rpms
/
libselinux
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SELinux userspace 2.9-rc2 release

This commit is contained in:
Petr Lautrbach 2019-03-06 17:25:11 +01:00
parent 781fbd8e07
commit 813ea3403a
4 changed files with 51 additions and 230 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -210,3 +210,4 @@ libselinux-2.0.96.tgz
/libselinux-2.8-rc3.tar.gz
/libselinux-2.8.tar.gz
/libselinux-2.9-rc1.tar.gz
/libselinux-2.9-rc2.tar.gz

261
libselinux-fedora.patch
View File

@ -1,7 +1,7 @@
diff --git libselinux-2.9-rc1/man/man8/selinux.8 libselinux-2.9-rc1/man/man8/selinux.8
diff --git libselinux-2.9-rc2/man/man8/selinux.8 libselinux-2.9-rc2/man/man8/selinux.8
index e37aee6..bf23b65 100644
--- libselinux-2.9-rc1/man/man8/selinux.8
+++ libselinux-2.9-rc1/man/man8/selinux.8
--- libselinux-2.9-rc2/man/man8/selinux.8
+++ libselinux-2.9-rc2/man/man8/selinux.8
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
.BR sepolicy (8),
.BR system-config-selinux (8),
@ -17,10 +17,10 @@ index e37aee6..bf23b65 100644
Every confined service on the system has a man page in the following format:
.br
diff --git libselinux-2.9-rc1/src/avc_sidtab.c libselinux-2.9-rc1/src/avc_sidtab.c
diff --git libselinux-2.9-rc2/src/avc_sidtab.c libselinux-2.9-rc2/src/avc_sidtab.c
index 9669264..c775430 100644
--- libselinux-2.9-rc1/src/avc_sidtab.c
+++ libselinux-2.9-rc1/src/avc_sidtab.c
--- libselinux-2.9-rc2/src/avc_sidtab.c
+++ libselinux-2.9-rc2/src/avc_sidtab.c
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
int hvalue, rc = 0;
struct sidtab_node *cur;
@ -33,22 +33,10 @@ index 9669264..c775430 100644
*sid = NULL;
hvalue = sidtab_hash(ctx);
diff --git libselinux-2.9-rc1/src/booleans.c libselinux-2.9-rc1/src/booleans.c
index b3ea362..a6d46fe 100644
--- libselinux-2.9-rc1/src/booleans.c
+++ libselinux-2.9-rc1/src/booleans.c
@@ -55,6 +55,7 @@ int security_get_boolean_names(char ***names, int *len)
snprintf(path, sizeof path, "%s%s", selinux_mnt, SELINUX_BOOL_DIR);
*len = scandir(path, &namelist, &filename_select, alphasort);
if (*len <= 0) {
+ errno = ENOENT;
return -1;
}
diff --git libselinux-2.9-rc1/src/canonicalize_context.c libselinux-2.9-rc1/src/canonicalize_context.c
diff --git libselinux-2.9-rc2/src/canonicalize_context.c libselinux-2.9-rc2/src/canonicalize_context.c
index ba4c9a2..c815872 100644
--- libselinux-2.9-rc1/src/canonicalize_context.c
+++ libselinux-2.9-rc1/src/canonicalize_context.c
--- libselinux-2.9-rc2/src/canonicalize_context.c
+++ libselinux-2.9-rc2/src/canonicalize_context.c
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
size_t size;
int fd, ret;
@ -61,26 +49,10 @@ index ba4c9a2..c815872 100644
if (!selinux_mnt) {
errno = ENOENT;
return -1;
diff --git libselinux-2.9-rc1/src/checkAccess.c libselinux-2.9-rc1/src/checkAccess.c
index 8de5747..16bfcfb 100644
--- libselinux-2.9-rc1/src/checkAccess.c
+++ libselinux-2.9-rc1/src/checkAccess.c
@@ -89,8 +89,10 @@ int selinux_check_passwd_access(access_vector_t requested)
int retval;
passwd_class = string_to_security_class("passwd");
- if (passwd_class == 0)
+ if (passwd_class == 0) {
+ freecon(user_context);
return 0;
+ }
retval = security_compute_av_raw(user_context,
user_context,
diff --git libselinux-2.9-rc1/src/check_context.c libselinux-2.9-rc1/src/check_context.c
diff --git libselinux-2.9-rc2/src/check_context.c libselinux-2.9-rc2/src/check_context.c
index 8a7997f..5be8434 100644
--- libselinux-2.9-rc1/src/check_context.c
+++ libselinux-2.9-rc1/src/check_context.c
--- libselinux-2.9-rc2/src/check_context.c
+++ libselinux-2.9-rc2/src/check_context.c
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
char path[PATH_MAX];
int fd, ret;
@ -93,11 +65,11 @@ index 8a7997f..5be8434 100644
if (!selinux_mnt) {
errno = ENOENT;
return -1;
diff --git libselinux-2.9-rc1/src/compute_av.c libselinux-2.9-rc1/src/compute_av.c
index 1d05e7b..d9095cc 100644
--- libselinux-2.9-rc1/src/compute_av.c
+++ libselinux-2.9-rc1/src/compute_av.c
@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon,
diff --git libselinux-2.9-rc2/src/compute_av.c libselinux-2.9-rc2/src/compute_av.c
index a47cffe..6d285a2 100644
--- libselinux-2.9-rc2/src/compute_av.c
+++ libselinux-2.9-rc2/src/compute_av.c
@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon,
return -1;
}
@ -109,10 +81,10 @@ index 1d05e7b..d9095cc 100644
snprintf(path, sizeof path, "%s/access", selinux_mnt);
fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0)
diff --git libselinux-2.9-rc1/src/compute_create.c libselinux-2.9-rc1/src/compute_create.c
diff --git libselinux-2.9-rc2/src/compute_create.c libselinux-2.9-rc2/src/compute_create.c
index 0975aea..3e6a48c 100644
--- libselinux-2.9-rc1/src/compute_create.c
+++ libselinux-2.9-rc1/src/compute_create.c
--- libselinux-2.9-rc2/src/compute_create.c
+++ libselinux-2.9-rc2/src/compute_create.c
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
return -1;
}
@ -125,10 +97,10 @@ index 0975aea..3e6a48c 100644
snprintf(path, sizeof path, "%s/create", selinux_mnt);
fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0)
diff --git libselinux-2.9-rc1/src/compute_member.c libselinux-2.9-rc1/src/compute_member.c
diff --git libselinux-2.9-rc2/src/compute_member.c libselinux-2.9-rc2/src/compute_member.c
index 4e2d221..d1dd977 100644
--- libselinux-2.9-rc1/src/compute_member.c
+++ libselinux-2.9-rc1/src/compute_member.c
--- libselinux-2.9-rc2/src/compute_member.c
+++ libselinux-2.9-rc2/src/compute_member.c
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
return -1;
}
@ -141,10 +113,10 @@ index 4e2d221..d1dd977 100644
snprintf(path, sizeof path, "%s/member", selinux_mnt);
fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0)
diff --git libselinux-2.9-rc1/src/compute_relabel.c libselinux-2.9-rc1/src/compute_relabel.c
diff --git libselinux-2.9-rc2/src/compute_relabel.c libselinux-2.9-rc2/src/compute_relabel.c
index 49f77ef..c3db7c0 100644
--- libselinux-2.9-rc1/src/compute_relabel.c
+++ libselinux-2.9-rc1/src/compute_relabel.c
--- libselinux-2.9-rc2/src/compute_relabel.c
+++ libselinux-2.9-rc2/src/compute_relabel.c
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
return -1;
}
@ -157,10 +129,10 @@ index 49f77ef..c3db7c0 100644
snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0)
diff --git libselinux-2.9-rc1/src/compute_user.c libselinux-2.9-rc1/src/compute_user.c
diff --git libselinux-2.9-rc2/src/compute_user.c libselinux-2.9-rc2/src/compute_user.c
index 7b88121..401fd10 100644
--- libselinux-2.9-rc1/src/compute_user.c
+++ libselinux-2.9-rc1/src/compute_user.c
--- libselinux-2.9-rc2/src/compute_user.c
+++ libselinux-2.9-rc2/src/compute_user.c
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
return -1;
}
@ -173,10 +145,10 @@ index 7b88121..401fd10 100644
snprintf(path, sizeof path, "%s/user", selinux_mnt);
fd = open(path, O_RDWR | O_CLOEXEC);
if (fd < 0)
diff --git libselinux-2.9-rc1/src/fsetfilecon.c libselinux-2.9-rc1/src/fsetfilecon.c
diff --git libselinux-2.9-rc2/src/fsetfilecon.c libselinux-2.9-rc2/src/fsetfilecon.c
index 52707d0..0cbe12d 100644
--- libselinux-2.9-rc1/src/fsetfilecon.c
+++ libselinux-2.9-rc1/src/fsetfilecon.c
--- libselinux-2.9-rc2/src/fsetfilecon.c
+++ libselinux-2.9-rc2/src/fsetfilecon.c
@@ -9,8 +9,12 @@
int fsetfilecon_raw(int fd, const char * context)
@ -192,67 +164,10 @@ index 52707d0..0cbe12d 100644
if (rc < 0 && errno == ENOTSUP) {
char * ccontext = NULL;
int err = errno;
diff --git libselinux-2.9-rc1/src/label_db.c libselinux-2.9-rc1/src/label_db.c
index c46d0a1..fa481e0 100644
--- libselinux-2.9-rc1/src/label_db.c
+++ libselinux-2.9-rc1/src/label_db.c
@@ -283,10 +283,12 @@ db_init(const struct selinux_opt *opts, unsigned nopts,
}
if (fstat(fileno(filp), &sb) < 0) {
free(catalog);
+ fclose(filp);
return NULL;
}
if (!S_ISREG(sb.st_mode)) {
free(catalog);
+ fclose(filp);
errno = EINVAL;
return NULL;
}
@@ -340,6 +342,7 @@ out_error:
free(spec->lr.ctx_trans);
}
free(catalog);
+ fclose(filp);
return NULL;
}
diff --git libselinux-2.9-rc1/src/label_file.c libselinux-2.9-rc1/src/label_file.c
index dbf51a9..b81fd55 100644
--- libselinux-2.9-rc1/src/label_file.c
+++ libselinux-2.9-rc1/src/label_file.c
@@ -317,8 +317,10 @@ end_arch_check:
goto out;
}
rc = next_entry(str_buf, mmap_area, entry_len);
- if (rc < 0)
+ if (rc < 0) {
+ free(str_buf);
goto out;
+ }
if (str_buf[entry_len - 1] != '\0') {
free(str_buf);
diff --git libselinux-2.9-rc1/src/load_policy.c libselinux-2.9-rc1/src/load_policy.c
index e9f1264..20052be 100644
--- libselinux-2.9-rc1/src/load_policy.c
+++ libselinux-2.9-rc1/src/load_policy.c
@@ -262,8 +262,10 @@ checkbool:
rc = security_get_boolean_names(&names, &len);
if (!rc) {
values = malloc(sizeof(int) * len);
- if (!values)
+ if (!values) {
+ free(names);
goto unmap;
+ }
for (i = 0; i < len; i++)
values[i] =
security_get_boolean_active(names[i]);
diff --git libselinux-2.9-rc1/src/lsetfilecon.c libselinux-2.9-rc1/src/lsetfilecon.c
diff --git libselinux-2.9-rc2/src/lsetfilecon.c libselinux-2.9-rc2/src/lsetfilecon.c
index 1d3b28a..ea6d70b 100644
--- libselinux-2.9-rc1/src/lsetfilecon.c
+++ libselinux-2.9-rc1/src/lsetfilecon.c
--- libselinux-2.9-rc2/src/lsetfilecon.c
+++ libselinux-2.9-rc2/src/lsetfilecon.c
@@ -9,8 +9,13 @@
int lsetfilecon_raw(const char *path, const char * context)
@ -269,97 +184,10 @@ index 1d3b28a..ea6d70b 100644
if (rc < 0 && errno == ENOTSUP) {
char * ccontext = NULL;
int err = errno;
diff --git libselinux-2.9-rc1/src/selinux_config.c libselinux-2.9-rc1/src/selinux_config.c
index 292728f..b06cb63 100644
--- libselinux-2.9-rc1/src/selinux_config.c
+++ libselinux-2.9-rc1/src/selinux_config.c
@@ -177,8 +177,7 @@ static void init_selinux_config(void)
if (!strncasecmp(buf_p, SELINUXTYPETAG,
sizeof(SELINUXTYPETAG) - 1)) {
- selinux_policytype = type =
- strdup(buf_p + sizeof(SELINUXTYPETAG) - 1);
+ type = strdup(buf_p + sizeof(SELINUXTYPETAG) - 1);
if (!type)
return;
end = type + strlen(type) - 1;
@@ -187,6 +186,11 @@ static void init_selinux_config(void)
*end = 0;
end--;
}
+ if (setpolicytype(type) != 0) {
+ free(type);
+ return;
+ }
+ free(type);
continue;
} else if (!strncmp(buf_p, SETLOCALDEFS,
sizeof(SETLOCALDEFS) - 1)) {
@@ -212,13 +216,10 @@ static void init_selinux_config(void)
fclose(fp);
}
- if (!type) {
- selinux_policytype = type = strdup(SELINUXDEFAULT);
- if (!type)
- return;
- }
+ if (!selinux_policytype && setpolicytype(SELINUXDEFAULT) != 0)
+ return;
- if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, type) == -1)
+ if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, selinux_policytype) == -1)
return;
for (i = 0; i < NEL; i++)
diff --git libselinux-2.9-rc1/src/selinux_restorecon.c libselinux-2.9-rc1/src/selinux_restorecon.c
index 42a48f5..924d953 100644
--- libselinux-2.9-rc1/src/selinux_restorecon.c
+++ libselinux-2.9-rc1/src/selinux_restorecon.c
@@ -351,12 +351,19 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
new_entry->next = NULL;
new_entry->directory = strdup(directory);
- if (!new_entry->directory)
+ if (!new_entry->directory) {
+ free(new_entry);
+ free(sha1_buf);
goto oom;
+ }
new_entry->digest = strdup(sha1_buf);
- if (!new_entry->digest)
+ if (!new_entry->digest) {
+ free(new_entry->directory);
+ free(new_entry);
+ free(sha1_buf);
goto oom;
+ }
new_entry->result = digest_result;
@@ -672,8 +679,8 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
selinux_log(SELINUX_INFO,
"%s not reset as customized by admin to %s\n",
pathname, curcon);
- goto out;
}
+ goto out;
}
if (!flags->set_specctx && curcon) {
@@ -850,6 +857,7 @@ int selinux_restorecon(const char *pathname_orig,
if (lstat(pathname, &sb) < 0) {
if (flags.ignore_noent && errno == ENOENT) {
+ free(xattr_value);
free(pathdnamer);
free(pathname);
return 0;
diff --git libselinux-2.9-rc1/src/setfilecon.c libselinux-2.9-rc1/src/setfilecon.c
diff --git libselinux-2.9-rc2/src/setfilecon.c libselinux-2.9-rc2/src/setfilecon.c
index d05969c..3f0200e 100644
--- libselinux-2.9-rc1/src/setfilecon.c
+++ libselinux-2.9-rc1/src/setfilecon.c
--- libselinux-2.9-rc2/src/setfilecon.c
+++ libselinux-2.9-rc2/src/setfilecon.c
@@ -9,8 +9,12 @@
int setfilecon_raw(const char *path, const char * context)
@ -375,16 +203,3 @@ index d05969c..3f0200e 100644
if (rc < 0 && errno == ENOTSUP) {
char * ccontext = NULL;
int err = errno;
diff --git libselinux-2.9-rc1/utils/matchpathcon.c libselinux-2.9-rc1/utils/matchpathcon.c
index 67e4a43..9756d7d 100644
--- libselinux-2.9-rc1/utils/matchpathcon.c
+++ libselinux-2.9-rc1/utils/matchpathcon.c
@@ -14,7 +14,7 @@
static __attribute__ ((__noreturn__)) void usage(const char *progname)
{
fprintf(stderr,
- "usage: %s [-N] [-n] [-f file_contexts] [ -P policy_root_path ] [-p prefix] [-Vq] path...\n",
+ "usage: %s [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...\n",
progname);
exit(1);
}

17
libselinux.spec
View File

@ -1,20 +1,20 @@
%define ruby_inc %(pkg-config --cflags ruby)
%define libsepolver 2.9-0
%define libsepolver 2.9-0.rc2
Summary: SELinux library and simple utilities
Name: libselinux
Version: 2.9
Release: 0.rc1.1%{?dist}.1
Release: 0.rc2.1%{?dist}
License: Public Domain
# https://github.com/SELinuxProject/selinux/wiki/Releases
Source0: https://github.com/SELinuxProject/selinux/releases/download/20190125/libselinux-2.9-rc1.tar.gz
Source0: https://github.com/SELinuxProject/selinux/releases/download/20190301/libselinux-2.9-rc2.tar.gz
Source1: selinuxconlist.8
Source2: selinuxdefcon.8
Url: https://github.com/SELinuxProject/selinux/wiki
# download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh
# run:
# $ VERSION=2.9-rc1 ./make-fedora-selinux-patch.sh libselinux
# HEAD https://github.com/fedora-selinux/selinux/commit/a69fe203e41c9493e13ffafa51908d17da6fa7a2
# $ VERSION=2.9-rc2 ./make-fedora-selinux-patch.sh libselinux
# HEAD https://github.com/fedora-selinux/selinux/commit/6bd6bf8f31effadb9ee8bfec701afdf9a7e9ea3b
Patch1: libselinux-fedora.patch
BuildRequires: gcc
BuildRequires: python2 python2-devel ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel
@ -98,7 +98,7 @@ The libselinux-static package contains the static libraries
needed for developing SELinux applications.
%prep
%autosetup -p 1 -n libselinux-%{version}-rc1
%autosetup -p 1 -n libselinux-%{version}-rc2
%build
export LDFLAGS="%{?__global_ldflags}"
@ -207,6 +207,8 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
%{_sbindir}/selinux_check_access
%{_mandir}/man5/*
%{_mandir}/man8/*
%{_mandir}/ru/man5/*
%{_mandir}/ru/man8/*
%files devel
%{_libdir}/libselinux.so
@ -229,6 +231,9 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
%{ruby_vendorarchdir}/selinux.so
%changelog
* Wed Mar 6 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-0.rc2.1
- SELinux userspace 2.9-rc2 release
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9-0.rc1.1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

2
sources
View File

@ -1 +1 @@
SHA512 (libselinux-2.9-rc1.tar.gz) = 15c068b7ad2852a3b6db9a5e192981de8f8257ae4e7f8b57c92755e74c0b5b03ad5489505a84d483fda16b879a20839914eb6a2ee563e37f01f6b3a9ac9c596d
SHA512 (libselinux-2.9-rc2.tar.gz) = b216928b090f769639bc888a69af102685247d574d1a2a44527fca1cd04d9396747080b5db87668bb01e2f8426ee74591826be7ee54de2f297e9766bcc417883