import setroubleshoot-3.3.24-3.el8

SOURCES/0002-framework-util-optimize-get_rpm_nvr_by_type-by-addin.patch

@@ -0,0 +1,153 @@
+From 6fbf777bc59c005e04d4616b9aebeb7c7f0866c0 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 13 Jan 2021 12:43:54 +0100
+Subject: [PATCH] framework/util: optimize get_rpm_nvr_by_type by adding a
+ cache
+
+The cache build could be optimized by assuming that all modules with
+priority 100 are part of selinux-policy-<policytype> package. This way
+the cache would only have to contain types from modules of other
+priorities.
+
+Another optimization would be making the cache persistent. This way it
+would only have to be rebuild on policy reload (sedispatch could trigger
+cache rebuild over dbus).
+
+My testing shows significant time save when processing multiple AVCs:
+setroubleshoot-server-3.3.24-1.el8:
+real	2m26.075s
+user	2m17.989s
+sys	0m5.916s
+
+Cache:
+real	0m15.337s
+user	0m11.004s
+sys	0m3.995s
+
+But curiously, there is also a small time save for individual AVCs
+(measured by forcing the cache rebuild for each call of
+get_rpm_nvr_by_type):
+real	1m40.393s
+user	1m32.830s
+sys	0m5.960s
+
+It could be caused by processing policy modules by lines, which quickly
+eliminates all lines not starting by "(type " (as opposed to comparing
+the regular expression with the whole file).
+---
+ framework/src/setroubleshoot/util.py | 86 +++++++++++++++++++++-------
+ 1 file changed, 65 insertions(+), 21 deletions(-)
+
+diff --git a/framework/src/setroubleshoot/util.py b/framework/src/setroubleshoot/util.py
+index 023d1c4..657c882 100755
+--- a/framework/src/setroubleshoot/util.py
++++ b/framework/src/setroubleshoot/util.py
+@@ -114,6 +114,12 @@ hex_re = re.compile('^[A-Fa-f0-9]+$')
+ href_re = re.compile(r'<a\s*href="([^"]+)"[^<]*</a>')
+ name_at_domain_re = re.compile(r'^([^\s@]+)@([^\s@]+)$')
+ audit_decode_re = re.compile(r'^\s*"([^"]+)"\s*$')
++# regexp matching lines containing type definitions, eg. (type lib_t)
++# contains only 1 group that matches the type name
++typedef_regexp = re.compile(r"\s*\(\s*type\s+([\w-]+)\s*\)\s*")
++#Dictionary with all types defined in the module store as keys
++#and corresponding module paths as values. Used by get_package_nvr_by_name
++module_type_cache = None
+ 
+ log_level = syslog.LOG_WARNING
+ 
+@@ -425,33 +431,71 @@ Finds an SELinux module which defines given SELinux type
+ 'mysql-selinux-...
+ 
+     """
++
++    if module_type_cache is None:
++        build_module_type_cache()
++        if module_type_cache is None:
++            return None
++
++    path = module_type_cache.get(selinux_type, None)
++
++    return get_package_nvr_by_file_path(path)
++
++# check if given string represents an integer
++def __str_is_int(str):
++    try:
++        int(str)
++        return True
++    except:
++        return False
++
++def build_module_type_cache():
++    """
++Creates a dictionary with all types defined in the module store as keys
++and corresponding module paths as values.
++The dictionary is stored in "module_type_cache" to be used by
++"get_rpm_nvr_by_type"
++    """
+     retval, policytype = selinux.selinux_getpolicytype()
++
+     if retval != 0:
+-        return None
+-    typedef = "(type {})\n".format(selinux_type)
+-    modules = []
+-    for (dirpath, dirnames, filenames) in os.walk("/var/lib/selinux/{}/active/modules".format(policytype)):
+-        if "cil" in filenames:
+-            try:
+-                defined = False
++        return
++
++    module_type_dict = dict()
++
++    priorities = []
++
++    # get list of module priorities, present in the module store, sorted by integer value
++    with os.scandir("/var/lib/selinux/{}/active/modules".format(policytype)) as module_store:
++        priorities = sorted([x.name for x in module_store if x.is_dir() and __str_is_int(x.name)], key = lambda x: int(x))
++
++    for dir in priorities:
++        # find individual modules in each priority and identify type definitions
++        for (dirpath, dirnames, filenames) in os.walk("/var/lib/selinux/{}/active/modules/{}".format(policytype,dir)):
++            if "cil" in filenames:
+                 try:
+-                    # cil files are bzip2'ed by default
+-                    defined = typedef.encode() in bz2.open("{}/cil".format(dirpath))
+-                except:
+-                    # maybe cil file is not bzip2'ed, try plain text
+-                    defined = typedef in open("{}/cil".format(dirpath))
++                    try:
++                        # cil files are bzip2'ed by default
++                        f = bz2.open("{}/cil".format(dirpath), mode = 'rt')
+ 
+-                if defined:
+-                    modules.append(dirpath)
+-            except:
+-                # something's wrong, move on
+-                # FIXME: log a problem?
+-                pass
++                    except:
++                        # maybe cil file is not bzip2'ed, try plain text
++                        f = open("{}/cil".format(dirpath))
+ 
+-    if len(modules) > 0:
+-        return get_package_nvr_by_file_path(sorted(modules)[-1])
++                    for line in f:
++                        result = typedef_regexp.match(line)
++                        if result:
++                            module_type_dict[result.group(1)] = dirpath
+ 
+-    return None
++                    f.close()
++
++                except:
++                    # something's wrong, move on
++                    # FIXME: log a problem?
++                    pass
++
++    global module_type_cache
++    module_type_cache = module_type_dict
+ 
+ def get_rpm_nvr_by_scontext(scontext, use_dbus=False):
+     """
+-- 
+2.29.2
+

SOURCES/0003-framework-sealert-exit-on-any-connection-close.patch

@@ -0,0 +1,30 @@
+From e339956442fb7284bce31e132b0be7ad0f3badc5 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 2 Feb 2021 13:18:49 +0100
+Subject: [PATCH] framework/sealert: exit on any connection close
+
+SECommandLine is only connecting to setroubleshootd for a short time.
+Therefore any connection close from "server" side should be treated as
+error.
+
+This prevents "sealert" from hanging when setroubleshootd crashes.
+---
+ framework/src/sealert | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/framework/src/sealert b/framework/src/sealert
+index 7839367..bae0c81 100755
+--- a/framework/src/sealert
++++ b/framework/src/sealert
+@@ -488,7 +488,7 @@ class SECommandLine(object):
+     def on_connection_state_change(self, connection, connection_state, flags, flags_added, flags_removed):
+         log_debug("%s.on_connection_state_change: connection_state=%s flags_added=%s flags_removed=%s address=%s" % (self.__class__.__name__, connection_state, connection_state.flags_to_string(flags_added), connection_state.flags_to_string(flags_removed), connection.socket_address))
+ 
+-        if flags_added & ConnectionState.ERROR:
++        if (flags_added & (ConnectionState.ERROR | ConnectionState.HUP)) or (flags_removed & ConnectionState.OPEN):
+             errno, strerror = connection_state.get_result()
+             print("failed to connect to server: %s" % (strerror), file=sys.stderr)
+             sys.exit(1)
+-- 
+2.29.2
+

SPECS/setroubleshoot.spec

@@ -1,13 +1,16 @@
 Summary: Helps troubleshoot SELinux problems
 Name: setroubleshoot
 Version: 3.3.24
-Release: 1%{?dist}
+Release: 3%{?dist}
 License: GPLv2+
 URL: https://pagure.io/setroubleshoot
 Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz
 Source1: %{name}.tmpfiles
 # git format-patch -N setroubleshoot-3.3.24 -- framework
 # i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
+Patch0001: 0001-framework-Update-translations.patch
+Patch0002: 0002-framework-util-optimize-get_rpm_nvr_by_type-by-addin.patch
+Patch0003: 0003-framework-sealert-exit-on-any-connection-close.patch
 BuildRequires: gcc
 BuildRequires: libcap-ng-devel
 BuildRequires: intltool gettext python3 python3-devel
@@ -62,7 +65,7 @@ to user preference. The same tools can be run on existing log files.
 
 %build
 autoreconf -f
-%configure PYTHON=%{__python3} --enable-seappletlegacy=yes --with-auditpluginsdir=/etc/audit/plugins.d
+%configure PYTHON=%{__python3} --enable-seappletlegacy=no --with-auditpluginsdir=/etc/audit/plugins.d
 make
 
 %install
@@ -195,19 +198,15 @@ chown -R setroubleshoot:setroubleshoot %{pkgvardatadir}
 %attr(0711,setroubleshoot,setroubleshoot) %dir %{_rundir}/setroubleshoot
 %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO
 
-%package legacy
-Summary: SELinux troubleshoot legacy applet
-
-Requires: gtk2
-Requires: %{name} = %{version}-%{release}
-
-%description legacy
-SELinux troubleshoot legacy applet
-
-%files legacy
-%{_bindir}/seappletlegacy
-
 %changelog
+* Tue Feb 02 2021 Vit Mojzis <vmojzis@redhat.com> - 3.3.24-3
+- sealert: exit on any connection close (#1875290)
+
+* Wed Jan 13 2021 Vit Mojzis <vmojzis@redhat.com> - 3.3.24-2
+- Optimize get_rpm_nvr_by_type by adding a cache (#1794807)
+- Stop building seappletlegacy (#1878792)
+- Update translations
+
 * Wed Aug 12 2020 Vit Mojzis <vmojzis@redhat.com> - 3.3.24-1
 - Add 'fur' into shipped locales
 - Update translations (#1820570)