From d1b284533d6ee36f652cb47b732bbe1ad4becde5 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 1 Jul 2026 22:06:19 +0200 Subject: [PATCH] SELinux userspace 3.11 release Resolves: RHEL-192089 --- .gitignore | 2 + ...Fix-translation-for-uncached-entries.patch | 108 ------------------ changelog | 3 + mcstrans.spec | 11 +- sources | 4 +- 5 files changed, 12 insertions(+), 116 deletions(-) delete mode 100644 0001-mcstrans-Fix-translation-for-uncached-entries.patch diff --git a/.gitignore b/.gitignore index 199d0ef..5a86061 100644 --- a/.gitignore +++ b/.gitignore @@ -60,3 +60,5 @@ mcstrans-0.3.1.tgz /mcstrans-3.9.tar.gz.asc /mcstrans-3.10.tar.gz /mcstrans-3.10.tar.gz.asc +/mcstrans-3.11.tar.gz +/mcstrans-3.11.tar.gz.asc diff --git a/0001-mcstrans-Fix-translation-for-uncached-entries.patch b/0001-mcstrans-Fix-translation-for-uncached-entries.patch deleted file mode 100644 index a4cde94..0000000 --- a/0001-mcstrans-Fix-translation-for-uncached-entries.patch +++ /dev/null @@ -1,108 +0,0 @@ -From edcec0d1f6920f53c372c43906182f9d01bf9640 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 16 Feb 2026 20:40:11 +0100 -Subject: [PATCH] mcstrans: Fix translation for uncached entries - -trans_context: -In case the raw context is not found in cache (find_in_hashtable returns -NULL) and the context does not contain a dash (dashp == NULL), -compute_trans_from_raw gets executed, but the translation (trans) gets -freed immediately after caching, at the end of the "for" loop. - -untrans_context: -Same as trans_context, if the translation is not cached and "range" does -not contain a dash, compute_raw_from_trans is called, but the -translation (raw) gets freed right after the reverse translation is -computed and cached. - -Also, fix the README for "nato" example and add README for "pipes" -example of setrans configuration. - -Fixes: - Pipes/NATO examples from /usr/share/mcstrans/examples - - $ /usr/share/mcstrans/util/mlstrans-test pipes.test -untrans: 'a:b:c:Restricted Handle Via Iron Pipes Only' -> 'a:b:c:Restricted Handle Via Iron Pipes Only' != 'a:b:c:s2:c102,c200.c511' FAILED -untrans: 'a:b:c:Restricted Handle Via Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Copper Pipes Only' != 'a:b:c:s2:c103,c200.c511' FAILED -untrans: 'a:b:c:Restricted Handle Via Plastic Pipes Only' -> 'a:b:c:Restricted Handle Via Plastic Pipes Only' != 'a:b:c:s2:c101,c200.c511' FAILED -untrans: 'a:b:c:Restricted Handle Via Galvanized Pipes Only' -> 'a:b:c:Restricted Handle Via Galvanized Pipes Only' != 'a:b:c:s2:c104,c200.c511' FAILED -untrans: 'a:b:c:Restricted Handle Via Plastic,Iron,Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Plastic,Iron,Copper Pipes Only' != 'a:b:c:s2:c101.c103,c200.c511' FAILED -untrans: 'a:b:c:Restricted Handle Via Iron,Plastic,Copper Pipes Only' -> 'a:b:c:Restricted Handle Via Iron,Plastic,Copper Pipes Only' != 'a:b:c:s2:c101.c103,c200.c511' FAILED -mlstrans-test done with 6 errors - -Signed-off-by: Vit Mojzis -Acked-by: James Carter ---- - mcstrans/share/examples/nato/README | 8 +++----- - mcstrans/share/examples/pipes/README | 10 ++++++++++ - mcstrans/src/mcstrans.c | 5 ++++- - 3 files changed, 17 insertions(+), 6 deletions(-) - create mode 100644 mcstrans/share/examples/pipes/README - -diff --git a/mcstrans/share/examples/nato/README b/mcstrans/share/examples/nato/README -index b8b30bf7..7d75e0d6 100644 ---- a/mcstrans/share/examples/nato/README -+++ b/mcstrans/share/examples/nato/README -@@ -1,12 +1,10 @@ - NATO example test setrans.conf - - To use: --mkdir /etc/selinux/mls/mcstrand.d --cp rel.conf /etc/selinux/mls/mcstrand.d --cp eyes-only.conf /etc/selinux/mls/mcstrand.d --cp constraints.conf /etc/selinux/mls/mcstrand.d -+rm -f /etc/selinux/mls/setrans.d/* -+cp setrans.d/* /etc/selinux/mls/setrans.d - cp setrans.conf /etc/selinux/mls/setrans.conf --sudo run_init /etc/init.d/mcstrans restart -+run_init /etc/init.d/mcstrans restart - - To test: - /usr/share/mcstrans/util/mlstrans-test nato.test -diff --git a/mcstrans/share/examples/pipes/README b/mcstrans/share/examples/pipes/README -new file mode 100644 -index 00000000..3963d300 ---- /dev/null -+++ b/mcstrans/share/examples/pipes/README -@@ -0,0 +1,10 @@ -+PIPES example test setrans.conf -+ -+To use: -+rm -f /etc/selinux/mls/setrans.d/* -+cp setrans.d/* /etc/selinux/mls/setrans.d -+cp setrans.conf /etc/selinux/mls/setrans.conf -+run_init /etc/init.d/mcstrans restart -+ -+To test: -+/usr/share/mcstrans/util/mlstrans-test pipes.test -diff --git a/mcstrans/src/mcstrans.c b/mcstrans/src/mcstrans.c -index f18f9da9..5ef6a0b9 100644 ---- a/mcstrans/src/mcstrans.c -+++ b/mcstrans/src/mcstrans.c -@@ -1578,12 +1578,14 @@ trans_context(const char *incon, char **rcon) { - urange = dashp+1; - } else { - trans = compute_trans_from_raw(range, domain); -- if (trans) -+ if (trans) { - if (add_cache(domain, range, trans) < 0) { - free(trans); - free(range); - return -1; - } -+ break; -+ } - } - - if (lrange && urange) { -@@ -1728,6 +1730,7 @@ untrans_context(const char *incon, char **rcon) { - free(raw); - return -1; - } -+ break; - } else { - log_debug("untrans_context unable to compute raw context %s\n", range); - } --- -2.53.0 - diff --git a/changelog b/changelog index 02e5525..4960c4a 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Jul 01 2026 Petr Lautrbach - 3.11-1 +- SELinux userspace 3.11 release + * Tue May 05 2026 Vit Mojzis - 3.10-2 - Fix translation for uncached entries (RHEL-122278) diff --git a/mcstrans.spec b/mcstrans.spec index c735602..3c560a8 100644 --- a/mcstrans.spec +++ b/mcstrans.spec @@ -1,19 +1,18 @@ -%define libselinuxver 3.10-1 +%define libselinuxver 3.11-1 Summary: SELinux Translation Daemon Name: mcstrans -Version: 3.10 -Release: 2%{?dist} +Version: 3.11 +Release: 1%{?dist} License: GPL-2.0-or-later Url: https://github.com/SELinuxProject/selinux/wiki Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/mcstrans-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/mcstrans-%{version}.tar.gz.asc -Source2: https://github.com/perfinion.gpg +Source2: https://github.com/bachradsusi.gpg Source3: secolor.conf.8 -# fedora-selinux/selinux: git format-patch -N 3.10 -- mcstrans +# fedora-selinux/selinux: git format-patch -N 3.11 -- mcstrans # i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done # Patch list start -Patch0001: 0001-mcstrans-Fix-translation-for-uncached-entries.patch # Patch list end BuildRequires: gcc BuildRequires: make diff --git a/sources b/sources index 8b10272..3070af0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (mcstrans-3.10.tar.gz) = 3100ae052c23a36312dce70d7b62c4135cb2850d0aa84088edddf71348944168ad753f7625157cbcf7dc7613169527676e42a5db6a850599230a42effb4c12e7 -SHA512 (mcstrans-3.10.tar.gz.asc) = 7590d5666ee915c7fe4693e223ee6e36cc75a63a54c39f8885443df0601c07220e0a24c61bf4e5756ad2b093dad20b73f1eafd178581587b8f1e29d97b065bf2 +SHA512 (mcstrans-3.11.tar.gz) = bc6ee5eb93518a6b41ac8775927bbf4a9d4a5be837feb8f1bbdc5105bcc94843d94c40dd172c0bd621e5d793c9dc1e588be64d6fe67ec8a33730bce10bcde79a +SHA512 (mcstrans-3.11.tar.gz.asc) = 3d1927c850733bf1b75820700fdce67fbe9f0b6372254795d1c39e09be53fd1e19b52250f0c21da3952cf9ef03ea5a4b3dcd4fd3af0fc9b11a8ef3dad799b9ca