libsepol-3.5-0.rc1.1
- SELinux userspace 3.5-rc1 release Resolves: rhbz#2145224
This commit is contained in:
Petr Lautrbach
parent
4441f91a39
commit
d8b506680e
1
.gitignore
vendored
1
.gitignore
vendored
@ -184,3 +184,4 @@ libsepol-2.0.41.tgz
|
||||
/libsepol-3.3-rc3.tar.gz
|
||||
/libsepol-3.3.tar.gz
|
||||
/libsepol-3.4.tar.gz
|
||||
/libsepol-3.5-rc1.tar.gz
|
||||
|
||||
@ -1,43 +0,0 @@
|
||||
From 0594b9bdeac8e78aacd737e95ce0f74a467d1c43 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <plautrba@redhat.com>
|
||||
Date: Mon, 23 May 2022 12:25:58 +0200
|
||||
Subject: [PATCH] libsepol: Bring back POLICYDB_CAPABILITY_* constants
|
||||
Content-type: text/plain
|
||||
|
||||
They were removed by the commit 0d84ebcbc475d ("libsepol: Shorten the
|
||||
policy capability enum names") but they might be used somewhere in code
|
||||
deployed on RHEL 9.0
|
||||
|
||||
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||
---
|
||||
libsepol/include/sepol/policydb/polcaps.h | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
|
||||
index f5e32e60975d..e568733b3a33 100644
|
||||
--- a/libsepol/include/sepol/policydb/polcaps.h
|
||||
+++ b/libsepol/include/sepol/policydb/polcaps.h
|
||||
@@ -19,6 +19,20 @@ enum {
|
||||
};
|
||||
#define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
|
||||
|
||||
+/* legacy constants from past to preserve backward compatibility */
|
||||
+enum {
|
||||
+ POLICYDB_CAPABILITY_NETPEER = POLICYDB_CAP_NETPEER,
|
||||
+ POLICYDB_CAPABILITY_OPENPERM = POLICYDB_CAP_OPENPERM,
|
||||
+ POLICYDB_CAPABILITY_EXTSOCKCLASS = POLICYDB_CAP_EXTSOCKCLASS,
|
||||
+ POLICYDB_CAPABILITY_ALWAYSNETWORK = POLICYDB_CAP_ALWAYSNETWORK,
|
||||
+ POLICYDB_CAPABILITY_CGROUPSECLABEL = POLICYDB_CAP_CGROUPSECLABEL,
|
||||
+ POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION = POLICYDB_CAP_NNP_NOSUID_TRANSITION,
|
||||
+ POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS = POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS,
|
||||
+ POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC = POLICYDB_CAP_IOCTL_SKIP_CLOEXEC,
|
||||
+ __POLICYDB_CAPABILITY_MAX = __POLICYDB_CAP_MAX
|
||||
+};
|
||||
+#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAP_MAX - 1)
|
||||
+
|
||||
/* Convert a capability name to number. */
|
||||
extern int sepol_polcap_getnum(const char *name);
|
||||
|
||||
--
|
||||
2.36.1
|
||||
|
||||
@ -1,50 +0,0 @@
|
||||
From 4446a0661b4113a91a2b5d693d497de939b44843 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
||||
Date: Wed, 12 Oct 2022 16:27:51 +0200
|
||||
Subject: [PATCH] libsepol/cil: restore error on context rule conflicts
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
Content-type: text/plain
|
||||
|
||||
Commit bc26ddc59c8d ("libsepol/cil: Limit the amount of reporting for
|
||||
context rule conflicts") reworked the processing of context rule
|
||||
conflicts to limit the number of written conflicting statements to
|
||||
increase readability of the printed error message. It forgot to set the
|
||||
return value, signaling a context conflict, in the case the logging
|
||||
level is higher than warning (e.g. in semodule(8), which defaults to
|
||||
error).
|
||||
|
||||
Reported-by: Milos Malik <mmalik@redhat.com> [1]
|
||||
Fixes: bc26ddc59c8d ("libsepol/cil: Limit the amount of reporting for context rule conflicts")
|
||||
|
||||
[1]: https://lore.kernel.org/selinux/87y1u1rkoo.fsf@redhat.com/
|
||||
|
||||
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
|
||||
---
|
||||
libsepol/cil/src/cil_post.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
|
||||
index 6e95225f93f1..11e572e274aa 100644
|
||||
--- a/libsepol/cil/src/cil_post.c
|
||||
+++ b/libsepol/cil/src/cil_post.c
|
||||
@@ -2290,6 +2290,7 @@ static int __cil_post_process_context_rules(struct cil_sort *sort, int (*compar)
|
||||
} else {
|
||||
removed++;
|
||||
if (!db->multiple_decls || concompar(&sort->array[i], &sort->array[j]) != 0) {
|
||||
+ rc = SEPOL_ERR;
|
||||
conflicting++;
|
||||
if (log_level >= CIL_WARN) {
|
||||
struct cil_list_item li;
|
||||
@@ -2297,7 +2298,6 @@ static int __cil_post_process_context_rules(struct cil_sort *sort, int (*compar)
|
||||
li.flavor = flavor;
|
||||
if (conflicting == 1) {
|
||||
cil_log(CIL_WARN, "Found conflicting %s rules\n", flavor_str);
|
||||
- rc = SEPOL_ERR;
|
||||
li.data = sort->array[i];
|
||||
rc2 = cil_tree_walk(db->ast->root, __cil_post_report_conflict,
|
||||
NULL, NULL, &li);
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -1,76 +0,0 @@
|
||||
From 39b5a1e0cb5d24109c9d8ddc980022ad6474ef1a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
||||
Date: Tue, 7 Jun 2022 17:01:45 +0200
|
||||
Subject: [PATCH] libsepol: fix validation of user declarations in modules
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
Content-type: text/plain
|
||||
|
||||
Users are allowed to be declared in modules. Modules do not get expanded
|
||||
leaving the `struct user_datum` members `exp_range` and `exp_dfltlevel`
|
||||
empty.
|
||||
Do no validate the expanded range and level for modular polices.
|
||||
|
||||
Reported-by: bauen1 <j2468h@gmail.com>
|
||||
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
libsepol/src/policydb_validate.c | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
|
||||
index da18282bafc8..99d4eb7f670e 100644
|
||||
--- a/libsepol/src/policydb_validate.c
|
||||
+++ b/libsepol/src/policydb_validate.c
|
||||
@@ -18,7 +18,7 @@ typedef struct validate {
|
||||
typedef struct map_arg {
|
||||
validate_t *flavors;
|
||||
sepol_handle_t *handle;
|
||||
- int mls;
|
||||
+ policydb_t *policy;
|
||||
} map_arg_t;
|
||||
|
||||
static int create_gap_ebitmap(char **val_to_name, uint32_t nprim, ebitmap_t *gaps)
|
||||
@@ -571,7 +571,7 @@ static int validate_mls_range(mls_range_t *range, validate_t *sens, validate_t *
|
||||
return -1;
|
||||
}
|
||||
|
||||
-static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], int mls)
|
||||
+static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], policydb_t *p)
|
||||
{
|
||||
if (validate_value(user->s.value, &flavors[SYM_USERS]))
|
||||
goto bad;
|
||||
@@ -581,9 +581,9 @@ static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, valid
|
||||
goto bad;
|
||||
if (validate_mls_semantic_level(&user->dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
|
||||
goto bad;
|
||||
- if (mls && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
|
||||
+ if (p->mls && p->policy_type != POLICY_MOD && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
|
||||
goto bad;
|
||||
- if (mls && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
|
||||
+ if (p->mls && p->policy_type != POLICY_MOD && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
|
||||
goto bad;
|
||||
if (user->bounds && validate_value(user->bounds, &flavors[SYM_USERS]))
|
||||
goto bad;
|
||||
@@ -599,7 +599,7 @@ static int validate_user_datum_wrapper(__attribute__((unused)) hashtab_key_t k,
|
||||
{
|
||||
map_arg_t *margs = args;
|
||||
|
||||
- return validate_user_datum(margs->handle, d, margs->flavors, margs->mls);
|
||||
+ return validate_user_datum(margs->handle, d, margs->flavors, margs->policy);
|
||||
}
|
||||
|
||||
static int validate_bool_datum(sepol_handle_t *handle, cond_bool_datum_t *boolean, validate_t flavors[])
|
||||
@@ -689,7 +689,7 @@ static int validate_datum(__attribute__ ((unused))hashtab_key_t k, hashtab_datum
|
||||
|
||||
static int validate_datum_array_entries(sepol_handle_t *handle, policydb_t *p, validate_t flavors[])
|
||||
{
|
||||
- map_arg_t margs = { flavors, handle, p->mls };
|
||||
+ map_arg_t margs = { flavors, handle, p };
|
||||
|
||||
if (hashtab_map(p->p_commons.table, validate_common_datum_wrapper, &margs))
|
||||
goto bad;
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -1,18 +1,15 @@
|
||||
Summary: SELinux binary policy manipulation library
|
||||
Name: libsepol
|
||||
Version: 3.4
|
||||
Release: 3%{?dist}
|
||||
Version: 3.5
|
||||
Release: 0.rc1.1%{?dist}
|
||||
License: LGPLv2+
|
||||
Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/libsepol-3.4.tar.gz
|
||||
Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc1/libsepol-3.5-rc1.tar.gz
|
||||
URL: https://github.com/SELinuxProject/selinux/wiki
|
||||
# $ git clone https://github.com/fedora-selinux/selinux.git
|
||||
# $ cd selinux
|
||||
# $ git format-patch -N libsepol-3.4 -- libsepol
|
||||
# $ git format-patch -N libsepol-3.5-rc1 -- libsepol
|
||||
# $ i=1; for j in 0*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
|
||||
# Patch list start
|
||||
Patch0001: 0001-libsepol-Bring-back-POLICYDB_CAPABILITY_-constants.patch
|
||||
Patch0002: 0002-libsepol-cil-restore-error-on-context-rule-conflicts.patch
|
||||
Patch0003: 0003-libsepol-fix-validation-of-user-declarations-in-modu.patch
|
||||
# Patch list end
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
@ -59,7 +56,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
The libsepol-utils package contains the utilities
|
||||
|
||||
%prep
|
||||
%autosetup -p 2 -n libsepol-%{version}
|
||||
%autosetup -p 2 -n libsepol-%{version}-rc1
|
||||
|
||||
# sparc64 is an -fPIC arch, so we need to fix it here
|
||||
%ifarch sparc64
|
||||
@ -96,7 +93,7 @@ rm -rf ${RPM_BUILD_ROOT}%{_mandir}/ru/man8
|
||||
%{_includedir}/sepol/cil/*.h
|
||||
|
||||
%files
|
||||
%license COPYING
|
||||
%license LICENSE
|
||||
%{_libdir}/libsepol.so.2
|
||||
|
||||
%files utils
|
||||
@ -109,6 +106,9 @@ rm -rf ${RPM_BUILD_ROOT}%{_mandir}/ru/man8
|
||||
%{_mandir}/man8/chkcon.8.gz
|
||||
|
||||
%changelog
|
||||
* Mon Jan 2 2023 Petr Lautrbach <lautrbach@redhat.com> - 3.5-0.rc1.1
|
||||
- SELinux userspace 3.5-rc1 release
|
||||
|
||||
* Fri Oct 21 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-3
|
||||
- Fix validation of user declarations in modules (#2136212)
|
||||
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (libsepol-3.4.tar.gz) = 5e47e6ac626f2bfc10a9f2f24c2e66c4d7f291ca778ebd81c7d565326e036e821d3eb92e5d7540517b1c715466232a7d7da895ab48811d037ad92d423ed934b6
|
||||
SHA512 (libsepol-3.5-rc1.tar.gz) = d4a57a599b98bc56349fcbcc347ce9d19f03c11490a34e71d219548f722d892a4b2d4edc2d4b9340b6b830021a6325d142e2207412b4b69f88fd3194e8fc98e0
|
||||
|
||||
Loading…
Reference in New Issue
Block a user