libsemanage: fix deprecation warning for bison

The %name-prefix="foo" syntax was deprecated in bison 2.3b [1], which
was released in 2006. This patches fixes the syntax to use the newer
syntax. This breaks support for older versions of bison.

[1] http://lists.gnu.org/archive/html/help-bison/2009-10/msg00018.html

Reported-by: Ilya Frolov <ilya.a.frolov@gmail.com>
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libselinux: Compiled file context files and the original should have the same permissions

Currently the compiled file context files can end up with different
permissions then the original.  This can lead to non priv users
not being able to read the compiled versions.
sepolgen: remove unnecessary grammar in interface call param list

The addition of this rule caused interface vectors to be less accurate.
The grammar looks correct without the rule, so remove it.

Reverted hunk from commit 17cc87e56b0241688c119f774f103622b002e0ae

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: fix typo in tests makefile -o -> -O

Fixed typo in the tests Makefile where '-o' should have been '-O'.

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: only try to compile file contexts if they exist

It is not a requirement that all file context files exists (e.g.
file_contexts.local is not mandatory). However, sefcontext_compile is
executed for all file contexts files regardless of existance, which
results in an error when they do not exist and causes policy load to
fail. This modifies libsemanage so that sefcontext_compile is only
executed on file contexts that do exist.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
libsemanage: fix memory leak when setting a custom store_path

A strdup was setting store_path without freeing the original
value in the semanage conf.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Revert "libsemanage: Cleanup/fix enable/disable/remove module."

This reverts commit c9b09be4244f3c90cee19d9e3feca324f0e0e636.
Revert "libsemanage: Use default semanage.conf as a fallback"

This reverts commit 4120df1c6ea85aa56ed602e46a4030d9e4e45ee6.
Revert "libsemanage: Alternate path for semanage.conf"

This reverts commit 66dd98b83a519840a26be7fa5644c982524f3bf7.
Revert "libsemanage: change module disabled from rename to symlink"

This reverts commit 60c780ffb6e7a48a2121e871ad20471a8fe0337d.
Revert "fixes to commit 847d27b8385ce77ac71df8aa58a2d298b33d1ea4"

This reverts commit c1323f22c7ad93b975eb8b6a251b893bc88f240f.
Revert "Last attempt at upstreaming semodule_disable patch."

This reverts commit 654dcb897e49908a958dae55cf29793412c4b390.

Conflicts:

	policycoreutils/semodule/semodule.c
Revert "policycoreutils: semodule: support for alternative root paths"

This reverts commit 5e096d9ceb637a785d4537555799602a3de2b3dc.

Conflicts:

	policycoreutils/semodule/semodule.c
Revert "libsemanage: introduce semanage_set_root and friends"

This reverts commit 9cd587f5533456e7b26601e27e65744272e2e783.

Conflicts:

	libsemanage/include/semanage/handle.h
semanage: move permissive module creation to /tmp

semanage currently uses /var/lib/selinux/tmp to create permissive
modules. However, with the move to /var, the same tmp directory is used
for building policy binaries, causing a conflict. This patch creates a
random temporary directory in /tmp and moves permissive module creation
to that directory, avoiding the directory conflict.

This patch also imports shutil for rmtree to easily delete all created
temporary files.

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: move the module store to /var/lib/selinux

This patch moves the module store from /etc/selinux/<store>/modules to
/var/lib/selinux/<store>.

This move will allow for the use of a read-only /etc/selinux. Currently
that is not possible with semanage because of the lock files.

A consequence of this move is that packagers of libsemanage should
create the /var/lib/selinux directory.

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: split final files into /var/lib/selinux/tmp

This patch moves the final files from inside
/var/lib/selinux/<store>/[active|previous|tmp] to
/var/lib/selinux/tmp/<store>. The move is done to facilitate using
source control management on the /var/lib/selinux/<store> directory. If
these files remain in /var/lib/selinux/<store> they will pose a size
problem if an SCM like git is used as we'd be storing lots of binary
diffs. We are suggesting making this change now, rather than later when
source policy, SCM, and CIL[1] support are available, to ease the
migration burden.

These are the files that have been moved:

/var/lib/selinux/<store>/active/...	/var/lib/selinux/tmp/<store>/...

file_contexts				contexts/files/file_contexts
file_contexts.homedirs			contexts/files/file_contexts.homedirs
file_contexts.local			contexts/files/file_contexts.local
netfilter_contexts			contexts/netfilter_contexts
policy.kern				policy/policy.<policyversion>
seusers.final				seusers

The layout of these files in /var/lib/selinux/tmp/<store> is designed to
mirror their locations in /etc/selinux/<store>. This should help clarify
the relationship between these final files and the files installed in
etc.

One consequence of this move is that reverting to the previous policy
version requires a policy rebuild. Currently you can revert without
rebuilding.

[1] CIL RFC: http://marc.info/?l=selinux&m=124759244409438&w=2

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: update unit tests for move to /var/lib/selinux

This updates the unit tests to accommodate the change in layout (no top
level 'modules' directory).

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: add default priority to semanage_handle_t

For backwards compatiblity purposes we need to provide a default
priority that the current set of module install/upgrade/remove functions
can use.

The default priority is 400.

Adds semanage_module_validate_priority so that it can be used to verify
the given priority. See next patch for other validation functions.

Signed-off-by: Chad Sellers <csellers@tresys.com>
libsemanage: augment semanage_module_info_t and provide semanage_module_key_t

Adds priority, language ext, and enabled fields to
semanage_module_info_t.

Adds get/set functions for all semanage_module_info_t/key_t fields. This
is necessary so that semanage_module_info_t/key_t can be used in the
specifing meta data on source policies.

Adds create, destroy, and init functions for semanage_module_info_t and
semanage_module_key_t. Create initializes and allocates, destroy
deallocates fields (but not struct), and init initializes fields.

Provide several utility functions for converting a string priority to a
uint16_t and validating fields.

Adds semanage_module_get_path for getting module specific file paths.

Signed-off-by: Chad Sellers <csellers@tresys.com>