Only invoke RPM on RPM-enabled Linux distributions

When calling "sepolgen generate" to automatically generate a SELinux policy template, the command fails when it cannot invoke RPM related commands on Linux distributions that do not support RPM by default:

Failed to retrieve rpm info for selinux-policy
Traceback (most recent call last):
File "/usr/lib/python-exec/python2.7/sepolicy", line 643, in <module>
args.func(args)
File "/usr/lib/python-exec/python2.7/sepolicy", line 517, in generate
print mypolicy.generate(args.path)
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1370, in generate

    out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))

File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1219, in write_spec
fd.write(self.generate_spec())
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1181, in generate_spec
selinux_policyver = get_rpm_nvr_list("selinux-policy")[1]
TypeError: 'NoneType' object has no attribute '__getitem__'

As the RPM related steps are only needed on RPM-enabled distributions, we should ignore these steps on other Linux distribution platforms.

In this patch, we use the Python platform module to get the Linux distribution, and only start the RPM-related activities on Linux distributions that use RPM as their native package manager.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policycoreutils/sepolicy/sepolicy/generate.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

policycoreutils/sepolicy/sepolicy/generate.py +5 -2

index 6b53035..4858582 100644
@@ -26,6 +26,7 @@ import re
 import sepolicy
 from sepolicy import get_all_types, get_all_attributes, get_all_roles
 import time
+import platform
 
 from templates import executable
 from templates import boolean

@@ -1171,7 +1172,8 @@ allow %s_t %s_t:%s_socket name_%s;
 			newsh += re.sub("TEMPLATETYPE", self.name, t1)
 
                 newsh += self.generate_user_sh()
-                newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
+                if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+                    newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
 
 		return newsh
 

@@ -1367,6 +1369,7 @@ Warning %s does not exist
             out += "%s # %s\n" % (self.write_if(out_dir), _("Interface file"))
             out += "%s # %s\n" % (self.write_fc(out_dir), _("File Contexts file"))
             if self.type != NEWTYPE:
-                out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
+                if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+                    out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
                 out += "%s # %s\n" % (self.write_sh(out_dir), _("Setup Script"))
             return out

Quoted 5 lines · Sven Vermeulen

In this patch, we use the Python platform module to get the Linux distribution, and only start the RPM-related activities on Linux distributions that use RPM as their native package manager.

Signed-off-by Sven Vermeulen <[email protected]>

Is there a more general way that we could do this without hardcoding checks of distribution names? Maybe we could just test for the existence of rpm?

Quoted 10 lines · Stephen Smalley

Quoted 5 lines · Sven Vermeulen

In this patch, we use the Python platform module to get the Linux distribution, and only start the RPM-related activities on Linux distributions that use RPM as their native package manager.

Signed-off-by Sven Vermeulen <[email protected]>

Is there a more general way that we could do this without hardcoding checks of distribution names? Maybe we could just test for the existence of rpm?

That wouldn't be sufficient.

The rpm binary might be installed for other reasons. The code in sepolicy is used to query the rpm database and search for specific package names. This is distribution-specific behavior.

If you rather check on the rpm binary, then additional checks will need to be added to make sure that the assumptions that the code takes (such as "selinux-policy" package being available) are valid as well.

Quoted 10 lines · Sven Vermeulen

Quoted 5 lines

In this patch, we use the Python platform module to get the Linux distribution, and only start the RPM-related activities on Linux distributions that use RPM as their native package manager.

Signed-off-by Sven Vermeulen <[email protected]>

Is there a more general way that we could do this without hardcoding checks of distribution names? Maybe we could just test for the existence of rpm?

That wouldn't be sufficient.

The rpm binary might be installed for other reasons. The code in sepolicy is used to query the rpm database and search for specific package names. This is distribution-specific behavior.

If you rather check on the rpm binary, then additional checks will need to be added to make sure that the assumptions that the code takes (such as "selinux-policy" package being available) are valid as well.

When calling "sepolgen generate" to automatically generate a SELinux policy template, the command fails when it cannot invoke RPM related commands on Linux distributions that do not support RPM by default:

Failed to retrieve rpm info for selinux-policy
Traceback (most recent call last):
File "/usr/lib/python-exec/python2.7/sepolicy", line 643, in <module>
args.func(args)
File "/usr/lib/python-exec/python2.7/sepolicy", line 517, in generate
print mypolicy.generate(args.path)
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1370, in generate

    out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))

File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1219, in write_spec
fd.write(self.generate_spec())
File "/usr/lib64/python2.7/site-packages/sepolicy/generate.py", line 1181, in generate_spec
selinux_policyver = get_rpm_nvr_list("selinux-policy")[1]
TypeError: 'NoneType' object has no attribute '__getitem__'

As the RPM related steps are only needed on RPM-enabled distributions, we should ignore these steps on other Linux distribution platforms.

In this patch, we use the Python platform module to get the Linux distribution, and only start the RPM-related activities on Linux distributions that use RPM as their native package manager.

Signed-off-by Sven Vermeulen <[email protected]>

---
 policycoreutils/sepolicy/sepolicy/generate.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

policycoreutils/sepolicy/sepolicy/generate.py +5 -2

index 6b53035..4858582 100644
@@ -26,6 +26,7 @@ import re
 import sepolicy
 from sepolicy import get_all_types, get_all_attributes, get_all_roles
 import time
+import platform
 
 from templates import executable
 from templates import boolean

@@ -1171,7 +1172,8 @@ allow %s_t %s_t:%s_socket name_%s;
 			newsh += re.sub("TEMPLATETYPE", self.name, t1)
 
                 newsh += self.generate_user_sh()
-                newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
+                if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+                    newsh += re.sub("TEMPLATEFILE", self.file_name, script.rpm)
 
 		return newsh
 

@@ -1367,6 +1369,7 @@ Warning %s does not exist
             out += "%s # %s\n" % (self.write_if(out_dir), _("Interface file"))
             out += "%s # %s\n" % (self.write_fc(out_dir), _("File Contexts file"))
             if self.type != NEWTYPE:
-                out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
+                if (platform.linux_distribution(full_distribution_name=0)[0] in ("redhat","centos","SuSE","fedora","mandrake","mandriva")):
+                    out += "%s # %s\n" % (self.write_spec(out_dir), _("Spec file"))
                 out += "%s # %s\n" % (self.write_sh(out_dir), _("Setup Script"))
             return out