semanage: optionally remove previous and linked to reduce disck usage

This patch adds two options to the semanage config file to control whether the previous module directory and linked module are saved after a successful commit to the policy store. The default is to delete both.

On my system this reduces the size of the module directory from 78mb to 22mb.

Signed-off-by Karl MacMillan <[email protected]>

diff -r 5a199c52a29c libsemanage/src/conf-parse.y

libsemanage/src/conf-parse.y Thu Jan 04 11:48:29 2007 -0500 renamed from libsemanage/src/conf-parse.y Wed Jan 03 22:27:17 2007 -0500 +1 -1

@@ -56,7 +56,7 @@ static int parse_errors;
         char *s;
 }
 
-%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE
+%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE SAVE_PREVIOUS 

SAVE_LINKED
%token LOAD_POLICY_START SETFILES_START GENHOMEDIRCON_START %token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START
BLOCK_END
%token PROG_PATH PROG_ARGS

libsemanage/src/conf-parse.y Thu Jan 04 11:48:29 2007 -0500 renamed from libsemanage/src/conf-parse.y Wed Jan 03 22:27:17 2007 -0500 +24 -0

@@ -78,6 +78,8 @@ single_opt:     module_store
         |       version
         |       expand_check
         |       file_mode
+        |       save_previous
+        |       save_linked
         ;
 
 module_store:   MODULE_STORE '=' ARG {

@@ -112,6 +114,24 @@ file_mode:   FILE_MODE '=' ARG  {
                 }
         ;
 
+save_previous:    SAVE_PREVIOUS '=' ARG {
+                    if (strcmp($3, "true") == 0)
+                        current_conf->save_previous = 1;
+            else
+                current_conf->save_previous = 0;       
+                }
+        ;
+
+
+save_linked:    SAVE_LINKED '=' ARG {
+                    if (strcmp($3, "true") == 0)
+                        current_conf->save_linked = 1;
+            else
+                current_conf->save_linked = 0;       
+                }
+        ;
+
+
 command_block:
                 command_start external_opts BLOCK_END  {
                         if (new_external->path == NULL) {

@@ -186,6 +206,9 @@ static int semanage_conf_init(semanage_c
     conf->policyvers = sepol_policy_kern_vers_max();
     conf->expand_check = 1;
     conf->file_mode = 0644;
+
+    conf->save_previous = 0;
+    conf->save_linked = 0;
 
     if ((conf->load_policy =
          calloc(1, sizeof(*(current_conf->load_policy)))) == NULL) {

@@ -284,6 +307,7 @@ void semanage_conf_destroy(semanage_conf
 
 int semanage_error(char *msg)
 {
+    fprintf(stderr, "error parsing semanage configuration file: 
 %s\n", msg);
     parse_errors++;
     return 0;

}
diff -r 5a199c52a29c libsemanage/src/conf-scan.l

libsemanage/src/conf-scan.l Thu Jan 04 11:48:29 2007 -0500 renamed from libsemanage/src/conf-scan.l Wed Jan 03 22:27:17 2007 -0500 +2 -0

@@ -42,6 +42,8 @@ policy-version    return VERSION;
 policy-version    return VERSION;
 expand-check      return EXPAND_CHECK;
 file-mode         return FILE_MODE;
+save-previous     return SAVE_PREVIOUS;
+save-linked       return SAVE_LINKED;
 "[load_policy]"   return LOAD_POLICY_START;
 "[setfiles]"      return SETFILES_START;
 "[genhomedircon]" return GENHOMEDIRCON_START;

diff -r 5a199c52a29c libsemanage/src/direct_api.c

libsemanage/src/direct_api.c Thu Jan 04 11:48:29 2007 -0500 renamed from libsemanage/src/direct_api.c Wed Jan 03 22:27:17 2007 -0500 +24 -7

@@ -509,18 +509,35 @@ static int semanage_direct_commit(semana
         if (retval < 0)
             goto cleanup;
 
-        /* write the linked base */
+        /* write the linked base if we want to save or we have a
+         * verification program that wants it. */
         linked_filename = semanage_path(SEMANAGE_TMP, SEMANAGE_LINKED);
         if (linked_filename == NULL) {
             retval = -1;
             goto cleanup;
         }
-        retval = semanage_write_module(sh, linked_filename, base);
-        if (retval < 0)
-            goto cleanup;
-        retval = semanage_verify_linked(sh);
-        if (retval < 0)
-            goto cleanup;
+        if (sh->conf->save_linked || sh->conf->linked_prog) {
+            retval = semanage_write_module(sh, linked_filename, base);
+            if (retval < 0)
+                goto cleanup;
+            retval = semanage_verify_linked(sh);
+            if (retval < 0)
+                goto cleanup;
+            /* remove the linked policy if we only wrote it for the
+             * verification program. */
+            if (!sh->conf->save_linked) {
+                retval = unlink(linked_filename);
+                if (retval < 0)
+                    goto cleanup;
+            }
+        } else {
+            /* Try to delete the linked copy - this is needed if
+             * the save_link option has changed to prevent the
+             * old linked copy from being copied forever. No error
+             * checking is done because this is likely to fail because
+             * the file does not exist - which is not an error. */
+            unlink(linked_filename);
+        }
 
         /* ==================== File-backed ================== */
 

diff -r 5a199c52a29c libsemanage/src/semanage_conf.h

libsemanage/src/semanage_conf.h Thu Jan 04 11:48:29 2007 -0500 renamed from libsemanage/src/semanage_conf.h Wed Jan 03 22:27:17 2007 -0500 +2 -0

@@ -35,6 +35,8 @@ typedef struct semanage_conf {
     int server_port;
     int policyvers;        /* version for server generated policies */
     int expand_check;
+    int save_previous;
+    int save_linked;
     mode_t file_mode;
     struct external_prog *load_policy;
     struct external_prog *setfiles;

diff -r 5a199c52a29c libsemanage/src/semanage_store.c

This patch adds two options to the semanage config file to control whether the previous module directory and linked module are saved after a successful commit to the policy store. The default is to delete both.

On my system this reduces the size of the module directory from 78mb to 22mb.

Signed-off-by Karl MacMillan <[email protected]>

libsemanage/src/semanage_store.c +2 -0

+	}
+
        cleanup:
  	semanage_release_active_lock(sh);
  	return retval;

Quoted 5 lines · Karl MacMillan

This patch adds two options to the semanage config file to control whether the previous module directory and linked module are saved after a successful commit to the policy store. The default is to delete both.

On my system this reduces the size of the module directory from 78mb to 22mb.

Signed-off-by Karl MacMillan <[email protected]>

A couple of minor suggestions...

libsemanage/src/conf-parse.y file_mode: FILE_MODE '=' ARG { · line 118

Quoted 9 lines

diff -r 5a199c52a29c libsemanage/src/conf-parse.y

libsemanage/src/conf-parse.y +2 -0

@@ -112,6 +114,24 @@ file_mode:   FILE_MODE '=' ARG  {
                  }
          ;
 
+save_previous:    SAVE_PREVIOUS '=' ARG {
+	                if (strcmp($3, "true") == 0)

Use strcasecmp() here

libsemanage/src/conf-parse.y file_mode: FILE_MODE '=' ARG { · line 120

Quoted 2 lines

libsemanage/src/conf-parse.y +2 -0

+		                current_conf->save_previous = 1;
+			else

Explicitly check for "false" here.

libsemanage/src/conf-parse.y file_mode: FILE_MODE '=' ARG { · line 121

Quoted 1 line

libsemanage/src/conf-parse.y +1 -0

+				current_conf->save_previous = 0;

Add another else clause to report an error otherwise.

libsemanage/src/conf-parse.y file_mode: FILE_MODE '=' ARG { · line 130

Quoted 10 lines

libsemanage/src/conf-parse.y +9 -0

+                }
+        ;
+
+
+save_linked:    SAVE_LINKED '=' ARG {
+	                if (strcmp($3, "true") == 0)
+		                current_conf->save_linked = 1;
+			else
+				current_conf->save_linked = 0;

Ditto.

Quoted 2 lines

libsemanage/src/conf-parse.y +0 -0

@@ -284,6 +307,7 @@ void semanage_conf_destroy(semanage_conf
 

libsemanage/src/conf-parse.y void semanage_conf_destroy(semanage_conf · line 313

Quoted 6 lines

libsemanage/src/conf-parse.y +1 -0

  int semanage_error(char *msg)
  {
+	fprintf(stderr, "error parsing semanage configuration file: %s\n", msg);
  	parse_errors++;
  	return 0;
  }

Offhand, this seems inconsistent with the standard error reporting mechanism in libsemanage, but naturally we don't have a handle here, and the generated parser/scanner will use stderr too. No change required here I suppose, but not ideal for a library.

libsemanage/src/semanage_store.c static int semanage_commit_sandbox(seman · line 1227

Quoted 8 lines

diff -r 5a199c52a29c libsemanage/src/semanage_store.c

libsemanage/src/semanage_store.c +1 -0

@@ -1224,6 +1224,10 @@ static int semanage_commit_sandbox(seman
  		goto cleanup;
  	}
 
+	if (sh->conf->save_previous != 1) {

Simplify as if (!sh->conf->save_previous)

libsemanage/src/semanage_store.c static int semanage_commit_sandbox(seman · line 1228

Quoted 1 line

libsemanage/src/semanage_store.c +1 -0

+		retval = semanage_remove_directory(backup);

Needs an ERR() statement to report the error?
And should it be an error or just a warning, as the actual commit did succeed?

New version below:

Signed-off-by Karl MacMillan <[email protected]>

diff -r 5eec2dbb1b6c libsemanage/src/direct_api.c

libsemanage/src/direct_api.c +5 -7

@@ -509,18 +509,35 @@ static int semanage_direct_commit(semana
  		if (retval < 0)
  			goto cleanup;
 
-		/* write the linked base */
+		/* write the linked base if we want to save or we have a
+		 * verification program that wants it. */
  		linked_filename = semanage_path(SEMANAGE_TMP, SEMANAGE_LINKED);
  		if (linked_filename == NULL) {
  			retval = -1;
  			goto cleanup;
  		}
-		retval = semanage_write_module(sh, linked_filename, base);
-		if (retval < 0)
-			goto cleanup;
-		retval = semanage_verify_linked(sh);
-		if (retval < 0)
-			goto cleanup;
+		if (sh->conf->save_linked || sh->conf->linked_prog) {
+			retval = semanage_write_module(sh, linked_filename, base);
+			if (retval < 0)

libsemanage/src/semanage_store.c +3 -0

+		goto cleanup;
+	}
+
        cleanup:
  	semanage_release_active_lock(sh);
  	return retval;

Quoted 5 lines · Stephen Smalley

Quoted 3 lines · Karl MacMillan

New version below:

Signed-off-by Karl MacMillan <[email protected]>

Another try below.

This patch adds two options to the semanage config file to control whether the previous module directory and linked module are saved after a successful commit to the policy store. The default is to delete both.

On my system this reduces the size of the module directory from 78mb to 22mb.

Signed-off-by Karl MacMillan <[email protected]>

diff -r 701cfcc87cf7 libsemanage/src/conf-parse.y

libsemanage/src/conf-parse.y +1 -1

@@ -56,7 +56,7 @@ static int parse_errors;
          char *s;
  }
 
-%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE
+%token MODULE_STORE VERSION EXPAND_CHECK FILE_MODE SAVE_PREVIOUS 

SAVE_LINKED
%token LOAD_POLICY_START SETFILES_START GENHOMEDIRCON_START %token VERIFY_MOD_START VERIFY_LINKED_START VERIFY_KERNEL_START BLOCK_END %token PROG_PATH PROG_ARGS

libsemanage/src/conf-parse.y +30 -0

@@ -78,6 +78,8 @@ single_opt:     module_store
          |       version
          |       expand_check
          |       file_mode
+        |       save_previous
+        |       save_linked
          ;
 
  module_store:   MODULE_STORE '=' ARG {

@@ -112,6 +114,30 @@ file_mode:   FILE_MODE '=' ARG  {
                  }
          ;
 
+save_previous:    SAVE_PREVIOUS '=' ARG {
+	                if (strcasecmp($3, "true") == 0)
+		                current_conf->save_previous = 1;
+			else if (strcasecmp($3, "false") == 0)
+				current_conf->save_previous = 0;		
+			else {
+				yyerror("save-previous can only be 'true' or 'false'");
+			}
+                }
+        ;
+
+
+save_linked:    SAVE_LINKED '=' ARG {
+	                if (strcasecmp($3, "true") == 0)
+		                current_conf->save_linked = 1;
+			else if (strcasecmp($3, "false") == 0)
+				current_conf->save_linked = 0;		
+			else {
+				yyerror("save-linked can only be 'true' or 'false'");
+			}
+                }
+        ;
+
+
  command_block:
                  command_start external_opts BLOCK_END  {
                          if (new_external->path == NULL) {

@@ -186,6 +212,9 @@ static int semanage_conf_init(semanage_c
  	conf->policyvers = sepol_policy_kern_vers_max();
  	conf->expand_check = 1;
  	conf->file_mode = 0644;
+
+	conf->save_previous = 0;
+	conf->save_linked = 0;
 
  	if ((conf->load_policy =
  	     calloc(1, sizeof(*(current_conf->load_policy)))) == NULL) {

@@ -284,6 +313,7 @@ void semanage_conf_destroy(semanage_conf
 
  int semanage_error(char *msg)
  {
+	fprintf(stderr, "error parsing semanage configuration file: %s\n", msg);
  	parse_errors++;
  	return 0;
  }

diff -r 701cfcc87cf7 libsemanage/src/conf-scan.l

libsemanage/src/conf-scan.l +2 -0

@@ -42,6 +42,8 @@ policy-version    return VERSION;
  policy-version    return VERSION;
  expand-check      return EXPAND_CHECK;
  file-mode         return FILE_MODE;
+save-previous     return SAVE_PREVIOUS;
+save-linked       return SAVE_LINKED;
  "[load_policy]"   return LOAD_POLICY_START;
  "[setfiles]"      return SETFILES_START;
  "[genhomedircon]" return GENHOMEDIRCON_START;

diff -r 701cfcc87cf7 libsemanage/src/direct_api.c

libsemanage/src/direct_api.c +27 -7

@@ -509,18 +509,38 @@ static int semanage_direct_commit(semana
  		if (retval < 0)
  			goto cleanup;
 
-		/* write the linked base */
+		/* write the linked base if we want to save or we have a
+		 * verification program that wants it. */
  		linked_filename = semanage_path(SEMANAGE_TMP, SEMANAGE_LINKED);
  		if (linked_filename == NULL) {
  			retval = -1;
  			goto cleanup;
  		}
-		retval = semanage_write_module(sh, linked_filename, base);
-		if (retval < 0)
-			goto cleanup;
-		retval = semanage_verify_linked(sh);
-		if (retval < 0)
-			goto cleanup;
+		if (sh->conf->save_linked || sh->conf->linked_prog) {
+			retval = semanage_write_module(sh, linked_filename, base);
+			if (retval < 0)
+				goto cleanup;
+			retval = semanage_verify_linked(sh);
+			if (retval < 0)
+				goto cleanup;
+			/* remove the linked policy if we only wrote it for the
+			 * verification program. */
+			if (!sh->conf->save_linked) {
+				retval = unlink(linked_filename);
+				if (retval < 0) {
+					ERR(sh, "could not remove linked base %s",
+					    linked_filename);
+					goto cleanup;
+				}
+			}
+		} else {
+			/* Try to delete the linked copy - this is needed if
+			 * the save_link option has changed to prevent the
+			 * old linked copy from being copied forever. No error
+			 * checking is done because this is likely to fail because
+			 * the file does not exist - which is not an error. */
+			unlink(linked_filename);
+		}
 
  		/* ==================== File-backed ================== */
 

diff -r 701cfcc87cf7 libsemanage/src/semanage_conf.h

libsemanage/src/semanage_conf.h +2 -0

@@ -35,6 +35,8 @@ typedef struct semanage_conf {
  	int server_port;
  	int policyvers;		/* version for server generated policies */
  	int expand_check;
+	int save_previous;
+	int save_linked;
  	mode_t file_mode;
  	struct external_prog *load_policy;
  	struct external_prog *setfiles;

diff -r 701cfcc87cf7 libsemanage/src/semanage_store.c

libsemanage/src/semanage_store.c +8 -0

@@ -1224,6 +1224,14 @@ static int semanage_commit_sandbox(seman
  		goto cleanup;
  	}
 
+	if (!sh->conf->save_previous) {
+		retval = semanage_remove_directory(backup);
+		if (retval < 0) {
+			ERR(sh, "Could not delete previous directory %s.", backup);
+			goto cleanup;
+		}
+	}
+
        cleanup:
  	semanage_release_active_lock(sh);
  	return retval;

Quoted 3 lines · Karl MacMillan

New version below:

Signed-off-by Karl MacMillan <[email protected]>