rpms/policycoreutils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

policycoreutils-3.2-4

Browse Source 
- policycoreutils-dbus requires polkit
- fixfiles: do not exclude /dev and /run in -C mode
- dbus: use GLib.MainLoop

Resolves: rhbz#1949841

Modified-by: Petr Lautrbach <plautrba@redhat.com>
Modified-by: Petr Lautrbach <plautrba@redhat.com>
Modified-by: Petr Lautrbach <plautrba@redhat.com>
This commit is contained in:
Petr Lautrbach 2021-05-13 11:21:26 +02:00
parent 9e19888d09
commit e9034b4c9f
5 changed files with 175 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
0018-Do-not-use-Python-slip.patch
View File

@ -1,4 +1,4 @@
From ebfdc2e9e1eebfa75f1c230085ea4def40905158 Mon Sep 17 00:00:00 2001
From 02fd46cee210fc693ddf985d7d03674397f8342f Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 15 Apr 2021 17:39:39 +0200
Subject: [PATCH] Do not use Python slip
@ -14,7 +14,7 @@ Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2 files changed, 41 insertions(+), 37 deletions(-)
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
index be4f4557a9fa..f13f90cddbb6 100644
index be4f4557a9fa..b7c9378bcb5d 100644
--- a/dbus/selinux_server.py
+++ b/dbus/selinux_server.py
@@ -4,26 +4,33 @@ import dbus
@ -118,7 +118,7 @@ index be4f4557a9fa..f13f90cddbb6 100644
- def relabel_on_boot(self, value):
+ @dbus.service.method("org.selinux", in_signature='i', sender_keyword="sender")
+ def relabel_on_boot(self, value, sender):
+ if not self.is_authorized(sender, "org.selinux.relabel_on_reboot"):
+ if not self.is_authorized(sender, "org.selinux.relabel_on_boot"):
+ raise dbus.exceptions.DBusException("Not authorized")
if value == 1:
fd = open("/.autorelabel", "w")

43
0019-dbus-Use-GLib.MainLoop.patch Normal file
View File

@ -0,0 +1,43 @@
From 30b9e992819a2c94434a0a30d5ce96e642c84d20 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Wed, 12 May 2021 19:19:29 +0200
Subject: [PATCH] dbus: Use GLib.MainLoop()
Fixes:
PyGIDeprecationWarning: GObject.MainLoop is deprecated; use GLib.MainLoop instead
---
dbus/selinux_server.py | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
index b7c9378bcb5d..a969f2268ceb 100644
--- a/dbus/selinux_server.py
+++ b/dbus/selinux_server.py
@@ -2,8 +2,9 @@
import dbus
import dbus.service
-import dbus.mainloop.glib
+from dbus.mainloop.glib import DBusGMainLoop
from gi.repository import GObject
+from gi.repository import GLib
import os
import selinux
from subprocess import Popen, PIPE, STDOUT
@@ -145,9 +146,10 @@ class selinux_server(dbus.service.Object):
raise ValueError("%s does not exist" % path)
if __name__ == "__main__":
- mainloop = GObject.MainLoop()
- dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
+ DBusGMainLoop(set_as_default=True)
+ mainloop = GLib.MainLoop()
+
system_bus = dbus.SystemBus()
name = dbus.service.BusName("org.selinux", system_bus)
- object = selinux_server(system_bus, "/org/selinux/object")
+ server = selinux_server(system_bus, "/org/selinux/object")
mainloop.run()
--
2.31.1

67
0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch Normal file
View File

@ -0,0 +1,67 @@
From d36c5c43d17896ebd655f8bdc6e0303dcbf2f47b Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Fri, 19 Mar 2021 22:30:59 +0100
Subject: [PATCH] policycoreutils/setfiles: do not create useless
setfiles.8.man file
Seems to have been there to allow for some sed substitution over the
text. Now that this is gone, the redundant intermediate file can be
removed, too.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
policycoreutils/setfiles/.gitignore | 1 -
policycoreutils/setfiles/Makefile | 9 +++------
2 files changed, 3 insertions(+), 7 deletions(-)
delete mode 100644 policycoreutils/setfiles/.gitignore
diff --git a/policycoreutils/setfiles/.gitignore b/policycoreutils/setfiles/.gitignore
deleted file mode 100644
index 5e899c95af23..000000000000
--- a/policycoreutils/setfiles/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-setfiles.8.man
diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile
index a3bbbe116b7f..63d818509791 100644
--- a/policycoreutils/setfiles/Makefile
+++ b/policycoreutils/setfiles/Makefile
@@ -13,7 +13,7 @@ ifeq ($(AUDITH), y)
override LDLIBS += -laudit
endif
-all: setfiles restorecon restorecon_xattr man
+all: setfiles restorecon restorecon_xattr
setfiles: setfiles.o restore.o
@@ -22,16 +22,13 @@ restorecon: setfiles
restorecon_xattr: restorecon_xattr.o restore.o
-man:
- @cp -af setfiles.8 setfiles.8.man
-
install: all
[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
-mkdir -p $(DESTDIR)$(SBINDIR)
install -m 755 setfiles $(DESTDIR)$(SBINDIR)
(cd $(DESTDIR)$(SBINDIR) && ln -sf setfiles restorecon)
install -m 755 restorecon_xattr $(DESTDIR)$(SBINDIR)
- install -m 644 setfiles.8.man $(DESTDIR)$(MANDIR)/man8/setfiles.8
+ install -m 644 setfiles.8 $(DESTDIR)$(MANDIR)/man8/setfiles.8
install -m 644 restorecon.8 $(DESTDIR)$(MANDIR)/man8/restorecon.8
install -m 644 restorecon_xattr.8 $(DESTDIR)$(MANDIR)/man8/restorecon_xattr.8
for lang in $(LINGUAS) ; do \
@@ -42,7 +39,7 @@ install: all
done
clean:
- rm -f setfiles restorecon restorecon_xattr *.o setfiles.8.man
+ rm -f setfiles restorecon restorecon_xattr *.o
indent:
../../scripts/Lindent $(wildcard *.[ch])
--
2.31.1

50
0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch Normal file
View File

@ -0,0 +1,50 @@
From 38d88fc70844b6f5b02883172af6df7bbd05de24 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Mon, 1 Mar 2021 18:19:22 +0100
Subject: [PATCH] fixfiles: do not exclude /dev and /run in -C mode
I can't think of a good reason why they should be excluded. On the
contrary, excluding them can cause trouble very easily if some labeling
rules for these directories change. For example, we changed the label
for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
(updating the allow rules accordingly) and after policy update they
ended up with an invalid context, causing denials.
Thus, remove /dev and /run from the excludes. While there, also add
/root to the basic excludes to match the regex that excludes fc rules
(that should be effectively no functional change).
I did a sanity check on my system by running `restorecon -nv /dev /run`
and it didn't report any label differences.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
---
policycoreutils/scripts/fixfiles | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index e73bb81c3336..cb20002ab613 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -163,7 +163,7 @@ newer() {
#
diff_filecontext() {
EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
-for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
+for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
[ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
done
LogExcluded
@@ -176,7 +176,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
sed -r -e 's,:s0, ,g' $FC | sort -u | \
/usr/bin/diff -b ${PREFCTEMPFILE} - | \
grep '^[<>]'|cut -c3-| grep ^/ | \
- egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
+ egrep -v '(^/home|^/root|^/tmp)' |\
sed -r -e 's,[[:blank:]].*,,g' \
-e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
-e 's|([/[:alnum:]])\?|{\1,}|g' \
--
2.31.1

13
policycoreutils.spec
View File

@ -11,7 +11,7 @@
Summary: SELinux policy core utilities
Name: policycoreutils
Version: 3.2
Release: 3.1%{?dist}
Release: 4%{?dist}
License: GPLv2
# https://github.com/SELinuxProject/selinux/wiki/Releases
Source0: https://github.com/SELinuxProject/selinux/releases/download/3.2/selinux-3.2.tar.gz
@ -49,6 +49,9 @@ Patch0015: 0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch
Patch0016: 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
Patch0017: 0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch
Patch0018: 0018-Do-not-use-Python-slip.patch
Patch0019: 0019-dbus-Use-GLib.MainLoop.patch
Patch0020: 0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch
Patch0021: 0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch
# Patch list end
Obsoletes: policycoreutils < 2.0.61-2
@ -91,6 +94,8 @@ tar -xvf %{SOURCE14} -C python/sepolicy/
# Since patches containing translation changes were too big, translations were moved to separate tarballs
# For more information see README.translations
# First remove old translation files
rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po
tar -x -f %{SOURCE20} -C policycoreutils -z
tar -x -f %{SOURCE21} -C python -z
tar -x -f %{SOURCE22} -C gui -z
@ -213,6 +218,7 @@ an SELinux environment.
Summary: SELinux policy core DBUS api
Requires: python3-policycoreutils = %{version}-%{release}
Requires: python3-gobject-base
Requires: polkit
BuildArch: noarch
%description dbus
@ -508,6 +514,11 @@ The policycoreutils-restorecond package contains the restorecond service.
%systemd_postun_with_restart restorecond.service
%changelog
* Thu May 13 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-4
- policycoreutils-dbus requires polkit
- fixfiles: do not exclude /dev and /run in -C mode
- dbus: use GLib.MainLoop
* Fri Apr 23 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-3.1
- Do not use Python slip (#1949841)