.gitignore

@@ -1,6 +1 @@
-/v0.1.5.tar.gz
+SOURCES/v0.2.1.tar.gz
-/v0.1.6.tar.gz
-/v0.1.8.tar.gz
-/v0.2.0.tar.gz
-/v0.2.1.tar.gz
-/v0.2.5.tar.gz

.udica.metadata

@@ -0,0 +1 @@
+4040bc2746225acabf5c7038d8eb38ae2de30ac2 SOURCES/v0.2.1.tar.gz

0001-Update-templates-to-work-properly-with-new-cil-parse.patch

@@ -1,381 +0,0 @@
-From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Thu, 26 Aug 2021 17:48:45 +0200
-Subject: [PATCH] Update templates to work properly with new cil parser
-
-Cil parser was recently updated to reject the following:
-(block template1 (type t) )
-(block template2 (blockinherit template1))
-(block b (blockinherit template1) (blockinherit template2))
-
-Re-declaration of type t
-Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1
-Failed to copy block contents into blockinherit
-Failed to resolve AST
-semodule:  Failed!
-
-Remove (blockinherit container) from all templates so that "process" and
-"socket" are only defined once (by inheriting "container" block in the
-generated policy).
-All allow rules referencing "process" and "socket" now need to be
-enclosed in an optional block.
-
-While at it, unify indentation.
-
-Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
----
- udica/templates/config_container.cil | 33 ++++++++++---------
- udica/templates/home_container.cil   | 48 +++++++++++++++-------------
- udica/templates/log_container.cil    | 44 +++++++++++++------------
- udica/templates/net_container.cil    | 32 +++++++++----------
- udica/templates/tmp_container.cil    | 18 +++++------
- udica/templates/tty_container.cil    | 13 ++++----
- udica/templates/virt_container.cil   | 20 ++++++------
- udica/templates/x_container.cil      | 30 ++++++++---------
- 8 files changed, 120 insertions(+), 118 deletions(-)
-
-diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil
-index abd2c0e..6014f90 100644
---- a/udica/templates/config_container.cil
-+++ b/udica/templates/config_container.cil
-@@ -1,25 +1,24 @@
- (block config_container
--    (blockinherit container)
--
--    (allow process configfile (dir (ioctl read getattr lock search open)))
--    (allow process configfile (file (ioctl read getattr lock open)))
--    (allow process configfile (lnk_file (read getattr)))
--
-+	(optional config_container_optional
-+		(allow process configfile (dir (ioctl read getattr lock search open)))
-+		(allow process configfile (file (ioctl read getattr lock open)))
-+		(allow process configfile (lnk_file (read getattr)))
-+	)
- )
- 
- (block config_rw_container
--    (blockinherit config_container)
--
--    (allow process configfile (dir (ioctl read write getattr lock append open)))
--    (allow process configfile (file (ioctl read write getattr lock append open)))
--    (allow process configfile (lnk_file (ioctl read write getattr lock append open)))
-+	(blockinherit config_container)
-+	(optional config_rw_container_optional
-+		(allow process configfile (dir (ioctl read write getattr lock append open)))
-+		(allow process configfile (file (ioctl read write getattr lock append open)))
-+		(allow process configfile (lnk_file (ioctl read write getattr lock append open)))
-+	)
- )
- 
- (block config_manage_container
--    (blockinherit container)
--
--    (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
--    (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
--    (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open)))
--
-+	(optional config_manage_container_optional
-+		(allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
-+		(allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
-+		(allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open)))
-+	)
- )
-diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil
-index 2683606..33499bc 100644
---- a/udica/templates/home_container.cil
-+++ b/udica/templates/home_container.cil
-@@ -1,33 +1,37 @@
- (block home_container
--	(blockinherit container)
-+	(optional home_container_optional
-+		(allow process process (capability (dac_override )))
- 
--    (allow process process (capability (dac_override )))
-+		(allow process user_home_dir_t (dir (getattr search open read lock ioctl)))
-+		(allow process home_root_t (dir (getattr search open read lock ioctl)))
-+		(allow process user_home_t (dir (getattr search open read lock ioctl)))
- 
--	(allow process user_home_dir_t (dir (getattr search open read lock ioctl)))
--	(allow process home_root_t (dir (getattr search open read lock ioctl)))
--    (allow process user_home_t (dir (getattr search open read lock ioctl)))
--
--	(allow process user_home_dir_t (file (getattr ioctl lock open read)))
--	(allow process user_home_t (file (getattr ioctl lock open read)))
-+		(allow process user_home_dir_t (file (getattr ioctl lock open read)))
-+		(allow process user_home_t (file (getattr ioctl lock open read)))
-+	)
- )
- 
- 
- (block home_rw_container
--    (blockinherit home_container)
--	(allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
--	(allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
--	(allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
--
--	(allow process user_home_t (file (open getattr read write append ioctl lock)))
--	(allow process user_home_dir_t (file (open getattr read write append ioctl lock)))
-+	(blockinherit home_container)
-+	(optional home_rw_container_optional
-+		(allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
-+		(allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
-+		(allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
-+
-+		(allow process user_home_t (file (open getattr read write append ioctl lock)))
-+		(allow process user_home_dir_t (file (open getattr read write append ioctl lock)))
-+	)
- )
- 
- (block home_manage_container
--    (blockinherit home_rw_container)
--	(allow process user_home_dir_t (dir (create unlink rename rmdir )))
--	(allow process home_root_t (dir (create unlink rename rmdir )))
--	(allow process user_home_t (dir (create unlink rename rmdir )))
--
--	(allow process user_home_t (file (create rename link unlink )))
--	(allow process user_home_dir_t (file (create rename link unlink )))
-+	(blockinherit home_rw_container)
-+	(optional home_manage_container_optional
-+		(allow process user_home_dir_t (dir (create unlink rename rmdir )))
-+		(allow process home_root_t (dir (create unlink rename rmdir )))
-+		(allow process user_home_t (dir (create unlink rename rmdir )))
-+
-+		(allow process user_home_t (file (create rename link unlink )))
-+		(allow process user_home_dir_t (file (create rename link unlink )))
-+	)
- )
-diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil
-index 767c669..a5ecf45 100644
---- a/udica/templates/log_container.cil
-+++ b/udica/templates/log_container.cil
-@@ -1,31 +1,35 @@
- (block log_container
--    (blockinherit container)
--
--    (allow process var_t (dir (getattr search open)))
--    (allow process logfile (dir (ioctl read getattr lock search open)))
--    (allow process logfile (file (ioctl read getattr lock open map)))
--    (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
--    (allow process auditd_log_t (file (ioctl read getattr lock open)))
-+	(optional log_container_optional
-+		(allow process var_t (dir (getattr search open)))
-+		(allow process logfile (dir (ioctl read getattr lock search open)))
-+		(allow process logfile (file (ioctl read getattr lock open map)))
-+		(allow process auditd_log_t (dir (ioctl read getattr lock search open)))
-+		(allow process auditd_log_t (file (ioctl read getattr lock open)))
-+	)
- )
- 
- 
- (block log_rw_container
--    (blockinherit log_container)
-+	(blockinherit log_container)
- 
--    (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open)))
--    (allow process logfile (file (ioctl read write create getattr setattr lock append open)))
--    (allow process logfile (lnk_file (ioctl read write getattr lock append open)))
--    (allow process var_t (dir (getattr search open)))
--    (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
--    (allow process auditd_log_t (file (ioctl read getattr lock open)))
-+	(optional log_rw_container_optional
-+		(allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open)))
-+		(allow process logfile (file (ioctl read write create getattr setattr lock append open)))
-+		(allow process logfile (lnk_file (ioctl read write getattr lock append open)))
-+		(allow process var_t (dir (getattr search open)))
-+		(allow process auditd_log_t (dir (ioctl read getattr lock search open)))
-+		(allow process auditd_log_t (file (ioctl read getattr lock open)))
-+	)
- )
- 
- (block log_manage_container
--    (blockinherit log_rw_container)
-+	(blockinherit log_rw_container)
- 
--    (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
--    (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
--    (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename)))
--    (allow process auditd_log_t (dir (ioctl read write getattr lock search open)))
--    (allow process auditd_log_t (file (ioctl read write getattr lock open)))
-+	(optional log_manage_container_optional
-+		(allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
-+		(allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
-+		(allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename)))
-+		(allow process auditd_log_t (dir (ioctl read write getattr lock search open)))
-+		(allow process auditd_log_t (file (ioctl read write getattr lock open)))
-+	)
- )
-diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil
-index f839ed3..a89d548 100644
---- a/udica/templates/net_container.cil
-+++ b/udica/templates/net_container.cil
-@@ -1,25 +1,25 @@
- (block net_container
--	(blockinherit container)
--	(typeattributeset sandbox_net_domain (process))
-+	(optional net_container_optional
-+		(typeattributeset sandbox_net_domain (process))
-+	)
- )
- 
- (block restricted_net_container
--    (blockinherit container)
-+	(optional restricted_net_container_optional
-+		(allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept)))
-+		(allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
-+		(allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
- 
--    (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept)))
--    (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
--    (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
-+		(allow process proc_t (lnk_file (read)))
- 
--    (allow process proc_t (lnk_file (read)))
-+		(allow process node_t (node (tcp_recv tcp_send recvfrom sendto)))
-+		(allow process node_t (node (udp_recv recvfrom)))
-+		(allow process node_t (node (udp_send sendto)))
- 
--    (allow process node_t (node (tcp_recv tcp_send recvfrom sendto)))
--    (allow process node_t (node (udp_recv recvfrom)))
--    (allow process node_t (node (udp_send sendto)))
-+		(allow process node_t (udp_socket (node_bind)))
-+		(allow process node_t (tcp_socket (node_bind)))
- 
--    (allow process node_t (udp_socket (node_bind)))
--    (allow process node_t (tcp_socket (node_bind)))
--
--    (allow process http_port_t (tcp_socket (name_connect)))
--    (allow process http_port_t (tcp_socket (recv_msg send_msg)))
-+		(allow process http_port_t (tcp_socket (name_connect)))
-+		(allow process http_port_t (tcp_socket (recv_msg send_msg)))
-+	)
- )
--
-diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil
-index 3b3e940..c2a899b 100644
---- a/udica/templates/tmp_container.cil
-+++ b/udica/templates/tmp_container.cil
-@@ -1,15 +1,15 @@
- (block tmp_container
--    (blockinherit container)
--
--    (allow process tmpfile (dir (getattr search open)))
--    (allow process tmpfile (file (ioctl read getattr lock open)))
--
-+	(optional tmp_container_optional
-+		(allow process tmpfile (dir (getattr search open)))
-+		(allow process tmpfile (file (ioctl read getattr lock open)))
-+	)
- )
- 
- (block tmp_rw_container
--    (blockinherit tmp_container)
--
--    (allow process tmpfile (file (ioctl read write getattr lock append open)))
--    (allow process tmpfile (dir (ioctl read write getattr lock append open)))
-+	(blockinherit tmp_container)
- 
-+	(optional tmp_rw_container_optional
-+		(allow process tmpfile (file (ioctl read write getattr lock append open)))
-+		(allow process tmpfile (dir (ioctl read write getattr lock append open)))
-+	)
- )
-diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil
-index 444b5f8..7a5522e 100644
---- a/udica/templates/tty_container.cil
-+++ b/udica/templates/tty_container.cil
-@@ -1,10 +1,9 @@
- (block tty_container
--    (blockinherit container)
-+	(optional tty_container_optional
-+		(allow process device_t (dir (getattr search open)))
-+		(allow process device_t (dir (ioctl read getattr lock search open)))
-+		(allow process device_t (lnk_file (read getattr)))
- 
--    (allow process device_t (dir (getattr search open)))
--    (allow process device_t (dir (ioctl read getattr lock search open)))
--    (allow process device_t (lnk_file (read getattr)))
--
--    (allow process devtty_t (chr_file (ioctl read write getattr lock append open)))
-+		(allow process devtty_t (chr_file (ioctl read write getattr lock append open)))
-+	)
- )
--
-diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil
-index 8ecae54..0728eba 100644
---- a/udica/templates/virt_container.cil
-+++ b/udica/templates/virt_container.cil
-@@ -1,16 +1,14 @@
- (block virt_container
--    (blockinherit container)
-+	(optional virt_container_optional
-+		(allow process var_t (dir (getattr search open)))
-+		(allow process var_t (lnk_file (read getattr)))
- 
--    (allow process var_t (dir (getattr search open)))
--    (allow process var_t (lnk_file (read getattr)))
-+		(allow process var_run_t (dir (getattr search open)))
-+		(allow process var_run_t (lnk_file (read getattr)))
- 
--    (allow process var_run_t (dir (getattr search open)))
--    (allow process var_run_t (lnk_file (read getattr)))
--
--    (allow process virt_var_run_t (dir (getattr search open)))
--    (allow process virt_var_run_t (sock_file (write getattr append open)))
--
--    (allow process virtd_t (unix_stream_socket (connectto)))
-+		(allow process virt_var_run_t (dir (getattr search open)))
-+		(allow process virt_var_run_t (sock_file (write getattr append open)))
- 
-+		(allow process virtd_t (unix_stream_socket (connectto)))
-+	)
- )
--
-diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil
-index ee7441e..0a6ddb9 100644
---- a/udica/templates/x_container.cil
-+++ b/udica/templates/x_container.cil
-@@ -1,27 +1,25 @@
- (block x_container
--    (blockinherit container)
-+	(optional x_container_optional
-+		(allow xserver_t process (shm (getattr read write associate unix_read unix_write lock)))
- 
--    (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock)))
-+		(allow process xserver_t (unix_stream_socket (connectto)))
- 
--    (allow process xserver_t (unix_stream_socket (connectto)))
-+		(allow process device_t (dir (getattr search open)))
- 
--    (allow process device_t (dir (getattr search open)))
-+		(allow process dri_device_t (chr_file (ioctl read write getattr lock append open map)))
- 
--    (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map)))
-+		(allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map)))
- 
--    (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map)))
-+		(allow process urandom_device_t (chr_file (open read)))
- 
--    (allow process urandom_device_t (chr_file (open read)))
-+		(allow process tmpfs_t (dir (getattr search open)))
- 
--    (allow process tmpfs_t (dir (getattr search open)))
-+		(allow process tmp_t (dir (getattr search open)))
-+		(allow process tmp_t (lnk_file (read getattr)))
- 
--    (allow process tmp_t (dir (getattr search open)))
--    (allow process tmp_t (lnk_file (read getattr)))
--
--    (allow process xserver_tmp_t (dir (getattr search open)))
--    (allow process xserver_tmp_t (sock_file (write getattr append open)))
--
--    (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open)))
-+		(allow process xserver_tmp_t (dir (getattr search open)))
-+		(allow process xserver_tmp_t (sock_file (write getattr append open)))
- 
-+		(allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open)))
-+	)
- )
--
--- 
-2.30.2
-

SPECS/udica.spec

@@ -1,9 +1,8 @@
 Summary: A tool for generating SELinux security policies for containers
 Name: udica
-Version: 0.2.5
+Version: 0.2.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
-Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch
 License: GPLv3+
 BuildArch: noarch
 Url: https://github.com/containers/udica
@@ -20,7 +19,7 @@ Tool for generating SELinux security profiles for containers based on
 inspection of container JSON file.
 
 %prep
-%autosetup -p 1
+%setup -q
 
 %build
 %if 0%{?fedora} || 0%{?rhel} > 7
@@ -61,12 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
 %endif
 
 %changelog
-* Thu Aug 26 2021 Vit Mojzis <vmojzis@redhat.com> - 0.2.5-1
+* Tue Nov 26 2019 Jindrich Novy <jnovy@redhat.com> - 0.2.1-2
-- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 (#1995041)
+- initial import to container-tools 8.2.0
-- Replace capability dictionary with str.lower()
+- Related: RHELPLAN-25139
-- Enable udica to generate policies with fifo class
-- Sort container inspect data before processing
-- Update templates to work properly with new cil parser
 
 * Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1
 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0

gating.yaml

@@ -1,9 +0,0 @@
-#recipients: mmalik
---- !Policy
-product_versions:
-  - rhel-8
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
-

sources

@@ -1 +0,0 @@
-SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57

tests/tests.yml

@@ -1,22 +0,0 @@
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  roles:
-  - role: standard-test-source
-
-  - role: standard-test-basic
-    required_packages:
-    - make
-    - python3
-    - udica
-    tests:
-    - build_test:
-        dir: ./source
-        run: make
-    - smoke:
-        dir: ./source
-        run: python3 -m unittest -v tests/test_unit.py
-    - smoke2:
-        dir: ./source
-        run: python3 tests/test_integration.py