From bd46fc11c7d8c601b91e987ea88c6c240280cbf2 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 29 Jul 2026 13:04:17 +0200 Subject: [PATCH] setroubleshoot-3.3.37-2 - Update GPL2 license texts to the latest version - Limit RPC request size in RequestReceiver to prevent memory exhaustion Resolves: RHEL-214326 --- ...-license-texts-to-the-latest-version.patch | 443 ++++++++++++++++++ ...t-size-in-RequestReceiver-to-prevent.patch | 80 ++++ setroubleshoot.spec | 10 +- 3 files changed, 531 insertions(+), 2 deletions(-) create mode 100644 0001-Update-GPL2-license-texts-to-the-latest-version.patch create mode 100644 0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch diff --git a/0001-Update-GPL2-license-texts-to-the-latest-version.patch b/0001-Update-GPL2-license-texts-to-the-latest-version.patch new file mode 100644 index 0000000..5674128 --- /dev/null +++ b/0001-Update-GPL2-license-texts-to-the-latest-version.patch @@ -0,0 +1,443 @@ +From 96f8442e292e651437004d78abdbb8586ebb728e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 2 Jun 2026 11:15:33 +0200 +Subject: [PATCH] Update GPL2 license texts to the latest version + +Fixes: https://gitlab.com/setroubleshoot/setroubleshoot/-/work_items/6 + + setroubleshoot.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/browser.py + setroubleshoot.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/gui_utils.py + setroubleshoot-server.x86_64: E: incorrect-fsf-address /usr/bin/sealert + setroubleshoot-server.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/Plugin.py + ... +--- + COPYING | 15 +++++++-------- + src/SetroubleshootPrivileged.py | 5 ++--- + src/config.py.in | 3 +-- + src/default_encoding.c | 3 +-- + src/sealert | 3 +-- + src/seappletlegacy.c | 3 +-- + src/sedbus.c | 3 +-- + src/sedispatch.c | 3 +-- + src/setroubleshoot/Plugin.py | 3 +-- + src/setroubleshoot/__init__.py | 3 +-- + src/setroubleshoot/access_control.py | 3 +-- + src/setroubleshoot/analyze.py | 3 +-- + src/setroubleshoot/audit_data.py | 3 +-- + src/setroubleshoot/avc_audit.py | 3 +-- + src/setroubleshoot/browser.py | 3 +-- + src/setroubleshoot/email_alert.py | 3 +-- + src/setroubleshoot/errcode.py | 3 +-- + src/setroubleshoot/gui_utils.py | 3 +-- + src/setroubleshoot/html_util.py | 3 +-- + src/setroubleshoot/rpc.py | 3 +-- + src/setroubleshoot/rpc_interfaces.py | 3 +-- + src/setroubleshoot/server.py | 3 +-- + src/setroubleshoot/signature.py | 3 +-- + src/setroubleshoot/util.py | 3 +-- + src/setroubleshoot/xml_serialize.py | 3 +-- + src/setroubleshootd | 3 +-- + 26 files changed, 33 insertions(+), 59 deletions(-) + +diff --git a/COPYING b/COPYING +index 623b625..6c6dbab 100644 +--- a/COPYING ++++ b/COPYING +@@ -1,8 +1,8 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + +- Copyright (C) 1989, 1991 Free Software Foundation, Inc. +- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Copyright (C) 1989, 1991 Free Software Foundation, Inc., ++ + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This + General Public License applies to most of the Free Software + Foundation's software and to any other program whose authors commit to + using it. (Some other Free Software Foundation software is covered by +-the GNU Library General Public License instead.) You can apply it to ++the GNU Lesser General Public License instead.) You can apply it to + your programs, too. + + When we speak of free software, we are referring to freedom, not +@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found. + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License +- along with this program; if not, write to the Free Software +- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ along with this program; if not, see . + + + Also add information on how to contact you by electronic and paper mail. +@@ -330,11 +329,11 @@ necessary. Here is a sample; alter the names: + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + +- , 1 April 1989 +- Ty Coon, President of Vice ++ , 1 April 1989 ++ Moe Ghoul, President of Vice + + This General Public License does not permit incorporating your program into + proprietary programs. If your program is a subroutine library, you may + consider it more useful to permit linking proprietary applications with the +-library. If this is what you want to do, use the GNU Library General ++library. If this is what you want to do, use the GNU Lesser General + Public License instead of this License. +diff --git a/src/SetroubleshootPrivileged.py b/src/SetroubleshootPrivileged.py +index c9f46da..845a006 100644 +--- a/src/SetroubleshootPrivileged.py ++++ b/src/SetroubleshootPrivileged.py +@@ -14,9 +14,8 @@ + # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + # GNU General Public License for more details. + # +-# You should have received a copy of the GNU General Public License along +-# with this program; if not, write to the Free Software Foundation, Inc., +-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, see . + + import signal + from gi.repository import GLib +diff --git a/src/config.py.in b/src/config.py.in +index 48a670a..d8e7e35 100644 +--- a/src/config.py.in ++++ b/src/config.py.in +@@ -14,8 +14,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['config_init', +diff --git a/src/default_encoding.c b/src/default_encoding.c +index 61d6382..75e9930 100644 +--- a/src/default_encoding.c ++++ b/src/default_encoding.c +@@ -15,8 +15,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + */ + + #include +diff --git a/src/sealert b/src/sealert +index c45f4fc..91af079 100755 +--- a/src/sealert ++++ b/src/sealert +@@ -16,8 +16,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import print_function +diff --git a/src/seappletlegacy.c b/src/seappletlegacy.c +index d6ce7ec..1e14482 100644 +--- a/src/seappletlegacy.c ++++ b/src/seappletlegacy.c +@@ -17,8 +17,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++ * along with this program; if not, see . + * + * compile command + * gcc -g sealerttrayicon.c -o sealerttrayicon `pkg-config --cflags --libs gtk+-2.0` -lnotify +diff --git a/src/sedbus.c b/src/sedbus.c +index 702bed7..fd4a860 100644 +--- a/src/sedbus.c ++++ b/src/sedbus.c +@@ -13,8 +13,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + * + * Authors: + * Dan Walsh +diff --git a/src/sedispatch.c b/src/sedispatch.c +index 07d9c90..b1b80fc 100644 +--- a/src/sedispatch.c ++++ b/src/sedispatch.c +@@ -13,8 +13,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + * + * Authors: + * Dan Walsh +diff --git a/src/setroubleshoot/Plugin.py b/src/setroubleshoot/Plugin.py +index 3c52b7f..13f31f0 100644 +--- a/src/setroubleshoot/Plugin.py ++++ b/src/setroubleshoot/Plugin.py +@@ -15,8 +15,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import gettext +diff --git a/src/setroubleshoot/__init__.py b/src/setroubleshoot/__init__.py +index ccb6b8b..0fe4d80 100644 +--- a/src/setroubleshoot/__init__.py ++++ b/src/setroubleshoot/__init__.py +@@ -12,6 +12,5 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # +diff --git a/src/setroubleshoot/access_control.py b/src/setroubleshoot/access_control.py +index de16e32..3c2c02b 100644 +--- a/src/setroubleshoot/access_control.py ++++ b/src/setroubleshoot/access_control.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + """Access control for setroubleshoot. For now this is only used for +diff --git a/src/setroubleshoot/analyze.py b/src/setroubleshoot/analyze.py +index d1c7ac6..b2bbce8 100644 +--- a/src/setroubleshoot/analyze.py ++++ b/src/setroubleshoot/analyze.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import print_function +diff --git a/src/setroubleshoot/audit_data.py b/src/setroubleshoot/audit_data.py +index 34cc3b1..d1e03d7 100644 +--- a/src/setroubleshoot/audit_data.py ++++ b/src/setroubleshoot/audit_data.py +@@ -15,8 +15,7 @@ import sys + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['derive_record_format', +diff --git a/src/setroubleshoot/avc_audit.py b/src/setroubleshoot/avc_audit.py +index 5419280..2f61349 100644 +--- a/src/setroubleshoot/avc_audit.py ++++ b/src/setroubleshoot/avc_audit.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = [ +diff --git a/src/setroubleshoot/browser.py b/src/setroubleshoot/browser.py +index 47788a7..d8e9921 100644 +--- a/src/setroubleshoot/browser.py ++++ b/src/setroubleshoot/browser.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import absolute_import +diff --git a/src/setroubleshoot/email_alert.py b/src/setroubleshoot/email_alert.py +index 0921b99..8e41124 100644 +--- a/src/setroubleshoot/email_alert.py ++++ b/src/setroubleshoot/email_alert.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['email_alert', +diff --git a/src/setroubleshoot/errcode.py b/src/setroubleshoot/errcode.py +index 2a2aa21..7a925b9 100644 +--- a/src/setroubleshoot/errcode.py ++++ b/src/setroubleshoot/errcode.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + import gettext + from setroubleshoot.config import parse_config_setting, get_config +diff --git a/src/setroubleshoot/gui_utils.py b/src/setroubleshoot/gui_utils.py +index e28673a..cbec874 100644 +--- a/src/setroubleshoot/gui_utils.py ++++ b/src/setroubleshoot/gui_utils.py +@@ -14,8 +14,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + # Needed to silence warnings if X display is not present +diff --git a/src/setroubleshoot/html_util.py b/src/setroubleshoot/html_util.py +index 5021683..c08e5b5 100644 +--- a/src/setroubleshoot/html_util.py ++++ b/src/setroubleshoot/html_util.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 82fc294..2a874ae 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -15,8 +15,7 @@ from __future__ import print_function + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import xml.etree.ElementTree as ET +diff --git a/src/setroubleshoot/rpc_interfaces.py b/src/setroubleshoot/rpc_interfaces.py +index ec7ff50..5a42f0b 100644 +--- a/src/setroubleshoot/rpc_interfaces.py ++++ b/src/setroubleshoot/rpc_interfaces.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from setroubleshoot.rpc import rpc_method, rpc_arg_type, rpc_callback, rpc_signal +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index 3369af1..cf0f345 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -16,8 +16,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['RunFaultServer', +diff --git a/src/setroubleshoot/signature.py b/src/setroubleshoot/signature.py +index cf675ff..e4fee53 100755 +--- a/src/setroubleshoot/signature.py ++++ b/src/setroubleshoot/signature.py +@@ -17,8 +17,7 @@ from __future__ import print_function + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import syslog +diff --git a/src/setroubleshoot/util.py b/src/setroubleshoot/util.py +index b6125aa..dd331b7 100755 +--- a/src/setroubleshoot/util.py ++++ b/src/setroubleshoot/util.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = [ +diff --git a/src/setroubleshoot/xml_serialize.py b/src/setroubleshoot/xml_serialize.py +index e1adf7f..596e276 100755 +--- a/src/setroubleshoot/xml_serialize.py ++++ b/src/setroubleshoot/xml_serialize.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + # Escaping +diff --git a/src/setroubleshootd b/src/setroubleshootd +index 3affe3a..2ad355b 100755 +--- a/src/setroubleshootd ++++ b/src/setroubleshootd +@@ -17,8 +17,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + import sys + import os +-- +2.53.0 + diff --git a/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch b/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch new file mode 100644 index 0000000..b327aac --- /dev/null +++ b/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch @@ -0,0 +1,80 @@ +From 4ffb87384c1c104f14db183b26d445c1685fb053 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 27 Jul 2026 17:06:52 +0200 +Subject: [PATCH] Limit RPC request size in RequestReceiver to prevent memory + exhaustion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A local attacker could connect to the world-writable setroubleshootd +UNIX socket and send a crafted RPC header with an arbitrarily large +content-length value, then continuously stream body data. Because +RequestReceiver.feed() appended incoming data to feed_buf without any +upper bound and parse_header() trusted the content-length value +directly, memory usage would grow until the daemon was OOM-killed by +the MemoryMax=1G cgroup limit. + +Add size limits at three levels: +- Reject content-length values that are missing, negative, or exceed + MAX_BODY_LEN (1 MiB) in parse_header() +- Reject incomplete headers once feed_buf exceeds MAX_HEADER_LEN + (8 KiB) without a terminator in process() +- Cap total feed_buf size to MAX_HEADER_LEN + MAX_BODY_LEN in feed() + as a catch-all safety net + +All ValueError exceptions propagate to the existing except handler in +handle_client_io(), which logs the error and closes only the offending +client connection — the daemon continues serving other clients. + +Co-Authored-By: Claude Opus 4.6 +--- + src/setroubleshoot/rpc.py | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 2a874ae..aca2d7e 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -710,6 +710,8 @@ class ListeningServer(ConnectionIO): + + + class RequestReceiver: ++ MAX_HEADER_LEN = 8192 ++ MAX_BODY_LEN = 1024 * 1024 + + def __init__(self, dispatchFunc): + self.dispatchFunc = dispatchFunc +@@ -736,6 +738,8 @@ class RequestReceiver: + self.parse_header() + continue + else: ++ if len(self.feed_buf) > self.MAX_HEADER_LEN: ++ raise ValueError("RPC header too large") + # Can't read header till more data arrives + break + if len(self.feed_buf) >= self.headerLen + self.bodyLen: +@@ -754,6 +758,8 @@ class RequestReceiver: + + def feed(self, data): + self.feed_buf += data ++ if len(self.feed_buf) > self.MAX_HEADER_LEN + self.MAX_BODY_LEN: ++ raise ValueError("RPC request exceeds maximum allowed size") + self.process() + + def parse_header(self): +@@ -768,7 +774,11 @@ class RequestReceiver: + begin = match.end() + else: + break ++ if 'content-length' not in self.header: ++ raise ValueError("RPC request missing content-length") + self.bodyLen = int(self.header['content-length']) ++ if self.bodyLen < 0 or self.bodyLen > self.MAX_BODY_LEN: ++ raise ValueError("RPC body length out of range") + + #----------------------------------------------------------------------------- + +-- +2.53.0 + diff --git a/setroubleshoot.spec b/setroubleshoot.spec index f245031..01fb9e5 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,14 +6,16 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz Source1: %{name}.tmpfiles Source2: %{name}.sysusers -# git format-patch -N 3.3.37 +# git format-patch -N 3.3.37 -- . ':!src/sedispatch.h' ':!test' # for j in 00*patch; do printf "Patch: %s\n" $j; done +Patch: 0001-Update-GPL2-license-texts-to-the-latest-version.patch +Patch: 0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch BuildRequires: gcc BuildRequires: make BuildRequires: libcap-ng-devel @@ -194,6 +196,10 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Wed Jul 29 2026 Vit Mojzis - 3.3.37-2 +- Update GPL2 license texts to the latest version +- Limit RPC request size in RequestReceiver to prevent memory exhaustion (RHEL-214326) + * Thu May 07 2026 Vit Mojzis - 3.3.37-1 - Migrate from libxml2 to xml.etree.ElementTree - Handle ImportError when setroubleshoot.browser is not available