| Message ID | 20231122112942.2832586-2-lautrbach@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d1ea1a16344a |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | [v2] sepolicy: port to dnf4 python API | expand |
On Wed, Nov 22, 2023 at 12:31 PM Petr Lautrbach <lautrbach@redhat.com> wrote: > > yum module is not available since RHEL 7. > > Drop -systemd related code as it's obsoleted these days - only 2 > packages ship their .service in -systemd subpackage > > Signed-off-by: Petr Lautrbach <lautrbach@redhat.com> > --- > > v2: use with dnf.Base() as base: suggested by Ondrej Mosnacek <omosnace@redhat.com> For the fix: Acked-by: Ondrej Mosnacek <omosnace@redhat.com> (I didn't review the full patch, but Jim's v1 ack should still apply to the rest.) > > python/sepolicy/sepolicy/generate.py | 56 +++++++++++++--------------- > 1 file changed, 25 insertions(+), 31 deletions(-) > > diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py > index b6df3e91160b..adf65f27a822 100644 > --- a/python/sepolicy/sepolicy/generate.py > +++ b/python/sepolicy/sepolicy/generate.py > @@ -1262,24 +1262,20 @@ allow %s_t %s_t:%s_socket name_%s; > return fcfile > > def __extract_rpms(self): > - import yum > - yb = yum.YumBase() > - yb.setCacheDir() > - > - for pkg in yb.rpmdb.searchProvides(self.program): > - self.rpms.append(pkg.name) > - for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist: > - for b in self.DEFAULT_DIRS: > - if b == "/etc": > - continue > - if fname.startswith(b): > - if os.path.isfile(fname): > - self.add_file(fname) > - else: > - self.add_dir(fname) > + import dnf > + > + with dnf.Base() as base: > + base.read_all_repos() > + base.fill_sack(load_system_repo=True) > + > + query = base.sack.query() > > - for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]): > - for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist: > + pq = query.available() > + pq = pq.filter(file=self.program) > + > + for pkg in pq: > + self.rpms.append(pkg.name) > + for fname in pkg.files: > for b in self.DEFAULT_DIRS: > if b == "/etc": > continue > @@ -1288,20 +1284,18 @@ allow %s_t %s_t:%s_socket name_%s; > self.add_file(fname) > else: > self.add_dir(fname) > - > - # some packages have own systemd subpackage > - # tor-systemd for example > - binary_name = self.program.split("/")[-1] > - for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]): > - for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist: > - for b in self.DEFAULT_DIRS: > - if b == "/etc": > - continue > - if fname.startswith(b): > - if os.path.isfile(fname): > - self.add_file(fname) > - else: > - self.add_dir(fname) > + sq = query.available() > + sq = sq.filter(provides=pkg.source_name) > + for bpkg in sq: > + for fname in bpkg.files: > + for b in self.DEFAULT_DIRS: > + if b == "/etc": > + continue > + if fname.startswith(b): > + if os.path.isfile(fname): > + self.add_file(fname) > + else: > + self.add_dir(fname) > > def gen_writeable(self): > try: > -- > 2.41.0 >
On Tue, Nov 28, 2023 at 10:02 AM Ondrej Mosnacek <omosnace@redhat.com> wrote: > > On Wed, Nov 22, 2023 at 12:31 PM Petr Lautrbach <lautrbach@redhat.com> wrote: > > > > yum module is not available since RHEL 7. > > > > Drop -systemd related code as it's obsoleted these days - only 2 > > packages ship their .service in -systemd subpackage > > > > Signed-off-by: Petr Lautrbach <lautrbach@redhat.com> > > --- > > > > v2: use with dnf.Base() as base: suggested by Ondrej Mosnacek <omosnace@redhat.com> > > For the fix: > > Acked-by: Ondrej Mosnacek <omosnace@redhat.com> > > (I didn't review the full patch, but Jim's v1 ack should still apply > to the rest.) > This has now been merged. Thanks, Jim > > > > python/sepolicy/sepolicy/generate.py | 56 +++++++++++++--------------- > > 1 file changed, 25 insertions(+), 31 deletions(-) > > > > diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py > > index b6df3e91160b..adf65f27a822 100644 > > --- a/python/sepolicy/sepolicy/generate.py > > +++ b/python/sepolicy/sepolicy/generate.py > > @@ -1262,24 +1262,20 @@ allow %s_t %s_t:%s_socket name_%s; > > return fcfile > > > > def __extract_rpms(self): > > - import yum > > - yb = yum.YumBase() > > - yb.setCacheDir() > > - > > - for pkg in yb.rpmdb.searchProvides(self.program): > > - self.rpms.append(pkg.name) > > - for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist: > > - for b in self.DEFAULT_DIRS: > > - if b == "/etc": > > - continue > > - if fname.startswith(b): > > - if os.path.isfile(fname): > > - self.add_file(fname) > > - else: > > - self.add_dir(fname) > > + import dnf > > + > > + with dnf.Base() as base: > > + base.read_all_repos() > > + base.fill_sack(load_system_repo=True) > > + > > + query = base.sack.query() > > > > - for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]): > > - for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist: > > + pq = query.available() > > + pq = pq.filter(file=self.program) > > + > > + for pkg in pq: > > + self.rpms.append(pkg.name) > > + for fname in pkg.files: > > for b in self.DEFAULT_DIRS: > > if b == "/etc": > > continue > > @@ -1288,20 +1284,18 @@ allow %s_t %s_t:%s_socket name_%s; > > self.add_file(fname) > > else: > > self.add_dir(fname) > > - > > - # some packages have own systemd subpackage > > - # tor-systemd for example > > - binary_name = self.program.split("/")[-1] > > - for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]): > > - for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist: > > - for b in self.DEFAULT_DIRS: > > - if b == "/etc": > > - continue > > - if fname.startswith(b): > > - if os.path.isfile(fname): > > - self.add_file(fname) > > - else: > > - self.add_dir(fname) > > + sq = query.available() > > + sq = sq.filter(provides=pkg.source_name) > > + for bpkg in sq: > > + for fname in bpkg.files: > > + for b in self.DEFAULT_DIRS: > > + if b == "/etc": > > + continue > > + if fname.startswith(b): > > + if os.path.isfile(fname): > > + self.add_file(fname) > > + else: > > + self.add_dir(fname) > > > > def gen_writeable(self): > > try: > > -- > > 2.41.0 > > > > -- > Ondrej Mosnacek > Senior Software Engineer, Linux Security - SELinux kernel > Red Hat, Inc. > >
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py index b6df3e91160b..adf65f27a822 100644 --- a/python/sepolicy/sepolicy/generate.py +++ b/python/sepolicy/sepolicy/generate.py @@ -1262,24 +1262,20 @@ allow %s_t %s_t:%s_socket name_%s; return fcfile def __extract_rpms(self): - import yum - yb = yum.YumBase() - yb.setCacheDir() - - for pkg in yb.rpmdb.searchProvides(self.program): - self.rpms.append(pkg.name) - for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist: - for b in self.DEFAULT_DIRS: - if b == "/etc": - continue - if fname.startswith(b): - if os.path.isfile(fname): - self.add_file(fname) - else: - self.add_dir(fname) + import dnf + + with dnf.Base() as base: + base.read_all_repos() + base.fill_sack(load_system_repo=True) + + query = base.sack.query() - for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]): - for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist: + pq = query.available() + pq = pq.filter(file=self.program) + + for pkg in pq: + self.rpms.append(pkg.name) + for fname in pkg.files: for b in self.DEFAULT_DIRS: if b == "/etc": continue @@ -1288,20 +1284,18 @@ allow %s_t %s_t:%s_socket name_%s; self.add_file(fname) else: self.add_dir(fname) - - # some packages have own systemd subpackage - # tor-systemd for example - binary_name = self.program.split("/")[-1] - for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]): - for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist: - for b in self.DEFAULT_DIRS: - if b == "/etc": - continue - if fname.startswith(b): - if os.path.isfile(fname): - self.add_file(fname) - else: - self.add_dir(fname) + sq = query.available() + sq = sq.filter(provides=pkg.source_name) + for bpkg in sq: + for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": + continue + if fname.startswith(b): + if os.path.isfile(fname): + self.add_file(fname) + else: + self.add_dir(fname) def gen_writeable(self): try:
yum module is not available since RHEL 7. Drop -systemd related code as it's obsoleted these days - only 2 packages ship their .service in -systemd subpackage Signed-off-by: Petr Lautrbach <lautrbach@redhat.com> --- v2: use with dnf.Base() as base: suggested by Ondrej Mosnacek <omosnace@redhat.com> python/sepolicy/sepolicy/generate.py | 56 +++++++++++++--------------- 1 file changed, 25 insertions(+), 31 deletions(-)