SELinux userspace 3.11 release
Resolves: RHEL-192089
This commit is contained in:
Petr Lautrbach
parent
5a0e2cc4ce
commit
d1b284533d
2
.gitignore
vendored
2
.gitignore
vendored
@ -60,3 +60,5 @@ mcstrans-0.3.1.tgz
|
||||
/mcstrans-3.9.tar.gz.asc
|
||||
/mcstrans-3.10.tar.gz
|
||||
/mcstrans-3.10.tar.gz.asc
|
||||
/mcstrans-3.11.tar.gz
|
||||
/mcstrans-3.11.tar.gz.asc
|
||||
|
||||
@ -1,108 +0,0 @@
|
||||
From edcec0d1f6920f53c372c43906182f9d01bf9640 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 16 Feb 2026 20:40:11 +0100
|
||||
Subject: [PATCH] mcstrans: Fix translation for uncached entries
|
||||
|
||||
trans_context:
|
||||
In case the raw context is not found in cache (find_in_hashtable returns
|
||||
NULL) and the context does not contain a dash (dashp == NULL),
|
||||
compute_trans_from_raw gets executed, but the translation (trans) gets
|
||||
freed immediately after caching, at the end of the "for" loop.
|
||||
|
||||
untrans_context:
|
||||
Same as trans_context, if the translation is not cached and "range" does
|
||||
not contain a dash, compute_raw_from_trans is called, but the
|
||||
translation (raw) gets freed right after the reverse translation is
|
||||
computed and cached.
|
||||
|
||||
Also, fix the README for "nato" example and add README for "pipes"
|
||||
example of setrans configuration.
|
||||
|
||||
Fixes:
|
||||
Pipes/NATO examples from /usr/share/mcstrans/examples
|
||||
|
||||
$ /usr/share/mcstrans/util/mlstrans-test pipes.test
|
||||
untrans: 'a:b:c:Restricted Handle Via Iron Pipes Only' -> 'a:b:c:Restricted Handle Via Iron Pipes Only' != 'a:b:c:s2:c102,c200.c511' FAILED
|
||||
untrans: 'a:b:c:Restricted Handle Via Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Copper Pipes Only' != 'a:b:c:s2:c103,c200.c511' FAILED
|
||||
untrans: 'a:b:c:Restricted Handle Via Plastic Pipes Only' -> 'a:b:c:Restricted Handle Via Plastic Pipes Only' != 'a:b:c:s2:c101,c200.c511' FAILED
|
||||
untrans: 'a:b:c:Restricted Handle Via Galvanized Pipes Only' -> 'a:b:c:Restricted Handle Via Galvanized Pipes Only' != 'a:b:c:s2:c104,c200.c511' FAILED
|
||||
untrans: 'a:b:c:Restricted Handle Via Plastic,Iron,Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Plastic,Iron,Copper Pipes Only' != 'a:b:c:s2:c101.c103,c200.c511' FAILED
|
||||
untrans: 'a:b:c:Restricted Handle Via Iron,Plastic,Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Iron,Plastic,Copper Pipes Only' != 'a:b:c:s2:c101.c103,c200.c511' FAILED
|
||||
mlstrans-test done with 6 errors
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
Acked-by: James Carter <jwcart2@gmail.com>
|
||||
---
|
||||
mcstrans/share/examples/nato/README | 8 +++-----
|
||||
mcstrans/share/examples/pipes/README | 10 ++++++++++
|
||||
mcstrans/src/mcstrans.c | 5 ++++-
|
||||
3 files changed, 17 insertions(+), 6 deletions(-)
|
||||
create mode 100644 mcstrans/share/examples/pipes/README
|
||||
|
||||
diff --git a/mcstrans/share/examples/nato/README b/mcstrans/share/examples/nato/README
|
||||
index b8b30bf7..7d75e0d6 100644
|
||||
--- a/mcstrans/share/examples/nato/README
|
||||
+++ b/mcstrans/share/examples/nato/README
|
||||
@@ -1,12 +1,10 @@
|
||||
NATO example test setrans.conf
|
||||
|
||||
To use:
|
||||
-mkdir /etc/selinux/mls/mcstrand.d
|
||||
-cp rel.conf /etc/selinux/mls/mcstrand.d
|
||||
-cp eyes-only.conf /etc/selinux/mls/mcstrand.d
|
||||
-cp constraints.conf /etc/selinux/mls/mcstrand.d
|
||||
+rm -f /etc/selinux/mls/setrans.d/*
|
||||
+cp setrans.d/* /etc/selinux/mls/setrans.d
|
||||
cp setrans.conf /etc/selinux/mls/setrans.conf
|
||||
-sudo run_init /etc/init.d/mcstrans restart
|
||||
+run_init /etc/init.d/mcstrans restart
|
||||
|
||||
To test:
|
||||
/usr/share/mcstrans/util/mlstrans-test nato.test
|
||||
diff --git a/mcstrans/share/examples/pipes/README b/mcstrans/share/examples/pipes/README
|
||||
new file mode 100644
|
||||
index 00000000..3963d300
|
||||
--- /dev/null
|
||||
+++ b/mcstrans/share/examples/pipes/README
|
||||
@@ -0,0 +1,10 @@
|
||||
+PIPES example test setrans.conf
|
||||
+
|
||||
+To use:
|
||||
+rm -f /etc/selinux/mls/setrans.d/*
|
||||
+cp setrans.d/* /etc/selinux/mls/setrans.d
|
||||
+cp setrans.conf /etc/selinux/mls/setrans.conf
|
||||
+run_init /etc/init.d/mcstrans restart
|
||||
+
|
||||
+To test:
|
||||
+/usr/share/mcstrans/util/mlstrans-test pipes.test
|
||||
diff --git a/mcstrans/src/mcstrans.c b/mcstrans/src/mcstrans.c
|
||||
index f18f9da9..5ef6a0b9 100644
|
||||
--- a/mcstrans/src/mcstrans.c
|
||||
+++ b/mcstrans/src/mcstrans.c
|
||||
@@ -1578,12 +1578,14 @@ trans_context(const char *incon, char **rcon) {
|
||||
urange = dashp+1;
|
||||
} else {
|
||||
trans = compute_trans_from_raw(range, domain);
|
||||
- if (trans)
|
||||
+ if (trans) {
|
||||
if (add_cache(domain, range, trans) < 0) {
|
||||
free(trans);
|
||||
free(range);
|
||||
return -1;
|
||||
}
|
||||
+ break;
|
||||
+ }
|
||||
}
|
||||
|
||||
if (lrange && urange) {
|
||||
@@ -1728,6 +1730,7 @@ untrans_context(const char *incon, char **rcon) {
|
||||
free(raw);
|
||||
return -1;
|
||||
}
|
||||
+ break;
|
||||
} else {
|
||||
log_debug("untrans_context unable to compute raw context %s\n", range);
|
||||
}
|
||||
--
|
||||
2.53.0
|
||||
|
||||
@ -1,3 +1,6 @@
|
||||
* Wed Jul 01 2026 Petr Lautrbach <lautrbach@redhat.com> - 3.11-1
|
||||
- SELinux userspace 3.11 release
|
||||
|
||||
* Tue May 05 2026 Vit Mojzis <vmojzis@redhat.com> - 3.10-2
|
||||
- Fix translation for uncached entries (RHEL-122278)
|
||||
|
||||
|
||||
@ -1,19 +1,18 @@
|
||||
%define libselinuxver 3.10-1
|
||||
%define libselinuxver 3.11-1
|
||||
|
||||
Summary: SELinux Translation Daemon
|
||||
Name: mcstrans
|
||||
Version: 3.10
|
||||
Release: 2%{?dist}
|
||||
Version: 3.11
|
||||
Release: 1%{?dist}
|
||||
License: GPL-2.0-or-later
|
||||
Url: https://github.com/SELinuxProject/selinux/wiki
|
||||
Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/mcstrans-%{version}.tar.gz
|
||||
Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/mcstrans-%{version}.tar.gz.asc
|
||||
Source2: https://github.com/perfinion.gpg
|
||||
Source2: https://github.com/bachradsusi.gpg
|
||||
Source3: secolor.conf.8
|
||||
# fedora-selinux/selinux: git format-patch -N 3.10 -- mcstrans
|
||||
# fedora-selinux/selinux: git format-patch -N 3.11 -- mcstrans
|
||||
# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
|
||||
# Patch list start
|
||||
Patch0001: 0001-mcstrans-Fix-translation-for-uncached-entries.patch
|
||||
# Patch list end
|
||||
BuildRequires: gcc
|
||||
BuildRequires: make
|
||||
|
||||
4
sources
4
sources
@ -1,2 +1,2 @@
|
||||
SHA512 (mcstrans-3.10.tar.gz) = 3100ae052c23a36312dce70d7b62c4135cb2850d0aa84088edddf71348944168ad753f7625157cbcf7dc7613169527676e42a5db6a850599230a42effb4c12e7
|
||||
SHA512 (mcstrans-3.10.tar.gz.asc) = 7590d5666ee915c7fe4693e223ee6e36cc75a63a54c39f8885443df0601c07220e0a24c61bf4e5756ad2b093dad20b73f1eafd178581587b8f1e29d97b065bf2
|
||||
SHA512 (mcstrans-3.11.tar.gz) = bc6ee5eb93518a6b41ac8775927bbf4a9d4a5be837feb8f1bbdc5105bcc94843d94c40dd172c0bd621e5d793c9dc1e588be64d6fe67ec8a33730bce10bcde79a
|
||||
SHA512 (mcstrans-3.11.tar.gz.asc) = 3d1927c850733bf1b75820700fdce67fbe9f0b6372254795d1c39e09be53fd1e19b52250f0c21da3952cf9ef03ea5a4b3dcd4fd3af0fc9b11a8ef3dad799b9ca
|
||||
|
||||
Loading…
Reference in New Issue
Block a user