From a9ed1e6ae1dfd7427129819c8f416e436caa69c5 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Jan 08 2019 22:39:45 +0000
Subject: Issue 50122 - Selinux test for presence


Description:  Selinux is not present on all systems. Trying to
import python-selinux when it's not available fails, but we
can not guarantee that the with_selinux flag to defaults is
correct because some systems build with selinux but may not
have it enabled. We should check if we can access the tools
instead, and skip them (with warnings) if we can't make changes

https://pagure.io/389-ds-base/issue/50122

Reviewed by: mreynolds

---

diff --git a/m4/doxygen.m4 b/m4/doxygen.m4
index 2ffd6bd..a73c7fd 100644
--- a/m4/doxygen.m4
+++ b/m4/doxygen.m4
@@ -8,7 +8,7 @@
 
 AC_CHECK_PROGS([DOXYGEN], [doxygen])
 if test -z "$DOXYGEN";
-    then AC_MSG_ERROR([Doxygen not found - continuing without Doxygen support])
+    then AC_MSG_WARN([Doxygen not found - continuing without Doxygen support])
 fi
 
 AC_MSG_RESULT([using system dokygen])
diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index d8fc2a8..73bc80d 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -16,7 +16,6 @@ import socket
 import subprocess
 import getpass
 import configparser
-import selinux
 from lib389 import _ds_shutil_copytree, DirSrv
 from lib389._constants import *
 from lib389.properties import *
@@ -33,7 +32,8 @@ from lib389.utils import (
     is_a_dn,
     ensure_str,
     socket_check_open,
-    selinux_label_port)
+    selinux_label_port,
+    selinux_restorecon)
 
 ds_paths = Paths()
 
@@ -806,15 +806,11 @@ class SetupDs(object):
                 selinux_label_port(slapd['secure_port'])
 
         # Do selinux fixups
-        if not self.containerised and general['selinux'] and selinux.is_selinux_enabled():
+        if not self.containerised and general['selinux']:
             selinux_paths = ('backup_dir', 'cert_dir', 'config_dir', 'db_dir', 'ldif_dir',
                              'lock_dir', 'log_dir', 'run_dir', 'schema_dir', 'tmp_dir')
             for path in selinux_paths:
-                try:
-                    selinux.restorecon(slapd[path], recursive=True)
-                except:
-                    self.log.debug("Failed to run restorecon on: " + slapd[path])
-                    pass
+                selinux_restorecon(path)
 
             selinux_label_port(slapd['port'])
 
diff --git a/src/lib389/lib389/utils.py b/src/lib389/lib389/utils.py
index 55ef7c7..258afe8 100644
--- a/src/lib389/lib389/utils.py
+++ b/src/lib389/lib389/utils.py
@@ -1,5 +1,6 @@
 # --- BEGIN COPYRIGHT BLOCK ---
 # Copyright (C) 2015 Red Hat, Inc.
+# Copyright (C) 2019 William Brown <william@blackhats.net.au>
 # All rights reserved.
 #
 # License: GPL (version 3 or any later version).
@@ -34,8 +35,6 @@ import sys
 import filecmp
 import six
 import shlex
-import selinux
-import sepolicy
 import subprocess
 from socket import getfqdn
 from ldapurl import LDAPUrl
@@ -172,6 +171,28 @@ _chars = {
 # Utilities
 #
 
+def selinux_restorecon(path):
+    """
+    Relabel a filesystem rooted at path.
+
+    :param path: The filesystem path to recursively relabel
+    :type path: str:
+    """
+
+    try:
+        import selinux
+    except ImportError:
+        log.error('selinux python module not found, skipping relabel path %s' % path)
+        return
+
+    if not selinux.is_selinux_enabled():
+        log.error('selinux is disabled, skipping relabel path %s' % path)
+        return
+
+    try:
+        selinux.restorecon(slapd[path], recursive=True)
+    except:
+        log.debug("Failed to run restorecon on: " + slapd[path])
 
 def selinux_label_port(port, remove_label=False):
     """
@@ -183,9 +204,27 @@ def selinux_label_port(port, remove_label=False):
     :type remove_label: boolean
     :raises: ValueError: Error message
     """
+    try:
+        import selinux
+    except ImportError:
+        log.error('selinux python module not found, skipping port labeling.')
+        return
+
+    try:
+        import sepolicy
+    except ImportError:
+        log.error('sepolicy python module not found, skipping port labeling.')
+        return
+
+    if not selinux.is_selinux_enabled():
+        log.error('selinux is disabled, skipping port relabel')
+        return
 
+    # We only label ports that ARE NOT in the default policy that comes with
+    # a RH based system.
     selinux_default_ports = [389, 636, 3268, 3269, 7389]
-    if not selinux.is_selinux_enabled() or port in selinux_default_ports:
+    if port in selinux_default_ports:
+        log.error('port %s already in %s, skipping port relabel' % (port, selinux_default_ports))
         return
 
     label_set = False