RHEL 9.0.0 Alpha bootstrap
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/udica#e23d97dbf9a4ec25fcbb29217dbf54ba68c4738c
This commit is contained in:
Troy Dawson
parent
74b6192512
commit
9b4abb0b8d
|
|
@ -0,0 +1,13 @@
|
|||
/v0.1.1.tar.gz
|
||||
/v0.1.2.tar.gz
|
||||
/v0.1.3.tar.gz
|
||||
/v0.1.4.tar.gz
|
||||
/v0.1.5.tar.gz
|
||||
/v0.1.6.tar.gz
|
||||
/v0.1.7.tar.gz
|
||||
/v0.1.8.tar.gz
|
||||
/v0.1.9.tar.gz
|
||||
/v0.2.0.tar.gz
|
||||
/v0.2.1.tar.gz
|
||||
/v0.2.2.tar.gz
|
||||
/v0.2.3.tar.gz
|
||||
|
|
@ -0,0 +1 @@
|
|||
SHA512 (v0.2.3.tar.gz) = 78e6bae5a26e50ddc01a251802a02d6c48d8a87a8a1c343f9b40d0b2fdafbe435d62e6c1b6fb7c1365f536fac02f01d9057b2ffdaef27a9f91f3b245840754fb
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Description: Compare udica output between podman and docker
|
||||
# Author: Jan Zarsky <jzarsky@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="udica"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm "udica"
|
||||
rlAssertRpm "policycoreutils"
|
||||
rlAssertRpm "podman"
|
||||
rlAssertRpm "docker"
|
||||
rlRun "rlServiceStart docker"
|
||||
OUTPUT_FILE=$(mktemp)
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
for BACKEND in podman docker ; do
|
||||
rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||
rlRun "$BACKEND ps | grep test"
|
||||
CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1)
|
||||
rlRun "udica -i $CONT_ID my_container"
|
||||
rlRun "mv my_container.cil my_cont_$BACKEND.cil"
|
||||
rlRun "$BACKEND stop test"
|
||||
rlRun "$BACKEND rm test"
|
||||
done
|
||||
|
||||
rlRun "sed -i '/capability/d' my_cont_podman.cil"
|
||||
rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil"
|
||||
|
||||
rlRun "rm my_cont_podman.cil my_cont_docker.cil"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rm -f $OUTPUT_FILE"
|
||||
rlRun "rlServiceRestore docker"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,129 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Description: Test basic functionality of udica
|
||||
# Author: Jan Zarsky <jzarsky@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="udica"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm "udica"
|
||||
rlAssertRpm "policycoreutils"
|
||||
rlAssertRpm "podman"
|
||||
OUTPUT_FILE=$(mktemp)
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "udica --help"
|
||||
rlRun "PAGER=cat man udica"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Test basic scenario"
|
||||
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||
rlRun "podman ps | grep test"
|
||||
rlRun "ps -efZ | grep bash"
|
||||
rlRun "ps -efZ | grep bash | grep container_t"
|
||||
|
||||
rlRun "podman exec test ls /home" 1,2
|
||||
rlRun "podman exec test touch /var/spool/test" 1
|
||||
rlRun "podman exec test dnf install nmap-ncat -y" 0
|
||||
rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3
|
||||
|
||||
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||
rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE"
|
||||
rlRun "podman stop test"
|
||||
rlRun "podman rm --force test"
|
||||
|
||||
rlRun "cat $OUTPUT_FILE"
|
||||
rlAssertExists "my_container.cil"
|
||||
SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2)
|
||||
rlRun "$SEMODULE"
|
||||
|
||||
PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2)
|
||||
rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||
rlRun "podman ps | grep test2"
|
||||
rlRun "ps -efZ | grep bash"
|
||||
rlRun "ps -efZ | grep bash | grep my_container.process"
|
||||
|
||||
rlRun "podman exec test2 ls /home" 0
|
||||
rlRun "podman exec test2 touch /var/spool/test" 0
|
||||
rlRun "podman exec test2 dnf install nmap-ncat -y" 0
|
||||
rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3
|
||||
|
||||
rlRun "podman stop test2"
|
||||
rlRun "podman rm --force test2"
|
||||
|
||||
rlRun "semodule -r my_container base_container net_container home_container"
|
||||
rlRun "rm my_container.cil"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Compare different ways of obtaining policy"
|
||||
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||
rlRun "podman ps | grep test"
|
||||
|
||||
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||
rlRun "podman inspect $CONT_ID | udica my_container >pipe.result"
|
||||
|
||||
rlRun "podman inspect $CONT_ID >container.json"
|
||||
rlRun "udica -j container.json my_container >json.result"
|
||||
|
||||
rlRun "udica -i $CONT_ID my_container >id.result"
|
||||
|
||||
rlRun "diff pipe.result json.result"
|
||||
rlRun "diff pipe.result id.result"
|
||||
|
||||
rlRun "rm -f pipe.result json.result id.result container.json"
|
||||
rlRun "podman stop test"
|
||||
rlRun "podman rm test"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Test loading modules"
|
||||
rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
|
||||
rlRun "podman ps | grep test"
|
||||
|
||||
CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
|
||||
rlRun "podman inspect $CONT_ID | udica -l my_container"
|
||||
|
||||
rlRun "podman stop test"
|
||||
rlRun "podman rm test"
|
||||
|
||||
rlRun "semodule -l >$OUTPUT_FILE"
|
||||
rlAssertGrep "my_container" $OUTPUT_FILE
|
||||
rlAssertGrep "base_container" $OUTPUT_FILE
|
||||
rlAssertGrep "net_container" $OUTPUT_FILE
|
||||
rlAssertGrep "home_container" $OUTPUT_FILE
|
||||
|
||||
rlRun "semodule -r my_container base_container net_container home_container"
|
||||
rlRun "rm my_container.cil"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rm -f $OUTPUT_FILE"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
- hosts: localhost
|
||||
tags:
|
||||
- classic
|
||||
- container
|
||||
roles:
|
||||
- role: standard-test-source
|
||||
|
||||
- role: standard-test-basic
|
||||
required_packages:
|
||||
- python3
|
||||
tests:
|
||||
- smoke:
|
||||
dir: ./source
|
||||
run: python3 -m unittest -v tests/test_unit.py
|
||||
- smoke2:
|
||||
dir: ./source
|
||||
run: python3 tests/test_integration.py
|
||||
|
||||
- role: standard-test-beakerlib
|
||||
tags:
|
||||
- classic
|
||||
tests:
|
||||
- sanity
|
||||
required_packages:
|
||||
- podman
|
||||
|
|
@ -0,0 +1,177 @@
|
|||
Summary: A tool for generating SELinux security policies for containers
|
||||
Name: udica
|
||||
Version: 0.2.3
|
||||
Release: 1%{?dist}
|
||||
Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
|
||||
License: GPLv3+
|
||||
BuildArch: noarch
|
||||
Url: https://github.com/containers/udica
|
||||
%if 0%{?fedora} || 0%{?rhel} > 7
|
||||
BuildRequires: python3 python3-devel python3-setuptools
|
||||
Requires: python3 python3-libsemanage python3-libselinux
|
||||
%else
|
||||
BuildRequires: python2 python2-devel python2-setuptools
|
||||
Requires: python2 libsemanage-python libselinux-python
|
||||
%endif
|
||||
|
||||
%description
|
||||
Tool for generating SELinux security profiles for containers based on
|
||||
inspection of container JSON file.
|
||||
|
||||
%prep
|
||||
%autosetup -p 1
|
||||
|
||||
%build
|
||||
%if 0%{?fedora} || 0%{?rhel} > 7
|
||||
%{__python3} setup.py build
|
||||
%else
|
||||
%{__python2} setup.py build
|
||||
%endif
|
||||
|
||||
%install
|
||||
install --directory %%{buildroot}%{_datadir}/udica/templates
|
||||
|
||||
%if 0%{?fedora} || 0%{?rhel} > 7
|
||||
%{__python3} setup.py install --single-version-externally-managed --root=%{buildroot}
|
||||
%else
|
||||
%{__python2} setup.py install --single-version-externally-managed --root=%{buildroot}
|
||||
%endif
|
||||
|
||||
install --directory %{buildroot}%{_mandir}/man8
|
||||
install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
|
||||
|
||||
%files
|
||||
%{_mandir}/man8/udica.8*
|
||||
%{_bindir}/udica
|
||||
%dir %{_datadir}/udica
|
||||
%dir %{_datadir}/udica/ansible
|
||||
%dir %{_datadir}/udica/templates
|
||||
%{_datadir}/udica/ansible/*
|
||||
%{_datadir}/udica/templates/*
|
||||
|
||||
%if 0%{?fedora} || 0%{?rhel} > 7
|
||||
%license LICENSE
|
||||
%{python3_sitelib}/udica/
|
||||
%{python3_sitelib}/udica-*.egg-info
|
||||
%else
|
||||
%{_datarootdir}/licenses/udica/LICENSE
|
||||
%{python2_sitelib}/udica/
|
||||
%{python2_sitelib}/udica-*.egg-info
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Aug 13 2020 Lukas Vrabec <lvrabec@redhat.com> - 0.2.3-1
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.2.3
|
||||
|
||||
* Mon Aug 03 2020 Lukas Vrabec <lvrabec@redhat.com> - 0.2.2-1
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.2.2
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.2.1-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 0.2.1-3
|
||||
- Rebuilt for Python 3.9
|
||||
|
||||
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.2.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.2.1
|
||||
|
||||
* Wed Sep 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.0-1
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.2.0
|
||||
|
||||
* Wed Aug 28 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.9-1
|
||||
- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.1.9
|
||||
|
||||
* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 0.1.8-3
|
||||
- Rebuilt for Python 3.8
|
||||
|
||||
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.8-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Thu Jul 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.8-1
|
||||
- New rebase https://github.com/containers/udica/releases/tag/v0.1.8
|
||||
|
||||
* Wed Jun 12 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.7-1
|
||||
- New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7
|
||||
|
||||
* Thu May 16 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.6-1
|
||||
- New rebase with upstream adding new tests
|
||||
|
||||
* Tue Apr 30 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-2
|
||||
- Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules.
|
||||
* Fri Apr 19 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-1
|
||||
- Create mock selinux and semanage module
|
||||
- Update testing section in README
|
||||
- Add travis file for Travis CI
|
||||
- Grammar fixes in the udica.8 manpage file
|
||||
- Support port ranges (Resolves: #16)
|
||||
- Test port ranges
|
||||
|
||||
* Mon Mar 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.4-1
|
||||
- Fix minor problems reported by pylint #11
|
||||
- Catch FileNotFoundError when inspecting containers #12
|
||||
- Create basic tests #13
|
||||
- Restore working directory #14
|
||||
- udica cannot use the container ID once it is provided #10
|
||||
|
||||
* Mon Feb 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-4
|
||||
- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8
|
||||
- Add check if runtimes are installed on the system
|
||||
|
||||
* Sun Feb 17 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-3
|
||||
- Improve capability parsing for docker containers
|
||||
- Update small changes in manpage, like issue with mandatory option '-c' for docker containers
|
||||
- Fix parsing Mountpoints in docker inspect JSON file
|
||||
|
||||
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Wed Jan 23 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-1
|
||||
- Fix capability allow rules when capabilities are specified in JSON file
|
||||
- Add additional SELinux allow rules to base container template to allow container to read proc_type types.
|
||||
|
||||
* Fri Jan 04 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.2-1
|
||||
- Fix invalid syntax output when policy is using just one template
|
||||
Resolves: #6
|
||||
|
||||
* Tue Oct 23 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.1-2
|
||||
- Fix small issues in spec file like improve description and change files section.
|
||||
|
||||
* Mon Oct 22 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.1-1
|
||||
- Add proper shebang to all source files
|
||||
- Add License to all source files
|
||||
|
||||
* Sat Oct 13 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.0-1
|
||||
- Add support for docker containers
|
||||
|
||||
* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.5-1
|
||||
- Update x_container template based on testing container related to Nvidia Cuda operations
|
||||
|
||||
* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.4-2
|
||||
- Build udica on Red Hat Enterprise Linux 7 with python version 2
|
||||
|
||||
* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.4-1
|
||||
- Add manpages
|
||||
- Add support for communicating with libvirt daemon
|
||||
- Add support for communicating with X server.
|
||||
- Add support for read/write to the controlling terminal
|
||||
|
||||
* Sun Oct 07 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.3-1
|
||||
- Remove required parameters -i or -j and added support for reading json file from stdin.
|
||||
- Remove "-n" or "--name" parameter. Name of the container will be required for this tool
|
||||
|
||||
* Tue Sep 25 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.2-1
|
||||
- Use subprocess.Popen instead of subprocess.run for inspecting to support also python2
|
||||
|
||||
* Thu Sep 20 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-3
|
||||
- Update readme and setup.py files after migration to github
|
||||
|
||||
* Sun Sep 16 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-2
|
||||
- Update LICENSE
|
||||
- Improve %%files section
|
||||
|
||||
* Sun Sep 16 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-1
|
||||
- Initial build
|
||||
Loading…
Reference in New Issue