From e4687e4d16b63994ab308ab4cc582c8b52b43de8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 30 Oct 2025 14:43:50 +0100 Subject: [PATCH] fapolicyd-1.4 https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4 Resolves: RHEL-118363 --- .gitignore | 6 +- ...llow-daemon-to-change-dir-attributes.patch | 42 --- 0101-Bring-back-var-run-contexts.patch | 31 -- Add-var-lib-fapolicyd-to-tmpfiles.patch | 28 -- fapolicyd-data-format.patch | 27 -- fapolicyd-infinite-loop.patch | 67 ---- fapolicyd-normal-pattern.patch | 27 -- fapolicyd-nss-lookup.patch | 26 -- fapolicyd-rpm-loader.patch | 309 ------------------ fapolicyd-rpm-v.patch | 34 -- fapolicyd-skip-nonregular.patch | 39 --- fapolicyd-socket-segfault.patch | 48 --- fapolicyd-uthash-bundle.patch | 39 --- fapolicyd.spec | 13 +- selinux.patch | 13 - sources | 8 +- var-run-selinux.patch | 26 -- var-run-t-dir-selinux.patch | 11 - 18 files changed, 15 insertions(+), 779 deletions(-) delete mode 100644 0100-Allow-daemon-to-change-dir-attributes.patch delete mode 100644 0101-Bring-back-var-run-contexts.patch delete mode 100644 Add-var-lib-fapolicyd-to-tmpfiles.patch delete mode 100644 fapolicyd-data-format.patch delete mode 100644 fapolicyd-infinite-loop.patch delete mode 100644 fapolicyd-normal-pattern.patch delete mode 100644 fapolicyd-nss-lookup.patch delete mode 100644 fapolicyd-rpm-loader.patch delete mode 100644 fapolicyd-rpm-v.patch delete mode 100644 fapolicyd-skip-nonregular.patch delete mode 100644 fapolicyd-socket-segfault.patch delete mode 100644 fapolicyd-uthash-bundle.patch delete mode 100644 selinux.patch delete mode 100644 var-run-selinux.patch delete mode 100644 var-run-t-dir-selinux.patch diff --git a/.gitignore b/.gitignore index 585fcd8..1623776 100644 --- a/.gitignore +++ b/.gitignore @@ -27,5 +27,7 @@ /fapolicyd-selinux-0.7.tar.gz /fapolicyd-1.3.7.tar.gz /fapolicyd-1.3.7.tar.gz.asc -/fapolicyd-selinux-0.9.tar.gz -/fapolicyd-selinux-0.9.tar.gz.asc +/fapolicyd-1.4.tar.gz +/fapolicyd-1.4.tar.gz.asc +/fapolicyd-selinux-1.0.tar.gz +/fapolicyd-selinux-1.0.tar.gz.asc diff --git a/0100-Allow-daemon-to-change-dir-attributes.patch b/0100-Allow-daemon-to-change-dir-attributes.patch deleted file mode 100644 index 6dddb3f..0000000 --- a/0100-Allow-daemon-to-change-dir-attributes.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 679385956d73f37bf1295a4f0bc38a87bcb7245e Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 17 Oct 2025 16:49:24 +0200 -Subject: [PATCH] Allow daemon to change dir attributes -Content-type: text/plain - -This is connected to: - -https://github.com/linux-application-whitelisting/fapolicyd/commit/c32b5baea4d371417c8259cce3a41d77d5cec1ad - -Originally introduced in commit 1db0e39fbd50, later poorly reverted due -to lint issues - -Signed-off-by: Radovan Sroka -Signed-off-by: Petr Lautrbach ---- - fapolicyd.te | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fapolicyd-selinux-0.9/fapolicyd.te b/fapolicyd-selinux-0.9/fapolicyd.te -index ef437295ec42..6edda3f64ef9 100644 ---- a/fapolicyd-selinux-0.9/fapolicyd.te -+++ b/fapolicyd-selinux-0.9/fapolicyd.te -@@ -40,6 +40,7 @@ gen_require(` - attribute file_type; - attribute filesystem_type; - attribute mountpoint; -+ type var_run_t; - ') - - ifdef(`watch_mount_dirs_pattern',` -@@ -54,6 +55,7 @@ ifdef(`fs_watch_all_fs',` - ') - - allow fapolicyd_t file_type : lnk_file { getattr read }; -+allow fapolicyd_t var_run_t:dir setattr; - - manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) - logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file) --- -2.51.0 - diff --git a/0101-Bring-back-var-run-contexts.patch b/0101-Bring-back-var-run-contexts.patch deleted file mode 100644 index e8fbb67..0000000 --- a/0101-Bring-back-var-run-contexts.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 6ae8cf688fb57f77a8793c8165296dab27134d82 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 22 Oct 2025 08:47:18 +0200 -Subject: [PATCH] Bring back /var/run/ contexts -Content-type: text/plain - -Commit 750c5e288f82 ("Rename all /var/run file context entries to /run") -removed all /var/run entries to follow /var/run -> /run change in -selinux-policy. This change has not been applied in c9s and so it's -necessary to provide also the original context mappings. - -Signed-off-by: Petr Lautrbach ---- - fapolicyd.fc | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/fapolicyd-selinux-0.9/fapolicyd.fc b/fapolicyd-selinux-0.9/fapolicyd.fc -index 1b9f649b4476..c7046776b266 100644 ---- a/fapolicyd-selinux-0.9/fapolicyd.fc -+++ b/fapolicyd-selinux-0.9/fapolicyd.fc -@@ -10,5 +10,7 @@ - /var/log/fapolicyd-access.log -- gen_context(system_u:object_r:fapolicyd_log_t,s0) - - /run/fapolicyd(/.*)? gen_context(system_u:object_r:fapolicyd_var_run_t,s0) -+/var/run/fapolicyd(/.*)? gen_context(system_u:object_r:fapolicyd_var_run_t,s0) - - /run/fapolicyd\.pid -- gen_context(system_u:object_r:fapolicyd_var_run_t,s0) -+/var/run/fapolicyd\.pid -- gen_context(system_u:object_r:fapolicyd_var_run_t,s0) --- -2.51.0 - diff --git a/Add-var-lib-fapolicyd-to-tmpfiles.patch b/Add-var-lib-fapolicyd-to-tmpfiles.patch deleted file mode 100644 index 4ea65dd..0000000 --- a/Add-var-lib-fapolicyd-to-tmpfiles.patch +++ /dev/null @@ -1,28 +0,0 @@ -From de7b5e953e56ecad497878d1113abd8c10d8a453 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 15 Aug 2025 12:38:04 +0200 -Subject: [PATCH] Add /var/lib/fapolicyd to tmpfiles -Content-type: text/plain - -On image based system, /var/lib/fapolicyd is not created during rpm -installation but needs to be created during boot using tmpfiles.d - -Fixes: - fapolicyd[1463]: Failed writing db version No such file or directory - -Signed-off-by: Petr Lautrbach ---- - init/fapolicyd-tmpfiles.conf | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/init/fapolicyd-tmpfiles.conf b/init/fapolicyd-tmpfiles.conf -index 24459d340d3c..84fbaa1cf6ed 100644 ---- a/init/fapolicyd-tmpfiles.conf -+++ b/init/fapolicyd-tmpfiles.conf -@@ -1,1 +1,3 @@ - d /run/fapolicyd 0770 root fapolicyd - -+d /var/lib/fapolicyd 770 root fapolicyd - -+Z /etc/fapolicyd - root fapolicyd - --- -2.50.1 - diff --git a/fapolicyd-data-format.patch b/fapolicyd-data-format.patch deleted file mode 100644 index c39fba8..0000000 --- a/fapolicyd-data-format.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 6ce38340bd0ed3863259224de613ef6a29ca9297 Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Sun, 20 Jul 2025 20:56:34 +0200 -Subject: [PATCH] ddasd - -Signed-off-by: Radovan Sroka ---- - src/library/fapolicyd-backend.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/library/fapolicyd-backend.h b/src/library/fapolicyd-backend.h -index 2844780..26f0a54 100644 ---- a/src/library/fapolicyd-backend.h -+++ b/src/library/fapolicyd-backend.h -@@ -32,7 +32,8 @@ - typedef enum { SRC_UNKNOWN, SRC_RPM, SRC_FILE_DB, SRC_DEB } trust_src_t; - - // source, size, sha --#define DATA_FORMAT "%u %lu %64s" -+// do not pad the hash value so SHA1 and SHA256 digests parse correctly -+#define DATA_FORMAT "%u %lu %s" - - typedef struct _backend - { --- -2.50.1 - diff --git a/fapolicyd-infinite-loop.patch b/fapolicyd-infinite-loop.patch deleted file mode 100644 index 87826b3..0000000 --- a/fapolicyd-infinite-loop.patch +++ /dev/null @@ -1,67 +0,0 @@ -From baf402ccaf16bc993ce34d4e4ed08aa283cd2c94 Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Fri, 18 Jul 2025 10:55:12 +0200 -Subject: [PATCH] Fix an infinite loop - -- either malloc fail or corruped data from lmdb can cause -"fapolicyd -D" to hang in infinite loop - -Signed-off-by: Radovan Sroka ---- - src/cli/fapolicyd-cli.c | 30 ++++++++++++++++-------------- - 1 file changed, 16 insertions(+), 14 deletions(-) - -diff --git a/src/cli/fapolicyd-cli.c b/src/cli/fapolicyd-cli.c -index 0c72733c..7eddf4e2 100644 ---- a/src/cli/fapolicyd-cli.c -+++ b/src/cli/fapolicyd-cli.c -@@ -185,33 +185,35 @@ static int do_dump_db(void) - goto txn_abort; - } - do { -- char *path, *data, sha[65]; -+ char *path = NULL, *data = NULL, sha[65]; - unsigned int tsource; - off_t size; - const char *source; - -- path = malloc(key.mv_size+1); -+ path = malloc(key.mv_size + 1); - if (!path) -- continue; -+ goto next_record; -+ - memcpy(path, key.mv_data, key.mv_size); - path[key.mv_size] = 0; -- data = malloc(val.mv_size+1); -- if (!data) { -- free(path); -- continue; -- } -+ data = malloc(val.mv_size + 1); -+ -+ if (!data) -+ goto next_record; -+ - memcpy(data, val.mv_data, val.mv_size); - data[val.mv_size] = 0; -- if (sscanf(data, DATA_FORMAT, &tsource, &size, sha) != 3) { -- free(data); -- free(path); -- continue; -- } -+ -+ if (sscanf(data, DATA_FORMAT, &tsource, &size, sha) != 3) -+ goto next_record; -+ - source = lookup_tsource(tsource); - printf("%s %s %lu %s\n", source, path, size, sha); -+ -+next_record: - free(data); - free(path); -- // Try to get the duplicate. If doesn't exist, get the next one -+ // Try to get the duplicate. If it doesn't exist, get the next one - rc = mdb_cursor_get(cursor, &key, &val, MDB_NEXT_DUP); - if (rc == MDB_NOTFOUND) - rc = mdb_cursor_get(cursor, &key, &val, MDB_NEXT_NODUP); diff --git a/fapolicyd-normal-pattern.patch b/fapolicyd-normal-pattern.patch deleted file mode 100644 index 59b4723..0000000 --- a/fapolicyd-normal-pattern.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 0b42573e129c8c095536e15b326fe76b87da2601 Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Fri, 28 Feb 2025 18:02:16 +0100 -Subject: [PATCH] Fix normal pattern handling - -Signed-off-by: Radovan Sroka ---- - src/library/rules.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/src/library/rules.c b/src/library/rules.c -index 849a6c39..7f8fc7f5 100644 ---- a/src/library/rules.c -+++ b/src/library/rules.c -@@ -406,9 +406,10 @@ static int assign_subject(lnode *n, int type, const char *ptr2, int lineno) - goto free_and_error; - } - -- if (strcmp(tmp, -- PATTERN_LD_SO_STR) == 0) { -+ if (strcmp(tmp, PATTERN_LD_SO_STR) == 0) { - n->s[i].val = PATTERN_LD_SO_VAL; -+ } else if (strcmp(tmp, PATTERN_NORMAL_STR) == 0) { -+ n->s[i].val = PATTERN_NORMAL_VAL; - } else if (strcmp(tmp, PATTERN_STATIC_STR) == 0) { - n->s[i].val = PATTERN_STATIC_VAL; - } else if (strcmp(tmp, PATTERN_LD_PRELOAD_STR) == 0) { diff --git a/fapolicyd-nss-lookup.patch b/fapolicyd-nss-lookup.patch deleted file mode 100644 index 1e4ed5b..0000000 --- a/fapolicyd-nss-lookup.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/init/fapolicyd.service b/init/fapolicyd.service -index 7eb2841a..a1b7da90 100644 ---- a/init/fapolicyd.service -+++ b/init/fapolicyd.service -@@ -1,6 +1,12 @@ -+# You should manage this file with systemctl edit utility and not manually -+ - [Unit] - Description=File Access Policy Daemon - DefaultDependencies=no -+# If rules need user/group lookup, create a drop-in to delay the startup after NSS lookup is available: -+# # mkdir -p /etc/systemd/system/fapolicyd.service.d -+# # echo -e "[Unit]\nAfter=nss-user-lookup.target local-fs.target systemd-tmpfiles-setup.service" > /etc/systemd/system/fapolicyd.service.d/nss-lookup.conf -+# # systemctl daemon-reload - After=local-fs.target systemd-tmpfiles-setup.service - Documentation=man:fapolicyd(8) - -@@ -12,8 +18,6 @@ PIDFile=/run/fapolicyd.pid - ExecStartPre=/usr/sbin/fagenrules - ExecStart=/usr/sbin/fapolicyd - Restart=on-abnormal --# Uncomment the following line if rules need user/group name lookup --#After=nss-user-lookup.target - - [Install] - WantedBy=multi-user.target diff --git a/fapolicyd-rpm-loader.patch b/fapolicyd-rpm-loader.patch deleted file mode 100644 index d55397d..0000000 --- a/fapolicyd-rpm-loader.patch +++ /dev/null @@ -1,309 +0,0 @@ -diff -up ./fapolicyd.spec.rpm-loader ./fapolicyd.spec ---- ./fapolicyd.spec.rpm-loader 2024-04-29 17:59:11.000000000 +0200 -+++ ./fapolicyd.spec 2025-05-18 20:11:39.722717947 +0200 -@@ -268,6 +268,7 @@ fi - %attr(644,root,root) %{_tmpfilesdir}/%{name}.conf - %attr(755,root,root) %{_sbindir}/%{name} - %attr(755,root,root) %{_sbindir}/%{name}-cli -+%attr(755,root,root) %{_sbindir}/%{name}-rpm-loader - %attr(755,root,root) %{_sbindir}/fagenrules - %attr(644,root,root) %{_mandir}/man8/* - %attr(644,root,root) %{_mandir}/man5/* -diff -up ./src/daemon/fapolicyd.c.rpm-loader ./src/daemon/fapolicyd.c ---- ./src/daemon/fapolicyd.c.rpm-loader 2025-05-18 20:11:39.721683468 +0200 -+++ ./src/daemon/fapolicyd.c 2025-05-18 20:11:39.722858226 +0200 -@@ -105,17 +105,19 @@ static void install_syscall_filter(void) - ctx = seccomp_init(SCMP_ACT_ALLOW); - if (ctx == NULL) - goto err_out; -- -+#ifndef USE_RPM - rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), - SCMP_SYS(execve), 0); - if (rc < 0) - goto err_out; --#ifdef HAVE_FEXECVE --# ifdef __NR_fexecve -+ -+# ifdef HAVE_FEXECVE -+# ifdef __NR_fexecve - rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), - SCMP_SYS(fexecve), 0); - if (rc < 0) - goto err_out; -+# endif - # endif - #endif - rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EIO), -diff -up ./src/handler/fapolicyd-rpm-loader.c.rpm-loader ./src/handler/fapolicyd-rpm-loader.c ---- ./src/handler/fapolicyd-rpm-loader.c.rpm-loader 2025-05-18 20:11:39.722986504 +0200 -+++ ./src/handler/fapolicyd-rpm-loader.c 2025-05-18 20:13:48.417481732 +0200 -@@ -0,0 +1,85 @@ -+/* -+ * fapolicy-rpm-loader.c - loader tool for fapolicyd -+ * Copyright (c) 2025-2025 Red Hat Inc. -+ * All Rights Reserved. -+ * -+ * This software may be freely redistributed and/or modified under the -+ * terms of the GNU General Public License as published by the Free -+ * Software Foundation; either version 2, or (at your option) any -+ * later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program; see the file COPYING. If not, write to the -+ * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor -+ * Boston, MA 02110-1335, USA. -+ * -+ * Authors: -+ * Radovan Sroka -+ */ -+ -+#include "config.h" -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "backend-manager.h" -+#include "daemon-config.h" -+#include "message.h" -+#include "llist.h" -+#include "fd-fgets.h" -+#include "paths.h" -+ -+volatile atomic_bool stop = 0; // Library needs this -+unsigned int debug_mode = 0; // Library needs this -+unsigned int permissive = 0; // Library needs this -+ -+ -+int do_rpm_init_backend(void); -+int do_rpm_load_list(conf_t * conf); -+int do_rpm_destroy_backend(void); -+ -+extern backend rpm_backend; -+ -+int main(int argc, char * const argv[]) -+{ -+ -+ set_message_mode(MSG_STDERR, DBG_YES); -+ -+ conf_t config; -+ -+ load_daemon_config(&config); -+ -+ do_rpm_init_backend(); -+ do_rpm_load_list(&config); -+ -+ msg(LOG_INFO, "Loaded files %ld", rpm_backend.list.count); -+ -+ list_item_t *item = list_get_first(&rpm_backend.list); -+ for (; item != NULL; item = item->next) { -+ printf("%s %s\n", (const char*)item->index, (const char*)item->data); -+ } -+ -+ do_rpm_destroy_backend(); -+ -+ free_daemon_config(&config); -+ return 0; -+} -+ -diff -up ./src/library/rpm-backend.c.rpm-loader ./src/library/rpm-backend.c ---- ./src/library/rpm-backend.c.rpm-loader 2025-05-18 20:11:39.718862697 +0200 -+++ ./src/library/rpm-backend.c 2025-05-18 20:11:39.723077584 +0200 -@@ -23,8 +23,11 @@ - */ - - #include "config.h" -+#include - #include - #include -+#include -+#include - #include - #include - #include -@@ -37,11 +40,16 @@ - - #include "message.h" - #include "gcc-attributes.h" -+#include "fd-fgets.h" - #include "fapolicyd-backend.h" - #include "llist.h" - - #include "filter.h" - -+int do_rpm_init_backend(void); -+int do_rpm_load_list(const conf_t *); -+int do_rpm_destroy_backend(void); -+ - static int rpm_init_backend(void); - static int rpm_load_list(const conf_t *); - static int rpm_destroy_backend(void); -@@ -183,9 +191,104 @@ struct _hash_record { - UT_hash_handle hh; - }; - --extern unsigned int debug_mode; -+#define BUFFER_SIZE 4096 -+#define MAX_DELIMS 3 - static int rpm_load_list(const conf_t *conf) - { -+ int pipefd[2]; -+ if (pipe(pipefd) == -1) { -+ perror("pipe failed"); -+ return 1; -+ } -+ // we well read stdout later -+ // there will be data from rpmdb -+ posix_spawn_file_actions_t actions; -+ posix_spawn_file_actions_init(&actions); -+ posix_spawn_file_actions_addclose(&actions, pipefd[0]); -+ posix_spawn_file_actions_adddup2(&actions, pipefd[1], STDOUT_FILENO); -+ posix_spawn_file_actions_addclose(&actions, pipefd[1]); -+ -+ char *argv[] = { NULL }; -+ char *custom_env[] = { NULL }; -+ -+ pid_t pid = -1; -+ // int status = posix_spawn(&pid, "/home/rsroka/Work/fapolicyd-upstream-fork2/src/fapolicyd-rpm-loader", &actions, NULL, argv, custom_env); -+ int status = posix_spawn(&pid, "/usr/sbin/fapolicyd-rpm-loader", &actions, NULL, argv, custom_env); -+ -+ -+ close(pipefd[1]); // Parent doesn't write -+ -+ if (status == 0) { -+ msg(LOG_DEBUG, "fapolicyd-rpm-loader spawned with pid: %d", pid); -+ -+ char buff[BUFFER_SIZE]; -+ fd_fgets_context_t * fd_fgets_context = fd_fgets_init(); -+ do { -+ fd_fgets_rewind(fd_fgets_context); -+ int res = fd_fgets(fd_fgets_context, buff, sizeof(buff), pipefd[0]); -+ if (res == -1) -+ break; -+ else if (res > 0) { -+ char* end = strchr(buff, '\n'); -+ -+ if (end == NULL) { -+ msg(LOG_ERR, "Too long line?"); -+ continue; -+ } -+ -+ int size = end - buff; -+ *end = '\0'; -+ -+ // it's better to parse it from the end because there can be space in file name -+ int delims = 0; -+ char * delim = NULL; -+ for (int i = size-1 ; i >= 0 ; i--) { -+ if (isspace(buff[i])) { -+ delim = &buff[i]; -+ delims++; -+ } -+ -+ if (delims >= MAX_DELIMS) { -+ buff[i] = '\0'; -+ break; -+ } -+ } -+ -+ char * index = strdup(buff); -+ char * data = strdup(delim + 1); -+ if (!index || !data) { -+ free(index); -+ free(data); -+ continue; -+ } -+ -+ list_append(&rpm_backend.list, index, data); -+ } -+ } while(!fd_fgets_eof(fd_fgets_context)); -+ -+ fd_fgets_destroy(fd_fgets_context); -+ -+ close(pipefd[0]); -+ waitpid(pid, NULL, 0); -+ -+ } else { -+ msg(LOG_ERR, "posix_spawn failed: %s\n", strerror(status)); -+ } -+ -+ posix_spawn_file_actions_destroy(&actions); -+ -+ if (rpm_backend.list.count == 0) { -+ msg(LOG_DEBUG, "Recieved 0 files from rpmdb loader"); -+ return 1; -+ } -+ -+ return 0; -+} -+ -+// this function is used in fapolicyd-rpm-loader -+extern unsigned int debug_mode; -+int do_rpm_load_list(const conf_t *conf) -+{ - int rc; - unsigned int msg_count = 0; - -@@ -298,6 +401,14 @@ static int rpm_load_list(const conf_t *c - - static int rpm_init_backend(void) - { -+ list_init(&rpm_backend.list); -+ -+ return 0; -+} -+ -+// this function is used in fapolicyd-rpm-loader -+int do_rpm_init_backend(void) -+{ - if (filter_init()) - return 1; - -@@ -318,3 +429,10 @@ static int rpm_destroy_backend(void) - list_empty(&rpm_backend.list); - return 0; - } -+ -+// this function is used in fapolicyd-rpm-loader -+int do_rpm_destroy_backend(void) -+{ -+ list_empty(&rpm_backend.list); -+ return 0; -+} -diff -up ./src/Makefile.am.rpm-loader ./src/Makefile.am ---- ./src/Makefile.am.rpm-loader 2025-05-18 20:11:39.718965116 +0200 -+++ ./src/Makefile.am 2025-05-18 20:11:39.723185202 +0200 -@@ -75,6 +75,15 @@ libfapolicyd_la_SOURCES += \ - library/filter.c \ - library/filter.h - -+sbin_PROGRAMS += fapolicyd-rpm-loader -+ -+fapolicyd_rpm_loader_SOURCES = \ -+ handler/fapolicyd-rpm-loader.c -+ -+fapolicyd_rpm_loader_CFLAGS = $(fapolicyd_CFLAGS) -+fapolicyd_rpm_loader_LDFLAGS = $(fapolicyd_LDFLAGS) -+ -+fapolicyd_rpm_loader_LDADD = libfapolicyd.la - endif - - if WITH_DEB diff --git a/fapolicyd-rpm-v.patch b/fapolicyd-rpm-v.patch deleted file mode 100644 index 78fb1d7..0000000 --- a/fapolicyd-rpm-v.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 686096c400587d5f28e041c4ebb58e07e4d7b3fc Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Wed, 20 Nov 2024 14:30:14 +0100 -Subject: [PATCH] Fix creation of RUN_DIR because it breaks rpm verify - -Signed-off-by: Radovan Sroka ---- - src/library/database.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/src/library/database.c b/src/library/database.c -index 44dd0b2b..d89b16c1 100644 ---- a/src/library/database.c -+++ b/src/library/database.c -@@ -122,6 +122,19 @@ int preconstruct_fifo(const conf_t *config) - strerror_r(errno, err_buff, BUFFER_SIZE)); - return 1; - } else { -+ -+ if ((chmod(RUN_DIR, 0770))) { -+ msg(LOG_ERR, "Failed to fix mode of dir %s (%s)", -+ RUN_DIR, strerror_r(errno, err_buff, BUFFER_SIZE)); -+ return 1; -+ } -+ -+ if ((chown(RUN_DIR, 0, config->gid))) { -+ msg(LOG_ERR, "Failed to fix ownership of dir %s (%s)", -+ RUN_DIR, strerror_r(errno, err_buff, BUFFER_SIZE)); -+ return 1; -+ } -+ - /* Make sure that there is no such file/fifo */ - unlink_fifo(); - } diff --git a/fapolicyd-skip-nonregular.patch b/fapolicyd-skip-nonregular.patch deleted file mode 100644 index 9d25230..0000000 --- a/fapolicyd-skip-nonregular.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 508805c9f47ca22695fd7a265668f99e9258ea27 Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Thu, 24 Jul 2025 15:30:06 +0200 -Subject: [PATCH] Skip to add non regular files to trustdb - -- it does not make any sense to have them in the trustdb -- the patch should be fix potential error when reading nonregular files - -Signed-off-by: Radovan Sroka ---- - src/cli/file-cli.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c -index 7deec39c..ae326c14 100644 ---- a/src/cli/file-cli.c -+++ b/src/cli/file-cli.c -@@ -67,7 +67,7 @@ static int ftw_add_list_append(const char *fpath, - */ - static int add_list_load_path(const char *path) - { -- int fd = open(path, O_RDONLY); -+ int fd = open(path, O_RDONLY|O_NONBLOCK); - if (fd < 0) { - msg(LOG_ERR, "Cannot open %s", path); - return 1; -@@ -83,8 +83,11 @@ static int add_list_load_path(const char *path) - - if (S_ISDIR(sb.st_mode)) - nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS); -- else -+ else if (S_ISREG(sb.st_mode)) { - list_append(&add_list, strdup(path), NULL); -+ } else { -+ msg(LOG_INFO, "Skipping non regular file: %s", path); -+ } - - return 0; - } diff --git a/fapolicyd-socket-segfault.patch b/fapolicyd-socket-segfault.patch deleted file mode 100644 index 33c2c65..0000000 --- a/fapolicyd-socket-segfault.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 73770c9111800cb5a1e62203e460ae9149307d49 Mon Sep 17 00:00:00 2001 -From: Radovan Sroka -Date: Mon, 28 Jul 2025 18:44:08 +0200 -Subject: [PATCH] Fix segfault when socket is inside of the directory - -$ socat UNIX-LISTEN:"/home/rsroka/dir/socket" /dev/null & - -[ ERROR ]: Cannot open /home/rsroka/dir/socket -Program received signal SIGSEGV, Segmentation fault. - -Signed-off-by: Radovan Sroka ---- - src/cli/file-cli.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c -index ae326c14..655e8f15 100644 ---- a/src/cli/file-cli.c -+++ b/src/cli/file-cli.c -@@ -53,8 +53,13 @@ static int ftw_add_list_append(const char *fpath, - int typeflag, - struct FTW *ftwbuf __attribute__ ((unused))) - { -- if (typeflag == FTW_F) -- list_append(&add_list, strdup(fpath), NULL); -+ if (typeflag == FTW_F) { -+ if (S_ISREG(sb->st_mode)) { -+ list_append(&add_list, strdup(fpath), NULL); -+ } else { -+ msg(LOG_INFO, "Skipping non regular file: %s", fpath); -+ } -+ } - return FTW_CONTINUE; - } - -@@ -83,11 +88,8 @@ static int add_list_load_path(const char *path) - - if (S_ISDIR(sb.st_mode)) - nftw(path, &ftw_add_list_append, FTW_NOPENFD, FTW_FLAGS); -- else if (S_ISREG(sb.st_mode)) { -+ else - list_append(&add_list, strdup(path), NULL); -- } else { -- msg(LOG_INFO, "Skipping non regular file: %s", path); -- } - - return 0; - } diff --git a/fapolicyd-uthash-bundle.patch b/fapolicyd-uthash-bundle.patch deleted file mode 100644 index 13f7662..0000000 --- a/fapolicyd-uthash-bundle.patch +++ /dev/null @@ -1,39 +0,0 @@ -diff -up ./configure.ac.uthash ./configure.ac ---- ./configure.ac.uthash 2022-09-27 16:34:59.000000000 +0200 -+++ ./configure.ac 2022-09-29 11:57:26.297879027 +0200 -@@ -162,10 +162,6 @@ AC_CHECK_HEADER(sys/fanotify.h, , [AC_MS - ["Couldn't find sys/fanotify.h...your kernel might not be new enough"] )]) - AC_CHECK_FUNCS(fexecve, [], []) - AC_CHECK_FUNCS([gettid]) --AC_CHECK_HEADER(uthash.h, , [AC_MSG_ERROR( --["Couldn't find uthash.h...uthash-devel is missing"] )]) -- -- - echo . - echo Checking for required libraries - AC_CHECK_LIB(udev, udev_device_get_devnode, , [AC_MSG_ERROR([libudev not found])], -ludev) -diff -up ./src/library/rpm-backend.c.uthash ./src/library/rpm-backend.c ---- ./src/library/rpm-backend.c.uthash 2022-09-29 11:57:26.297879027 +0200 -+++ ./src/library/rpm-backend.c 2022-09-29 11:58:45.470119807 +0200 -@@ -33,7 +33,7 @@ - #include - #include - --#include -+#include "uthash.h" - - #include "message.h" - #include "gcc-attributes.h" -diff -up ./src/Makefile.am.uthash ./src/Makefile.am ---- ./src/Makefile.am.uthash 2022-09-27 16:34:59.000000000 +0200 -+++ ./src/Makefile.am 2022-09-29 11:57:26.297879027 +0200 -@@ -5,6 +5,9 @@ AM_CPPFLAGS = \ - -I${top_srcdir} \ - -I${top_srcdir}/src/library - -+AM_CPPFLAGS += \ -+ -I${top_srcdir}/uthash-2.3.0/include -+ - sbin_PROGRAMS = fapolicyd fapolicyd-cli - lib_LTLIBRARIES= libfapolicyd.la - diff --git a/fapolicyd.spec b/fapolicyd.spec index bcf4d2c..36176e1 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.9 +%define semodule_version 1.0 Summary: Application Whitelisting Daemon Name: fapolicyd -Version: 1.3.7 +Version: 1.4 Release: 1%{?dist} License: GPL-3.0-or-later URL: https://github.com/linux-application-whitelisting/fapolicyd @@ -18,13 +18,11 @@ Source11: https://github.com/linux-application-whitelisting/%{name}-selinux/rele Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#/uthash-2.3.0.tar.gz # https://github.com/linux-application-whitelisting/fapolicyd -# $ git format-patch -N v1.3.7 +# $ git format-patch -N v1.4 # https://github.com/linux-application-whitelisting/fapolicyd-selinux -# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-0.9/ --dst-prefix=b/fapolicyd-selinux-0.9/ v0.9 +# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-0.9/ --dst-prefix=b/fapolicyd-selinux-1.0/ v1.0 # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0100: 0100-Allow-daemon-to-change-dir-attributes.patch -Patch0101: 0101-Bring-back-var-run-contexts.patch # Patch list end BuildRequires: gcc @@ -279,6 +277,9 @@ fi %selinux_relabel_post -s %{selinuxtype} %changelog +* Thu Oct 30 2025 Petr Lautrbach - 1.4-1 +- fapolicyd-1.4 and fapolicyd-selinux-1.0 + * Thu Oct 16 2025 Petr Lautrbach - 1.3.7-1 - fapolicyd-1.3.7 and fapolicyd-selinux-0.9 diff --git a/selinux.patch b/selinux.patch deleted file mode 100644 index e95313a..0000000 --- a/selinux.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up ./fapolicyd-selinux-0.7/fapolicyd.te.fix ./fapolicyd-selinux-0.7/fapolicyd.te ---- ./fapolicyd-selinux-0.7/fapolicyd.te.fix 2023-06-15 17:11:47.964646794 +0200 -+++ ./fapolicyd-selinux-0.7/fapolicyd.te 2023-06-15 17:13:10.426477653 +0200 -@@ -50,6 +50,9 @@ ifdef(`watch_mount_dirs_pattern',` - - ifdef(`fs_watch_all_fs',` - fs_watch_all_fs(fapolicyd_t) -+') -+ -+ifdef(`files_watch_sb_all_mountpoints',` - files_watch_sb_all_mountpoints(fapolicyd_t) - ') - diff --git a/sources b/sources index a29cad1..9eb2b1f 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (fapolicyd-1.3.7.tar.gz) = eb66e279377ed33763b9d64c0b0115a0ff37b20a08e47e41c920e30bcf39088781d0cede107b16af22ddf3fec3e48c35ea8dbc24b4e1c9e09ff0b99269d46775 -SHA512 (fapolicyd-1.3.7.tar.gz.asc) = f17504b3b3270e1c37f162c23cbc179b4fbe26ceaca3a06097980e3ed37d9aef3ecaec3e530effed9d09ffec3c7f7f6ef274d3659284ccc72dad29bd2ee1b51e -SHA512 (fapolicyd-selinux-0.9.tar.gz) = 6b1c5af84bb5cbae225f236350931bdf9579771bd116adf9a1c1d900536c74dc873470c08ce55bdda0c71861f12044dd9702ceef5799449c35e4e78f236146e2 -SHA512 (fapolicyd-selinux-0.9.tar.gz.asc) = 79e14b6109367bc2fa7f7a2521927077e39c34049ec50e66d00f1758b907e95e42a6bc63440a1a5c791dcd7ac8970e9096e8fd93324ae1b1256c74f8284924c4 +SHA512 (fapolicyd-1.4.tar.gz) = c8e98192930eecb04eb4dd0f82eaaea72a307883c69e829f1801232ef71b493a0fcac39c8a2ce8dbd7253aa7566853b0404de150b8b0de7002e8226d2bf71334 +SHA512 (fapolicyd-1.4.tar.gz.asc) = 0e2df3d425aeec2f3b5e4a8c4c93601816f06ac874ab124bcc8af53bedc56e07bae4cc11c9c9b9bbd0e990b595f93e6738897c43042743ac2f64416b4d7f72e9 +SHA512 (fapolicyd-selinux-1.0.tar.gz) = 3c044b7570e2d5b990fcf85695e00526f3fd3c141d3d9b36209ee740f94031cb0a409a6887697f5b7a70f21a7c8fea2caab42eee605ba4b74d8b4a2fa1d8fa4a +SHA512 (fapolicyd-selinux-1.0.tar.gz.asc) = caf55ef941587b10e62a9ed99b92dcf1dad32a444b80a5688899dbb49c4ee7ea0ff5d661c50e7403e38b1ab592cc893d907174f7ee071a10f7afcaeb6aa50858 SHA512 (uthash-2.3.0.tar.gz) = 3b01f1074790fb242900411cb16eb82c1a9afcf58e3196a0f4611d9d7ef94690ad38c0a500e7783d3efa20328aa8d6ab14f246be63b3b3d385502ba2b6b2a294 diff --git a/var-run-selinux.patch b/var-run-selinux.patch deleted file mode 100644 index 511fe00..0000000 --- a/var-run-selinux.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 750c5e288f8253c71a9722da960addb078aee93c Mon Sep 17 00:00:00 2001 -From: Zdenek Pytela -Date: Tue, 6 Feb 2024 21:17:27 +0100 -Subject: [PATCH] Rename all /var/run file context entries to /run - -With the 1f76e522a ("Rename all /var/run file context entries to /run") -selinux-policy commit, all /var/run file context entries moved to /run -and the equivalency was inverted. Subsequently, changes in fapolicyd.fc -need to be done, too, in a similar manner. ---- - fapolicyd.fc | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/fapolicyd-selinux-0.7/fapolicyd.fc b/fapolicyd-selinux-0.7/fapolicyd.fc -index 2bdc7aa..d081dc8 100644 ---- a/fapolicyd-selinux-0.7/fapolicyd.fc -+++ b/fapolicyd-selinux-0.7/fapolicyd.fc -@@ -8,6 +8,6 @@ - - /var/log/fapolicyd-access.log -- gen_context(system_u:object_r:fapolicyd_log_t,s0) - --/var/run/fapolicyd(/.*)? gen_context(system_u:object_r:fapolicyd_var_run_t,s0) -+/run/fapolicyd(/.*)? gen_context(system_u:object_r:fapolicyd_var_run_t,s0) - --/var/run/fapolicyd\.pid -- gen_context(system_u:object_r:fapolicyd_var_run_t,s0) -+/run/fapolicyd\.pid -- gen_context(system_u:object_r:fapolicyd_var_run_t,s0) diff --git a/var-run-t-dir-selinux.patch b/var-run-t-dir-selinux.patch deleted file mode 100644 index dfd8a6a..0000000 --- a/var-run-t-dir-selinux.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -up ./fapolicyd-selinux-0.7/fapolicyd.te.var_run_dir ./fapolicyd-selinux-0.7/fapolicyd.te ---- ./fapolicyd-selinux-0.7/fapolicyd.te.var_run_dir 2025-07-20 21:08:05.054395347 +0200 -+++ ./fapolicyd-selinux-0.7/fapolicyd.te 2025-07-20 21:08:28.240293532 +0200 -@@ -57,6 +57,7 @@ ifdef(`files_watch_sb_all_mountpoints',` - ') - - allow fapolicyd_t file_type : lnk_file { getattr read }; -+allow fapolicyd_t var_run_t:dir setattr; - - manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t) - logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)