rpms/libsemanage
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import libsemanage-2.9-1.el8

Browse Source
This commit is contained in:
CentOS Sources 2019-11-05 15:20:54 -05:00 committed by Andrew Lukoshko
parent a5978c644e
commit ed5c9efd87
5 changed files with 84 additions and 284 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/libsemanage-2.8.tar.gz
SOURCES/libsemanage-2.9.tar.gz

2
.libsemanage.metadata
View File

@ -1 +1 @@
c66c8ee307012270a202143041bc4583d7a778c9 SOURCES/libsemanage-2.8.tar.gz
4c669c72c4626391d67e5c7e69be8397d71ee31e SOURCES/libsemanage-2.9.tar.gz

66
SOURCES/0001-libsemanage-Fix-RESOURCE_LEAK-and-USE_AFTER_FREE-cov.patch Normal file
View File

@ -0,0 +1,66 @@
From dc105dcb5e34e256bcbcf547fea590cfcee06933 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Wed, 7 Nov 2018 18:17:34 +0100
Subject: [PATCH] libsemanage: Fix RESOURCE_LEAK and USE_AFTER_FREE coverity
scan defects
---
libsemanage/src/direct_api.c | 21 ++++++++-------------
1 file changed, 8 insertions(+), 13 deletions(-)
diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c
index c58961be..8e4d116d 100644
--- a/libsemanage/src/direct_api.c
+++ b/libsemanage/src/direct_api.c
@@ -1028,7 +1028,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh,
fp = NULL;
- ret = 0;
+ return 0;
cleanup:
if (fp != NULL) fclose(fp);
@@ -2177,7 +2177,6 @@ cleanup:
semanage_module_info_destroy(sh, modinfo);
free(modinfo);
- if (fp != NULL) fclose(fp);
return status;
}
@@ -2342,16 +2341,6 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
free(tmp);
tmp = NULL;
- if (fclose(fp) != 0) {
- ERR(sh,
- "Unable to close %s module lang ext file.",
- (*modinfo)->name);
- status = -1;
- goto cleanup;
- }
-
- fp = NULL;
-
/* lookup enabled/disabled status */
ret = semanage_module_get_path(sh,
*modinfo,
@@ -2395,7 +2384,13 @@ cleanup:
free(modinfos);
}
- if (fp != NULL) fclose(fp);
+ if (fp != NULL && fclose(fp) != 0) {
+ ERR(sh,
+ "Unable to close %s module lang ext file.",
+ (*modinfo)->name);
+ status = -1;
+ }
+
return status;
}
--
2.21.0

267
SOURCES/libsemanage-fedora.patch
View File

@ -1,267 +0,0 @@
diff --git libsemanage-2.8/src/direct_api.c libsemanage-2.8/src/direct_api.c
index c58961b..8e4d116 100644
--- libsemanage-2.8/src/direct_api.c
+++ libsemanage-2.8/src/direct_api.c
@@ -1028,7 +1028,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh,
fp = NULL;
- ret = 0;
+ return 0;
cleanup:
if (fp != NULL) fclose(fp);
@@ -2177,7 +2177,6 @@ cleanup:
semanage_module_info_destroy(sh, modinfo);
free(modinfo);
- if (fp != NULL) fclose(fp);
return status;
}
@@ -2342,16 +2341,6 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
free(tmp);
tmp = NULL;
- if (fclose(fp) != 0) {
- ERR(sh,
- "Unable to close %s module lang ext file.",
- (*modinfo)->name);
- status = -1;
- goto cleanup;
- }
-
- fp = NULL;
-
/* lookup enabled/disabled status */
ret = semanage_module_get_path(sh,
*modinfo,
@@ -2395,7 +2384,13 @@ cleanup:
free(modinfos);
}
- if (fp != NULL) fclose(fp);
+ if (fp != NULL && fclose(fp) != 0) {
+ ERR(sh,
+ "Unable to close %s module lang ext file.",
+ (*modinfo)->name);
+ status = -1;
+ }
+
return status;
}
diff --git libsemanage-2.8/src/genhomedircon.c libsemanage-2.8/src/genhomedircon.c
index 3e61b51..c35f878 100644
--- libsemanage-2.8/src/genhomedircon.c
+++ libsemanage-2.8/src/genhomedircon.c
@@ -1074,10 +1074,20 @@ static int get_group_users(genhomedircon_settings_t * s,
const char *grname = selogin + 1;
- if (getgrnam_r(grname, &grstorage, grbuf,
- (size_t) grbuflen, &group) != 0) {
- goto cleanup;
+ errno = 0;
+ while (
+ (retval = getgrnam_r(grname, &grstorage, grbuf, (size_t) grbuflen, &group)) != 0 &&
+ errno == ERANGE
+ ) {
+ char *new_grbuf;
+ grbuflen *= 2;
+ new_grbuf = realloc(grbuf, grbuflen);
+ if (new_grbuf == NULL)
+ goto cleanup;
+ grbuf = new_grbuf;
}
+ if (retval == -1)
+ goto cleanup;
if (group == NULL) {
ERR(s->h_semanage, "Can't find group named %s\n", grname);
diff --git libsemanage-2.8/src/semanage_store.c libsemanage-2.8/src/semanage_store.c
index f1984c5..58dded6 100644
--- libsemanage-2.8/src/semanage_store.c
+++ libsemanage-2.8/src/semanage_store.c
@@ -541,14 +541,18 @@ int semanage_create_store(semanage_handle_t * sh, int create)
struct stat sb;
const char *path = semanage_files[SEMANAGE_ROOT];
int fd;
+ mode_t mask;
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh, "Could not create module store at %s.",
path);
return -2;
}
+ umask(mask);
} else {
if (create)
ERR(sh,
@@ -567,12 +571,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL);
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh,
"Could not create module store, active subdirectory at %s.",
path);
return -2;
}
+ umask(mask);
} else {
ERR(sh,
"Could not read from module store, active subdirectory at %s.",
@@ -590,12 +597,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_MODULES);
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh,
"Could not create module store, active modules subdirectory at %s.",
path);
return -2;
}
+ umask(mask);
} else {
ERR(sh,
"Could not read from module store, active modules subdirectory at %s.",
@@ -613,11 +623,14 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_files[SEMANAGE_READ_LOCK];
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if ((fd = creat(path, S_IRUSR | S_IWUSR)) == -1) {
+ umask(mask);
ERR(sh, "Could not create lock file at %s.",
path);
return -2;
}
+ umask(mask);
close(fd);
} else {
ERR(sh, "Could not read lock file at %s.", path);
@@ -763,6 +776,7 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
struct stat sb;
struct dirent **names = NULL;
char path[PATH_MAX], path2[PATH_MAX];
+ mode_t mask;
if ((len = scandir(src, &names, semanage_filename_select, NULL)) == -1) {
fprintf(stderr, "Could not read the contents of %s: %s\n", src, strerror(errno));
@@ -770,10 +784,13 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
}
if (stat(dst, &sb) != 0) {
+ mask = umask(0077);
if (mkdir(dst, S_IRWXU) != 0) {
+ umask(mask);
fprintf(stderr, "Could not create %s: %s\n", dst, strerror(errno));
goto cleanup;
}
+ umask(mask);
}
for (i = 0; i < len; i++) {
@@ -785,14 +802,20 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
}
snprintf(path2, sizeof(path2), "%s/%s", dst, names[i]->d_name);
if (S_ISDIR(sb.st_mode)) {
+ mask = umask(0077);
if (mkdir(path2, 0700) == -1 ||
semanage_copy_dir_flags(path, path2, flag) == -1) {
+ umask(mask);
goto cleanup;
}
+ umask(mask);
} else if (S_ISREG(sb.st_mode) && flag == 1) {
+ mask = umask(0077);
if (semanage_copy_file(path, path2, sb.st_mode) < 0) {
+ umask(mask);
goto cleanup;
}
+ umask(mask);
}
}
retval = 0;
@@ -872,16 +895,20 @@ int semanage_mkdir(semanage_handle_t *sh, const char *path)
{
int status = 0;
struct stat sb;
+ mode_t mask;
/* check if directory already exists */
if (stat(path, &sb) != 0) {
/* make the modules directory */
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) != 0) {
+ umask(mask);
ERR(sh, "Cannot make directory at %s", path);
status = -1;
goto cleanup;
}
+ umask(mask);
}
else {
/* check that it really is a directory */
@@ -906,6 +933,7 @@ int semanage_make_sandbox(semanage_handle_t * sh)
const char *sandbox = semanage_path(SEMANAGE_TMP, SEMANAGE_TOPLEVEL);
struct stat buf;
int errsv;
+ mode_t mask;
if (stat(sandbox, &buf) == -1) {
if (errno != ENOENT) {
@@ -922,12 +950,15 @@ int semanage_make_sandbox(semanage_handle_t * sh)
}
}
+ mask = umask(0077);
if (mkdir(sandbox, S_IRWXU) == -1 ||
semanage_copy_dir(semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL),
sandbox) == -1) {
+ umask(mask);
ERR(sh, "Could not copy files to sandbox %s.", sandbox);
goto cleanup;
}
+ umask(mask);
return 0;
cleanup:
diff --git libsemanage-2.8/src/seusers_local.c libsemanage-2.8/src/seusers_local.c
index 413ebdd..a79e2d3 100644
--- libsemanage-2.8/src/seusers_local.c
+++ libsemanage-2.8/src/seusers_local.c
@@ -71,17 +71,18 @@ static int semanage_seuser_audit(semanage_handle_t * handle,
const char *sep = "-";
int rc = -1;
strcpy(msg, "login");
+ if (previous) {
+ name = semanage_seuser_get_name(previous);
+ psename = semanage_seuser_get_sename(previous);
+ pmls = semanage_seuser_get_mlsrange(previous);
+ proles = semanage_user_roles(handle, psename);
+ }
if (seuser) {
name = semanage_seuser_get_name(seuser);
sename = semanage_seuser_get_sename(seuser);
mls = semanage_seuser_get_mlsrange(seuser);
roles = semanage_user_roles(handle, sename);
}
- if (previous) {
- psename = semanage_seuser_get_sename(previous);
- pmls = semanage_seuser_get_mlsrange(previous);
- proles = semanage_user_roles(handle, psename);
- }
if (audit_type != AUDIT_ROLE_REMOVE) {
if (sename && (!psename || strcmp(psename, sename) != 0)) {
strcat(msg,sep);

31
SPECS/libsemanage.spec
View File

@ -1,17 +1,14 @@
%define libsepolver 2.8-2
%define libselinuxver 2.8-6
%define libsepolver 2.9-1
%define libselinuxver 2.9-1
Summary: SELinux binary policy manipulation library
Name: libsemanage
Version: 2.8
Release: 5%{?dist}
Version: 2.9
Release: 1%{?dist}
License: LGPLv2+
Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/libsemanage-2.8.tar.gz
# download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh
# run:
# $ VERSION=2.8 ./make-fedora-selinux-patch.sh libsemanage
# HEAD 92c6801145e904bc7d5a5b9cfd30120da04b0b10
Patch1: libsemanage-fedora.patch
Source0: https://github.com/SELinuxProject/selinux/releases/download/20190315/libsemanage-2.9.tar.gz
# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
Patch0001: 0001-libsemanage-Fix-RESOURCE_LEAK-and-USE_AFTER_FREE-cov.patch
URL: https://github.com/SELinuxProject/selinux/wiki
Source1: semanage.conf
@ -74,11 +71,11 @@ The libsemanage-python3 package contains the python 3 bindings for developing
SELinux management applications.
%prep
%autosetup -n libsemanage-%{version} -p 1
%autosetup -n libsemanage-%{version} -p 2
%build
export LDFLAGS="%{?__global_ldflags}"
%set_build_flags
# To support building the Python wrapper against multiple Python runtimes
# Define a function, for how to perform a "build" of the python wrapper against
@ -89,13 +86,13 @@ BuildPythonWrapper() {
# Perform the build from the upstream Makefile:
make \
PYTHON=$BinaryName \
CFLAGS="%{optflags}" LIBDIR="%{_libdir}" SHLIBDIR="%{_lib}" \
LIBDIR="%{_libdir}" SHLIBDIR="%{_lib}" \
pywrap
}
make clean
make CFLAGS="%{optflags}" swigify
make CFLAGS="%{optflags}" LIBDIR="%{_libdir}" SHLIBDIR="%{_lib}" all
make swigify
make LIBDIR="%{_libdir}" SHLIBDIR="%{_lib}" all
BuildPythonWrapper \
%{__python3}
@ -133,6 +130,7 @@ rm %{buildroot}%{_libexecdir}/selinux/semanage_migrate_store~
%config(noreplace) %{_sysconfdir}/selinux/semanage.conf
%{_libdir}/libsemanage.so.1
%{_mandir}/man5/*
%{_mandir}/ru/man5/*
%dir %{_libexecdir}/selinux
%dir %{_sharedstatedir}/selinux
%dir %{_sharedstatedir}/selinux/tmp
@ -156,6 +154,9 @@ rm %{buildroot}%{_libexecdir}/selinux/semanage_migrate_store~
%{_libexecdir}/selinux/semanage_migrate_store
%changelog
* Mon Mar 18 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-1
- SELinux userspace 2.9 release
* Thu Dec 6 2018 Petr Lautrbach <plautrba@redhat.com> - 2.8-5
- genhomedircon - improve handling large groups