Commit Graph

81 Commits

Author SHA1 Message Date
Daniel J Walsh
69181ce9f3 - Latest update from NSA
Fix alias field in module format, caused by boundary format change from
    Caleb Case.
2009-02-18 21:54:40 +00:00
Daniel J Walsh
d9e3ea1a9d - Latest update from NSA
Update checkpolicy for user and role mapping support from Joshua Brindle.
2008-05-28 15:15:49 +00:00
Daniel J Walsh
ce4fbaf6a7 - Latest update from NSA
Add permissive domain support from Eric Paris.
2008-04-14 19:34:07 +00:00
Daniel J Walsh
3181c033e3 - Latest update from NSA
Split out non-grammar parts of policy_parse.yacc into policy_define.c and
    policy_define.h from Todd C. Miller.
Initialize struct policy_file before using it, from Todd C. Miller.
Remove unused define, move variable out of .y file, simplify COND_ERR, from
    Todd C. Miller.
2008-03-14 00:24:03 +00:00
Daniel J Walsh
e22ff16832 - Latest update from NSA
Use yyerror2() where appropriate from Todd C. Miller.
- Build against latest libsepol
2008-02-28 21:57:00 +00:00
Daniel J Walsh
d793dcb07e - Latest update from NSA
Update dispol for libsepol avtab changes from Stephen Smalley.
2008-02-04 17:24:34 +00:00
Daniel J Walsh
1257a8cea9 - Latest update from NSA
Deprecate role dominance in parser.
2008-01-25 16:19:00 +00:00
Daniel J Walsh
4dd1371296 - Update to use libsepol-static library 2008-01-21 21:42:58 +00:00
Daniel J Walsh
5c3895bc13 - Latest update from NSA
Initialize the source file name from the command line argument so that
    checkpolicy/checkmodule report something more useful than "unknown
    source".
Merged remove use of REJECT and trailing context in lex rules; make ipv4
    address parsing like ipv6 from James Carter.
2007-11-15 18:41:43 +00:00
Daniel J Walsh
5d693896f6 Merged handle unknown policydb flag support from Eric Paris. Adds new
command line options -U {allow, reject, deny} for selecting the flag
    when a base module or kernel policy is built.
2007-09-19 00:20:03 +00:00
Daniel J Walsh
4bd6947fff - Latest update from NSA
Merged fix for segfault on duplicate require of sensitivity from Caleb
    Case.
Merged fix for dead URLs in checkpolicy man pages from Dan Walsh.
2007-06-04 19:21:50 +00:00
Daniel J Walsh
7b7e59092d - Latest update from NSA
Merged checkmodule man page fix from Dan Walsh.
2007-04-12 20:05:28 +00:00
Daniel J Walsh
c1870cdf3a - Latest update from NSA
Merged patch to allow dots in class identifiers from Caleb Case.
2007-02-20 14:59:15 +00:00
Daniel J Walsh
1ec43fbb6a - Latest update from NSA
Merged patch to use new libsepol error codes by Karl MacMillan.
Updated version for stable branch.
2007-02-07 21:42:36 +00:00
Daniel J Walsh
c2957dde68 - Latest update from NSA
Collapse user identifiers and identifiers together.
2006-11-14 14:50:36 +00:00
Daniel J Walsh
9e6b63128e - Latest update from NSA
Updated version for release.
2006-11-03 21:45:02 +00:00
Daniel J Walsh
2fc5612c93 - Latest update from NSA
Merged user and range_transition support for modules from Darrel Goeddel
2006-09-29 14:22:59 +00:00
Daniel J Walsh
39e4bfb0e8 - Latest update from NSA
merged range_transition enhancements and user module format changes from
    Darrel Goeddel
Merged symtab datum patch from Karl MacMillan.
2006-09-06 18:16:16 +00:00
Daniel J Walsh
0962a544c8 - Latest upgrade from NSA
Lindent.
Merged patch to remove TE rule conflict checking from the parser from
    Joshua Brindle. This can only be done properly by the expander.
Merged patch to make checkpolicy/checkmodule handling of
    duplicate/conflicting TE rules the same as the expander from Joshua
    Brindle.
Merged optionals in base take 2 patch set from Joshua Brindle.
2006-07-05 10:43:21 +00:00
Daniel J Walsh
0b33b45a9e - Latest upgrade from NSA
Merged compiler cleanup patch from Karl MacMillan.
Merged fix warnings patch from Karl MacMillan.
2006-05-24 03:11:52 +00:00
Daniel J Walsh
a7c8fb25b4 - Latest upgrade from NSA
Changed require_class to reject permissions that have not been declared if
    building a base module.
2006-04-05 17:46:41 +00:00
Daniel J Walsh
cb354e0254 - Latest upgrade from NSA
Fixed checkmodule to call link_modules prior to expand_module to handle
    optionals.
Fixed require_class to avoid shadowing permissions already defined in an
    inherited common definition.
2006-03-28 20:07:42 +00:00
Daniel J Walsh
01a9ba841e - Latest upgrade from NSA
Moved processing of role and user require statements to 2nd pass.
2006-03-23 16:14:03 +00:00
Daniel J Walsh
af7b9d6c00 - Latest upgrade from NSA
Updated version for release.
Fixed bug in role dominance (define_role_dom).
2006-03-17 18:36:26 +00:00
Daniel J Walsh
d0cfe1d1ab - Latest upgrade from NSA
Added a check for failure to declare each sensitivity in a level
    definition.
Changed to clone level data for aliased sensitivities to avoid double free
    upon sens_destroy. Bug reported by Kevin Carr of Tresys Technology.
2006-02-16 18:44:15 +00:00
Daniel J Walsh
6d151699a3 - Latest upgrade from NSA
Merged optionals in base patch from Joshua Brindle.
2006-02-13 19:31:17 +00:00
Daniel J Walsh
7cb707226a - Latest upgrade from NSA
Merged sepol_av_to_string patch from Joshua Brindle.
2006-02-07 15:33:17 +00:00
Daniel J Walsh
6300e4418d - Latest upgrade from NSA 2005-12-09 18:24:24 +00:00
Daniel J Walsh
428c7aa7cd - Latest upgrade from NSA
Merged checkmodule man page from Dan Walsh, and edited it.
2005-12-04 13:13:34 +00:00
Daniel J Walsh
e8c9487983 - Latest upgrade from NSA
Added error checking of all ebitmap_set_bit calls for out of memory
    conditions.
Merged removal of compatibility handling of netlink classes (requirement
    that policies with newer versions include the netlink class
    definitions, remapping of fine-grained netlink classes in newer source
    policies to single netlink class when generating older policies) from
    George Coker.
2005-12-01 20:02:47 +00:00
Daniel J Walsh
f4574040bd - Latest upgrade from NSA
Merged dismod fix from Joshua Brindle.
2005-10-25 19:18:26 +00:00
Daniel J Walsh
af4dd8d071 - Latest upgrade from NSA
Removed obsolete cond_check_type_rules() function and call and
    cond_optimize_lists() call from checkpolicy.c; these are handled during
    parsing and expansion now.
Updated calls to expand_module for interface change.
Changed checkmodule to verify that expand_module succeeds when building
    base modules.
Merged module compiler fixes from Joshua Brindle.
Removed direct calls to hierarchy_check_constraints() and
    check_assertions() from checkpolicy since they are now called
    internally by expand_module().
2005-10-20 20:34:02 +00:00
Daniel J Walsh
acfce4cb75 - Latest upgrade from NSA
Updated for changes to sepol policydb_index_others interface.
2005-10-18 18:27:54 +00:00
Daniel J Walsh
b1c24f328b - Latest upgrade from NSA
Updated for changes to sepol expand_module and link_modules interfaces.
Sat Oct 15 2005 Dan Walsh <dwalsh@redhat.com> 1.27.9-2
- Rebuild to get latest libsepol
2005-10-18 14:17:02 +00:00
Daniel J Walsh
571771b17d - Latest upgrade from NSA
Merged support for require blocks inside conditionals from Joshua Brindle
    (Tresys).
2005-10-14 12:31:36 +00:00
Daniel J Walsh
1b6c428fd8 - Latest upgrade from NSA
Updated for changes to libsepol.
2005-10-10 13:00:20 +00:00
Daniel J Walsh
b8c325caf1 - Latest upgrade from NSA
Merged several bug fixes from Joshua Brindle (Tresys).
2005-10-06 16:08:53 +00:00
Daniel J Walsh
43314203eb - Latest upgrade from NSA
Merged MLS in modules patch from Joshua Brindle (Tresys).
2005-10-04 18:02:36 +00:00
Daniel J Walsh
e21e3bfb9d - Latest upgrade from NSA
Merged error handling improvement in checkmodule from Karl MacMillan
    (Tresys).
2005-09-29 01:18:06 +00:00
Daniel J Walsh
d3c90af390 - Latest upgrade from NSA
Merged bugfix for dup role transition error messages from Karl MacMillan
    (Tresys).
2005-09-27 19:00:56 +00:00
Daniel J Walsh
e34019964c - Latest upgrade from NSA
Fixed parse_categories handling of undefined category.
2005-09-21 14:18:23 +00:00
Daniel J Walsh
ba974b169b - Latest upgrade from NSA
Merged bug fix for role dominance handling from Darrel Goeddel (TCS).
Wed Sep 14 2005 Dan Walsh <dwalsh@redhat.com> 1.26-2
- Rebuild to get latest libsepol
2005-09-17 11:40:23 +00:00
Daniel J Walsh
7ba2db9576 - Latest upgrade from NSA
Updated version for release.
- Rebuild to get latest libsepol
2005-09-12 20:30:47 +00:00
Daniel J Walsh
f28bede7d6 - Update to NSA Release
Fixed handling of validatetrans constraint expressions. Bug reported by Dan
    Walsh for checkpolicy -M.
2005-08-24 15:28:06 +00:00
Daniel J Walsh
b846509581 - Update to NSA Release
Merged use-after-free fix from Serge Hallyn (IBM). Bug found by Coverity.
2005-08-19 19:56:18 +00:00
Daniel J Walsh
cac0f0ba38 - Update to NSA Release
Fixed further memory leaks found by valgrind.
Changed checkpolicy to destroy the policydbs prior to exit to allow leak
    detection.
Fixed several memory leaks found by valgrind.
2005-08-15 20:17:00 +00:00
Daniel J Walsh
6798389672 - Update to NSA Release
The binary policy format version has been incremented to version 20 as a
    result of these changes. To build a policy for a kernel that does not
    yet include these changes, use the -c 19 option to checkpolicy.
Merged patch to prohibit use of "self" as a type name from Jason Tang
    (Tresys).
Merged patch to fix dismod compilation from Joshua Brindle (Tresys).
2005-08-12 02:57:19 +00:00
Daniel J Walsh
2d61bf5dd0 - Update to NSA Release
Fixed call to hierarchy checking code to pass the right policydb.
Merged patch to update dismod for the relocation of the module read/write
    code from libsemanage to libsepol, and to enable build of test
    subdirectory from Jason Tang (Tresys).
2005-08-10 21:05:55 +00:00
Daniel J Walsh
eb71cf87d9 - Update to NSA Release
Merged hierarchy check fix from Joshua Brindle (Tresys).
2005-08-02 16:58:50 +00:00
Daniel J Walsh
dfc85e21d9 - Update to NSA Release
Merged loadable module support from Tresys Technology.
Merged patch to prohibit the use of * and ~ in type sets (other than in
    neverallow statements) and in role sets from Joshua Brindle (Tresys).
Updated version for release.
2005-07-07 11:23:32 +00:00