From e9034b4c9f7e74de1a391735e5c223fc98c7b59d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 13 May 2021 11:21:26 +0200 Subject: [PATCH] policycoreutils-3.2-4 - policycoreutils-dbus requires polkit - fixfiles: do not exclude /dev and /run in -C mode - dbus: use GLib.MainLoop Resolves: rhbz#1949841 Modified-by: Petr Lautrbach Modified-by: Petr Lautrbach Modified-by: Petr Lautrbach --- 0018-Do-not-use-Python-slip.patch | 6 +- 0019-dbus-Use-GLib.MainLoop.patch | 43 ++++++++++++ ...setfiles-do-not-create-useless-setfi.patch | 67 +++++++++++++++++++ ...do-not-exclude-dev-and-run-in-C-mode.patch | 50 ++++++++++++++ policycoreutils.spec | 13 +++- 5 files changed, 175 insertions(+), 4 deletions(-) create mode 100644 0019-dbus-Use-GLib.MainLoop.patch create mode 100644 0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch create mode 100644 0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch diff --git a/0018-Do-not-use-Python-slip.patch b/0018-Do-not-use-Python-slip.patch index 3062efd..fc4bd6d 100644 --- a/0018-Do-not-use-Python-slip.patch +++ b/0018-Do-not-use-Python-slip.patch @@ -1,4 +1,4 @@ -From ebfdc2e9e1eebfa75f1c230085ea4def40905158 Mon Sep 17 00:00:00 2001 +From 02fd46cee210fc693ddf985d7d03674397f8342f Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 15 Apr 2021 17:39:39 +0200 Subject: [PATCH] Do not use Python slip @@ -14,7 +14,7 @@ Signed-off-by: Petr Lautrbach 2 files changed, 41 insertions(+), 37 deletions(-) diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py -index be4f4557a9fa..f13f90cddbb6 100644 +index be4f4557a9fa..b7c9378bcb5d 100644 --- a/dbus/selinux_server.py +++ b/dbus/selinux_server.py @@ -4,26 +4,33 @@ import dbus @@ -118,7 +118,7 @@ index be4f4557a9fa..f13f90cddbb6 100644 - def relabel_on_boot(self, value): + @dbus.service.method("org.selinux", in_signature='i', sender_keyword="sender") + def relabel_on_boot(self, value, sender): -+ if not self.is_authorized(sender, "org.selinux.relabel_on_reboot"): ++ if not self.is_authorized(sender, "org.selinux.relabel_on_boot"): + raise dbus.exceptions.DBusException("Not authorized") if value == 1: fd = open("/.autorelabel", "w") diff --git a/0019-dbus-Use-GLib.MainLoop.patch b/0019-dbus-Use-GLib.MainLoop.patch new file mode 100644 index 0000000..be546f3 --- /dev/null +++ b/0019-dbus-Use-GLib.MainLoop.patch @@ -0,0 +1,43 @@ +From 30b9e992819a2c94434a0a30d5ce96e642c84d20 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 12 May 2021 19:19:29 +0200 +Subject: [PATCH] dbus: Use GLib.MainLoop() + +Fixes: + PyGIDeprecationWarning: GObject.MainLoop is deprecated; use GLib.MainLoop instead +--- + dbus/selinux_server.py | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py +index b7c9378bcb5d..a969f2268ceb 100644 +--- a/dbus/selinux_server.py ++++ b/dbus/selinux_server.py +@@ -2,8 +2,9 @@ + + import dbus + import dbus.service +-import dbus.mainloop.glib ++from dbus.mainloop.glib import DBusGMainLoop + from gi.repository import GObject ++from gi.repository import GLib + import os + import selinux + from subprocess import Popen, PIPE, STDOUT +@@ -145,9 +146,10 @@ class selinux_server(dbus.service.Object): + raise ValueError("%s does not exist" % path) + + if __name__ == "__main__": +- mainloop = GObject.MainLoop() +- dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) ++ DBusGMainLoop(set_as_default=True) ++ mainloop = GLib.MainLoop() ++ + system_bus = dbus.SystemBus() + name = dbus.service.BusName("org.selinux", system_bus) +- object = selinux_server(system_bus, "/org/selinux/object") ++ server = selinux_server(system_bus, "/org/selinux/object") + mainloop.run() +-- +2.31.1 + diff --git a/0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch b/0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch new file mode 100644 index 0000000..bdc6287 --- /dev/null +++ b/0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch @@ -0,0 +1,67 @@ +From d36c5c43d17896ebd655f8bdc6e0303dcbf2f47b Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Fri, 19 Mar 2021 22:30:59 +0100 +Subject: [PATCH] policycoreutils/setfiles: do not create useless + setfiles.8.man file + +Seems to have been there to allow for some sed substitution over the +text. Now that this is gone, the redundant intermediate file can be +removed, too. + +Signed-off-by: Ondrej Mosnacek +--- + policycoreutils/setfiles/.gitignore | 1 - + policycoreutils/setfiles/Makefile | 9 +++------ + 2 files changed, 3 insertions(+), 7 deletions(-) + delete mode 100644 policycoreutils/setfiles/.gitignore + +diff --git a/policycoreutils/setfiles/.gitignore b/policycoreutils/setfiles/.gitignore +deleted file mode 100644 +index 5e899c95af23..000000000000 +--- a/policycoreutils/setfiles/.gitignore ++++ /dev/null +@@ -1 +0,0 @@ +-setfiles.8.man +diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile +index a3bbbe116b7f..63d818509791 100644 +--- a/policycoreutils/setfiles/Makefile ++++ b/policycoreutils/setfiles/Makefile +@@ -13,7 +13,7 @@ ifeq ($(AUDITH), y) + override LDLIBS += -laudit + endif + +-all: setfiles restorecon restorecon_xattr man ++all: setfiles restorecon restorecon_xattr + + setfiles: setfiles.o restore.o + +@@ -22,16 +22,13 @@ restorecon: setfiles + + restorecon_xattr: restorecon_xattr.o restore.o + +-man: +- @cp -af setfiles.8 setfiles.8.man +- + install: all + [ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8 + -mkdir -p $(DESTDIR)$(SBINDIR) + install -m 755 setfiles $(DESTDIR)$(SBINDIR) + (cd $(DESTDIR)$(SBINDIR) && ln -sf setfiles restorecon) + install -m 755 restorecon_xattr $(DESTDIR)$(SBINDIR) +- install -m 644 setfiles.8.man $(DESTDIR)$(MANDIR)/man8/setfiles.8 ++ install -m 644 setfiles.8 $(DESTDIR)$(MANDIR)/man8/setfiles.8 + install -m 644 restorecon.8 $(DESTDIR)$(MANDIR)/man8/restorecon.8 + install -m 644 restorecon_xattr.8 $(DESTDIR)$(MANDIR)/man8/restorecon_xattr.8 + for lang in $(LINGUAS) ; do \ +@@ -42,7 +39,7 @@ install: all + done + + clean: +- rm -f setfiles restorecon restorecon_xattr *.o setfiles.8.man ++ rm -f setfiles restorecon restorecon_xattr *.o + + indent: + ../../scripts/Lindent $(wildcard *.[ch]) +-- +2.31.1 + diff --git a/0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch b/0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch new file mode 100644 index 0000000..d798348 --- /dev/null +++ b/0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch @@ -0,0 +1,50 @@ +From 38d88fc70844b6f5b02883172af6df7bbd05de24 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 1 Mar 2021 18:19:22 +0100 +Subject: [PATCH] fixfiles: do not exclude /dev and /run in -C mode + +I can't think of a good reason why they should be excluded. On the +contrary, excluding them can cause trouble very easily if some labeling +rules for these directories change. For example, we changed the label +for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora +(updating the allow rules accordingly) and after policy update they +ended up with an invalid context, causing denials. + +Thus, remove /dev and /run from the excludes. While there, also add +/root to the basic excludes to match the regex that excludes fc rules +(that should be effectively no functional change). + +I did a sanity check on my system by running `restorecon -nv /dev /run` +and it didn't report any label differences. + +Signed-off-by: Ondrej Mosnacek +Acked-by: Petr Lautrbach +--- + policycoreutils/scripts/fixfiles | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles +index e73bb81c3336..cb20002ab613 100755 +--- a/policycoreutils/scripts/fixfiles ++++ b/policycoreutils/scripts/fixfiles +@@ -163,7 +163,7 @@ newer() { + # + diff_filecontext() { + EXCLUDEDIRS="`exclude_dirs_from_relabelling`" +-for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do ++for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do + [ -e $i ] && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i"; + done + LogExcluded +@@ -176,7 +176,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then + sed -r -e 's,:s0, ,g' $FC | sort -u | \ + /usr/bin/diff -b ${PREFCTEMPFILE} - | \ + grep '^[<>]'|cut -c3-| grep ^/ | \ +- egrep -v '(^/home|^/root|^/tmp|^/dev)' |\ ++ egrep -v '(^/home|^/root|^/tmp)' |\ + sed -r -e 's,[[:blank:]].*,,g' \ + -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \ + -e 's|([/[:alnum:]])\?|{\1,}|g' \ +-- +2.31.1 + diff --git a/policycoreutils.spec b/policycoreutils.spec index b84fce1..04fbb51 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.2 -Release: 3.1%{?dist} +Release: 4%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.2/selinux-3.2.tar.gz @@ -49,6 +49,9 @@ Patch0015: 0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch Patch0016: 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0017: 0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch Patch0018: 0018-Do-not-use-Python-slip.patch +Patch0019: 0019-dbus-Use-GLib.MainLoop.patch +Patch0020: 0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch +Patch0021: 0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -91,6 +94,8 @@ tar -xvf %{SOURCE14} -C python/sepolicy/ # Since patches containing translation changes were too big, translations were moved to separate tarballs # For more information see README.translations +# First remove old translation files +rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po tar -x -f %{SOURCE20} -C policycoreutils -z tar -x -f %{SOURCE21} -C python -z tar -x -f %{SOURCE22} -C gui -z @@ -213,6 +218,7 @@ an SELinux environment. Summary: SELinux policy core DBUS api Requires: python3-policycoreutils = %{version}-%{release} Requires: python3-gobject-base +Requires: polkit BuildArch: noarch %description dbus @@ -508,6 +514,11 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu May 13 2021 Petr Lautrbach - 3.2-4 +- policycoreutils-dbus requires polkit +- fixfiles: do not exclude /dev and /run in -C mode +- dbus: use GLib.MainLoop + * Fri Apr 23 2021 Petr Lautrbach - 3.2-3.1 - Do not use Python slip (#1949841)