MSVSphere Packaging Team
9 months ago
commit
df68672e88
@ -0,0 +1,13 @@
|
|||||||
|
SOURCES/gui-po.tgz
|
||||||
|
SOURCES/policycoreutils-2.9.tar.gz
|
||||||
|
SOURCES/policycoreutils-po.tgz
|
||||||
|
SOURCES/python-po.tgz
|
||||||
|
SOURCES/restorecond-2.9.tar.gz
|
||||||
|
SOURCES/sandbox-po.tgz
|
||||||
|
SOURCES/selinux-dbus-2.9.tar.gz
|
||||||
|
SOURCES/selinux-gui-2.9.tar.gz
|
||||||
|
SOURCES/selinux-python-2.9.tar.gz
|
||||||
|
SOURCES/selinux-sandbox-2.9.tar.gz
|
||||||
|
SOURCES/semodule-utils-2.9.tar.gz
|
||||||
|
SOURCES/sepolicy-icons.tgz
|
||||||
|
SOURCES/system-config-selinux.png
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
3f355f8cbfdf7be6f9a8190153090af95d2c7358 SOURCES/gui-po.tgz
|
||||||
|
6e64d9a38fb516738023eb429eef29af5383f443 SOURCES/policycoreutils-2.9.tar.gz
|
||||||
|
51122ae6029657bf762d72bff94bab38890fd1e7 SOURCES/policycoreutils-po.tgz
|
||||||
|
c503e61733af54159d5950bbd9fa8080771ee938 SOURCES/python-po.tgz
|
||||||
|
0a34ef54394972870203832c8ce52d4405bd5330 SOURCES/restorecond-2.9.tar.gz
|
||||||
|
7df1784ab0c6b0823943571d733b856d10a87f76 SOURCES/sandbox-po.tgz
|
||||||
|
8645509cdfc433278c2e4d29ee8f511625c7edcc SOURCES/selinux-dbus-2.9.tar.gz
|
||||||
|
5c155ae47692389d9fabaa154195e7f978f2a3f0 SOURCES/selinux-gui-2.9.tar.gz
|
||||||
|
660e1ab824ef80f7a69f0b70f61e231957fd398e SOURCES/selinux-python-2.9.tar.gz
|
||||||
|
0e208cad193021ad17a445b76b72af3fef8db999 SOURCES/selinux-sandbox-2.9.tar.gz
|
||||||
|
a4414223e60bb664ada4824e54f8d36ab208d599 SOURCES/semodule-utils-2.9.tar.gz
|
||||||
|
d849fa76cc3ef4a26047d8a69fef3a55d2f3097f SOURCES/sepolicy-icons.tgz
|
||||||
|
611a5d497efaddd45ec0dcc3e9b2e5b0f81ebc41 SOURCES/system-config-selinux.png
|
||||||
@ -0,0 +1,43 @@
|
|||||||
|
From c778509dd0ed3b184d720032f31971f975e42973 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 5 Mar 2019 17:38:55 +0100
|
||||||
|
Subject: [PATCH] gui: Install polgengui.py to /usr/bin/selinux-polgengui
|
||||||
|
|
||||||
|
polgengui.py is a standalone gui tool which should be in /usr/bin with other
|
||||||
|
tools.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
gui/Makefile | 2 +-
|
||||||
|
gui/modulesPage.py | 2 +-
|
||||||
|
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/gui/Makefile b/gui/Makefile
|
||||||
|
index c2f982de..b2375fbf 100644
|
||||||
|
--- a/gui/Makefile
|
||||||
|
+++ b/gui/Makefile
|
||||||
|
@@ -31,7 +31,7 @@ install: all
|
||||||
|
-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||||
|
install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
|
||||||
|
install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
|
||||||
|
- install -m 755 polgengui.py $(DESTDIR)$(SHAREDIR)
|
||||||
|
+ install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
|
||||||
|
install -m 644 $(TARGETS) $(DESTDIR)$(SHAREDIR)
|
||||||
|
install -m 644 system-config-selinux.8 $(DESTDIR)$(MANDIR)/man8
|
||||||
|
install -m 644 selinux-polgengui.8 $(DESTDIR)$(MANDIR)/man8
|
||||||
|
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||||
|
index 34c5d9e3..cb856b2d 100644
|
||||||
|
--- a/gui/modulesPage.py
|
||||||
|
+++ b/gui/modulesPage.py
|
||||||
|
@@ -118,7 +118,7 @@ class modulesPage(semanagePage):
|
||||||
|
|
||||||
|
def new_module(self, args):
|
||||||
|
try:
|
||||||
|
- Popen(["/usr/share/system-config-selinux/polgengui.py"])
|
||||||
|
+ Popen(["selinux-polgengui"])
|
||||||
|
except ValueError as e:
|
||||||
|
self.error(e.args[0])
|
||||||
|
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,49 @@
|
|||||||
|
From 04b632e6de14ec0336e14988bf4c2bd581f7308e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 5 Mar 2019 17:25:00 +0100
|
||||||
|
Subject: [PATCH] gui: Install .desktop files to /usr/share/applications by
|
||||||
|
default
|
||||||
|
|
||||||
|
/usr/share/applications is a standard directory for .desktop files.
|
||||||
|
Installation path can be changed using DESKTOPDIR variable in installation
|
||||||
|
phase, e.g.
|
||||||
|
|
||||||
|
make DESKTOPDIR=/usr/local/share/applications install
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
gui/Makefile | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/gui/Makefile b/gui/Makefile
|
||||||
|
index b2375fbf..ca965c94 100644
|
||||||
|
--- a/gui/Makefile
|
||||||
|
+++ b/gui/Makefile
|
||||||
|
@@ -5,6 +5,7 @@ BINDIR ?= $(PREFIX)/bin
|
||||||
|
SHAREDIR ?= $(PREFIX)/share/system-config-selinux
|
||||||
|
DATADIR ?= $(PREFIX)/share
|
||||||
|
MANDIR ?= $(PREFIX)/share/man
|
||||||
|
+DESKTOPDIR ?= $(PREFIX)/share/applications
|
||||||
|
|
||||||
|
TARGETS= \
|
||||||
|
booleansPage.py \
|
||||||
|
@@ -29,6 +30,7 @@ install: all
|
||||||
|
-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
|
||||||
|
-mkdir -p $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
|
||||||
|
-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||||
|
+ -mkdir -p $(DESTDIR)$(DESKTOPDIR)
|
||||||
|
install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
|
||||||
|
install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
|
||||||
|
install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
|
||||||
|
@@ -44,7 +46,7 @@ install: all
|
||||||
|
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/pixmaps
|
||||||
|
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
|
||||||
|
install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/system-config-selinux
|
||||||
|
- install -m 644 *.desktop $(DESTDIR)$(DATADIR)/system-config-selinux
|
||||||
|
+ install -m 644 *.desktop $(DESTDIR)$(DESKTOPDIR)
|
||||||
|
-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
|
||||||
|
install -m 644 sepolicy_256.png $(DESTDIR)$(DATADIR)/pixmaps/sepolicy.png
|
||||||
|
for i in 16 22 32 48 256; do \
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
From 52e0583f6adfe70825b009b626e19c290b49763a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 20 Aug 2015 12:58:41 +0200
|
||||||
|
Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in
|
||||||
|
recent Fedoras
|
||||||
|
|
||||||
|
---
|
||||||
|
sandbox/sandboxX.sh | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
|
||||||
|
index eaa500d0..47745280 100644
|
||||||
|
--- a/sandbox/sandboxX.sh
|
||||||
|
+++ b/sandbox/sandboxX.sh
|
||||||
|
@@ -20,7 +20,7 @@ cat > ~/.config/openbox/rc.xml << EOF
|
||||||
|
</openbox_config>
|
||||||
|
EOF
|
||||||
|
|
||||||
|
-(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
+(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
export DISPLAY=:$D
|
||||||
|
cat > ~/seremote << __EOF
|
||||||
|
#!/bin/sh
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,46 @@
|
|||||||
|
From 7504614fdd7dcf11b3a7568ca9b4b921973531dd Mon Sep 17 00:00:00 2001
|
||||||
|
From: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
Date: Mon, 21 Apr 2014 13:54:40 -0400
|
||||||
|
Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages
|
||||||
|
|
||||||
|
Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 7 +++++--
|
||||||
|
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index 1d367962..24e311a3 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -735,10 +735,13 @@ Default Defined Ports:""")
|
||||||
|
|
||||||
|
def _file_context(self):
|
||||||
|
flist = []
|
||||||
|
+ flist_non_exec = []
|
||||||
|
mpaths = []
|
||||||
|
for f in self.all_file_types:
|
||||||
|
if f.startswith(self.domainname):
|
||||||
|
flist.append(f)
|
||||||
|
+ if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
|
||||||
|
+ flist_non_exec.append(f)
|
||||||
|
if f in self.fcdict:
|
||||||
|
mpaths = mpaths + self.fcdict[f]["regex"]
|
||||||
|
if len(mpaths) == 0:
|
||||||
|
@@ -797,12 +800,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||||
|
SELinux defines the file context types for the %(domainname)s, if you wanted to
|
||||||
|
store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk.
|
||||||
|
|
||||||
|
-.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
|
||||||
|
+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
|
||||||
|
.br
|
||||||
|
.B restorecon -R -v /srv/my%(domainname)s_content
|
||||||
|
|
||||||
|
Note: SELinux often uses regular expressions to specify labels that match multiple files.
|
||||||
|
-""" % {'domainname': self.domainname, "type": flist[0]})
|
||||||
|
+""" % {'domainname': self.domainname, "type": flist_non_exec[-1]})
|
||||||
|
|
||||||
|
self.fd.write(r"""
|
||||||
|
.I The following file types are defined for %(domainname)s:
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
From 9847a26b7f8358432ee4c7019efb3cbad0c162b0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Mon, 12 May 2014 14:11:22 +0200
|
||||||
|
Subject: [PATCH] If there is no executable we don't want to print a part of
|
||||||
|
STANDARD FILE CONTEXT
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 3 ++-
|
||||||
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index 24e311a3..46092be0 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -793,7 +793,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
|
||||||
|
.PP
|
||||||
|
""" % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
|
||||||
|
|
||||||
|
- self.fd.write(r"""
|
||||||
|
+ if flist_non_exec:
|
||||||
|
+ self.fd.write(r"""
|
||||||
|
.PP
|
||||||
|
.B STANDARD FILE CONTEXT
|
||||||
|
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,169 @@
|
|||||||
|
From b2993d464e05291020dbf60fc2948ac152eb0003 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Thu, 19 Feb 2015 17:45:15 +0100
|
||||||
|
Subject: [PATCH] Simplication of sepolicy-manpage web functionality.
|
||||||
|
system_release is no longer hardcoded and it creates only index.html and html
|
||||||
|
man pages in the directory for the system release.
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/__init__.py | 25 +++--------
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 65 +++-------------------------
|
||||||
|
2 files changed, 13 insertions(+), 77 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
index 6aed31bd..88a2b8f6 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/__init__.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
@@ -1209,27 +1209,14 @@ def boolean_desc(boolean):
|
||||||
|
|
||||||
|
|
||||||
|
def get_os_version():
|
||||||
|
- os_version = ""
|
||||||
|
- pkg_name = "selinux-policy"
|
||||||
|
+ system_release = ""
|
||||||
|
try:
|
||||||
|
- try:
|
||||||
|
- from commands import getstatusoutput
|
||||||
|
- except ImportError:
|
||||||
|
- from subprocess import getstatusoutput
|
||||||
|
- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name)
|
||||||
|
- if rc == 0:
|
||||||
|
- os_version = output.split(".")[-2]
|
||||||
|
- except:
|
||||||
|
- os_version = ""
|
||||||
|
-
|
||||||
|
- if os_version[0:2] == "fc":
|
||||||
|
- os_version = "Fedora" + os_version[2:]
|
||||||
|
- elif os_version[0:2] == "el":
|
||||||
|
- os_version = "RHEL" + os_version[2:]
|
||||||
|
- else:
|
||||||
|
- os_version = ""
|
||||||
|
+ with open('/etc/system-release') as f:
|
||||||
|
+ system_release = f.readline()
|
||||||
|
+ except IOError:
|
||||||
|
+ system_release = "Misc"
|
||||||
|
|
||||||
|
- return os_version
|
||||||
|
+ return system_release
|
||||||
|
|
||||||
|
|
||||||
|
def reinit():
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index 46092be0..d60acfaf 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -149,10 +149,6 @@ def prettyprint(f, trim):
|
||||||
|
manpage_domains = []
|
||||||
|
manpage_roles = []
|
||||||
|
|
||||||
|
-fedora_releases = ["Fedora17", "Fedora18"]
|
||||||
|
-rhel_releases = ["RHEL6", "RHEL7"]
|
||||||
|
-
|
||||||
|
-
|
||||||
|
def get_alphabet_manpages(manpage_list):
|
||||||
|
alphabet_manpages = dict.fromkeys(string.ascii_letters, [])
|
||||||
|
for i in string.ascii_letters:
|
||||||
|
@@ -182,7 +178,7 @@ def convert_manpage_to_html(html_manpage, manpage):
|
||||||
|
class HTMLManPages:
|
||||||
|
|
||||||
|
"""
|
||||||
|
- Generate a HHTML Manpages on an given SELinux domains
|
||||||
|
+ Generate a HTML Manpages on an given SELinux domains
|
||||||
|
"""
|
||||||
|
|
||||||
|
def __init__(self, manpage_roles, manpage_domains, path, os_version):
|
||||||
|
@@ -190,9 +186,9 @@ class HTMLManPages:
|
||||||
|
self.manpage_domains = get_alphabet_manpages(manpage_domains)
|
||||||
|
self.os_version = os_version
|
||||||
|
self.old_path = path + "/"
|
||||||
|
- self.new_path = self.old_path + self.os_version + "/"
|
||||||
|
+ self.new_path = self.old_path
|
||||||
|
|
||||||
|
- if self.os_version in fedora_releases or self.os_version in rhel_releases:
|
||||||
|
+ if self.os_version:
|
||||||
|
self.__gen_html_manpages()
|
||||||
|
else:
|
||||||
|
print("SELinux HTML man pages can not be generated for this %s" % os_version)
|
||||||
|
@@ -201,7 +197,6 @@ class HTMLManPages:
|
||||||
|
def __gen_html_manpages(self):
|
||||||
|
self._write_html_manpage()
|
||||||
|
self._gen_index()
|
||||||
|
- self._gen_body()
|
||||||
|
self._gen_css()
|
||||||
|
|
||||||
|
def _write_html_manpage(self):
|
||||||
|
@@ -219,67 +214,21 @@ class HTMLManPages:
|
||||||
|
convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r)
|
||||||
|
|
||||||
|
def _gen_index(self):
|
||||||
|
- index = self.old_path + "index.html"
|
||||||
|
- fd = open(index, 'w')
|
||||||
|
- fd.write("""
|
||||||
|
-<html>
|
||||||
|
-<head>
|
||||||
|
- <link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||||
|
- <title>SELinux man pages online</title>
|
||||||
|
-</head>
|
||||||
|
-<body>
|
||||||
|
-<h1>SELinux man pages</h1>
|
||||||
|
-<br></br>
|
||||||
|
-Fedora or Red Hat Enterprise Linux Man Pages.</h2>
|
||||||
|
-<br></br>
|
||||||
|
-<hr>
|
||||||
|
-<h3>Fedora</h3>
|
||||||
|
-<table><tr>
|
||||||
|
-<td valign="middle">
|
||||||
|
-</td>
|
||||||
|
-</tr></table>
|
||||||
|
-<pre>
|
||||||
|
-""")
|
||||||
|
- for f in fedora_releases:
|
||||||
|
- fd.write("""
|
||||||
|
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (f, f, f, f))
|
||||||
|
-
|
||||||
|
- fd.write("""
|
||||||
|
-</pre>
|
||||||
|
-<hr>
|
||||||
|
-<h3>RHEL</h3>
|
||||||
|
-<table><tr>
|
||||||
|
-<td valign="middle">
|
||||||
|
-</td>
|
||||||
|
-</tr></table>
|
||||||
|
-<pre>
|
||||||
|
-""")
|
||||||
|
- for r in rhel_releases:
|
||||||
|
- fd.write("""
|
||||||
|
-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (r, r, r, r))
|
||||||
|
-
|
||||||
|
- fd.write("""
|
||||||
|
-</pre>
|
||||||
|
- """)
|
||||||
|
- fd.close()
|
||||||
|
- print("%s has been created" % index)
|
||||||
|
-
|
||||||
|
- def _gen_body(self):
|
||||||
|
html = self.new_path + self.os_version + ".html"
|
||||||
|
fd = open(html, 'w')
|
||||||
|
fd.write("""
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
- <link rel=stylesheet type="text/css" href="../style.css" title="style">
|
||||||
|
- <title>Linux man-pages online for Fedora18</title>
|
||||||
|
+ <link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||||
|
+ <title>SELinux man pages online</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
-<h1>SELinux man pages for Fedora18</h1>
|
||||||
|
+<h1>SELinux man pages for %s</h1>
|
||||||
|
<hr>
|
||||||
|
<table><tr>
|
||||||
|
<td valign="middle">
|
||||||
|
<h3>SELinux roles</h3>
|
||||||
|
-""")
|
||||||
|
+""" % self.os_version)
|
||||||
|
for letter in self.manpage_roles:
|
||||||
|
if len(self.manpage_roles[letter]):
|
||||||
|
fd.write("""
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
From bfcb599d9424ef6ffcd250931c89675b451edd00 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Fri, 20 Feb 2015 16:42:01 +0100
|
||||||
|
Subject: [PATCH] We want to remove the trailing newline for
|
||||||
|
/etc/system_release.
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/__init__.py | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
index 88a2b8f6..0c66f4d5 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/__init__.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
@@ -1212,7 +1212,7 @@ def get_os_version():
|
||||||
|
system_release = ""
|
||||||
|
try:
|
||||||
|
with open('/etc/system-release') as f:
|
||||||
|
- system_release = f.readline()
|
||||||
|
+ system_release = f.readline().rstrip()
|
||||||
|
except IOError:
|
||||||
|
system_release = "Misc"
|
||||||
|
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
From 4ea504acce6389c3e28134c4b8e6bf9072c295ce Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Fri, 20 Feb 2015 16:42:53 +0100
|
||||||
|
Subject: [PATCH] Fix title in manpage.py to not contain 'online'.
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index d60acfaf..de8184d8 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -220,7 +220,7 @@ class HTMLManPages:
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<link rel=stylesheet type="text/css" href="style.css" title="style">
|
||||||
|
- <title>SELinux man pages online</title>
|
||||||
|
+ <title>SELinux man pages</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>SELinux man pages for %s</h1>
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
From 8af697659bd662517571577bf47946a2113f34a1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
Date: Fri, 14 Feb 2014 12:32:12 -0500
|
||||||
|
Subject: [PATCH] Don't be verbose if you are not on a tty
|
||||||
|
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index b2779581..53d28c7b 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
|
||||||
|
fullFlag=0
|
||||||
|
BOOTTIME=""
|
||||||
|
VERBOSE="-p"
|
||||||
|
+[ -t 1 ] || VERBOSE=""
|
||||||
|
FORCEFLAG=""
|
||||||
|
RPMFILES=""
|
||||||
|
PREFC=""
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
From ef0f54ffc6d691d10e66a0793204edd159cd45d0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 27 Feb 2017 17:12:39 +0100
|
||||||
|
Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and
|
||||||
|
file_type_is_entrypoint(f)
|
||||||
|
|
||||||
|
- use direct queries
|
||||||
|
- load exec_types and entry_types only once
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++--
|
||||||
|
1 file changed, 20 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index de8184d8..f8a94fc0 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -125,8 +125,24 @@ def gen_domains():
|
||||||
|
domains.sort()
|
||||||
|
return domains
|
||||||
|
|
||||||
|
-types = None
|
||||||
|
|
||||||
|
+exec_types = None
|
||||||
|
+
|
||||||
|
+def _gen_exec_types():
|
||||||
|
+ global exec_types
|
||||||
|
+ if exec_types is None:
|
||||||
|
+ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"]
|
||||||
|
+ return exec_types
|
||||||
|
+
|
||||||
|
+entry_types = None
|
||||||
|
+
|
||||||
|
+def _gen_entry_types():
|
||||||
|
+ global entry_types
|
||||||
|
+ if entry_types is None:
|
||||||
|
+ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
|
||||||
|
+ return entry_types
|
||||||
|
+
|
||||||
|
+types = None
|
||||||
|
|
||||||
|
def _gen_types():
|
||||||
|
global types
|
||||||
|
@@ -372,6 +388,8 @@ class ManPage:
|
||||||
|
self.all_file_types = sepolicy.get_all_file_types()
|
||||||
|
self.role_allows = sepolicy.get_all_role_allows()
|
||||||
|
self.types = _gen_types()
|
||||||
|
+ self.exec_types = _gen_exec_types()
|
||||||
|
+ self.entry_types = _gen_entry_types()
|
||||||
|
|
||||||
|
if self.source_files:
|
||||||
|
self.fcpath = self.root + "file_contexts"
|
||||||
|
@@ -689,7 +707,7 @@ Default Defined Ports:""")
|
||||||
|
for f in self.all_file_types:
|
||||||
|
if f.startswith(self.domainname):
|
||||||
|
flist.append(f)
|
||||||
|
- if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
|
||||||
|
+ if not f in self.exec_types or not f in self.entry_types:
|
||||||
|
flist_non_exec.append(f)
|
||||||
|
if f in self.fcdict:
|
||||||
|
mpaths = mpaths + self.fcdict[f]["regex"]
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,53 @@
|
|||||||
|
From e54db76a3bff8e911ddd7c7ce834c024d634d9e1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 28 Feb 2017 21:29:46 +0100
|
||||||
|
Subject: [PATCH] sepolicy: Another small optimization for mcs types
|
||||||
|
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/manpage.py | 16 +++++++++++-----
|
||||||
|
1 file changed, 11 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
index f8a94fc0..67d39301 100755
|
||||||
|
--- a/python/sepolicy/sepolicy/manpage.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/manpage.py
|
||||||
|
@@ -142,6 +142,15 @@ def _gen_entry_types():
|
||||||
|
entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
|
||||||
|
return entry_types
|
||||||
|
|
||||||
|
+mcs_constrained_types = None
|
||||||
|
+
|
||||||
|
+def _gen_mcs_constrained_types():
|
||||||
|
+ global mcs_constrained_types
|
||||||
|
+ if mcs_constrained_types is None:
|
||||||
|
+ mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
||||||
|
+ return mcs_constrained_types
|
||||||
|
+
|
||||||
|
+
|
||||||
|
types = None
|
||||||
|
|
||||||
|
def _gen_types():
|
||||||
|
@@ -390,6 +399,7 @@ class ManPage:
|
||||||
|
self.types = _gen_types()
|
||||||
|
self.exec_types = _gen_exec_types()
|
||||||
|
self.entry_types = _gen_entry_types()
|
||||||
|
+ self.mcs_constrained_types = _gen_mcs_constrained_types()
|
||||||
|
|
||||||
|
if self.source_files:
|
||||||
|
self.fcpath = self.root + "file_contexts"
|
||||||
|
@@ -944,11 +954,7 @@ All executeables with the default executable label, usually stored in /usr/bin a
|
||||||
|
%s""" % ", ".join(paths))
|
||||||
|
|
||||||
|
def _mcs_types(self):
|
||||||
|
- try:
|
||||||
|
- mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
|
||||||
|
- except StopIteration:
|
||||||
|
- return
|
||||||
|
- if self.type not in mcs_constrained_type['types']:
|
||||||
|
+ if self.type not in self.mcs_constrained_types['types']:
|
||||||
|
return
|
||||||
|
self.fd.write ("""
|
||||||
|
.SH "MCS Constrained"
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,515 @@
|
|||||||
|
From 4015e9299bfda622e9d407cdbcc536000688aa8f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 6 Aug 2018 13:23:00 +0200
|
||||||
|
Subject: [PATCH] Move po/ translation files into the right sub-directories
|
||||||
|
|
||||||
|
When policycoreutils was split into policycoreutils/ python/ gui/ and sandbox/
|
||||||
|
sub-directories, po/ translation files stayed in policycoreutils/.
|
||||||
|
|
||||||
|
This commit split original policycoreutils/po directory into
|
||||||
|
policycoreutils/po
|
||||||
|
python/po
|
||||||
|
gui/po
|
||||||
|
sandbox/po
|
||||||
|
|
||||||
|
See https://github.com/fedora-selinux/selinux/issues/43
|
||||||
|
---
|
||||||
|
gui/Makefile | 3 ++
|
||||||
|
gui/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++
|
||||||
|
gui/po/POTFILES | 17 ++++++++
|
||||||
|
policycoreutils/po/Makefile | 70 ++-----------------------------
|
||||||
|
policycoreutils/po/POTFILES | 9 ++++
|
||||||
|
python/Makefile | 2 +-
|
||||||
|
python/po/Makefile | 83 +++++++++++++++++++++++++++++++++++++
|
||||||
|
python/po/POTFILES | 10 +++++
|
||||||
|
sandbox/Makefile | 2 +
|
||||||
|
sandbox/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++
|
||||||
|
sandbox/po/POTFILES | 1 +
|
||||||
|
11 files changed, 293 insertions(+), 68 deletions(-)
|
||||||
|
create mode 100644 gui/po/Makefile
|
||||||
|
create mode 100644 gui/po/POTFILES
|
||||||
|
create mode 100644 policycoreutils/po/POTFILES
|
||||||
|
create mode 100644 python/po/Makefile
|
||||||
|
create mode 100644 python/po/POTFILES
|
||||||
|
create mode 100644 sandbox/po/Makefile
|
||||||
|
create mode 100644 sandbox/po/POTFILES
|
||||||
|
|
||||||
|
diff --git a/gui/Makefile b/gui/Makefile
|
||||||
|
index ca965c94..5a5bf6dc 100644
|
||||||
|
--- a/gui/Makefile
|
||||||
|
+++ b/gui/Makefile
|
||||||
|
@@ -22,6 +22,7 @@ system-config-selinux.ui \
|
||||||
|
usersPage.py
|
||||||
|
|
||||||
|
all: $(TARGETS) system-config-selinux.py polgengui.py
|
||||||
|
+ (cd po && $(MAKE) $@)
|
||||||
|
|
||||||
|
install: all
|
||||||
|
-mkdir -p $(DESTDIR)$(MANDIR)/man8
|
||||||
|
@@ -54,6 +55,8 @@ install: all
|
||||||
|
install -m 644 sepolicy_$${i}.png $(DESTDIR)$(DATADIR)/icons/hicolor/$${i}x$${i}/apps/sepolicy.png; \
|
||||||
|
done
|
||||||
|
install -m 644 org.selinux.config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions/
|
||||||
|
+ (cd po && $(MAKE) $@)
|
||||||
|
+
|
||||||
|
clean:
|
||||||
|
|
||||||
|
indent:
|
||||||
|
diff --git a/gui/po/Makefile b/gui/po/Makefile
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..a0f5439f
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/gui/po/Makefile
|
||||||
|
@@ -0,0 +1,82 @@
|
||||||
|
+#
|
||||||
|
+# Makefile for the PO files (translation) catalog
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+PREFIX ?= /usr
|
||||||
|
+
|
||||||
|
+# What is this package?
|
||||||
|
+NLSPACKAGE = gui
|
||||||
|
+POTFILE = $(NLSPACKAGE).pot
|
||||||
|
+INSTALL = /usr/bin/install -c -p
|
||||||
|
+INSTALL_DATA = $(INSTALL) -m 644
|
||||||
|
+INSTALL_DIR = /usr/bin/install -d
|
||||||
|
+
|
||||||
|
+# destination directory
|
||||||
|
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||||
|
+
|
||||||
|
+# PO catalog handling
|
||||||
|
+MSGMERGE = msgmerge
|
||||||
|
+MSGMERGE_FLAGS = -q
|
||||||
|
+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE)
|
||||||
|
+MSGFMT = msgfmt
|
||||||
|
+
|
||||||
|
+# All possible linguas
|
||||||
|
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||||
|
+
|
||||||
|
+# Only the files matching what the user has set in LINGUAS
|
||||||
|
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+# if no valid LINGUAS, build all languages
|
||||||
|
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||||
|
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||||
|
+POTFILES = $(shell cat POTFILES)
|
||||||
|
+
|
||||||
|
+#default:: clean
|
||||||
|
+
|
||||||
|
+all:: $(MOFILES)
|
||||||
|
+
|
||||||
|
+$(POTFILE): $(POTFILES)
|
||||||
|
+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||||
|
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||||
|
+ rm -f $(NLSPACKAGE).po; \
|
||||||
|
+ else \
|
||||||
|
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||||
|
+ fi; \
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+refresh-po: Makefile
|
||||||
|
+ for cat in $(POFILES); do \
|
||||||
|
+ lang=`basename $$cat .po`; \
|
||||||
|
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||||
|
+ mv -f $$lang.pot $$lang.po ; \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||||
|
+ else \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||||
|
+ rm -f $$lang.pot ; \
|
||||||
|
+ fi \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+clean:
|
||||||
|
+ @rm -fv *mo *~ .depend
|
||||||
|
+ @rm -rf tmp
|
||||||
|
+
|
||||||
|
+install: $(MOFILES)
|
||||||
|
+ @for n in $(MOFILES); do \
|
||||||
|
+ l=`basename $$n .mo`; \
|
||||||
|
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||||
|
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+%.mo: %.po
|
||||||
|
+ $(MSGFMT) -o $@ $<
|
||||||
|
+report:
|
||||||
|
+ @for cat in $(wildcard *.po); do \
|
||||||
|
+ echo -n "$$cat: "; \
|
||||||
|
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+.PHONY: missing depend
|
||||||
|
+
|
||||||
|
+relabel:
|
||||||
|
diff --git a/gui/po/POTFILES b/gui/po/POTFILES
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..1795c5c1
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/gui/po/POTFILES
|
||||||
|
@@ -0,0 +1,17 @@
|
||||||
|
+../booleansPage.py
|
||||||
|
+../domainsPage.py
|
||||||
|
+../fcontextPage.py
|
||||||
|
+../loginsPage.py
|
||||||
|
+../modulesPage.py
|
||||||
|
+../org.selinux.config.policy
|
||||||
|
+../polgengui.py
|
||||||
|
+../polgen.ui
|
||||||
|
+../portsPage.py
|
||||||
|
+../selinux-polgengui.desktop
|
||||||
|
+../semanagePage.py
|
||||||
|
+../sepolicy.desktop
|
||||||
|
+../statusPage.py
|
||||||
|
+../system-config-selinux.desktop
|
||||||
|
+../system-config-selinux.py
|
||||||
|
+../system-config-selinux.ui
|
||||||
|
+../usersPage.py
|
||||||
|
diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile
|
||||||
|
index 575e1431..18bc1dff 100644
|
||||||
|
--- a/policycoreutils/po/Makefile
|
||||||
|
+++ b/policycoreutils/po/Makefile
|
||||||
|
@@ -3,7 +3,6 @@
|
||||||
|
#
|
||||||
|
|
||||||
|
PREFIX ?= /usr
|
||||||
|
-TOP = ../..
|
||||||
|
|
||||||
|
# What is this package?
|
||||||
|
NLSPACKAGE = policycoreutils
|
||||||
|
@@ -32,74 +31,13 @@ USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||||
|
|
||||||
|
POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||||
|
MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||||
|
-POTFILES = \
|
||||||
|
- ../run_init/open_init_pty.c \
|
||||||
|
- ../run_init/run_init.c \
|
||||||
|
- ../semodule_link/semodule_link.c \
|
||||||
|
- ../audit2allow/audit2allow \
|
||||||
|
- ../semanage/seobject.py \
|
||||||
|
- ../setsebool/setsebool.c \
|
||||||
|
- ../newrole/newrole.c \
|
||||||
|
- ../load_policy/load_policy.c \
|
||||||
|
- ../sestatus/sestatus.c \
|
||||||
|
- ../semodule/semodule.c \
|
||||||
|
- ../setfiles/setfiles.c \
|
||||||
|
- ../semodule_package/semodule_package.c \
|
||||||
|
- ../semodule_deps/semodule_deps.c \
|
||||||
|
- ../semodule_expand/semodule_expand.c \
|
||||||
|
- ../scripts/chcat \
|
||||||
|
- ../scripts/fixfiles \
|
||||||
|
- ../restorecond/stringslist.c \
|
||||||
|
- ../restorecond/restorecond.h \
|
||||||
|
- ../restorecond/utmpwatcher.h \
|
||||||
|
- ../restorecond/stringslist.h \
|
||||||
|
- ../restorecond/restorecond.c \
|
||||||
|
- ../restorecond/utmpwatcher.c \
|
||||||
|
- ../gui/booleansPage.py \
|
||||||
|
- ../gui/fcontextPage.py \
|
||||||
|
- ../gui/loginsPage.py \
|
||||||
|
- ../gui/mappingsPage.py \
|
||||||
|
- ../gui/modulesPage.py \
|
||||||
|
- ../gui/polgen.glade \
|
||||||
|
- ../gui/polgengui.py \
|
||||||
|
- ../gui/portsPage.py \
|
||||||
|
- ../gui/semanagePage.py \
|
||||||
|
- ../gui/statusPage.py \
|
||||||
|
- ../gui/system-config-selinux.glade \
|
||||||
|
- ../gui/system-config-selinux.py \
|
||||||
|
- ../gui/usersPage.py \
|
||||||
|
- ../secon/secon.c \
|
||||||
|
- booleans.py \
|
||||||
|
- ../sepolicy/sepolicy.py \
|
||||||
|
- ../sepolicy/sepolicy/communicate.py \
|
||||||
|
- ../sepolicy/sepolicy/__init__.py \
|
||||||
|
- ../sepolicy/sepolicy/network.py \
|
||||||
|
- ../sepolicy/sepolicy/generate.py \
|
||||||
|
- ../sepolicy/sepolicy/sepolicy.glade \
|
||||||
|
- ../sepolicy/sepolicy/gui.py \
|
||||||
|
- ../sepolicy/sepolicy/manpage.py \
|
||||||
|
- ../sepolicy/sepolicy/transition.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/executable.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/__init__.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/network.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/rw.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/script.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/semodule.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/tmp.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/user.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/var_lib.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/var_log.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/var_run.py \
|
||||||
|
- ../sepolicy/sepolicy/templates/var_spool.py
|
||||||
|
+POTFILES = $(shell cat POTFILES)
|
||||||
|
|
||||||
|
#default:: clean
|
||||||
|
|
||||||
|
-all:: $(MOFILES)
|
||||||
|
+all:: $(POTFILE) $(MOFILES)
|
||||||
|
|
||||||
|
-booleans.py:
|
||||||
|
- sepolicy booleans -a > booleans.py
|
||||||
|
-
|
||||||
|
-$(POTFILE): $(POTFILES) booleans.py
|
||||||
|
+$(POTFILE): $(POTFILES)
|
||||||
|
$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||||
|
@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||||
|
rm -f $(NLSPACKAGE).po; \
|
||||||
|
@@ -107,8 +45,6 @@ $(POTFILE): $(POTFILES) booleans.py
|
||||||
|
mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||||
|
fi; \
|
||||||
|
|
||||||
|
-update-po: Makefile $(POTFILE) refresh-po
|
||||||
|
- @rm -f booleans.py
|
||||||
|
|
||||||
|
refresh-po: Makefile
|
||||||
|
for cat in $(POFILES); do \
|
||||||
|
diff --git a/policycoreutils/po/POTFILES b/policycoreutils/po/POTFILES
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..12237dc6
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/policycoreutils/po/POTFILES
|
||||||
|
@@ -0,0 +1,9 @@
|
||||||
|
+../run_init/open_init_pty.c
|
||||||
|
+../run_init/run_init.c
|
||||||
|
+../setsebool/setsebool.c
|
||||||
|
+../newrole/newrole.c
|
||||||
|
+../load_policy/load_policy.c
|
||||||
|
+../sestatus/sestatus.c
|
||||||
|
+../semodule/semodule.c
|
||||||
|
+../setfiles/setfiles.c
|
||||||
|
+../secon/secon.c
|
||||||
|
diff --git a/python/Makefile b/python/Makefile
|
||||||
|
index 9b66d52f..00312dbd 100644
|
||||||
|
--- a/python/Makefile
|
||||||
|
+++ b/python/Makefile
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-SUBDIRS = sepolicy audit2allow semanage sepolgen chcat
|
||||||
|
+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po
|
||||||
|
|
||||||
|
all install relabel clean indent test:
|
||||||
|
@for subdir in $(SUBDIRS); do \
|
||||||
|
diff --git a/python/po/Makefile b/python/po/Makefile
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..4e052d5a
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/python/po/Makefile
|
||||||
|
@@ -0,0 +1,83 @@
|
||||||
|
+#
|
||||||
|
+# Makefile for the PO files (translation) catalog
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+PREFIX ?= /usr
|
||||||
|
+
|
||||||
|
+# What is this package?
|
||||||
|
+NLSPACKAGE = python
|
||||||
|
+POTFILE = $(NLSPACKAGE).pot
|
||||||
|
+INSTALL = /usr/bin/install -c -p
|
||||||
|
+INSTALL_DATA = $(INSTALL) -m 644
|
||||||
|
+INSTALL_DIR = /usr/bin/install -d
|
||||||
|
+
|
||||||
|
+# destination directory
|
||||||
|
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||||
|
+
|
||||||
|
+# PO catalog handling
|
||||||
|
+MSGMERGE = msgmerge
|
||||||
|
+MSGMERGE_FLAGS = -q
|
||||||
|
+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE)
|
||||||
|
+MSGFMT = msgfmt
|
||||||
|
+
|
||||||
|
+# All possible linguas
|
||||||
|
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||||
|
+
|
||||||
|
+# Only the files matching what the user has set in LINGUAS
|
||||||
|
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+# if no valid LINGUAS, build all languages
|
||||||
|
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||||
|
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||||
|
+POTFILES = $(shell cat POTFILES)
|
||||||
|
+
|
||||||
|
+#default:: clean
|
||||||
|
+
|
||||||
|
+all:: $(MOFILES)
|
||||||
|
+
|
||||||
|
+$(POTFILE): $(POTFILES)
|
||||||
|
+ $(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)
|
||||||
|
+ $(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade
|
||||||
|
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||||
|
+ rm -f $(NLSPACKAGE).po; \
|
||||||
|
+ else \
|
||||||
|
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||||
|
+ fi; \
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+refresh-po: Makefile
|
||||||
|
+ for cat in $(POFILES); do \
|
||||||
|
+ lang=`basename $$cat .po`; \
|
||||||
|
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||||
|
+ mv -f $$lang.pot $$lang.po ; \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||||
|
+ else \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||||
|
+ rm -f $$lang.pot ; \
|
||||||
|
+ fi \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+clean:
|
||||||
|
+ @rm -fv *mo *~ .depend
|
||||||
|
+ @rm -rf tmp
|
||||||
|
+
|
||||||
|
+install: $(MOFILES)
|
||||||
|
+ @for n in $(MOFILES); do \
|
||||||
|
+ l=`basename $$n .mo`; \
|
||||||
|
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||||
|
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+%.mo: %.po
|
||||||
|
+ $(MSGFMT) -o $@ $<
|
||||||
|
+report:
|
||||||
|
+ @for cat in $(wildcard *.po); do \
|
||||||
|
+ echo -n "$$cat: "; \
|
||||||
|
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+.PHONY: missing depend
|
||||||
|
+
|
||||||
|
+relabel:
|
||||||
|
diff --git a/python/po/POTFILES b/python/po/POTFILES
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..128eb870
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/python/po/POTFILES
|
||||||
|
@@ -0,0 +1,10 @@
|
||||||
|
+../audit2allow/audit2allow
|
||||||
|
+../chcat/chcat
|
||||||
|
+../semanage/semanage
|
||||||
|
+../semanage/seobject.py
|
||||||
|
+../sepolgen/src/sepolgen/interfaces.py
|
||||||
|
+../sepolicy/sepolicy/generate.py
|
||||||
|
+../sepolicy/sepolicy/gui.py
|
||||||
|
+../sepolicy/sepolicy/__init__.py
|
||||||
|
+../sepolicy/sepolicy/interface.py
|
||||||
|
+../sepolicy/sepolicy.py
|
||||||
|
diff --git a/sandbox/Makefile b/sandbox/Makefile
|
||||||
|
index 9da5e58d..b817824e 100644
|
||||||
|
--- a/sandbox/Makefile
|
||||||
|
+++ b/sandbox/Makefile
|
||||||
|
@@ -13,6 +13,7 @@ override LDLIBS += -lselinux -lcap-ng
|
||||||
|
SEUNSHARE_OBJS = seunshare.o
|
||||||
|
|
||||||
|
all: sandbox seunshare sandboxX.sh start
|
||||||
|
+ (cd po && $(MAKE) $@)
|
||||||
|
|
||||||
|
seunshare: $(SEUNSHARE_OBJS)
|
||||||
|
|
||||||
|
@@ -39,6 +40,7 @@ install: all
|
||||||
|
install -m 755 start $(DESTDIR)$(SHAREDIR)
|
||||||
|
-mkdir -p $(DESTDIR)$(SYSCONFDIR)
|
||||||
|
install -m 644 sandbox.conf $(DESTDIR)$(SYSCONFDIR)/sandbox
|
||||||
|
+ (cd po && $(MAKE) $@)
|
||||||
|
|
||||||
|
test:
|
||||||
|
@$(PYTHON) test_sandbox.py -v
|
||||||
|
diff --git a/sandbox/po/Makefile b/sandbox/po/Makefile
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..0556bbe9
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sandbox/po/Makefile
|
||||||
|
@@ -0,0 +1,82 @@
|
||||||
|
+#
|
||||||
|
+# Makefile for the PO files (translation) catalog
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+PREFIX ?= /usr
|
||||||
|
+
|
||||||
|
+# What is this package?
|
||||||
|
+NLSPACKAGE = sandbox
|
||||||
|
+POTFILE = $(NLSPACKAGE).pot
|
||||||
|
+INSTALL = /usr/bin/install -c -p
|
||||||
|
+INSTALL_DATA = $(INSTALL) -m 644
|
||||||
|
+INSTALL_DIR = /usr/bin/install -d
|
||||||
|
+
|
||||||
|
+# destination directory
|
||||||
|
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
|
||||||
|
+
|
||||||
|
+# PO catalog handling
|
||||||
|
+MSGMERGE = msgmerge
|
||||||
|
+MSGMERGE_FLAGS = -q
|
||||||
|
+XGETTEXT = xgettext -L Python --default-domain=$(NLSPACKAGE)
|
||||||
|
+MSGFMT = msgfmt
|
||||||
|
+
|
||||||
|
+# All possible linguas
|
||||||
|
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
|
||||||
|
+
|
||||||
|
+# Only the files matching what the user has set in LINGUAS
|
||||||
|
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+# if no valid LINGUAS, build all languages
|
||||||
|
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
|
||||||
|
+
|
||||||
|
+POFILES = $(patsubst %,%.po,$(USE_LINGUAS))
|
||||||
|
+MOFILES = $(patsubst %.po,%.mo,$(POFILES))
|
||||||
|
+POTFILES = $(shell cat POTFILES)
|
||||||
|
+
|
||||||
|
+#default:: clean
|
||||||
|
+
|
||||||
|
+all:: $(POTFILE) $(MOFILES)
|
||||||
|
+
|
||||||
|
+$(POTFILE): $(POTFILES)
|
||||||
|
+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
|
||||||
|
+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
|
||||||
|
+ rm -f $(NLSPACKAGE).po; \
|
||||||
|
+ else \
|
||||||
|
+ mv -f $(NLSPACKAGE).po $(POTFILE); \
|
||||||
|
+ fi; \
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+refresh-po: Makefile
|
||||||
|
+ for cat in $(POFILES); do \
|
||||||
|
+ lang=`basename $$cat .po`; \
|
||||||
|
+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
|
||||||
|
+ mv -f $$lang.pot $$lang.po ; \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang succeeded" ; \
|
||||||
|
+ else \
|
||||||
|
+ echo "$(MSGMERGE) of $$lang failed" ; \
|
||||||
|
+ rm -f $$lang.pot ; \
|
||||||
|
+ fi \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+clean:
|
||||||
|
+ @rm -fv *mo *~ .depend
|
||||||
|
+ @rm -rf tmp
|
||||||
|
+
|
||||||
|
+install: $(MOFILES)
|
||||||
|
+ @for n in $(MOFILES); do \
|
||||||
|
+ l=`basename $$n .mo`; \
|
||||||
|
+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
|
||||||
|
+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+%.mo: %.po
|
||||||
|
+ $(MSGFMT) -o $@ $<
|
||||||
|
+report:
|
||||||
|
+ @for cat in $(wildcard *.po); do \
|
||||||
|
+ echo -n "$$cat: "; \
|
||||||
|
+ msgfmt -v --statistics -o /dev/null $$cat; \
|
||||||
|
+ done
|
||||||
|
+
|
||||||
|
+.PHONY: missing depend
|
||||||
|
+
|
||||||
|
+relabel:
|
||||||
|
diff --git a/sandbox/po/POTFILES b/sandbox/po/POTFILES
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..deff3f2f
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sandbox/po/POTFILES
|
||||||
|
@@ -0,0 +1 @@
|
||||||
|
+../sandbox
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,306 @@
|
|||||||
|
From 57cd23e11e1a700802a5955e84a0a7e04c30ec73 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 6 Aug 2018 13:37:07 +0200
|
||||||
|
Subject: [PATCH] Use correct gettext domains in python/ gui/ sandbox/
|
||||||
|
|
||||||
|
https://github.com/fedora-selinux/selinux/issues/43
|
||||||
|
---
|
||||||
|
gui/booleansPage.py | 2 +-
|
||||||
|
gui/domainsPage.py | 2 +-
|
||||||
|
gui/fcontextPage.py | 2 +-
|
||||||
|
gui/loginsPage.py | 2 +-
|
||||||
|
gui/modulesPage.py | 2 +-
|
||||||
|
gui/polgengui.py | 2 +-
|
||||||
|
gui/portsPage.py | 2 +-
|
||||||
|
gui/semanagePage.py | 2 +-
|
||||||
|
gui/statusPage.py | 2 +-
|
||||||
|
gui/system-config-selinux.py | 2 +-
|
||||||
|
gui/usersPage.py | 2 +-
|
||||||
|
python/chcat/chcat | 2 +-
|
||||||
|
python/semanage/semanage | 2 +-
|
||||||
|
python/semanage/seobject.py | 2 +-
|
||||||
|
python/sepolgen/src/sepolgen/sepolgeni18n.py | 2 +-
|
||||||
|
python/sepolicy/sepolicy.py | 2 +-
|
||||||
|
python/sepolicy/sepolicy/__init__.py | 2 +-
|
||||||
|
python/sepolicy/sepolicy/generate.py | 2 +-
|
||||||
|
python/sepolicy/sepolicy/gui.py | 2 +-
|
||||||
|
python/sepolicy/sepolicy/interface.py | 2 +-
|
||||||
|
sandbox/sandbox | 2 +-
|
||||||
|
21 files changed, 21 insertions(+), 21 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/gui/booleansPage.py b/gui/booleansPage.py
|
||||||
|
index 7849bea2..dd12b6d6 100644
|
||||||
|
--- a/gui/booleansPage.py
|
||||||
|
+++ b/gui/booleansPage.py
|
||||||
|
@@ -38,7 +38,7 @@ DISABLED = 2
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/domainsPage.py b/gui/domainsPage.py
|
||||||
|
index bad5140d..6bbe4de5 100644
|
||||||
|
--- a/gui/domainsPage.py
|
||||||
|
+++ b/gui/domainsPage.py
|
||||||
|
@@ -30,7 +30,7 @@ from semanagePage import *
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
|
||||||
|
index 370bbee4..e424366d 100644
|
||||||
|
--- a/gui/fcontextPage.py
|
||||||
|
+++ b/gui/fcontextPage.py
|
||||||
|
@@ -47,7 +47,7 @@ class context:
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/loginsPage.py b/gui/loginsPage.py
|
||||||
|
index b67eb8bc..cbfb0cc2 100644
|
||||||
|
--- a/gui/loginsPage.py
|
||||||
|
+++ b/gui/loginsPage.py
|
||||||
|
@@ -29,7 +29,7 @@ from semanagePage import *
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||||
|
index cb856b2d..26ac5404 100644
|
||||||
|
--- a/gui/modulesPage.py
|
||||||
|
+++ b/gui/modulesPage.py
|
||||||
|
@@ -30,7 +30,7 @@ from semanagePage import *
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/polgengui.py b/gui/polgengui.py
|
||||||
|
index b1cc9937..46a1bd2c 100644
|
||||||
|
--- a/gui/polgengui.py
|
||||||
|
+++ b/gui/polgengui.py
|
||||||
|
@@ -63,7 +63,7 @@ def get_all_modules():
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/portsPage.py b/gui/portsPage.py
|
||||||
|
index 30f58383..a537ecc8 100644
|
||||||
|
--- a/gui/portsPage.py
|
||||||
|
+++ b/gui/portsPage.py
|
||||||
|
@@ -35,7 +35,7 @@ from semanagePage import *
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/semanagePage.py b/gui/semanagePage.py
|
||||||
|
index 4127804f..5361d69c 100644
|
||||||
|
--- a/gui/semanagePage.py
|
||||||
|
+++ b/gui/semanagePage.py
|
||||||
|
@@ -22,7 +22,7 @@ from gi.repository import Gdk, Gtk
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/statusPage.py b/gui/statusPage.py
|
||||||
|
index 766854b1..a8f079b9 100644
|
||||||
|
--- a/gui/statusPage.py
|
||||||
|
+++ b/gui/statusPage.py
|
||||||
|
@@ -35,7 +35,7 @@ RELABELFILE = "/.autorelabel"
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
|
||||||
|
index c42301b6..1e0d5eb1 100644
|
||||||
|
--- a/gui/system-config-selinux.py
|
||||||
|
+++ b/gui/system-config-selinux.py
|
||||||
|
@@ -45,7 +45,7 @@ import selinux
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/gui/usersPage.py b/gui/usersPage.py
|
||||||
|
index 26794ed5..d15d4c5a 100644
|
||||||
|
--- a/gui/usersPage.py
|
||||||
|
+++ b/gui/usersPage.py
|
||||||
|
@@ -29,7 +29,7 @@ from semanagePage import *
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-gui"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
||||||
|
index ba398684..df2509f2 100755
|
||||||
|
--- a/python/chcat/chcat
|
||||||
|
+++ b/python/chcat/chcat
|
||||||
|
@@ -30,7 +30,7 @@ import getopt
|
||||||
|
import selinux
|
||||||
|
import seobject
|
||||||
|
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index 144cc000..56db3e0d 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -27,7 +27,7 @@ import traceback
|
||||||
|
import argparse
|
||||||
|
import seobject
|
||||||
|
import sys
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index 13fdf531..b90b1070 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -29,7 +29,7 @@ import sys
|
||||||
|
import stat
|
||||||
|
import socket
|
||||||
|
from semanage import *
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
import sepolicy
|
||||||
|
import setools
|
||||||
|
from IPy import IP
|
||||||
|
diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||||
|
index 998c4356..56ebd807 100644
|
||||||
|
--- a/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||||
|
+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py
|
||||||
|
@@ -19,7 +19,7 @@
|
||||||
|
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
- t = gettext.translation( 'yumex' )
|
||||||
|
+ t = gettext.translation( 'selinux-python' )
|
||||||
|
_ = t.gettext
|
||||||
|
except:
|
||||||
|
def _(str):
|
||||||
|
diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
|
||||||
|
index 1934cd86..8bd6a579 100755
|
||||||
|
--- a/python/sepolicy/sepolicy.py
|
||||||
|
+++ b/python/sepolicy/sepolicy.py
|
||||||
|
@@ -27,7 +27,7 @@ import selinux
|
||||||
|
import sepolicy
|
||||||
|
from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text
|
||||||
|
import argparse
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
index 0c66f4d5..b6ca57c3 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/__init__.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
@@ -13,7 +13,7 @@ import os
|
||||||
|
import re
|
||||||
|
import gzip
|
||||||
|
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||||
|
index 019e7836..7175d36b 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/generate.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/generate.py
|
||||||
|
@@ -49,7 +49,7 @@ import sepolgen.defaults as defaults
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py
|
||||||
|
index 00fd7a11..805cee67 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/gui.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/gui.py
|
||||||
|
@@ -41,7 +41,7 @@ import os
|
||||||
|
import re
|
||||||
|
import unicodedata
|
||||||
|
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py
|
||||||
|
index 583091ae..e2b8d23b 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/interface.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/interface.py
|
||||||
|
@@ -30,7 +30,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us
|
||||||
|
##
|
||||||
|
## I18N
|
||||||
|
##
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||||
|
index 1dec07ac..a12403b3 100644
|
||||||
|
--- a/sandbox/sandbox
|
||||||
|
+++ b/sandbox/sandbox
|
||||||
|
@@ -37,7 +37,7 @@ import sepolicy
|
||||||
|
|
||||||
|
SEUNSHARE = "/usr/sbin/seunshare"
|
||||||
|
SANDBOXSH = "/usr/share/sandbox/sandboxX.sh"
|
||||||
|
-PROGNAME = "policycoreutils"
|
||||||
|
+PROGNAME = "selinux-sandbox"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
kwargs = {}
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,30 @@
|
|||||||
|
From c8fbb8042852c18775c001999ce949e9b591e381 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 21 Mar 2018 08:51:31 +0100
|
||||||
|
Subject: [PATCH] policycoreutils/setfiles: Improve description of -d switch
|
||||||
|
|
||||||
|
The "-q" switch is becoming obsolete (completely unused in fedora) and
|
||||||
|
debug output ("-d" switch) makes sense in any scenario. Therefore both
|
||||||
|
options can be specified at once.
|
||||||
|
|
||||||
|
Resolves: rhbz#1271327
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/setfiles.8 | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||||
|
index ccaaf4de..a8a76c86 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.8
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.8
|
||||||
|
@@ -57,7 +57,7 @@ check the validity of the contexts against the specified binary policy.
|
||||||
|
.TP
|
||||||
|
.B \-d
|
||||||
|
show what specification matched each file (do not abort validation
|
||||||
|
-after ABORT_ON_ERRORS errors).
|
||||||
|
+after ABORT_ON_ERRORS errors). Not affected by "\-q"
|
||||||
|
.TP
|
||||||
|
.BI \-e \ directory
|
||||||
|
directory to exclude (repeat option for more than one directory).
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
From 3073efc112929b535f3a832c6f99e0dbe3af29ca Mon Sep 17 00:00:00 2001
|
||||||
|
From: Masatake YAMATO <yamato@redhat.com>
|
||||||
|
Date: Thu, 14 Dec 2017 15:57:58 +0900
|
||||||
|
Subject: [PATCH] sepolicy-generate: Handle more reserved port types
|
||||||
|
|
||||||
|
Currently only reserved_port_t, port_t and hi_reserved_port_t are
|
||||||
|
handled as special when making a ports-dictionary. However, as fas as
|
||||||
|
corenetwork.te.in of serefpolicy, unreserved_port_t and
|
||||||
|
ephemeral_port_t should be handled in the same way, too.
|
||||||
|
|
||||||
|
(Details) I found the need of this change when I was using
|
||||||
|
selinux-polgengui. Though tcp port 12345, which my application may
|
||||||
|
use, was given to the gui, selinux-polgengui generates expected te
|
||||||
|
file and sh file which didn't utilize the tcp port.
|
||||||
|
|
||||||
|
selinux-polgengui checks whether a port given via gui is already typed
|
||||||
|
or not.
|
||||||
|
|
||||||
|
If it is already typed, selinux-polgengui generates a te file having
|
||||||
|
rules to allow the application to use the port. (A)
|
||||||
|
|
||||||
|
If not, it seems for me that selinux-polgengui is designed to generate
|
||||||
|
a te file having rules to allow the application to own(?) the port;
|
||||||
|
and a sh file having a command line to assign the application own type
|
||||||
|
to the port. (B)
|
||||||
|
|
||||||
|
As we can see the output of `semanage port -l' some of ports for
|
||||||
|
specified purpose have types already. The important point is that the
|
||||||
|
rest of ports also have types already:
|
||||||
|
|
||||||
|
hi_reserved_port_t tcp 512-1023
|
||||||
|
hi_reserved_port_t udp 512-1023
|
||||||
|
unreserved_port_t tcp 1024-32767, 61001-65535
|
||||||
|
unreserved_port_t udp 1024-32767, 61001-65535
|
||||||
|
ephemeral_port_t tcp 32768-61000
|
||||||
|
ephemeral_port_t udp 32768-61000
|
||||||
|
|
||||||
|
As my patch shows, the original selinux-polgengui ignored
|
||||||
|
hi_reserved_port_t; though hi_reserved_port_t is assigned,
|
||||||
|
selinux-polgengui considered ports 512-1023 are not used. As the
|
||||||
|
result selinux-polgengui generates file sets of (B).
|
||||||
|
|
||||||
|
For the purpose of selinux-polgengui, I think unreserved_port_t and
|
||||||
|
ephemeral_port_t are treated as the same as hi_reserved_port_t.
|
||||||
|
|
||||||
|
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
|
||||||
|
|
||||||
|
Fedora only patch:
|
||||||
|
https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redhat.com/
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/generate.py | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||||
|
index 7175d36b..93caedee 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/generate.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/generate.py
|
||||||
|
@@ -100,7 +100,9 @@ def get_all_ports():
|
||||||
|
for p in sepolicy.info(sepolicy.PORT):
|
||||||
|
if p['type'] == "reserved_port_t" or \
|
||||||
|
p['type'] == "port_t" or \
|
||||||
|
- p['type'] == "hi_reserved_port_t":
|
||||||
|
+ p['type'] == "hi_reserved_port_t" or \
|
||||||
|
+ p['type'] == "ephemeral_port_t" or \
|
||||||
|
+ p['type'] == "unreserved_port_t":
|
||||||
|
continue
|
||||||
|
dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
|
||||||
|
return dict
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
From f8602180d042e95947fe0bbd35d261771b347705 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 8 Nov 2018 09:20:58 +0100
|
||||||
|
Subject: [PATCH] semodule-utils: Fix RESOURCE_LEAK coverity scan defects
|
||||||
|
|
||||||
|
---
|
||||||
|
semodule-utils/semodule_package/semodule_package.c | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/semodule-utils/semodule_package/semodule_package.c b/semodule-utils/semodule_package/semodule_package.c
|
||||||
|
index 3515234e..7b75b3fd 100644
|
||||||
|
--- a/semodule-utils/semodule_package/semodule_package.c
|
||||||
|
+++ b/semodule-utils/semodule_package/semodule_package.c
|
||||||
|
@@ -74,6 +74,7 @@ static int file_to_data(const char *path, char **data, size_t * len)
|
||||||
|
}
|
||||||
|
if (!sb.st_size) {
|
||||||
|
*len = 0;
|
||||||
|
+ close(fd);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,74 @@
|
|||||||
|
From 89895635ae012d1864a03700054ecc723973b5c0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Wed, 18 Jul 2018 09:09:35 +0200
|
||||||
|
Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
|
||||||
|
|
||||||
|
---
|
||||||
|
sandbox/sandbox | 4 ++--
|
||||||
|
sandbox/sandbox.8 | 2 +-
|
||||||
|
sandbox/sandboxX.sh | 14 --------------
|
||||||
|
3 files changed, 3 insertions(+), 17 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||||
|
index a12403b3..707959a6 100644
|
||||||
|
--- a/sandbox/sandbox
|
||||||
|
+++ b/sandbox/sandbox
|
||||||
|
@@ -268,7 +268,7 @@ class Sandbox:
|
||||||
|
copyfile(f, "/tmp", self.__tmpdir)
|
||||||
|
copyfile(f, "/var/tmp", self.__tmpdir)
|
||||||
|
|
||||||
|
- def __setup_sandboxrc(self, wm="/usr/bin/openbox"):
|
||||||
|
+ def __setup_sandboxrc(self, wm="/usr/bin/matchbox-window-manager"):
|
||||||
|
execfile = self.__homedir + "/.sandboxrc"
|
||||||
|
fd = open(execfile, "w+")
|
||||||
|
if self.__options.session:
|
||||||
|
@@ -362,7 +362,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [-
|
||||||
|
|
||||||
|
parser.add_option("-W", "--windowmanager", dest="wm",
|
||||||
|
type="string",
|
||||||
|
- default="/usr/bin/openbox",
|
||||||
|
+ default="/usr/bin/matchbox-window-manager",
|
||||||
|
help=_("alternate window manager"))
|
||||||
|
|
||||||
|
parser.add_option("-l", "--level", dest="level",
|
||||||
|
diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8
|
||||||
|
index d83fee76..90ef4951 100644
|
||||||
|
--- a/sandbox/sandbox.8
|
||||||
|
+++ b/sandbox/sandbox.8
|
||||||
|
@@ -77,7 +77,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
|
||||||
|
\fB\-W\fR \fB\-\-windowmanager\fR
|
||||||
|
Select alternative window manager to run within
|
||||||
|
.B sandbox \-X.
|
||||||
|
-Default to /usr/bin/openbox.
|
||||||
|
+Default to /usr/bin/matchbox-window-manager.
|
||||||
|
.TP
|
||||||
|
\fB\-X\fR
|
||||||
|
Create an X based Sandbox for gui apps, temporary files for
|
||||||
|
diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
|
||||||
|
index 47745280..c211ebc1 100644
|
||||||
|
--- a/sandbox/sandboxX.sh
|
||||||
|
+++ b/sandbox/sandboxX.sh
|
||||||
|
@@ -6,20 +6,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
|
||||||
|
[ -z $2 ] && export DPI="96" || export DPI="$2"
|
||||||
|
trap "exit 0" HUP
|
||||||
|
|
||||||
|
-mkdir -p ~/.config/openbox
|
||||||
|
-cat > ~/.config/openbox/rc.xml << EOF
|
||||||
|
-<openbox_config xmlns="http://openbox.org/3.4/rc"
|
||||||
|
- xmlns:xi="http://www.w3.org/2001/XInclude">
|
||||||
|
-<applications>
|
||||||
|
- <application class="*">
|
||||||
|
- <decor>no</decor>
|
||||||
|
- <desktop>all</desktop>
|
||||||
|
- <maximized>yes</maximized>
|
||||||
|
- </application>
|
||||||
|
-</applications>
|
||||||
|
-</openbox_config>
|
||||||
|
-EOF
|
||||||
|
-
|
||||||
|
(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
|
||||||
|
export DISPLAY=:$D
|
||||||
|
cat > ~/seremote << __EOF
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,45 @@
|
|||||||
|
From b2512e2a92a33360639a3459039cdf2e685655a8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 3 Dec 2018 14:40:09 +0100
|
||||||
|
Subject: [PATCH] python: Use ipaddress instead of IPy
|
||||||
|
|
||||||
|
ipaddress module was added in python 3.3 and this allows us to drop python3-IPy
|
||||||
|
---
|
||||||
|
python/semanage/seobject.py | 12 ++++++------
|
||||||
|
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index b90b1070..58497e3b 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -32,7 +32,7 @@ from semanage import *
|
||||||
|
PROGNAME = "selinux-python"
|
||||||
|
import sepolicy
|
||||||
|
import setools
|
||||||
|
-from IPy import IP
|
||||||
|
+import ipaddress
|
||||||
|
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
@@ -1851,13 +1851,13 @@ class nodeRecords(semanageRecords):
|
||||||
|
|
||||||
|
# verify valid comination
|
||||||
|
if len(mask) == 0 or mask[0] == "/":
|
||||||
|
- i = IP(addr + mask)
|
||||||
|
- newaddr = i.strNormal(0)
|
||||||
|
- newmask = str(i.netmask())
|
||||||
|
- if newmask == "0.0.0.0" and i.version() == 6:
|
||||||
|
+ i = ipaddress.ip_network(addr + mask)
|
||||||
|
+ newaddr = str(i.network_address)
|
||||||
|
+ newmask = str(i.netmask)
|
||||||
|
+ if newmask == "0.0.0.0" and i.version == 6:
|
||||||
|
newmask = "::"
|
||||||
|
|
||||||
|
- protocol = "ipv%d" % i.version()
|
||||||
|
+ protocol = "ipv%d" % i.version
|
||||||
|
|
||||||
|
try:
|
||||||
|
newprotocol = self.protocol.index(protocol)
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,93 @@
|
|||||||
|
From 5938d18536f4c0a76521d1f0721e981e6570b012 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 4 Apr 2019 23:02:56 +0200
|
||||||
|
Subject: [PATCH] python/semanage: Do not traceback when the default policy is
|
||||||
|
not available
|
||||||
|
|
||||||
|
"import seobject" causes "import sepolicy" which crashes when the system policy
|
||||||
|
is not available. It's better to provide an error message instead.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 37 +++++++++++++++++++++----------------
|
||||||
|
1 file changed, 21 insertions(+), 16 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index 56db3e0d..4c766ae3 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -25,7 +25,6 @@
|
||||||
|
|
||||||
|
import traceback
|
||||||
|
import argparse
|
||||||
|
-import seobject
|
||||||
|
import sys
|
||||||
|
PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
@@ -129,21 +128,6 @@ class SetImportFile(argparse.Action):
|
||||||
|
sys.exit(1)
|
||||||
|
setattr(namespace, self.dest, values)
|
||||||
|
|
||||||
|
-# define dictonary for seobject OBEJCTS
|
||||||
|
-object_dict = {
|
||||||
|
- 'login': seobject.loginRecords,
|
||||||
|
- 'user': seobject.seluserRecords,
|
||||||
|
- 'port': seobject.portRecords,
|
||||||
|
- 'module': seobject.moduleRecords,
|
||||||
|
- 'interface': seobject.interfaceRecords,
|
||||||
|
- 'node': seobject.nodeRecords,
|
||||||
|
- 'fcontext': seobject.fcontextRecords,
|
||||||
|
- 'boolean': seobject.booleanRecords,
|
||||||
|
- 'permissive': seobject.permissiveRecords,
|
||||||
|
- 'dontaudit': seobject.dontauditClass,
|
||||||
|
- 'ibpkey': seobject.ibpkeyRecords,
|
||||||
|
- 'ibendport': seobject.ibendportRecords
|
||||||
|
-}
|
||||||
|
|
||||||
|
def generate_custom_usage(usage_text, usage_dict):
|
||||||
|
# generate custom usage from given text and dictonary
|
||||||
|
@@ -608,6 +592,7 @@ def setupInterfaceParser(subparsers):
|
||||||
|
|
||||||
|
|
||||||
|
def handleModule(args):
|
||||||
|
+ import seobject
|
||||||
|
OBJECT = seobject.moduleRecords(args)
|
||||||
|
if args.action_add:
|
||||||
|
OBJECT.add(args.action_add[0], args.priority)
|
||||||
|
@@ -846,6 +831,7 @@ def mkargv(line):
|
||||||
|
|
||||||
|
|
||||||
|
def handleImport(args):
|
||||||
|
+ import seobject
|
||||||
|
trans = seobject.semanageRecords(args)
|
||||||
|
trans.start()
|
||||||
|
|
||||||
|
@@ -887,6 +873,25 @@ def createCommandParser():
|
||||||
|
#To add a new subcommand define the parser for it in a function above and call it here.
|
||||||
|
subparsers = commandParser.add_subparsers(dest='subcommand')
|
||||||
|
subparsers.required = True
|
||||||
|
+
|
||||||
|
+ import seobject
|
||||||
|
+ # define dictonary for seobject OBEJCTS
|
||||||
|
+ global object_dict
|
||||||
|
+ object_dict = {
|
||||||
|
+ 'login': seobject.loginRecords,
|
||||||
|
+ 'user': seobject.seluserRecords,
|
||||||
|
+ 'port': seobject.portRecords,
|
||||||
|
+ 'module': seobject.moduleRecords,
|
||||||
|
+ 'interface': seobject.interfaceRecords,
|
||||||
|
+ 'node': seobject.nodeRecords,
|
||||||
|
+ 'fcontext': seobject.fcontextRecords,
|
||||||
|
+ 'boolean': seobject.booleanRecords,
|
||||||
|
+ 'permissive': seobject.permissiveRecords,
|
||||||
|
+ 'dontaudit': seobject.dontauditClass,
|
||||||
|
+ 'ibpkey': seobject.ibpkeyRecords,
|
||||||
|
+ 'ibendport': seobject.ibendportRecords
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
setupImportParser(subparsers)
|
||||||
|
setupExportParser(subparsers)
|
||||||
|
setupLoginParser(subparsers)
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,108 @@
|
|||||||
|
From 99582e3bf63475b7af5793bb9230e88d847dc7c8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 2 Jul 2019 17:11:32 +0200
|
||||||
|
Subject: [PATCH] policycoreutils/fixfiles: Fix [-B] [-F] onboot
|
||||||
|
|
||||||
|
Commit 6e289bb7bf3d ("policycoreutils: fixfiles: remove bad modes of "relabel"
|
||||||
|
command") added "$RESTORE_MODE" != DEFAULT test when onboot is used. It makes
|
||||||
|
`fixfiles -B onboot` to show usage instead of updating /.autorelabel
|
||||||
|
|
||||||
|
The code is restructured to handle -B for different modes correctly.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
# fixfiles -B onboot
|
||||||
|
Usage: /usr/sbin/fixfiles [-v] [-F] [-f] relabel
|
||||||
|
...
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 29 +++++++++++++++--------------
|
||||||
|
1 file changed, 15 insertions(+), 14 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index 53d28c7b..9dd44213 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -112,7 +112,7 @@ VERBOSE="-p"
|
||||||
|
FORCEFLAG=""
|
||||||
|
RPMFILES=""
|
||||||
|
PREFC=""
|
||||||
|
-RESTORE_MODE="DEFAULT"
|
||||||
|
+RESTORE_MODE=""
|
||||||
|
SETFILES=/sbin/setfiles
|
||||||
|
RESTORECON=/sbin/restorecon
|
||||||
|
FILESYSTEMSRW=`get_rw_labeled_mounts`
|
||||||
|
@@ -214,16 +214,17 @@ restore () {
|
||||||
|
OPTION=$1
|
||||||
|
shift
|
||||||
|
|
||||||
|
-case "$RESTORE_MODE" in
|
||||||
|
- PREFC)
|
||||||
|
- diff_filecontext $*
|
||||||
|
- return
|
||||||
|
- ;;
|
||||||
|
- BOOTTIME)
|
||||||
|
+# [-B | -N time ]
|
||||||
|
+if [ -z "$BOOTTIME" ]; then
|
||||||
|
newer $BOOTTIME $*
|
||||||
|
return
|
||||||
|
- ;;
|
||||||
|
-esac
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+# -C PREVIOUS_FILECONTEXT
|
||||||
|
+if [ "$RESTORE_MODE" == PREFC ]; then
|
||||||
|
+ diff_filecontext $*
|
||||||
|
+ return
|
||||||
|
+fi
|
||||||
|
|
||||||
|
[ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
|
||||||
|
|
||||||
|
@@ -239,7 +240,7 @@ case "$RESTORE_MODE" in
|
||||||
|
FILEPATH)
|
||||||
|
${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -R -- "$FILEPATH"
|
||||||
|
;;
|
||||||
|
- DEFAULT)
|
||||||
|
+ *)
|
||||||
|
if [ -n "${FILESYSTEMSRW}" ]; then
|
||||||
|
LogReadOnly
|
||||||
|
echo "${OPTION}ing `echo ${FILESYSTEMSRW}`"
|
||||||
|
@@ -272,7 +273,7 @@ fullrelabel() {
|
||||||
|
|
||||||
|
|
||||||
|
relabel() {
|
||||||
|
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
+ if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
@@ -306,7 +307,7 @@ case "$1" in
|
||||||
|
verify) restore Verify -n;;
|
||||||
|
relabel) relabel;;
|
||||||
|
onboot)
|
||||||
|
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
+ if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
@@ -344,7 +345,7 @@ if [ $# -eq 0 ]; then
|
||||||
|
fi
|
||||||
|
|
||||||
|
set_restore_mode() {
|
||||||
|
- if [ "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
+ if [ -n "$RESTORE_MODE" ]; then
|
||||||
|
# can't specify two different modes
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
@@ -357,7 +358,7 @@ while getopts "N:BC:FfR:l:v" i; do
|
||||||
|
case "$i" in
|
||||||
|
B)
|
||||||
|
BOOTTIME=`/bin/who -b | awk '{print $3}'`
|
||||||
|
- set_restore_mode BOOTTIME
|
||||||
|
+ set_restore_mode DEFAULT
|
||||||
|
;;
|
||||||
|
N)
|
||||||
|
BOOTTIME=$OPTARG
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,33 @@
|
|||||||
|
From 9bcf8ad7b9b6d8d761f7d097196b2b9bc114fa0a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 2 Jul 2019 17:12:07 +0200
|
||||||
|
Subject: [PATCH] policycoreutils/fixfiles: Force full relabel when SELinux is
|
||||||
|
disabled
|
||||||
|
|
||||||
|
The previous check used getfilecon to check whether / slash contains a label,
|
||||||
|
but getfilecon fails only when SELinux is disabled. Therefore it's better to
|
||||||
|
check this using selinuxenabled.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index 9dd44213..a9d27d13 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -314,8 +314,8 @@ case "$1" in
|
||||||
|
> /.autorelabel || exit $?
|
||||||
|
[ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel
|
||||||
|
[ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel
|
||||||
|
- # Force full relabel if / does not have a label on it
|
||||||
|
- getfilecon / > /dev/null 2>&1 || echo -F >/.autorelabel
|
||||||
|
+ # Force full relabel if SELinux is not enabled
|
||||||
|
+ selinuxenabled || echo -F > /.autorelabel
|
||||||
|
echo "System will relabel on next boot"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
From 7383f8fbab82826de21d3013a43680867642e49e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 21 Aug 2019 17:43:25 +0200
|
||||||
|
Subject: [PATCH] policycoreutils/fixfiles: Fix unbound variable problem
|
||||||
|
|
||||||
|
Fix a typo introduced in commit d3f8b2c3cd909 ("policycoreutils/fixfiles: Fix
|
||||||
|
[-B] [-F] onboot"), which broke "fixfiles relabel":
|
||||||
|
|
||||||
|
#fixfiles relabel
|
||||||
|
/sbin/fixfiles: line 151: $1: unbound variable
|
||||||
|
|
||||||
|
Resolves: rhbz#1743213
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index a9d27d13..df0042aa 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -215,7 +215,7 @@ OPTION=$1
|
||||||
|
shift
|
||||||
|
|
||||||
|
# [-B | -N time ]
|
||||||
|
-if [ -z "$BOOTTIME" ]; then
|
||||||
|
+if [ -n "$BOOTTIME" ]; then
|
||||||
|
newer $BOOTTIME $*
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,38 @@
|
|||||||
|
From f6c67c02f25d3a8971dcc5667121236fab85dd65 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 29 Aug 2019 08:58:20 +0200
|
||||||
|
Subject: [PATCH] gui: Fix remove module in system-config-selinux
|
||||||
|
|
||||||
|
When a user tried to remove a policy module with priority other than 400 via
|
||||||
|
GUI, it failed with a message:
|
||||||
|
|
||||||
|
libsemanage.semanage_direct_remove_key: Unable to remove module somemodule at priority 400. (No such file or directory).
|
||||||
|
|
||||||
|
This is fixed by calling "semodule -x PRIORITY -r NAME" instead of
|
||||||
|
"semodule -r NAME".
|
||||||
|
|
||||||
|
From Jono Hein <fredwacko40@hotmail.com>
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
gui/modulesPage.py | 3 ++-
|
||||||
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/gui/modulesPage.py b/gui/modulesPage.py
|
||||||
|
index 26ac5404..35a0129b 100644
|
||||||
|
--- a/gui/modulesPage.py
|
||||||
|
+++ b/gui/modulesPage.py
|
||||||
|
@@ -125,9 +125,10 @@ class modulesPage(semanagePage):
|
||||||
|
def delete(self):
|
||||||
|
store, iter = self.view.get_selection().get_selected()
|
||||||
|
module = store.get_value(iter, 0)
|
||||||
|
+ priority = store.get_value(iter, 1)
|
||||||
|
try:
|
||||||
|
self.wait()
|
||||||
|
- status, output = getstatusoutput("semodule -r %s" % module)
|
||||||
|
+ status, output = getstatusoutput("semodule -X %s -r %s" % (priority, module))
|
||||||
|
self.ready()
|
||||||
|
if status != 0:
|
||||||
|
self.error(output)
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
From c2e942fc452bff06cc5ed9017afe169c6941f4e4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 3 Sep 2019 15:17:27 +0200
|
||||||
|
Subject: [PATCH] python/semanage: Do not use default s0 range in "semanage
|
||||||
|
login -a"
|
||||||
|
|
||||||
|
Using the "s0" default means that new login mappings are always added with "s0"
|
||||||
|
range instead of the range of SELinux user.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index 4c766ae3..fa78afce 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -221,7 +221,7 @@ def parser_add_level(parser, name):
|
||||||
|
|
||||||
|
|
||||||
|
def parser_add_range(parser, name):
|
||||||
|
- parser.add_argument('-r', '--range', default="s0",
|
||||||
|
+ parser.add_argument('-r', '--range', default='',
|
||||||
|
help=_('''
|
||||||
|
MLS/MCS Security Range (MLS/MCS Systems only)
|
||||||
|
SELinux Range for SELinux login mapping
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,33 @@
|
|||||||
|
From 4733a594c5df14f64293d19f16498e68dc5e3a98 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 24 Sep 2019 08:41:30 +0200
|
||||||
|
Subject: [PATCH] policycoreutils/fixfiles: Fix "verify" option
|
||||||
|
|
||||||
|
"restorecon -n" (used in the "restore" function) has to be used with
|
||||||
|
"-v" to display the files whose labels would be changed.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Fixfiles verify does not report misslabelled files unless "-v" option is
|
||||||
|
used.
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/scripts/fixfiles | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
|
||||||
|
index df0042aa..be19e56c 100755
|
||||||
|
--- a/policycoreutils/scripts/fixfiles
|
||||||
|
+++ b/policycoreutils/scripts/fixfiles
|
||||||
|
@@ -304,7 +304,7 @@ process() {
|
||||||
|
case "$1" in
|
||||||
|
restore) restore Relabel;;
|
||||||
|
check) VERBOSE="-v"; restore Check -n;;
|
||||||
|
- verify) restore Verify -n;;
|
||||||
|
+ verify) VERBOSE="-v"; restore Verify -n;;
|
||||||
|
relabel) relabel;;
|
||||||
|
onboot)
|
||||||
|
if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,102 @@
|
|||||||
|
From 0803fcb2c014b2cedf8f4d92b80fc382916477ee Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Fri, 27 Sep 2019 16:13:47 +0200
|
||||||
|
Subject: [PATCH] python/semanage: Improve handling of "permissive" statements
|
||||||
|
|
||||||
|
- Add "customized" method to permissiveRecords which is than used for
|
||||||
|
"semanage permissive --extract" and "semanage export"
|
||||||
|
- Enable "semanage permissive --deleteall" (already implemented)
|
||||||
|
- Add "permissive" to the list of modules exported using
|
||||||
|
"semanage export"
|
||||||
|
- Update "semanage permissive" man page
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 11 ++++++++---
|
||||||
|
python/semanage/semanage-permissive.8 | 8 +++++++-
|
||||||
|
python/semanage/seobject.py | 3 +++
|
||||||
|
3 files changed, 18 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index fa78afce..b2bd9df9 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -722,6 +722,11 @@ def handlePermissive(args):
|
||||||
|
|
||||||
|
if args.action == "list":
|
||||||
|
OBJECT.list(args.noheading)
|
||||||
|
+ elif args.action == "deleteall":
|
||||||
|
+ OBJECT.deleteall()
|
||||||
|
+ elif args.action == "extract":
|
||||||
|
+ for i in OBJECT.customized():
|
||||||
|
+ print("permissive %s" % str(i))
|
||||||
|
elif args.type is not None:
|
||||||
|
if args.action == "add":
|
||||||
|
OBJECT.add(args.type)
|
||||||
|
@@ -737,9 +742,9 @@ def setupPermissiveParser(subparsers):
|
||||||
|
pgroup = permissiveParser.add_mutually_exclusive_group(required=True)
|
||||||
|
parser_add_add(pgroup, "permissive")
|
||||||
|
parser_add_delete(pgroup, "permissive")
|
||||||
|
+ parser_add_deleteall(pgroup, "permissive")
|
||||||
|
+ parser_add_extract(pgroup, "permissive")
|
||||||
|
parser_add_list(pgroup, "permissive")
|
||||||
|
- #TODO: probably should be also added => need to implement own option handling
|
||||||
|
- #parser_add_deleteall(pgroup)
|
||||||
|
|
||||||
|
parser_add_noheading(permissiveParser, "permissive")
|
||||||
|
parser_add_noreload(permissiveParser, "permissive")
|
||||||
|
@@ -763,7 +768,7 @@ def setupDontauditParser(subparsers):
|
||||||
|
|
||||||
|
|
||||||
|
def handleExport(args):
|
||||||
|
- manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey"]
|
||||||
|
+ manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey", "permissive"]
|
||||||
|
for i in manageditems:
|
||||||
|
print("%s -D" % i)
|
||||||
|
for i in manageditems:
|
||||||
|
diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
|
||||||
|
index 1999a451..5c3364fa 100644
|
||||||
|
--- a/python/semanage/semanage-permissive.8
|
||||||
|
+++ b/python/semanage/semanage-permissive.8
|
||||||
|
@@ -2,7 +2,7 @@
|
||||||
|
.SH "NAME"
|
||||||
|
.B semanage\-permissive \- SELinux Policy Management permissive mapping tool
|
||||||
|
.SH "SYNOPSIS"
|
||||||
|
-.B semanage permissive [\-h] (\-a | \-d | \-l) [\-n] [\-N] [\-S STORE] [type]
|
||||||
|
+.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
|
||||||
|
|
||||||
|
.SH "DESCRIPTION"
|
||||||
|
semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module.
|
||||||
|
@@ -18,9 +18,15 @@ Add a record of the specified object type
|
||||||
|
.I \-d, \-\-delete
|
||||||
|
Delete a record of the specified object type
|
||||||
|
.TP
|
||||||
|
+.I \-D, \-\-deleteall
|
||||||
|
+Remove all local customizations of permissive domains
|
||||||
|
+.TP
|
||||||
|
.I \-l, \-\-list
|
||||||
|
List records of the specified object type
|
||||||
|
.TP
|
||||||
|
+.I \-E, \-\-extract
|
||||||
|
+Extract customizable commands, for use within a transaction
|
||||||
|
+.TP
|
||||||
|
.I \-n, \-\-noheading
|
||||||
|
Do not print heading when listing the specified object type
|
||||||
|
.TP
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index 58497e3b..3959abc8 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -478,6 +478,9 @@ class permissiveRecords(semanageRecords):
|
||||||
|
l.append(name.split("permissive_")[1])
|
||||||
|
return l
|
||||||
|
|
||||||
|
+ def customized(self):
|
||||||
|
+ return ["-a %s" % x for x in sorted(self.get_all())]
|
||||||
|
+
|
||||||
|
def list(self, heading=1, locallist=0):
|
||||||
|
all = [y["name"] for y in [x for x in sepolicy.info(sepolicy.TYPE) if x["permissive"]]]
|
||||||
|
if len(all) == 0:
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
From 7cc31c4799dd94ed516a39d853744bd1ffb6dc69 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Mon, 30 Sep 2019 09:49:04 +0200
|
||||||
|
Subject: [PATCH] python/semanage: fix moduleRecords.customized()
|
||||||
|
|
||||||
|
Return value of "customized" has to be iterable.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
"semanage export" with no modules in the system (eg. monolithic policy)
|
||||||
|
crashes:
|
||||||
|
|
||||||
|
Traceback (most recent call last):
|
||||||
|
File "/usr/sbin/semanage", line 970, in <module>
|
||||||
|
do_parser()
|
||||||
|
File "/usr/sbin/semanage", line 949, in do_parser
|
||||||
|
args.func(args)
|
||||||
|
File "/usr/sbin/semanage", line 771, in handleExport
|
||||||
|
for c in OBJECT.customized():
|
||||||
|
TypeError: 'NoneType' object is not iterable
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/seobject.py | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index 3959abc8..16edacaa 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -380,7 +380,7 @@ class moduleRecords(semanageRecords):
|
||||||
|
def customized(self):
|
||||||
|
all = self.get_all()
|
||||||
|
if len(all) == 0:
|
||||||
|
- return
|
||||||
|
+ return []
|
||||||
|
return ["-d %s" % x[0] for x in [t for t in all if t[1] == 0]]
|
||||||
|
|
||||||
|
def list(self, heading=1, locallist=0):
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,45 @@
|
|||||||
|
From 7cbfcec89a6972f9c700687ed3cef25ff0846461 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 8 Oct 2019 14:22:13 +0200
|
||||||
|
Subject: [PATCH] python/semanage: Add support for DCCP and SCTP protocols
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
# semanage port -a -p sctp -t port_t 1234
|
||||||
|
ValueError: Protocol udp or tcp is required
|
||||||
|
# semanage port -d -p sctp -t port_t 1234
|
||||||
|
ValueError: Protocol udp or tcp is required
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/seobject.py | 14 ++++++++------
|
||||||
|
1 file changed, 8 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index 16edacaa..70ebfd08 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -1058,13 +1058,15 @@ class portRecords(semanageRecords):
|
||||||
|
pass
|
||||||
|
|
||||||
|
def __genkey(self, port, proto):
|
||||||
|
- if proto == "tcp":
|
||||||
|
- proto_d = SEMANAGE_PROTO_TCP
|
||||||
|
+ protocols = {"tcp": SEMANAGE_PROTO_TCP,
|
||||||
|
+ "udp": SEMANAGE_PROTO_UDP,
|
||||||
|
+ "sctp": SEMANAGE_PROTO_SCTP,
|
||||||
|
+ "dccp": SEMANAGE_PROTO_DCCP}
|
||||||
|
+
|
||||||
|
+ if proto in protocols.keys():
|
||||||
|
+ proto_d = protocols[proto]
|
||||||
|
else:
|
||||||
|
- if proto == "udp":
|
||||||
|
- proto_d = SEMANAGE_PROTO_UDP
|
||||||
|
- else:
|
||||||
|
- raise ValueError(_("Protocol udp or tcp is required"))
|
||||||
|
+ raise ValueError(_("Protocol has to be one of udp, tcp, dccp or sctp"))
|
||||||
|
if port == "":
|
||||||
|
raise ValueError(_("Port is required"))
|
||||||
|
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
From 6e5ccf2dd3329b400b70b7806b9c6128c5c50995 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Fri, 15 Nov 2019 09:15:49 +0100
|
||||||
|
Subject: [PATCH] dbus: Fix FileNotFoundError in org.selinux.relabel_on_boot
|
||||||
|
|
||||||
|
When org.selinux.relabel_on_boot(0) was called twice, it failed with
|
||||||
|
FileNotFoundError.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:1
|
||||||
|
method return sender=:1.53 -> dest=:1.54 reply_serial=2
|
||||||
|
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
|
||||||
|
method return sender=:1.53 -> dest=:1.55 reply_serial=2
|
||||||
|
$ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
|
||||||
|
Error org.freedesktop.DBus.Python.FileNotFoundError: FileNotFoundError: [Errno 2] No such file or directory: '/.autorelabel'
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
dbus/selinux_server.py | 5 ++++-
|
||||||
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
|
||||||
|
index b9debc071485..be4f4557a9fa 100644
|
||||||
|
--- a/dbus/selinux_server.py
|
||||||
|
+++ b/dbus/selinux_server.py
|
||||||
|
@@ -85,7 +85,10 @@ class selinux_server(slip.dbus.service.Object):
|
||||||
|
fd = open("/.autorelabel", "w")
|
||||||
|
fd.close()
|
||||||
|
else:
|
||||||
|
- os.unlink("/.autorelabel")
|
||||||
|
+ try:
|
||||||
|
+ os.unlink("/.autorelabel")
|
||||||
|
+ except FileNotFoundError:
|
||||||
|
+ pass
|
||||||
|
|
||||||
|
def write_selinux_config(self, enforcing=None, policy=None):
|
||||||
|
path = selinux.selinux_path() + "config"
|
||||||
|
--
|
||||||
|
2.23.0
|
||||||
|
|
||||||
@ -0,0 +1,200 @@
|
|||||||
|
From 76371721bafed56efcb7a83b3fa3285383ede5b7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Baichuan Kong <kongbaichuan@huawei.com>
|
||||||
|
Date: Thu, 14 Nov 2019 10:48:07 +0800
|
||||||
|
Subject: [PATCH] restorecond: Fix redundant console log output error
|
||||||
|
|
||||||
|
When starting restorecond without any option the following redundant
|
||||||
|
console log is outputed:
|
||||||
|
|
||||||
|
/dev/log 100.0%
|
||||||
|
/var/volatile/run/syslogd.pid 100.0%
|
||||||
|
...
|
||||||
|
|
||||||
|
This is caused by two global variables of same name r_opts. When
|
||||||
|
executes r_opts = opts in restore_init(), it originally intends
|
||||||
|
to assign the address of struct r_opts in "restorecond.c" to the
|
||||||
|
pointer *r_opts in "restore.c".
|
||||||
|
|
||||||
|
However, the address is assigned to the struct r_opts and covers
|
||||||
|
the value of low eight bytes in it. That causes unexpected value
|
||||||
|
of member varibale 'nochange' and 'verbose' in struct r_opts, thus
|
||||||
|
affects value of 'restorecon_flags' and executes unexpected operations
|
||||||
|
when restorecon the files such as the redundant console log output or
|
||||||
|
file label nochange.
|
||||||
|
|
||||||
|
Cause restorecond/restore.c is copied from policycoreutils/setfiles,
|
||||||
|
which share the same pattern. It also has potential risk to generate
|
||||||
|
same problems, So fix it in case.
|
||||||
|
|
||||||
|
Signed-off-by: Baichuan Kong <kongbaichuan@huawei.com>
|
||||||
|
|
||||||
|
(cherry-picked from SElinuxProject
|
||||||
|
commit ad2208ec220f55877a4d31084be2b4d6413ee082)
|
||||||
|
|
||||||
|
Resolves: rhbz#1626468
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/restore.c | 42 ++++++++++++++----------------
|
||||||
|
restorecond/restore.c | 40 +++++++++++++---------------
|
||||||
|
2 files changed, 37 insertions(+), 45 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
|
||||||
|
index 9dea5656..d3335d1a 100644
|
||||||
|
--- a/policycoreutils/setfiles/restore.c
|
||||||
|
+++ b/policycoreutils/setfiles/restore.c
|
||||||
|
@@ -17,40 +17,37 @@
|
||||||
|
char **exclude_list;
|
||||||
|
int exclude_count;
|
||||||
|
|
||||||
|
-struct restore_opts *r_opts;
|
||||||
|
-
|
||||||
|
void restore_init(struct restore_opts *opts)
|
||||||
|
{
|
||||||
|
int rc;
|
||||||
|
|
||||||
|
- r_opts = opts;
|
||||||
|
struct selinux_opt selinux_opts[] = {
|
||||||
|
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
||||||
|
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
||||||
|
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
||||||
|
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
||||||
|
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
||||||
|
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
||||||
|
};
|
||||||
|
|
||||||
|
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||||
|
- if (!r_opts->hnd) {
|
||||||
|
- perror(r_opts->selabel_opt_path);
|
||||||
|
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||||
|
+ if (!opts->hnd) {
|
||||||
|
+ perror(opts->selabel_opt_path);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
- r_opts->restorecon_flags = 0;
|
||||||
|
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
||||||
|
- r_opts->progress | r_opts->set_specctx |
|
||||||
|
- r_opts->add_assoc | r_opts->ignore_digest |
|
||||||
|
- r_opts->recurse | r_opts->userealpath |
|
||||||
|
- r_opts->xdev | r_opts->abort_on_error |
|
||||||
|
- r_opts->syslog_changes | r_opts->log_matches |
|
||||||
|
- r_opts->ignore_noent | r_opts->ignore_mounts |
|
||||||
|
- r_opts->mass_relabel;
|
||||||
|
+ opts->restorecon_flags = 0;
|
||||||
|
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
||||||
|
+ opts->progress | opts->set_specctx |
|
||||||
|
+ opts->add_assoc | opts->ignore_digest |
|
||||||
|
+ opts->recurse | opts->userealpath |
|
||||||
|
+ opts->xdev | opts->abort_on_error |
|
||||||
|
+ opts->syslog_changes | opts->log_matches |
|
||||||
|
+ opts->ignore_noent | opts->ignore_mounts |
|
||||||
|
+ opts->mass_relabel;
|
||||||
|
|
||||||
|
/* Use setfiles, restorecon and restorecond own handles */
|
||||||
|
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
||||||
|
+ selinux_restorecon_set_sehandle(opts->hnd);
|
||||||
|
|
||||||
|
- if (r_opts->rootpath) {
|
||||||
|
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
||||||
|
+ if (opts->rootpath) {
|
||||||
|
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
||||||
|
if (rc) {
|
||||||
|
fprintf(stderr,
|
||||||
|
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
||||||
|
@@ -81,7 +78,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||||
|
size_t i = 0;
|
||||||
|
int len, rc, errors;
|
||||||
|
|
||||||
|
- r_opts = opts;
|
||||||
|
memset(&globbuf, 0, sizeof(globbuf));
|
||||||
|
|
||||||
|
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
||||||
|
@@ -96,7 +92,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||||
|
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
||||||
|
continue;
|
||||||
|
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
||||||
|
- r_opts->restorecon_flags);
|
||||||
|
+ opts->restorecon_flags);
|
||||||
|
if (rc < 0)
|
||||||
|
errors = rc;
|
||||||
|
}
|
||||||
|
diff --git a/restorecond/restore.c b/restorecond/restore.c
|
||||||
|
index f6e30001..b93b5fdb 100644
|
||||||
|
--- a/restorecond/restore.c
|
||||||
|
+++ b/restorecond/restore.c
|
||||||
|
@@ -12,39 +12,36 @@
|
||||||
|
char **exclude_list;
|
||||||
|
int exclude_count;
|
||||||
|
|
||||||
|
-struct restore_opts *r_opts;
|
||||||
|
-
|
||||||
|
void restore_init(struct restore_opts *opts)
|
||||||
|
{
|
||||||
|
int rc;
|
||||||
|
|
||||||
|
- r_opts = opts;
|
||||||
|
struct selinux_opt selinux_opts[] = {
|
||||||
|
- { SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
|
||||||
|
- { SELABEL_OPT_PATH, r_opts->selabel_opt_path },
|
||||||
|
- { SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
|
||||||
|
+ { SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
|
||||||
|
+ { SELABEL_OPT_PATH, opts->selabel_opt_path },
|
||||||
|
+ { SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
|
||||||
|
};
|
||||||
|
|
||||||
|
- r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||||
|
- if (!r_opts->hnd) {
|
||||||
|
- perror(r_opts->selabel_opt_path);
|
||||||
|
+ opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||||
|
+ if (!opts->hnd) {
|
||||||
|
+ perror(opts->selabel_opt_path);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
- r_opts->restorecon_flags = 0;
|
||||||
|
- r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
|
||||||
|
- r_opts->progress | r_opts->set_specctx |
|
||||||
|
- r_opts->add_assoc | r_opts->ignore_digest |
|
||||||
|
- r_opts->recurse | r_opts->userealpath |
|
||||||
|
- r_opts->xdev | r_opts->abort_on_error |
|
||||||
|
- r_opts->syslog_changes | r_opts->log_matches |
|
||||||
|
- r_opts->ignore_noent | r_opts->ignore_mounts;
|
||||||
|
+ opts->restorecon_flags = 0;
|
||||||
|
+ opts->restorecon_flags = opts->nochange | opts->verbose |
|
||||||
|
+ opts->progress | opts->set_specctx |
|
||||||
|
+ opts->add_assoc | opts->ignore_digest |
|
||||||
|
+ opts->recurse | opts->userealpath |
|
||||||
|
+ opts->xdev | opts->abort_on_error |
|
||||||
|
+ opts->syslog_changes | opts->log_matches |
|
||||||
|
+ opts->ignore_noent | opts->ignore_mounts;
|
||||||
|
|
||||||
|
/* Use setfiles, restorecon and restorecond own handles */
|
||||||
|
- selinux_restorecon_set_sehandle(r_opts->hnd);
|
||||||
|
+ selinux_restorecon_set_sehandle(opts->hnd);
|
||||||
|
|
||||||
|
- if (r_opts->rootpath) {
|
||||||
|
- rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
|
||||||
|
+ if (opts->rootpath) {
|
||||||
|
+ rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
|
||||||
|
if (rc) {
|
||||||
|
fprintf(stderr,
|
||||||
|
"selinux_restorecon_set_alt_rootpath error: %s.\n",
|
||||||
|
@@ -75,7 +72,6 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||||
|
size_t i = 0;
|
||||||
|
int len, rc, errors;
|
||||||
|
|
||||||
|
- r_opts = opts;
|
||||||
|
memset(&globbuf, 0, sizeof(globbuf));
|
||||||
|
|
||||||
|
errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
|
||||||
|
@@ -90,7 +86,7 @@ int process_glob(char *name, struct restore_opts *opts)
|
||||||
|
if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
|
||||||
|
continue;
|
||||||
|
rc = selinux_restorecon(globbuf.gl_pathv[i],
|
||||||
|
- r_opts->restorecon_flags);
|
||||||
|
+ opts->restorecon_flags);
|
||||||
|
if (rc < 0)
|
||||||
|
errors = rc;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,55 @@
|
|||||||
|
From 0bed778c53a4f93b1b092b3db33e8c36aabfa39d Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 5 Jan 2021 17:00:21 +0100
|
||||||
|
Subject: [PATCH] python/semanage: empty stdout before exiting on
|
||||||
|
BrokenPipeError
|
||||||
|
|
||||||
|
Empty stdout buffer before exiting when BrokenPipeError is
|
||||||
|
encountered. Otherwise python will flush the bufer during exit, which
|
||||||
|
may trigger the exception again.
|
||||||
|
https://docs.python.org/3/library/signal.html#note-on-sigpipe
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
#semanage fcontext -l | egrep -q -e '^/home'
|
||||||
|
BrokenPipeError: [Errno 32] Broken pipe
|
||||||
|
Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='UTF-8'>
|
||||||
|
BrokenPipeError: [Errno 32] Broken pipe
|
||||||
|
|
||||||
|
Note that the error above only appears occasionally (usually only the
|
||||||
|
first line is printed).
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 8 ++++++++
|
||||||
|
1 file changed, 8 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index b2bd9df9..1abe3536 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -26,6 +26,7 @@
|
||||||
|
import traceback
|
||||||
|
import argparse
|
||||||
|
import sys
|
||||||
|
+import os
|
||||||
|
PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
@@ -953,6 +954,13 @@ def do_parser():
|
||||||
|
args = commandParser.parse_args(make_args(sys.argv))
|
||||||
|
args.func(args)
|
||||||
|
sys.exit(0)
|
||||||
|
+ except BrokenPipeError as e:
|
||||||
|
+ sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
|
||||||
|
+ # Python flushes standard streams on exit; redirect remaining output
|
||||||
|
+ # to devnull to avoid another BrokenPipeError at shutdown
|
||||||
|
+ devnull = os.open(os.devnull, os.O_WRONLY)
|
||||||
|
+ os.dup2(devnull, sys.stdout.fileno())
|
||||||
|
+ sys.exit(1)
|
||||||
|
except IOError as e:
|
||||||
|
sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
|
||||||
|
sys.exit(1)
|
||||||
|
--
|
||||||
|
2.29.2
|
||||||
|
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
From 4b0e627d42f9a8e09dcd064a6ae897f4c2e9cf6c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 6 Jan 2021 10:00:07 +0100
|
||||||
|
Subject: [PATCH] python/semanage: Sort imports in alphabetical order
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 8 ++++----
|
||||||
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index 1abe3536..781e8645 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -23,10 +23,12 @@
|
||||||
|
#
|
||||||
|
#
|
||||||
|
|
||||||
|
-import traceback
|
||||||
|
import argparse
|
||||||
|
-import sys
|
||||||
|
import os
|
||||||
|
+import re
|
||||||
|
+import sys
|
||||||
|
+import traceback
|
||||||
|
+
|
||||||
|
PROGNAME = "selinux-python"
|
||||||
|
try:
|
||||||
|
import gettext
|
||||||
|
@@ -786,8 +788,6 @@ def setupExportParser(subparsers):
|
||||||
|
exportParser.add_argument('-f', '--output_file', dest='output_file', action=SetExportFile, help=_('Output file'))
|
||||||
|
exportParser.set_defaults(func=handleExport)
|
||||||
|
|
||||||
|
-import re
|
||||||
|
-
|
||||||
|
|
||||||
|
def mkargv(line):
|
||||||
|
dquote = "\""
|
||||||
|
--
|
||||||
|
2.29.2
|
||||||
|
|
||||||
@ -0,0 +1,49 @@
|
|||||||
|
From e0a1cdb6181bcf3a23fe63b8e67fd5020e81d05e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Fri, 22 Jan 2021 16:25:52 +0100
|
||||||
|
Subject: [PATCH] python/sepolgen: allow any policy statement in if(n)def
|
||||||
|
|
||||||
|
"ifdef/ifndef" statements can be used to conditionally define
|
||||||
|
an interface, but this syntax is not recognised by sepolgen-ifgen.
|
||||||
|
Fix sepolgen-ifgen to allow any policy statement inside an
|
||||||
|
"ifdef/ifndef" statement.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
$ cat <<EOF > i.if
|
||||||
|
ifndef(`apache_manage_pid_files',`
|
||||||
|
interface(`apache_manage_pid_files',`
|
||||||
|
manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
#sepolgen-ifgen --interface=i.if
|
||||||
|
i.if: Syntax error on line 2 interface [type=INTERFACE]
|
||||||
|
i.if: Syntax error on line 4 ' [type=SQUOTE]
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
[OM: s/fidef/ifdef/]
|
||||||
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
---
|
||||||
|
python/sepolgen/src/sepolgen/refparser.py | 6 +++---
|
||||||
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
|
||||||
|
index f506dc3a..5d77e2a3 100644
|
||||||
|
--- a/python/sepolgen/src/sepolgen/refparser.py
|
||||||
|
+++ b/python/sepolgen/src/sepolgen/refparser.py
|
||||||
|
@@ -431,9 +431,9 @@ def p_ifelse(p):
|
||||||
|
|
||||||
|
|
||||||
|
def p_ifdef(p):
|
||||||
|
- '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||||
|
- | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||||
|
- | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||||
|
+ '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||||
|
+ | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||||
|
+ | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
|
||||||
|
'''
|
||||||
|
x = refpolicy.IfDef(p[4])
|
||||||
|
if p[1] == 'ifdef':
|
||||||
|
--
|
||||||
|
2.29.2
|
||||||
|
|
||||||
@ -0,0 +1,68 @@
|
|||||||
|
From 53ccdd55adfbec60fb4277286f2ad94660838504 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Wed, 13 Jan 2021 22:09:47 +0100
|
||||||
|
Subject: [PATCH] setfiles: Do not abort on labeling error
|
||||||
|
|
||||||
|
Commit 602347c7422e ("policycoreutils: setfiles - Modify to use
|
||||||
|
selinux_restorecon") changed behavior of setfiles. Original
|
||||||
|
implementation skipped files which it couldn't set context to while the
|
||||||
|
new implementation aborts on them. setfiles should abort only if it
|
||||||
|
can't validate a context from spec_file.
|
||||||
|
|
||||||
|
Reproducer:
|
||||||
|
|
||||||
|
# mkdir -p r/1 r/2 r/3
|
||||||
|
# touch r/1/1 r/2/1
|
||||||
|
# chattr +i r/2/1
|
||||||
|
# touch r/3/1
|
||||||
|
# setfiles -r r -v /etc/selinux/targeted/contexts/files/file_contexts r
|
||||||
|
Relabeled r from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:root_t:s0
|
||||||
|
Relabeled r/2 from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:default_t:s0
|
||||||
|
setfiles: Could not set context for r/2/1: Operation not permitted
|
||||||
|
|
||||||
|
r/3 and r/1 are not relabeled.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/setfiles.c | 4 +---
|
||||||
|
1 file changed, 1 insertion(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||||
|
index bc83c27b4c06..68eab45aa2b4 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.c
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.c
|
||||||
|
@@ -182,6 +182,7 @@ int main(int argc, char **argv)
|
||||||
|
policyfile = NULL;
|
||||||
|
nerr = 0;
|
||||||
|
|
||||||
|
+ r_opts.abort_on_error = 0;
|
||||||
|
r_opts.progname = strdup(argv[0]);
|
||||||
|
if (!r_opts.progname) {
|
||||||
|
fprintf(stderr, "%s: Out of memory!\n", argv[0]);
|
||||||
|
@@ -194,7 +195,6 @@ int main(int argc, char **argv)
|
||||||
|
* setfiles:
|
||||||
|
* Recursive descent,
|
||||||
|
* Does not expand paths via realpath,
|
||||||
|
- * Aborts on errors during the file tree walk,
|
||||||
|
* Try to track inode associations for conflict detection,
|
||||||
|
* Does not follow mounts (sets SELINUX_RESTORECON_XDEV),
|
||||||
|
* Validates all file contexts at init time.
|
||||||
|
@@ -202,7 +202,6 @@ int main(int argc, char **argv)
|
||||||
|
iamrestorecon = 0;
|
||||||
|
r_opts.recurse = SELINUX_RESTORECON_RECURSE;
|
||||||
|
r_opts.userealpath = 0; /* SELINUX_RESTORECON_REALPATH */
|
||||||
|
- r_opts.abort_on_error = SELINUX_RESTORECON_ABORT_ON_ERROR;
|
||||||
|
r_opts.add_assoc = SELINUX_RESTORECON_ADD_ASSOC;
|
||||||
|
/* FTS_PHYSICAL and FTS_NOCHDIR are always set by selinux_restorecon(3) */
|
||||||
|
r_opts.xdev = SELINUX_RESTORECON_XDEV;
|
||||||
|
@@ -226,7 +225,6 @@ int main(int argc, char **argv)
|
||||||
|
iamrestorecon = 1;
|
||||||
|
r_opts.recurse = 0;
|
||||||
|
r_opts.userealpath = SELINUX_RESTORECON_REALPATH;
|
||||||
|
- r_opts.abort_on_error = 0;
|
||||||
|
r_opts.add_assoc = 0;
|
||||||
|
r_opts.xdev = 0;
|
||||||
|
r_opts.ignore_mounts = 0;
|
||||||
|
--
|
||||||
|
2.30.0
|
||||||
|
|
||||||
@ -0,0 +1,110 @@
|
|||||||
|
From 2f135022f4372dc34198c48cfd67b91044e6dfd7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Wed, 13 Jan 2021 22:09:48 +0100
|
||||||
|
Subject: [PATCH] setfiles: drop ABORT_ON_ERRORS and related code
|
||||||
|
|
||||||
|
`setfiles -d` doesn't have any impact on number of errors before it
|
||||||
|
aborts. It always aborts on first invalid context in spec file.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/Makefile | 3 ---
|
||||||
|
policycoreutils/setfiles/ru/setfiles.8 | 2 +-
|
||||||
|
policycoreutils/setfiles/setfiles.8 | 3 +--
|
||||||
|
policycoreutils/setfiles/setfiles.c | 18 ------------------
|
||||||
|
4 files changed, 2 insertions(+), 24 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile
|
||||||
|
index bc5a8db789a5..a3bbbe116b7f 100644
|
||||||
|
--- a/policycoreutils/setfiles/Makefile
|
||||||
|
+++ b/policycoreutils/setfiles/Makefile
|
||||||
|
@@ -5,8 +5,6 @@ SBINDIR ?= /sbin
|
||||||
|
MANDIR = $(PREFIX)/share/man
|
||||||
|
AUDITH ?= $(shell test -f /usr/include/libaudit.h && echo y)
|
||||||
|
|
||||||
|
-ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }')
|
||||||
|
-
|
||||||
|
CFLAGS ?= -g -Werror -Wall -W
|
||||||
|
override LDLIBS += -lselinux -lsepol
|
||||||
|
|
||||||
|
@@ -26,7 +24,6 @@ restorecon_xattr: restorecon_xattr.o restore.o
|
||||||
|
|
||||||
|
man:
|
||||||
|
@cp -af setfiles.8 setfiles.8.man
|
||||||
|
- @sed -i "s/ABORT_ON_ERRORS/$(ABORT_ON_ERRORS)/g" setfiles.8.man
|
||||||
|
|
||||||
|
install: all
|
||||||
|
[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
|
||||||
|
diff --git a/policycoreutils/setfiles/ru/setfiles.8 b/policycoreutils/setfiles/ru/setfiles.8
|
||||||
|
index 27815a3f1eee..910101452625 100644
|
||||||
|
--- a/policycoreutils/setfiles/ru/setfiles.8
|
||||||
|
+++ b/policycoreutils/setfiles/ru/setfiles.8
|
||||||
|
@@ -47,7 +47,7 @@ setfiles \- установить SELinux-контексты безопаснос
|
||||||
|
проверить действительность контекстов относительно указанной двоичной политики.
|
||||||
|
.TP
|
||||||
|
.B \-d
|
||||||
|
-показать, какая спецификация соответствует каждому из файлов (не прекращать проверку после получения ошибок ABORT_ON_ERRORS).
|
||||||
|
+показать, какая спецификация соответствует каждому из файлов.
|
||||||
|
.TP
|
||||||
|
.BI \-e \ directory
|
||||||
|
исключить каталог (чтобы исключить более одного каталога, этот параметр необходимо использовать соответствующее количество раз).
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||||
|
index a8a76c860dac..b7d3cefb96ff 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.8
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.8
|
||||||
|
@@ -56,8 +56,7 @@ option will force a replacement of the entire context.
|
||||||
|
check the validity of the contexts against the specified binary policy.
|
||||||
|
.TP
|
||||||
|
.B \-d
|
||||||
|
-show what specification matched each file (do not abort validation
|
||||||
|
-after ABORT_ON_ERRORS errors). Not affected by "\-q"
|
||||||
|
+show what specification matched each file. Not affected by "\-q"
|
||||||
|
.TP
|
||||||
|
.BI \-e \ directory
|
||||||
|
directory to exclude (repeat option for more than one directory).
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||||
|
index 68eab45aa2b4..bcbdfbfe53e2 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.c
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.c
|
||||||
|
@@ -23,14 +23,6 @@ static int nerr;
|
||||||
|
|
||||||
|
#define STAT_BLOCK_SIZE 1
|
||||||
|
|
||||||
|
-/* setfiles will abort its operation after reaching the
|
||||||
|
- * following number of errors (e.g. invalid contexts),
|
||||||
|
- * unless it is used in "debug" mode (-d option).
|
||||||
|
- */
|
||||||
|
-#ifndef ABORT_ON_ERRORS
|
||||||
|
-#define ABORT_ON_ERRORS 10
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
#define SETFILES "setfiles"
|
||||||
|
#define RESTORECON "restorecon"
|
||||||
|
static int iamrestorecon;
|
||||||
|
@@ -57,15 +49,6 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
||||||
|
exit(-1);
|
||||||
|
}
|
||||||
|
|
||||||
|
-void inc_err(void)
|
||||||
|
-{
|
||||||
|
- nerr++;
|
||||||
|
- if (nerr > ABORT_ON_ERRORS - 1 && !r_opts.debug) {
|
||||||
|
- fprintf(stderr, "Exiting after %d errors.\n", ABORT_ON_ERRORS);
|
||||||
|
- exit(-1);
|
||||||
|
- }
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
void set_rootpath(const char *arg)
|
||||||
|
{
|
||||||
|
if (strlen(arg) == 1 && strncmp(arg, "/", 1) == 0) {
|
||||||
|
@@ -98,7 +81,6 @@ int canoncon(char **contextp)
|
||||||
|
*contextp = tmpcon;
|
||||||
|
} else if (errno != ENOENT) {
|
||||||
|
rc = -1;
|
||||||
|
- inc_err();
|
||||||
|
}
|
||||||
|
|
||||||
|
return rc;
|
||||||
|
--
|
||||||
|
2.30.0
|
||||||
|
|
||||||
@ -0,0 +1,44 @@
|
|||||||
|
From a691da617a2d3c864786ff2742d9a9f87ecc7d05 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 1 Feb 2021 15:24:32 +0100
|
||||||
|
Subject: [PATCH] policycoreutils/setfiles: Drop unused nerr variable
|
||||||
|
|
||||||
|
Suggested-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/setfiles.c | 5 -----
|
||||||
|
1 file changed, 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||||
|
index bcbdfbfe53e2..82d0aaa75893 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.c
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.c
|
||||||
|
@@ -19,7 +19,6 @@ static int warn_no_match;
|
||||||
|
static int null_terminated;
|
||||||
|
static int request_digest;
|
||||||
|
static struct restore_opts r_opts;
|
||||||
|
-static int nerr;
|
||||||
|
|
||||||
|
#define STAT_BLOCK_SIZE 1
|
||||||
|
|
||||||
|
@@ -162,7 +161,6 @@ int main(int argc, char **argv)
|
||||||
|
warn_no_match = 0;
|
||||||
|
request_digest = 0;
|
||||||
|
policyfile = NULL;
|
||||||
|
- nerr = 0;
|
||||||
|
|
||||||
|
r_opts.abort_on_error = 0;
|
||||||
|
r_opts.progname = strdup(argv[0]);
|
||||||
|
@@ -417,9 +415,6 @@ int main(int argc, char **argv)
|
||||||
|
r_opts.selabel_opt_digest = (request_digest ? (char *)1 : NULL);
|
||||||
|
r_opts.selabel_opt_path = altpath;
|
||||||
|
|
||||||
|
- if (nerr)
|
||||||
|
- exit(-1);
|
||||||
|
-
|
||||||
|
restore_init(&r_opts);
|
||||||
|
|
||||||
|
if (use_input_file) {
|
||||||
|
--
|
||||||
|
2.30.0
|
||||||
|
|
||||||
@ -0,0 +1,62 @@
|
|||||||
|
From c556c6ad0b94cf3ba4b441a1a0930f2468434227 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 10 Feb 2021 18:05:29 +0100
|
||||||
|
Subject: [PATCH] selinux(8,5): Describe fcontext regular expressions
|
||||||
|
|
||||||
|
Describe which type of regular expression is used in file context
|
||||||
|
definitions and which flags are in effect.
|
||||||
|
|
||||||
|
Explain how local file context modifications are processed.
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 2 +-
|
||||||
|
python/semanage/semanage-fcontext.8 | 18 ++++++++++++++++++
|
||||||
|
2 files changed, 19 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index 781e8645..ebb93ea5 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -366,7 +366,7 @@ If you do not specify a file type, the file type will default to "all files".
|
||||||
|
parser_add_seuser(fcontextParser, "fcontext")
|
||||||
|
parser_add_type(fcontextParser, "fcontext")
|
||||||
|
parser_add_range(fcontextParser, "fcontext")
|
||||||
|
- fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('file_spec'))
|
||||||
|
+ fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
|
||||||
|
fcontextParser.set_defaults(func=handleFcontext)
|
||||||
|
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
|
||||||
|
index 561123af..49635ba7 100644
|
||||||
|
--- a/python/semanage/semanage-fcontext.8
|
||||||
|
+++ b/python/semanage/semanage-fcontext.8
|
||||||
|
@@ -11,6 +11,24 @@ SELinux policy without requiring modification to or recompilation
|
||||||
|
from policy sources. semanage fcontext is used to manage the default
|
||||||
|
file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.
|
||||||
|
|
||||||
|
+FILE_SPEC may contain either a fully qualified path,
|
||||||
|
+or a Perl compatible regular expression (PCRE),
|
||||||
|
+describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL,
|
||||||
|
+which causes a wildcard '.' to match anything, including a new line.
|
||||||
|
+Strings representing paths are processed as bytes (as opposed to Unicode),
|
||||||
|
+meaning that non-ASCII characters are not matched by a single wildcard.
|
||||||
|
+
|
||||||
|
+Note, that file context definitions specified using 'semanage fcontext'
|
||||||
|
+(i.e. local file context modifications stored in file_contexts.local)
|
||||||
|
+have higher priority than those specified in policy modules.
|
||||||
|
+This means that whenever a match for given file path is found in
|
||||||
|
+file_contexts.local, no other file context definitions are considered.
|
||||||
|
+Entries in file_contexts.local are processed from most recent one to the oldest,
|
||||||
|
+with first match being used (as opposed to the most specific match,
|
||||||
|
+which is used when matching other file context definitions).
|
||||||
|
+All regular expressions should therefore be as specific as possible,
|
||||||
|
+to avoid unintentionally impacting other parts of the filesystem.
|
||||||
|
+
|
||||||
|
.SH "OPTIONS"
|
||||||
|
.TP
|
||||||
|
.I \-h, \-\-help
|
||||||
|
--
|
||||||
|
2.29.2
|
||||||
|
|
||||||
@ -0,0 +1,69 @@
|
|||||||
|
From d10e773c014a12b17fefd9caef0bd02528d75d18 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Antoine Tenart <antoine.tenart@bootlin.com>
|
||||||
|
Date: Tue, 7 Jul 2020 16:35:01 +0200
|
||||||
|
Subject: [PATCH] policycoreutils: setfiles: do not restrict checks against a
|
||||||
|
binary policy
|
||||||
|
|
||||||
|
The -c option allows to check the validity of contexts against a
|
||||||
|
specified binary policy. Its use is restricted: no pathname can be used
|
||||||
|
when a binary policy is given to setfiles. It's not clear if this is
|
||||||
|
intentional as the built-in help and the man page are not stating the
|
||||||
|
same thing about this (the man page document -c as a normal option,
|
||||||
|
while the built-in help shows it is restricted).
|
||||||
|
|
||||||
|
When generating full system images later used with SELinux in enforcing
|
||||||
|
mode, the extended attributed of files have to be set by the build
|
||||||
|
machine. The issue is setfiles always checks the contexts against a
|
||||||
|
policy (ctx_validate = 1) and using an external binary policy is not
|
||||||
|
currently possible when using a pathname. This ends up in setfiles
|
||||||
|
failing early as the contexts of the target image are not always
|
||||||
|
compatible with the ones of the build machine.
|
||||||
|
|
||||||
|
This patch reworks a check on optind only made when -c is used, that
|
||||||
|
enforced the use of a single argument to allow 1+ arguments, allowing to
|
||||||
|
use setfiles with an external binary policy and pathnames. The following
|
||||||
|
command is then allowed, as already documented in the man page:
|
||||||
|
|
||||||
|
$ setfiles -m -r target/ -c policy.32 file_contexts target/
|
||||||
|
|
||||||
|
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
|
||||||
|
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
|
||||||
|
|
||||||
|
(cherry-picked from SElinuxProject
|
||||||
|
commit: c94e542c98da2f26863c1cbd9d7ad9bc5cca6aff )
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/setfiles.c | 11 +++++------
|
||||||
|
1 file changed, 5 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||||
|
index 82d0aaa7..4fd3d756 100644
|
||||||
|
--- a/policycoreutils/setfiles/setfiles.c
|
||||||
|
+++ b/policycoreutils/setfiles/setfiles.c
|
||||||
|
@@ -39,11 +39,10 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
||||||
|
name, name);
|
||||||
|
} else {
|
||||||
|
fprintf(stderr,
|
||||||
|
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n"
|
||||||
|
- "usage: %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n"
|
||||||
|
- "usage: %s -s [-diIDlmnpqvFW] spec_file\n"
|
||||||
|
- "usage: %s -c policyfile spec_file\n",
|
||||||
|
- name, name, name, name);
|
||||||
|
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
|
||||||
|
+ "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
|
||||||
|
+ "usage: %s -s [-diIDlmnpqvFW] spec_file\n",
|
||||||
|
+ name, name, name);
|
||||||
|
}
|
||||||
|
exit(-1);
|
||||||
|
}
|
||||||
|
@@ -376,7 +375,7 @@ int main(int argc, char **argv)
|
||||||
|
|
||||||
|
if (!iamrestorecon) {
|
||||||
|
if (policyfile) {
|
||||||
|
- if (optind != (argc - 1))
|
||||||
|
+ if (optind > (argc - 1))
|
||||||
|
usage(argv[0]);
|
||||||
|
} else if (use_input_file) {
|
||||||
|
if (optind != (argc - 1)) {
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
||||||
@ -0,0 +1,674 @@
|
|||||||
|
From e748832819b781507903838483376d308c90ca79 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 16 Nov 2021 14:27:11 +0100
|
||||||
|
Subject: [PATCH] semodule: add -m | --checksum option
|
||||||
|
|
||||||
|
Since cil doesn't store module name and module version in module itself,
|
||||||
|
there's no simple way how to compare that installed module is the same
|
||||||
|
version as the module which is supposed to be installed. Even though the
|
||||||
|
version was not used by semodule itself, it was apparently used by some
|
||||||
|
team.
|
||||||
|
|
||||||
|
With `semodule -l --checksum` users get SHA256 hashes of modules and
|
||||||
|
could compare them with their files which is faster than installing
|
||||||
|
modules again and again.
|
||||||
|
|
||||||
|
E.g.
|
||||||
|
|
||||||
|
# time (
|
||||||
|
semodule -l --checksum | grep localmodule
|
||||||
|
/usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
|
||||||
|
)
|
||||||
|
localmodule db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd
|
||||||
|
db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd -
|
||||||
|
|
||||||
|
real 0m0.876s
|
||||||
|
user 0m0.849s
|
||||||
|
sys 0m0.028s
|
||||||
|
|
||||||
|
vs
|
||||||
|
|
||||||
|
# time semodule -i localmodule.pp
|
||||||
|
|
||||||
|
real 0m6.147s
|
||||||
|
user 0m5.800s
|
||||||
|
sys 0m0.231s
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/Makefile | 2 +-
|
||||||
|
policycoreutils/semodule/semodule.8 | 6 +
|
||||||
|
policycoreutils/semodule/semodule.c | 95 ++++++++-
|
||||||
|
policycoreutils/semodule/sha256.c | 294 ++++++++++++++++++++++++++++
|
||||||
|
policycoreutils/semodule/sha256.h | 89 +++++++++
|
||||||
|
5 files changed, 480 insertions(+), 6 deletions(-)
|
||||||
|
create mode 100644 policycoreutils/semodule/sha256.c
|
||||||
|
create mode 100644 policycoreutils/semodule/sha256.h
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
|
||||||
|
index 73801e487a76..9875ac383280 100644
|
||||||
|
--- a/policycoreutils/semodule/Makefile
|
||||||
|
+++ b/policycoreutils/semodule/Makefile
|
||||||
|
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
|
||||||
|
|
||||||
|
CFLAGS ?= -Werror -Wall -W
|
||||||
|
override LDLIBS += -lsepol -lselinux -lsemanage
|
||||||
|
-SEMODULE_OBJS = semodule.o
|
||||||
|
+SEMODULE_OBJS = semodule.o sha256.o
|
||||||
|
|
||||||
|
all: semodule genhomedircon
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||||
|
index 18d4f708661c..3a2fb21c2481 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.8
|
||||||
|
+++ b/policycoreutils/semodule/semodule.8
|
||||||
|
@@ -95,6 +95,9 @@ only modules listed in \-\-extract after this option.
|
||||||
|
.B \-H,\-\-hll
|
||||||
|
Extract module as an HLL file. This only affects the \-\-extract option and
|
||||||
|
only modules listed in \-\-extract after this option.
|
||||||
|
+.TP
|
||||||
|
+.B \-m,\-\-checksum
|
||||||
|
+Add SHA256 checksum of modules to the list output.
|
||||||
|
|
||||||
|
.SH EXAMPLE
|
||||||
|
.nf
|
||||||
|
@@ -130,6 +133,9 @@ $ semodule \-B \-S "/tmp/var/lib/selinux"
|
||||||
|
# Write the HLL version of puppet and the CIL version of wireshark
|
||||||
|
# modules at priority 400 to the current working directory
|
||||||
|
$ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark
|
||||||
|
+# Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
|
||||||
|
+$ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
|
||||||
|
+$ semodule -l -m | grep localmodule
|
||||||
|
.fi
|
||||||
|
|
||||||
|
.SH SEE ALSO
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index a76797f505cd..300a97d735cc 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -24,6 +24,8 @@
|
||||||
|
|
||||||
|
#include <semanage/modules.h>
|
||||||
|
|
||||||
|
+#include "sha256.h"
|
||||||
|
+
|
||||||
|
enum client_modes {
|
||||||
|
NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
|
||||||
|
LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
|
||||||
|
@@ -56,6 +58,7 @@ static semanage_handle_t *sh = NULL;
|
||||||
|
static char *store;
|
||||||
|
static char *store_root;
|
||||||
|
int extract_cil = 0;
|
||||||
|
+static int checksum = 0;
|
||||||
|
|
||||||
|
extern char *optarg;
|
||||||
|
extern int optind;
|
||||||
|
@@ -146,6 +149,7 @@ static void usage(char *progname)
|
||||||
|
printf(" -S,--store-path use an alternate path for the policy store root\n");
|
||||||
|
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||||
|
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||||
|
+ printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Sets the global mode variable to new_mode, but only if no other
|
||||||
|
@@ -199,6 +203,7 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
{"disable", required_argument, NULL, 'd'},
|
||||||
|
{"path", required_argument, NULL, 'p'},
|
||||||
|
{"store-path", required_argument, NULL, 'S'},
|
||||||
|
+ {"checksum", 0, NULL, 'm'},
|
||||||
|
{NULL, 0, NULL, 0}
|
||||||
|
};
|
||||||
|
int extract_selected = 0;
|
||||||
|
@@ -209,7 +214,7 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
no_reload = 0;
|
||||||
|
priority = 400;
|
||||||
|
while ((i =
|
||||||
|
- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cH", opts,
|
||||||
|
+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
|
||||||
|
NULL)) != -1) {
|
||||||
|
switch (i) {
|
||||||
|
case 'b':
|
||||||
|
@@ -286,6 +291,9 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
case 'd':
|
||||||
|
set_mode(DISABLE_M, optarg);
|
||||||
|
break;
|
||||||
|
+ case 'm':
|
||||||
|
+ checksum = 1;
|
||||||
|
+ break;
|
||||||
|
case '?':
|
||||||
|
default:{
|
||||||
|
usage(argv[0]);
|
||||||
|
@@ -337,6 +345,61 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* Get module checksum */
|
||||||
|
+static char *hash_module_data(const char *module_name, const int prio) {
|
||||||
|
+ semanage_module_info_t *extract_info = NULL;
|
||||||
|
+ semanage_module_key_t *modkey = NULL;
|
||||||
|
+ Sha256Context context;
|
||||||
|
+ uint8_t sha256_hash[SHA256_HASH_SIZE];
|
||||||
|
+ char *sha256_buf = NULL;
|
||||||
|
+ void *data;
|
||||||
|
+ size_t data_len = 0, i;
|
||||||
|
+ int result;
|
||||||
|
+
|
||||||
|
+ result = semanage_module_key_create(sh, &modkey);
|
||||||
|
+ if (result != 0) {
|
||||||
|
+ goto cleanup_extract;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ result = semanage_module_key_set_name(sh, modkey, module_name);
|
||||||
|
+ if (result != 0) {
|
||||||
|
+ goto cleanup_extract;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ result = semanage_module_key_set_priority(sh, modkey, prio);
|
||||||
|
+ if (result != 0) {
|
||||||
|
+ goto cleanup_extract;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
|
||||||
|
+ &extract_info);
|
||||||
|
+ if (result != 0) {
|
||||||
|
+ goto cleanup_extract;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ Sha256Initialise(&context);
|
||||||
|
+ Sha256Update(&context, data, data_len);
|
||||||
|
+
|
||||||
|
+ Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
|
||||||
|
+
|
||||||
|
+ sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
|
||||||
|
+
|
||||||
|
+ if (sha256_buf == NULL)
|
||||||
|
+ goto cleanup_extract;
|
||||||
|
+
|
||||||
|
+ for (i = 0; i < SHA256_HASH_SIZE; i++) {
|
||||||
|
+ sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
|
||||||
|
+ }
|
||||||
|
+ sha256_buf[i * 2] = 0;
|
||||||
|
+
|
||||||
|
+cleanup_extract:
|
||||||
|
+ semanage_module_info_destroy(sh, extract_info);
|
||||||
|
+ free(extract_info);
|
||||||
|
+ semanage_module_key_destroy(sh, modkey);
|
||||||
|
+ free(modkey);
|
||||||
|
+ return sha256_buf;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
{
|
||||||
|
int i, commit = 0;
|
||||||
|
@@ -544,6 +607,8 @@ cleanup_extract:
|
||||||
|
int modinfos_len = 0;
|
||||||
|
semanage_module_info_t *m = NULL;
|
||||||
|
int j = 0;
|
||||||
|
+ char *module_checksum = NULL;
|
||||||
|
+ uint16_t pri = 0;
|
||||||
|
|
||||||
|
if (verbose) {
|
||||||
|
printf
|
||||||
|
@@ -568,7 +633,18 @@ cleanup_extract:
|
||||||
|
result = semanage_module_info_get_name(sh, m, &name);
|
||||||
|
if (result != 0) goto cleanup_list;
|
||||||
|
|
||||||
|
- printf("%s\n", name);
|
||||||
|
+ result = semanage_module_info_get_priority(sh, m, &pri);
|
||||||
|
+ if (result != 0) goto cleanup_list;
|
||||||
|
+
|
||||||
|
+ printf("%s", name);
|
||||||
|
+ if (checksum) {
|
||||||
|
+ module_checksum = hash_module_data(name, pri);
|
||||||
|
+ if (module_checksum) {
|
||||||
|
+ printf(" %s", module_checksum);
|
||||||
|
+ free(module_checksum);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ printf("\n");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if (strcmp(mode_arg, "full") == 0) {
|
||||||
|
@@ -583,11 +659,12 @@ cleanup_extract:
|
||||||
|
}
|
||||||
|
|
||||||
|
/* calculate column widths */
|
||||||
|
- size_t column[4] = { 0, 0, 0, 0 };
|
||||||
|
+ size_t column[5] = { 0, 0, 0, 0, 0 };
|
||||||
|
|
||||||
|
/* fixed width columns */
|
||||||
|
column[0] = sizeof("000") - 1;
|
||||||
|
column[3] = sizeof("disabled") - 1;
|
||||||
|
+ column[4] = 64; /* SHA256_HASH_SIZE * 2 */
|
||||||
|
|
||||||
|
/* variable width columns */
|
||||||
|
const char *tmp = NULL;
|
||||||
|
@@ -610,7 +687,6 @@ cleanup_extract:
|
||||||
|
|
||||||
|
/* print out each module */
|
||||||
|
for (j = 0; j < modinfos_len; j++) {
|
||||||
|
- uint16_t pri = 0;
|
||||||
|
const char *name = NULL;
|
||||||
|
int enabled = 0;
|
||||||
|
const char *lang_ext = NULL;
|
||||||
|
@@ -629,11 +705,20 @@ cleanup_extract:
|
||||||
|
result = semanage_module_info_get_lang_ext(sh, m, &lang_ext);
|
||||||
|
if (result != 0) goto cleanup_list;
|
||||||
|
|
||||||
|
- printf("%0*u %-*s %-*s %-*s\n",
|
||||||
|
+ printf("%0*u %-*s %-*s %-*s",
|
||||||
|
(int)column[0], pri,
|
||||||
|
(int)column[1], name,
|
||||||
|
(int)column[2], lang_ext,
|
||||||
|
(int)column[3], enabled ? "" : "disabled");
|
||||||
|
+ if (checksum) {
|
||||||
|
+ module_checksum = hash_module_data(name, pri);
|
||||||
|
+ if (module_checksum) {
|
||||||
|
+ printf(" %-*s", (int)column[4], module_checksum);
|
||||||
|
+ free(module_checksum);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ printf("\n");
|
||||||
|
+
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
|
||||||
|
new file mode 100644
|
||||||
|
index 000000000000..fe2aeef07f53
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/policycoreutils/semodule/sha256.c
|
||||||
|
@@ -0,0 +1,294 @@
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// WjCryptLib_Sha256
|
||||||
|
+//
|
||||||
|
+// Implementation of SHA256 hash function.
|
||||||
|
+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||||
|
+// Modified by WaterJuice retaining Public Domain license.
|
||||||
|
+//
|
||||||
|
+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// IMPORTS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+#include "sha256.h"
|
||||||
|
+#include <memory.h>
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// MACROS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
|
||||||
|
+
|
||||||
|
+#define MIN(x, y) ( ((x)<(y))?(x):(y) )
|
||||||
|
+
|
||||||
|
+#define STORE32H(x, y) \
|
||||||
|
+ { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \
|
||||||
|
+ (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
|
||||||
|
+
|
||||||
|
+#define LOAD32H(x, y) \
|
||||||
|
+ { x = ((uint32_t)((y)[0] & 255)<<24) | \
|
||||||
|
+ ((uint32_t)((y)[1] & 255)<<16) | \
|
||||||
|
+ ((uint32_t)((y)[2] & 255)<<8) | \
|
||||||
|
+ ((uint32_t)((y)[3] & 255)); }
|
||||||
|
+
|
||||||
|
+#define STORE64H(x, y) \
|
||||||
|
+ { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \
|
||||||
|
+ (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \
|
||||||
|
+ (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \
|
||||||
|
+ (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// CONSTANTS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+// The K array
|
||||||
|
+static const uint32_t K[64] = {
|
||||||
|
+ 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
|
||||||
|
+ 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
|
||||||
|
+ 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
|
||||||
|
+ 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
|
||||||
|
+ 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
|
||||||
|
+ 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
|
||||||
|
+ 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
|
||||||
|
+ 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
|
||||||
|
+ 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
|
||||||
|
+ 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
|
||||||
|
+ 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
|
||||||
|
+ 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
|
||||||
|
+ 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+#define BLOCK_SIZE 64
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// INTERNAL FUNCTIONS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+// Various logical functions
|
||||||
|
+#define Ch( x, y, z ) (z ^ (x & (y ^ z)))
|
||||||
|
+#define Maj( x, y, z ) (((x | y) & z) | (x & y))
|
||||||
|
+#define S( x, n ) ror((x),(n))
|
||||||
|
+#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n))
|
||||||
|
+#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
||||||
|
+#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
||||||
|
+#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
||||||
|
+#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
||||||
|
+
|
||||||
|
+#define Sha256Round( a, b, c, d, e, f, g, h, i ) \
|
||||||
|
+ t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
|
||||||
|
+ t1 = Sigma0(a) + Maj(a, b, c); \
|
||||||
|
+ d += t0; \
|
||||||
|
+ h = t0 + t1;
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// TransformFunction
|
||||||
|
+//
|
||||||
|
+// Compress 512-bits
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+static
|
||||||
|
+void
|
||||||
|
+ TransformFunction
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context,
|
||||||
|
+ uint8_t const* Buffer
|
||||||
|
+ )
|
||||||
|
+{
|
||||||
|
+ uint32_t S[8];
|
||||||
|
+ uint32_t W[64];
|
||||||
|
+ uint32_t t0;
|
||||||
|
+ uint32_t t1;
|
||||||
|
+ uint32_t t;
|
||||||
|
+ int i;
|
||||||
|
+
|
||||||
|
+ // Copy state into S
|
||||||
|
+ for( i=0; i<8; i++ )
|
||||||
|
+ {
|
||||||
|
+ S[i] = Context->state[i];
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Copy the state into 512-bits into W[0..15]
|
||||||
|
+ for( i=0; i<16; i++ )
|
||||||
|
+ {
|
||||||
|
+ LOAD32H( W[i], Buffer + (4*i) );
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Fill W[16..63]
|
||||||
|
+ for( i=16; i<64; i++ )
|
||||||
|
+ {
|
||||||
|
+ W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Compress
|
||||||
|
+ for( i=0; i<64; i++ )
|
||||||
|
+ {
|
||||||
|
+ Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
|
||||||
|
+ t = S[7];
|
||||||
|
+ S[7] = S[6];
|
||||||
|
+ S[6] = S[5];
|
||||||
|
+ S[5] = S[4];
|
||||||
|
+ S[4] = S[3];
|
||||||
|
+ S[3] = S[2];
|
||||||
|
+ S[2] = S[1];
|
||||||
|
+ S[1] = S[0];
|
||||||
|
+ S[0] = t;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Feedback
|
||||||
|
+ for( i=0; i<8; i++ )
|
||||||
|
+ {
|
||||||
|
+ Context->state[i] = Context->state[i] + S[i];
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// PUBLIC FUNCTIONS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Initialise
|
||||||
|
+//
|
||||||
|
+// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Initialise
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context // [out]
|
||||||
|
+ )
|
||||||
|
+{
|
||||||
|
+ Context->curlen = 0;
|
||||||
|
+ Context->length = 0;
|
||||||
|
+ Context->state[0] = 0x6A09E667UL;
|
||||||
|
+ Context->state[1] = 0xBB67AE85UL;
|
||||||
|
+ Context->state[2] = 0x3C6EF372UL;
|
||||||
|
+ Context->state[3] = 0xA54FF53AUL;
|
||||||
|
+ Context->state[4] = 0x510E527FUL;
|
||||||
|
+ Context->state[5] = 0x9B05688CUL;
|
||||||
|
+ Context->state[6] = 0x1F83D9ABUL;
|
||||||
|
+ Context->state[7] = 0x5BE0CD19UL;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Update
|
||||||
|
+//
|
||||||
|
+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||||
|
+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Update
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context, // [in out]
|
||||||
|
+ void const* Buffer, // [in]
|
||||||
|
+ uint32_t BufferSize // [in]
|
||||||
|
+ )
|
||||||
|
+{
|
||||||
|
+ uint32_t n;
|
||||||
|
+
|
||||||
|
+ if( Context->curlen > sizeof(Context->buf) )
|
||||||
|
+ {
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ while( BufferSize > 0 )
|
||||||
|
+ {
|
||||||
|
+ if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
|
||||||
|
+ {
|
||||||
|
+ TransformFunction( Context, (uint8_t*)Buffer );
|
||||||
|
+ Context->length += BLOCK_SIZE * 8;
|
||||||
|
+ Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
|
||||||
|
+ BufferSize -= BLOCK_SIZE;
|
||||||
|
+ }
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
|
||||||
|
+ memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
|
||||||
|
+ Context->curlen += n;
|
||||||
|
+ Buffer = (uint8_t*)Buffer + n;
|
||||||
|
+ BufferSize -= n;
|
||||||
|
+ if( Context->curlen == BLOCK_SIZE )
|
||||||
|
+ {
|
||||||
|
+ TransformFunction( Context, Context->buf );
|
||||||
|
+ Context->length += 8*BLOCK_SIZE;
|
||||||
|
+ Context->curlen = 0;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Finalise
|
||||||
|
+//
|
||||||
|
+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||||
|
+// calling this, Sha256Initialised must be used to reuse the context.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Finalise
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context, // [in out]
|
||||||
|
+ SHA256_HASH* Digest // [out]
|
||||||
|
+ )
|
||||||
|
+{
|
||||||
|
+ int i;
|
||||||
|
+
|
||||||
|
+ if( Context->curlen >= sizeof(Context->buf) )
|
||||||
|
+ {
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Increase the length of the message
|
||||||
|
+ Context->length += Context->curlen * 8;
|
||||||
|
+
|
||||||
|
+ // Append the '1' bit
|
||||||
|
+ Context->buf[Context->curlen++] = (uint8_t)0x80;
|
||||||
|
+
|
||||||
|
+ // if the length is currently above 56 bytes we append zeros
|
||||||
|
+ // then compress. Then we can fall back to padding zeros and length
|
||||||
|
+ // encoding like normal.
|
||||||
|
+ if( Context->curlen > 56 )
|
||||||
|
+ {
|
||||||
|
+ while( Context->curlen < 64 )
|
||||||
|
+ {
|
||||||
|
+ Context->buf[Context->curlen++] = (uint8_t)0;
|
||||||
|
+ }
|
||||||
|
+ TransformFunction(Context, Context->buf);
|
||||||
|
+ Context->curlen = 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Pad up to 56 bytes of zeroes
|
||||||
|
+ while( Context->curlen < 56 )
|
||||||
|
+ {
|
||||||
|
+ Context->buf[Context->curlen++] = (uint8_t)0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ // Store length
|
||||||
|
+ STORE64H( Context->length, Context->buf+56 );
|
||||||
|
+ TransformFunction( Context, Context->buf );
|
||||||
|
+
|
||||||
|
+ // Copy output
|
||||||
|
+ for( i=0; i<8; i++ )
|
||||||
|
+ {
|
||||||
|
+ STORE32H( Context->state[i], Digest->bytes+(4*i) );
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Calculate
|
||||||
|
+//
|
||||||
|
+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||||
|
+// buffer.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Calculate
|
||||||
|
+ (
|
||||||
|
+ void const* Buffer, // [in]
|
||||||
|
+ uint32_t BufferSize, // [in]
|
||||||
|
+ SHA256_HASH* Digest // [in]
|
||||||
|
+ )
|
||||||
|
+{
|
||||||
|
+ Sha256Context context;
|
||||||
|
+
|
||||||
|
+ Sha256Initialise( &context );
|
||||||
|
+ Sha256Update( &context, Buffer, BufferSize );
|
||||||
|
+ Sha256Finalise( &context, Digest );
|
||||||
|
+}
|
||||||
|
diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
|
||||||
|
new file mode 100644
|
||||||
|
index 000000000000..406ed869cd82
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/policycoreutils/semodule/sha256.h
|
||||||
|
@@ -0,0 +1,89 @@
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// WjCryptLib_Sha256
|
||||||
|
+//
|
||||||
|
+// Implementation of SHA256 hash function.
|
||||||
|
+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||||
|
+// Modified by WaterJuice retaining Public Domain license.
|
||||||
|
+//
|
||||||
|
+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+#pragma once
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// IMPORTS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+#include <stdint.h>
|
||||||
|
+#include <stdio.h>
|
||||||
|
+
|
||||||
|
+typedef struct
|
||||||
|
+{
|
||||||
|
+ uint64_t length;
|
||||||
|
+ uint32_t state[8];
|
||||||
|
+ uint32_t curlen;
|
||||||
|
+ uint8_t buf[64];
|
||||||
|
+} Sha256Context;
|
||||||
|
+
|
||||||
|
+#define SHA256_HASH_SIZE ( 256 / 8 )
|
||||||
|
+
|
||||||
|
+typedef struct
|
||||||
|
+{
|
||||||
|
+ uint8_t bytes [SHA256_HASH_SIZE];
|
||||||
|
+} SHA256_HASH;
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// PUBLIC FUNCTIONS
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Initialise
|
||||||
|
+//
|
||||||
|
+// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Initialise
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context // [out]
|
||||||
|
+ );
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Update
|
||||||
|
+//
|
||||||
|
+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||||
|
+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Update
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context, // [in out]
|
||||||
|
+ void const* Buffer, // [in]
|
||||||
|
+ uint32_t BufferSize // [in]
|
||||||
|
+ );
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Finalise
|
||||||
|
+//
|
||||||
|
+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||||
|
+// calling this, Sha256Initialised must be used to reuse the context.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Finalise
|
||||||
|
+ (
|
||||||
|
+ Sha256Context* Context, // [in out]
|
||||||
|
+ SHA256_HASH* Digest // [out]
|
||||||
|
+ );
|
||||||
|
+
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+// Sha256Calculate
|
||||||
|
+//
|
||||||
|
+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||||
|
+// buffer.
|
||||||
|
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
+void
|
||||||
|
+ Sha256Calculate
|
||||||
|
+ (
|
||||||
|
+ void const* Buffer, // [in]
|
||||||
|
+ uint32_t BufferSize, // [in]
|
||||||
|
+ SHA256_HASH* Digest // [in]
|
||||||
|
+ );
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
From 14084bad4f5bcfdb769ba39c9a6f12e4787ab909 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 16 Nov 2021 16:11:22 +0100
|
||||||
|
Subject: [PATCH] semodule: Fix lang_ext column index
|
||||||
|
|
||||||
|
lang_ext is 3. column - index number 2.
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/semodule.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index 300a97d735cc..c677cc4f1d81 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -682,7 +682,7 @@ cleanup_extract:
|
||||||
|
if (result != 0) goto cleanup_list;
|
||||||
|
|
||||||
|
size = strlen(tmp);
|
||||||
|
- if (size > column[3]) column[3] = size;
|
||||||
|
+ if (size > column[2]) column[2] = size;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* print out each module */
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
From 61f05b6d26063e1ebdc06609c29a067d44579b41 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Tue, 23 Nov 2021 17:38:51 +0100
|
||||||
|
Subject: [PATCH] semodule: Don't forget to munmap() data
|
||||||
|
|
||||||
|
semanage_module_extract() mmap()'s the module raw data but it leaves on
|
||||||
|
the caller to munmap() them.
|
||||||
|
|
||||||
|
Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/semodule.c | 3 +++
|
||||||
|
1 file changed, 3 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index c677cc4f1d81..dc227058b073 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -393,6 +393,9 @@ static char *hash_module_data(const char *module_name, const int prio) {
|
||||||
|
sha256_buf[i * 2] = 0;
|
||||||
|
|
||||||
|
cleanup_extract:
|
||||||
|
+ if (data_len > 0) {
|
||||||
|
+ munmap(data, data_len);
|
||||||
|
+ }
|
||||||
|
semanage_module_info_destroy(sh, extract_info);
|
||||||
|
free(extract_info);
|
||||||
|
semanage_module_key_destroy(sh, modkey);
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -0,0 +1,41 @@
|
|||||||
|
From 69da6239d8505a9d6ca547187f71a351df17f157 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Mon, 10 Jan 2022 18:35:27 +0100
|
||||||
|
Subject: [PATCH] policycoreutils: Improve error message when selabel_open
|
||||||
|
fails
|
||||||
|
|
||||||
|
When selabel_open fails to locate file_context files and
|
||||||
|
selabel_opt_path is not specified (e.g. when the policy type is
|
||||||
|
missconfigured in /etc/selinux/config), perror only prints
|
||||||
|
"No such file or directory".
|
||||||
|
This can be confusing in case of "restorecon" since it's
|
||||||
|
not apparent that the issue is in policy store.
|
||||||
|
|
||||||
|
Before:
|
||||||
|
\# restorecon -v /tmp/foo.txt
|
||||||
|
No such file or directory
|
||||||
|
After:
|
||||||
|
\# restorecon -v /tmp/foo.txt
|
||||||
|
/etc/selinux/yolo/contexts/files/file_contexts: No such file or directory
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/setfiles/restore.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
|
||||||
|
index d3335d1a..ba2668b3 100644
|
||||||
|
--- a/policycoreutils/setfiles/restore.c
|
||||||
|
+++ b/policycoreutils/setfiles/restore.c
|
||||||
|
@@ -29,7 +29,7 @@ void restore_init(struct restore_opts *opts)
|
||||||
|
|
||||||
|
opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
|
||||||
|
if (!opts->hnd) {
|
||||||
|
- perror(opts->selabel_opt_path);
|
||||||
|
+ perror(opts->selabel_opt_path ? opts->selabel_opt_path : selinux_file_context_path());
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
||||||
@ -0,0 +1,539 @@
|
|||||||
|
From 066007029b3dd250305d7fac0bfd53aa1e4543cf Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
Date: Thu, 3 Feb 2022 17:53:23 +0100
|
||||||
|
Subject: [PATCH] semodule,libsemanage: move module hashing into libsemanage
|
||||||
|
|
||||||
|
The main goal of this move is to have the SHA-256 implementation under
|
||||||
|
libsemanage, since upcoming patches will make use of SHA-256 for a
|
||||||
|
different (but similar) purpose in libsemanage. Having the hashing code
|
||||||
|
in libsemanage will reduce code duplication and allow for easier hash
|
||||||
|
algorithm upgrade in the future.
|
||||||
|
|
||||||
|
Note that libselinux currently also contains a hash function
|
||||||
|
implementation (for yet another different purpose). This patch doesn't
|
||||||
|
make any effort to address that duplicity yet.
|
||||||
|
|
||||||
|
This patch also changes the format of the hash string printed by
|
||||||
|
semodule to include the name of the hash. The intent is to avoid
|
||||||
|
ambiguity and potential collisions when the algorithm is potentially
|
||||||
|
changed in the future.
|
||||||
|
|
||||||
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/Makefile | 2 +-
|
||||||
|
policycoreutils/semodule/semodule.c | 53 ++---
|
||||||
|
policycoreutils/semodule/sha256.c | 294 ----------------------------
|
||||||
|
policycoreutils/semodule/sha256.h | 89 ---------
|
||||||
|
4 files changed, 17 insertions(+), 421 deletions(-)
|
||||||
|
delete mode 100644 policycoreutils/semodule/sha256.c
|
||||||
|
delete mode 100644 policycoreutils/semodule/sha256.h
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
|
||||||
|
index 9875ac38..73801e48 100644
|
||||||
|
--- a/policycoreutils/semodule/Makefile
|
||||||
|
+++ b/policycoreutils/semodule/Makefile
|
||||||
|
@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
|
||||||
|
|
||||||
|
CFLAGS ?= -Werror -Wall -W
|
||||||
|
override LDLIBS += -lsepol -lselinux -lsemanage
|
||||||
|
-SEMODULE_OBJS = semodule.o sha256.o
|
||||||
|
+SEMODULE_OBJS = semodule.o
|
||||||
|
|
||||||
|
all: semodule genhomedircon
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index dc227058..243b1add 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -24,8 +24,6 @@
|
||||||
|
|
||||||
|
#include <semanage/modules.h>
|
||||||
|
|
||||||
|
-#include "sha256.h"
|
||||||
|
-
|
||||||
|
enum client_modes {
|
||||||
|
NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
|
||||||
|
LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
|
||||||
|
@@ -347,60 +345,38 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
|
||||||
|
/* Get module checksum */
|
||||||
|
static char *hash_module_data(const char *module_name, const int prio) {
|
||||||
|
- semanage_module_info_t *extract_info = NULL;
|
||||||
|
semanage_module_key_t *modkey = NULL;
|
||||||
|
- Sha256Context context;
|
||||||
|
- uint8_t sha256_hash[SHA256_HASH_SIZE];
|
||||||
|
- char *sha256_buf = NULL;
|
||||||
|
- void *data;
|
||||||
|
- size_t data_len = 0, i;
|
||||||
|
+ char *hash_str = NULL;
|
||||||
|
+ void *hash = NULL;
|
||||||
|
+ size_t hash_len = 0;
|
||||||
|
int result;
|
||||||
|
|
||||||
|
result = semanage_module_key_create(sh, &modkey);
|
||||||
|
if (result != 0) {
|
||||||
|
- goto cleanup_extract;
|
||||||
|
+ goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = semanage_module_key_set_name(sh, modkey, module_name);
|
||||||
|
if (result != 0) {
|
||||||
|
- goto cleanup_extract;
|
||||||
|
+ goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
result = semanage_module_key_set_priority(sh, modkey, prio);
|
||||||
|
if (result != 0) {
|
||||||
|
- goto cleanup_extract;
|
||||||
|
+ goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
- result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
|
||||||
|
- &extract_info);
|
||||||
|
+ result = semanage_module_compute_checksum(sh, modkey, 1, &hash_str,
|
||||||
|
+ &hash_len);
|
||||||
|
if (result != 0) {
|
||||||
|
- goto cleanup_extract;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- Sha256Initialise(&context);
|
||||||
|
- Sha256Update(&context, data, data_len);
|
||||||
|
-
|
||||||
|
- Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
|
||||||
|
-
|
||||||
|
- sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
|
||||||
|
-
|
||||||
|
- if (sha256_buf == NULL)
|
||||||
|
- goto cleanup_extract;
|
||||||
|
-
|
||||||
|
- for (i = 0; i < SHA256_HASH_SIZE; i++) {
|
||||||
|
- sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
|
||||||
|
+ goto cleanup;
|
||||||
|
}
|
||||||
|
- sha256_buf[i * 2] = 0;
|
||||||
|
|
||||||
|
-cleanup_extract:
|
||||||
|
- if (data_len > 0) {
|
||||||
|
- munmap(data, data_len);
|
||||||
|
- }
|
||||||
|
- semanage_module_info_destroy(sh, extract_info);
|
||||||
|
- free(extract_info);
|
||||||
|
+cleanup:
|
||||||
|
+ free(hash);
|
||||||
|
semanage_module_key_destroy(sh, modkey);
|
||||||
|
free(modkey);
|
||||||
|
- return sha256_buf;
|
||||||
|
+ return hash_str;
|
||||||
|
}
|
||||||
|
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
@@ -667,7 +643,10 @@ cleanup_extract:
|
||||||
|
/* fixed width columns */
|
||||||
|
column[0] = sizeof("000") - 1;
|
||||||
|
column[3] = sizeof("disabled") - 1;
|
||||||
|
- column[4] = 64; /* SHA256_HASH_SIZE * 2 */
|
||||||
|
+
|
||||||
|
+ result = semanage_module_compute_checksum(sh, NULL, 0, NULL,
|
||||||
|
+ &column[4]);
|
||||||
|
+ if (result != 0) goto cleanup_list;
|
||||||
|
|
||||||
|
/* variable width columns */
|
||||||
|
const char *tmp = NULL;
|
||||||
|
diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
|
||||||
|
deleted file mode 100644
|
||||||
|
index fe2aeef0..00000000
|
||||||
|
--- a/policycoreutils/semodule/sha256.c
|
||||||
|
+++ /dev/null
|
||||||
|
@@ -1,294 +0,0 @@
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// WjCryptLib_Sha256
|
||||||
|
-//
|
||||||
|
-// Implementation of SHA256 hash function.
|
||||||
|
-// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||||
|
-// Modified by WaterJuice retaining Public Domain license.
|
||||||
|
-//
|
||||||
|
-// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// IMPORTS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-#include "sha256.h"
|
||||||
|
-#include <memory.h>
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// MACROS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
|
||||||
|
-
|
||||||
|
-#define MIN(x, y) ( ((x)<(y))?(x):(y) )
|
||||||
|
-
|
||||||
|
-#define STORE32H(x, y) \
|
||||||
|
- { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \
|
||||||
|
- (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
|
||||||
|
-
|
||||||
|
-#define LOAD32H(x, y) \
|
||||||
|
- { x = ((uint32_t)((y)[0] & 255)<<24) | \
|
||||||
|
- ((uint32_t)((y)[1] & 255)<<16) | \
|
||||||
|
- ((uint32_t)((y)[2] & 255)<<8) | \
|
||||||
|
- ((uint32_t)((y)[3] & 255)); }
|
||||||
|
-
|
||||||
|
-#define STORE64H(x, y) \
|
||||||
|
- { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \
|
||||||
|
- (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \
|
||||||
|
- (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \
|
||||||
|
- (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// CONSTANTS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-// The K array
|
||||||
|
-static const uint32_t K[64] = {
|
||||||
|
- 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
|
||||||
|
- 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
|
||||||
|
- 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
|
||||||
|
- 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
|
||||||
|
- 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
|
||||||
|
- 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
|
||||||
|
- 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
|
||||||
|
- 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
|
||||||
|
- 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
|
||||||
|
- 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
|
||||||
|
- 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
|
||||||
|
- 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
|
||||||
|
- 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
|
||||||
|
-};
|
||||||
|
-
|
||||||
|
-#define BLOCK_SIZE 64
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// INTERNAL FUNCTIONS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-// Various logical functions
|
||||||
|
-#define Ch( x, y, z ) (z ^ (x & (y ^ z)))
|
||||||
|
-#define Maj( x, y, z ) (((x | y) & z) | (x & y))
|
||||||
|
-#define S( x, n ) ror((x),(n))
|
||||||
|
-#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n))
|
||||||
|
-#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
||||||
|
-#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
||||||
|
-#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
||||||
|
-#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
||||||
|
-
|
||||||
|
-#define Sha256Round( a, b, c, d, e, f, g, h, i ) \
|
||||||
|
- t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
|
||||||
|
- t1 = Sigma0(a) + Maj(a, b, c); \
|
||||||
|
- d += t0; \
|
||||||
|
- h = t0 + t1;
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// TransformFunction
|
||||||
|
-//
|
||||||
|
-// Compress 512-bits
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-static
|
||||||
|
-void
|
||||||
|
- TransformFunction
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context,
|
||||||
|
- uint8_t const* Buffer
|
||||||
|
- )
|
||||||
|
-{
|
||||||
|
- uint32_t S[8];
|
||||||
|
- uint32_t W[64];
|
||||||
|
- uint32_t t0;
|
||||||
|
- uint32_t t1;
|
||||||
|
- uint32_t t;
|
||||||
|
- int i;
|
||||||
|
-
|
||||||
|
- // Copy state into S
|
||||||
|
- for( i=0; i<8; i++ )
|
||||||
|
- {
|
||||||
|
- S[i] = Context->state[i];
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Copy the state into 512-bits into W[0..15]
|
||||||
|
- for( i=0; i<16; i++ )
|
||||||
|
- {
|
||||||
|
- LOAD32H( W[i], Buffer + (4*i) );
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Fill W[16..63]
|
||||||
|
- for( i=16; i<64; i++ )
|
||||||
|
- {
|
||||||
|
- W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Compress
|
||||||
|
- for( i=0; i<64; i++ )
|
||||||
|
- {
|
||||||
|
- Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
|
||||||
|
- t = S[7];
|
||||||
|
- S[7] = S[6];
|
||||||
|
- S[6] = S[5];
|
||||||
|
- S[5] = S[4];
|
||||||
|
- S[4] = S[3];
|
||||||
|
- S[3] = S[2];
|
||||||
|
- S[2] = S[1];
|
||||||
|
- S[1] = S[0];
|
||||||
|
- S[0] = t;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Feedback
|
||||||
|
- for( i=0; i<8; i++ )
|
||||||
|
- {
|
||||||
|
- Context->state[i] = Context->state[i] + S[i];
|
||||||
|
- }
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// PUBLIC FUNCTIONS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Initialise
|
||||||
|
-//
|
||||||
|
-// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Initialise
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context // [out]
|
||||||
|
- )
|
||||||
|
-{
|
||||||
|
- Context->curlen = 0;
|
||||||
|
- Context->length = 0;
|
||||||
|
- Context->state[0] = 0x6A09E667UL;
|
||||||
|
- Context->state[1] = 0xBB67AE85UL;
|
||||||
|
- Context->state[2] = 0x3C6EF372UL;
|
||||||
|
- Context->state[3] = 0xA54FF53AUL;
|
||||||
|
- Context->state[4] = 0x510E527FUL;
|
||||||
|
- Context->state[5] = 0x9B05688CUL;
|
||||||
|
- Context->state[6] = 0x1F83D9ABUL;
|
||||||
|
- Context->state[7] = 0x5BE0CD19UL;
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Update
|
||||||
|
-//
|
||||||
|
-// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||||
|
-// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Update
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context, // [in out]
|
||||||
|
- void const* Buffer, // [in]
|
||||||
|
- uint32_t BufferSize // [in]
|
||||||
|
- )
|
||||||
|
-{
|
||||||
|
- uint32_t n;
|
||||||
|
-
|
||||||
|
- if( Context->curlen > sizeof(Context->buf) )
|
||||||
|
- {
|
||||||
|
- return;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- while( BufferSize > 0 )
|
||||||
|
- {
|
||||||
|
- if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
|
||||||
|
- {
|
||||||
|
- TransformFunction( Context, (uint8_t*)Buffer );
|
||||||
|
- Context->length += BLOCK_SIZE * 8;
|
||||||
|
- Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
|
||||||
|
- BufferSize -= BLOCK_SIZE;
|
||||||
|
- }
|
||||||
|
- else
|
||||||
|
- {
|
||||||
|
- n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
|
||||||
|
- memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
|
||||||
|
- Context->curlen += n;
|
||||||
|
- Buffer = (uint8_t*)Buffer + n;
|
||||||
|
- BufferSize -= n;
|
||||||
|
- if( Context->curlen == BLOCK_SIZE )
|
||||||
|
- {
|
||||||
|
- TransformFunction( Context, Context->buf );
|
||||||
|
- Context->length += 8*BLOCK_SIZE;
|
||||||
|
- Context->curlen = 0;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Finalise
|
||||||
|
-//
|
||||||
|
-// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||||
|
-// calling this, Sha256Initialised must be used to reuse the context.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Finalise
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context, // [in out]
|
||||||
|
- SHA256_HASH* Digest // [out]
|
||||||
|
- )
|
||||||
|
-{
|
||||||
|
- int i;
|
||||||
|
-
|
||||||
|
- if( Context->curlen >= sizeof(Context->buf) )
|
||||||
|
- {
|
||||||
|
- return;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Increase the length of the message
|
||||||
|
- Context->length += Context->curlen * 8;
|
||||||
|
-
|
||||||
|
- // Append the '1' bit
|
||||||
|
- Context->buf[Context->curlen++] = (uint8_t)0x80;
|
||||||
|
-
|
||||||
|
- // if the length is currently above 56 bytes we append zeros
|
||||||
|
- // then compress. Then we can fall back to padding zeros and length
|
||||||
|
- // encoding like normal.
|
||||||
|
- if( Context->curlen > 56 )
|
||||||
|
- {
|
||||||
|
- while( Context->curlen < 64 )
|
||||||
|
- {
|
||||||
|
- Context->buf[Context->curlen++] = (uint8_t)0;
|
||||||
|
- }
|
||||||
|
- TransformFunction(Context, Context->buf);
|
||||||
|
- Context->curlen = 0;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Pad up to 56 bytes of zeroes
|
||||||
|
- while( Context->curlen < 56 )
|
||||||
|
- {
|
||||||
|
- Context->buf[Context->curlen++] = (uint8_t)0;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- // Store length
|
||||||
|
- STORE64H( Context->length, Context->buf+56 );
|
||||||
|
- TransformFunction( Context, Context->buf );
|
||||||
|
-
|
||||||
|
- // Copy output
|
||||||
|
- for( i=0; i<8; i++ )
|
||||||
|
- {
|
||||||
|
- STORE32H( Context->state[i], Digest->bytes+(4*i) );
|
||||||
|
- }
|
||||||
|
-}
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Calculate
|
||||||
|
-//
|
||||||
|
-// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||||
|
-// buffer.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Calculate
|
||||||
|
- (
|
||||||
|
- void const* Buffer, // [in]
|
||||||
|
- uint32_t BufferSize, // [in]
|
||||||
|
- SHA256_HASH* Digest // [in]
|
||||||
|
- )
|
||||||
|
-{
|
||||||
|
- Sha256Context context;
|
||||||
|
-
|
||||||
|
- Sha256Initialise( &context );
|
||||||
|
- Sha256Update( &context, Buffer, BufferSize );
|
||||||
|
- Sha256Finalise( &context, Digest );
|
||||||
|
-}
|
||||||
|
diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
|
||||||
|
deleted file mode 100644
|
||||||
|
index 406ed869..00000000
|
||||||
|
--- a/policycoreutils/semodule/sha256.h
|
||||||
|
+++ /dev/null
|
||||||
|
@@ -1,89 +0,0 @@
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// WjCryptLib_Sha256
|
||||||
|
-//
|
||||||
|
-// Implementation of SHA256 hash function.
|
||||||
|
-// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
|
||||||
|
-// Modified by WaterJuice retaining Public Domain license.
|
||||||
|
-//
|
||||||
|
-// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-#pragma once
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// IMPORTS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-#include <stdint.h>
|
||||||
|
-#include <stdio.h>
|
||||||
|
-
|
||||||
|
-typedef struct
|
||||||
|
-{
|
||||||
|
- uint64_t length;
|
||||||
|
- uint32_t state[8];
|
||||||
|
- uint32_t curlen;
|
||||||
|
- uint8_t buf[64];
|
||||||
|
-} Sha256Context;
|
||||||
|
-
|
||||||
|
-#define SHA256_HASH_SIZE ( 256 / 8 )
|
||||||
|
-
|
||||||
|
-typedef struct
|
||||||
|
-{
|
||||||
|
- uint8_t bytes [SHA256_HASH_SIZE];
|
||||||
|
-} SHA256_HASH;
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// PUBLIC FUNCTIONS
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Initialise
|
||||||
|
-//
|
||||||
|
-// Initialises a SHA256 Context. Use this to initialise/reset a context.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Initialise
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context // [out]
|
||||||
|
- );
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Update
|
||||||
|
-//
|
||||||
|
-// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
|
||||||
|
-// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Update
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context, // [in out]
|
||||||
|
- void const* Buffer, // [in]
|
||||||
|
- uint32_t BufferSize // [in]
|
||||||
|
- );
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Finalise
|
||||||
|
-//
|
||||||
|
-// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
|
||||||
|
-// calling this, Sha256Initialised must be used to reuse the context.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Finalise
|
||||||
|
- (
|
||||||
|
- Sha256Context* Context, // [in out]
|
||||||
|
- SHA256_HASH* Digest // [out]
|
||||||
|
- );
|
||||||
|
-
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-// Sha256Calculate
|
||||||
|
-//
|
||||||
|
-// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
|
||||||
|
-// buffer.
|
||||||
|
-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
-void
|
||||||
|
- Sha256Calculate
|
||||||
|
- (
|
||||||
|
- void const* Buffer, // [in]
|
||||||
|
- uint32_t BufferSize, // [in]
|
||||||
|
- SHA256_HASH* Digest // [in]
|
||||||
|
- );
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
||||||
@ -0,0 +1,144 @@
|
|||||||
|
From e3fc737e43561ecadcb977ce4c9a1db44be636ae Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
Date: Thu, 3 Feb 2022 17:53:27 +0100
|
||||||
|
Subject: [PATCH] semodule: add command-line option to detect module changes
|
||||||
|
|
||||||
|
Add a new command-line option "--rebuild-if-modules-changed" to control
|
||||||
|
the newly introduced check_ext_changes libsemanage flag.
|
||||||
|
|
||||||
|
For example, running `semodule --rebuild-if-modules-changed` will ensure
|
||||||
|
that any externally added/removed modules (e.g. by an RPM transaction)
|
||||||
|
are reflected in the compiled policy, while skipping the most expensive
|
||||||
|
part of the rebuild if no module change was deteceted since the last
|
||||||
|
libsemanage transaction.
|
||||||
|
|
||||||
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/semodule.8 | 7 +++++++
|
||||||
|
policycoreutils/semodule/semodule.c | 32 ++++++++++++++++++++++-------
|
||||||
|
2 files changed, 32 insertions(+), 7 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||||
|
index 3a2fb21c..d1735d21 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.8
|
||||||
|
+++ b/policycoreutils/semodule/semodule.8
|
||||||
|
@@ -23,6 +23,13 @@ force a reload of policy
|
||||||
|
.B \-B, \-\-build
|
||||||
|
force a rebuild of policy (also reloads unless \-n is used)
|
||||||
|
.TP
|
||||||
|
+.B \-\-rebuild-if-modules-changed
|
||||||
|
+Force a rebuild of the policy if any changes to module content are detected
|
||||||
|
+(by comparing with checksum from the last transaction). One can use this
|
||||||
|
+instead of \-B to ensure that any changes to the module store done by an
|
||||||
|
+external tool (e.g. a package manager) are applied, while automatically
|
||||||
|
+skipping the rebuild if there are no new changes.
|
||||||
|
+.TP
|
||||||
|
.B \-D, \-\-disable_dontaudit
|
||||||
|
Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
|
||||||
|
.TP
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index 243b1add..22a42a75 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -46,6 +46,7 @@ static int verbose;
|
||||||
|
static int reload;
|
||||||
|
static int no_reload;
|
||||||
|
static int build;
|
||||||
|
+static int check_ext_changes;
|
||||||
|
static int disable_dontaudit;
|
||||||
|
static int preserve_tunables;
|
||||||
|
static int ignore_module_cache;
|
||||||
|
@@ -148,6 +149,9 @@ static void usage(char *progname)
|
||||||
|
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||||
|
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||||
|
printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||||
|
+ printf(" --rebuild-if-modules-changed\n"
|
||||||
|
+ " force policy rebuild if module content changed since\n"
|
||||||
|
+ " last rebuild (based on checksum)\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Sets the global mode variable to new_mode, but only if no other
|
||||||
|
@@ -179,6 +183,7 @@ static void set_mode(enum client_modes new_mode, char *arg)
|
||||||
|
static void parse_command_line(int argc, char **argv)
|
||||||
|
{
|
||||||
|
static struct option opts[] = {
|
||||||
|
+ {"rebuild-if-modules-changed", 0, NULL, '\0'},
|
||||||
|
{"store", required_argument, NULL, 's'},
|
||||||
|
{"base", required_argument, NULL, 'b'},
|
||||||
|
{"help", 0, NULL, 'h'},
|
||||||
|
@@ -206,15 +211,26 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
};
|
||||||
|
int extract_selected = 0;
|
||||||
|
int cil_hll_set = 0;
|
||||||
|
- int i;
|
||||||
|
+ int i, longind;
|
||||||
|
verbose = 0;
|
||||||
|
reload = 0;
|
||||||
|
no_reload = 0;
|
||||||
|
+ check_ext_changes = 0;
|
||||||
|
priority = 400;
|
||||||
|
while ((i =
|
||||||
|
- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
|
||||||
|
- NULL)) != -1) {
|
||||||
|
+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm",
|
||||||
|
+ opts, &longind)) != -1) {
|
||||||
|
switch (i) {
|
||||||
|
+ case '\0':
|
||||||
|
+ switch(longind) {
|
||||||
|
+ case 0: /* --rebuild-if-modules-changed */
|
||||||
|
+ check_ext_changes = 1;
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ usage(argv[0]);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+ break;
|
||||||
|
case 'b':
|
||||||
|
fprintf(stderr, "The --base option is deprecated. Use --install instead.\n");
|
||||||
|
set_mode(INSTALL_M, optarg);
|
||||||
|
@@ -299,13 +315,13 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
- if ((build || reload) && num_commands) {
|
||||||
|
+ if ((build || reload || check_ext_changes) && num_commands) {
|
||||||
|
fprintf(stderr,
|
||||||
|
"build or reload should not be used with other commands\n");
|
||||||
|
usage(argv[0]);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
- if (num_commands == 0 && reload == 0 && build == 0) {
|
||||||
|
+ if (num_commands == 0 && reload == 0 && build == 0 && check_ext_changes == 0) {
|
||||||
|
fprintf(stderr, "At least one mode must be specified.\n");
|
||||||
|
usage(argv[0]);
|
||||||
|
exit(1);
|
||||||
|
@@ -392,7 +408,7 @@ int main(int argc, char *argv[])
|
||||||
|
}
|
||||||
|
parse_command_line(argc, argv);
|
||||||
|
|
||||||
|
- if (build)
|
||||||
|
+ if (build || check_ext_changes)
|
||||||
|
commit = 1;
|
||||||
|
|
||||||
|
sh = semanage_handle_create();
|
||||||
|
@@ -431,7 +447,7 @@ int main(int argc, char *argv[])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (build) {
|
||||||
|
+ if (build || check_ext_changes) {
|
||||||
|
if ((result = semanage_begin_transaction(sh)) < 0) {
|
||||||
|
fprintf(stderr, "%s: Could not begin transaction: %s\n",
|
||||||
|
argv[0], errno ? strerror(errno) : "");
|
||||||
|
@@ -805,6 +821,8 @@ cleanup_disable:
|
||||||
|
semanage_set_reload(sh, 0);
|
||||||
|
if (build)
|
||||||
|
semanage_set_rebuild(sh, 1);
|
||||||
|
+ if (check_ext_changes)
|
||||||
|
+ semanage_set_check_ext_changes(sh, 1);
|
||||||
|
if (disable_dontaudit)
|
||||||
|
semanage_set_disable_dontaudit(sh, 1);
|
||||||
|
else if (build)
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
||||||
@ -0,0 +1,64 @@
|
|||||||
|
From 09c944561c76146b1fc11e99e95b6a674366cddf Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Mon, 30 May 2022 14:20:21 +0200
|
||||||
|
Subject: [PATCH] python: Split "semanage import" into two transactions
|
||||||
|
|
||||||
|
First transaction applies all deletion operations, so that there are no
|
||||||
|
collisions when applying the rest of the changes.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
# semanage port -a -t http_cache_port_t -r s0 -p tcp 3024
|
||||||
|
# semanage export | semanage import
|
||||||
|
ValueError: Port tcp/3024 already defined
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/semanage/semanage | 21 +++++++++++++++++++--
|
||||||
|
1 file changed, 19 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index ebb93ea5..b8842d28 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -841,10 +841,29 @@ def handleImport(args):
|
||||||
|
trans = seobject.semanageRecords(args)
|
||||||
|
trans.start()
|
||||||
|
|
||||||
|
+ deleteCommands = []
|
||||||
|
+ commands = []
|
||||||
|
+ # separate commands for deletion from the rest so they can be
|
||||||
|
+ # applied in a separate transaction
|
||||||
|
for l in sys.stdin.readlines():
|
||||||
|
if len(l.strip()) == 0:
|
||||||
|
continue
|
||||||
|
+ if "-d" in l or "-D" in l:
|
||||||
|
+ deleteCommands.append(l)
|
||||||
|
+ else:
|
||||||
|
+ commands.append(l)
|
||||||
|
+
|
||||||
|
+ if deleteCommands:
|
||||||
|
+ importHelper(deleteCommands)
|
||||||
|
+ trans.finish()
|
||||||
|
+ trans.start()
|
||||||
|
+
|
||||||
|
+ importHelper(commands)
|
||||||
|
+ trans.finish()
|
||||||
|
|
||||||
|
+
|
||||||
|
+def importHelper(commands):
|
||||||
|
+ for l in commands:
|
||||||
|
try:
|
||||||
|
commandParser = createCommandParser()
|
||||||
|
args = commandParser.parse_args(mkargv(l))
|
||||||
|
@@ -858,8 +877,6 @@ def handleImport(args):
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
sys.exit(0)
|
||||||
|
|
||||||
|
- trans.finish()
|
||||||
|
-
|
||||||
|
|
||||||
|
def setupImportParser(subparsers):
|
||||||
|
importParser = subparsers.add_parser('import', help=_('Import local customizations'))
|
||||||
|
--
|
||||||
|
2.35.3
|
||||||
|
|
||||||
@ -0,0 +1,81 @@
|
|||||||
|
From c0ca652dce6b1d5d11e697cc3a4695d87944f9ad Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
Date: Wed, 8 Jun 2022 19:09:54 +0200
|
||||||
|
Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh
|
||||||
|
|
||||||
|
After the last commit this option's name and description no longer
|
||||||
|
matches the semantic, so give it a new one and update the descriptions.
|
||||||
|
The old name is still recognized and aliased to the new one for
|
||||||
|
backwards compatibility.
|
||||||
|
|
||||||
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
||||||
|
---
|
||||||
|
policycoreutils/semodule/semodule.8 | 12 ++++++------
|
||||||
|
policycoreutils/semodule/semodule.c | 13 ++++++++++---
|
||||||
|
2 files changed, 16 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
|
||||||
|
index d1735d21..c56e580f 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.8
|
||||||
|
+++ b/policycoreutils/semodule/semodule.8
|
||||||
|
@@ -23,12 +23,12 @@ force a reload of policy
|
||||||
|
.B \-B, \-\-build
|
||||||
|
force a rebuild of policy (also reloads unless \-n is used)
|
||||||
|
.TP
|
||||||
|
-.B \-\-rebuild-if-modules-changed
|
||||||
|
-Force a rebuild of the policy if any changes to module content are detected
|
||||||
|
-(by comparing with checksum from the last transaction). One can use this
|
||||||
|
-instead of \-B to ensure that any changes to the module store done by an
|
||||||
|
-external tool (e.g. a package manager) are applied, while automatically
|
||||||
|
-skipping the rebuild if there are no new changes.
|
||||||
|
+.B \-\-refresh
|
||||||
|
+Like \-\-build, but reuses existing linked policy if no changes to module
|
||||||
|
+files are detected (by comparing with checksum from the last transaction).
|
||||||
|
+One can use this instead of \-B to ensure that any changes to the module
|
||||||
|
+store done by an external tool (e.g. a package manager) are applied, while
|
||||||
|
+automatically skipping the module re-linking if there are no module changes.
|
||||||
|
.TP
|
||||||
|
.B \-D, \-\-disable_dontaudit
|
||||||
|
Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt
|
||||||
|
diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
|
||||||
|
index 22a42a75..324ec9fb 100644
|
||||||
|
--- a/policycoreutils/semodule/semodule.c
|
||||||
|
+++ b/policycoreutils/semodule/semodule.c
|
||||||
|
@@ -149,9 +149,12 @@ static void usage(char *progname)
|
||||||
|
printf(" -c, --cil extract module as cil. This only affects module extraction.\n");
|
||||||
|
printf(" -H, --hll extract module as hll. This only affects module extraction.\n");
|
||||||
|
printf(" -m, --checksum print module checksum (SHA256).\n");
|
||||||
|
- printf(" --rebuild-if-modules-changed\n"
|
||||||
|
- " force policy rebuild if module content changed since\n"
|
||||||
|
- " last rebuild (based on checksum)\n");
|
||||||
|
+ printf(" --refresh like --build, but reuses existing linked policy if no\n"
|
||||||
|
+ " changes to module files are detected (via checksum)\n");
|
||||||
|
+ printf("Deprecated options:\n");
|
||||||
|
+ printf(" -b,--base same as --install\n");
|
||||||
|
+ printf(" --rebuild-if-modules-changed\n"
|
||||||
|
+ " same as --refresh\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Sets the global mode variable to new_mode, but only if no other
|
||||||
|
@@ -184,6 +187,7 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
{
|
||||||
|
static struct option opts[] = {
|
||||||
|
{"rebuild-if-modules-changed", 0, NULL, '\0'},
|
||||||
|
+ {"refresh", 0, NULL, '\0'},
|
||||||
|
{"store", required_argument, NULL, 's'},
|
||||||
|
{"base", required_argument, NULL, 'b'},
|
||||||
|
{"help", 0, NULL, 'h'},
|
||||||
|
@@ -224,6 +228,9 @@ static void parse_command_line(int argc, char **argv)
|
||||||
|
case '\0':
|
||||||
|
switch(longind) {
|
||||||
|
case 0: /* --rebuild-if-modules-changed */
|
||||||
|
+ fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n");
|
||||||
|
+ /* fallthrough */
|
||||||
|
+ case 1: /* --refresh */
|
||||||
|
check_ext_changes = 1;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
--
|
||||||
|
2.35.3
|
||||||
|
|
||||||
@ -0,0 +1,79 @@
|
|||||||
|
From 72c7e9123980b003a21d51e2805529a3e90b2460 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Thu, 13 Oct 2022 17:33:18 +0200
|
||||||
|
Subject: [PATCH] python: Harden tools against "rogue" modules
|
||||||
|
|
||||||
|
Python scripts present in "/usr/sbin" override regular modules.
|
||||||
|
Make sure /usr/sbin is not present in PYTHONPATH.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
#cat > /usr/sbin/audit.py <<EOF
|
||||||
|
import sys
|
||||||
|
print("BAD GUY!", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
EOF
|
||||||
|
#semanage boolean -l
|
||||||
|
BAD GUY!
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/audit2allow/audit2allow | 2 +-
|
||||||
|
python/audit2allow/sepolgen-ifgen | 2 +-
|
||||||
|
python/chcat/chcat | 2 +-
|
||||||
|
python/semanage/semanage | 2 +-
|
||||||
|
python/sepolicy/sepolicy.py | 2 +-
|
||||||
|
5 files changed, 5 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
|
||||||
|
index 09b06f66..eafeea88 100644
|
||||||
|
--- a/python/audit2allow/audit2allow
|
||||||
|
+++ b/python/audit2allow/audit2allow
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||||
|
# Authors: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
#
|
||||||
|
diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen
|
||||||
|
index be2d093b..f25f8af1 100644
|
||||||
|
--- a/python/audit2allow/sepolgen-ifgen
|
||||||
|
+++ b/python/audit2allow/sepolgen-ifgen
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
#
|
||||||
|
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||||
|
#
|
||||||
|
diff --git a/python/chcat/chcat b/python/chcat/chcat
|
||||||
|
index df2509f2..5671cec6 100755
|
||||||
|
--- a/python/chcat/chcat
|
||||||
|
+++ b/python/chcat/chcat
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
# Copyright (C) 2005 Red Hat
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
#
|
||||||
|
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
||||||
|
index b8842d28..1f170f60 100644
|
||||||
|
--- a/python/semanage/semanage
|
||||||
|
+++ b/python/semanage/semanage
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
# Copyright (C) 2012-2013 Red Hat
|
||||||
|
# AUTHOR: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
# AUTHOR: David Quigley <selinux@davequigley.com>
|
||||||
|
diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
|
||||||
|
index 8bd6a579..0c1d9641 100755
|
||||||
|
--- a/python/sepolicy/sepolicy.py
|
||||||
|
+++ b/python/sepolicy/sepolicy.py
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
# Copyright (C) 2012 Red Hat
|
||||||
|
# AUTHOR: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
# see file 'COPYING' for use and warranty information
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
@ -0,0 +1,65 @@
|
|||||||
|
From f33e40265d192e5d725e7b82e5f14f603e1fba48 Mon Sep 17 00:00:00 2001
|
||||||
|
From: James Carter <jwcart2@gmail.com>
|
||||||
|
Date: Wed, 19 Oct 2022 14:20:11 -0400
|
||||||
|
Subject: [PATCH] python: Do not query the local database if the fcontext is
|
||||||
|
non-local
|
||||||
|
|
||||||
|
Vit Mojzis reports that an error message is produced when modifying
|
||||||
|
a non-local fcontext.
|
||||||
|
|
||||||
|
He gives the following example:
|
||||||
|
# semanage fcontext -f f -m -t passwd_file_t /etc/security/opasswd
|
||||||
|
libsemanage.dbase_llist_query: could not query record value (No such file or directory).
|
||||||
|
|
||||||
|
When modifying an fcontext, the non-local database is checked for the
|
||||||
|
key and then, if it is not found there, the local database is checked.
|
||||||
|
If the key doesn't exist, then an error is raised. If the key exists
|
||||||
|
then the local database is queried first and, if that fails, the non-
|
||||||
|
local database is queried.
|
||||||
|
|
||||||
|
The error is from querying the local database when the fcontext is in
|
||||||
|
the non-local database.
|
||||||
|
|
||||||
|
Instead, if the fcontext is in the non-local database, just query
|
||||||
|
the non-local database. Only query the local database if the
|
||||||
|
fcontext was found in it.
|
||||||
|
|
||||||
|
Reported-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Signed-off-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
python/semanage/seobject.py | 15 +++++++++------
|
||||||
|
1 file changed, 9 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||||
|
index 70ebfd08..0e923a0d 100644
|
||||||
|
--- a/python/semanage/seobject.py
|
||||||
|
+++ b/python/semanage/seobject.py
|
||||||
|
@@ -2490,16 +2490,19 @@ class fcontextRecords(semanageRecords):
|
||||||
|
(rc, exists) = semanage_fcontext_exists(self.sh, k)
|
||||||
|
if rc < 0:
|
||||||
|
raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||||
|
- if not exists:
|
||||||
|
+ if exists:
|
||||||
|
+ try:
|
||||||
|
+ (rc, fcontext) = semanage_fcontext_query(self.sh, k)
|
||||||
|
+ except OSError:
|
||||||
|
+ raise ValueError(_("Could not query file context for %s") % target)
|
||||||
|
+ else:
|
||||||
|
(rc, exists) = semanage_fcontext_exists_local(self.sh, k)
|
||||||
|
+ if rc < 0:
|
||||||
|
+ raise ValueError(_("Could not check if file context for %s is defined") % target)
|
||||||
|
if not exists:
|
||||||
|
raise ValueError(_("File context for %s is not defined") % target)
|
||||||
|
-
|
||||||
|
- try:
|
||||||
|
- (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
|
||||||
|
- except OSError:
|
||||||
|
try:
|
||||||
|
- (rc, fcontext) = semanage_fcontext_query(self.sh, k)
|
||||||
|
+ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
|
||||||
|
except OSError:
|
||||||
|
raise ValueError(_("Could not query file context for %s") % target)
|
||||||
|
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
@ -0,0 +1,112 @@
|
|||||||
|
From f3ddbd8220d9646072c9a4c9ed37f2dff998a53c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 10 Jan 2023 11:37:26 +0100
|
||||||
|
Subject: [PATCH] python/sepolicy: add missing booleans to man pages
|
||||||
|
|
||||||
|
get_bools should return a list of booleans that can affect given type,
|
||||||
|
but it did not handle non trivial conditional statements properly
|
||||||
|
(returning the whole conditional statement instead of a list of booleans
|
||||||
|
in the statement).
|
||||||
|
|
||||||
|
e.g. for
|
||||||
|
allow httpd_t spamc_t:process transition; [ httpd_can_check_spam && httpd_can_sendmail ]:True
|
||||||
|
get_bools used to return [("httpd_can_check_spam && httpd_can_sendmail", False)] instead of
|
||||||
|
[("httpd_can_check_spam", False), ("httpd_can_sendmail", False)]
|
||||||
|
|
||||||
|
- rename "boolean" in sepolicy rule dictionary to "booleans" to suggest
|
||||||
|
it can contain multiple values and make sure it is populated correctly
|
||||||
|
- add "conditional" key to the rule dictionary to accommodate
|
||||||
|
get_conditionals, which requires the whole conditional statement
|
||||||
|
- extend get_bools search to dontaudit rules so that it covers booleans
|
||||||
|
like httpd_dontaudit_search_dirs
|
||||||
|
|
||||||
|
Note: get_bools uses security_get_boolean_active to get the boolean
|
||||||
|
value, but the value is later used to represent the default.
|
||||||
|
Not ideal, but I'm not aware of a way to get the actual defaults.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
"sepolicy manpage" generates man pages that are missing booleans
|
||||||
|
which are included in non trivial conditional expressions
|
||||||
|
e.g. httpd_selinux(8) does not include httpd_can_check_spam,
|
||||||
|
httpd_tmp_exec, httpd_unified, or httpd_use_gpg
|
||||||
|
|
||||||
|
This fix, however, also adds some not strictly related booleans
|
||||||
|
to some man pages. e.g. use_nfs_home_dirs and
|
||||||
|
use_samba_home_dirs are added to httpd_selinux(8)
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: Jason Zaman <jason@perfinion.com>
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/__init__.py | 21 +++++++++++++--------
|
||||||
|
1 file changed, 13 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
index b6ca57c3..0f51174d 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/__init__.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
@@ -324,7 +324,12 @@ def _setools_rule_to_dict(rule):
|
||||||
|
pass
|
||||||
|
|
||||||
|
try:
|
||||||
|
- d['boolean'] = [(str(rule.conditional), enabled)]
|
||||||
|
+ d['booleans'] = [(str(b), b.state) for b in rule.conditional.booleans]
|
||||||
|
+ except AttributeError:
|
||||||
|
+ pass
|
||||||
|
+
|
||||||
|
+ try:
|
||||||
|
+ d['conditional'] = str(rule.conditional)
|
||||||
|
except AttributeError:
|
||||||
|
pass
|
||||||
|
|
||||||
|
@@ -426,12 +431,12 @@ def get_conditionals(src, dest, tclass, perm):
|
||||||
|
x['source'] in src_list and
|
||||||
|
x['target'] in dest_list and
|
||||||
|
set(perm).issubset(x[PERMS]) and
|
||||||
|
- 'boolean' in x,
|
||||||
|
+ 'conditional' in x,
|
||||||
|
get_all_allow_rules()))
|
||||||
|
|
||||||
|
try:
|
||||||
|
for i in allows:
|
||||||
|
- tdict.update({'source': i['source'], 'boolean': i['boolean']})
|
||||||
|
+ tdict.update({'source': i['source'], 'conditional': (i['conditional'], i['enabled'])})
|
||||||
|
if tdict not in tlist:
|
||||||
|
tlist.append(tdict)
|
||||||
|
tdict = {}
|
||||||
|
@@ -445,10 +450,10 @@ def get_conditionals_format_text(cond):
|
||||||
|
|
||||||
|
enabled = False
|
||||||
|
for x in cond:
|
||||||
|
- if x['boolean'][0][1]:
|
||||||
|
+ if x['conditional'][1]:
|
||||||
|
enabled = True
|
||||||
|
break
|
||||||
|
- return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['boolean'][0][0], x['boolean'][0][1]), cond))))
|
||||||
|
+ return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['conditional'][0], x['conditional'][1]), cond))))
|
||||||
|
|
||||||
|
|
||||||
|
def get_types_from_attribute(attribute):
|
||||||
|
@@ -703,9 +708,9 @@ def get_boolean_rules(setype, boolean):
|
||||||
|
boollist = []
|
||||||
|
permlist = search([ALLOW], {'source': setype})
|
||||||
|
for p in permlist:
|
||||||
|
- if "boolean" in p:
|
||||||
|
+ if "booleans" in p:
|
||||||
|
try:
|
||||||
|
- for b in p["boolean"]:
|
||||||
|
+ for b in p["booleans"]:
|
||||||
|
if boolean in b:
|
||||||
|
boollist.append(p)
|
||||||
|
except:
|
||||||
|
@@ -1124,7 +1129,7 @@ def get_bools(setype):
|
||||||
|
bools = []
|
||||||
|
domainbools = []
|
||||||
|
domainname, short_name = gen_short_name(setype)
|
||||||
|
- for i in map(lambda x: x['boolean'], filter(lambda x: 'boolean' in x and x['source'] == setype, get_all_allow_rules())):
|
||||||
|
+ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
|
||||||
|
for b in i:
|
||||||
|
if not isinstance(b, tuple):
|
||||||
|
continue
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
From 25373db5cac520b85350db91b8a7ed0737d3316c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 24 Jan 2023 21:05:05 +0100
|
||||||
|
Subject: [PATCH] python/sepolicy: Cache conditional rule queries
|
||||||
|
|
||||||
|
Commit 7506771e4b630fe0ab853f96574e039055cb72eb
|
||||||
|
"add missing booleans to man pages" dramatically slowed down
|
||||||
|
"sepolicy manpage -a" by removing caching of setools rule query.
|
||||||
|
Re-add said caching and update the query to only return conditional
|
||||||
|
rules.
|
||||||
|
|
||||||
|
Before commit 7506771e:
|
||||||
|
#time sepolicy manpage -a
|
||||||
|
real 1m43.153s
|
||||||
|
# time sepolicy manpage -d httpd_t
|
||||||
|
real 0m4.493s
|
||||||
|
|
||||||
|
After commit 7506771e:
|
||||||
|
#time sepolicy manpage -a
|
||||||
|
real 1h56m43.153s
|
||||||
|
# time sepolicy manpage -d httpd_t
|
||||||
|
real 0m8.352s
|
||||||
|
|
||||||
|
After this commit:
|
||||||
|
#time sepolicy manpage -a
|
||||||
|
real 1m41.074s
|
||||||
|
# time sepolicy manpage -d httpd_t
|
||||||
|
real 0m7.358s
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/__init__.py | 11 ++++++++++-
|
||||||
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
index 0f51174d..f48231e9 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/__init__.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/__init__.py
|
||||||
|
@@ -114,6 +114,7 @@ all_attributes = None
|
||||||
|
booleans = None
|
||||||
|
booleans_dict = None
|
||||||
|
all_allow_rules = None
|
||||||
|
+all_bool_rules = None
|
||||||
|
all_transitions = None
|
||||||
|
|
||||||
|
|
||||||
|
@@ -1119,6 +1120,14 @@ def get_all_allow_rules():
|
||||||
|
all_allow_rules = search([ALLOW])
|
||||||
|
return all_allow_rules
|
||||||
|
|
||||||
|
+def get_all_bool_rules():
|
||||||
|
+ global all_bool_rules
|
||||||
|
+ if not all_bool_rules:
|
||||||
|
+ q = setools.TERuleQuery(_pol, boolean=".*", boolean_regex=True,
|
||||||
|
+ ruletype=[ALLOW, DONTAUDIT])
|
||||||
|
+ all_bool_rules = [_setools_rule_to_dict(x) for x in q.results()]
|
||||||
|
+ return all_bool_rules
|
||||||
|
+
|
||||||
|
def get_all_transitions():
|
||||||
|
global all_transitions
|
||||||
|
if not all_transitions:
|
||||||
|
@@ -1129,7 +1138,7 @@ def get_bools(setype):
|
||||||
|
bools = []
|
||||||
|
domainbools = []
|
||||||
|
domainname, short_name = gen_short_name(setype)
|
||||||
|
- for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
|
||||||
|
+ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, get_all_bool_rules())):
|
||||||
|
for b in i:
|
||||||
|
if not isinstance(b, tuple):
|
||||||
|
continue
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
@ -0,0 +1,98 @@
|
|||||||
|
From 7aef364bc6607953a34cb9e8fe9ea51c88379a5c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 6 Dec 2023 15:31:51 +0100
|
||||||
|
Subject: [PATCH] python: Harden more tools against "rogue" modules
|
||||||
|
|
||||||
|
Python scripts present in the same directory as the tool
|
||||||
|
override regular modules.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
#cat > /usr/bin/signal.py <<EOF
|
||||||
|
import sys
|
||||||
|
print("BAD GUY!", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
EOF
|
||||||
|
#sandbox date
|
||||||
|
BAD GUY!
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
dbus/selinux_server.py | 2 +-
|
||||||
|
gui/polgengui.py | 2 +-
|
||||||
|
gui/system-config-selinux.py | 6 +++---
|
||||||
|
sandbox/sandbox | 2 +-
|
||||||
|
sandbox/start | 2 +-
|
||||||
|
5 files changed, 7 insertions(+), 7 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
|
||||||
|
index 97bf91ba..eae38de5 100644
|
||||||
|
--- a/dbus/selinux_server.py
|
||||||
|
+++ b/dbus/selinux_server.py
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
|
||||||
|
import dbus
|
||||||
|
import dbus.service
|
||||||
|
diff --git a/gui/polgengui.py b/gui/polgengui.py
|
||||||
|
index 46a1bd2c..0402e82c 100644
|
||||||
|
--- a/gui/polgengui.py
|
||||||
|
+++ b/gui/polgengui.py
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
#
|
||||||
|
# polgengui.py - GUI for SELinux Config tool in system-config-selinux
|
||||||
|
#
|
||||||
|
diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
|
||||||
|
index 1e0d5eb1..c344c076 100644
|
||||||
|
--- a/gui/system-config-selinux.py
|
||||||
|
+++ b/gui/system-config-selinux.py
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
#
|
||||||
|
# system-config-selinux.py - GUI for SELinux Config tool in system-config-selinux
|
||||||
|
#
|
||||||
|
@@ -32,6 +32,8 @@ except RuntimeError as e:
|
||||||
|
print("This is a graphical application and requires DISPLAY to be set.")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
+sys.path.append('/usr/share/system-config-selinux')
|
||||||
|
+
|
||||||
|
from gi.repository import GObject
|
||||||
|
import statusPage
|
||||||
|
import booleansPage
|
||||||
|
@@ -65,8 +67,6 @@ except:
|
||||||
|
|
||||||
|
version = "1.0"
|
||||||
|
|
||||||
|
-sys.path.append('/usr/share/system-config-selinux')
|
||||||
|
-
|
||||||
|
|
||||||
|
##
|
||||||
|
## Pull in the Glade file
|
||||||
|
diff --git a/sandbox/sandbox b/sandbox/sandbox
|
||||||
|
index 707959a6..e276e594 100644
|
||||||
|
--- a/sandbox/sandbox
|
||||||
|
+++ b/sandbox/sandbox
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
# Authors: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
# Authors: Thomas Liu <tliu@fedoraproject.org>
|
||||||
|
# Authors: Josh Cogliati
|
||||||
|
diff --git a/sandbox/start b/sandbox/start
|
||||||
|
index 4ed3cb5c..3c1a1783 100644
|
||||||
|
--- a/sandbox/start
|
||||||
|
+++ b/sandbox/start
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/python3 -Es
|
||||||
|
+#!/usr/bin/python3 -EsI
|
||||||
|
try:
|
||||||
|
from subprocess import getstatusoutput
|
||||||
|
except ImportError:
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
@ -0,0 +1,95 @@
|
|||||||
|
From ea93da38a16eb44307b522f8a26f2d8f967fcc01 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||||
|
Date: Wed, 22 Nov 2023 12:29:43 +0100
|
||||||
|
Subject: [PATCH] sepolicy: port to dnf4 python API
|
||||||
|
|
||||||
|
yum module is not available since RHEL 7.
|
||||||
|
|
||||||
|
Drop -systemd related code as it's obsoleted these days - only 2
|
||||||
|
packages ship their .service in -systemd subpackage
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||||||
|
---
|
||||||
|
python/sepolicy/sepolicy/generate.py | 56 +++++++++++++---------------
|
||||||
|
1 file changed, 25 insertions(+), 31 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||||
|
index 93caedee..c841a499 100644
|
||||||
|
--- a/python/sepolicy/sepolicy/generate.py
|
||||||
|
+++ b/python/sepolicy/sepolicy/generate.py
|
||||||
|
@@ -1265,24 +1265,20 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||||
|
return fcfile
|
||||||
|
|
||||||
|
def __extract_rpms(self):
|
||||||
|
- import yum
|
||||||
|
- yb = yum.YumBase()
|
||||||
|
- yb.setCacheDir()
|
||||||
|
-
|
||||||
|
- for pkg in yb.rpmdb.searchProvides(self.program):
|
||||||
|
- self.rpms.append(pkg.name)
|
||||||
|
- for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist:
|
||||||
|
- for b in self.DEFAULT_DIRS:
|
||||||
|
- if b == "/etc":
|
||||||
|
- continue
|
||||||
|
- if fname.startswith(b):
|
||||||
|
- if os.path.isfile(fname):
|
||||||
|
- self.add_file(fname)
|
||||||
|
- else:
|
||||||
|
- self.add_dir(fname)
|
||||||
|
+ import dnf
|
||||||
|
+
|
||||||
|
+ with dnf.Base() as base:
|
||||||
|
+ base.read_all_repos()
|
||||||
|
+ base.fill_sack(load_system_repo=True)
|
||||||
|
+
|
||||||
|
+ query = base.sack.query()
|
||||||
|
|
||||||
|
- for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]):
|
||||||
|
- for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist:
|
||||||
|
+ pq = query.available()
|
||||||
|
+ pq = pq.filter(file=self.program)
|
||||||
|
+
|
||||||
|
+ for pkg in pq:
|
||||||
|
+ self.rpms.append(pkg.name)
|
||||||
|
+ for fname in pkg.files:
|
||||||
|
for b in self.DEFAULT_DIRS:
|
||||||
|
if b == "/etc":
|
||||||
|
continue
|
||||||
|
@@ -1291,20 +1287,18 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||||
|
self.add_file(fname)
|
||||||
|
else:
|
||||||
|
self.add_dir(fname)
|
||||||
|
-
|
||||||
|
- # some packages have own systemd subpackage
|
||||||
|
- # tor-systemd for example
|
||||||
|
- binary_name = self.program.split("/")[-1]
|
||||||
|
- for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]):
|
||||||
|
- for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist:
|
||||||
|
- for b in self.DEFAULT_DIRS:
|
||||||
|
- if b == "/etc":
|
||||||
|
- continue
|
||||||
|
- if fname.startswith(b):
|
||||||
|
- if os.path.isfile(fname):
|
||||||
|
- self.add_file(fname)
|
||||||
|
- else:
|
||||||
|
- self.add_dir(fname)
|
||||||
|
+ sq = query.available()
|
||||||
|
+ sq = sq.filter(provides=pkg.source_name)
|
||||||
|
+ for bpkg in sq:
|
||||||
|
+ for fname in bpkg.files:
|
||||||
|
+ for b in self.DEFAULT_DIRS:
|
||||||
|
+ if b == "/etc":
|
||||||
|
+ continue
|
||||||
|
+ if fname.startswith(b):
|
||||||
|
+ if os.path.isfile(fname):
|
||||||
|
+ self.add_file(fname)
|
||||||
|
+ else:
|
||||||
|
+ self.add_dir(fname)
|
||||||
|
|
||||||
|
def gen_writeable(self):
|
||||||
|
try:
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Do automatic relabelling
|
||||||
|
#
|
||||||
|
|
||||||
|
# . /etc/init.d/functions
|
||||||
|
|
||||||
|
# If the user has this (or similar) UEFI boot order:
|
||||||
|
#
|
||||||
|
# Windows | grub | Linux
|
||||||
|
#
|
||||||
|
# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
|
||||||
|
# would cause the system to boot into Windows again, if the autorelabel was run.
|
||||||
|
#
|
||||||
|
# This function restores the UEFI boot order, so the user will boot into the
|
||||||
|
# previously set (and expected) partition.
|
||||||
|
efi_set_boot_next() {
|
||||||
|
# NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
|
||||||
|
# succeed even on system which is not EFI-enabled...
|
||||||
|
if ! efibootmgr > /dev/null 2>&1; then
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# NOTE: It it possible that some other services might be setting the
|
||||||
|
# 'BootNext' item for any reasons, and we shouldn't override it if so.
|
||||||
|
if ! efibootmgr | grep --quiet -e 'BootNext'; then
|
||||||
|
CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
|
||||||
|
efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
relabel_selinux() {
|
||||||
|
# if /sbin/init is not labeled correctly this process is running in the
|
||||||
|
# wrong context, so a reboot will be required after relabel
|
||||||
|
AUTORELABEL=
|
||||||
|
. /etc/selinux/config
|
||||||
|
echo "0" > /sys/fs/selinux/enforce
|
||||||
|
[ -x /bin/plymouth ] && plymouth --quit
|
||||||
|
|
||||||
|
if [ "$AUTORELABEL" = "0" ]; then
|
||||||
|
echo
|
||||||
|
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required. "
|
||||||
|
echo $"*** /etc/selinux/config indicates you want to manually fix labeling"
|
||||||
|
echo $"*** problems. Dropping you to a shell; the system will reboot"
|
||||||
|
echo $"*** when you leave the shell."
|
||||||
|
sulogin
|
||||||
|
|
||||||
|
else
|
||||||
|
echo
|
||||||
|
echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required."
|
||||||
|
echo $"*** Relabeling could take a very long time, depending on file"
|
||||||
|
echo $"*** system size and speed of hard drives."
|
||||||
|
|
||||||
|
FORCE=`cat /.autorelabel`
|
||||||
|
[ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
|
||||||
|
/sbin/fixfiles $FORCE restore
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -f /.autorelabel
|
||||||
|
/usr/lib/dracut/dracut-initramfs-restore
|
||||||
|
efi_set_boot_next
|
||||||
|
if [ -x /usr/bin/grub2-editenv ]; then
|
||||||
|
grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
|
||||||
|
fi
|
||||||
|
sync
|
||||||
|
systemctl reboot
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check to see if a full relabel is needed
|
||||||
|
if [ "$READONLY" != "yes" ]; then
|
||||||
|
restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1
|
||||||
|
relabel_selinux
|
||||||
|
fi
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# This systemd.generator(7) detects if SELinux is running and if the
|
||||||
|
# user requested an autorelabel, and if so sets the default target to
|
||||||
|
# selinux-autorelabel.target, which will cause the filesystem to be
|
||||||
|
# relabelled and then the system will reboot again and boot into the
|
||||||
|
# real default target.
|
||||||
|
|
||||||
|
PATH=/usr/sbin:$PATH
|
||||||
|
unitdir=/usr/lib/systemd/system
|
||||||
|
|
||||||
|
# If invoked with no arguments (for testing) write to /tmp.
|
||||||
|
earlydir="/tmp"
|
||||||
|
if [ -n "$2" ]; then
|
||||||
|
earlydir="$2"
|
||||||
|
fi
|
||||||
|
|
||||||
|
set_target ()
|
||||||
|
{
|
||||||
|
ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target"
|
||||||
|
}
|
||||||
|
|
||||||
|
if selinuxenabled; then
|
||||||
|
if test -f /.autorelabel; then
|
||||||
|
set_target
|
||||||
|
elif grep -sqE "\bautorelabel\b" /proc/cmdline; then
|
||||||
|
set_target
|
||||||
|
fi
|
||||||
|
fi
|
||||||
@ -0,0 +1,18 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Mark the need to relabel after reboot
|
||||||
|
DefaultDependencies=no
|
||||||
|
Requires=local-fs.target
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=local-fs.target
|
||||||
|
Before=sysinit.target shutdown.target
|
||||||
|
ConditionSecurity=!selinux
|
||||||
|
ConditionPathIsDirectory=/etc/selinux
|
||||||
|
ConditionPathExists=!/.autorelabel
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=-/bin/touch /.autorelabel
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sysinit.target
|
||||||
@ -0,0 +1,14 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Relabel all filesystems
|
||||||
|
DefaultDependencies=no
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=sysinit.target
|
||||||
|
Before=shutdown.target
|
||||||
|
ConditionSecurity=selinux
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=/usr/libexec/selinux/selinux-autorelabel
|
||||||
|
Type=oneshot
|
||||||
|
TimeoutSec=0
|
||||||
|
RemainAfterExit=yes
|
||||||
|
StandardOutput=journal+console
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Relabel all filesystems and reboot
|
||||||
|
DefaultDependencies=no
|
||||||
|
Requires=sysinit.target selinux-autorelabel.service
|
||||||
|
Conflicts=shutdown.target
|
||||||
|
After=sysinit.target selinux-autorelabel.service
|
||||||
|
ConditionSecurity=selinux
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue