diff --git a/.gitignore b/.gitignore index 579e635..ba651bf 100644 --- a/.gitignore +++ b/.gitignore @@ -184,3 +184,4 @@ libsepol-2.0.41.tgz /libsepol-3.3-rc3.tar.gz /libsepol-3.3.tar.gz /libsepol-3.4.tar.gz +/libsepol-3.5-rc1.tar.gz diff --git a/0001-libsepol-Bring-back-POLICYDB_CAPABILITY_-constants.patch b/0001-libsepol-Bring-back-POLICYDB_CAPABILITY_-constants.patch deleted file mode 100644 index dc4afbc..0000000 --- a/0001-libsepol-Bring-back-POLICYDB_CAPABILITY_-constants.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 0594b9bdeac8e78aacd737e95ce0f74a467d1c43 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 23 May 2022 12:25:58 +0200 -Subject: [PATCH] libsepol: Bring back POLICYDB_CAPABILITY_* constants -Content-type: text/plain - -They were removed by the commit 0d84ebcbc475d ("libsepol: Shorten the -policy capability enum names") but they might be used somewhere in code -deployed on RHEL 9.0 - -Signed-off-by: Petr Lautrbach ---- - libsepol/include/sepol/policydb/polcaps.h | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h -index f5e32e60975d..e568733b3a33 100644 ---- a/libsepol/include/sepol/policydb/polcaps.h -+++ b/libsepol/include/sepol/policydb/polcaps.h -@@ -19,6 +19,20 @@ enum { - }; - #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1) - -+/* legacy constants from past to preserve backward compatibility */ -+enum { -+ POLICYDB_CAPABILITY_NETPEER = POLICYDB_CAP_NETPEER, -+ POLICYDB_CAPABILITY_OPENPERM = POLICYDB_CAP_OPENPERM, -+ POLICYDB_CAPABILITY_EXTSOCKCLASS = POLICYDB_CAP_EXTSOCKCLASS, -+ POLICYDB_CAPABILITY_ALWAYSNETWORK = POLICYDB_CAP_ALWAYSNETWORK, -+ POLICYDB_CAPABILITY_CGROUPSECLABEL = POLICYDB_CAP_CGROUPSECLABEL, -+ POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION = POLICYDB_CAP_NNP_NOSUID_TRANSITION, -+ POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS = POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS, -+ POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC = POLICYDB_CAP_IOCTL_SKIP_CLOEXEC, -+ __POLICYDB_CAPABILITY_MAX = __POLICYDB_CAP_MAX -+}; -+#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAP_MAX - 1) -+ - /* Convert a capability name to number. */ - extern int sepol_polcap_getnum(const char *name); - --- -2.36.1 - diff --git a/0002-libsepol-cil-restore-error-on-context-rule-conflicts.patch b/0002-libsepol-cil-restore-error-on-context-rule-conflicts.patch deleted file mode 100644 index bb44af6..0000000 --- a/0002-libsepol-cil-restore-error-on-context-rule-conflicts.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 4446a0661b4113a91a2b5d693d497de939b44843 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Wed, 12 Oct 2022 16:27:51 +0200 -Subject: [PATCH] libsepol/cil: restore error on context rule conflicts -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -Commit bc26ddc59c8d ("libsepol/cil: Limit the amount of reporting for -context rule conflicts") reworked the processing of context rule -conflicts to limit the number of written conflicting statements to -increase readability of the printed error message. It forgot to set the -return value, signaling a context conflict, in the case the logging -level is higher than warning (e.g. in semodule(8), which defaults to -error). - -Reported-by: Milos Malik [1] -Fixes: bc26ddc59c8d ("libsepol/cil: Limit the amount of reporting for context rule conflicts") - -[1]: https://lore.kernel.org/selinux/87y1u1rkoo.fsf@redhat.com/ - -Signed-off-by: Christian Göttsche ---- - libsepol/cil/src/cil_post.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c -index 6e95225f93f1..11e572e274aa 100644 ---- a/libsepol/cil/src/cil_post.c -+++ b/libsepol/cil/src/cil_post.c -@@ -2290,6 +2290,7 @@ static int __cil_post_process_context_rules(struct cil_sort *sort, int (*compar) - } else { - removed++; - if (!db->multiple_decls || concompar(&sort->array[i], &sort->array[j]) != 0) { -+ rc = SEPOL_ERR; - conflicting++; - if (log_level >= CIL_WARN) { - struct cil_list_item li; -@@ -2297,7 +2298,6 @@ static int __cil_post_process_context_rules(struct cil_sort *sort, int (*compar) - li.flavor = flavor; - if (conflicting == 1) { - cil_log(CIL_WARN, "Found conflicting %s rules\n", flavor_str); -- rc = SEPOL_ERR; - li.data = sort->array[i]; - rc2 = cil_tree_walk(db->ast->root, __cil_post_report_conflict, - NULL, NULL, &li); --- -2.37.3 - diff --git a/0003-libsepol-fix-validation-of-user-declarations-in-modu.patch b/0003-libsepol-fix-validation-of-user-declarations-in-modu.patch deleted file mode 100644 index 5de40ed..0000000 --- a/0003-libsepol-fix-validation-of-user-declarations-in-modu.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 39b5a1e0cb5d24109c9d8ddc980022ad6474ef1a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Tue, 7 Jun 2022 17:01:45 +0200 -Subject: [PATCH] libsepol: fix validation of user declarations in modules -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -Users are allowed to be declared in modules. Modules do not get expanded -leaving the `struct user_datum` members `exp_range` and `exp_dfltlevel` -empty. -Do no validate the expanded range and level for modular polices. - -Reported-by: bauen1 -Signed-off-by: Christian Göttsche -Acked-by: James Carter ---- - libsepol/src/policydb_validate.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - -diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c -index da18282bafc8..99d4eb7f670e 100644 ---- a/libsepol/src/policydb_validate.c -+++ b/libsepol/src/policydb_validate.c -@@ -18,7 +18,7 @@ typedef struct validate { - typedef struct map_arg { - validate_t *flavors; - sepol_handle_t *handle; -- int mls; -+ policydb_t *policy; - } map_arg_t; - - static int create_gap_ebitmap(char **val_to_name, uint32_t nprim, ebitmap_t *gaps) -@@ -571,7 +571,7 @@ static int validate_mls_range(mls_range_t *range, validate_t *sens, validate_t * - return -1; - } - --static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], int mls) -+static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], policydb_t *p) - { - if (validate_value(user->s.value, &flavors[SYM_USERS])) - goto bad; -@@ -581,9 +581,9 @@ static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, valid - goto bad; - if (validate_mls_semantic_level(&user->dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS])) - goto bad; -- if (mls && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS])) -+ if (p->mls && p->policy_type != POLICY_MOD && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS])) - goto bad; -- if (mls && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS])) -+ if (p->mls && p->policy_type != POLICY_MOD && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS])) - goto bad; - if (user->bounds && validate_value(user->bounds, &flavors[SYM_USERS])) - goto bad; -@@ -599,7 +599,7 @@ static int validate_user_datum_wrapper(__attribute__((unused)) hashtab_key_t k, - { - map_arg_t *margs = args; - -- return validate_user_datum(margs->handle, d, margs->flavors, margs->mls); -+ return validate_user_datum(margs->handle, d, margs->flavors, margs->policy); - } - - static int validate_bool_datum(sepol_handle_t *handle, cond_bool_datum_t *boolean, validate_t flavors[]) -@@ -689,7 +689,7 @@ static int validate_datum(__attribute__ ((unused))hashtab_key_t k, hashtab_datum - - static int validate_datum_array_entries(sepol_handle_t *handle, policydb_t *p, validate_t flavors[]) - { -- map_arg_t margs = { flavors, handle, p->mls }; -+ map_arg_t margs = { flavors, handle, p }; - - if (hashtab_map(p->p_commons.table, validate_common_datum_wrapper, &margs)) - goto bad; --- -2.37.3 - diff --git a/libsepol.spec b/libsepol.spec index 9303754..9729ac5 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -1,18 +1,15 @@ Summary: SELinux binary policy manipulation library Name: libsepol -Version: 3.4 -Release: 3%{?dist} +Version: 3.5 +Release: 0.rc1.1%{?dist} License: LGPLv2+ -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/libsepol-3.4.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc1/libsepol-3.5-rc1.tar.gz URL: https://github.com/SELinuxProject/selinux/wiki # $ git clone https://github.com/fedora-selinux/selinux.git # $ cd selinux -# $ git format-patch -N libsepol-3.4 -- libsepol +# $ git format-patch -N libsepol-3.5-rc1 -- libsepol # $ i=1; for j in 0*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done # Patch list start -Patch0001: 0001-libsepol-Bring-back-POLICYDB_CAPABILITY_-constants.patch -Patch0002: 0002-libsepol-cil-restore-error-on-context-rule-conflicts.patch -Patch0003: 0003-libsepol-fix-validation-of-user-declarations-in-modu.patch # Patch list end BuildRequires: make BuildRequires: gcc @@ -59,7 +56,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release} The libsepol-utils package contains the utilities %prep -%autosetup -p 2 -n libsepol-%{version} +%autosetup -p 2 -n libsepol-%{version}-rc1 # sparc64 is an -fPIC arch, so we need to fix it here %ifarch sparc64 @@ -96,7 +93,7 @@ rm -rf ${RPM_BUILD_ROOT}%{_mandir}/ru/man8 %{_includedir}/sepol/cil/*.h %files -%license COPYING +%license LICENSE %{_libdir}/libsepol.so.2 %files utils @@ -109,6 +106,9 @@ rm -rf ${RPM_BUILD_ROOT}%{_mandir}/ru/man8 %{_mandir}/man8/chkcon.8.gz %changelog +* Mon Jan 2 2023 Petr Lautrbach - 3.5-0.rc1.1 +- SELinux userspace 3.5-rc1 release + * Fri Oct 21 2022 Petr Lautrbach - 3.4-3 - Fix validation of user declarations in modules (#2136212) diff --git a/sources b/sources index b7769cb..062fdac 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libsepol-3.4.tar.gz) = 5e47e6ac626f2bfc10a9f2f24c2e66c4d7f291ca778ebd81c7d565326e036e821d3eb92e5d7540517b1c715466232a7d7da895ab48811d037ad92d423ed934b6 +SHA512 (libsepol-3.5-rc1.tar.gz) = d4a57a599b98bc56349fcbcc347ce9d19f03c11490a34e71d219548f722d892a4b2d4edc2d4b9340b6b830021a6325d142e2207412b4b69f88fd3194e8fc98e0