.gitignore

@@ -1 +1,4 @@
-SOURCES/netlabel_tools-0.30.0.tar.gz
+netlabel_tools-0.19.tar.gz
+/netlabel_tools-0.20.tar.gz
+/netlabel_tools-0.21.tar.gz
+/netlabel_tools-0.30.0.tar.gz

.netlabel_tools.metadata

@@ -1 +0,0 @@
-a33d33658f3c40448b9e7a52884ab28e90832b2f SOURCES/netlabel_tools-0.30.0.tar.gz

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

netlabel

@@ -0,0 +1,119 @@
+#!/bin/sh
+#
+# netlabel	Start CIPSO labeled networking
+#
+# chkconfig: - 09 91
+# description:	Starts and stops CIPSO labeled networking
+#
+# config: /etc/netlabel.rules
+#
+# Return values according to LSB for all commands but status:
+# 0 - success
+# 1 - generic or unspecified error
+# 2 - invalid or excess argument(s)
+# 3 - unimplemented feature (e.g. "reload")
+# 4 - insufficient privilege
+# 5 - program is not installed
+# 6 - program is not configured
+# 7 - program is not running
+
+PATH=/sbin:/bin:/usr/bin:/usr/sbin
+VAR_SUBSYS_NETLABEL=/var/lock/subsys/netlabel
+RULES=/etc/netlabel.rules
+
+# Source function library.
+. /etc/init.d/functions
+
+# Check that we are root ... so non-root users stop here
+test `id -u` = 0  || exit 4
+test -x /sbin/netlabelctl || exit 5
+test -f $RULES || exit 6
+
+start() {
+    ret_val="0"
+
+    # Loop through rules
+    while read LINE
+    do
+	# Skip comments and blank lines
+	if echo $LINE | egrep '^#|^$' >/dev/null ; then
+		continue
+	fi
+	/sbin/netlabelctl $LINE >/dev/null 2>&1
+	ret="$?"
+	if [ "$ret" != "0" ] ; then
+		ret_val="$ret"
+	fi
+    done < $RULES
+    touch $VAR_SUBSYS_NETLABEL
+    return $ret_val
+}
+
+stop() {
+    rm -f $VAR_SUBSYS_NETLABEL
+
+    # Delete rules
+    list=`/sbin/netlabelctl cipsov4 list 2>/dev/null`
+    ret="$?"
+    if [ x"$list" != "x" ] ; then
+	for line in "$list"
+	do
+		/sbin/netlabelctl cipsov4 del "doi:$line" 2>/dev/null
+    		ret="$?"
+	done
+    fi
+    return $ret
+}
+
+status() {
+    # Do not print status if lockfile is missing 
+    if [ ! -f "$VAR_SUBSYS_NETLABEL" ]; then
+	echo $"Netlabel is stopped."
+	return 3
+    fi
+
+    # List rules
+    /sbin/netlabelctl -p cipsov4 list 2>/dev/null
+    ret1="$?"
+    /sbin/netlabelctl -p mgmt protocols 2>/dev/null
+    ret2="$?"
+
+    if [ "$ret1" != "0" -o "$ret2" != "0" ] ; then
+	return 2
+    fi
+    return 0
+}
+
+restart() {
+    stop
+    start
+}
+
+case "$1" in
+    start)
+	stop
+	start
+	RETVAL="$?"
+	;;
+    stop)
+	stop
+	RETVAL="$?"
+	;;
+    restart)
+	restart
+	RETVAL="$?"
+	;;
+    condrestart)
+	[ -e "$VAR_SUBSYS_NETLABEL" ] && restart
+	;;
+    status)
+	status
+	RETVAL="$?"
+	;;
+    *)
+	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
+	exit 3
+	;;
+esac
+
+exit $RETVAL

netlabel.rules

@@ -0,0 +1,59 @@
+# This file contains the rules for the Netlabel subsystem, for more information
+# please see the netlabelctl(1) man page.
+#
+# Each line contains just the arguments to the netlabel command
+
+####
+# NOTE: By default the kernel sends unlabeled traffic and allows unlabled
+#       traffic into the system, to disable that add the following two lines to
+#       the beginning of your configuration.  However, be warned that you
+#       should only change these settings if you know what you are doing as you
+#       could accidently disable networking with a bad configuration.
+#
+
+# Remove the default domain mapping
+#map del default
+
+# Do not accept incoming unlabeled packets
+#unlbl accept off
+
+####
+# Unlabeled examples:
+#
+
+# Enable unlabeled packets
+#unlbl accept on
+
+# Disable unlabeled packets
+#unlbl accept off
+
+
+####
+# CIPSOv4 examples:
+#
+
+# Create a CIPSOv4 DOI definition using a pass-through mapping with a DOI
+# value of 6 and the restricted bitmap tag (CIPSOv4 tag type #1)
+#cipsov4 add pass doi:6 tags:1
+
+# Create a CIPSOv4 DOI definition using a standard mapping with a DOI value
+# of 8 and the restricted bitmap tag (CIPSOv4 tag type #1).  The example
+# below maps MLS sensitivity levels and categories 0 through 2 to the same
+# values for both CIPSO and the Linux LSM
+#cipsov4 add std doi:8 tags:1 levels:0=0,1=1,2=2 categories:0=0,1=1,2=2
+
+
+####
+# LSM mapping examples:
+#
+
+# Create a default mapping for all LSM domains using the unlabeled protocol
+#map add default protocol:unlbl
+
+# Create a default mapping for all LSM domains using the CIPSOv4 protocol
+# with DOI number 6
+#map add default protocol:cipsov4,6
+
+# Create a mapping for the "secret_t" LSM domain and the CIPSOv4 protocol
+# with DOI number 8
+#map add domain:secret_t protocol:cipsov4,8

netlabel_tools.spec

@@ -1,16 +1,18 @@
 Summary: Tools to manage the Linux NetLabel subsystem
 Name: netlabel_tools
 Version: 0.30.0
-Release: 3%{?dist}
+Release: 13%{?dist}
 License: GPLv2
-Group: System Environment/Daemons
-Source: https://github.com/netlabel/netlabel_tools/releases/download/v%{version}/%{name}-%{version}.tar.gz
 URL: https://github.com/netlabel/netlabel_tools
+Source: https://github.com/netlabel/netlabel_tools/releases/download/v%{version}/%{name}-%{version}.tar.gz
+Patch0: rhbz1683434.patch
 
-Requires: kernel libnl3
+Requires: libnl3
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
+BuildRequires: make
+BuildRequires:  gcc
 BuildRequires: kernel-headers
 BuildRequires: libnl3-devel
 BuildRequires: doxygen
@@ -25,6 +27,7 @@ kernel subsystem.
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 %configure
@@ -64,6 +67,38 @@ make V=1 DESTDIR="%{buildroot}" install
 %attr(0644,root,root) %config(noreplace) /etc/netlabel.rules
 
 %changelog
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 0.30.0-13
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 0.30.0-12
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Aug 02 2019 Paul Moore <paul@paul-moore.com> - 0.30.0-8
+- Applied upstream patch to improve netlabel-config error reporting (rhbz #1683434)
+- Removed the kernel dependency (rhbz #1733605)
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.30.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

rhbz1683434.patch

@@ -0,0 +1,38 @@
+From 578a65904ff6426c01d81826873d27d0af35f355 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Sun, 17 Mar 2019 17:13:55 -0400
+Subject: [PATCH] netlabel_config: better error reporting on load
+
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+---
+ netlabelctl/netlabel-config | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/netlabelctl/netlabel-config b/netlabelctl/netlabel-config
+index 717d795..15c74f7 100755
+--- a/netlabelctl/netlabel-config
++++ b/netlabelctl/netlabel-config
+@@ -114,15 +114,21 @@ function nlbl_reset() {
+ # load the NetLabel configuration from the configuration file
+ function nlbl_load() {
+ 	local ret_rc=0
++	local line_num=0
+ 	local line
+ 	while read line; do
++		line_num=$(($line_num + 1))
+ 		# skip comments and blank lines
+ 		echo "$line" | egrep '^#|^$' >& /dev/null && continue
+ 
+ 		# perform the configuration
+-		netlabelctl $line >& /dev/null
++		output=$(netlabelctl $line 2>&1)
+ 		rc=$?
+-		[[ $rc -ne 0 ]] && ret_rc=1
++		if [[ $rc -ne 0 ]]; then
++			ret_rc=1
++			echo "error: line $line_num \"$line\""
++			echo "$output"
++		fi
+ 	done < "$CFG_FILE"
+ 
+ 	return $ret_rc

sources

@@ -0,0 +1 @@
+fc6b07bf01bc3f68f5f05071072e521e  netlabel_tools-0.30.0.tar.gz