You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
144 lines
5.1 KiB
144 lines
5.1 KiB
From 9341da3478625bb2ba2e7d4f3e227735cc9c8198 Mon Sep 17 00:00:00 2001 |
|
From: Ondrej Mosnacek <omosnace@redhat.com> |
|
Date: Thu, 3 Feb 2022 17:53:27 +0100 |
|
Subject: [PATCH] semodule: add command-line option to detect module changes |
|
|
|
Add a new command-line option "--rebuild-if-modules-changed" to control |
|
the newly introduced check_ext_changes libsemanage flag. |
|
|
|
For example, running `semodule --rebuild-if-modules-changed` will ensure |
|
that any externally added/removed modules (e.g. by an RPM transaction) |
|
are reflected in the compiled policy, while skipping the most expensive |
|
part of the rebuild if no module change was deteceted since the last |
|
libsemanage transaction. |
|
|
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> |
|
--- |
|
policycoreutils/semodule/semodule.8 | 7 +++++++ |
|
policycoreutils/semodule/semodule.c | 32 ++++++++++++++++++++++------- |
|
2 files changed, 32 insertions(+), 7 deletions(-) |
|
|
|
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 |
|
index 3a2fb21c2481..d1735d216276 100644 |
|
--- a/policycoreutils/semodule/semodule.8 |
|
+++ b/policycoreutils/semodule/semodule.8 |
|
@@ -23,6 +23,13 @@ force a reload of policy |
|
.B \-B, \-\-build |
|
force a rebuild of policy (also reloads unless \-n is used) |
|
.TP |
|
+.B \-\-rebuild-if-modules-changed |
|
+Force a rebuild of the policy if any changes to module content are detected |
|
+(by comparing with checksum from the last transaction). One can use this |
|
+instead of \-B to ensure that any changes to the module store done by an |
|
+external tool (e.g. a package manager) are applied, while automatically |
|
+skipping the rebuild if there are no new changes. |
|
+.TP |
|
.B \-D, \-\-disable_dontaudit |
|
Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt |
|
.TP |
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c |
|
index f4a76289efa3..1ed8e69054e0 100644 |
|
--- a/policycoreutils/semodule/semodule.c |
|
+++ b/policycoreutils/semodule/semodule.c |
|
@@ -47,6 +47,7 @@ static int verbose; |
|
static int reload; |
|
static int no_reload; |
|
static int build; |
|
+static int check_ext_changes; |
|
static int disable_dontaudit; |
|
static int preserve_tunables; |
|
static int ignore_module_cache; |
|
@@ -149,6 +150,9 @@ static void usage(char *progname) |
|
printf(" -c, --cil extract module as cil. This only affects module extraction.\n"); |
|
printf(" -H, --hll extract module as hll. This only affects module extraction.\n"); |
|
printf(" -m, --checksum print module checksum (SHA256).\n"); |
|
+ printf(" --rebuild-if-modules-changed\n" |
|
+ " force policy rebuild if module content changed since\n" |
|
+ " last rebuild (based on checksum)\n"); |
|
} |
|
|
|
/* Sets the global mode variable to new_mode, but only if no other |
|
@@ -180,6 +184,7 @@ static void set_mode(enum client_modes new_mode, char *arg) |
|
static void parse_command_line(int argc, char **argv) |
|
{ |
|
static struct option opts[] = { |
|
+ {"rebuild-if-modules-changed", 0, NULL, '\0'}, |
|
{"store", required_argument, NULL, 's'}, |
|
{"base", required_argument, NULL, 'b'}, |
|
{"help", 0, NULL, 'h'}, |
|
@@ -207,15 +212,26 @@ static void parse_command_line(int argc, char **argv) |
|
}; |
|
int extract_selected = 0; |
|
int cil_hll_set = 0; |
|
- int i; |
|
+ int i, longind; |
|
verbose = 0; |
|
reload = 0; |
|
no_reload = 0; |
|
+ check_ext_changes = 0; |
|
priority = 400; |
|
while ((i = |
|
- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts, |
|
- NULL)) != -1) { |
|
+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", |
|
+ opts, &longind)) != -1) { |
|
switch (i) { |
|
+ case '\0': |
|
+ switch(longind) { |
|
+ case 0: /* --rebuild-if-modules-changed */ |
|
+ check_ext_changes = 1; |
|
+ break; |
|
+ default: |
|
+ usage(argv[0]); |
|
+ exit(1); |
|
+ } |
|
+ break; |
|
case 'b': |
|
fprintf(stderr, "The --base option is deprecated. Use --install instead.\n"); |
|
set_mode(INSTALL_M, optarg); |
|
@@ -300,13 +316,13 @@ static void parse_command_line(int argc, char **argv) |
|
} |
|
} |
|
} |
|
- if ((build || reload) && num_commands) { |
|
+ if ((build || reload || check_ext_changes) && num_commands) { |
|
fprintf(stderr, |
|
"build or reload should not be used with other commands\n"); |
|
usage(argv[0]); |
|
exit(1); |
|
} |
|
- if (num_commands == 0 && reload == 0 && build == 0) { |
|
+ if (num_commands == 0 && reload == 0 && build == 0 && check_ext_changes == 0) { |
|
fprintf(stderr, "At least one mode must be specified.\n"); |
|
usage(argv[0]); |
|
exit(1); |
|
@@ -395,7 +411,7 @@ int main(int argc, char *argv[]) |
|
|
|
cil_set_log_level(CIL_ERR + verbose); |
|
|
|
- if (build) |
|
+ if (build || check_ext_changes) |
|
commit = 1; |
|
|
|
sh = semanage_handle_create(); |
|
@@ -434,7 +450,7 @@ int main(int argc, char *argv[]) |
|
} |
|
} |
|
|
|
- if (build) { |
|
+ if (build || check_ext_changes) { |
|
if ((result = semanage_begin_transaction(sh)) < 0) { |
|
fprintf(stderr, "%s: Could not begin transaction: %s\n", |
|
argv[0], errno ? strerror(errno) : ""); |
|
@@ -807,6 +823,8 @@ cleanup_disable: |
|
semanage_set_reload(sh, 0); |
|
if (build) |
|
semanage_set_rebuild(sh, 1); |
|
+ if (check_ext_changes) |
|
+ semanage_set_check_ext_changes(sh, 1); |
|
if (disable_dontaudit) |
|
semanage_set_disable_dontaudit(sh, 1); |
|
else if (build) |
|
-- |
|
2.34.1 |
|
|
|
|