Commit Graph

244 Commits

Author SHA1 Message Date
Dan Walsh
ce3cc634eb Update to upstream
* Fix dead links to www.nsa.gov/selinux
	* Remove jump over variable declaration
	* Fix old style function definitions
	* Fix const-correctness
	* Remove unused flush_class_cache method
	* Add prototype decl for destructor
	* Add more printf format annotations
	* Add printf format attribute annotation to die() method
	* Fix const-ness of parameters & make usage() methods static
	* Enable many more gcc warnings for libselinux/src/ builds
	* utils: Enable many more gcc warnings for libselinux/utils builds
	* Change annotation on include/selinux/avc.h to avoid upsetting SWIG
	* Ensure there is a prototype for 'matchpathcon_lib_destructor'
	* Update Makefiles to handle /usrmove
	* utils: Stop separating out matchpathcon as something special
	* pkg-config to figure out where ruby include files are located
	* build with either ruby 1.9 or ruby 1.8
	* assert if avc_init() not called
	* take security_deny_unknown into account
	* security_compute_create_name(3)
	* Do not link against python library, this is considered
	* bad practice in debian
	* Hide unnecessarily-exported library destructors
2012-03-29 14:39:18 -04:00
Dan Walsh
76fb5c8e65 avc_netlink_recieve should continue to poll if it receinves an EINTR rather 2012-02-03 10:31:53 -05:00
Dan Walsh
86fcde8ff1 Rebuild with cleaned up upstream to work in /usr 2012-01-27 14:50:47 -05:00
Dan Walsh
f5849c1fad Add Dan Berrange code cleanup patches. 2012-01-23 13:39:03 -05:00
Dan Walsh
80c334bf8d Fix selabal_open man page to refer to proper selinux_opt structure 2012-01-23 11:28:11 -05:00
Dan Walsh
ad8477f7a1 Fix selabal_open man page to refer to proper selinux_opt structure 2012-01-04 11:03:19 -05:00
Dan Walsh
7959ef108b Update to upstream
* Fix setenforce man page to refer to selinux man page
	* Cleanup Man pages
	* merge freecon with getcon man page
2011-12-21 18:09:52 +00:00
Dan Walsh
0c717c5b8c Add patch from Richard Haines
When selabel_lookup found an invalid context with validation enabled, it
always stated it was 'file_contexts' whether media, x, db or file.
The fix is to store the spec file name in the selabel_lookup_rec on
selabel_open and use this as output for logs. Also a minor fix if key is
NULL to stop seg faults.
Fix setenforce manage page.
2011-12-19 14:48:33 -05:00
Dan Walsh
e9493af009 Fix setenforce man page, from Miroslav Grepl 2011-12-06 10:43:58 -05:00
Dan Walsh
de1ce20f11 Upgrade to upstream
* selinuxswig_python.i: don't make syscall if it won't change anything
	* Remove assert in security_get_boolean_names(3)
	* Mapped compute functions now obey deny_unknown flag
	* get_default_type now sets EINVAL if no entry.
	* return EINVAL if invalid role selected
	* Updated selabel_file(5) man page
	* Updated selabel_db(5) man page
	* Updated selabel_media(5) man page
	* Updated selabel_x(5) man page
	* Add man/man5 man pages
	* Add man/man5 man pages
	* Add man/man5 man pages
	* use -W and -Werror in utils
2011-12-06 08:55:52 -05:00
Dan Walsh
0921286973 Change python binding for restorecon to check if the context matches.
If it does do not reset
2011-11-29 09:47:57 -05:00
Dan Walsh
5cb2893d59 * Makefiles: syntax, convert all ${VAR} to $(VAR)
* load_policy: handle selinux=0 and /sys/fs/selinux not exist
	* regenerate .pc on VERSION change
	* label: cosmetic cleanups
	* simple interface for access checks
	* Don't reinitialize avc_init if it has been called previously
	* seusers: fix to handle large sets of groups
	* audit2why: close fd on enomem
	* rename and export symlink_realpath
	* label_file: style changes to make Eric happy.
2011-11-04 09:13:56 -04:00
Dan Walsh
8075466849 Apply libselinux patch to handle large groups in seusers. 2011-10-24 14:30:05 -04:00
Dan Walsh
9328ed5d59 Add selinux_check_access function. Needed for passwd, chfn, chsh 2011-10-20 16:50:40 -04:00
Dan Walsh
a8fa8756a9 Add selinux_check_access function. Needed for passwd, chfn, chsh 2011-10-20 15:44:39 -04:00
Dan Walsh
3f542ebbed Handle situation where selinux=0 passed to the kernel and both /selinux and 2011-09-22 09:38:06 -04:00
Dan Walsh
aa09b7d954 Update to upstream
* utils: matchpathcon: remove duplicate declaration
	* src: matchpathcon: use myprintf not fprintf
	* src: matchpathcon: make sure resolved path starts
	* put libselinux.so.1 in /lib not /usr/lib
	* tree: default make target to all not
2011-09-19 06:52:45 -04:00
Dan Walsh
5113c7563a Switch to use ":" as prefix separator rather then ";" 2011-09-14 22:01:30 -04:00
Dan Walsh
c03bd38197 Fix handling of subset labeling that is causing segfault in restorecon 2011-09-06 09:46:57 -04:00
Dan Walsh
10e77a8370 Change matchpathcon_init_prefix and selabel_open to allow multiple initial
prefixes.  Now you can specify a ";" separated list of prefixes and the
labeling system will only load regular expressions that match these prefixes.
2011-09-02 08:58:11 -04:00
Dan Walsh
495b754734 Change matchpatcon to use proper myprintf
Fix symlink_realpath to always include "/"
Update to upstream
	* selinux_file_context_verify function returns wrong value.
	* move realpath helper to matchpathcon library
	* python wrapper makefile changes
2011-08-30 11:08:49 -04:00
Dan Walsh
4eca5fc79f Move to new Makefile that can build with or without PYTHON being set 2011-08-22 11:04:32 -04:00
Dan Walsh
00e063e5f5 Update to upstream
2.1.4 2011-0817
	* mapping fix for invalid class/perms after selinux_set_mapping
	* audit2why: work around python bug not defining
	* resolv symlinks and dot directories before matching
2011-08-18 07:09:51 -04:00
Dan Walsh
076f35f59b Only call dups check within selabel/matchpathcon if you are validating the
context
This seems to speed the loading of labels by 4 times.
2011-06-13 11:29:06 -04:00
Dan Walsh
2c3aaeae1e Move /selinux to /sys/fs/selinux
Add selinuxexeccon
Add realpath to matchpathcon to handle matchpathcon * type queries.
2011-05-25 14:25:56 -04:00
Dan Walsh
73bed069d2 Fix restorecon python binding to accept relative paths 2011-04-13 16:51:22 -04:00
Dan Walsh
6db4df3c24 Update to upstream
* Give correct names to mount points in load_policy by Dan Walsh.
	* Make sure selinux state is reported correctly if selinux is disabled or
	fails to load by Dan Walsh.
	* Fix crash if selinux_key_create was never called by Dan Walsh.
	* Add new file_context.subs_dist for distro specific filecon substitutions
	by Dan Walsh.
	* Update man pages for selinux_color_* functions by Richard Haines.
2011-04-12 10:09:47 -04:00
Dan Walsh
3d499ceb03 Clean up patch to make handling of constructor cleanup more portable 2011-04-06 11:19:19 -04:00
Dan Walsh
8723500e16 Add file_context.subs_dist to subs paths 2011-04-05 14:03:07 -04:00
Dan Walsh
4b2caaad18 Add patch from dbhole@redhat.com to initialize thread keys to -1
Errors were being seen in libpthread/libdl that were related
to corrupt thread specific keys. Global destructors that are called on dl
unload. During destruction delete a thread specific key without checking
if it has been initialized. Since the constructor is not called each time
(i.e. key is not initialized with pthread_key_create each time), and the
default is 0, there is a possibility that key 0 for an active thread gets
deleted. This is exactly what is happening in case of OpenJDK.
2011-04-05 12:10:57 -04:00
Dan Walsh
9ac8a9964b Call fini_selinuxmnt if selinux is disabled, to cause is_selinux_disabled() to report correct data 2011-04-05 11:37:30 -04:00
Dan Walsh
0cd375f839 Call fini_selinuxmnt if selinux is disabled, to cause is_selinux_disabled() to report correct data 2011-04-05 11:25:39 -04:00
Dan Walsh
1fefea1eb1 Update to upstream
* Turn off default user handling when computing user contexts by Dan Walsh
2011-03-30 14:42:17 -04:00
Dan Walsh
c49c04df3b - Fixup selinux man page 2011-02-01 17:40:11 -05:00
Dan Walsh
3c1b814b3d - Fix Makefile to use pkg-config --cflags python3 to discover include paths 2011-01-18 10:08:15 -05:00
Dan Walsh
ca9cea7698 - Update to upstream
- Turn off fallback in to SELINUX_DEFAULTUSER in get_context_list
2010-12-21 16:29:19 -05:00
Daniel J Walsh
159f7d2174 - Turn off fallback in to SELINUX_DEFAULTUSER in get_context_list 2010-07-27 17:50:51 +00:00
Daniel J Walsh
4235807de2 - Turn off messages in audit2why 2010-06-25 21:05:56 +00:00
Daniel J Walsh
5abec270e9 - Update to upstream
Add const qualifiers to public API where appropriate by KaiGai Kohei.
2010-06-16 13:23:15 +00:00
Daniel J Walsh
982ffdc3f5 - Update to upstream
Fix from Eric Paris to fix leak on non-selinux systems.
regenerate swig wrappers
pkgconfig fix to respect LIBDIR from Dan Walsh.
2010-03-08 13:14:35 +00:00
Daniel J Walsh
68c8d967fd - Update to upstream
Change the AVC to only audit the permissions specified by the policy,
    excluding any permissions specified via dontaudit or not specified via
    auditallow.
Fix compilation of label_file.c with latest glibc headers.
2010-02-24 19:12:12 +00:00
Daniel J Walsh
de078cb3d5 - Fix man page for selinuxdefcon 2010-01-18 21:59:45 +00:00
Daniel J Walsh
995afc05f3 - Fix man page for selinuxdefcon 2010-01-18 21:44:50 +00:00
Daniel J Walsh
1f46a5f18f Mon Jam 4 2010 Dan Walsh <dwalsh@redhat.com> - 2.0.90-2
- Free memory on disabled selinux boxes
2010-01-04 22:17:33 +00:00
Daniel J Walsh
4ed79e3521 - Fix selinuxdefcon man page 2009-11-23 18:32:48 +00:00
Daniel J Walsh
510eba6977 - Update to upstream
Add exception handling in libselinux from Dan Walsh. This uses a shell
    script called exception.sh to generate a swig interface file.
make swigify
Make matchpathcon print <<none>> if path not found in fcontext file.
2009-09-28 20:33:26 +00:00
Daniel J Walsh
d3cc14428b - Eliminate -pthread switch in Makefile 2009-09-15 19:24:22 +00:00
Daniel J Walsh
fa621852dc - Update to upstream
Reverted Tomas Mraz's fix for freeing thread local storage to avoid pthread
    dependency.
Removed fini_context_translations() altogether.
Merged lazy init patch from Stephen Smalley based on original patch by
    Steve Grubb.
2009-07-14 15:29:55 +00:00
Daniel J Walsh
23660c5dba - Update to upstream
Add per-service seuser support from Dan Walsh.
Let load_policy gracefully handle selinuxfs being mounted from Stephen
    Smalley.
Check /proc/filesystems before /proc/mounts for selinuxfs from Eric Paris.
2009-07-07 16:26:11 +00:00
Daniel J Walsh
a66522107b - Update to upstream
Fix improper use of thread local storage from Tomas Mraz
    <tmraz@redhat.com>.
Label substitution support from Dan Walsh.
Support for labeling virtual machine images from Dan Walsh.
2009-06-23 19:54:03 +00:00