c K s� | ddi d�}|� dd�r |� dd�r d|d< d|d < |S |� dd�r4|� d | �}t|�}|d s3|S n |� dd�r>t| �S td � }| |vrUd | � d �|d < d|d< |S t|�}|dkrkd�|t�|d < d|d< |S |dkr�|| d }||ks�d�||�|d < d|d< |S t|| d �} || kr�d | � d�|d < |S td r�d|d< d�| |�|d < |S td | |�r�d | � d|� �|d < |S d|d< d| � d|� �|d < |S ) a; Enable/Disable and optionally force a specific version for an SELinux module name The name of the module to control module_state Should the module be enabled or disabled? version Defaults to no preference, set to a specified value if required. Currently can only alert if the version is incorrect. install Setting to True installs module source Points to module source file, used only when install is True remove Setting to True removes module .. versionadded:: 2016.3.0 Tr" r# �installF�remover% z*Cannot install and remove at the same timer& �source�selinux.list_semod�Module r. r z*{} is not a valid state for the {} module.r �VersionzbModule version is {} and does not match the desired version of {} or you are using semodule >= 2.4r6 z is in the desired stater( Nz$Module {} is set to be toggled to {}zselinux.setsemodr0 zFailed to set the Module r1 )�get�module_install� module_remover r! �format�moduler, ) r$ r �version�optsr- Z module_path�modulesZ rmodule_stateZinstalled_versionZcurrent_module_stater r r rA � sb � � ��rA c C sH | ddi d�}t d | �rd| � d�|d< |S d|d < d | � �|d< |S ) z� Installs custom SELinux module from given file name Path to file with module to install .. versionadded:: 2016.11.6 Tr" r# zselinux.install_semodr; z has been installedr& Fr% zFailed to install module r )r$ r- r r r r> � s r> c C sv | ddi d�}t d � }| |vr d| � d�|d< d|d < |S t d | �r.d| � d �|d< |S d|d < d | � �|d< |S ) zt Removes SELinux module name The name of the module to remove .. versionadded:: 2016.11.6 Tr" r# r: r; r. r& Fr% zselinux.remove_semodz has been removedzFailed to remove module r )r$ r- rD r r r r? s r? �aNc C s� | di dd�}i }i }t d |�}t d | ||||d�} | sU| ||d�i}td r1|�d d i� n�t d | ||||d�} | d d krM|�dd| � �i� nf|�d di� n^| d |krp|�| d| d ii� |�| d|ii� n|�dd| � d�d�||� d�� |S td r�|�d d i� n#t d | ||||d�} | d d kr�|�dd| � �i� n|�d di� |d r�|s�|r�|d �||d�� |S )a" .. versionadded:: 2017.7.0 Makes sure a SELinux policy for a given filespec (name), filetype and SELinux context type is present. name filespec of the file or directory. Regex syntax is allowed. sel_type SELinux context type. There are many. filetype The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also `man semanage-fcontext`. Defaults to 'a' (all files). sel_user The SELinux user. sel_level The SELinux MLS range. Fr" �r$ r% r' r& z selinux.filetype_id_to_string�selinux.fcontext_get_policy�r$ �filetype�sel_type�sel_user� sel_level)rI rJ r( r% Nzselinux.fcontext_add_policy�retcode� r& zError adding new rule: TrJ �SELinux policy for "�" already present �/with specified filetype "{}" and sel_type "{}".�r% r& r' r) )r r, r2 r@ ) r$ rJ rI rK rL r- � new_state� old_stateZ filetype_str� current_state�add_retZ change_retr r r �fcontext_policy_present( sj �� ���� � rW c C s� | di dd�}i }i }t d | ||||d�}|s,|�dd| � d�d �||� d �� |S |�| |i� |d �||d �� td rJ|�ddi� |S t d | ||pT|d ||d�} | d dkrk|�dd| � �i� |S |�ddi� |S )a3 .. versionadded:: 2017.7.0 Makes sure an SELinux file context policy for a given filespec (name), filetype and SELinux context type is absent. name filespec of the file or directory. Regex syntax is allowed. filetype The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also `man semanage-fcontext`. Defaults to 'a' (all files). sel_type The SELinux context type. There are many. sel_user The SELinux user. sel_level The SELinux MLS range. Fr" rF rG rH TrO �" already absent rQ rR r' r) r( r% Nz selinux.fcontext_delete_policyrJ rM rN r& zError removing policy: �r r2 r@ r, ) r$ rI rJ rK rL r- rS rT rU Z remove_retr r r �fcontext_policy_absent� sL � ���� � � �rZ c C s� | di dd�}t d | |�}|dkr |�dd�| �d�� |S td r,|�d d i� |S t d | |�}|d d krB|�d|i� |S |�d di� |�d|�d�i� |S )zz .. versionadded:: 2017.7.0 Checks and makes sure the SELinux policies for a given filespec are applied. Fr" rF z"selinux.fcontext_policy_is_appliedTz6SElinux policies are already applied for filespec "{}"rR r( r% Nz selinux.fcontext_apply_policyrM rN r& r' )r r2 r@ r, r= )r$ � recursiver- Z changes_textZ apply_retr r r �fcontext_policy_applied� s* ��� � �r\ c C s� | di dd�}t d | |||d�}|r(|�dd| � d�d �|||� d �� |S td r5|�d d i� |S t d | ||||d�}|d dkrR|�dd|� �i� |S |�d di� t d | |||d�}|d �||d�� |S )a .. versionadded:: 2019.2.0 Makes sure an SELinux port policy for a given port, protocol and SELinux context type is present. name The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``. sel_type The SELinux Type. protocol The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted. port The port or port range. Required if name is not formatted. sel_range The SELinux MLS/MCS Security Range. Fr" rF �selinux.port_get_policy�r$ rJ �protocol�portTrO rP �:with specified sel_type "{}", protocol "{}" and port "{}".rR r( r% Nzselinux.port_add_policy)r$ rJ r_ r` � sel_rangerM rN r& zError adding new policy: r' r) rY ) r$ rJ r_ r` rb r- rT rV rS r r r �port_policy_present� sP � ���� �� ��rc c C s� | di dd�}t d | |||d�}|s(|�dd| � d�d �|||� d �� |S td r5|�d d i� |S t d | ||d�}|d dkrP|�dd|� �i� |S |�d di� t d | |||d�}|d �||d�� |S )a4 .. versionadded:: 2019.2.0 Makes sure an SELinux port policy for a given port, protocol and SELinux context type is absent. name The protocol and port spec. Can be formatted as ``(tcp|udp)/(port|port-range)``. sel_type The SELinux Type. Optional; can be used in determining if policy is present, ignored by ``semanage port --delete``. protocol The protocol for the port, ``tcp`` or ``udp``. Required if name is not formatted. port The port or port range. Required if name is not formatted. Fr" rF r] r^ TrO rX ra rR r( r% Nzselinux.port_delete_policy)r$ r_ r` rM rN r& zError deleting policy: r' r) rY )r$ rJ r_ r` r- rT Z delete_retrS r r r �port_policy_absent& sL � ���� �� ��rd )F)r6 r )rE NN)rE NNN)NNN)�__doc__r r r r! r r5 rA r> r? rW rZ r\ rc rd r r r r �<module> s" 0 5N �[ � C "?
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings