[semanage] [python-sepol] semanage crashes on systems without policy

[schmittlauch]

The semanage tool crashes on systems without installed policies:

# semanage
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 28, in <module>
    import seobject
  File "/usr/lib/python3.4/site-packages/seobject.py", line 1039, in <module>
    class portRecords(semanageRecords):
  File "/usr/lib/python3.4/site-packages/seobject.py", line 1041, in portRecords
    valid_types = list(list(sepolicy.info(sepolicy.ATTRIBUTE, "port_type"))[0]["types"])
  File "/usr/lib/python3.4/site-packages/sepolicy/__init__.py", line 196, in <genexpr>
    return ({
  File "/usr/lib/python3.4/site-packages/setools/typeattrquery.py", line 65, in results
    for attr in self.policy.typeattributes():
AttributeError: 'NoneType' object has no attribute 'typeattributes'

This is caused by sepol (the python module) setting the global _pol variable to None – something setools.TypeAttributeQuery can't deal with.

platform details:

python3-modules used with python-3.4.3
distribution: mer
libselinux/ libsepol/ libsemanage/ policycoreutils: v2.7
python3-setools: 4.1.1

disclaimer: policycoreutils and setools are customly packaged, this is a possible (but unlikely) error source

[stephensmalley]

Reproduced upstream, e.g. just mv /etc/selinux /etc/selinux.old and try running semanage as above.

[fishilico]

This behavior is mainly due to having valid_types = list(list(sepolicy.info(... in class definitions instead of having them in class constructors (in seobject.py). This makes it harder to catch the fact that no policy is loaded.
I suggest moving the valid_types definitions to class constructors, to give importers of seobject.py the possibility to display a nice error message if no policy is loaded (or to specify a policy to be loaded).
What do you think of this?

[bachradsusi]

I should probably drop the reference to this issue from my working commits in order to prevent another automatic closing. Sorry for the noise.

[bachradsusi]

Fixed by a73b0bb e718c2a

[devZer0]

on recent debian 9.7, i'm also getting this. some note about the missing package would be nice, i found this via strace...

[renannprado]

@devZer0 would be nice if you say which is the missing package...

I have this problem in Ubuntu still.

Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.4 LTS
Release:	18.04
Codename:	bionic

[JeanCarlosChavarriaHughes]

Facing the same issue when doing:

# semanage
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 28, in <module>
    import seobject
  File "/usr/lib/python3/dist-packages/seobject.py", line 1039, in <module>
    class portRecords(semanageRecords):
  File "/usr/lib/python3/dist-packages/seobject.py", line 1041, in portRecords
    valid_types = list(list(sepolicy.info(sepolicy.ATTRIBUTE, "port_type"))[0]["types"])
  File "/usr/lib/python3/dist-packages/sepolicy/__init__.py", line 196, in <genexpr>
    return ({
  File "/usr/lib/python3/dist-packages/setools/typeattrquery.py", line 65, in results
    for attr in self.policy.typeattributes():
AttributeError: 'NoneType' object has no attribute 'typeattributes'

OR

# semanage permissive -a httpd_t
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 28, in <module>
    import seobject
  File "/usr/lib/python3/dist-packages/seobject.py", line 1039, in <module>
    class portRecords(semanageRecords):
  File "/usr/lib/python3/dist-packages/seobject.py", line 1041, in portRecords
    valid_types = list(list(sepolicy.info(sepolicy.ATTRIBUTE, "port_type"))[0]["types"])
  File "/usr/lib/python3/dist-packages/sepolicy/__init__.py", line 196, in <genexpr>
    return ({
  File "/usr/lib/python3/dist-packages/setools/typeattrquery.py", line 65, in results
    for attr in self.policy.typeattributes():
AttributeError: 'NoneType' object has no attribute 'typeattributes'

Environment

Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic

Python 3.6.9

pip 20.2.3

python3-setools is already the newest version (4.1.1-3)