Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add functionality and tests for managing selinux port policy #47230

Merged
merged 2 commits into from Apr 26, 2018

Conversation

@leeclemens
Copy link
Contributor

@leeclemens leeclemens commented Apr 22, 2018

What does this PR do?

Allow usage of semanage port via modules and states to view/add/delete SELinux port policies.

What issues does this PR fix or reference?

Fixes #42635

New Behavior

Modules:

  • selinux.port_get_policy
  • selinux.port_add_or_delete_policy

States:

  • selinux.port_policy_present
  • selinux.port_policy_absent

Tests written?

Yes (for validating arguments and parsing semanage output)

Commits signed with GPG?

Yes

Please review Salt's Contributing Guide for best practices.

See GitHub's page on GPG signing for more information about signing commits with GPG.

@leeclemens leeclemens force-pushed the add-selinux-port branch 2 times, most recently from ef022c2 to e5f3487 Apr 22, 2018
Copy link
Contributor

@gtmanfred gtmanfred left a comment

Just some doc fixes, and this should be good.


def port_get_policy(name, sel_type=None, protocol=None, port=None):
'''
.. versionadded:: develop
Copy link
Contributor

@gtmanfred gtmanfred Apr 23, 2018

This should be Fluorine.

Copy link
Contributor Author

@leeclemens leeclemens Apr 23, 2018

Should it be set to literally "Fluorine"? https://docs.saltstack.com/en/latest/topics/releases/version_numbers.html shows the version number as TBD - I wasn't sure how/when these get updated when released.

Copy link
Contributor

@gtmanfred gtmanfred Apr 23, 2018

Yes, it should be just the word Fluorine we do a search and replace on the code word once we know when the release date will be.

Copy link
Contributor Author

@leeclemens leeclemens Apr 23, 2018

Thanks, updated


def port_policy_present(name, sel_type, protocol=None, port=None, sel_range=None):
'''
.. versionadded:: develop
Copy link
Contributor

@gtmanfred gtmanfred Apr 23, 2018

Fluorine here too

Copy link
Contributor Author

@leeclemens leeclemens Apr 23, 2018

Thanks, updated

Returns the result of the call to semanage.
name
Copy link
Contributor

@gtmanfred gtmanfred Apr 23, 2018

Can you document the action variable as well? including that it is add or delete.

Copy link
Contributor Author

@leeclemens leeclemens Apr 23, 2018

Good catch, adding that as well

@leeclemens leeclemens force-pushed the add-selinux-port branch 5 times, most recently from ebb5790 to fb5efaa Apr 23, 2018
@leeclemens leeclemens force-pushed the add-selinux-port branch from 03f514a to fecf6d4 Apr 23, 2018
@rallytime
Copy link
Contributor

@rallytime rallytime commented Apr 25, 2018

re-run py

'port': parts.group(3).strip(), }


def port_add_or_delete_policy(action, name, sel_type=None, protocol=None, port=None, sel_range=None):
Copy link
Collaborator

@terminalmage terminalmage Apr 26, 2018

This seems like a cumbersome name for a function, and also redundant since you're making the user specify the action as an argument. How about changing this function name to _port_add_or_delete_policy() and then making two separate functions to add and delete, each of which is a one-liner that calls the common function. For example:

def port_add_policy(name, sel_type=None, protocol=None, port=None, sel_range=None):
    '''
    <docstring goes here>
    '''
    return _port_add_or_delete_policy('add', name, sel_type, protocol, port, sel_range)


def port_delete_policy(name, sel_type=None, protocol=None, port=None, sel_range=None):
    '''
    <docstring goes here>
    '''
    return _port_add_or_delete_policy('delete', name, sel_type, protocol, port, sel_range)

Copy link
Contributor

@gtmanfred gtmanfred Apr 26, 2018

This is the same naming scheme as the rest of the modules in this execution module.

https://github.com/saltstack/salt/blob/develop/salt/modules/selinux.py#L483

Probably good to rename all of them honestly, but i think that can be done in a different pr.

Copy link
Contributor Author

@leeclemens leeclemens Apr 26, 2018

Yes, I pretty much copied the fcontext naming/flow and altered it accordingly. I'll make a note to put together another PR - thanks for the feedback from both of you!

Copy link
Contributor Author

@leeclemens leeclemens May 12, 2018

I submitted PR #47622

Copy link
Contributor

@gtmanfred gtmanfred May 13, 2018

Awesome thanks @leeclemens

@rallytime rallytime merged commit 587c438 into saltstack:develop Apr 26, 2018
5 of 10 checks passed
@leeclemens leeclemens deleted the add-selinux-port branch Apr 27, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

4 participants