RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/udica#e23d97dbf9a4ec25fcbb29217dbf54ba68c4738c

.gitignore

@@ -0,0 +1,13 @@
+/v0.1.1.tar.gz
+/v0.1.2.tar.gz
+/v0.1.3.tar.gz
+/v0.1.4.tar.gz
+/v0.1.5.tar.gz
+/v0.1.6.tar.gz
+/v0.1.7.tar.gz
+/v0.1.8.tar.gz
+/v0.1.9.tar.gz
+/v0.2.0.tar.gz
+/v0.2.1.tar.gz
+/v0.2.2.tar.gz
+/v0.2.3.tar.gz

README.md

@@ -0,0 +1,3 @@
+# udica
+
+The udica package

sources

@@ -0,0 +1 @@
+SHA512 (v0.2.3.tar.gz) = 78e6bae5a26e50ddc01a251802a02d6c48d8a87a8a1c343f9b40d0b2fdafbe435d62e6c1b6fb7c1365f536fac02f01d9057b2ffdaef27a9f91f3b245840754fb

tests/docker/runtest.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Compare udica output between podman and docker
+#   Author: Jan Zarsky <jzarsky@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="udica"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "udica"
+        rlAssertRpm "policycoreutils"
+        rlAssertRpm "podman"
+        rlAssertRpm "docker"
+        rlRun "rlServiceStart docker"
+        OUTPUT_FILE=$(mktemp)
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        for BACKEND in podman docker ; do
+            rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+            rlRun "$BACKEND ps | grep test"
+            CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1)
+            rlRun "udica -i $CONT_ID my_container"
+            rlRun "mv my_container.cil my_cont_$BACKEND.cil"
+            rlRun "$BACKEND stop test"
+            rlRun "$BACKEND rm test"
+        done
+
+        rlRun "sed -i '/capability/d' my_cont_podman.cil"
+        rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil"
+
+        rlRun "rm my_cont_podman.cil my_cont_docker.cil"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $OUTPUT_FILE"
+        rlRun "rlServiceRestore docker"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/sanity/runtest.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Description: Test basic functionality of udica
+#   Author: Jan Zarsky <jzarsky@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="udica"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm "udica"
+        rlAssertRpm "policycoreutils"
+        rlAssertRpm "podman"
+        OUTPUT_FILE=$(mktemp)
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "udica --help"
+        rlRun "PAGER=cat man udica"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test basic scenario"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+        rlRun "ps -efZ | grep bash"
+        rlRun "ps -efZ | grep bash | grep container_t"
+
+        rlRun "podman exec test ls /home" 1,2
+        rlRun "podman exec test touch /var/spool/test" 1
+        rlRun "podman exec test dnf install nmap-ncat -y" 0
+        rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE"
+        rlRun "podman stop test"
+        rlRun "podman rm --force test"
+
+        rlRun "cat $OUTPUT_FILE"
+        rlAssertExists "my_container.cil"
+        SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2)
+        rlRun "$SEMODULE"
+
+        PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2)
+        rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test2"
+        rlRun "ps -efZ | grep bash"
+        rlRun "ps -efZ | grep bash | grep my_container.process"
+
+        rlRun "podman exec test2 ls /home" 0
+        rlRun "podman exec test2 touch /var/spool/test" 0
+        rlRun "podman exec test2 dnf install nmap-ncat -y" 0
+        rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3
+
+        rlRun "podman stop test2"
+        rlRun "podman rm --force test2"
+
+        rlRun "semodule -r my_container base_container net_container home_container"
+        rlRun "rm my_container.cil"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Compare different ways of obtaining policy"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica my_container >pipe.result"
+
+        rlRun "podman inspect $CONT_ID >container.json"
+        rlRun "udica -j container.json my_container >json.result"
+
+        rlRun "udica -i $CONT_ID my_container >id.result"
+
+        rlRun "diff pipe.result json.result"
+        rlRun "diff pipe.result id.result"
+
+        rlRun "rm -f pipe.result json.result id.result container.json"
+        rlRun "podman stop test"
+        rlRun "podman rm test"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test loading modules"
+        rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora"
+        rlRun "podman ps | grep test"
+
+        CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1)
+        rlRun "podman inspect $CONT_ID | udica -l my_container"
+
+        rlRun "podman stop test"
+        rlRun "podman rm test"
+
+        rlRun "semodule -l >$OUTPUT_FILE"
+        rlAssertGrep "my_container" $OUTPUT_FILE
+        rlAssertGrep "base_container" $OUTPUT_FILE
+        rlAssertGrep "net_container" $OUTPUT_FILE
+        rlAssertGrep "home_container" $OUTPUT_FILE
+
+        rlRun "semodule -r my_container base_container net_container home_container"
+        rlRun "rm my_container.cil"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $OUTPUT_FILE"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/tests.yml

@@ -0,0 +1,25 @@
+- hosts: localhost
+  tags:
+  - classic
+  - container
+  roles:
+  - role: standard-test-source
+
+  - role: standard-test-basic
+    required_packages:
+    - python3
+    tests:
+    - smoke:
+        dir: ./source
+        run: python3 -m unittest -v tests/test_unit.py
+    - smoke2:
+        dir: ./source
+        run: python3 tests/test_integration.py
+
+  - role: standard-test-beakerlib
+    tags:
+        - classic
+    tests:
+        - sanity
+    required_packages:
+        - podman

udica.spec

@@ -0,0 +1,177 @@
+Summary: A tool for generating SELinux security policies for containers
+Name: udica
+Version: 0.2.3
+Release: 1%{?dist}
+Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
+License: GPLv3+
+BuildArch: noarch
+Url: https://github.com/containers/udica
+%if 0%{?fedora} || 0%{?rhel} > 7
+BuildRequires: python3 python3-devel python3-setuptools
+Requires: python3 python3-libsemanage python3-libselinux
+%else
+BuildRequires: python2 python2-devel python2-setuptools
+Requires: python2 libsemanage-python libselinux-python
+%endif
+
+%description
+Tool for generating SELinux security profiles for containers based on
+inspection of container JSON file.
+
+%prep
+%autosetup -p 1
+
+%build
+%if 0%{?fedora} || 0%{?rhel} > 7
+%{__python3} setup.py build
+%else
+%{__python2} setup.py build
+%endif
+
+%install
+install --directory %%{buildroot}%{_datadir}/udica/templates
+
+%if 0%{?fedora} || 0%{?rhel} > 7
+%{__python3} setup.py install --single-version-externally-managed --root=%{buildroot}
+%else
+%{__python2} setup.py install --single-version-externally-managed --root=%{buildroot}
+%endif
+
+install --directory %{buildroot}%{_mandir}/man8
+install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
+
+%files
+%{_mandir}/man8/udica.8*
+%{_bindir}/udica
+%dir %{_datadir}/udica
+%dir %{_datadir}/udica/ansible
+%dir %{_datadir}/udica/templates
+%{_datadir}/udica/ansible/*
+%{_datadir}/udica/templates/*
+
+%if 0%{?fedora} || 0%{?rhel} > 7
+%license LICENSE
+%{python3_sitelib}/udica/
+%{python3_sitelib}/udica-*.egg-info
+%else
+%{_datarootdir}/licenses/udica/LICENSE
+%{python2_sitelib}/udica/
+%{python2_sitelib}/udica-*.egg-info
+%endif
+
+%changelog
+* Thu Aug 13 2020 Lukas Vrabec <lvrabec@redhat.com> - 0.2.3-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.3
+
+* Mon Aug 03 2020 Lukas Vrabec <lvrabec@redhat.com> - 0.2.2-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.2
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.2.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 0.2.1-3
+- Rebuilt for Python 3.9
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.2.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.1
+
+* Wed Sep 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.0-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.2.0
+
+* Wed Aug 28 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.9-1
+- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2
+- New rebase https://github.com/containers/udica/releases/tag/v0.1.9
+
+* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 0.1.8-3
+- Rebuilt for Python 3.8
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jul 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.8-1
+- New rebase https://github.com/containers/udica/releases/tag/v0.1.8
+
+* Wed Jun 12 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.7-1
+- New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7
+
+* Thu May 16 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.6-1
+- New rebase with upstream adding new tests
+
+* Tue Apr 30 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-2
+- Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules.
+* Fri Apr 19 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-1
+- Create mock selinux and semanage module
+- Update testing section in README
+- Add travis file for Travis CI
+- Grammar fixes in the udica.8 manpage file
+- Support port ranges (Resolves: #16)
+- Test port ranges
+
+* Mon Mar 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.4-1
+- Fix minor problems reported by pylint #11
+- Catch FileNotFoundError when inspecting containers #12
+- Create basic tests #13
+- Restore working directory #14
+- udica cannot use the container ID once it is provided #10
+
+* Mon Feb 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-4
+- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8
+- Add check if runtimes are installed on the system
+
+* Sun Feb 17 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-3
+- Improve capability parsing for docker containers
+- Update small changes in manpage, like issue with mandatory option '-c' for docker containers
+- Fix parsing Mountpoints in docker inspect JSON file
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Jan 23 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-1
+- Fix capability allow rules when capabilities are specified in JSON file
+- Add additional SELinux allow rules to base container template to allow container to read proc_type types.
+
+* Fri Jan 04 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.2-1
+- Fix invalid syntax output when policy is using just one template
+Resolves: #6
+
+* Tue Oct 23 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.1-2
+- Fix small issues in spec file like improve description and change files section.
+
+* Mon Oct 22 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.1-1
+- Add proper shebang to all source files
+- Add License to all source files
+
+* Sat Oct 13 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.1.0-1
+- Add support for docker containers
+
+* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.5-1
+- Update x_container template based on testing container related to Nvidia Cuda operations
+
+* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.4-2
+- Build udica on Red Hat Enterprise Linux 7 with python version 2
+
+* Mon Oct 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.4-1
+- Add manpages
+- Add support for communicating with libvirt daemon
+- Add support for communicating with X server.
+- Add support for read/write to the controlling terminal
+
+* Sun Oct 07 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.3-1
+- Remove required parameters -i or -j and added support for reading json file from stdin.
+- Remove "-n" or "--name" parameter. Name of the container will be required for this tool
+
+* Tue Sep 25 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.2-1
+- Use subprocess.Popen instead of subprocess.run for inspecting to support also python2
+
+* Thu Sep 20 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-3
+- Update readme and setup.py files after migration to github
+
+* Sun Sep 16 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-2
+- Update LICENSE
+- Improve %%files section
+
+* Sun Sep 16 2018 Lukas Vrabec <lvrabec@redhat.com> - 0.0.1-1
+- Initial build