libselinux-3.7-5
- setexecfilecon: Remove useless rc check (RHEL-35586) - matchpathcon: RESOURCE_LEAK: Variable "con" (RHEL-35584) Resolves: RHEL-35586, RHEL-35584
This commit is contained in:
Vit Mojzis
parent
13a23887f2
commit
de1d9f5fd5
37
0007-libselinux-setexecfilecon-Remove-useless-rc-check.patch
Normal file
37
0007-libselinux-setexecfilecon-Remove-useless-rc-check.patch
Normal file
@ -0,0 +1,37 @@
|
||||
From edce1de156f1daa71875e210c1d55ad8d3aefc90 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Fri, 25 Oct 2024 20:30:13 +0200
|
||||
Subject: [PATCH] libselinux/setexecfilecon: Remove useless rc check
|
||||
|
||||
Fixes:
|
||||
Error: IDENTICAL_BRANCHES (CWE-398):
|
||||
libselinux-3.6/src/setexecfilecon.c:45: implicit_else: The code from the above if-then branch is identical to the code after the if statement.
|
||||
libselinux-3.6/src/setexecfilecon.c:43: identical_branches: The same code is executed when the condition "rc < 0" is true or false, because the code in the if-then branch and after the if statement is identical. Should the if statement be removed?
|
||||
\# 41|
|
||||
\# 42| rc = setexeccon(newcon);
|
||||
\# 43|-> if (rc < 0)
|
||||
\# 44| goto out;
|
||||
\# 45| out:
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
libselinux/src/setexecfilecon.c | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/libselinux/src/setexecfilecon.c b/libselinux/src/setexecfilecon.c
|
||||
index 2c6505a9..4b31e775 100644
|
||||
--- a/libselinux/src/setexecfilecon.c
|
||||
+++ b/libselinux/src/setexecfilecon.c
|
||||
@@ -40,8 +40,6 @@ int setexecfilecon(const char *filename, const char *fallback_type)
|
||||
}
|
||||
|
||||
rc = setexeccon(newcon);
|
||||
- if (rc < 0)
|
||||
- goto out;
|
||||
out:
|
||||
|
||||
if (rc < 0 && security_getenforce() == 0)
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -0,0 +1,40 @@
|
||||
From 48bfb96d452a6893010977325940ca17619c207c Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Fri, 25 Oct 2024 20:30:14 +0200
|
||||
Subject: [PATCH] libselinux/matchpathcon: RESOURCE_LEAK: Variable "con"
|
||||
|
||||
Fixes:
|
||||
Error: RESOURCE_LEAK (CWE-772):
|
||||
libselinux-3.6/src/matchpathcon.c:519: alloc_arg: "lgetfilecon_raw" allocates memory that is stored into "con". [Note: The source code implementation of the function has been overridden by a user model.]
|
||||
libselinux-3.6/src/matchpathcon.c:528: leaked_storage: Variable "con" going out of scope leaks the storage it points to.
|
||||
\# 526|
|
||||
\# 527| if (!hnd && (matchpathcon_init_prefix(NULL, NULL) < 0))
|
||||
\# 528|-> return -1;
|
||||
\# 529|
|
||||
\# 530| if (selabel_lookup_raw(hnd, &fcontext, path, mode) != 0) {
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
libselinux/src/matchpathcon.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libselinux/src/matchpathcon.c b/libselinux/src/matchpathcon.c
|
||||
index e44734c3..967520e4 100644
|
||||
--- a/libselinux/src/matchpathcon.c
|
||||
+++ b/libselinux/src/matchpathcon.c
|
||||
@@ -524,8 +524,10 @@ int selinux_file_context_verify(const char *path, mode_t mode)
|
||||
return 0;
|
||||
}
|
||||
|
||||
- if (!hnd && (matchpathcon_init_prefix(NULL, NULL) < 0))
|
||||
+ if (!hnd && (matchpathcon_init_prefix(NULL, NULL) < 0)){
|
||||
+ freecon(con);
|
||||
return -1;
|
||||
+ }
|
||||
|
||||
if (selabel_lookup_raw(hnd, &fcontext, path, mode) != 0) {
|
||||
if (errno != ENOENT)
|
||||
--
|
||||
2.47.0
|
||||
|
||||
11
changelog
11
changelog
@ -1,3 +1,14 @@
|
||||
* Tue Nov 12 2024 Vit Mojzis <vmojzis@redhat.com> - 3.7-5
|
||||
- setexecfilecon: Remove useless rc check (RHEL-35586)
|
||||
- matchpathcon: RESOURCE_LEAK: Variable "con" (RHEL-35584)
|
||||
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 3.7-4
|
||||
- Bump release for October 2024 mass rebuild (RHEL-64018)
|
||||
|
||||
* Thu Oct 17 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.7-3.1
|
||||
- fix swig bindings for 4.3.0
|
||||
- deprecate security_disable(3)
|
||||
|
||||
* Fri Aug 09 2024 Vit Mojzis <vmojzis@redhat.com> - 3.7-3
|
||||
- restorecon: Include <selinux/label.h> (RHEL-53852)
|
||||
- Fix integer comparison issues when compiling for 32-bit
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
Summary: SELinux library and simple utilities
|
||||
Name: libselinux
|
||||
Version: 3.7
|
||||
Release: 4%{?dist}
|
||||
Release: 5%{?dist}
|
||||
License: LicenseRef-Fedora-Public-Domain
|
||||
# https://github.com/SELinuxProject/selinux/wiki/Releases
|
||||
Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/libselinux-3.7.tar.gz
|
||||
@ -25,6 +25,8 @@ Patch0003: 0003-libselinux-restorecon-Include-selinux-label.h.patch
|
||||
Patch0004: 0004-libselinux-Fix-integer-comparison-issues-when-compil.patch
|
||||
Patch0005: 0005-libselinux-deprecate-security_disable-3.patch
|
||||
Patch0006: 0006-libselinux-fix-swig-bindings-for-4.3.0.patch
|
||||
Patch0007: 0007-libselinux-setexecfilecon-Remove-useless-rc-check.patch
|
||||
Patch0008: 0008-libselinux-matchpathcon-RESOURCE_LEAK-Variable-con.patch
|
||||
# Patch list end
|
||||
BuildRequires: gcc make
|
||||
BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel
|
||||
@ -223,8 +225,5 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
|
||||
%{ruby_vendorarchdir}/selinux.so
|
||||
|
||||
%changelog
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 3.7-4
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
Resolves: RHEL-64018
|
||||
|
||||
%autochangelog
|
||||
|
||||
Loading…
Reference in New Issue
Block a user