1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
# vim:expandtab:autoindent:tabstop=4:shiftwidth=4:filetype=python:textwidth=0:
# License: GPL2 or later see COPYING
# Written by Jan Vcelak
# Copyright (C) 2010 Jan Vcelak <jvcelak@redhat.com>
# python library imports
import os
import sys
# our imports
from mock.trace_decorator import decorate, traceLog, getLog
import mock.util
requires_api_version = "1.0"
# plugin entry point
decorate(traceLog())
def init(rootObj, conf):
if mock.util.selinuxEnabled():
getLog().info("selinux enabled")
SELinux(rootObj, conf)
else:
getLog().info("selinux disabled")
# classes
class SELinux(object):
"""On SELinux enabled box, this plugin will pretend, that SELinux is disabled in build environment.
- fake /proc/filesystems is mounted into build enviroment, excluding selinuxfs
- option '--setopt=tsflags=nocontext' is appended to each 'yum' command
"""
decorate(traceLog())
def __init__(self, rootObj, conf):
self.rootObj = rootObj
self.conf = conf
self.filesystems = os.path.join(conf["cachedir"], "filesystems")
self.chrootFilesystems = rootObj.makeChrootPath("/proc/filesystems")
rootObj.addHook("preinit", self._selinuxPreInitHook)
rootObj.addHook("postbuild", self._selinuxPostBuildHook)
rootObj.addHook("initfailed", self._selinuxPostBuildHook)
if self._selinuxYumIsSetoptSupported():
rootObj.addHook("preyum", self._selinuxPreYumHook)
rootObj.addHook("postyum", self._selinuxPostYumHook)
else:
getLog().warn("selinux: 'yum' does not support '--setopt' option")
decorate(traceLog())
def _selinuxPreInitHook(self):
host = open("/proc/filesystems")
build = open(self.filesystems, "w")
for line in host:
if not "selinuxfs" in line:
build.write(line)
build.close()
host.close()
self.rootObj.mountCmds.append("mount -n --bind %s %s" % (self.filesystems, self.chrootFilesystems))
self.rootObj.umountCmds.insert(0, "umount -n %s" % self.chrootFilesystems)
decorate(traceLog())
def _selinuxPostBuildHook(self):
os.unlink(self.filesystems)
decorate(traceLog())
def _selinuxPreYumHook(self):
self._originalUtilDo = mock.util.do
mock.util.do = self._selinuxDoYum
decorate(traceLog())
def _selinuxPostYumHook(self):
mock.util.do = self._originalUtilDo
decorate(traceLog())
def _selinuxDoYum(self, command, *args, **kargs):
option = "--setopt=tsflags=nocontexts"
if type(command) is list:
command.append(option)
elif type(command) is str:
command += " %s" % option
return self._originalUtilDo(command, *args, **kargs)
decorate(traceLog())
def _selinuxYumIsSetoptSupported(self):
# ugly hack: discover, whether yum supports --setopt option
sys.path.insert(0, '/usr/share/yum-cli')
import cli
supported = hasattr(cli.YumBaseCli, "_parseSetOpts")
sys.path.pop(0)
return supported
|
