rpms/setools
7
0
Fork 0
Code Issues Pull Requests Releases Activity

SETools 4.2.2 release

Browse Source 
- Replaced the Python/SWIG/static-linked-libsepol policyrep module with
   a Cython implementation. This will have performance and memory-usage
   improvements and breaks the static linking to libsepol.
- Significant memory usage reduction in sediff (approximately 60%,
   depending on the policies).
- Added support for SCTP portcons
- Updated permission maps
- Support for Python 2.7 was dropped
- Drop python2 subpackage (4.2.0 no longer supports python2)
- Require userspace release 2.9
- setools-gui requires python3-setools
- Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371)
- Fixed performance regressions
- Made further memory usage improvements
- Fixed build issues with clean target and runtime_library_dirs
- Revised package structure to make policyrep a module of the setools
  package
- Symbol names are now available as the name attribute
  (e.g. Boolean.name, Type.name, etc.)
- Fixed some apol layouts to increase the size of text fields
- Move constraint expression to its own class
- Made Conditional.evaluate() more useful and added
  BaseTERule.enabled() method to determine if a rule is enabled
- Restored missing statement() methods in some policyrep classes
- Fixed NULL pointer dereference when iterating over type attributes when the policy has none
- Added xdp_socket permission mapping
- SELinuxPolicy: Create a map of aliases on policy load
- Remove source policy references from man pages, as loading source policies
  is no longer supported.
- Fix a performance regression in alias loading after alias dereferencing
  fixes in 4.2.1
This commit is contained in:
Vit Mojzis 2018-08-09 16:34:27 +02:00 committed by Petr Lautrbach
parent 5443cd02b9
commit 082b752534
7 changed files with 91 additions and 299 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@ -3,3 +3,8 @@ setools-3.3.8.tar.bz2
setools-3.3.8-f1e5b20.tar.bz2
/4.1.0.tar.gz
/4.1.1.tar.gz
/4.2.0-beta.tar.gz
/4.2.0-rc.tar.gz
/4.2.0.tar.gz
/4.2.1.tar.gz
/4.2.2.tar.gz

26
0003-bswap_-macros-are-defined-in-byteswap.h.patch
View File

@ -1,26 +0,0 @@
From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 10 Aug 2017 08:23:47 +0200
Subject: [PATCH] bswap_* macros are defined in byteswap.h
Fixes ImportError on s390x:
/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32
---
libqpol/policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libqpol/policy.c b/libqpol/policy.c
index ae3acb5..e412be0 100644
--- a/libqpol/policy.c
+++ b/libqpol/policy.c
@@ -28,6 +28,7 @@
#include "qpol_internal.h"
#include <assert.h>
+#include <byteswap.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
--
2.13.3

158
0004-Add-support-for-SCTP-protocol.patch
View File

@ -1,158 +0,0 @@
From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Mon, 16 Apr 2018 20:46:20 +0200
Subject: [PATCH] Add support for SCTP protocol
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
libqpol/include/qpol/linux_types.h | 1 +
libqpol/policy_define.c | 5 +++++
setools/perm_map | 36 +++++++++++++++++++++++++++---
setools/policyrep/netcontext.py | 5 +++++
4 files changed, 44 insertions(+), 3 deletions(-)
diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h
index c3c056b..0985162 100644
--- a/libqpol/include/qpol/linux_types.h
+++ b/libqpol/include/qpol/linux_types.h
@@ -12,6 +12,7 @@ typedef uint16_t __u16;
#define s6_addr32 __u6_addr32
#define IPPROTO_DCCP 33
+#define IPPROTO_SCTP 132
#endif
#endif
diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c
index dcc69fc..1e623a3 100644
--- a/libqpol/policy_define.c
+++ b/libqpol/policy_define.c
@@ -44,6 +44,9 @@
#ifndef IPPROTO_DCCP
#define IPPROTO_DCCP 33
#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
#include <arpa/inet.h>
#include <stdlib.h>
#include <limits.h>
@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high)
protocol = IPPROTO_UDP;
} else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) {
protocol = IPPROTO_DCCP;
+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) {
+ protocol = IPPROTO_SCTP;
} else {
yyerror2("unrecognized protocol %s", id);
goto bad;
diff --git a/setools/perm_map b/setools/perm_map
index 0a9f91c..8bd34f5 100644
--- a/setools/perm_map
+++ b/setools/perm_map
@@ -27,7 +27,7 @@
# Look to the examples below for further clarification.
#
# Number of object classes.
-95
+96
class netlink_audit_socket 27
nlmsg_relay w 10
@@ -376,7 +376,7 @@ class file 22
quotaon b 1
swapon b 1
-class node 11
+class node 13
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -385,6 +385,8 @@ class node 11
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
enforce_dest n 1
sendto w 10
recvfrom r 10
@@ -699,6 +701,32 @@ class dccp_socket 24
relabelto w 10
listen r 1
+class sctp_socket 24
+ node_bind n 1
+ name_connect w 10
+ append w 10
+ bind w 1
+ connect w 1
+ create w 1
+ write w 10
+ relabelfrom r 10
+ ioctl n 1
+ name_bind n 1
+ sendto w 10
+ recv_msg r 10
+ send_msg w 10
+ getattr r 7
+ setattr w 7
+ accept r 1
+ getopt r 1
+ read r 10
+ setopt w 1
+ shutdown w 1
+ recvfrom r 10
+ lock n 1
+ relabelto w 10
+ listen r 1
+
class netlink_firewall_socket 24
nlmsg_write w 10
nlmsg_read r 10
@@ -973,7 +1001,7 @@ class key_socket 22
relabelto w 10
listen r 1
-class netif 10
+class netif 12
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -984,6 +1012,8 @@ class netif 10
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
class packet_socket 22
append w 10
diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py
index 9a01fc5..630b42c 100644
--- a/setools/policyrep/netcontext.py
+++ b/setools/policyrep/netcontext.py
@@ -35,6 +35,10 @@ try:
IPPROTO_DCCP = getprotobyname("dccp")
except socket.error:
IPPROTO_DCCP = 33
+try:
+ IPPROTO_SCTP = getprotobyname("sctp")
+except socket.error:
+ IPPROTO_SCTP = 132
def netifcon_factory(policy, name):
@@ -161,6 +165,7 @@ class PortconProtocol(int, PolicyEnum):
tcp = IPPROTO_TCP
udp = IPPROTO_UDP
dccp = IPPROTO_DCCP
+ sctp = IPPROTO_SCTP
class Portcon(NetContext):
--
2.18.0

16
0001-Do-not-use-Werror-during-build.patch → 1001-Do-not-use-Werror-during-build.patch
View File

@ -1,7 +1,7 @@
From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001
From 4b3dc6b38abbd32cda557d5ef9ea1383ac5fdcf2 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 1/2] Do not use -Werror during build
Subject: [PATCH 2/3] Do not use -Werror during build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
@ -32,18 +32,18 @@ error: command 'gcc' failed with exit status 1
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/setup.py b/setup.py
index 2ca44c9..9319bf6 100644
index c94daf1..a7442ac 100644
--- a/setup.py
+++ b/setup.py
@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol',
'libqpol/policy_scan.c',
'libqpol/xen_query.c'],
include_dirs=include_dirs,
@@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'],
libraries=['selinux', 'sepol'],
library_dirs=lib_dirs,
define_macros=macros,
- extra_compile_args=['-Werror', '-Wextra',
+ extra_compile_args=['-Wextra',
'-Waggregate-return',
'-Wfloat-equal',
'-Wformat', '-Wformat=2',
--
2.9.3
2.17.2

83
0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch → 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
View File

@ -1,7 +1,7 @@
From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and
From b960869bcbcb58f2ce9af598484f209935c096b0 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Fri, 26 Apr 2019 15:27:25 +0200
Subject: [PATCH 3/3] Do not export/use setools.InfoFlowAnalysis and
setools.DomainTransitionAnalysis
dta and infoflow modules require networkx which brings lot of dependencies.
@ -12,28 +12,29 @@ Therefore it's better to use setools.infoflow.InfoFlowAnalysis and
setools.dta.DomainTransitionAnalysis and let the package containing
sedta and seinfoflow to require python3-networkx
---
sedta | 3 ++-
seinfoflow | 3 ++-
setools/__init__.py | 4 ++--
sedta | 4 ++--
seinfoflow | 4 ++--
setools/__init__.py | 4 ----
setoolsgui/apol/dta.py | 2 +-
setoolsgui/apol/infoflow.py | 2 +-
tests/dta.py | 3 ++-
tests/infoflow.py | 3 ++-
7 files changed, 12 insertions(+), 8 deletions(-)
tests/dta.py | 2 +-
tests/infoflow.py | 2 +-
7 files changed, 8 insertions(+), 12 deletions(-)
diff --git a/sedta b/sedta
index 1c76ebb..255ad49 100755
index 60861ca..41e38a2 100755
--- a/sedta
+++ b/sedta
@@ -23,6 +23,7 @@ import argparse
@@ -22,7 +22,7 @@ import argparse
import logging
import signal
import setools
-import setools
+import setools.dta
def print_transition(trans):
@@ -111,7 +112,7 @@ else:
@@ -114,7 +114,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
@ -43,18 +44,19 @@ index 1c76ebb..255ad49 100755
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/seinfoflow b/seinfoflow
index b287921..d53bdef 100755
index 97b14ba..e7f965d 100755
--- a/seinfoflow
+++ b/seinfoflow
@@ -19,6 +19,7 @@
@@ -17,7 +17,7 @@
# along with SETools. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import setools
-import setools
+import setools.infoflow
import argparse
import sys
import logging
@@ -79,7 +80,7 @@ else:
@@ -81,7 +81,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
m = setools.PermissionMap(args.map)
@ -64,25 +66,24 @@ index b287921..d53bdef 100755
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/setools/__init__.py b/setools/__init__.py
index a84c846..a53c5a7 100644
index 7b70f5e..5a5f7fe 100644
--- a/setools/__init__.py
+++ b/setools/__init__.py
@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery
@@ -73,12 +73,8 @@ from .pcideviceconquery import PcideviceconQuery
from .devicetreeconquery import DevicetreeconQuery
# Information Flow Analysis
-from .infoflow import InfoFlowAnalysis
+# from .infoflow import InfoFlowAnalysis
from .permmap import PermissionMap
# Domain Transition Analysis
-# Domain Transition Analysis
-from .dta import DomainTransitionAnalysis
+# from .dta import DomainTransitionAnalysis
-
# Policy difference
from .diff import PolicyDifference
diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py
index 0aaf13f..5b1ea20 100644
index 4608b9d..2cde44c 100644
--- a/setoolsgui/apol/dta.py
+++ b/setoolsgui/apol/dta.py
@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
@ -95,10 +96,10 @@ index 0aaf13f..5b1ea20 100644
from ..logtosignal import LogHandlerToSignal
from .analysistab import AnalysisTab
diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py
index 1ae16de..fdf8f7b 100644
index 7bca299..7fee277 100644
--- a/setoolsgui/apol/infoflow.py
+++ b/setoolsgui/apol/infoflow.py
@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
@@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
from PyQt5.QtGui import QPalette, QTextCursor
from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
QTreeWidgetItem
@ -108,33 +109,31 @@ index 1ae16de..fdf8f7b 100644
from ..logtosignal import LogHandlerToSignal
diff --git a/tests/dta.py b/tests/dta.py
index 32b9271..2bdd052 100644
index a0cc938..177e6fb 100644
--- a/tests/dta.py
+++ b/tests/dta.py
@@ -17,7 +17,8 @@
#
@@ -18,7 +18,7 @@
import os
import unittest
-from setools import SELinuxPolicy, DomainTransitionAnalysis
+from setools import SELinuxPolicy
-from setools import DomainTransitionAnalysis
+from setools.dta import DomainTransitionAnalysis
from setools import TERuletype as TERT
from setools.policyrep.exception import InvalidType
from setools.policyrep.typeattr import Type
from setools.exception import InvalidType
from setools.policyrep import Type
diff --git a/tests/infoflow.py b/tests/infoflow.py
index 7751dda..a21c683 100644
index aa0e44a..fca2848 100644
--- a/tests/infoflow.py
+++ b/tests/infoflow.py
@@ -17,7 +17,8 @@
#
@@ -18,7 +18,7 @@
import os
import unittest
-from setools import SELinuxPolicy, InfoFlowAnalysis
+from setools import SELinuxPolicy
-from setools import InfoFlowAnalysis
+from setools.infoflow import InfoFlowAnalysis
from setools import TERuletype as TERT
from setools.exception import InvalidType
from setools.permmap import PermissionMap
from setools.policyrep.exception import InvalidType
--
2.9.3
2.17.2

96
setools.spec
View File

@ -1,17 +1,13 @@
# sitelib for noarch packages, sitearch for others (remove the unneeded one)
%{!?__python2: %global __python2 %__python}
%{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
%{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
# % global setools_pre_ver beta.1.8e09d95
# % global setools_pre_ver rc
# % global gitver f1e5b20
%global sepol_ver 2.8-1
%global selinux_ver 2.8-1
%global sepol_ver 2.9-1
%global selinux_ver 2.9-1
Name: setools
Version: 4.1.1
Release: 15%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist}
Version: 4.2.2
Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist}
Summary: Policy analysis tools for SELinux
License: GPLv2
@ -19,10 +15,8 @@ URL: https://github.com/SELinuxProject/setools/wiki
Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz
Source1: setools.pam
Source2: apol.desktop
Patch1: 0001-Do-not-use-Werror-during-build.patch
Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch
Patch4: 0004-Add-support-for-SCTP-protocol.patch
Patch1001: 1001-Do-not-use-Werror-during-build.patch
Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
BuildRequires: flex, bison
@ -30,10 +24,10 @@ BuildRequires: glibc-devel, gcc, git
BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver}
BuildRequires: qt5-qtbase-devel
BuildRequires: swig
BuildRequires: python2-devel
BuildRequires: python2-setuptools
BuildRequires: python3-Cython
BuildRequires: python3-devel
BuildRequires: python3-setuptools
BuildRequires: libselinux-devel
# BuildArch:
Requires: python3-%{name} = %{version}-%{release}
@ -76,30 +70,11 @@ This package includes the following console tools:
seinfoflow Perform information flow analyses.
%package -n python2-setools
Summary: Policy analysis tools for SELinux
Recommends: python2-libselinux
%{?python_provide:%python_provide python2-setools}
# Remove before F30
Provides: %{name}-python = %{version}-%{release}
Provides: %{name}-python%{?_isa} = %{version}-%{release}
Obsoletes: %{name}-python < %{version}-%{release}
Requires: python2-enum34
Requires: python2-setuptools
%description -n python2-setools
SETools is a collection of graphical tools, command-line tools, and
Python 2 modules designed to facilitate SELinux policy analysis.
%package -n python3-setools
Summary: Policy analysis tools for SELinux
Obsoletes: setools-libs < 4.0.0
Recommends: libselinux-python3
%{?python_provide:%python_provide python2-setools}
# Remove before F30
Provides: %{name}-python3 = %{version}-%{release}
Provides: %{name}-python3%{?_isa} = %{version}-%{release}
Obsoletes: %{name}-python3 < %{version}-%{release}
%{?python_provide:%python_provide python3-setools}
Requires: python3-setuptools
%description -n python3-setools
@ -119,36 +94,19 @@ Python modules designed to facilitate SELinux policy analysis.
%prep
%autosetup -p 1 -S git
cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2
%autosetup -p 1 -S git -n setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}
%build
%py3_build
pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2
# Remove CFLAGS=... for noarch packages (unneeded)
CFLAGS="%{optflags}" %{__python2} setup.py build
popd
%install
rm -rf %{buildroot}
pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2
%{__python2} setup.py install --root %{buildroot}
popd
rm -rf %{buildroot}%{_bindir}
%py3_install
%check
%if %{?_with_check:1}%{!?_with_check:0}
%{__python3} setup.py test
pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2
%{__python2} setup.py test
popd
%endif
@ -168,10 +126,6 @@ popd
%{_mandir}/man1/sedta*
%{_mandir}/man1/seinfoflow*
%files -n python2-setools
%license COPYING COPYING.GPL COPYING.LGPL
%{python2_sitearch}/*
%files -n python3-setools
%license COPYING COPYING.GPL COPYING.LGPL
%{python3_sitearch}/setools
@ -183,11 +137,29 @@ popd
%{_mandir}/man1/apol*
%changelog
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Jul 08 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.2-1}
- SETools 4.2.2 release
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Mon May 13 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
- Use %set_build_flags instead of %optflags
* Mon May 06 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.1-2
- SELinuxPolicy: Create a map of aliases on policy load (#1672631)
* Tue Mar 26 2019 Petr Lautrbach <plautrba@redhat.com> - 4.2.1-1
- SETools 4.2.1 release (#1581761, #1595582)
* Wed Nov 14 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-1
- Update source to SETools 4.2.0 release
* Mon Oct 01 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-0.3.rc
- Update upstream source to 4.2.0-rc
* Wed Sep 19 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-0.2.beta
- Require userspace release 2.8
- setools-gui requires python3-setools
- Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371)
- Drop python2 subpackage (4.2.0 no longer supports python2)
* Wed Aug 29 2018 Vit Mojzis <vmojzis@redhat.com> - 4.1.1-13
- Add Requires for python[23]-setuptools - no longer required (just recommended)

2
sources
View File

@ -1 +1 @@
SHA512 (4.1.1.tar.gz) = 2e55a3b07e2f94d7c84054f31d266567b9acc708fe2b0e16ac3ea24e8301c712bcf564ff915a6135a1a6ba6822682bb3a6530dae20161a832fb7048364acbd04
SHA512 (4.2.2.tar.gz) = 5044b04d0895ffe31557b3b71bb277ab49710a6066485c8f204ce7858abab259f973000f1fcfde0149ed4e33a50103984939dcc68ce322d70e9e927e81d4f798