import libsemanage-2.8-5.el8

.gitignore

@@ -0,0 +1 @@
+SOURCES/libsemanage-2.8.tar.gz

.libsemanage.metadata

@@ -0,0 +1 @@
+c66c8ee307012270a202143041bc4583d7a778c9 SOURCES/libsemanage-2.8.tar.gz

SOURCES/libsemanage-fedora.patch

@@ -0,0 +1,267 @@
+diff --git libsemanage-2.8/src/direct_api.c libsemanage-2.8/src/direct_api.c
+index c58961b..8e4d116 100644
+--- libsemanage-2.8/src/direct_api.c
++++ libsemanage-2.8/src/direct_api.c
+@@ -1028,7 +1028,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh,
+ 
+ 	fp = NULL;
+ 
+-	ret = 0;
++	return 0;
+ 
+ cleanup:
+ 	if (fp != NULL) fclose(fp);
+@@ -2177,7 +2177,6 @@ cleanup:
+ 	semanage_module_info_destroy(sh, modinfo);
+ 	free(modinfo);
+ 
+-	if (fp != NULL) fclose(fp);
+ 	return status;
+ }
+ 
+@@ -2342,16 +2341,6 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
+ 	free(tmp);
+ 	tmp = NULL;
+ 
+-	if (fclose(fp) != 0) {
+-		ERR(sh,
+-		    "Unable to close %s module lang ext file.",
+-		    (*modinfo)->name);
+-		status = -1;
+-		goto cleanup;
+-	}
+-
+-	fp = NULL;
+-
+ 	/* lookup enabled/disabled status */
+ 	ret = semanage_module_get_path(sh,
+ 				       *modinfo,
+@@ -2395,7 +2384,13 @@ cleanup:
+ 		free(modinfos);
+ 	}
+ 
+-	if (fp != NULL) fclose(fp);
++	if (fp != NULL && fclose(fp) != 0) {
++		ERR(sh,
++		    "Unable to close %s module lang ext file.",
++		    (*modinfo)->name);
++		status = -1;
++	}
++
+ 	return status;
+ }
+ 
+diff --git libsemanage-2.8/src/genhomedircon.c libsemanage-2.8/src/genhomedircon.c
+index 3e61b51..c35f878 100644
+--- libsemanage-2.8/src/genhomedircon.c
++++ libsemanage-2.8/src/genhomedircon.c
+@@ -1074,10 +1074,20 @@ static int get_group_users(genhomedircon_settings_t * s,
+ 
+ 	const char *grname = selogin + 1;
+ 
+-	if (getgrnam_r(grname, &grstorage, grbuf,
+-			(size_t) grbuflen, &group) != 0) {
+-		goto cleanup;
++	errno = 0;
++	while (
++		(retval = getgrnam_r(grname, &grstorage, grbuf, (size_t) grbuflen, &group)) != 0 &&
++		errno == ERANGE
++	) {
++		char *new_grbuf;
++		grbuflen *= 2;
++		new_grbuf = realloc(grbuf, grbuflen);
++		if (new_grbuf == NULL)
++			goto cleanup;
++		grbuf = new_grbuf;
+ 	}
++	if (retval == -1)
++		goto cleanup;
+ 
+ 	if (group == NULL) {
+ 		ERR(s->h_semanage, "Can't find group named %s\n", grname);
+diff --git libsemanage-2.8/src/semanage_store.c libsemanage-2.8/src/semanage_store.c
+index f1984c5..58dded6 100644
+--- libsemanage-2.8/src/semanage_store.c
++++ libsemanage-2.8/src/semanage_store.c
+@@ -541,14 +541,18 @@ int semanage_create_store(semanage_handle_t * sh, int create)
+ 	struct stat sb;
+ 	const char *path = semanage_files[SEMANAGE_ROOT];
+ 	int fd;
++	mode_t mask;
+ 
+ 	if (stat(path, &sb) == -1) {
+ 		if (errno == ENOENT && create) {
++			mask = umask(0077);
+ 			if (mkdir(path, S_IRWXU) == -1) {
++				umask(mask);
+ 				ERR(sh, "Could not create module store at %s.",
+ 				    path);
+ 				return -2;
+ 			}
++			umask(mask);
+ 		} else {
+ 			if (create)
+ 				ERR(sh,
+@@ -567,12 +571,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
+ 	path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL);
+ 	if (stat(path, &sb) == -1) {
+ 		if (errno == ENOENT && create) {
++			mask = umask(0077);
+ 			if (mkdir(path, S_IRWXU) == -1) {
++				umask(mask);
+ 				ERR(sh,
+ 				    "Could not create module store, active subdirectory at %s.",
+ 				    path);
+ 				return -2;
+ 			}
++			umask(mask);
+ 		} else {
+ 			ERR(sh,
+ 			    "Could not read from module store, active subdirectory at %s.",
+@@ -590,12 +597,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
+ 	path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_MODULES);
+ 	if (stat(path, &sb) == -1) {
+ 		if (errno == ENOENT && create) {
++			mask = umask(0077);
+ 			if (mkdir(path, S_IRWXU) == -1) {
++				umask(mask);
+ 				ERR(sh,
+ 				    "Could not create module store, active modules subdirectory at %s.",
+ 				    path);
+ 				return -2;
+ 			}
++			umask(mask);
+ 		} else {
+ 			ERR(sh,
+ 			    "Could not read from module store, active modules subdirectory at %s.",
+@@ -613,11 +623,14 @@ int semanage_create_store(semanage_handle_t * sh, int create)
+ 	path = semanage_files[SEMANAGE_READ_LOCK];
+ 	if (stat(path, &sb) == -1) {
+ 		if (errno == ENOENT && create) {
++			mask = umask(0077);
+ 			if ((fd = creat(path, S_IRUSR | S_IWUSR)) == -1) {
++				umask(mask);
+ 				ERR(sh, "Could not create lock file at %s.",
+ 				    path);
+ 				return -2;
+ 			}
++			umask(mask);
+ 			close(fd);
+ 		} else {
+ 			ERR(sh, "Could not read lock file at %s.", path);
+@@ -763,6 +776,7 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
+ 	struct stat sb;
+ 	struct dirent **names = NULL;
+ 	char path[PATH_MAX], path2[PATH_MAX];
++	mode_t mask;
+ 
+ 	if ((len = scandir(src, &names, semanage_filename_select, NULL)) == -1) {
+ 		fprintf(stderr, "Could not read the contents of %s: %s\n", src, strerror(errno));
+@@ -770,10 +784,13 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
+ 	}
+ 
+ 	if (stat(dst, &sb) != 0) {
++		mask = umask(0077);
+ 		if (mkdir(dst, S_IRWXU) != 0) {
++			umask(mask);
+ 			fprintf(stderr, "Could not create %s: %s\n", dst, strerror(errno));
+ 			goto cleanup;
+ 		}
++		umask(mask);
+ 	}
+ 
+ 	for (i = 0; i < len; i++) {
+@@ -785,14 +802,20 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
+ 		}
+ 		snprintf(path2, sizeof(path2), "%s/%s", dst, names[i]->d_name);
+ 		if (S_ISDIR(sb.st_mode)) {
++			mask = umask(0077);
+ 			if (mkdir(path2, 0700) == -1 ||
+ 			    semanage_copy_dir_flags(path, path2, flag) == -1) {
++				umask(mask);
+ 				goto cleanup;
+ 			}
++			umask(mask);
+ 		} else if (S_ISREG(sb.st_mode) && flag == 1) {
++			mask = umask(0077);
+ 			if (semanage_copy_file(path, path2, sb.st_mode) < 0) {
++				umask(mask);
+ 				goto cleanup;
+ 			}
++			umask(mask);
+ 		}
+ 	}
+ 	retval = 0;
+@@ -872,16 +895,20 @@ int semanage_mkdir(semanage_handle_t *sh, const char *path)
+ {
+ 	int status = 0;
+ 	struct stat sb;
++	mode_t mask;
+ 
+ 	/* check if directory already exists */
+ 	if (stat(path, &sb) != 0) {
+ 		/* make the modules directory */
++		mask = umask(0077);
+ 		if (mkdir(path, S_IRWXU) != 0) {
++			umask(mask);
+ 			ERR(sh, "Cannot make directory at %s", path);
+ 			status = -1;
+ 			goto cleanup;
+ 
+ 		}
++		umask(mask);
+ 	}
+ 	else {
+ 		/* check that it really is a directory */
+@@ -906,6 +933,7 @@ int semanage_make_sandbox(semanage_handle_t * sh)
+ 	const char *sandbox = semanage_path(SEMANAGE_TMP, SEMANAGE_TOPLEVEL);
+ 	struct stat buf;
+ 	int errsv;
++	mode_t mask;
+ 
+ 	if (stat(sandbox, &buf) == -1) {
+ 		if (errno != ENOENT) {
+@@ -922,12 +950,15 @@ int semanage_make_sandbox(semanage_handle_t * sh)
+ 		}
+ 	}
+ 
++	mask = umask(0077);
+ 	if (mkdir(sandbox, S_IRWXU) == -1 ||
+ 	    semanage_copy_dir(semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL),
+ 			      sandbox) == -1) {
++		umask(mask);
+ 		ERR(sh, "Could not copy files to sandbox %s.", sandbox);
+ 		goto cleanup;
+ 	}
++	umask(mask);
+ 	return 0;
+ 
+       cleanup:
+diff --git libsemanage-2.8/src/seusers_local.c libsemanage-2.8/src/seusers_local.c
+index 413ebdd..a79e2d3 100644
+--- libsemanage-2.8/src/seusers_local.c
++++ libsemanage-2.8/src/seusers_local.c
+@@ -71,17 +71,18 @@ static int semanage_seuser_audit(semanage_handle_t * handle,
+ 	const char *sep = "-";
+ 	int rc = -1;
+ 	strcpy(msg, "login");
++	if (previous) {
++		name = semanage_seuser_get_name(previous);
++		psename = semanage_seuser_get_sename(previous);
++		pmls = semanage_seuser_get_mlsrange(previous);
++		proles = semanage_user_roles(handle, psename);
++	}
+ 	if (seuser) {
+ 		name = semanage_seuser_get_name(seuser);
+ 		sename = semanage_seuser_get_sename(seuser);
+ 		mls = semanage_seuser_get_mlsrange(seuser);
+ 		roles = semanage_user_roles(handle, sename);
+ 	}
+-	if (previous) {
+-		psename = semanage_seuser_get_sename(previous);
+-		pmls = semanage_seuser_get_mlsrange(previous);
+-		proles = semanage_user_roles(handle, psename);
+-	}
+ 	if (audit_type != AUDIT_ROLE_REMOVE) {
+ 		if (sename && (!psename || strcmp(psename, sename) != 0)) {
+ 			strcat(msg,sep);

SOURCES/semanage.conf

@@ -0,0 +1,57 @@
+# Authors: Jason Tang <jtang@tresys.com>
+#
+# Copyright (C) 2004-2005 Tresys Technology, LLC
+#
+#  This library is free software; you can redistribute it and/or
+#  modify it under the terms of the GNU Lesser General Public
+#  License as published by the Free Software Foundation; either
+#  version 2.1 of the License, or (at your option) any later version.
+#
+#  This library is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#  Lesser General Public License for more details.
+#
+#  You should have received a copy of the GNU Lesser General Public
+#  License along with this library; if not, write to the Free Software
+#  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+#
+# Specify how libsemanage will interact with a SELinux policy manager.
+# The four options are:
+#
+#  "source"     - libsemanage manipulates a source SELinux policy
+#  "direct"     - libsemanage will write directly to a module store.
+#  /foo/bar     - Write by way of a policy management server, whose
+#                 named socket is at /foo/bar.  The path must begin
+#                 with a '/'.
+#  foo.com:4242 - Establish a TCP connection to a remote policy
+#                 management server at foo.com.  If there is a colon
+#                 then the remainder is interpreted as a port number;
+#                 otherwise default to port 4242.
+module-store = direct
+
+# When generating the final linked and expanded policy, by default
+# semanage will set the policy version to POLICYDB_VERSION_MAX, as
+# given in <sepol/policydb.h>.  Change this setting if a different
+# version is necessary.
+#policy-version = 19
+
+# expand-check check neverallow rules when executing all semanage
+# commands. There might be a penalty in execution time if this
+# option is enabled.
+expand-check=0
+
+# usepasswd check tells semanage to scan all pass word records for home directories
+# and setup the labeling correctly.  If this is turned off, SELinux will label /home 
+# correctly only.  You will need to use semanage fcontext command.  
+# For example, if you had home dirs in /althome directory you would have to execute
+# semanage fcontext -a -e /home /althome
+usepasswd=False
+bzip-small=true
+bzip-blocksize=5
+ignoredirs=/root
+
+[sefcontext_compile]
+path = /usr/sbin/sefcontext_compile
+args = -r $@
+[end]