import libselinux-2.9-1.el8
This commit is contained in:
commit
20bf07fc98
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
SOURCES/libselinux-2.9.tar.gz
|
1
.libselinux.metadata
Normal file
1
.libselinux.metadata
Normal file
@ -0,0 +1 @@
|
|||||||
|
c53911ee9da673f7653ab1afe66c0b2bf5fb5ac9 SOURCES/libselinux-2.9.tar.gz
|
@ -0,0 +1,31 @@
|
|||||||
|
From f71fc47524bef3c4cd8a412e43d13daebd1c418b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Miroslav Grepl <mgrepl@redhat.com>
|
||||||
|
Date: Wed, 16 Jul 2014 08:28:03 +0200
|
||||||
|
Subject: [PATCH 1/5] Fix selinux man page to refer seinfo and sesearch tools.
|
||||||
|
|
||||||
|
---
|
||||||
|
libselinux/man/man8/selinux.8 | 4 +++-
|
||||||
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
|
||||||
|
index e37aee68..bf23b655 100644
|
||||||
|
--- a/libselinux/man/man8/selinux.8
|
||||||
|
+++ b/libselinux/man/man8/selinux.8
|
||||||
|
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||||
|
.BR sepolicy (8),
|
||||||
|
.BR system-config-selinux (8),
|
||||||
|
.BR togglesebool (8),
|
||||||
|
-.BR restorecon (8),
|
||||||
|
.BR fixfiles (8),
|
||||||
|
+.BR restorecon (8),
|
||||||
|
.BR setfiles (8),
|
||||||
|
.BR semanage (8),
|
||||||
|
.BR sepolicy (8)
|
||||||
|
+.BR seinfo (8),
|
||||||
|
+.BR sesearch (8)
|
||||||
|
|
||||||
|
Every confined service on the system has a man page in the following format:
|
||||||
|
.br
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
@ -0,0 +1,214 @@
|
|||||||
|
From ad3d3a0bf819f5895a6884357c2d0e18ea1ef314 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Dan Walsh <dwalsh@redhat.com>
|
||||||
|
Date: Mon, 23 Dec 2013 09:50:54 -0500
|
||||||
|
Subject: [PATCH 2/5] Verify context input to funtions to make sure the context
|
||||||
|
field is not null.
|
||||||
|
|
||||||
|
Return errno EINVAL, to prevent segfault.
|
||||||
|
|
||||||
|
Rejected by upstream https://marc.info/?l=selinux&m=145036088424584&w=2
|
||||||
|
|
||||||
|
FIXME: use __attribute__(nonnull (arg-index, ...))
|
||||||
|
---
|
||||||
|
libselinux/src/avc_sidtab.c | 5 +++++
|
||||||
|
libselinux/src/canonicalize_context.c | 5 +++++
|
||||||
|
libselinux/src/check_context.c | 5 +++++
|
||||||
|
libselinux/src/compute_av.c | 5 +++++
|
||||||
|
libselinux/src/compute_create.c | 5 +++++
|
||||||
|
libselinux/src/compute_member.c | 5 +++++
|
||||||
|
libselinux/src/compute_relabel.c | 5 +++++
|
||||||
|
libselinux/src/compute_user.c | 5 +++++
|
||||||
|
libselinux/src/fsetfilecon.c | 8 ++++++--
|
||||||
|
libselinux/src/lsetfilecon.c | 9 +++++++--
|
||||||
|
libselinux/src/setfilecon.c | 8 ++++++--
|
||||||
|
11 files changed, 59 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c
|
||||||
|
index 9669264d..c7754305 100644
|
||||||
|
--- a/libselinux/src/avc_sidtab.c
|
||||||
|
+++ b/libselinux/src/avc_sidtab.c
|
||||||
|
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
|
||||||
|
int hvalue, rc = 0;
|
||||||
|
struct sidtab_node *cur;
|
||||||
|
|
||||||
|
+ if (! ctx) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
*sid = NULL;
|
||||||
|
hvalue = sidtab_hash(ctx);
|
||||||
|
|
||||||
|
diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
|
||||||
|
index ba4c9a2c..c8158725 100644
|
||||||
|
--- a/libselinux/src/canonicalize_context.c
|
||||||
|
+++ b/libselinux/src/canonicalize_context.c
|
||||||
|
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
|
||||||
|
size_t size;
|
||||||
|
int fd, ret;
|
||||||
|
|
||||||
|
+ if (! con) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!selinux_mnt) {
|
||||||
|
errno = ENOENT;
|
||||||
|
return -1;
|
||||||
|
diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c
|
||||||
|
index 8a7997f0..5be84348 100644
|
||||||
|
--- a/libselinux/src/check_context.c
|
||||||
|
+++ b/libselinux/src/check_context.c
|
||||||
|
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
|
||||||
|
char path[PATH_MAX];
|
||||||
|
int fd, ret;
|
||||||
|
|
||||||
|
+ if (! con) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!selinux_mnt) {
|
||||||
|
errno = ENOENT;
|
||||||
|
return -1;
|
||||||
|
diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
|
||||||
|
index a47cffe9..6d285a2e 100644
|
||||||
|
--- a/libselinux/src/compute_av.c
|
||||||
|
+++ b/libselinux/src/compute_av.c
|
||||||
|
@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon,
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if ((! scon) || (! tcon)) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
snprintf(path, sizeof path, "%s/access", selinux_mnt);
|
||||||
|
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||||
|
if (fd < 0)
|
||||||
|
diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
|
||||||
|
index 0975aeac..3e6a48c1 100644
|
||||||
|
--- a/libselinux/src/compute_create.c
|
||||||
|
+++ b/libselinux/src/compute_create.c
|
||||||
|
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if ((! scon) || (! tcon)) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
snprintf(path, sizeof path, "%s/create", selinux_mnt);
|
||||||
|
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||||
|
if (fd < 0)
|
||||||
|
diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
|
||||||
|
index 4e2d221e..d1dd9772 100644
|
||||||
|
--- a/libselinux/src/compute_member.c
|
||||||
|
+++ b/libselinux/src/compute_member.c
|
||||||
|
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if ((! scon) || (! tcon)) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
snprintf(path, sizeof path, "%s/member", selinux_mnt);
|
||||||
|
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||||
|
if (fd < 0)
|
||||||
|
diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
|
||||||
|
index 49f77ef3..c3db7c0a 100644
|
||||||
|
--- a/libselinux/src/compute_relabel.c
|
||||||
|
+++ b/libselinux/src/compute_relabel.c
|
||||||
|
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if ((! scon) || (! tcon)) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
|
||||||
|
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||||
|
if (fd < 0)
|
||||||
|
diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
|
||||||
|
index 7b881215..401fd107 100644
|
||||||
|
--- a/libselinux/src/compute_user.c
|
||||||
|
+++ b/libselinux/src/compute_user.c
|
||||||
|
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (! scon) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
snprintf(path, sizeof path, "%s/user", selinux_mnt);
|
||||||
|
fd = open(path, O_RDWR | O_CLOEXEC);
|
||||||
|
if (fd < 0)
|
||||||
|
diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c
|
||||||
|
index 52707d05..0cbe12d8 100644
|
||||||
|
--- a/libselinux/src/fsetfilecon.c
|
||||||
|
+++ b/libselinux/src/fsetfilecon.c
|
||||||
|
@@ -9,8 +9,12 @@
|
||||||
|
|
||||||
|
int fsetfilecon_raw(int fd, const char * context)
|
||||||
|
{
|
||||||
|
- int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||||
|
- 0);
|
||||||
|
+ int rc;
|
||||||
|
+ if (! context) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+ rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||||
|
if (rc < 0 && errno == ENOTSUP) {
|
||||||
|
char * ccontext = NULL;
|
||||||
|
int err = errno;
|
||||||
|
diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c
|
||||||
|
index 1d3b28a1..ea6d70b7 100644
|
||||||
|
--- a/libselinux/src/lsetfilecon.c
|
||||||
|
+++ b/libselinux/src/lsetfilecon.c
|
||||||
|
@@ -9,8 +9,13 @@
|
||||||
|
|
||||||
|
int lsetfilecon_raw(const char *path, const char * context)
|
||||||
|
{
|
||||||
|
- int rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||||
|
- 0);
|
||||||
|
+ int rc;
|
||||||
|
+ if (! context) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||||
|
if (rc < 0 && errno == ENOTSUP) {
|
||||||
|
char * ccontext = NULL;
|
||||||
|
int err = errno;
|
||||||
|
diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c
|
||||||
|
index d05969c6..3f0200e8 100644
|
||||||
|
--- a/libselinux/src/setfilecon.c
|
||||||
|
+++ b/libselinux/src/setfilecon.c
|
||||||
|
@@ -9,8 +9,12 @@
|
||||||
|
|
||||||
|
int setfilecon_raw(const char *path, const char * context)
|
||||||
|
{
|
||||||
|
- int rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
|
||||||
|
- 0);
|
||||||
|
+ int rc;
|
||||||
|
+ if (! context) {
|
||||||
|
+ errno=EINVAL;
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+ rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
|
||||||
|
if (rc < 0 && errno == ENOTSUP) {
|
||||||
|
char * ccontext = NULL;
|
||||||
|
int err = errno;
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
@ -0,0 +1,39 @@
|
|||||||
|
From 431f72836d6c02450725cf6ffb1c7223b9fa6acc Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Mon, 11 Mar 2019 15:26:43 +0100
|
||||||
|
Subject: [PATCH 3/5] libselinux: Allow to override OVERRIDE_GETTID from
|
||||||
|
command line
|
||||||
|
|
||||||
|
$ make CFLAGS="$CFLAGS -DOVERRIDE_GETTID=0" ...
|
||||||
|
|
||||||
|
Drop this as soon as glibc-2.30 will become real 2.30 version, see
|
||||||
|
https://bugzilla.redhat.com/show_bug.cgi?id=1685594
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
libselinux/src/procattr.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libselinux/src/procattr.c b/libselinux/src/procattr.c
|
||||||
|
index c6799ef2..cbb6824e 100644
|
||||||
|
--- a/libselinux/src/procattr.c
|
||||||
|
+++ b/libselinux/src/procattr.c
|
||||||
|
@@ -24,6 +24,7 @@ static __thread char destructor_initialized;
|
||||||
|
|
||||||
|
/* Bionic and glibc >= 2.30 declare gettid() system call wrapper in unistd.h and
|
||||||
|
* has a definition for it */
|
||||||
|
+#ifndef OVERRIDE_GETTID
|
||||||
|
#ifdef __BIONIC__
|
||||||
|
#define OVERRIDE_GETTID 0
|
||||||
|
#elif !defined(__GLIBC_PREREQ)
|
||||||
|
@@ -33,6 +34,7 @@ static __thread char destructor_initialized;
|
||||||
|
#else
|
||||||
|
#define OVERRIDE_GETTID 0
|
||||||
|
#endif
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
#if OVERRIDE_GETTID
|
||||||
|
static pid_t gettid(void)
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
@ -0,0 +1,55 @@
|
|||||||
|
From dca54ca1a8ab0b256e7834f7f5e97375427fbfd9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Wed, 27 Feb 2019 09:37:17 +0100
|
||||||
|
Subject: [PATCH 4/5] Bring some old permission and flask constants back to
|
||||||
|
Python bindings
|
||||||
|
|
||||||
|
---
|
||||||
|
libselinux/src/selinuxswig.i | 4 ++++
|
||||||
|
libselinux/src/selinuxswig_python.i | 3 ++-
|
||||||
|
2 files changed, 6 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libselinux/src/selinuxswig.i b/libselinux/src/selinuxswig.i
|
||||||
|
index dbdb4c3d..9c5b9263 100644
|
||||||
|
--- a/libselinux/src/selinuxswig.i
|
||||||
|
+++ b/libselinux/src/selinuxswig.i
|
||||||
|
@@ -5,7 +5,9 @@
|
||||||
|
%module selinux
|
||||||
|
%{
|
||||||
|
#include "../include/selinux/avc.h"
|
||||||
|
+ #include "../include/selinux/av_permissions.h"
|
||||||
|
#include "../include/selinux/context.h"
|
||||||
|
+ #include "../include/selinux/flask.h"
|
||||||
|
#include "../include/selinux/get_context_list.h"
|
||||||
|
#include "../include/selinux/get_default_type.h"
|
||||||
|
#include "../include/selinux/label.h"
|
||||||
|
@@ -58,7 +60,9 @@
|
||||||
|
%ignore avc_netlink_check_nb;
|
||||||
|
|
||||||
|
%include "../include/selinux/avc.h"
|
||||||
|
+%include "../include/selinux/av_permissions.h"
|
||||||
|
%include "../include/selinux/context.h"
|
||||||
|
+%include "../include/selinux/flask.h"
|
||||||
|
%include "../include/selinux/get_context_list.h"
|
||||||
|
%include "../include/selinux/get_default_type.h"
|
||||||
|
%include "../include/selinux/label.h"
|
||||||
|
diff --git a/libselinux/src/selinuxswig_python.i b/libselinux/src/selinuxswig_python.i
|
||||||
|
index 4c73bf92..6eaab081 100644
|
||||||
|
--- a/libselinux/src/selinuxswig_python.i
|
||||||
|
+++ b/libselinux/src/selinuxswig_python.i
|
||||||
|
@@ -1,10 +1,11 @@
|
||||||
|
/* Author: James Athey
|
||||||
|
*/
|
||||||
|
|
||||||
|
-/* Never build rpm_execcon interface */
|
||||||
|
+/* Never build rpm_execcon interface unless you need to have ACG compatibility
|
||||||
|
#ifndef DISABLE_RPM
|
||||||
|
#define DISABLE_RPM
|
||||||
|
#endif
|
||||||
|
+*/
|
||||||
|
|
||||||
|
%module selinux
|
||||||
|
%{
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
@ -0,0 +1,32 @@
|
|||||||
|
From 8384ffa7a371c8845c145951363da5d978ab98b5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 28 Feb 2017 16:12:43 +0100
|
||||||
|
Subject: [PATCH 5/5] libselinux: add missing av_permission values
|
||||||
|
|
||||||
|
Add missing av_permission values to av_permissions.h for the sake of
|
||||||
|
completeness (this interface is obsolete - these values are now
|
||||||
|
obtained at runtime).
|
||||||
|
|
||||||
|
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1025931
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
libselinux/include/selinux/av_permissions.h | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libselinux/include/selinux/av_permissions.h b/libselinux/include/selinux/av_permissions.h
|
||||||
|
index c1269af9..631f0276 100644
|
||||||
|
--- a/libselinux/include/selinux/av_permissions.h
|
||||||
|
+++ b/libselinux/include/selinux/av_permissions.h
|
||||||
|
@@ -876,6 +876,8 @@
|
||||||
|
#define NSCD__SHMEMHOST 0x00000080UL
|
||||||
|
#define NSCD__GETSERV 0x00000100UL
|
||||||
|
#define NSCD__SHMEMSERV 0x00000200UL
|
||||||
|
+#define NSCD__GETNETGRP 0x00000400UL
|
||||||
|
+#define NSCD__SHMEMNETGRP 0x00000800UL
|
||||||
|
#define ASSOCIATION__SENDTO 0x00000001UL
|
||||||
|
#define ASSOCIATION__RECVFROM 0x00000002UL
|
||||||
|
#define ASSOCIATION__SETCONTEXT 0x00000004UL
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
18
SOURCES/selinuxconlist.8
Normal file
18
SOURCES/selinuxconlist.8
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
.TH "selinuxconlist" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation"
|
||||||
|
.SH "NAME"
|
||||||
|
selinuxconlist \- list all SELinux context reachable for user
|
||||||
|
.SH "SYNOPSIS"
|
||||||
|
.B selinuxconlist [-l level] user [context]
|
||||||
|
|
||||||
|
.SH "DESCRIPTION"
|
||||||
|
.B selinuxconlist
|
||||||
|
reports the list of context reachable for user from the current context or specified context
|
||||||
|
|
||||||
|
.B \-l level
|
||||||
|
mcs/mls level
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||||
|
|
||||||
|
.SH "SEE ALSO"
|
||||||
|
secon(8), selinuxdefcon(8)
|
24
SOURCES/selinuxdefcon.8
Normal file
24
SOURCES/selinuxdefcon.8
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
.TH "selinuxdefcon" "1" "7 May 2008" "dwalsh@redhat.com" "SELinux Command Line documentation"
|
||||||
|
.SH "NAME"
|
||||||
|
selinuxdefcon \- report default SELinux context for user
|
||||||
|
|
||||||
|
.SH "SYNOPSIS"
|
||||||
|
.B selinuxdefcon [-l level] user fromcon
|
||||||
|
|
||||||
|
.SH "DESCRIPTION"
|
||||||
|
.B selinuxdefcon
|
||||||
|
reports the default context for the specified user from the specified context
|
||||||
|
|
||||||
|
.B \-l level
|
||||||
|
mcs/mls level
|
||||||
|
|
||||||
|
.SH EXAMPLE
|
||||||
|
# selinuxdefcon jsmith system_u:system_r:sshd_t:s0
|
||||||
|
.br
|
||||||
|
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
This manual page was written by Dan Walsh <dwalsh@redhat.com>.
|
||||||
|
|
||||||
|
.SH "SEE ALSO"
|
||||||
|
secon(8), selinuxconlist(8)
|
2744
SPECS/libselinux.spec
Normal file
2744
SPECS/libselinux.spec
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user