diff --git a/.gitignore b/.gitignore index c99180c..920f783 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/4.2.2.tar.gz +SOURCES/4.3.0.tar.gz diff --git a/.setools.metadata b/.setools.metadata index d477efe..9d7c407 100644 --- a/.setools.metadata +++ b/.setools.metadata @@ -1 +1 @@ -96da818e44293bac44d765453036b624ed573512 SOURCES/4.2.2.tar.gz +7b4a07a20ecee70da558bfe4ad26edf7eb6ca103 SOURCES/4.3.0.tar.gz diff --git a/SOURCES/0001-Support-old-boolean-names-in-policy-queries.patch b/SOURCES/0001-Support-old-boolean-names-in-policy-queries.patch new file mode 100644 index 0000000..0f40902 --- /dev/null +++ b/SOURCES/0001-Support-old-boolean-names-in-policy-queries.patch @@ -0,0 +1,94 @@ +From 97bd46865e12246c00517d1e07aabca530a305ac Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Wed, 17 Jun 2020 13:34:19 +0200 +Subject: [PATCH] Support old boolean names in policy queries + +Translate old boolean names based on /etc/selinux/*/booleans.subs_dist +file. The translation is only attempted when "policy" was not specified +to avoid influencing queries of policies from other systems. + +Signed-off-by: Vit Mojzis +--- + seinfo | 6 +++++- + sesearch | 7 ++++++- + setools/policyrep/selinux.pxd | 1 + + setools/policyrep/util.pxi | 22 ++++++++++++++++++++++ + 4 files changed, 34 insertions(+), 2 deletions(-) + +diff --git a/seinfo b/seinfo +index d2caf7c..bc33e12 100755 +--- a/seinfo ++++ b/seinfo +@@ -125,7 +125,11 @@ try: + if args.boolquery or args.all: + q = setools.BoolQuery(p) + if isinstance(args.boolquery, str): +- q.name = args.boolquery ++ if args.policy: ++ q.name = args.boolquery ++ else: ++ # try to find substitutions for old boolean names ++ q.name = setools.policyrep.lookup_boolean_name_sub(args.boolquery) + + components.append(("Booleans", q, lambda x: x.statement())) + +diff --git a/sesearch b/sesearch +index c4b1d38..733f3d3 100755 +--- a/sesearch ++++ b/sesearch +@@ -189,7 +189,12 @@ try: + if args.boolean_regex: + q.boolean = args.boolean + else: +- q.boolean = args.boolean.split(",") ++ if args.policy: ++ q.boolean = args.boolean.split(",") ++ else: ++ # try to find substitutions for old boolean names ++ q.boolean = map(setools.policyrep.lookup_boolean_name_sub, ++ args.boolean.split(",")) + + for r in sorted(q.results()): + print(r) +diff --git a/setools/policyrep/selinux.pxd b/setools/policyrep/selinux.pxd +index a2e8af0..1686831 100644 +--- a/setools/policyrep/selinux.pxd ++++ b/setools/policyrep/selinux.pxd +@@ -24,3 +24,4 @@ cdef extern from "": + bint selinuxfs_exists() + const char* selinux_current_policy_path() + const char* selinux_binary_policy_path() ++ char* selinux_boolean_sub(const char *boolean_name); +diff --git a/setools/policyrep/util.pxi b/setools/policyrep/util.pxi +index 40f21a7..abc7be8 100644 +--- a/setools/policyrep/util.pxi ++++ b/setools/policyrep/util.pxi +@@ -230,3 +230,25 @@ cdef flatten_list(input_list): + ret.append(i) + + return ret ++ ++ ++def lookup_boolean_name_sub(name): ++ """ ++ Read the /etc/selinux/TYPE/booleans.subs_dist file looking ++ for a record with 'name'. ++ Return the translated name if a corresponding substitution exists, ++ otherwise return the original name. ++ """ ++ cdef: ++ char *_name = selinux.selinux_boolean_sub(name) ++ str new_name = name ++ ++ if _name == NULL: ++ raise MemoryError ++ # cast "char *" to "str" and free ++ try: ++ new_name = _name ++ finally: ++ free(_name) ++ ++ return new_name +-- +2.25.4 + diff --git a/SOURCES/1001-Do-not-use-Werror-during-build.patch b/SOURCES/1001-Do-not-use-Werror-during-build.patch index 60f11e2..7bbc37b 100644 --- a/SOURCES/1001-Do-not-use-Werror-during-build.patch +++ b/SOURCES/1001-Do-not-use-Werror-during-build.patch @@ -1,7 +1,7 @@ -From 4b3dc6b38abbd32cda557d5ef9ea1383ac5fdcf2 Mon Sep 17 00:00:00 2001 +From 8d98b324fabcad6b09f9c734f79e6da9f9e85786 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Thu, 23 Feb 2017 08:17:07 +0100 -Subject: [PATCH 2/3] Do not use -Werror during build +Subject: [PATCH] Do not use -Werror during build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -32,10 +32,10 @@ error: command 'gcc' failed with exit status 1 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index c94daf1..a7442ac 100644 +index 457c830..4dcb301 100644 --- a/setup.py +++ b/setup.py -@@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], +@@ -106,7 +106,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], libraries=['selinux', 'sepol'], library_dirs=lib_dirs, define_macros=macros, @@ -45,5 +45,5 @@ index c94daf1..a7442ac 100644 '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.17.2 +2.25.1 diff --git a/SOURCES/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/SOURCES/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 3057072..f9d9b6c 100644 --- a/SOURCES/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/SOURCES/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From b960869bcbcb58f2ce9af598484f209935c096b0 Mon Sep 17 00:00:00 2001 +From 52f5f911c4ae481530a57b6a0dd42067406a9d36 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 26 Apr 2019 15:27:25 +0200 -Subject: [PATCH 3/3] Do not export/use setools.InfoFlowAnalysis and +Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -44,7 +44,7 @@ index 60861ca..41e38a2 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index 97b14ba..e7f965d 100755 +index f10c39d..fee749a 100755 --- a/seinfoflow +++ b/seinfoflow @@ -17,7 +17,7 @@ @@ -56,20 +56,20 @@ index 97b14ba..e7f965d 100755 import argparse import sys import logging -@@ -81,7 +81,7 @@ else: +@@ -101,7 +101,7 @@ elif args.booleans is not None: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) -- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) -+ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) +- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, ++ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, + booleans=booleans) if args.shortest_path or args.all_paths: - if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index 7b70f5e..5a5f7fe 100644 +index 26fa5aa..b7e51c4 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -73,12 +73,8 @@ from .pcideviceconquery import PcideviceconQuery +@@ -75,12 +75,8 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis @@ -135,5 +135,5 @@ index aa0e44a..fca2848 100644 from setools.exception import InvalidType from setools.permmap import PermissionMap -- -2.17.2 +2.25.1 diff --git a/SOURCES/1003-Require-networkx-on-package-level.patch b/SOURCES/1003-Require-networkx-on-package-level.patch new file mode 100644 index 0000000..809aca9 --- /dev/null +++ b/SOURCES/1003-Require-networkx-on-package-level.patch @@ -0,0 +1,24 @@ +From 67067b6df7139cc38cf33d3cb2c66434cf4e89e4 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 2 Apr 2020 16:06:14 +0200 +Subject: [PATCH] Require networkx on package level + +It allows us to ship python3-setools without dependency on python3-networkx +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index 4dcb301..9333e0c 100644 +--- a/setup.py ++++ b/setup.py +@@ -170,5 +170,5 @@ setup(name='setools', + # setup also requires libsepol and libselinux + # C libraries and headers to compile. + setup_requires=['setuptools', 'Cython>=0.27'], +- install_requires=['setuptools', 'networkx>=2.0'] ++ install_requires=['setuptools'] + ) +-- +2.25.1 + diff --git a/SOURCES/1003-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch b/SOURCES/1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch similarity index 93% rename from SOURCES/1003-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch rename to SOURCES/1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch index 741c5a7..d70b541 100644 --- a/SOURCES/1003-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch +++ b/SOURCES/1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch @@ -1,4 +1,4 @@ -From acfb532e781d600271e5ab1ebc5d9d6d6ea3a7f8 Mon Sep 17 00:00:00 2001 +From d249ea3316fcfaa203055d2b1f2c52423216e7e7 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 30 Jul 2019 17:13:44 +0200 Subject: [PATCH] Do not use NoteNotFound as it's not implemented in networkx-1 @@ -49,7 +49,7 @@ index 3239d2d..e15d8b8 100644 # NetworkXNoPath: no paths or the target type is # not in the graph diff --git a/setools/infoflow.py b/setools/infoflow.py -index 1b88efa..4fbe682 100644 +index 579e064..89e5c8e 100644 --- a/setools/infoflow.py +++ b/setools/infoflow.py @@ -21,7 +21,7 @@ import logging @@ -60,8 +60,8 @@ index 1b88efa..4fbe682 100644 +from networkx.exception import NetworkXError, NetworkXNoPath from .descriptors import EdgeAttrIntMax, EdgeAttrList - from .policyrep import TERuletype -@@ -118,7 +118,7 @@ class InfoFlowAnalysis: + from .exception import RuleNotConditional +@@ -124,7 +124,7 @@ class InfoFlowAnalysis: self.log.info("Generating one shortest information flow path from {0} to {1}...". format(s, t)) @@ -70,7 +70,7 @@ index 1b88efa..4fbe682 100644 # NodeNotFound: the type is valid but not in graph, e.g. # excluded or disconnected due to min weight # NetworkXNoPath: no paths or the target type is -@@ -157,7 +157,7 @@ class InfoFlowAnalysis: +@@ -163,7 +163,7 @@ class InfoFlowAnalysis: self.log.info("Generating all information flow paths from {0} to {1}, max length {2}...". format(s, t, maxlen)) @@ -79,7 +79,7 @@ index 1b88efa..4fbe682 100644 # NodeNotFound: the type is valid but not in graph, e.g. # excluded or disconnected due to min weight # NetworkXNoPath: no paths or the target type is -@@ -191,7 +191,7 @@ class InfoFlowAnalysis: +@@ -197,7 +197,7 @@ class InfoFlowAnalysis: self.log.info("Generating all shortest information flow paths from {0} to {1}...". format(s, t)) @@ -89,5 +89,5 @@ index 1b88efa..4fbe682 100644 # excluded or disconnected due to min weight # NetworkXNoPath: no paths or the target type is -- -2.22.0 +2.25.1 diff --git a/SPECS/setools.spec b/SPECS/setools.spec index 09026c0..57a83ac 100644 --- a/SPECS/setools.spec +++ b/SPECS/setools.spec @@ -7,7 +7,7 @@ %bcond_without networkx Name: setools -Version: 4.2.2 +Version: 4.3.0 Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux @@ -16,9 +16,11 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch0001: 0001-Support-old-boolean-names-in-policy-queries.patch Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch -Patch1003: 1003-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch +Patch1003: 1003-Require-networkx-on-package-level.patch +Patch1004: 1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -32,7 +34,11 @@ BuildRequires: python3-setuptools BuildRequires: libselinux-devel # BuildArch: -Requires: python3-%{name} = %{version}-%{release} +Requires: %{name}-console = %{version}-%{release} +%if %{with networkx} +Requires: %{name}-console-analyses = %{version}-%{release} +Requires: %{name}-gui = %{version}-%{release} +%endif %description SETools is a collection of graphical tools, command-line tools, and @@ -121,9 +127,9 @@ Python modules designed to facilitate SELinux policy analysis. %if %{without networkx} rm -f %{buildroot}%{_bindir}/sedta %{buildroot}%{_bindir}/seinfoflow \ - %{buildroot}%{_mandir}/man1/sedta* %{buildroot}%{_mandir}/man1/sedinfoflow* + %{buildroot}%{_mandir}*/man1/sedta* %{buildroot}%{_mandir}*/man1/sedinfoflow* \ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \ - %{buildroot}%{_mandir}/man1/apol* + %{buildroot}%{_mandir}*/man1/apol* %endif %check @@ -141,6 +147,9 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \ %{_mandir}/man1/sediff* %{_mandir}/man1/seinfo* %{_mandir}/man1/sesearch* +%{_mandir}/ru/man1/sediff* +%{_mandir}/ru/man1/seinfo* +%{_mandir}/ru/man1/sesearch* %if %{with networkx} %files console-analyses @@ -148,6 +157,8 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \ %{_bindir}/seinfoflow %{_mandir}/man1/sedta* %{_mandir}/man1/seinfoflow* +%{_mandir}/ru/man1/sedta* +%{_mandir}/ru/man1/seinfoflow* %endif %files -n python3-setools @@ -160,9 +171,26 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \ %{_bindir}/apol %{python3_sitearch}/setoolsgui %{_mandir}/man1/apol* +%{_mandir}/ru/man1/apol* %endif %changelog +* Tue Jun 30 2020 Vit Mojzis - 4.3.0-2 +- Support old boolean names in policy queries (#1595572, #1581848) + +* Fri Apr 03 2020 Vit Mojzis - 4.3.0-1 +- SETools 4.3.0 release (#1820079) +- Revised sediff method for TE rules. This drastically reduced memory and run time. +- Added infiniband context support to seinfo, sediff, and apol. +- Added apol configuration for location of Qt assistant. +- Fixed sediff issue where properties header would display when not requested. +- Fixed sediff issue with type_transition file name comparison. +- Fixed permission map socket sendto information flow direction. +- Added methods to TypeAttribute class to make it a complete Python collection. +- Genfscon now will look up classes rather than using fixed values which + were dropped from libsepol. +- setools requires -console, -console-analyses and -gui packages (#1820078) + * Sat Nov 30 2019 Petr Lautrbach - 4.2.2-2 - Build setools-console-analyses and setools-gui (#1731519)