Ñò
Ã#xPc @ s4 d d k l Z l Z d d k l Z l Z l Z d d k Td d k l Z l Z d d k l
Z
e d ƒ Z e d ƒ Z d „ Z
d „ Z d
e f d „ ƒ YZ e i e ƒ d e f d
„ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e f d „ ƒ YZ e i e ƒ d e! f d „ ƒ YZ" e i e" ƒ d e f d „ ƒ YZ# e i e# ƒ d e! f d! „ ƒ YZ$ e i e$ ƒ d" S(# iÿÿÿÿ( t apit errors( t Strt StrEnumt Bool( t *( t _t ngettext( t is_allsü
SELinux User Mapping
Map IPA users to SELinux users by host.
Hosts, hostgroups, users and groups can be either defined within
the rule or it may point to an existing HBAC rule. When using
--hbacrule option to selinuxusermap-find an exact match is made on the
HBAC rule name, so only one or zero entries will be returned.
EXAMPLES:
Create a rule, "test1", that sets all users to xguest_u:s0 on the host "server":
ipa selinuxusermap-add --usercat=all --selinuxuser=xguest_u:s0 test1
ipa selinuxusermap-add-host --hosts=server.example.com test1
Create a rule, "test2", that sets all users to guest_u:s0 and uses an existing HBAC rule for users and hosts:
ipa selinuxusermap-add --usercat=all --hbacrule=webserver --selinuxuser=guest_u:s0 test2
Display the properties of a rule:
ipa selinuxusermap-show test2
Create a rule for a specific user. This sets the SELinux context for
user john to unconfined_u:s0-s0:c0.c1023 on any machine:
ipa selinuxusermap-add --hostcat=all --selinuxuser=unconfined_u:s0-s0:c0.c1023 john_unconfined
ipa selinuxusermap-add-user --users=john john_unconfined
Disable a rule:
ipa selinuxusermap-disable test1
Enable a rule:
ipa selinuxusermap-enable test1
Find a rule referencing a specific HBAC rule:
ipa selinuxusermap-find --hbacrule=allow_some
Remove a rule:
ipa selinuxusermap-del john_unconfined
SEEALSO:
The list controlling the order in which the SELinux user map is applied
and the default SELinux user are available in the config-show command.
s. HBAC rule and local members cannot both be setc
C sç t i d ƒ } t i d ƒ } t i d ƒ } | d i d d ƒ \ } } } } | i | ƒ p t d ƒ S| p | i | ƒ o t d ƒ S| i | ƒ } | o? | p, | i d ƒ o' t | i d ƒ ƒ d j o t d
ƒ Sd S( sÈ
An SELinux user has 3 components: user:MLS:MCS. user and MLS are required.
user traditionally ends with _u but this is not mandatory.
The regex is ^[a-zA-Z][a-zA-Z_]*
The MLS part can only be:
Level: s[0-15](-s[0-15])
Then MCS could be c[0-1023].c[0-1023] and/or c[0-1023]-c[0-c0123]
Meaning
s0 s0-s1 s0-s15:c0.c1023 s0-s1:c0,c2,c15.c26 s0-s0:c0.c1023
Returns a message on invalid, returns nothing on valid.
s ^[a-zA-Z][a-zA-Z_]*$s* ^s[0-9][1-5]{0,1}(-s[0-9][1-5]{0,1}){0,1}$s ^c(\d+)([.,-]c(\d+))*?$s :::t :i s5 Invalid SELinux user name, only a-Z and _ are alloweds/ Invalid MLS value, must match s[0-15](-s[0-15])iÿ sM Invalid MCS value, must match c[0-1023].c[0-1023] and/or c[0-1023]-c[0-c0123]N( t ret compilet splitt matchR t groupt intt None(
t ugettextt usert
regex_namet regex_mlst regex_mcst namet mlst mcst ignoret m( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyt validate_selinuxuserJ s " ; c C sž | i ƒ d } | i d g ƒ } t | ƒ d j o t i d t d ƒ ƒ ‚ n | d i d ƒ } | | j o) t i d t d ƒ t d | ƒ ƒ ‚ n d S(
sŒ
Ensure the user is in the list of allowed SELinux users.
Returns nothing if the user is found, raises an exception otherwise.
i t ipaselinuxusermapordert reasons0 SELinux user map list not found in configurationi t $s< SELinux user %(user)s not found in ordering list (in config)R N( t get_ipa_configt gett lenR t NotFoundR R t dict( t ldapR t configt itemt userlist( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyt validate_selinuxuser_inlistm s
t selinuxusermapc B sJ e Z d Z e i i Z e d ƒ Z e d ƒ Z d d g Z
d d d d d d d
d d d
d g Z d Z d Z
h d d g d
6d d g d 6Z e d ƒ Z e d ƒ Z e d d d d e d ƒ d e ƒe d e d d d e d ƒ ƒe d d d d e d ƒ d e d! ƒ ƒe d" d d# d e d$ ƒ d e d% ƒ d& d@ ƒe d( d d) d e d* ƒ d e d+ ƒ d& dA ƒe d, d d- d e d. ƒ ƒe d/ d e d0 ƒ d1 d2 g ƒe d3 d e d4 ƒ d1 d5 d6 d7 g ƒe d8 d e d9 ƒ d1 d5 d6 d7 g ƒe d: d e d; ƒ d1 d5 d6 d7 g ƒe d< d e d= ƒ d1 d5 d6 d7 g ƒf Z d> „ Z d? „ Z RS(B s"
SELinux User Map object.
s SELinux User Map rules SELinux User Map rulest ipaassociationt ipaselinuxusermapt cnt ipaenabledflagt descriptiont usercategoryt hostcategoryt
memberusert
memberhostt memberhostgroupt seealsot ipaselinuxusert ipauniqueidR R t hostt hostgroups SELinux User Mapss SELinux User Mapt cli_nameR t labels Rule namet primary_keyt selinuxusers SELinux Users seealso?t hbacrules HBAC Rulet docs7 HBAC Rule that defines the users, groups and hostgroupss
usercategory?t usercats
User categorys! User category the rule applies tot valuesu alls
hostcategory?t hostcats
Host categorys! Host category the rule applies tos description?t desct Descriptions ipaenabledflag?t Enabledt flagst no_options memberuser_user?t Userst no_createt no_updatet no_searchs memberuser_group?s User Groupss memberhost_host?t Hostss memberhost_hostgroup?s Host Groupsc
C sÙ | p d Sy t | ƒ } t | ƒ SWn¬ t j
o y[ | i i | i i d i i | | i i d i
d g | i i d i ƒ \ } } | } WqÕ t i
j
o, t i
d t d ƒ t d | ƒ ƒ ‚ qÕ Xn X| S( sP
Given a HBAC rule name verify its existence and return the dn.
R= t R s HBAC rule %(rule)s not foundt ruleN( R t DNt strt
ValueErrort backendt find_entry_by_attrR t ObjectR; R t object_classt container_dnR R" R R# ( t selfR4 t dnt entry_attrs( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyt _normalize_seealsoÐ s"
/c K sb | i d t ƒ o d Sd | j o9 | i | d d d g ƒ \ } } | d d | d s c 3 s x | ] } ˆ | ƒ Vq Wd S( N( ( t .0t attr( t is_to_be_set( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pys s R/ R0 R4 R ( s usercategorys hostcategory(
t
isinstanceRN t AssertionErrorR( t anyR t MutuallyExclusiveErrort notboth_errt objRY ( RV R$ RW RX t
attrs_listt keysR] t are_local_members_to_be_sett is_hbacrule_to_be_set( ( RX Ru sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyt pre_callbackû s
c O s1 t | t ƒ p t ‚ | i i | | | | S( N( Rv RN Rw R{ R` ( RV R$ RW RX R} R] ( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyt
post_callback s ( Ra Rb R Rc t msg_summaryR€ R ( ( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyRo ö s t selinuxusermap_delc B s e Z e d ƒ Z e d ƒ Z RS( s Delete a SELinux User Map.s$ Deleted SELinux User Map "%(value)s"( Ra Rb R Rc R‚ ( ( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyRƒ s t selinuxusermap_modc B s2 e Z e d ƒ Z e d ƒ Z d „ Z d „ Z RS( s Modify a SELinux User Map.s% Modified SELinux User Map "%(value)s"c
s† t | t ƒ p t ‚ y | i | | ƒ \ } ‰ Wn& t i j
o | i i | Œ n X‡ ‡ f d † ‰ ‡ ‡ ‡ f d † ‰ t ‡ f d † d
Dƒ ƒ } ˆ d ƒ } | o | o t i d t
ƒ ‚ n t ˆ d ƒ o# d ˆ j o t i d d
ƒ ‚ n t ˆ d ƒ o# d ˆ j o t i d d ƒ ‚ n d ˆ j o t | ˆ d ƒ n d ˆ j o | i i
ˆ d ƒ ˆ d 8 s R/ R0 R1 R2 R4 R sB user category cannot be set to 'all' while there are allowed userssB host category cannot be set to 'all' while there are allowed hostsR5 ( s usercategorys hostcategorys
memberusers
memberhost( Rv RN Rw R\ R R" R{ t handle_not_foundRx Ry Rz R R( RY (
RV R$ RW RX R| R} R] t _dnR~ R ( ( RX Ru R… R† sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyR€ ( s0
c O s1 t | t ƒ p t ‚ | i i | | | | S( N( Rv RN Rw R{ R` ( RV R$ RW RX R} R] ( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyR S s ( Ra Rb R Rc R‚ R€ R ( ( ( sA /usr/lib/python2.6/site-packages/ipalib/plugins/selinuxusermap.pyR„ # s +t selinuxusermap_findc B s8 e Z e d ƒ Z e d d d ƒ Z d „ Z d „ Z RS( s Search for SELinux User Maps.s" %(count)d SELinux User Map matcheds# %(count)d SELinux User Maps matchedi c O s› | i d ƒ or | d } y+ t i d | d t ƒd } | d } Wn, t i j
o t d d d g d t ƒ SX| | d sB
+ # r
"
5