When selabel_lookup found an invalid context with validation enabled, it
always stated it was 'file_contexts' whether media, x, db or file.
The fix is to store the spec file name in the selabel_lookup_rec on
selabel_open and use this as output for logs. Also a minor fix if key is
NULL to stop seg faults.
Fix setenforce manage page.
* selinuxswig_python.i: don't make syscall if it won't change anything
* Remove assert in security_get_boolean_names(3)
* Mapped compute functions now obey deny_unknown flag
* get_default_type now sets EINVAL if no entry.
* return EINVAL if invalid role selected
* Updated selabel_file(5) man page
* Updated selabel_db(5) man page
* Updated selabel_media(5) man page
* Updated selabel_x(5) man page
* Add man/man5 man pages
* Add man/man5 man pages
* Add man/man5 man pages
* use -W and -Werror in utils
* load_policy: handle selinux=0 and /sys/fs/selinux not exist
* regenerate .pc on VERSION change
* label: cosmetic cleanups
* simple interface for access checks
* Don't reinitialize avc_init if it has been called previously
* seusers: fix to handle large sets of groups
* audit2why: close fd on enomem
* rename and export symlink_realpath
* label_file: style changes to make Eric happy.
* utils: matchpathcon: remove duplicate declaration
* src: matchpathcon: use myprintf not fprintf
* src: matchpathcon: make sure resolved path starts
* put libselinux.so.1 in /lib not /usr/lib
* tree: default make target to all not
2.1.4 2011-0817
* mapping fix for invalid class/perms after selinux_set_mapping
* audit2why: work around python bug not defining
* resolv symlinks and dot directories before matching
* Give correct names to mount points in load_policy by Dan Walsh.
* Make sure selinux state is reported correctly if selinux is disabled or
fails to load by Dan Walsh.
* Fix crash if selinux_key_create was never called by Dan Walsh.
* Add new file_context.subs_dist for distro specific filecon substitutions
by Dan Walsh.
* Update man pages for selinux_color_* functions by Richard Haines.
Errors were being seen in libpthread/libdl that were related
to corrupt thread specific keys. Global destructors that are called on dl
unload. During destruction delete a thread specific key without checking
if it has been initialized. Since the constructor is not called each time
(i.e. key is not initialized with pthread_key_create each time), and the
default is 0, there is a possibility that key 0 for an active thread gets
deleted. This is exactly what is happening in case of OpenJDK.
Change the AVC to only audit the permissions specified by the policy,
excluding any permissions specified via dontaudit or not specified via
auditallow.
Fix compilation of label_file.c with latest glibc headers.
Add exception handling in libselinux from Dan Walsh. This uses a shell
script called exception.sh to generate a swig interface file.
make swigify
Make matchpathcon print <<none>> if path not found in fcontext file.
Reverted Tomas Mraz's fix for freeing thread local storage to avoid pthread
dependency.
Removed fini_context_translations() altogether.
Merged lazy init patch from Stephen Smalley based on original patch by
Steve Grubb.
Add per-service seuser support from Dan Walsh.
Let load_policy gracefully handle selinuxfs being mounted from Stephen
Smalley.
Check /proc/filesystems before /proc/mounts for selinuxfs from Eric Paris.
Fix improper use of thread local storage from Tomas Mraz
<tmraz@redhat.com>.
Label substitution support from Dan Walsh.
Support for labeling virtual machine images from Dan Walsh.
Fix improper use of thread local storage from Tomas Mraz
<tmraz@redhat.com>.
Label substitution support from Dan Walsh.
Support for labeling virtual machine images from Dan Walsh.
Trim / from the end of input paths to matchpathcon from Dan Walsh.
Fix leak in process_line in label_file.c from Hiroshi Shinji.
Move matchpathcon to /sbin, add matchpathcon to clean target from Dan
Walsh.
getdefaultcon to print just the correct match and add verbose option from
Dan Walsh.
Dan Walsh
Daniel J Walsh