From a859c29b48c626b7d858d73afd6b2280b2828554 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 18 May 2021 02:34:47 -0400 Subject: [PATCH] import libselinux-2.9-5.el8 --- ...cate-security_compute_user-update-ma.patch | 168 ++++++++++++++++++ SPECS/libselinux.spec | 6 +- 2 files changed, 173 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0010-libselinux-deprecate-security_compute_user-update-ma.patch diff --git a/SOURCES/0010-libselinux-deprecate-security_compute_user-update-ma.patch b/SOURCES/0010-libselinux-deprecate-security_compute_user-update-ma.patch new file mode 100644 index 0000000..7e782b4 --- /dev/null +++ b/SOURCES/0010-libselinux-deprecate-security_compute_user-update-ma.patch @@ -0,0 +1,168 @@ +From d4c22fcd5943fe35db648dee971f631d40b3eb94 Mon Sep 17 00:00:00 2001 +From: Stephen Smalley +Date: Thu, 20 Feb 2020 10:40:19 -0500 +Subject: [PATCH] libselinux: deprecate security_compute_user(), update man + pages + +commit 1f89c4e7879fcf6da5d8d1b025dcc03371f30fc9 ("libselinux: Eliminate +use of security_compute_user()") eliminated the use of +security_compute_user() by get_ordered_context_list(). Deprecate +all use of security_compute_user() by updating the headers and man +pages and logging a warning message on any calls to it. Remove +the example utility that called the interface. While here, also +fix the documentation of correct usage of the user argument to these +interfaces. + +Fixes: https://github.com/SELinuxProject/selinux/issues/70 +Signed-off-by: Stephen Smalley +Acked-by: Petr Lautrbach +--- + libselinux/include/selinux/selinux.h | 8 +++- + .../man/man3/get_ordered_context_list.3 | 24 +++++++++--- + libselinux/man/man3/security_compute_av.3 | 5 ++- + libselinux/src/compute_user.c | 3 ++ + libselinux/utils/compute_user.c | 38 ------------------- + 5 files changed, 31 insertions(+), 47 deletions(-) + delete mode 100644 libselinux/utils/compute_user.c + +diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h +index a34d54fc..a5ada324 100644 +--- a/libselinux/include/selinux/selinux.h ++++ b/libselinux/include/selinux/selinux.h +@@ -246,8 +246,12 @@ extern int security_compute_member_raw(const char * scon, + security_class_t tclass, + char ** newcon); + +-/* Compute the set of reachable user contexts and set *con to refer to +- the NULL-terminated array of contexts. Caller must free via freeconary. */ ++/* ++ * Compute the set of reachable user contexts and set *con to refer to ++ * the NULL-terminated array of contexts. Caller must free via freeconary. ++ * These interfaces are deprecated. Use get_ordered_context_list() or ++ * one of its variant interfaces instead. ++ */ + extern int security_compute_user(const char * scon, + const char *username, + char *** con); +diff --git a/libselinux/man/man3/get_ordered_context_list.3 b/libselinux/man/man3/get_ordered_context_list.3 +index e084da40..3ed14a96 100644 +--- a/libselinux/man/man3/get_ordered_context_list.3 ++++ b/libselinux/man/man3/get_ordered_context_list.3 +@@ -26,14 +26,28 @@ get_ordered_context_list, get_ordered_context_list_with_level, get_default_conte + .BI "int get_default_type(const char *" role ", char **" type ); + . + .SH "DESCRIPTION" ++ ++This family of functions can be used to obtain either a prioritized list of ++all reachable security contexts for a given SELinux user or a single default ++(highest priority) context for a given SELinux user for use by login-like ++programs. These functions takes a SELinux user identity that must ++be defined in the SELinux policy as their input, not a Linux username. ++Most callers should typically first call ++.BR getseuserbyname(3) ++to look up the SELinux user identity and level for a given ++Linux username and then invoke one of ++.BR get_ordered_context_list_with_level () ++or ++.BR get_default_context_with_level () ++with the returned SELinux user and level as inputs. ++ + .BR get_ordered_context_list () +-invokes the +-.BR security_compute_user (3) +-function to obtain the list of contexts for the specified ++obtains the list of contexts for the specified ++SELinux + .I user +-that are reachable from the specified ++identity that are reachable from the specified + .I fromcon +-context. The function then orders the resulting list based on the global ++context based on the global + .I \%/etc/selinux/{SELINUXTYPE}/contexts/default_contexts + file and the per-user + .I \%/etc/selinux/{SELINUXTYPE}/contexts/users/ +diff --git a/libselinux/man/man3/security_compute_av.3 b/libselinux/man/man3/security_compute_av.3 +index 2aade5fe..8e1f746a 100644 +--- a/libselinux/man/man3/security_compute_av.3 ++++ b/libselinux/man/man3/security_compute_av.3 +@@ -97,8 +97,9 @@ instance. + + .BR security_compute_user () + is used to determine the set of user contexts that can be reached from a +-source context. It is mainly used by +-.BR get_ordered_context_list (). ++source context. This function is deprecated; use ++.BR get_ordered_context_list (3) ++instead. + + .BR security_get_initial_context () + is used to get the context of a kernel initial security identifier specified by +diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c +index 401fd107..0f55de84 100644 +--- a/libselinux/src/compute_user.c ++++ b/libselinux/src/compute_user.c +@@ -8,6 +8,7 @@ + #include "selinux_internal.h" + #include "policy.h" + #include ++#include "callbacks.h" + + int security_compute_user_raw(const char * scon, + const char *user, char *** con) +@@ -24,6 +25,8 @@ int security_compute_user_raw(const char * scon, + return -1; + } + ++ selinux_log(SELINUX_WARNING, "Direct use of security_compute_user() is deprecated, switch to get_ordered_context_list()\n"); ++ + if (! scon) { + errno=EINVAL; + return -1; +diff --git a/libselinux/utils/compute_user.c b/libselinux/utils/compute_user.c +deleted file mode 100644 +index cae62b26..00000000 +--- a/libselinux/utils/compute_user.c ++++ /dev/null +@@ -1,38 +0,0 @@ +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-int main(int argc, char **argv) +-{ +- char **buf, **ptr; +- int ret; +- +- if (argc != 3) { +- fprintf(stderr, "usage: %s context user\n", argv[0]); +- exit(1); +- } +- +- ret = security_compute_user(argv[1], argv[2], &buf); +- if (ret < 0) { +- fprintf(stderr, "%s: security_compute_user(%s,%s) failed\n", +- argv[0], argv[1], argv[2]); +- exit(2); +- } +- +- if (!buf[0]) { +- printf("none\n"); +- exit(0); +- } +- +- for (ptr = buf; *ptr; ptr++) { +- printf("%s\n", *ptr); +- } +- freeconary(buf); +- exit(0); +-} +-- +2.25.4 + diff --git a/SPECS/libselinux.spec b/SPECS/libselinux.spec index 804b5bb..5c649a9 100644 --- a/SPECS/libselinux.spec +++ b/SPECS/libselinux.spec @@ -6,7 +6,7 @@ %endif %define libsepolver 2.9-1 -%define libselinuxrelease 4 +%define libselinuxrelease 5 Summary: SELinux library and simple utilities Name: libselinux @@ -28,6 +28,7 @@ Patch0006: 0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch Patch0007: 0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch Patch0008: 0008-Fix-mcstrans-secolor-examples.patch Patch0009: 0009-libselinux-Eliminate-use-of-security_compute_user.patch +Patch0010: 0010-libselinux-deprecate-security_compute_user-update-ma.patch BuildRequires: gcc %if 0%{?with_ruby} @@ -275,6 +276,9 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool* %endif %changelog +* Tue Oct 20 2020 Vit Mojzis - 2.9-5 +- Deprecate security_compute_user(), update man pages (#1879368) + * Thu Sep 24 2020 Vit Mojzis - 2.9-4 - Eliminate use of security_compute_user() (#1879368)