Commit Graph

164 Commits

Author SHA1 Message Date
Daniel J Walsh
e60c844fba - Upgrade to latest from NSA
Added selinux_getpolicytype() function.
Modified setrans code to skip processing if !mls_enabled.
Set errno in the !selinux_mnt case.
Allocate large buffers from the heap, not on stack. Affects
    is_context_customizable, selinux_init_load_policy, and
    selinux_getenforcemode.
2006-06-16 19:16:03 +00:00
Daniel J Walsh
af1839bde5 - Upgrade to latest from NSA
Merged !selinux_mnt checks from Ian Kent.
2006-06-05 18:52:19 +00:00
Daniel J Walsh
9cf72ebb65 Merged matchmediacon and trans_to_raw_context fixes from Serge Hallyn. 2006-05-31 10:36:45 +00:00
Daniel J Walsh
c2de2ffa71 - Upgrade to latest from NSA
Merged simple setrans client cache from Dan Walsh. Merged avcstat patch
    from Russell Coker.
Modified selinux_mkload_policy() to also set /selinux/compat_net
    appropriately for the loaded policy.
2006-05-23 10:39:18 +00:00
Daniel J Walsh
8f927c4a9f - More fixes for translation cache
- Upgrade to latest from NSA
Added matchpathcon_fini() function to free memory allocated by
    matchpathcon_init().
2006-05-18 16:15:35 +00:00
Daniel J Walsh
b71bf0b207 - Upgrade to latest from NSA
Merged setrans client cleanup patch from Steve Grubb.
2006-05-17 00:49:24 +00:00
Daniel J Walsh
20222fb072 - Upgrade to latest from NSA
Merged getfscreatecon man page fix from Dan Walsh.
Updated booleans(8) man page to drop references to the old booleans file
    and to note that setsebool can be used to set the boot-time defaults
    via -P.
2006-05-08 15:04:16 +00:00
Daniel J Walsh
98a597a060 Merged fix warnings patch from Karl MacMillan.
Merged setrans client support from Dan Walsh. This removes use of
    libsetrans.
Merged patch to eliminate use of PAGE_SIZE constant from Dan Walsh.
Merged swig typemap fixes from Glauber de Oliveira Costa.
2006-05-08 14:08:21 +00:00
Daniel J Walsh
ea8c625b8c - Upgrade to latest from NSA
Added distclean target to Makefile.
Regenerated swig files.
Changed matchpathcon_init to verify that the spec file is a regular file.
Merged python binding t_output_helper removal patch from Dan Walsh.
2006-04-14 11:31:14 +00:00
Daniel J Walsh
c8030dcf96 Merged Makefile PYLIBVER definition patch from Dan Walsh. 2006-04-11 18:25:46 +00:00
Daniel J Walsh
d27dc97404 - Make some fixes so it will build on RHEL4
- Upgrade to latest from NSA
Updated version for release.
Altered rpm_execcon fallback logic for permissive mode to also handle case
    where /selinux/enforce is not available.
2006-03-17 17:20:57 +00:00
Daniel J Walsh
6a494f5394 - Upgrade to latest from NSA
Merged install-pywrap Makefile patch from Joshua Brindle.
2006-01-20 16:17:43 +00:00
Daniel J Walsh
9ecb57d018 - Upgrade to latest from NSA
Merged pywrap Makefile patch from Dan Walsh.
2006-01-18 16:16:30 +00:00
Daniel J Walsh
ee0a60b0f5 - Upgrade to latest from NSA
Added getseuser test program.
2006-01-13 22:14:28 +00:00
Daniel J Walsh
9ad8aa5f09 - Upgrade to latest from NSA
Added format attribute to myprintf in matchpathcon.c and removed obsoleted
    rootlen variable in init_selinux_config().
2006-01-06 15:47:03 +00:00
Daniel J Walsh
dab5a2cb5a - Upgrade to latest from NSA
- corrected use of getline
- further calls to __fsetlocking for local files
- use of strdupa and asprintf
- proper handling of dirent in booleans code
- use of -z relro
- several other optimizations
Merged getpidcon python wrapper from Dan Walsh (Red Hat).
2006-01-04 15:40:59 +00:00
Daniel J Walsh
0b65dc6081 - Upgrade to latest from NSA
Merged call to finish_context_translations from Dan Walsh. This eliminates
    a memory leak from failing to release memory allocated by libsetrans.
2005-12-14 19:22:10 +00:00
Daniel J Walsh
2774b7d0d8 - Update to never version
Merged patch for swig interfaces from Dan Walsh.
2005-12-08 18:04:22 +00:00
Daniel J Walsh
710322bbd4 - Update to never version 2005-12-08 04:35:07 +00:00
Daniel J Walsh
38b50da3f8 - Update to latest from NSA
Added MATCHPATHCON_VALIDATE flag for set_matchpathcon_flags() and modified
    matchpathcon implementation to make context validation/
    canonicalization optional at matchpathcon_init time, deferring it to a
    successful matchpathcon by default unless the new flag is set by the
    caller.
Added matchpathcon_init_prefix() interface, and reworked matchpathcon
    implementation to support selective loading of file contexts entries
    based on prefix matching between the pathname regex stems and the
    specified path prefix (stem must be a prefix of the specified path
    prefix).
2005-12-01 19:20:49 +00:00
Daniel J Walsh
827fc8369b - Update to latest from NSA
Change getsebool to return on/off instead of active/inactive
2005-11-30 20:10:18 +00:00
Daniel J Walsh
116a5b0c09 - Update to latest from NSA
Added -f file_contexts option to matchpathcon util. Fixed warning message
    in matchpathcon_init().
Merged Makefile python definitions patch from Dan Walsh.
2005-11-29 18:47:52 +00:00
Daniel J Walsh
86e0b5f76e - Separate out libselinux-python bindings into separate rpm 2005-11-29 03:02:30 +00:00
Daniel J Walsh
ac2f72cc37 - Update to latest from NSA
Merged make failure in rpm_execcon non-fatal in permissive mode patch from
    Ivan Gyurdiev.
2005-11-17 02:41:51 +00:00
Daniel J Walsh
67ec76fa36 - Update to latest from NSA
Added MATCHPATHCON_NOTRANS flag for set_matchpathcon_flags() and modified
    matchpathcon_init() to skip context translation if it is set by the
    caller.
2005-11-09 01:39:32 +00:00
Daniel J Walsh
e6236defe6 - Update to latest from NSA
Added security_canonicalize_context() interface and
    set_matchpathcon_canoncon() interface for obtaining canonical contexts.
    Changed matchpathcon internals to obtain canonical contexts by default.
    Provided fallback for kernels that lack extended selinuxfs context
    interface.
- Patch to not translate mls when calling setfiles
2005-11-08 23:41:10 +00:00
Daniel J Walsh
8f768f0ce7 - Update to latest from NSA
Merged seusers parser changes from Ivan Gyurdiev.
Merged setsebool to libsemanage patch from Ivan Gyurdiev.
Changed seusers parser to reject empty fields.
2005-11-07 14:50:45 +00:00
Daniel J Walsh
e559debc39 Merged seusers empty level handling patch from Jonathan Kim (TCS). 2005-11-04 14:49:42 +00:00
Daniel J Walsh
08d2242291 - Change default to __default__ 2005-10-27 17:57:25 +00:00
Daniel J Walsh
2300981c61 - Update to latest from NSA
Merged selinux_path() and selinux_homedir_context_path() functions from
    Joshua Brindle.
2005-10-25 19:17:22 +00:00
Daniel J Walsh
3ef1de9af9 - Update to latest from NSA
Merged fixes for make DESTDIR= builds from Joshua Brindle.
2005-10-20 20:34:28 +00:00
Daniel J Walsh
78dc042098 - Update to latest from NSA
Merged get_default_context_with_rolelevel and man pages from Dan Walsh (Red
    Hat).
Updated call to sepol_policydb_to_image for sepol changes.
Changed getseuserbyname to ignore empty lines and to handle no matching
    entry in the same manner as no seusers file.
2005-10-18 18:27:41 +00:00
Daniel J Walsh
61427961fc - 2005-10-17 18:19:07 +00:00
Daniel J Walsh
c521275b65 - Update to latest from NSA
Changed selinux_mkload_policy to try downgrading the latest policy version
    available to the kernel-supported version.
Changed selinux_mkload_policy to fall back to the maximum policy version
    supported by libsepol if the kernel policy version falls outside of the
    supported range.
2005-10-14 12:34:19 +00:00
Daniel J Walsh
b19e5c854f - Update to latest from NSA
Changed getseuserbyname to fall back to the Linux username and NULL level
    if seusers config file doesn't exist unless REQUIRESEUSERS=1 is set in
    /etc/selinux/config.
Moved seusers.conf under $SELINUXTYPE and renamed to seusers.
2005-10-07 14:09:21 +00:00
Daniel J Walsh
33b55398a2 - Update to latest from NSA
Added selinux_init_load_policy() function as an even higher level interface
    for the initial policy load by /sbin/init. This obsoletes the
    load_policy() function in the sysvinit-selinux.patch.
Added selinux_mkload_policy() function as a higher level interface for
    loading policy than the security_load_policy() interface.
2005-10-06 19:03:52 +00:00
Daniel J Walsh
90c2814893 - Update to latest from NSA
Merged fix for matchpathcon (regcomp error checking) from Johan Fischer.
    Also added use of regerror to obtain the error string for inclusion in
    the error message.
2005-10-06 13:21:54 +00:00
Daniel J Walsh
f76369a096 - Update to latest from NSA
Changed getseuserbyname to not require (and ignore if present) the MLS
    level in seusers.conf if MLS is disabled, setting *level to NULL in
    this case.
2005-10-04 15:43:00 +00:00
Daniel J Walsh
1cfd4dc1a6 - Update to latest from NSA
Merged getseuserbyname patch from Dan Walsh.
2005-10-03 13:14:47 +00:00
Daniel J Walsh
bebb529bd5 - Update to latest from NSA
- Add getseuserbyname
2005-09-29 02:12:47 +00:00
Daniel J Walsh
b86cfc3a43 - Fix strip_con call 2005-09-16 18:42:27 +00:00
Daniel J Walsh
96ff98944c - Go back to original libsetrans code 2005-09-16 17:43:14 +00:00
Daniel J Walsh
017ea0e76c - Update from NSA
Merged modified form of patch to avoid dlopen/dlclose by the static
    libselinux from Dan Walsh. Users of the static libselinux will not have
    any context translation by default.
2005-09-12 15:52:30 +00:00
Daniel J Walsh
99ddec8d69 - Update from NSA
Merged modified form of patch to avoid dlopen/dlclose by the static
    libselinux from Dan Walsh. Users of the static libselinux will not have
    any context translation by default.
2005-09-06 16:41:47 +00:00
Daniel J Walsh
59d6552e7d - Update from NSA
Added public functions to export context translation to users of libselinux
    (selinux_trans_to_raw_context, selinux_raw_to_trans_context).
2005-09-01 15:23:17 +00:00
Daniel J Walsh
eb500fb164 - Update from NSA
Remove special definition for context_range_set; use common code.
2005-08-29 11:59:41 +00:00
Daniel J Walsh
d3d9f9e7f8 - Update from NSA
Hid translation-related symbols entirely and ensured that raw functions
    have hidden definitions for internal use.
Allowed setting NULL via context_set* functions.
Allowed whitespace in MLS component of context.
Changed rpm_execcon to use translated functions to workaround lack of MLS
    level on upgraded systems.
2005-08-25 20:21:14 +00:00
Daniel J Walsh
e7e35da33b Merged context translation patch, originally by TCS, with modifications by
Dan Walsh (Red Hat).
2005-08-24 13:15:02 +00:00
Daniel J Walsh
1f935e2ec7 - Update from NSA
Merged several fixes for error handling paths in the AVC sidtab,
    matchpathcon, booleans, context, and get_context_list code from Serge
    Hallyn (IBM). Bugs found by Coverity.
Removed setupns; migrated to pam.
Merged patches to rename checkPasswdAccess() from Joshua Brindle. Original
    symbol is temporarily retained for compatibility until all callers are
    updated.
2005-08-12 02:46:49 +00:00
Daniel J Walsh
44200d6b78 - Update makefiles 2005-07-18 19:15:29 +00:00
Daniel J Walsh
67d0acbf49 - Update from NSA
Merged security_setupns() from Chad Sellers.
- fix selinuxenabled man page
2005-06-29 20:04:50 +00:00
Daniel J Walsh
661867eccf - Update from NSA
Merged avcstat and selinux man page from Dan Walsh.
Changed security_load_booleans to process booleans.local even if booleans
    file doesn't exist.
Fri Apr 26 2005 Dan Walsh <dwalsh@redhat.com> 1.23.10-3
- Fix avcstat to clear totals
2005-05-20 17:18:49 +00:00
Daniel J Walsh
d3be4d7a20 - Update from NSA
Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
Rewrote get_ordered_context_list and helpers, including changing logic to
    allow variable MLS fields.
2005-04-29 19:01:28 +00:00
Daniel J Walsh
d7bbd88ea0 - Update from NSA 2005-04-26 16:25:57 +00:00
Daniel J Walsh
b83512ff2c - Change assert(selinux_mnt) to if (!selinux_mnt) return -1; 2005-04-13 15:42:02 +00:00
Daniel J Walsh
e39f335d11 - Update from NSA
Fixed bug in matchpathcon_filespec_destroy.
2005-04-11 20:11:29 +00:00
Daniel J Walsh
5b866cc468 - Update from NSA
Fixed bug in rpm_execcon error handling path.
2005-04-06 11:06:40 +00:00
Daniel J Walsh
03a50e15ab - Update from NSA
Merged fix for set_matchpathcon* functions from Andreas Steinmetz.
Merged fix for getconlist utility from Andreas Steinmetz.
2005-04-04 20:17:21 +00:00
Daniel J Walsh
fbe330170e - Update from NSA 2005-03-30 03:12:14 +00:00
Daniel J Walsh
e037587aca - Update from NSA
Merged destructors patch from Tomas Mraz.
2005-03-17 20:01:37 +00:00
Daniel J Walsh
d432883eeb - Update from NSA
Added set_matchpathcon_flags() function for setting flags controlling
    operation of matchpathcon. MATCHPATHCON_BASEONLY means only process the
    base file_contexts file, not file_contexts.homedirs or
    file_contexts.local, and is for use by setfiles -c.
Updated matchpathcon.3 man page.
2005-03-17 15:39:58 +00:00
Daniel J Walsh
8e67581eb8 - Update from NSA 2005-03-10 14:44:02 +00:00
Daniel J Walsh
adbca5042d - Update from NSA
Fixed bug in matchpathcon_filespec_add() - failure to clear fl_head.
2005-03-08 20:15:20 +00:00
Daniel J Walsh
d4111cf41f - Update from NSA
Changed matchpathcon_common to ignore any non-format bits in the mode.
2005-03-02 04:04:04 +00:00
Daniel J Walsh
1ec9b46064 - Update from NSA
Merged several fixes from Ulrich Drepper.
2005-02-22 22:12:25 +00:00
Daniel J Walsh
8e994c6484 - Update from NSA
Merged matchpathcon patch for file_contexts.homedir from Dan Walsh.
Added selinux_users_path() for path to directory containing system.users
    and local.users.
2005-02-17 19:27:56 +00:00
Daniel J Walsh
34474bcbb4 - Update from NSA
Changed relabel Makefile target to use restorecon.
2005-02-10 13:48:34 +00:00
Daniel J Walsh
e508830eca - Update from NSA
Regenerated av_permissions.h.
2005-02-08 21:20:55 +00:00
Daniel J Walsh
3fbeee478d - Update from NSA
Modified avc_dump_av to explicitly check for any permissions that cannot be
    mapped to string names and display them as a hex value.
Regenerated av_permissions.h.
2005-02-02 23:18:13 +00:00
Daniel J Walsh
8851687ce1 - Update from NSA
Generalized matchpathcon internals, exported more interfaces, and moved
    additional code from setfiles into libselinux so that setfiles can
    directly use matchpathcon.
2005-01-31 18:51:58 +00:00
Daniel J Walsh
1d69704875 - Update from NSA
Prevent overflow of spec array in matchpathcon.
Fixed several uses of internal functions to avoid relocations.
Changed rpm_execcon to check is_selinux_enabled() and fallback to a regular
    execve if not enabled (or unable to determine due to a lack of /proc,
    e.g. chroot'd environment).
2005-01-28 17:19:20 +00:00
Daniel J Walsh
cc65d5b546 - Update from NSA
Merged minor fix for avcstat from Dan Walsh.
2005-01-26 16:36:33 +00:00
Daniel J Walsh
e1e9d62ce4 - Update from NSA 2005-01-20 13:58:18 +00:00
Daniel J Walsh
dffd9eaafd - Update to latest from upstream
Just changing version number to match upstream
2005-01-07 14:48:24 +00:00
Daniel J Walsh
c88fca683f - Update to latest from upstream
Changed matchpathcon to return -1 with errno ENOENT for <<none>> entries,
    and also for an empty file_contexts configuration.
2004-12-29 17:08:58 +00:00
Daniel J Walsh
8ecfe2db4e - Upgrade to upstream
Removed some trivial utils that were not useful or redundant.
Changed BINDIR default to /usr/sbin to match change in Fedora.
Added security_compute_member.
Added man page for setcon.
2004-12-03 19:41:58 +00:00
Daniel J Walsh
cc63ca70ad - Upgrade to upstream 2004-12-01 01:31:34 +00:00
Daniel J Walsh
38be80f2c3 - Update from upstream, fix setsebool -P segfault 2004-11-09 14:24:39 +00:00
Daniel J Walsh
cfb1f307ae - Upgrade to latest from NSA 2004-11-02 19:47:54 +00:00
Daniel J Walsh
b2c3e1fca2 add -g to build and update with rpmexec 2004-10-15 13:42:33 +00:00
Daniel J Walsh
224faef153 update to NSA version 2004-10-06 14:03:28 +00:00
Daniel J Walsh
228dd64e4f latest from NSA 2004-09-20 19:50:16 +00:00
Daniel J Walsh
0474ff5fef NSA Cleanup 2004-09-15 14:14:10 +00:00
Daniel J Walsh
39b34ebda7 latest from NSA 2004-09-14 13:43:57 +00:00
Daniel J Walsh
791a651339 add nscd perms 2004-09-14 13:39:22 +00:00
Daniel J Walsh
dcf4ba68c9 latest from NSA 2004-09-10 18:40:42 +00:00
cvsdist
aca62f6df6 auto-import changelog data from libselinux-1.17.9-1.src.rpm
Wed Sep 08 2004 Dan Walsh <dwalsh@redhat.com> 1.17.9-1
- Update from NSA
Added get_default_context_with_role.
2004-09-09 07:46:10 +00:00
cvsdist
f453bd1f3d auto-import changelog data from libselinux-1.17.8-1.src.rpm
Thu Sep 02 2004 Dan Walsh <dwalsh@redhat.com> 1.17.8-1
- Update from NSA
Added set_matchpathcon_printf.
Wed Sep 01 2004 Dan Walsh <dwalsh@redhat.com> 1.17.7-1
- Update from NSA
Reworked av_inherit.h to allow easier re-use by kernel.
2004-09-09 07:45:53 +00:00
cvsdist
b320ff19bb auto-import libselinux-1.17.7-1 from libselinux-1.17.7-1.src.rpm 2004-09-09 07:45:43 +00:00
cvsdist
e34dcc2219 auto-import changelog data from libselinux-1.17.6-1.src.rpm
Tue Aug 31 2004 Dan Walsh <dwalsh@redhat.com> 1.17.6-1
- Add strcasecmp in selinux_config
- Update from NSA
Changed avc_has_perm_noaudit to not fail on netlink errors.
Changed avc netlink code to check pid based on patch by Steve Grubb.
Merged second optimization patch from Ulrich Drepper.
Changed matchpathcon to skip invalid file_contexts entries.
Made string tables private to libselinux.
Merged strcat->stpcpy patch from Ulrich Drepper.
Merged matchpathcon man page from Dan Walsh.
Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
Autobind netlink socket.
Dropped compatibility code from security_compute_user.
Merged fix for context_range_set from Chad Hanson.
Merged allocation failure checking patch from Chad Hanson.
Merged avc netlink error message patch from Colin Walters.
2004-09-09 07:45:35 +00:00
cvsdist
4b578fd4a9 auto-import libselinux-1.17.5-1 from libselinux-1.17.5-1.src.rpm 2004-09-09 07:45:27 +00:00
cvsdist
052a62dd21 auto-import changelog data from libselinux-1.17.4-1.src.rpm
Mon Aug 30 2004 Dan Walsh <dwalsh@redhat.com> 1.17.4-1
- Update from NSA
- Add optflags
2004-09-09 07:45:21 +00:00
cvsdist
f991fab43a auto-import libselinux-1.17.3-1 from libselinux-1.17.3-1.src.rpm 2004-09-09 07:45:16 +00:00
cvsdist
6df57245c3 auto-import changelog data from libselinux-1.17.2-1.src.rpm
Thu Aug 26 2004 Dan Walsh <dwalsh@redhat.com> 1.17.2-1
- Add matchpathcon man page
- Latest from NSA
Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
Autobind netlink socket.
Dropped compatibility code from security_compute_user.
Merged fix for context_range_set from Chad Hanson.
Merged allocation failure checking patch from Chad Hanson.
Merged avc netlink error message patch from Colin Walters.
2004-09-09 07:45:13 +00:00
cvsdist
569258dd79 auto-import changelog data from libselinux-1.17.1-1.src.rpm
Tue Aug 24 2004 Dan Walsh <dwalsh@redhat.com> 1.17.1-1
- Latest from NSA
Autobind netlink socket.
Dropped compatibility code from security_compute_user.
Merged fix for context_range_set from Chad Hanson.
Merged allocation failure checking patch from Chad Hanson.
Merged avc netlink error message patch from Colin Walters.
2004-09-09 07:45:06 +00:00
cvsdist
c722471fde auto-import changelog data from libselinux-1.16.1-1.src.rpm
Sun Aug 22 2004 Dan Walsh <dwalsh@redhat.com> 1.16.1-1
- Latest from NSA
2004-09-09 07:44:55 +00:00
cvsdist
1e259b6254 auto-import changelog data from libselinux-1.16-1.src.rpm
Thu Aug 19 2004 Colin Walters <walters@redhat.com> 1.16-1
- New upstream version
2004-09-09 07:44:50 +00:00
cvsdist
998a860c58 auto-import changelog data from libselinux-1.15.7-1.src.rpm
Tue Aug 17 2004 Dan Walsh <dwalsh@redhat.com> 1.15.7-1
- Latest from Upstream
2004-09-09 07:44:47 +00:00
cvsdist
d4d9fd7e66 auto-import libselinux-1.15.6-1 from libselinux-1.15.6-1.src.rpm 2004-09-09 07:44:43 +00:00
cvsdist
431f96de8c auto-import changelog data from libselinux-1.15.5-1.src.rpm
Mon Aug 16 2004 Dan Walsh <dwalsh@redhat.com> 1.15.5-1
- Latest from Upstream
2004-09-09 07:44:40 +00:00