SELinux userspace 2.9-rc2 release

.gitignore

@@ -210,3 +210,4 @@ libselinux-2.0.96.tgz
 /libselinux-2.8-rc3.tar.gz
 /libselinux-2.8.tar.gz
 /libselinux-2.9-rc1.tar.gz
+/libselinux-2.9-rc2.tar.gz

libselinux-fedora.patch

@@ -1,7 +1,7 @@
-diff --git libselinux-2.9-rc1/man/man8/selinux.8 libselinux-2.9-rc1/man/man8/selinux.8
+diff --git libselinux-2.9-rc2/man/man8/selinux.8 libselinux-2.9-rc2/man/man8/selinux.8
 index e37aee6..bf23b65 100644
---- libselinux-2.9-rc1/man/man8/selinux.8
+--- libselinux-2.9-rc2/man/man8/selinux.8
-+++ libselinux-2.9-rc1/man/man8/selinux.8
++++ libselinux-2.9-rc2/man/man8/selinux.8
 @@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
  .BR sepolicy (8),
  .BR system-config-selinux (8),
@@ -17,10 +17,10 @@ index e37aee6..bf23b65 100644
  
  Every confined service on the system has a man page in the following format:
  .br
-diff --git libselinux-2.9-rc1/src/avc_sidtab.c libselinux-2.9-rc1/src/avc_sidtab.c
+diff --git libselinux-2.9-rc2/src/avc_sidtab.c libselinux-2.9-rc2/src/avc_sidtab.c
 index 9669264..c775430 100644
---- libselinux-2.9-rc1/src/avc_sidtab.c
+--- libselinux-2.9-rc2/src/avc_sidtab.c
-+++ libselinux-2.9-rc1/src/avc_sidtab.c
++++ libselinux-2.9-rc2/src/avc_sidtab.c
 @@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
  	int hvalue, rc = 0;
  	struct sidtab_node *cur;
@@ -33,22 +33,10 @@ index 9669264..c775430 100644
  	*sid = NULL;
  	hvalue = sidtab_hash(ctx);
  
-diff --git libselinux-2.9-rc1/src/booleans.c libselinux-2.9-rc1/src/booleans.c
+diff --git libselinux-2.9-rc2/src/canonicalize_context.c libselinux-2.9-rc2/src/canonicalize_context.c
-index b3ea362..a6d46fe 100644
---- libselinux-2.9-rc1/src/booleans.c
-+++ libselinux-2.9-rc1/src/booleans.c
-@@ -55,6 +55,7 @@ int security_get_boolean_names(char ***names, int *len)
- 	snprintf(path, sizeof path, "%s%s", selinux_mnt, SELINUX_BOOL_DIR);
- 	*len = scandir(path, &namelist, &filename_select, alphasort);
- 	if (*len <= 0) {
-+		errno = ENOENT;
- 		return -1;
- 	}
- 
-diff --git libselinux-2.9-rc1/src/canonicalize_context.c libselinux-2.9-rc1/src/canonicalize_context.c
 index ba4c9a2..c815872 100644
---- libselinux-2.9-rc1/src/canonicalize_context.c
+--- libselinux-2.9-rc2/src/canonicalize_context.c
-+++ libselinux-2.9-rc1/src/canonicalize_context.c
++++ libselinux-2.9-rc2/src/canonicalize_context.c
 @@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
  	size_t size;
  	int fd, ret;
@@ -61,26 +49,10 @@ index ba4c9a2..c815872 100644
  	if (!selinux_mnt) {
  		errno = ENOENT;
  		return -1;
-diff --git libselinux-2.9-rc1/src/checkAccess.c libselinux-2.9-rc1/src/checkAccess.c
+diff --git libselinux-2.9-rc2/src/check_context.c libselinux-2.9-rc2/src/check_context.c
-index 8de5747..16bfcfb 100644
---- libselinux-2.9-rc1/src/checkAccess.c
-+++ libselinux-2.9-rc1/src/checkAccess.c
-@@ -89,8 +89,10 @@ int selinux_check_passwd_access(access_vector_t requested)
- 		int retval;
- 
- 		passwd_class = string_to_security_class("passwd");
--		if (passwd_class == 0)
-+		if (passwd_class == 0) {
-+			freecon(user_context);
- 			return 0;
-+		}
- 
- 		retval = security_compute_av_raw(user_context,
- 						     user_context,
-diff --git libselinux-2.9-rc1/src/check_context.c libselinux-2.9-rc1/src/check_context.c
 index 8a7997f..5be8434 100644
---- libselinux-2.9-rc1/src/check_context.c
+--- libselinux-2.9-rc2/src/check_context.c
-+++ libselinux-2.9-rc1/src/check_context.c
++++ libselinux-2.9-rc2/src/check_context.c
 @@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
  	char path[PATH_MAX];
  	int fd, ret;
@@ -93,11 +65,11 @@ index 8a7997f..5be8434 100644
  	if (!selinux_mnt) {
  		errno = ENOENT;
  		return -1;
-diff --git libselinux-2.9-rc1/src/compute_av.c libselinux-2.9-rc1/src/compute_av.c
+diff --git libselinux-2.9-rc2/src/compute_av.c libselinux-2.9-rc2/src/compute_av.c
-index 1d05e7b..d9095cc 100644
+index a47cffe..6d285a2 100644
---- libselinux-2.9-rc1/src/compute_av.c
+--- libselinux-2.9-rc2/src/compute_av.c
-+++ libselinux-2.9-rc1/src/compute_av.c
++++ libselinux-2.9-rc2/src/compute_av.c
-@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon,
+@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon,
  		return -1;
  	}
  
@@ -109,10 +81,10 @@ index 1d05e7b..d9095cc 100644
  	snprintf(path, sizeof path, "%s/access", selinux_mnt);
  	fd = open(path, O_RDWR | O_CLOEXEC);
  	if (fd < 0)
-diff --git libselinux-2.9-rc1/src/compute_create.c libselinux-2.9-rc1/src/compute_create.c
+diff --git libselinux-2.9-rc2/src/compute_create.c libselinux-2.9-rc2/src/compute_create.c
 index 0975aea..3e6a48c 100644
---- libselinux-2.9-rc1/src/compute_create.c
+--- libselinux-2.9-rc2/src/compute_create.c
-+++ libselinux-2.9-rc1/src/compute_create.c
++++ libselinux-2.9-rc2/src/compute_create.c
 @@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
  		return -1;
  	}
@@ -125,10 +97,10 @@ index 0975aea..3e6a48c 100644
  	snprintf(path, sizeof path, "%s/create", selinux_mnt);
  	fd = open(path, O_RDWR | O_CLOEXEC);
  	if (fd < 0)
-diff --git libselinux-2.9-rc1/src/compute_member.c libselinux-2.9-rc1/src/compute_member.c
+diff --git libselinux-2.9-rc2/src/compute_member.c libselinux-2.9-rc2/src/compute_member.c
 index 4e2d221..d1dd977 100644
---- libselinux-2.9-rc1/src/compute_member.c
+--- libselinux-2.9-rc2/src/compute_member.c
-+++ libselinux-2.9-rc1/src/compute_member.c
++++ libselinux-2.9-rc2/src/compute_member.c
 @@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
  		return -1;
  	}
@@ -141,10 +113,10 @@ index 4e2d221..d1dd977 100644
  	snprintf(path, sizeof path, "%s/member", selinux_mnt);
  	fd = open(path, O_RDWR | O_CLOEXEC);
  	if (fd < 0)
-diff --git libselinux-2.9-rc1/src/compute_relabel.c libselinux-2.9-rc1/src/compute_relabel.c
+diff --git libselinux-2.9-rc2/src/compute_relabel.c libselinux-2.9-rc2/src/compute_relabel.c
 index 49f77ef..c3db7c0 100644
---- libselinux-2.9-rc1/src/compute_relabel.c
+--- libselinux-2.9-rc2/src/compute_relabel.c
-+++ libselinux-2.9-rc1/src/compute_relabel.c
++++ libselinux-2.9-rc2/src/compute_relabel.c
 @@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
  		return -1;
  	}
@@ -157,10 +129,10 @@ index 49f77ef..c3db7c0 100644
  	snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
  	fd = open(path, O_RDWR | O_CLOEXEC);
  	if (fd < 0)
-diff --git libselinux-2.9-rc1/src/compute_user.c libselinux-2.9-rc1/src/compute_user.c
+diff --git libselinux-2.9-rc2/src/compute_user.c libselinux-2.9-rc2/src/compute_user.c
 index 7b88121..401fd10 100644
---- libselinux-2.9-rc1/src/compute_user.c
+--- libselinux-2.9-rc2/src/compute_user.c
-+++ libselinux-2.9-rc1/src/compute_user.c
++++ libselinux-2.9-rc2/src/compute_user.c
 @@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
  		return -1;
  	}
@@ -173,10 +145,10 @@ index 7b88121..401fd10 100644
  	snprintf(path, sizeof path, "%s/user", selinux_mnt);
  	fd = open(path, O_RDWR | O_CLOEXEC);
  	if (fd < 0)
-diff --git libselinux-2.9-rc1/src/fsetfilecon.c libselinux-2.9-rc1/src/fsetfilecon.c
+diff --git libselinux-2.9-rc2/src/fsetfilecon.c libselinux-2.9-rc2/src/fsetfilecon.c
 index 52707d0..0cbe12d 100644
---- libselinux-2.9-rc1/src/fsetfilecon.c
+--- libselinux-2.9-rc2/src/fsetfilecon.c
-+++ libselinux-2.9-rc1/src/fsetfilecon.c
++++ libselinux-2.9-rc2/src/fsetfilecon.c
 @@ -9,8 +9,12 @@
  
  int fsetfilecon_raw(int fd, const char * context)
@@ -192,67 +164,10 @@ index 52707d0..0cbe12d 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git libselinux-2.9-rc1/src/label_db.c libselinux-2.9-rc1/src/label_db.c
+diff --git libselinux-2.9-rc2/src/lsetfilecon.c libselinux-2.9-rc2/src/lsetfilecon.c
-index c46d0a1..fa481e0 100644
---- libselinux-2.9-rc1/src/label_db.c
-+++ libselinux-2.9-rc1/src/label_db.c
-@@ -283,10 +283,12 @@ db_init(const struct selinux_opt *opts, unsigned nopts,
- 	}
- 	if (fstat(fileno(filp), &sb) < 0) {
- 		free(catalog);
-+    fclose(filp);
- 		return NULL;
- 	}
- 	if (!S_ISREG(sb.st_mode)) {
- 		free(catalog);
-+    fclose(filp);
- 		errno = EINVAL;
- 		return NULL;
- 	}
-@@ -340,6 +342,7 @@ out_error:
- 		free(spec->lr.ctx_trans);
- 	}
- 	free(catalog);
-+	fclose(filp);
- 
- 	return NULL;
- }
-diff --git libselinux-2.9-rc1/src/label_file.c libselinux-2.9-rc1/src/label_file.c
-index dbf51a9..b81fd55 100644
---- libselinux-2.9-rc1/src/label_file.c
-+++ libselinux-2.9-rc1/src/label_file.c
-@@ -317,8 +317,10 @@ end_arch_check:
- 			goto out;
- 		}
- 		rc = next_entry(str_buf, mmap_area, entry_len);
--		if (rc < 0)
-+		if (rc < 0) {
-+			free(str_buf);
- 			goto out;
-+		}
- 
- 		if (str_buf[entry_len - 1] != '\0') {
- 			free(str_buf);
-diff --git libselinux-2.9-rc1/src/load_policy.c libselinux-2.9-rc1/src/load_policy.c
-index e9f1264..20052be 100644
---- libselinux-2.9-rc1/src/load_policy.c
-+++ libselinux-2.9-rc1/src/load_policy.c
-@@ -262,8 +262,10 @@ checkbool:
- 			rc = security_get_boolean_names(&names, &len);
- 			if (!rc) {
- 				values = malloc(sizeof(int) * len);
--				if (!values)
-+				if (!values) {
-+					free(names);
- 					goto unmap;
-+				}
- 				for (i = 0; i < len; i++)
- 					values[i] =
- 						security_get_boolean_active(names[i]);
-diff --git libselinux-2.9-rc1/src/lsetfilecon.c libselinux-2.9-rc1/src/lsetfilecon.c
 index 1d3b28a..ea6d70b 100644
---- libselinux-2.9-rc1/src/lsetfilecon.c
+--- libselinux-2.9-rc2/src/lsetfilecon.c
-+++ libselinux-2.9-rc1/src/lsetfilecon.c
++++ libselinux-2.9-rc2/src/lsetfilecon.c
 @@ -9,8 +9,13 @@
  
  int lsetfilecon_raw(const char *path, const char * context)
@@ -269,97 +184,10 @@ index 1d3b28a..ea6d70b 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git libselinux-2.9-rc1/src/selinux_config.c libselinux-2.9-rc1/src/selinux_config.c
+diff --git libselinux-2.9-rc2/src/setfilecon.c libselinux-2.9-rc2/src/setfilecon.c
-index 292728f..b06cb63 100644
---- libselinux-2.9-rc1/src/selinux_config.c
-+++ libselinux-2.9-rc1/src/selinux_config.c
-@@ -177,8 +177,7 @@ static void init_selinux_config(void)
- 
- 			if (!strncasecmp(buf_p, SELINUXTYPETAG,
- 					 sizeof(SELINUXTYPETAG) - 1)) {
--				selinux_policytype = type =
--				    strdup(buf_p + sizeof(SELINUXTYPETAG) - 1);
-+				type = strdup(buf_p + sizeof(SELINUXTYPETAG) - 1);
- 				if (!type)
- 					return;
- 				end = type + strlen(type) - 1;
-@@ -187,6 +186,11 @@ static void init_selinux_config(void)
- 					*end = 0;
- 					end--;
- 				}
-+				if (setpolicytype(type) != 0) {
-+					free(type);
-+					return;
-+				}
-+				free(type);
- 				continue;
- 			} else if (!strncmp(buf_p, SETLOCALDEFS,
- 					    sizeof(SETLOCALDEFS) - 1)) {
-@@ -212,13 +216,10 @@ static void init_selinux_config(void)
- 		fclose(fp);
- 	}
- 
--	if (!type) {
--		selinux_policytype = type = strdup(SELINUXDEFAULT);
--		if (!type)
--			return;
--	}
-+	if (!selinux_policytype && setpolicytype(SELINUXDEFAULT) != 0)
-+		return;
- 
--	if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, type) == -1)
-+	if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, selinux_policytype) == -1)
- 		return;
- 
- 	for (i = 0; i < NEL; i++)
-diff --git libselinux-2.9-rc1/src/selinux_restorecon.c libselinux-2.9-rc1/src/selinux_restorecon.c
-index 42a48f5..924d953 100644
---- libselinux-2.9-rc1/src/selinux_restorecon.c
-+++ libselinux-2.9-rc1/src/selinux_restorecon.c
-@@ -351,12 +351,19 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
- 	new_entry->next = NULL;
- 
- 	new_entry->directory = strdup(directory);
--	if (!new_entry->directory)
-+	if (!new_entry->directory) {
-+		free(new_entry);
-+		free(sha1_buf);
- 		goto oom;
-+	}
- 
- 	new_entry->digest = strdup(sha1_buf);
--	if (!new_entry->digest)
-+	if (!new_entry->digest) {
-+		free(new_entry->directory);
-+		free(new_entry);
-+		free(sha1_buf);
- 		goto oom;
-+	}
- 
- 	new_entry->result = digest_result;
- 
-@@ -672,8 +679,8 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
- 				selinux_log(SELINUX_INFO,
- 				 "%s not reset as customized by admin to %s\n",
- 							    pathname, curcon);
--				goto out;
- 			}
-+			goto out;
- 		}
- 
- 		if (!flags->set_specctx && curcon) {
-@@ -850,6 +857,7 @@ int selinux_restorecon(const char *pathname_orig,
- 
- 	if (lstat(pathname, &sb) < 0) {
- 		if (flags.ignore_noent && errno == ENOENT) {
-+			free(xattr_value);
- 			free(pathdnamer);
- 			free(pathname);
- 			return 0;
-diff --git libselinux-2.9-rc1/src/setfilecon.c libselinux-2.9-rc1/src/setfilecon.c
 index d05969c..3f0200e 100644
---- libselinux-2.9-rc1/src/setfilecon.c
+--- libselinux-2.9-rc2/src/setfilecon.c
-+++ libselinux-2.9-rc1/src/setfilecon.c
++++ libselinux-2.9-rc2/src/setfilecon.c
 @@ -9,8 +9,12 @@
  
  int setfilecon_raw(const char *path, const char * context)
@@ -375,16 +203,3 @@ index d05969c..3f0200e 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git libselinux-2.9-rc1/utils/matchpathcon.c libselinux-2.9-rc1/utils/matchpathcon.c
-index 67e4a43..9756d7d 100644
---- libselinux-2.9-rc1/utils/matchpathcon.c
-+++ libselinux-2.9-rc1/utils/matchpathcon.c
-@@ -14,7 +14,7 @@
- static __attribute__ ((__noreturn__)) void usage(const char *progname)
- {
- 	fprintf(stderr,
--		"usage:  %s [-N] [-n] [-f file_contexts] [ -P policy_root_path ] [-p prefix] [-Vq] path...\n",
-+		"usage:  %s [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...\n",
- 		progname);
- 	exit(1);
- }

libselinux.spec

@@ -1,20 +1,20 @@
 %define ruby_inc %(pkg-config --cflags ruby)
-%define libsepolver 2.9-0
+%define libsepolver 2.9-0.rc2
 
 Summary: SELinux library and simple utilities
 Name: libselinux
 Version: 2.9
-Release: 0.rc1.1%{?dist}.1
+Release: 0.rc2.1%{?dist}
 License: Public Domain
 # https://github.com/SELinuxProject/selinux/wiki/Releases
-Source0: https://github.com/SELinuxProject/selinux/releases/download/20190125/libselinux-2.9-rc1.tar.gz
+Source0: https://github.com/SELinuxProject/selinux/releases/download/20190301/libselinux-2.9-rc2.tar.gz
 Source1: selinuxconlist.8
 Source2: selinuxdefcon.8
 Url: https://github.com/SELinuxProject/selinux/wiki
 # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh
 # run:
-# $ VERSION=2.9-rc1 ./make-fedora-selinux-patch.sh libselinux
+# $ VERSION=2.9-rc2 ./make-fedora-selinux-patch.sh libselinux
-# HEAD https://github.com/fedora-selinux/selinux/commit/a69fe203e41c9493e13ffafa51908d17da6fa7a2
+# HEAD https://github.com/fedora-selinux/selinux/commit/6bd6bf8f31effadb9ee8bfec701afdf9a7e9ea3b
 Patch1: libselinux-fedora.patch
 BuildRequires: gcc
 BuildRequires: python2 python2-devel ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel
@@ -98,7 +98,7 @@ The libselinux-static package contains the static libraries
 needed for developing SELinux applications. 
 
 %prep
-%autosetup -p 1 -n libselinux-%{version}-rc1
+%autosetup -p 1 -n libselinux-%{version}-rc2
 
 %build
 export LDFLAGS="%{?__global_ldflags}"
@@ -207,6 +207,8 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
 %{_sbindir}/selinux_check_access
 %{_mandir}/man5/*
 %{_mandir}/man8/*
+%{_mandir}/ru/man5/*
+%{_mandir}/ru/man8/*
 
 %files devel
 %{_libdir}/libselinux.so
@@ -229,6 +231,9 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
 %{ruby_vendorarchdir}/selinux.so
 
 %changelog
+* Wed Mar  6 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-0.rc2.1
+- SELinux userspace 2.9-rc2 release
+
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9-0.rc1.1.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (libselinux-2.9-rc1.tar.gz) = 15c068b7ad2852a3b6db9a5e192981de8f8257ae4e7f8b57c92755e74c0b5b03ad5489505a84d483fda16b879a20839914eb6a2ee563e37f01f6b3a9ac9c596d
+SHA512 (libselinux-2.9-rc2.tar.gz) = b216928b090f769639bc888a69af102685247d574d1a2a44527fca1cd04d9396747080b5db87668bb01e2f8426ee74591826be7ee54de2f297e9766bcc417883