added fields to describe how arguments are used (to be used by shadow.py)

1 files changed, 61 insertions, 6 deletions

diff --git a/share/libmsec.py b/share/libmsec.py
index f95e1c7..d964e74 100644
--- a/share/libmsec.py
+++ b/share/libmsec.py
@@ -81,6 +81,9 @@ NONE=0
 ALL=1
 LOCAL=2
 
+ALL_LOCAL_NONE_TRANS = {ALL : 'ALL', NONE: 'NONE', LOCAL : 'LOCAL'}
+YES_NO_TRANS = {1 : 'yes', 0 : 'no'}
+
 # config files => actions
 
 ConfigFile.add_config_assoc(INITTAB, '/sbin/telinit q')
@@ -91,7 +94,7 @@ ConfigFile.add_config_assoc(LILOCONF, '[ `/usr/sbin/detectloader` = LILO ] && /s
 ConfigFile.add_config_assoc(SYSLOGCONF, '[ -f /var/lock/subsys/syslog ] && service syslog reload')
 ConfigFile.add_config_assoc('^/etc/issue$', '/usr/bin/killall mingetty')
 
-#
+# rules
 
 def changing_level():
     'D'
@@ -142,6 +145,8 @@ during the installation of packages.'''
         _interactive and log(_('Restricting chkconfig --add from rpm'))
         server.symlink(SERVER + '.' + str(level))
 
+create_server_link.arg_trans = YES_NO_TRANS
+
 # helper function for set_root_umask and set_user_umask
 def set_umask(variable, umask, msg):
     'D'
@@ -214,6 +219,9 @@ local connection) and NONE (no connection).'''
         error(_('invalid allow_x_connections arg: %s') % arg)
         return
 
+allow_x_connections.arg_trans=ALL_LOCAL_NONE_TRANS
+allow_x_connections.one_arg = 1
+
 STARTX_REGEXP = '(\s*clientargs=".*) -nolisten tcp(.*")'
 XSERVERS_REGEXP = '(\s*[^#]+/usr/X11R6/bin/X .*) -nolisten tcp(.*)'
 GDMCONF_REGEXP = '(\s*command=.*/X.*?) -nolisten tcp(.*)$'
@@ -250,6 +258,8 @@ to the X server on the tcp port 6000 or not.'''
             xservers.exists() and xservers.replace_line_matching('(\s*[^#]+/usr/X11R6/bin/X .*?)( -nolisten tcp)?$', '@1 -nolisten tcp', 0, 1)
             gdmconf.exists() and gdmconf. replace_line_matching('(\s*command=.*/X.*?)( -nolisten tcp)?$', '@1 -nolisten tcp', 0, 1)
 
+allow_xserver_to_listen.arg_trans = YES_NO_TRANS
+
 def set_shell_timeout(val):
     '''  Set the shell timeout. A value of zero means no timeout.'''
 
@@ -341,7 +351,9 @@ def allow_reboot(arg):
         sysctlconf.set_shell_variable('kernel.sysrq', 0)
         kdmrc.exists() and kdmrc.set_shell_variable('AllowShutdown', 'None', 'X-:\*-Greeter', '^\s*$')
         gdmconf.exists() and gdmconf.set_shell_variable('SystemMenu', 'false', '\[greeter\]', '^\s*$')
-    
+
+allow_reboot.arg_trans = YES_NO_TRANS
+
 def allow_user_list(arg):
     '''  Allow/Forbid the list of users on the system on display managers (kdm and gdm).'''
     kdmrc = ConfigFile.get_config_file(KDMRC)
@@ -373,6 +385,8 @@ def allow_user_list(arg):
         oldval_kdmrc != val_gdmconf and kdmrc.exists() and kdmrc.set_shell_variable('ShowUsers', val_kdmrc)
         oldval_gdmconf != val_gdmconf and gdmconf.exists() and gdmconf.set_shell_variable('Browser', val_gdmconf)
 
+allow_user_list.arg_trans = YES_NO_TRANS
+
 def allow_root_login(arg):
     '''  Allow/Forbid direct root login.'''
     securetty = ConfigFile.get_config_file(SECURETTY)
@@ -432,6 +446,8 @@ def allow_root_login(arg):
         
             securetty.remove_line_matching('.+', 1)
 
+allow_root_login.arg_trans = YES_NO_TRANS
+
 def allow_remote_root_login(arg):
     '''  Allow/Forbid remote root login.'''
     sshd_config = ConfigFile.get_config_file(SSHDCONFIG)
@@ -459,6 +475,8 @@ def allow_remote_root_login(arg):
             sshd_config.exists() and sshd_config.replace_line_matching('^\s*PermitRootLogin\s+(no|yes)',
                                                                        'PermitRootLogin no', 1)
 
+allow_remote_root_login.arg_trans = YES_NO_TRANS
+
 def enable_pam_wheel_for_su(arg):
     '''   Enabling su only from members of the wheel group or allow su from any user.'''
     su = ConfigFile.get_config_file(SU)
@@ -490,7 +508,9 @@ def enable_pam_wheel_for_su(arg):
         if val:
             _interactive and log(_('Allowing su for all'))
             su.exists() and su.remove_line_matching('^auth\s+required\s+/lib/security/pam_wheel.so\s+use_uid\s*$')
-    
+
+enable_pam_wheel_for_su.arg_trans = YES_NO_TRANS
+
 def allow_issues(arg):
     '''  If \\fIarg\\fP = ALL allow /etc/issue and /etc/issue.net to exist. If \\fIarg\\fP = NONE no issues are
 allowed else only /etc/issue is allowed.'''
@@ -525,6 +545,8 @@ allowed else only /etc/issue is allowed.'''
             _interactive and log(_('Disabling network pre-login message'))
             issuenet.exists(1) and issuenet.move(SUFFIX)
 
+allow_issues.arg_trans = YES_NO_TRANS
+
 def allow_autologin(arg):
     '''  Allow/Forbid autologin.'''
     autologin = ConfigFile.get_config_file(AUTOLOGIN)
@@ -548,6 +570,8 @@ def allow_autologin(arg):
             _interactive and log(_('Forbidding autologin'))
             autologin.exists() and autologin.set_shell_variable('AUTOLOGIN', 'no')
 
+allow_autologin.arg_trans = YES_NO_TRANS
+
 def password_loader(value):
     'D'
     _interactive and log(_('Activating password in boot loader'))
@@ -596,6 +620,8 @@ dev the device to report the log.'''
             _interactive and log(_('Disabling log on console'))
             syslogconf.exists() and syslogconf.remove_line_matching('\s*[^#]+/dev/')
 
+enable_console_log.arg_trans = YES_NO_TRANS
+
 CRON_ENTRY = '*/1 * * * *    root    /usr/share/msec/promisc_check.sh'
 CRON_REGEX = '[^#]+/usr/share/msec/promisc_check.sh'
 
@@ -619,6 +645,8 @@ def enable_promisc_check(arg):
             _interactive and log(_('Disabling periodic promiscuity check'))
             cron.remove_line_matching('[^#]+/usr/share/msec/promisc_check.sh')
 
+enable_promisc_check.arg_trans = YES_NO_TRANS
+
 def enable_security_check(arg):
     '''   Activate/Disable daily security check.'''
     cron = ConfigFile.get_config_file(CRON)
@@ -642,6 +670,8 @@ def enable_security_check(arg):
             _interactive and log(_('Disabling daily security check'))
             securitycron.unlink()
 
+enable_security_check.arg_trans = YES_NO_TRANS
+
 ALL_REGEXP = '^ALL:ALL:DENY'
 ALL_LOCAL_REGEXP = '^ALL:ALL EXCEPT 127\.0\.0\.1:DENY'
 def authorize_services(arg):
@@ -683,6 +713,8 @@ if \\fIarg\\fP = LOCAL and none if \\fIarg\\fP = NONE. To authorize the services
     else:
         error(_('authorize_services invalid argument: %s') % arg)
 
+authorize_services.arg_trans = ALL_LOCAL_NONE_TRANS
+
 # helper function for enable_ip_spoofing_protection, accept_icmp_echo, accept_broadcasted_icmp_echo,
 # accept_bogus_error_responses and enable_log_strange_packets.
 def set_zero_one_variable(file, variable, value, secure_value, one_msg, zero_msg):
@@ -715,6 +747,9 @@ def enable_ip_spoofing_protection(arg, alert=1):
     '''  Enable/Disable IP spoofing protection.'''
     set_zero_one_variable(SYSCTLCONF, 'net.ipv4.conf.all.rp_filter', arg, 1, 'Enabling ip spoofing protection', 'Disabling ip spoofing protection')
 
+enable_ip_spoofing_protection.arg_trans = YES_NO_TRANS
+enable_ip_spoofing_protection.one_arg = 1
+
 def enable_dns_spoofing_protection(arg, alert=1):
     ''' Enable/Disable name resolution spoofing protection.  If
 \\fIalert\\fP is true, also reports to syslog.'''
@@ -738,22 +773,32 @@ def enable_dns_spoofing_protection(arg, alert=1):
             hostconf.remove_line_matching('nospoof')
             hostconf.remove_line_matching('spoofalert')
 
+enable_dns_spoofing_protection.arg_trans = YES_NO_TRANS
+
 def accept_icmp_echo(arg):
     '''   Accept/Refuse icmp echo.'''
     set_zero_one_variable(SYSCTLCONF, 'net.ipv4.icmp_echo_ignore_all', not arg, 1, 'Accepting icmp echo', 'Ignoring icmp echo')
-    
+
+accept_icmp_echo.arg_trans = YES_NO_TRANS
+
 def accept_broadcasted_icmp_echo(arg):
     '''   Accept/Refuse broadcasted icmp echo.'''
     set_zero_one_variable(SYSCTLCONF, 'net.ipv4.icmp_echo_ignore_broadcasts', not arg, 1, 'Accepting broadcasted icmp echo', 'Ignoring broadcasted icmp echo')
-    
+
+accept_broadcasted_icmp_echo.arg_trans = YES_NO_TRANS
+
 def accept_bogus_error_responses(arg):
     '''  Accept/Refuse bogus IPv4 error messages.'''
     set_zero_one_variable(SYSCTLCONF, 'net.ipv4.icmp_ignore_bogus_error_responses', not arg, 1, 'Accepting bogus icmp error responses', 'Ignoring bogus icmp error responses')
-    
+
+accept_bogus_error_responses.arg_trans = YES_NO_TRANS
+
 def enable_log_strange_packets(arg):
     '''  Enable/Disable the logging of IPv4 strange packets.'''
     set_zero_one_variable(SYSCTLCONF, 'net.ipv4.conf.all.log_martians', arg, 1, 'Enabling logging of strange packets', 'Disabling logging of strange packets')
 
+enable_log_strange_packets.arg_trans = YES_NO_TRANS
+
 def enable_libsafe(arg):
     '''  Enable/Disable libsafe if libsafe is found on the system.'''
 
@@ -776,6 +821,8 @@ def enable_libsafe(arg):
             _interactive and log(_('Disabling libsafe'))
             ldsopreload.remove_line_matching('[^#]*libsafe')        
 
+enable_libsafe.arg_trans = YES_NO_TRANS
+
 LENGTH_REGEXP = '^(password\s+required\s+/lib/security/pam_cracklib.so.*?)\sminlen=([0-9]+)\s(.*)'
 NDIGITS_REGEXP = '^(password\s+required\s+/lib/security/pam_cracklib.so.*?)\sdcredit=([0-9]+)\s(.*)'
 UCREDIT_REGEXP = '^(password\s+required\s+/lib/security/pam_cracklib.so.*?)\sucredit=([0-9]+)\s(.*)'
@@ -851,6 +898,8 @@ def enable_password(arg):
             system_auth.replace_line_matching(PASSWORD_REGEXP, 'auth        sufficient    /lib/security/pam_permit.so') or \
             system_auth.insert_before('auth\s+sufficient', 'auth        sufficient    /lib/security/pam_permit.so')
 
+enable_password.arg_trans = YES_NO_TRANS
+
 SULOGIN_REGEXP = '~~:S:wait:/sbin/sulogin'
 def enable_sulogin(arg):
     '''   Enable/Disable sulogin(8) in single user level.'''
@@ -872,6 +921,8 @@ def enable_sulogin(arg):
             _interactive and log(_('Disabling sulogin in single user runlevel'))
             inittab.remove_line_matching('~~:S:wait:/sbin/sulogin')
 
+enable_sulogin.arg_trans = YES_NO_TRANS
+
 def enable_msec_cron(arg):
     '''  Enable/Disable msec hourly security check.'''
     mseccron = ConfigFile.get_config_file(MSECCRON)
@@ -892,6 +943,8 @@ def enable_msec_cron(arg):
             _interactive and log(_('Disabling msec periodic runs'))
             mseccron.unlink()
 
+enable_msec_cron.arg_trans = YES_NO_TRANS
+
 def enable_at_crontab(arg):
     '''  Enable/Disable crontab and at for users. Put allowed users in /etc/cron.allow and /etc/at.allow
 (see man at(1) and crontab(1)).'''
@@ -919,6 +972,8 @@ def enable_at_crontab(arg):
             cronallow.replace_line_matching('root', 'root', 1)
             atallow.replace_line_matching('root', 'root', 1)
 
+enable_at_crontab.arg_trans = YES_NO_TRANS
+
 maximum_regex = re.compile('^Maximum:\s*([0-9]+|-1)', re.MULTILINE)
 inactive_regex = re.compile('^Inactive:\s*(-?[0-9]+)', re.MULTILINE)
 no_aging_list = []