c8-stream-2.8
imports/c8-stream-2.8/libselinux-2.9-2.1.module+el8.1.0+3972+45ab4324
CentOS Sources
5 years ago
committed by
MSVSphere Packaging Team
commit
8ab685eebc
@ -0,0 +1 @@
|
||||
SOURCES/libselinux-2.9.tar.gz
|
||||
@ -0,0 +1 @@
|
||||
c53911ee9da673f7653ab1afe66c0b2bf5fb5ac9 SOURCES/libselinux-2.9.tar.gz
|
||||
@ -0,0 +1,31 @@
|
||||
From f71fc47524bef3c4cd8a412e43d13daebd1c418b Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||
Date: Wed, 16 Jul 2014 08:28:03 +0200
|
||||
Subject: [PATCH 1/5] Fix selinux man page to refer seinfo and sesearch tools.
|
||||
|
||||
---
|
||||
libselinux/man/man8/selinux.8 | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
|
||||
index e37aee68..bf23b655 100644
|
||||
--- a/libselinux/man/man8/selinux.8
|
||||
+++ b/libselinux/man/man8/selinux.8
|
||||
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||
.BR sepolicy (8),
|
||||
.BR system-config-selinux (8),
|
||||
.BR togglesebool (8),
|
||||
-.BR restorecon (8),
|
||||
.BR fixfiles (8),
|
||||
+.BR restorecon (8),
|
||||
.BR setfiles (8),
|
||||
.BR semanage (8),
|
||||
.BR sepolicy (8)
|
||||
+.BR seinfo (8),
|
||||
+.BR sesearch (8)
|
||||
|
||||
Every confined service on the system has a man page in the following format:
|
||||
.br
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,214 @@
|
||||
From ad3d3a0bf819f5895a6884357c2d0e18ea1ef314 Mon Sep 17 00:00:00 2001
|
||||
From: Dan Walsh <dwalsh@redhat.com>
|
||||
Date: Mon, 23 Dec 2013 09:50:54 -0500
|
||||
Subject: [PATCH 2/5] Verify context input to funtions to make sure the context
|
||||
field is not null.
|
||||
|
||||
Return errno EINVAL, to prevent segfault.
|
||||
|
||||
Rejected by upstream https://marc.info/?l=selinux&m=145036088424584&w=2
|
||||
|
||||
FIXME: use __attribute__(nonnull (arg-index, ...))
|
||||
---
|
||||
libselinux/src/avc_sidtab.c | 5 +++++
|
||||
libselinux/src/canonicalize_context.c | 5 +++++
|
||||
libselinux/src/check_context.c | 5 +++++
|
||||
libselinux/src/compute_av.c | 5 +++++
|
||||
libselinux/src/compute_create.c | 5 +++++
|
||||
libselinux/src/compute_member.c | 5 +++++
|
||||
libselinux/src/compute_relabel.c | 5 +++++
|
||||
libselinux/src/compute_user.c | 5 +++++
|
||||
libselinux/src/fsetfilecon.c | 8 ++++++--
|
||||
libselinux/src/lsetfilecon.c | 9 +++++++--
|
||||
libselinux/src/setfilecon.c | 8 ++++++--
|
||||
11 files changed, 59 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c
|
||||
index 9669264d..c7754305 100644
|
||||
--- a/libselinux/src/avc_sidtab.c
|
||||
+++ b/libselinux/src/avc_sidtab.c
|
||||
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
|
||||
int hvalue, rc = 0;
|
||||
struct sidtab_node *cur;
|
||||
|
||||
+ if (! ctx) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
*sid = NULL;
|
||||
hvalue = sidtab_hash(ctx);
|
||||
|
||||
diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
|
||||
index ba4c9a2c..c8158725 100644
|
||||
--- a/libselinux/src/canonicalize_context.c
|
||||
+++ b/libselinux/src/canonicalize_context.c
|
||||
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
|
||||
size_t size;
|
||||
int fd, ret;
|
||||
|
||||
+ if (! con) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
if (!selinux_mnt) {
|
||||
errno = ENOENT;
|
||||
return -1;
|
||||
diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c
|
||||
index 8a7997f0..5be84348 100644
|
||||
--- a/libselinux/src/check_context.c
|
||||
+++ b/libselinux/src/check_context.c
|
||||
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
|
||||
char path[PATH_MAX];
|
||||
int fd, ret;
|
||||
|
||||
+ if (! con) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
if (!selinux_mnt) {
|
||||
errno = ENOENT;
|
||||
return -1;
|
||||
diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
|
||||
index a47cffe9..6d285a2e 100644
|
||||
--- a/libselinux/src/compute_av.c
|
||||
+++ b/libselinux/src/compute_av.c
|
||||
@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if ((! scon) || (! tcon)) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
snprintf(path, sizeof path, "%s/access", selinux_mnt);
|
||||
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
|
||||
index 0975aeac..3e6a48c1 100644
|
||||
--- a/libselinux/src/compute_create.c
|
||||
+++ b/libselinux/src/compute_create.c
|
||||
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if ((! scon) || (! tcon)) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
snprintf(path, sizeof path, "%s/create", selinux_mnt);
|
||||
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
|
||||
index 4e2d221e..d1dd9772 100644
|
||||
--- a/libselinux/src/compute_member.c
|
||||
+++ b/libselinux/src/compute_member.c
|
||||
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if ((! scon) || (! tcon)) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
snprintf(path, sizeof path, "%s/member", selinux_mnt);
|
||||
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
|
||||
index 49f77ef3..c3db7c0a 100644
|
||||
--- a/libselinux/src/compute_relabel.c
|
||||
+++ b/libselinux/src/compute_relabel.c
|
||||
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if ((! scon) || (! tcon)) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
|
||||
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
|
||||
index 7b881215..401fd107 100644
|
||||
--- a/libselinux/src/compute_user.c
|
||||
+++ b/libselinux/src/compute_user.c
|
||||
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if (! scon) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
snprintf(path, sizeof path, "%s/user", selinux_mnt);
|
||||
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||
if (fd < 0)
|
||||
diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c
|
||||
index 52707d05..0cbe12d8 100644
|
||||
--- a/libselinux/src/fsetfilecon.c
|
||||
+++ b/libselinux/src/fsetfilecon.c
|
||||
@@ -9,8 +9,12 @@
|
||||
|
||||
int fsetfilecon_raw(int fd, const char * context)
|
||||
{
|
||||
- int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||
- 0);
|
||||
+ int rc;
|
||||
+ if (! context) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+ rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||
if (rc < 0 && errno == ENOTSUP) {
|
||||
char * ccontext = NULL;
|
||||
int err = errno;
|
||||
diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c
|
||||
index 1d3b28a1..ea6d70b7 100644
|
||||
--- a/libselinux/src/lsetfilecon.c
|
||||
+++ b/libselinux/src/lsetfilecon.c
|
||||
@@ -9,8 +9,13 @@
|
||||
|
||||
int lsetfilecon_raw(const char *path, const char * context)
|
||||
{
|
||||
- int rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||
- 0);
|
||||
+ int rc;
|
||||
+ if (! context) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||
if (rc < 0 && errno == ENOTSUP) {
|
||||
char * ccontext = NULL;
|
||||
int err = errno;
|
||||
diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c
|
||||
index d05969c6..3f0200e8 100644
|
||||
--- a/libselinux/src/setfilecon.c
|
||||
+++ b/libselinux/src/setfilecon.c
|
||||
@@ -9,8 +9,12 @@
|
||||
|
||||
int setfilecon_raw(const char *path, const char * context)
|
||||
{
|
||||
- int rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||
- 0);
|
||||
+ int rc;
|
||||
+ if (! context) {
|
||||
+ errno=EINVAL;
|
||||
+ return -1;
|
||||
+ }
|
||||
+ rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||
if (rc < 0 && errno == ENOTSUP) {
|
||||
char * ccontext = NULL;
|
||||
int err = errno;
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
From 431f72836d6c02450725cf6ffb1c7223b9fa6acc Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 11 Mar 2019 15:26:43 +0100
|
||||
Subject: [PATCH 3/5] libselinux: Allow to override OVERRIDE_GETTID from
|
||||
command line
|
||||
|
||||
$ make CFLAGS="$CFLAGS -DOVERRIDE_GETTID=0" ...
|
||||
|
||||
Drop this as soon as glibc-2.30 will become real 2.30 version, see
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=1685594
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
libselinux/src/procattr.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/libselinux/src/procattr.c b/libselinux/src/procattr.c
|
||||
index c6799ef2..cbb6824e 100644
|
||||
--- a/libselinux/src/procattr.c
|
||||
+++ b/libselinux/src/procattr.c
|
||||
@@ -24,6 +24,7 @@ static __thread char destructor_initialized;
|
||||
|
||||
/* Bionic and glibc >= 2.30 declare gettid() system call wrapper in unistd.h and
|
||||
* has a definition for it */
|
||||
+#ifndef OVERRIDE_GETTID
|
||||
#ifdef __BIONIC__
|
||||
#define OVERRIDE_GETTID 0
|
||||
#elif !defined(__GLIBC_PREREQ)
|
||||
@@ -33,6 +34,7 @@ static __thread char destructor_initialized;
|
||||
#else
|
||||
#define OVERRIDE_GETTID 0
|
||||
#endif
|
||||
+#endif
|
||||
|
||||
#if OVERRIDE_GETTID
|
||||
static pid_t gettid(void)
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,55 @@
|
||||
From dca54ca1a8ab0b256e7834f7f5e97375427fbfd9 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Wed, 27 Feb 2019 09:37:17 +0100
|
||||
Subject: [PATCH 4/5] Bring some old permission and flask constants back to
|
||||
Python bindings
|
||||
|
||||
---
|
||||
libselinux/src/selinuxswig.i | 4 ++++
|
||||
libselinux/src/selinuxswig_python.i | 3 ++-
|
||||
2 files changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libselinux/src/selinuxswig.i b/libselinux/src/selinuxswig.i
|
||||
index dbdb4c3d..9c5b9263 100644
|
||||
--- a/libselinux/src/selinuxswig.i
|
||||
+++ b/libselinux/src/selinuxswig.i
|
||||
@@ -5,7 +5,9 @@
|
||||
%module selinux
|
||||
%{
|
||||
#include "../include/selinux/avc.h"
|
||||
+ #include "../include/selinux/av_permissions.h"
|
||||
#include "../include/selinux/context.h"
|
||||
+ #include "../include/selinux/flask.h"
|
||||
#include "../include/selinux/get_context_list.h"
|
||||
#include "../include/selinux/get_default_type.h"
|
||||
#include "../include/selinux/label.h"
|
||||
@@ -58,7 +60,9 @@
|
||||
%ignore avc_netlink_check_nb;
|
||||
|
||||
%include "../include/selinux/avc.h"
|
||||
+%include "../include/selinux/av_permissions.h"
|
||||
%include "../include/selinux/context.h"
|
||||
+%include "../include/selinux/flask.h"
|
||||
%include "../include/selinux/get_context_list.h"
|
||||
%include "../include/selinux/get_default_type.h"
|
||||
%include "../include/selinux/label.h"
|
||||
diff --git a/libselinux/src/selinuxswig_python.i b/libselinux/src/selinuxswig_python.i
|
||||
index 4c73bf92..6eaab081 100644
|
||||
--- a/libselinux/src/selinuxswig_python.i
|
||||
+++ b/libselinux/src/selinuxswig_python.i
|
||||
@@ -1,10 +1,11 @@
|
||||
/* Author: James Athey
|
||||
*/
|
||||
|
||||
-/* Never build rpm_execcon interface */
|
||||
+/* Never build rpm_execcon interface unless you need to have ACG compatibility
|
||||
#ifndef DISABLE_RPM
|
||||
#define DISABLE_RPM
|
||||
#endif
|
||||
+*/
|
||||
|
||||
%module selinux
|
||||
%{
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
From 8384ffa7a371c8845c145951363da5d978ab98b5 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Tue, 28 Feb 2017 16:12:43 +0100
|
||||
Subject: [PATCH 5/5] libselinux: add missing av_permission values
|
||||
|
||||
Add missing av_permission values to av_permissions.h for the sake of
|
||||
completeness (this interface is obsolete - these values are now
|
||||
obtained at runtime).
|
||||
|
||||
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1025931
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
libselinux/include/selinux/av_permissions.h | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/libselinux/include/selinux/av_permissions.h b/libselinux/include/selinux/av_permissions.h
|
||||
index c1269af9..631f0276 100644
|
||||
--- a/libselinux/include/selinux/av_permissions.h
|
||||
+++ b/libselinux/include/selinux/av_permissions.h
|
||||
@@ -876,6 +876,8 @@
|
||||
#define NSCD__SHMEMHOST 0x00000080UL
|
||||
#define NSCD__GETSERV 0x00000100UL
|
||||
#define NSCD__SHMEMSERV 0x00000200UL
|
||||
+#define NSCD__GETNETGRP 0x00000400UL
|
||||
+#define NSCD__SHMEMNETGRP 0x00000800UL
|
||||
#define ASSOCIATION__SENDTO 0x00000001UL
|
||||
#define ASSOCIATION__RECVFROM 0x00000002UL
|
||||
#define ASSOCIATION__SETCONTEXT 0x00000004UL
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@ -0,0 +1,177 @@
|
||||
From 67d490a38a319126f371eaf66a5fc922d7005b1f Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 16 May 2019 15:01:59 +0200
|
||||
Subject: [PATCH 6/6] libselinux: Use Python distutils to install SELinux
|
||||
python bindings
|
||||
|
||||
SWIG-4.0 changed its behavior so that it uses: from . import _selinux which
|
||||
looks for _selinux module in the same directory as where __init__.py is -
|
||||
$(PYLIBDIR)/site-packages/selinux. But _selinux module is installed into
|
||||
$(PYLIBDIR)/site-packages/ since a9604c30a5e2f ("libselinux: Change the location
|
||||
of _selinux.so").
|
||||
|
||||
In order to prevent such breakage in future use Python's distutils instead of
|
||||
building and installing python bindings manually in Makefile.
|
||||
|
||||
Fixes:
|
||||
>>> import selinux
|
||||
Traceback (most recent call last):
|
||||
File "<stdin>", line 1, in <module>
|
||||
File "/usr/lib64/python3.7/site-packages/selinux/__init__.py", line 13, in <module>
|
||||
from . import _selinux
|
||||
ImportError: cannot import name '_selinux' from 'selinux' (/usr/lib64/python3.7/site-packages/selinux/__init__.py)
|
||||
>>>
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
libselinux/src/.gitignore | 2 +-
|
||||
libselinux/src/Makefile | 37 ++++++++-----------------------------
|
||||
libselinux/src/setup.py | 24 ++++++++++++++++++++++++
|
||||
3 files changed, 33 insertions(+), 30 deletions(-)
|
||||
create mode 100644 libselinux/src/setup.py
|
||||
|
||||
diff --git a/libselinux/src/.gitignore b/libselinux/src/.gitignore
|
||||
index 4dcc3b3b..428afe5a 100644
|
||||
--- a/libselinux/src/.gitignore
|
||||
+++ b/libselinux/src/.gitignore
|
||||
@@ -1,4 +1,4 @@
|
||||
selinux.py
|
||||
-selinuxswig_wrap.c
|
||||
+selinuxswig_python_wrap.c
|
||||
selinuxswig_python_exception.i
|
||||
selinuxswig_ruby_wrap.c
|
||||
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
|
||||
index e9ed0383..826c830c 100644
|
||||
--- a/libselinux/src/Makefile
|
||||
+++ b/libselinux/src/Makefile
|
||||
@@ -36,7 +36,7 @@ TARGET=libselinux.so
|
||||
LIBPC=libselinux.pc
|
||||
SWIGIF= selinuxswig_python.i selinuxswig_python_exception.i
|
||||
SWIGRUBYIF= selinuxswig_ruby.i
|
||||
-SWIGCOUT= selinuxswig_wrap.c
|
||||
+SWIGCOUT= selinuxswig_python_wrap.c
|
||||
SWIGPYOUT= selinux.py
|
||||
SWIGRUBYCOUT= selinuxswig_ruby_wrap.c
|
||||
SWIGLOBJ:= $(patsubst %.c,$(PYPREFIX)%.lo,$(SWIGCOUT))
|
||||
@@ -55,7 +55,7 @@ ifeq ($(LIBSEPOLA),)
|
||||
LDLIBS_LIBSEPOLA := -l:libsepol.a
|
||||
endif
|
||||
|
||||
-GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) selinuxswig_python_exception.i
|
||||
+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) $(SWIGCOUT) selinuxswig_python_exception.i
|
||||
SRCS= $(filter-out $(GENERATED) audit2why.c, $(sort $(wildcard *.c)))
|
||||
|
||||
MAX_STACK_SIZE=32768
|
||||
@@ -125,25 +125,18 @@ DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
|
||||
SRCS:= $(filter-out label_backends_android.c, $(SRCS))
|
||||
endif
|
||||
|
||||
-SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./ $(DISABLE_FLAGS)
|
||||
-
|
||||
SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
|
||||
|
||||
all: $(LIBA) $(LIBSO) $(LIBPC)
|
||||
|
||||
-pywrap: all $(SWIGFILES) $(AUDIT2WHYSO)
|
||||
+pywrap: all selinuxswig_python_exception.i
|
||||
+ CFLAGS="$(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
|
||||
|
||||
rubywrap: all $(SWIGRUBYSO)
|
||||
|
||||
-$(SWIGLOBJ): $(SWIGCOUT)
|
||||
- $(CC) $(CFLAGS) $(SWIG_CFLAGS) $(PYINC) -fPIC -DSHARED -c -o $@ $<
|
||||
-
|
||||
$(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
|
||||
$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $<
|
||||
|
||||
-$(SWIGSO): $(SWIGLOBJ)
|
||||
- $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $< -lselinux $(PYLIBS)
|
||||
-
|
||||
$(SWIGRUBYSO): $(SWIGRUBYLOBJ)
|
||||
$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(RUBYLIBS)
|
||||
|
||||
@@ -161,29 +154,15 @@ $(LIBPC): $(LIBPC).in ../VERSION
|
||||
selinuxswig_python_exception.i: ../include/selinux/selinux.h
|
||||
bash -e exception.sh > $@ || (rm -f $@ ; false)
|
||||
|
||||
-$(AUDIT2WHYLOBJ): audit2why.c
|
||||
- $(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
|
||||
-
|
||||
-$(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
|
||||
- $(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS) -Wl,-soname,audit2why.so,--version-script=audit2why.map,-z,defs
|
||||
-
|
||||
%.o: %.c policy.h
|
||||
$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
|
||||
|
||||
%.lo: %.c policy.h
|
||||
$(CC) $(CFLAGS) -fPIC -DSHARED -c -o $@ $<
|
||||
|
||||
-$(SWIGCOUT): $(SWIGIF)
|
||||
- $(SWIG) $<
|
||||
-
|
||||
-$(SWIGPYOUT): $(SWIGCOUT)
|
||||
-
|
||||
$(SWIGRUBYCOUT): $(SWIGRUBYIF)
|
||||
$(SWIGRUBY) $<
|
||||
|
||||
-swigify: $(SWIGIF)
|
||||
- $(SWIG) $<
|
||||
-
|
||||
install: all
|
||||
test -d $(DESTDIR)$(LIBDIR) || install -m 755 -d $(DESTDIR)$(LIBDIR)
|
||||
install -m 644 $(LIBA) $(DESTDIR)$(LIBDIR)
|
||||
@@ -194,10 +173,8 @@ install: all
|
||||
ln -sf --relative $(DESTDIR)$(SHLIBDIR)/$(LIBSO) $(DESTDIR)$(LIBDIR)/$(TARGET)
|
||||
|
||||
install-pywrap: pywrap
|
||||
- test -d $(DESTDIR)$(PYTHONLIBDIR)/selinux || install -m 755 -d $(DESTDIR)$(PYTHONLIBDIR)/selinux
|
||||
- install -m 755 $(SWIGSO) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
|
||||
- install -m 755 $(AUDIT2WHYSO) $(DESTDIR)$(PYTHONLIBDIR)/selinux/audit2why$(PYCEXT)
|
||||
- install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
|
||||
+ $(PYTHON) setup.py install --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR)`
|
||||
+ install -m 644 selinux.py $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
|
||||
|
||||
install-rubywrap: rubywrap
|
||||
test -d $(DESTDIR)$(RUBYINSTALL) || install -m 755 -d $(DESTDIR)$(RUBYINSTALL)
|
||||
@@ -208,6 +185,8 @@ relabel:
|
||||
|
||||
clean-pywrap:
|
||||
-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
|
||||
+ $(PYTHON) setup.py clean
|
||||
+ -rm -rf build *~ \#* *pyc .#*
|
||||
|
||||
clean-rubywrap:
|
||||
-rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
|
||||
diff --git a/libselinux/src/setup.py b/libselinux/src/setup.py
|
||||
new file mode 100644
|
||||
index 00000000..b12e7869
|
||||
--- /dev/null
|
||||
+++ b/libselinux/src/setup.py
|
||||
@@ -0,0 +1,24 @@
|
||||
+#!/usr/bin/python3
|
||||
+
|
||||
+from distutils.core import Extension, setup
|
||||
+
|
||||
+setup(
|
||||
+ name="selinux",
|
||||
+ version="2.9",
|
||||
+ description="SELinux python 3 bindings",
|
||||
+ author="SELinux Project",
|
||||
+ author_email="selinux@vger.kernel.org",
|
||||
+ ext_modules=[
|
||||
+ Extension('selinux._selinux',
|
||||
+ sources=['selinuxswig_python.i'],
|
||||
+ include_dirs=['../include'],
|
||||
+ library_dirs=['.'],
|
||||
+ libraries=['selinux']),
|
||||
+ Extension('selinux.audit2why',
|
||||
+ sources=['audit2why.c'],
|
||||
+ include_dirs=['../include'],
|
||||
+ library_dirs=['.'],
|
||||
+ libraries=['selinux'],
|
||||
+ extra_link_args=['-l:libsepol.a'])
|
||||
+ ],
|
||||
+)
|
||||
--
|
||||
2.22.0
|
||||
|
||||
@ -0,0 +1,44 @@
|
||||
From 6ec8116ee64a25a0c5eb543f0b12ed25f1348c45 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Thu, 27 Jun 2019 11:17:13 +0200
|
||||
Subject: [PATCH 7/7] libselinux: Do not use SWIG_CFLAGS when Python bindings
|
||||
are built
|
||||
|
||||
Fixes:
|
||||
https://rpmdiff.engineering.redhat.com/run/410372/7/
|
||||
|
||||
Detecting usr/lib64/python3.6/site-packages/selinux/audit2why.cpython-36m-x86_64-linux-gnu.so with not-hardened warnings '
|
||||
Hardened: audit2why.cpython-36m-x86_64-linux-gnu.so: FAIL: Gaps were detected in the annobin coverage. Run with -v to list.
|
||||
' on x86_64
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
libselinux/src/Makefile | 5 +----
|
||||
1 file changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
|
||||
index 826c830c..f64f23a8 100644
|
||||
--- a/libselinux/src/Makefile
|
||||
+++ b/libselinux/src/Makefile
|
||||
@@ -104,9 +104,6 @@ FTS_LDLIBS ?=
|
||||
|
||||
override CFLAGS += -I../include -D_GNU_SOURCE $(DISABLE_FLAGS) $(PCRE_CFLAGS)
|
||||
|
||||
-SWIG_CFLAGS += -Wno-error -Wno-unused-variable -Wno-unused-but-set-variable -Wno-unused-parameter \
|
||||
- -Wno-shadow -Wno-uninitialized -Wno-missing-prototypes -Wno-missing-declarations
|
||||
-
|
||||
RANLIB ?= ranlib
|
||||
|
||||
ARCH := $(patsubst i%86,i386,$(shell uname -m))
|
||||
@@ -130,7 +127,7 @@ SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./ $(DISABLE_FLAGS)
|
||||
all: $(LIBA) $(LIBSO) $(LIBPC)
|
||||
|
||||
pywrap: all selinuxswig_python_exception.i
|
||||
- CFLAGS="$(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
|
||||
+ $(PYTHON) setup.py build_ext -I $(DESTDIR)$(INCLUDEDIR) -L $(DESTDIR)$(LIBDIR)
|
||||
|
||||
rubywrap: all $(SWIGRUBYSO)
|
||||
|
||||
--
|
||||
2.22.0
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
.TH "selinuxconlist" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation"
|
||||
.SH "NAME"
|
||||
selinuxconlist \- list all SELinux context reachable for user
|
||||
.SH "SYNOPSIS"
|
||||
.B selinuxconlist [-l level] user [context]
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
.B selinuxconlist
|
||||
reports the list of context reachable for user from the current context or specified context
|
||||
|
||||
.B \-l level
|
||||
mcs/mls level
|
||||
|
||||
.SH AUTHOR
|
||||
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||
|
||||
.SH "SEE ALSO"
|
||||
secon(8), selinuxdefcon(8)
|
||||
@ -0,0 +1,24 @@
|
||||
.TH "selinuxdefcon" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation"
|
||||
.SH "NAME"
|
||||
selinuxdefcon \- report default SELinux context for user
|
||||
|
||||
.SH "SYNOPSIS"
|
||||
.B selinuxdefcon [-l level] user fromcon
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
.B selinuxdefcon
|
||||
reports the default context for the specified user from the specified context
|
||||
|
||||
.B \-l level
|
||||
mcs/mls level
|
||||
|
||||
.SH EXAMPLE
|
||||
# selinuxdefcon jsmith system_u:system_r:sshd_t:s0
|
||||
.br
|
||||
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
|
||||
|
||||
.SH AUTHOR
|
||||
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||
|
||||
.SH "SEE ALSO"
|
||||
secon(8), selinuxconlist(8)
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue