* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 2.0.34-2
- Make sepolgen set error exit code when partial failure - audit2why now checks booleans for avc diagnosis
This commit is contained in:
parent
bac931cd73
commit
7f6f58266d
@ -28,19 +28,233 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
.TP
|
.TP
|
||||||
.B "\-t " | "\-\-tefile"
|
.B "\-t " | "\-\-tefile"
|
||||||
Indicates input file is a te (type enforcement) file. This can be used to translate old te format to new policy format.
|
Indicates input file is a te (type enforcement) file. This can be used to translate old te format to new policy format.
|
||||||
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/sepolgen-ifgen policycoreutils-2.0.34/audit2allow/sepolgen-ifgen
|
||||||
|
--- nsapolicycoreutils/audit2allow/sepolgen-ifgen 2007-07-16 14:20:41.000000000 -0400
|
||||||
|
+++ policycoreutils-2.0.34/audit2allow/sepolgen-ifgen 2007-12-20 14:19:50.000000000 -0500
|
||||||
|
@@ -80,7 +80,10 @@
|
||||||
|
if_set.to_file(f)
|
||||||
|
f.close()
|
||||||
|
|
||||||
|
- return 0
|
||||||
|
+ if refparser.success:
|
||||||
|
+ return 0
|
||||||
|
+ else:
|
||||||
|
+ return 1
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
|
Binary files nsapolicycoreutils/audit2why/audit2why and policycoreutils-2.0.34/audit2why/audit2why differ
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/audit2why.c policycoreutils-2.0.34/audit2why/audit2why.c
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/audit2why.c policycoreutils-2.0.34/audit2why/audit2why.c
|
||||||
--- nsapolicycoreutils/audit2why/audit2why.c 2007-07-16 14:20:41.000000000 -0400
|
--- nsapolicycoreutils/audit2why/audit2why.c 2007-07-16 14:20:41.000000000 -0400
|
||||||
+++ policycoreutils-2.0.34/audit2why/audit2why.c 2007-12-19 06:05:50.000000000 -0500
|
+++ policycoreutils-2.0.34/audit2why/audit2why.c 2007-12-20 11:04:10.000000000 -0500
|
||||||
@@ -137,6 +137,8 @@
|
@@ -22,27 +22,151 @@
|
||||||
|
exit(rc);
|
||||||
|
}
|
||||||
|
|
||||||
|
+struct bool_t {
|
||||||
|
+ const sepol_bool_t * boolean;
|
||||||
|
+ char *name;
|
||||||
|
+ int active;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static struct bool_t **boollist = NULL;
|
||||||
|
+static int boolcnt = 0;
|
||||||
|
+
|
||||||
|
+struct access_t {
|
||||||
|
+ sepol_handle_t *handle;
|
||||||
|
+ sepol_policydb_t *policydb;
|
||||||
|
+ sepol_security_id_t ssid;
|
||||||
|
+ sepol_security_id_t tsid;
|
||||||
|
+ sepol_security_class_t tclass;
|
||||||
|
+ sepol_access_vector_t av;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int load_booleans (const sepol_bool_t * boolean,
|
||||||
|
+ void *arg __attribute__ ((__unused__)) ) {
|
||||||
|
+ boollist[boolcnt] = (struct bool_t *) malloc(sizeof (struct bool_t));
|
||||||
|
+ boollist[boolcnt]->boolean = boolean;
|
||||||
|
+ boollist[boolcnt]->name = strdup(sepol_bool_get_name(boolean));
|
||||||
|
+ boollist[boolcnt]->active = sepol_bool_get_value(boolean);
|
||||||
|
+ boolcnt++;
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static int check_booleans (struct access_t *access) {
|
||||||
|
+ struct sepol_av_decision avd;
|
||||||
|
+ unsigned int reason;
|
||||||
|
+ int rc;
|
||||||
|
+ int i;
|
||||||
|
+ sepol_bool_key_t *key=NULL;
|
||||||
|
+ int fcnt = 0;
|
||||||
|
+ int *foundlist = calloc(boolcnt, sizeof(int));
|
||||||
|
+ if (!foundlist) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+ "Out of memory.\n");
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+ for (i=0; i < boolcnt; i++) {
|
||||||
|
+ char *name = boollist[i]->name;
|
||||||
|
+ int active = boollist[i]->active;
|
||||||
|
+ sepol_bool_t * boolean = (sepol_bool_t *) boollist[i]->boolean;
|
||||||
|
+ rc = sepol_bool_key_create(access->handle,
|
||||||
|
+ name,
|
||||||
|
+ &key);
|
||||||
|
+ if (rc < 0) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+ "Could not create boolean key.\n");
|
||||||
|
+ rc = -1;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ sepol_bool_set_value(boolean, !active);
|
||||||
|
+
|
||||||
|
+ rc = sepol_bool_set(access->handle,
|
||||||
|
+ access->policydb,
|
||||||
|
+ key,
|
||||||
|
+ boolean);
|
||||||
|
+ if (rc < 0) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+ "Could not set boolean data %s.\n", name);
|
||||||
|
+ rc = -1;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* Reproduce the computation. */
|
||||||
|
+ rc = sepol_compute_av_reason(access->ssid, access->tsid, access->tclass, access->av, &avd, &reason);
|
||||||
|
+ if (rc < 0) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+ "Error during access vector computation, skipping...\n");
|
||||||
|
+ rc = -1;
|
||||||
|
+ break;
|
||||||
|
+ } else {
|
||||||
|
+ if (!reason) {
|
||||||
|
+ foundlist[fcnt] = i;
|
||||||
|
+ fcnt++;
|
||||||
|
+ rc = 0;
|
||||||
|
+ }
|
||||||
|
+ sepol_bool_set_value((sepol_bool_t*)boolean, active);
|
||||||
|
+ rc = sepol_bool_set(access->handle,
|
||||||
|
+ access->policydb,
|
||||||
|
+ key,
|
||||||
|
+ (sepol_bool_t*) boolean);
|
||||||
|
+ if (rc < 0) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+ "Could not set boolean data %s.\n", name);
|
||||||
|
+ rc = -1;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ sepol_bool_key_free(key);
|
||||||
|
+ key=NULL;
|
||||||
|
+ }
|
||||||
|
+ if (key)
|
||||||
|
+ sepol_bool_key_free(key);
|
||||||
|
+
|
||||||
|
+ if (fcnt > 0) {
|
||||||
|
+ printf("\tA boolean being set incorrectly.\n");
|
||||||
|
+ for (i = 0; i < fcnt; i++) {
|
||||||
|
+ int ctr = foundlist[i];
|
||||||
|
+ char *name = boollist[ctr]->name;
|
||||||
|
+ int active = boollist[ctr]->active;
|
||||||
|
+ printf("\n\tBoolean %s is %d.\n\tExecute the following to allow access:\n", name, active);
|
||||||
|
+ printf("\t# setsebool -P %s %d\n", name, !active);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ free(foundlist);
|
||||||
|
+ return rc;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+
|
||||||
|
int main(int argc, char **argv)
|
||||||
|
{
|
||||||
|
char path[PATH_MAX];
|
||||||
|
char *buffer = NULL, *bufcopy = NULL;
|
||||||
|
- unsigned int lineno = 0;
|
||||||
|
+ unsigned int lineno = 0, cnt;
|
||||||
|
size_t len = 0, bufcopy_len = 0;
|
||||||
|
- FILE *fp;
|
||||||
|
+ FILE *fp, *avcp=stdin;
|
||||||
|
int opt, rc, set_path = 0;
|
||||||
|
char *p, *scon, *tcon, *tclassstr, *permstr;
|
||||||
|
sepol_security_id_t ssid, tsid;
|
||||||
|
sepol_security_class_t tclass;
|
||||||
|
sepol_access_vector_t perm, av;
|
||||||
|
+ struct access_t access;
|
||||||
|
struct sepol_av_decision avd;
|
||||||
|
unsigned int reason;
|
||||||
|
int vers = 0;
|
||||||
|
sidtab_t sidtab;
|
||||||
|
policydb_t policydb;
|
||||||
|
struct policy_file pf;
|
||||||
|
-
|
||||||
|
- while ((opt = getopt(argc, argv, "p:?h")) > 0) {
|
||||||
|
+
|
||||||
|
+ while ((opt = getopt(argc, argv, "i:p:?h")) > 0) {
|
||||||
|
switch (opt) {
|
||||||
|
+ case 'i':
|
||||||
|
+ avcp = fopen(optarg, "r");
|
||||||
|
+ if (!avcp) {
|
||||||
|
+ fprintf(stderr, "%s: unable to open %s: %s\n",
|
||||||
|
+ argv[0], path, strerror(errno));
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+ break;
|
||||||
|
+
|
||||||
|
case 'p':
|
||||||
|
set_path = 1;
|
||||||
|
strncpy(path, optarg, PATH_MAX);
|
||||||
|
@@ -110,7 +234,6 @@
|
||||||
|
}
|
||||||
|
fclose(fp);
|
||||||
|
sepol_set_policydb(&policydb);
|
||||||
|
-
|
||||||
|
if (!set_path) {
|
||||||
|
/* If they didn't specify a full path of a binary policy file,
|
||||||
|
then also try loading any boolean settings and user
|
||||||
|
@@ -125,6 +248,30 @@
|
||||||
|
(void)sepol_genusers_policydb(&policydb, selinux_users_path());
|
||||||
|
}
|
||||||
|
|
||||||
|
+ access.handle = sepol_handle_create();
|
||||||
|
+ access.policydb = (sepol_policydb_t *) &policydb,
|
||||||
|
+
|
||||||
|
+ rc = sepol_bool_count(access.handle,
|
||||||
|
+ access.policydb,
|
||||||
|
+ &cnt);
|
||||||
|
+ if (rc < 0) {
|
||||||
|
+ fprintf(stderr, "%s: unable to get bool count\n", argv[0]);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ boollist = calloc(cnt, sizeof(struct bool_t));
|
||||||
|
+ if (!boollist) {
|
||||||
|
+ fprintf(stderr, "%s: Out of memory\n", argv[0]);
|
||||||
|
+ exit(1);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+ sepol_bool_iterate(access.handle,
|
||||||
|
+ (const sepol_policydb_t *) &policydb,
|
||||||
|
+ load_booleans,
|
||||||
|
+ (void *)NULL);
|
||||||
|
+
|
||||||
|
+
|
||||||
|
/* Initialize the sidtab for subsequent use by sepol_context_to_sid
|
||||||
|
and sepol_compute_av_reason. */
|
||||||
|
rc = sepol_sidtab_init(&sidtab);
|
||||||
|
@@ -135,8 +282,10 @@
|
||||||
|
sepol_set_sidtab(&sidtab);
|
||||||
|
|
||||||
/* Process the audit messages. */
|
/* Process the audit messages. */
|
||||||
while (getline(&buffer, &len, stdin) > 0) {
|
- while (getline(&buffer, &len, stdin) > 0) {
|
||||||
|
+ while (getline(&buffer, &len, avcp) > 0) {
|
||||||
size_t len2 = strlen(buffer);
|
size_t len2 = strlen(buffer);
|
||||||
+ char *begin, *end, *search_buf;
|
+ char *begin, *end, *search_buf;
|
||||||
+ int slen = 0;
|
+ int slen = 0;
|
||||||
|
|
||||||
if (buffer[len2 - 1] == '\n')
|
if (buffer[len2 - 1] == '\n')
|
||||||
buffer[len2 - 1] = 0;
|
buffer[len2 - 1] = 0;
|
||||||
@@ -179,6 +181,7 @@
|
@@ -179,6 +328,7 @@
|
||||||
}
|
}
|
||||||
*p++ = 0;
|
*p++ = 0;
|
||||||
|
|
||||||
@ -48,7 +262,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
/* Get scontext and convert to SID. */
|
/* Get scontext and convert to SID. */
|
||||||
while (*p && strncmp(p, SCONTEXT, sizeof(SCONTEXT) - 1))
|
while (*p && strncmp(p, SCONTEXT, sizeof(SCONTEXT) - 1))
|
||||||
p++;
|
p++;
|
||||||
@@ -188,11 +191,14 @@
|
@@ -188,11 +338,14 @@
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
p += sizeof(SCONTEXT) - 1;
|
p += sizeof(SCONTEXT) - 1;
|
||||||
@ -66,7 +280,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
rc = sepol_context_to_sid(scon, strlen(scon) + 1, &ssid);
|
rc = sepol_context_to_sid(scon, strlen(scon) + 1, &ssid);
|
||||||
if (rc < 0) {
|
if (rc < 0) {
|
||||||
fprintf(stderr,
|
fprintf(stderr,
|
||||||
@@ -201,6 +207,10 @@
|
@@ -201,6 +354,10 @@
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -77,7 +291,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
/* Get tcontext and convert to SID. */
|
/* Get tcontext and convert to SID. */
|
||||||
while (*p && strncmp(p, TCONTEXT, sizeof(TCONTEXT) - 1))
|
while (*p && strncmp(p, TCONTEXT, sizeof(TCONTEXT) - 1))
|
||||||
p++;
|
p++;
|
||||||
@@ -210,11 +220,15 @@
|
@@ -210,11 +367,15 @@
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
p += sizeof(TCONTEXT) - 1;
|
p += sizeof(TCONTEXT) - 1;
|
||||||
@ -96,7 +310,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
rc = sepol_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
|
rc = sepol_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
|
||||||
if (rc < 0) {
|
if (rc < 0) {
|
||||||
fprintf(stderr,
|
fprintf(stderr,
|
||||||
@@ -222,6 +236,9 @@
|
@@ -222,6 +383,9 @@
|
||||||
TCONTEXT, tcon, lineno);
|
TCONTEXT, tcon, lineno);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
@ -106,7 +320,7 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
|
|
||||||
/* Get tclass= and convert to value. */
|
/* Get tclass= and convert to value. */
|
||||||
while (*p && strncmp(p, TCLASS, sizeof(TCLASS) - 1))
|
while (*p && strncmp(p, TCLASS, sizeof(TCLASS) - 1))
|
||||||
@@ -232,12 +249,17 @@
|
@@ -232,12 +396,17 @@
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
p += sizeof(TCLASS) - 1;
|
p += sizeof(TCLASS) - 1;
|
||||||
@ -127,6 +341,37 @@ diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po
|
|||||||
if (!tclass) {
|
if (!tclass) {
|
||||||
fprintf(stderr,
|
fprintf(stderr,
|
||||||
"Invalid %s%s on line %u, skipping...\n",
|
"Invalid %s%s on line %u, skipping...\n",
|
||||||
|
@@ -286,11 +455,16 @@
|
||||||
|
}
|
||||||
|
|
||||||
|
if (reason & SEPOL_COMPUTEAV_TE) {
|
||||||
|
- printf("\t\tMissing or disabled TE allow rule.\n");
|
||||||
|
- printf
|
||||||
|
- ("\t\tAllow rules may exist but be disabled by boolean settings; check boolean settings.\n");
|
||||||
|
- printf
|
||||||
|
- ("\t\tYou can see the necessary allow rules by running audit2allow with this audit message as input.\n");
|
||||||
|
+ access.ssid = ssid;
|
||||||
|
+ access.tsid = tsid;
|
||||||
|
+ access.tclass = tclass;
|
||||||
|
+ access.av = av;
|
||||||
|
+
|
||||||
|
+ if (check_booleans(&access) < 0) {
|
||||||
|
+ printf("\t\tMissing or disabled TE allow rule.\n");
|
||||||
|
+ printf
|
||||||
|
+ ("\t\tYou can see the necessary allow rules by running audit2allow with this audit message as input.\n");
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
if (reason & SEPOL_COMPUTEAV_CONS) {
|
||||||
|
@@ -309,5 +483,8 @@
|
||||||
|
}
|
||||||
|
free(buffer);
|
||||||
|
free(bufcopy);
|
||||||
|
+ if (avcp != stdin)
|
||||||
|
+ fclose(avcp);
|
||||||
|
+
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.34/Makefile
|
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.34/Makefile
|
||||||
--- nsapolicycoreutils/Makefile 2007-12-19 06:02:52.000000000 -0500
|
--- nsapolicycoreutils/Makefile 2007-12-19 06:02:52.000000000 -0500
|
||||||
+++ policycoreutils-2.0.34/Makefile 2007-12-19 06:06:04.000000000 -0500
|
+++ policycoreutils-2.0.34/Makefile 2007-12-19 06:06:04.000000000 -0500
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py policycoreutils-2.0.34/sepolgen-1.0.10/src/sepolgen/refparser.py
|
diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py policycoreutils-2.0.34/sepolgen-1.0.10/src/sepolgen/refparser.py
|
||||||
--- nsasepolgen/src/sepolgen/refparser.py 2007-09-13 08:21:11.000000000 -0400
|
--- nsasepolgen/src/sepolgen/refparser.py 2007-09-13 08:21:11.000000000 -0400
|
||||||
+++ policycoreutils-2.0.34/sepolgen-1.0.10/src/sepolgen/refparser.py 2007-12-19 06:05:51.000000000 -0500
|
+++ policycoreutils-2.0.34/sepolgen-1.0.10/src/sepolgen/refparser.py 2007-12-20 14:20:49.000000000 -0500
|
||||||
@@ -118,6 +118,7 @@
|
@@ -118,6 +118,7 @@
|
||||||
'TEMPLATE',
|
'TEMPLATE',
|
||||||
'GEN_CONTEXT',
|
'GEN_CONTEXT',
|
||||||
@ -30,7 +30,7 @@ diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py polic
|
|||||||
def t_refpolicywarn(t):
|
def t_refpolicywarn(t):
|
||||||
r'refpolicywarn\(.*\n'
|
r'refpolicywarn\(.*\n'
|
||||||
# Ignore refpolicywarn statements - they sometimes
|
# Ignore refpolicywarn statements - they sometimes
|
||||||
@@ -258,6 +266,7 @@
|
@@ -258,10 +266,12 @@
|
||||||
m = None
|
m = None
|
||||||
# error is either None (indicating no error) or a string error message.
|
# error is either None (indicating no error) or a string error message.
|
||||||
error = None
|
error = None
|
||||||
@ -38,7 +38,12 @@ diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py polic
|
|||||||
# spt is the support macros (e.g., obj/perm sets) - it is an instance of
|
# spt is the support macros (e.g., obj/perm sets) - it is an instance of
|
||||||
# refpolicy.SupportMacros and should always be present during parsing
|
# refpolicy.SupportMacros and should always be present during parsing
|
||||||
# though it may not contain any macros.
|
# though it may not contain any macros.
|
||||||
@@ -382,6 +391,19 @@
|
spt = None
|
||||||
|
+success=True
|
||||||
|
|
||||||
|
# utilities
|
||||||
|
def collect(stmts, parent, val=None):
|
||||||
|
@@ -382,6 +392,19 @@
|
||||||
collect(p[12], x, val=False)
|
collect(p[12], x, val=False)
|
||||||
p[0] = [x]
|
p[0] = [x]
|
||||||
|
|
||||||
@ -58,7 +63,7 @@ diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py polic
|
|||||||
def p_ifdef(p):
|
def p_ifdef(p):
|
||||||
'''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
'''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||||
| IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
| IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
|
||||||
@@ -446,6 +468,7 @@
|
@@ -446,6 +469,7 @@
|
||||||
| optional_policy
|
| optional_policy
|
||||||
| tunable_policy
|
| tunable_policy
|
||||||
| ifdef
|
| ifdef
|
||||||
@ -66,17 +71,20 @@ diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py polic
|
|||||||
| conditional
|
| conditional
|
||||||
'''
|
'''
|
||||||
p[0] = p[1]
|
p[0] = p[1]
|
||||||
@@ -844,7 +867,8 @@
|
@@ -844,8 +868,11 @@
|
||||||
|
|
||||||
def p_error(tok):
|
def p_error(tok):
|
||||||
global error
|
global error
|
||||||
- error = "Syntax error on line %d %s [type=%s]" % (tok.lineno, tok.value, tok.type)
|
- error = "Syntax error on line %d %s [type=%s]" % (tok.lineno, tok.value, tok.type)
|
||||||
+ global parse_file
|
+ global parse_file
|
||||||
|
+ global success
|
||||||
+ error = "%s: Syntax error on line %d %s [type=%s]" % (parse_file, tok.lineno, tok.value, tok.type)
|
+ error = "%s: Syntax error on line %d %s [type=%s]" % (parse_file, tok.lineno, tok.value, tok.type)
|
||||||
print error
|
print error
|
||||||
|
+ success = False
|
||||||
|
|
||||||
def prep_spt(spt):
|
def prep_spt(spt):
|
||||||
@@ -892,7 +916,7 @@
|
if not spt:
|
||||||
|
@@ -892,7 +919,7 @@
|
||||||
def list_headers(root):
|
def list_headers(root):
|
||||||
modules = []
|
modules = []
|
||||||
support_macros = None
|
support_macros = None
|
||||||
@ -85,7 +93,7 @@ diff --exclude-from=exclude -N -u -r nsasepolgen/src/sepolgen/refparser.py polic
|
|||||||
|
|
||||||
for dirpath, dirnames, filenames in os.walk(root):
|
for dirpath, dirnames, filenames in os.walk(root):
|
||||||
for name in filenames:
|
for name in filenames:
|
||||||
@@ -941,12 +965,14 @@
|
@@ -941,12 +968,14 @@
|
||||||
output.write(msg)
|
output.write(msg)
|
||||||
|
|
||||||
def parse_file(f, module, spt=None):
|
def parse_file(f, module, spt=None):
|
||||||
|
@ -6,7 +6,7 @@
|
|||||||
Summary: SELinux policy core utilities
|
Summary: SELinux policy core utilities
|
||||||
Name: policycoreutils
|
Name: policycoreutils
|
||||||
Version: 2.0.34
|
Version: 2.0.34
|
||||||
Release: 1%{?dist}
|
Release: 2%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
|
Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz
|
||||||
@ -193,9 +193,14 @@ if [ "$1" -ge "1" ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Tue Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 2.0.34-1
|
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 2.0.34-2
|
||||||
|
- Make sepolgen set error exit code when partial failure
|
||||||
|
- audit2why now checks booleans for avc diagnosis
|
||||||
|
|
||||||
|
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 2.0.34-1
|
||||||
- Update to upstream
|
- Update to upstream
|
||||||
* Tue Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 2.0.33-4
|
|
||||||
|
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 2.0.33-4
|
||||||
- Fix sepolgen to be able to parse Fedora 9 policy
|
- Fix sepolgen to be able to parse Fedora 9 policy
|
||||||
Handle ifelse statements
|
Handle ifelse statements
|
||||||
Handle refpolicywarn inside of define
|
Handle refpolicywarn inside of define
|
||||||
|
Loading…
Reference in New Issue
Block a user