Add context=default option to file module
This adjusts behavior of file module such that removal of se* option does not revert the file's selinux context to the default. In order to go back to the default context according to the policy, you can use the context=default option.
This commit is contained in:
parent
187ab3f918
commit
332931b9b8
1 changed files with 24 additions and 21 deletions
45
file
45
file
|
@ -72,6 +72,21 @@ def add_path_info(kwargs):
|
||||||
kwargs['state'] = 'absent'
|
kwargs['state'] = 'absent'
|
||||||
return kwargs
|
return kwargs
|
||||||
|
|
||||||
|
# If selinux fails to find a default, return an array of None
|
||||||
|
def selinux_default_context(path, mode=0):
|
||||||
|
context = [None, None, None, None]
|
||||||
|
if not HAVE_SELINUX:
|
||||||
|
return context
|
||||||
|
try:
|
||||||
|
ret = selinux.matchpathcon(path, mode)
|
||||||
|
except OSError:
|
||||||
|
return context
|
||||||
|
if ret[0] == -1:
|
||||||
|
return context
|
||||||
|
context = ret[1].split(':')
|
||||||
|
debug("got default secontext=%s" % ret[1])
|
||||||
|
return context
|
||||||
|
|
||||||
# ===========================================
|
# ===========================================
|
||||||
|
|
||||||
argfile = sys.argv[1]
|
argfile = sys.argv[1]
|
||||||
|
@ -107,8 +122,16 @@ seuser = params.get('seuser', None)
|
||||||
serole = params.get('serole', None)
|
serole = params.get('serole', None)
|
||||||
setype = params.get('setype', None)
|
setype = params.get('setype', None)
|
||||||
selevel = params.get('serange', 's0')
|
selevel = params.get('serange', 's0')
|
||||||
|
context = params.get('context', None)
|
||||||
secontext = [seuser, serole, setype, selevel]
|
secontext = [seuser, serole, setype, selevel]
|
||||||
|
|
||||||
|
if context is not None:
|
||||||
|
if context != 'default':
|
||||||
|
fail_json(msg='invalid context: %s' % context)
|
||||||
|
if seuser is not None or serole is not None or setype is not None:
|
||||||
|
fail_json(msg='cannot define context=default and seuser, serole or setype')
|
||||||
|
secontext = selinux_default_context(path)
|
||||||
|
|
||||||
if state not in [ 'file', 'directory', 'link', 'absent']:
|
if state not in [ 'file', 'directory', 'link', 'absent']:
|
||||||
fail_json(msg='invalid state: %s' % state)
|
fail_json(msg='invalid state: %s' % state)
|
||||||
|
|
||||||
|
@ -148,34 +171,14 @@ def selinux_context(path):
|
||||||
debug("got current secontext=%s" % ret[1])
|
debug("got current secontext=%s" % ret[1])
|
||||||
return context
|
return context
|
||||||
|
|
||||||
# If selinux fails to find a default, return an array of None
|
|
||||||
def selinux_default_context(path, mode=0):
|
|
||||||
context = [None, None, None, None]
|
|
||||||
print >>sys.stderr, path
|
|
||||||
if not HAVE_SELINUX:
|
|
||||||
return context
|
|
||||||
try:
|
|
||||||
ret = selinux.matchpathcon(path, mode)
|
|
||||||
except OSError:
|
|
||||||
return context
|
|
||||||
if ret[0] == -1:
|
|
||||||
return context
|
|
||||||
context = ret[1].split(':')
|
|
||||||
debug("got default secontext=%s" % ret[1])
|
|
||||||
return context
|
|
||||||
|
|
||||||
def set_context_if_different(path, context, changed):
|
def set_context_if_different(path, context, changed):
|
||||||
if not HAVE_SELINUX:
|
if not HAVE_SELINUX:
|
||||||
return changed
|
return changed
|
||||||
cur_context = selinux_context(path)
|
cur_context = selinux_context(path)
|
||||||
new_context = selinux_default_context(path)
|
new_context = list(cur_context)
|
||||||
for i in range(len(context)):
|
for i in range(len(context)):
|
||||||
if context[i] is not None and context[i] != cur_context[i]:
|
if context[i] is not None and context[i] != cur_context[i]:
|
||||||
debug('new context was %s' % new_context[i])
|
|
||||||
new_context[i] = context[i]
|
new_context[i] = context[i]
|
||||||
debug('new context is %s' % new_context[i])
|
|
||||||
elif new_context[i] is None:
|
|
||||||
new_context[i] = cur_context[i]
|
|
||||||
debug("current secontext is %s" % ':'.join(cur_context))
|
debug("current secontext is %s" % ':'.join(cur_context))
|
||||||
debug("new secontext is %s" % ':'.join(new_context))
|
debug("new secontext is %s" % ':'.join(new_context))
|
||||||
if cur_context != new_context:
|
if cur_context != new_context:
|
||||||
|
|
Loading…
Reference in a new issue