From 813ea3403a6193f9638558893cc6c9519b9fadb1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 6 Mar 2019 17:25:11 +0100 Subject: [PATCH] SELinux userspace 2.9-rc2 release --- .gitignore | 1 + libselinux-fedora.patch | 261 ++++++---------------------------------- libselinux.spec | 17 ++- sources | 2 +- 4 files changed, 51 insertions(+), 230 deletions(-) diff --git a/.gitignore b/.gitignore index ad9988b..e1883c5 100644 --- a/.gitignore +++ b/.gitignore @@ -210,3 +210,4 @@ libselinux-2.0.96.tgz /libselinux-2.8-rc3.tar.gz /libselinux-2.8.tar.gz /libselinux-2.9-rc1.tar.gz +/libselinux-2.9-rc2.tar.gz diff --git a/libselinux-fedora.patch b/libselinux-fedora.patch index 596704b..c87da41 100644 --- a/libselinux-fedora.patch +++ b/libselinux-fedora.patch @@ -1,7 +1,7 @@ -diff --git libselinux-2.9-rc1/man/man8/selinux.8 libselinux-2.9-rc1/man/man8/selinux.8 +diff --git libselinux-2.9-rc2/man/man8/selinux.8 libselinux-2.9-rc2/man/man8/selinux.8 index e37aee6..bf23b65 100644 ---- libselinux-2.9-rc1/man/man8/selinux.8 -+++ libselinux-2.9-rc1/man/man8/selinux.8 +--- libselinux-2.9-rc2/man/man8/selinux.8 ++++ libselinux-2.9-rc2/man/man8/selinux.8 @@ -91,11 +91,13 @@ This manual page was written by Dan Walsh . .BR sepolicy (8), .BR system-config-selinux (8), @@ -17,10 +17,10 @@ index e37aee6..bf23b65 100644 Every confined service on the system has a man page in the following format: .br -diff --git libselinux-2.9-rc1/src/avc_sidtab.c libselinux-2.9-rc1/src/avc_sidtab.c +diff --git libselinux-2.9-rc2/src/avc_sidtab.c libselinux-2.9-rc2/src/avc_sidtab.c index 9669264..c775430 100644 ---- libselinux-2.9-rc1/src/avc_sidtab.c -+++ libselinux-2.9-rc1/src/avc_sidtab.c +--- libselinux-2.9-rc2/src/avc_sidtab.c ++++ libselinux-2.9-rc2/src/avc_sidtab.c @@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s, int hvalue, rc = 0; struct sidtab_node *cur; @@ -33,22 +33,10 @@ index 9669264..c775430 100644 *sid = NULL; hvalue = sidtab_hash(ctx); -diff --git libselinux-2.9-rc1/src/booleans.c libselinux-2.9-rc1/src/booleans.c -index b3ea362..a6d46fe 100644 ---- libselinux-2.9-rc1/src/booleans.c -+++ libselinux-2.9-rc1/src/booleans.c -@@ -55,6 +55,7 @@ int security_get_boolean_names(char ***names, int *len) - snprintf(path, sizeof path, "%s%s", selinux_mnt, SELINUX_BOOL_DIR); - *len = scandir(path, &namelist, &filename_select, alphasort); - if (*len <= 0) { -+ errno = ENOENT; - return -1; - } - -diff --git libselinux-2.9-rc1/src/canonicalize_context.c libselinux-2.9-rc1/src/canonicalize_context.c +diff --git libselinux-2.9-rc2/src/canonicalize_context.c libselinux-2.9-rc2/src/canonicalize_context.c index ba4c9a2..c815872 100644 ---- libselinux-2.9-rc1/src/canonicalize_context.c -+++ libselinux-2.9-rc1/src/canonicalize_context.c +--- libselinux-2.9-rc2/src/canonicalize_context.c ++++ libselinux-2.9-rc2/src/canonicalize_context.c @@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con, size_t size; int fd, ret; @@ -61,26 +49,10 @@ index ba4c9a2..c815872 100644 if (!selinux_mnt) { errno = ENOENT; return -1; -diff --git libselinux-2.9-rc1/src/checkAccess.c libselinux-2.9-rc1/src/checkAccess.c -index 8de5747..16bfcfb 100644 ---- libselinux-2.9-rc1/src/checkAccess.c -+++ libselinux-2.9-rc1/src/checkAccess.c -@@ -89,8 +89,10 @@ int selinux_check_passwd_access(access_vector_t requested) - int retval; - - passwd_class = string_to_security_class("passwd"); -- if (passwd_class == 0) -+ if (passwd_class == 0) { -+ freecon(user_context); - return 0; -+ } - - retval = security_compute_av_raw(user_context, - user_context, -diff --git libselinux-2.9-rc1/src/check_context.c libselinux-2.9-rc1/src/check_context.c +diff --git libselinux-2.9-rc2/src/check_context.c libselinux-2.9-rc2/src/check_context.c index 8a7997f..5be8434 100644 ---- libselinux-2.9-rc1/src/check_context.c -+++ libselinux-2.9-rc1/src/check_context.c +--- libselinux-2.9-rc2/src/check_context.c ++++ libselinux-2.9-rc2/src/check_context.c @@ -14,6 +14,11 @@ int security_check_context_raw(const char * con) char path[PATH_MAX]; int fd, ret; @@ -93,11 +65,11 @@ index 8a7997f..5be8434 100644 if (!selinux_mnt) { errno = ENOENT; return -1; -diff --git libselinux-2.9-rc1/src/compute_av.c libselinux-2.9-rc1/src/compute_av.c -index 1d05e7b..d9095cc 100644 ---- libselinux-2.9-rc1/src/compute_av.c -+++ libselinux-2.9-rc1/src/compute_av.c -@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon, +diff --git libselinux-2.9-rc2/src/compute_av.c libselinux-2.9-rc2/src/compute_av.c +index a47cffe..6d285a2 100644 +--- libselinux-2.9-rc2/src/compute_av.c ++++ libselinux-2.9-rc2/src/compute_av.c +@@ -27,6 +27,11 @@ int security_compute_av_flags_raw(const char * scon, return -1; } @@ -109,10 +81,10 @@ index 1d05e7b..d9095cc 100644 snprintf(path, sizeof path, "%s/access", selinux_mnt); fd = open(path, O_RDWR | O_CLOEXEC); if (fd < 0) -diff --git libselinux-2.9-rc1/src/compute_create.c libselinux-2.9-rc1/src/compute_create.c +diff --git libselinux-2.9-rc2/src/compute_create.c libselinux-2.9-rc2/src/compute_create.c index 0975aea..3e6a48c 100644 ---- libselinux-2.9-rc1/src/compute_create.c -+++ libselinux-2.9-rc1/src/compute_create.c +--- libselinux-2.9-rc2/src/compute_create.c ++++ libselinux-2.9-rc2/src/compute_create.c @@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon, return -1; } @@ -125,10 +97,10 @@ index 0975aea..3e6a48c 100644 snprintf(path, sizeof path, "%s/create", selinux_mnt); fd = open(path, O_RDWR | O_CLOEXEC); if (fd < 0) -diff --git libselinux-2.9-rc1/src/compute_member.c libselinux-2.9-rc1/src/compute_member.c +diff --git libselinux-2.9-rc2/src/compute_member.c libselinux-2.9-rc2/src/compute_member.c index 4e2d221..d1dd977 100644 ---- libselinux-2.9-rc1/src/compute_member.c -+++ libselinux-2.9-rc1/src/compute_member.c +--- libselinux-2.9-rc2/src/compute_member.c ++++ libselinux-2.9-rc2/src/compute_member.c @@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon, return -1; } @@ -141,10 +113,10 @@ index 4e2d221..d1dd977 100644 snprintf(path, sizeof path, "%s/member", selinux_mnt); fd = open(path, O_RDWR | O_CLOEXEC); if (fd < 0) -diff --git libselinux-2.9-rc1/src/compute_relabel.c libselinux-2.9-rc1/src/compute_relabel.c +diff --git libselinux-2.9-rc2/src/compute_relabel.c libselinux-2.9-rc2/src/compute_relabel.c index 49f77ef..c3db7c0 100644 ---- libselinux-2.9-rc1/src/compute_relabel.c -+++ libselinux-2.9-rc1/src/compute_relabel.c +--- libselinux-2.9-rc2/src/compute_relabel.c ++++ libselinux-2.9-rc2/src/compute_relabel.c @@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon, return -1; } @@ -157,10 +129,10 @@ index 49f77ef..c3db7c0 100644 snprintf(path, sizeof path, "%s/relabel", selinux_mnt); fd = open(path, O_RDWR | O_CLOEXEC); if (fd < 0) -diff --git libselinux-2.9-rc1/src/compute_user.c libselinux-2.9-rc1/src/compute_user.c +diff --git libselinux-2.9-rc2/src/compute_user.c libselinux-2.9-rc2/src/compute_user.c index 7b88121..401fd10 100644 ---- libselinux-2.9-rc1/src/compute_user.c -+++ libselinux-2.9-rc1/src/compute_user.c +--- libselinux-2.9-rc2/src/compute_user.c ++++ libselinux-2.9-rc2/src/compute_user.c @@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon, return -1; } @@ -173,10 +145,10 @@ index 7b88121..401fd10 100644 snprintf(path, sizeof path, "%s/user", selinux_mnt); fd = open(path, O_RDWR | O_CLOEXEC); if (fd < 0) -diff --git libselinux-2.9-rc1/src/fsetfilecon.c libselinux-2.9-rc1/src/fsetfilecon.c +diff --git libselinux-2.9-rc2/src/fsetfilecon.c libselinux-2.9-rc2/src/fsetfilecon.c index 52707d0..0cbe12d 100644 ---- libselinux-2.9-rc1/src/fsetfilecon.c -+++ libselinux-2.9-rc1/src/fsetfilecon.c +--- libselinux-2.9-rc2/src/fsetfilecon.c ++++ libselinux-2.9-rc2/src/fsetfilecon.c @@ -9,8 +9,12 @@ int fsetfilecon_raw(int fd, const char * context) @@ -192,67 +164,10 @@ index 52707d0..0cbe12d 100644 if (rc < 0 && errno == ENOTSUP) { char * ccontext = NULL; int err = errno; -diff --git libselinux-2.9-rc1/src/label_db.c libselinux-2.9-rc1/src/label_db.c -index c46d0a1..fa481e0 100644 ---- libselinux-2.9-rc1/src/label_db.c -+++ libselinux-2.9-rc1/src/label_db.c -@@ -283,10 +283,12 @@ db_init(const struct selinux_opt *opts, unsigned nopts, - } - if (fstat(fileno(filp), &sb) < 0) { - free(catalog); -+ fclose(filp); - return NULL; - } - if (!S_ISREG(sb.st_mode)) { - free(catalog); -+ fclose(filp); - errno = EINVAL; - return NULL; - } -@@ -340,6 +342,7 @@ out_error: - free(spec->lr.ctx_trans); - } - free(catalog); -+ fclose(filp); - - return NULL; - } -diff --git libselinux-2.9-rc1/src/label_file.c libselinux-2.9-rc1/src/label_file.c -index dbf51a9..b81fd55 100644 ---- libselinux-2.9-rc1/src/label_file.c -+++ libselinux-2.9-rc1/src/label_file.c -@@ -317,8 +317,10 @@ end_arch_check: - goto out; - } - rc = next_entry(str_buf, mmap_area, entry_len); -- if (rc < 0) -+ if (rc < 0) { -+ free(str_buf); - goto out; -+ } - - if (str_buf[entry_len - 1] != '\0') { - free(str_buf); -diff --git libselinux-2.9-rc1/src/load_policy.c libselinux-2.9-rc1/src/load_policy.c -index e9f1264..20052be 100644 ---- libselinux-2.9-rc1/src/load_policy.c -+++ libselinux-2.9-rc1/src/load_policy.c -@@ -262,8 +262,10 @@ checkbool: - rc = security_get_boolean_names(&names, &len); - if (!rc) { - values = malloc(sizeof(int) * len); -- if (!values) -+ if (!values) { -+ free(names); - goto unmap; -+ } - for (i = 0; i < len; i++) - values[i] = - security_get_boolean_active(names[i]); -diff --git libselinux-2.9-rc1/src/lsetfilecon.c libselinux-2.9-rc1/src/lsetfilecon.c +diff --git libselinux-2.9-rc2/src/lsetfilecon.c libselinux-2.9-rc2/src/lsetfilecon.c index 1d3b28a..ea6d70b 100644 ---- libselinux-2.9-rc1/src/lsetfilecon.c -+++ libselinux-2.9-rc1/src/lsetfilecon.c +--- libselinux-2.9-rc2/src/lsetfilecon.c ++++ libselinux-2.9-rc2/src/lsetfilecon.c @@ -9,8 +9,13 @@ int lsetfilecon_raw(const char *path, const char * context) @@ -269,97 +184,10 @@ index 1d3b28a..ea6d70b 100644 if (rc < 0 && errno == ENOTSUP) { char * ccontext = NULL; int err = errno; -diff --git libselinux-2.9-rc1/src/selinux_config.c libselinux-2.9-rc1/src/selinux_config.c -index 292728f..b06cb63 100644 ---- libselinux-2.9-rc1/src/selinux_config.c -+++ libselinux-2.9-rc1/src/selinux_config.c -@@ -177,8 +177,7 @@ static void init_selinux_config(void) - - if (!strncasecmp(buf_p, SELINUXTYPETAG, - sizeof(SELINUXTYPETAG) - 1)) { -- selinux_policytype = type = -- strdup(buf_p + sizeof(SELINUXTYPETAG) - 1); -+ type = strdup(buf_p + sizeof(SELINUXTYPETAG) - 1); - if (!type) - return; - end = type + strlen(type) - 1; -@@ -187,6 +186,11 @@ static void init_selinux_config(void) - *end = 0; - end--; - } -+ if (setpolicytype(type) != 0) { -+ free(type); -+ return; -+ } -+ free(type); - continue; - } else if (!strncmp(buf_p, SETLOCALDEFS, - sizeof(SETLOCALDEFS) - 1)) { -@@ -212,13 +216,10 @@ static void init_selinux_config(void) - fclose(fp); - } - -- if (!type) { -- selinux_policytype = type = strdup(SELINUXDEFAULT); -- if (!type) -- return; -- } -+ if (!selinux_policytype && setpolicytype(SELINUXDEFAULT) != 0) -+ return; - -- if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, type) == -1) -+ if (asprintf(&selinux_policyroot, "%s%s", SELINUXDIR, selinux_policytype) == -1) - return; - - for (i = 0; i < NEL; i++) -diff --git libselinux-2.9-rc1/src/selinux_restorecon.c libselinux-2.9-rc1/src/selinux_restorecon.c -index 42a48f5..924d953 100644 ---- libselinux-2.9-rc1/src/selinux_restorecon.c -+++ libselinux-2.9-rc1/src/selinux_restorecon.c -@@ -351,12 +351,19 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch, - new_entry->next = NULL; - - new_entry->directory = strdup(directory); -- if (!new_entry->directory) -+ if (!new_entry->directory) { -+ free(new_entry); -+ free(sha1_buf); - goto oom; -+ } - - new_entry->digest = strdup(sha1_buf); -- if (!new_entry->digest) -+ if (!new_entry->digest) { -+ free(new_entry->directory); -+ free(new_entry); -+ free(sha1_buf); - goto oom; -+ } - - new_entry->result = digest_result; - -@@ -672,8 +679,8 @@ static int restorecon_sb(const char *pathname, const struct stat *sb, - selinux_log(SELINUX_INFO, - "%s not reset as customized by admin to %s\n", - pathname, curcon); -- goto out; - } -+ goto out; - } - - if (!flags->set_specctx && curcon) { -@@ -850,6 +857,7 @@ int selinux_restorecon(const char *pathname_orig, - - if (lstat(pathname, &sb) < 0) { - if (flags.ignore_noent && errno == ENOENT) { -+ free(xattr_value); - free(pathdnamer); - free(pathname); - return 0; -diff --git libselinux-2.9-rc1/src/setfilecon.c libselinux-2.9-rc1/src/setfilecon.c +diff --git libselinux-2.9-rc2/src/setfilecon.c libselinux-2.9-rc2/src/setfilecon.c index d05969c..3f0200e 100644 ---- libselinux-2.9-rc1/src/setfilecon.c -+++ libselinux-2.9-rc1/src/setfilecon.c +--- libselinux-2.9-rc2/src/setfilecon.c ++++ libselinux-2.9-rc2/src/setfilecon.c @@ -9,8 +9,12 @@ int setfilecon_raw(const char *path, const char * context) @@ -375,16 +203,3 @@ index d05969c..3f0200e 100644 if (rc < 0 && errno == ENOTSUP) { char * ccontext = NULL; int err = errno; -diff --git libselinux-2.9-rc1/utils/matchpathcon.c libselinux-2.9-rc1/utils/matchpathcon.c -index 67e4a43..9756d7d 100644 ---- libselinux-2.9-rc1/utils/matchpathcon.c -+++ libselinux-2.9-rc1/utils/matchpathcon.c -@@ -14,7 +14,7 @@ - static __attribute__ ((__noreturn__)) void usage(const char *progname) - { - fprintf(stderr, -- "usage: %s [-N] [-n] [-f file_contexts] [ -P policy_root_path ] [-p prefix] [-Vq] path...\n", -+ "usage: %s [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...\n", - progname); - exit(1); - } diff --git a/libselinux.spec b/libselinux.spec index 84e45f9..a0c81b7 100644 --- a/libselinux.spec +++ b/libselinux.spec @@ -1,20 +1,20 @@ %define ruby_inc %(pkg-config --cflags ruby) -%define libsepolver 2.9-0 +%define libsepolver 2.9-0.rc2 Summary: SELinux library and simple utilities Name: libselinux Version: 2.9 -Release: 0.rc1.1%{?dist}.1 +Release: 0.rc2.1%{?dist} License: Public Domain # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/20190125/libselinux-2.9-rc1.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/20190301/libselinux-2.9-rc2.tar.gz Source1: selinuxconlist.8 Source2: selinuxdefcon.8 Url: https://github.com/SELinuxProject/selinux/wiki # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh # run: -# $ VERSION=2.9-rc1 ./make-fedora-selinux-patch.sh libselinux -# HEAD https://github.com/fedora-selinux/selinux/commit/a69fe203e41c9493e13ffafa51908d17da6fa7a2 +# $ VERSION=2.9-rc2 ./make-fedora-selinux-patch.sh libselinux +# HEAD https://github.com/fedora-selinux/selinux/commit/6bd6bf8f31effadb9ee8bfec701afdf9a7e9ea3b Patch1: libselinux-fedora.patch BuildRequires: gcc BuildRequires: python2 python2-devel ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel @@ -98,7 +98,7 @@ The libselinux-static package contains the static libraries needed for developing SELinux applications. %prep -%autosetup -p 1 -n libselinux-%{version}-rc1 +%autosetup -p 1 -n libselinux-%{version}-rc2 %build export LDFLAGS="%{?__global_ldflags}" @@ -207,6 +207,8 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool* %{_sbindir}/selinux_check_access %{_mandir}/man5/* %{_mandir}/man8/* +%{_mandir}/ru/man5/* +%{_mandir}/ru/man8/* %files devel %{_libdir}/libselinux.so @@ -229,6 +231,9 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool* %{ruby_vendorarchdir}/selinux.so %changelog +* Wed Mar 6 2019 Petr Lautrbach - 2.9-0.rc2.1 +- SELinux userspace 2.9-rc2 release + * Fri Feb 01 2019 Fedora Release Engineering - 2.9-0.rc1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sources b/sources index 18db3bb..c2f6b40 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libselinux-2.9-rc1.tar.gz) = 15c068b7ad2852a3b6db9a5e192981de8f8257ae4e7f8b57c92755e74c0b5b03ad5489505a84d483fda16b879a20839914eb6a2ee563e37f01f6b3a9ac9c596d +SHA512 (libselinux-2.9-rc2.tar.gz) = b216928b090f769639bc888a69af102685247d574d1a2a44527fca1cd04d9396747080b5db87668bb01e2f8426ee74591826be7ee54de2f297e9766bcc417883