rpms/fapolicyd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL 9.7.0 ERRATUM

Browse Source 
- "fapolicyd-cli --file add" crashes when processing sockets
Resolves: RHEL-69136

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
This commit is contained in:
Radovan Sroka 2025-07-24 17:12:40 +02:00
parent ae53b377c4
commit 15208c42a1
4 changed files with 95 additions and 83 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
fapolicyd-skip-nonregular.patch Normal file
View File

@ -0,0 +1,39 @@
From 508805c9f47ca22695fd7a265668f99e9258ea27 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Thu, 24 Jul 2025 15:30:06 +0200
Subject: [PATCH] Skip to add non regular files to trustdb
- it does not make any sense to have them in the trustdb
- the patch should be fix potential error when reading nonregular files
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
src/cli/file-cli.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c
index 7deec39c..ae326c14 100644
--- a/src/cli/file-cli.c
+++ b/src/cli/file-cli.c
@@ -67,7 +67,7 @@ static int ftw_add_list_append(const char *fpath,
*/
static int add_list_load_path(const char *path)
{
- int fd = open(path, O_RDONLY);
+ int fd = open(path, O_RDONLY|O_NONBLOCK);
if (fd < 0) {
msg(LOG_ERR, "Cannot open %s", path);
return 1;
@@ -83,8 +83,11 @@ static int add_list_load_path(const char *path)
if (S_ISDIR(sb.st_mode))
nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS);
- else
+ else if (S_ISREG(sb.st_mode)) {
list_append(&add_list, strdup(path), NULL);
+ } else {
+ msg(LOG_INFO, "Skipping non regular file: %s", path);
+ }
return 0;
}

48
fapolicyd-socket-segfault.patch Normal file
View File

@ -0,0 +1,48 @@
From 73770c9111800cb5a1e62203e460ae9149307d49 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 28 Jul 2025 18:44:08 +0200
Subject: [PATCH] Fix segfault when socket is inside of the directory
$ socat UNIX-LISTEN:"/home/rsroka/dir/socket" /dev/null &
[ ERROR ]: Cannot open /home/rsroka/dir/socket
Program received signal SIGSEGV, Segmentation fault.
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
---
src/cli/file-cli.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c
index ae326c14..655e8f15 100644
--- a/src/cli/file-cli.c
+++ b/src/cli/file-cli.c
@@ -53,8 +53,13 @@ static int ftw_add_list_append(const char *fpath,
int typeflag,
struct FTW *ftwbuf __attribute__ ((unused)))
{
- if (typeflag == FTW_F)
- list_append(&add_list, strdup(fpath), NULL);
+ if (typeflag == FTW_F) {
+ if (S_ISREG(sb->st_mode)) {
+ list_append(&add_list, strdup(fpath), NULL);
+ } else {
+ msg(LOG_INFO, "Skipping non regular file: %s", fpath);
+ }
+ }
return FTW_CONTINUE;
}
@@ -83,11 +88,8 @@ static int add_list_load_path(const char *path)
if (S_ISDIR(sb.st_mode))
nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS);
- else if (S_ISREG(sb.st_mode)) {
+ else
list_append(&add_list, strdup(path), NULL);
- } else {
- msg(LOG_INFO, "Skipping non regular file: %s", path);
- }
return 0;
}

81
fapolicyd-sync-update-thread.patch
View File

@ -1,81 +0,0 @@
diff -up ./src/daemon/fapolicyd.c.sync-update ./src/daemon/fapolicyd.c
--- ./src/daemon/fapolicyd.c.sync-update 2024-04-29 17:27:41.000000000 +0200
+++ ./src/daemon/fapolicyd.c 2025-04-21 13:35:21.751343832 +0200
@@ -66,7 +66,11 @@
unsigned int debug_mode = 0, permissive = 0;
// Signal handler notifications
-volatile atomic_bool stop = false, hup = false, run_stats = false;
+volatile atomic_bool try_to_stop = false, stop = false;
+volatile atomic_bool hup = false, run_stats = false;
+
+extern volatile atomic_bool update_thread_loop;
+extern volatile atomic_bool update_thread_stop;
// Local variables
static conf_t config;
@@ -214,7 +218,7 @@ static void init_fs_list(const char *wat
static void term_handler(int sig __attribute__((unused)))
{
- stop = true;
+ try_to_stop = true;
}
@@ -667,7 +672,7 @@ int main(int argc, const char *argv[])
msg(LOG_DEBUG, "Got SIGHUP");
reconfigure();
}
- rc = poll(pfd, 2, -1);
+ rc = poll(pfd, 2, 1000);
#ifdef DEBUG
msg(LOG_DEBUG, "Main poll interrupted");
@@ -699,7 +704,15 @@ int main(int argc, const char *argv[])
sigaction(SIGINT, &sa, NULL);
#endif
}
+
+ if (try_to_stop)
+ update_thread_stop = true;
+
+ if (try_to_stop && !update_thread_loop)
+ stop = true;
+
}
+
msg(LOG_INFO, "shutting down...");
shutdown_fanotify(m);
close(pfd[0].fd);
diff -up ./src/library/database.c.sync-update ./src/library/database.c
--- ./src/library/database.c.sync-update 2025-04-21 13:34:57.479790359 +0200
+++ ./src/library/database.c 2025-04-21 13:34:57.480928947 +0200
@@ -70,6 +70,9 @@ static struct pollfd ffd[1] = { {0, 0,
static integrity_t integrity;
static atomic_int reload_db = 0;
+volatile atomic_bool update_thread_loop = false;
+volatile atomic_bool update_thread_stop = false;
+
static pthread_t update_thread;
static pthread_mutex_t update_lock;
static pthread_mutex_t rule_lock;
@@ -1283,7 +1286,8 @@ static void *update_thread_main(void *ar
fcntl(ffd[0].fd, F_SETFL, O_NONBLOCK);
ffd[0].events = POLLIN;
- while (!stop) {
+ update_thread_loop = true;
+ while (!update_thread_stop) {
rc = poll(ffd, 1, 1000);
@@ -1407,6 +1411,7 @@ static void *update_thread_main(void *ar
}
finalize:
+ update_thread_loop = false;
close(ffd[0].fd);
unlink_fifo();

10
fapolicyd.spec
View File

@ -5,7 +5,7 @@
Summary: Application Whitelisting Daemon
Name: fapolicyd
Version: 1.3.3
Release: 103%{?dist}
Release: 105%{?dist}
License: GPLv3+
URL: http://people.redhat.com/sgrubb/fapolicyd
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
@ -40,6 +40,8 @@ Patch7: fapolicyd-rpm-loader.patch
Patch8: fapolicyd-infinite-loop.patch
Patch9: fapolicyd-data-format.patch
Patch10: var-run-t-dir-selinux.patch
Patch11: fapolicyd-skip-nonregular.patch
Patch12: fapolicyd-socket-segfault.patch
%description
Fapolicyd (File Access Policy Daemon) implements application whitelisting
@ -81,6 +83,8 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon.
%patch -P 8 -p1 -b .infinite-loop
%patch -P 9 -p1 -b .data-format
%patch -P 10 -p1 -b .var-run-dir
%patch -P 11 -p1 -b .skip-nonregular
%patch -P 12 -p1 -b .socket-segfault
# generate rules for python
sed -i "s|%python2_path%|`readlink -f %{__python2}`|g" rules.d/*.rules
@ -268,7 +272,7 @@ fi
%selinux_relabel_post -s %{selinuxtype}
%changelog
* Wed May 28 2025 Radovan Sroka <rsroka@redhat.com> - 1.3.3-103
* Wed May 28 2025 Radovan Sroka <rsroka@redhat.com> - 1.3.3-105
RHEL 9.7.0 ERRATUM
- RPMDB crashes with SIGBUS when updating the RPMDB repeatedly
Resolves: RHEL-63090
@ -278,6 +282,8 @@ Resolves: RHEL-59626
Resolves: RHEL-21871
- fapolicy rule containing 'pattern=normal' produces error
Resolves: RHEL-30020
- "fapolicyd-cli --file add" crashes when processing sockets
Resolves: RHEL-69136
* Wed Jul 19 2023 Radovan Sroka <rsroka@redhat.com> - 1.3.3-100
RHEL 9.5.0 ERRATUM