Try new patches
This commit is contained in:
Dan Walsh
parent
f204e024f1
commit
99ee75724c
|
|
@ -1,20 +1,8 @@
|
|||
diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
|
||||
index 481c0ba..f90a48d 100644
|
||||
--- a/libsepol/include/sepol/policydb/polcaps.h
|
||||
+++ b/libsepol/include/sepol/policydb/polcaps.h
|
||||
@@ -6,6 +6,7 @@ enum {
|
||||
POLICYDB_CAPABILITY_NETPEER,
|
||||
POLICYDB_CAPABILITY_OPENPERM,
|
||||
POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */
|
||||
+ POLICYDB_CAPABILITY_ALWAYSNETWORK,
|
||||
__POLICYDB_CAPABILITY_MAX
|
||||
};
|
||||
#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
|
||||
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
|
||||
index bef759c..4663321 100644
|
||||
index bef759c..2854f33 100644
|
||||
--- a/libsepol/src/expand.c
|
||||
+++ b/libsepol/src/expand.c
|
||||
@@ -49,6 +49,79 @@ typedef struct expand_state {
|
||||
@@ -49,6 +49,82 @@ typedef struct expand_state {
|
||||
int expand_neverallow;
|
||||
} expand_state_t;
|
||||
|
||||
|
|
@ -87,6 +75,9 @@ index bef759c..4663321 100644
|
|||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* Incoherent result and end pointers indicates bug */
|
||||
+ assert((result != NULL && end != NULL) || (result == NULL && end == NULL));
|
||||
+
|
||||
+ *endp = end;
|
||||
+ return result;
|
||||
+}
|
||||
|
|
@ -94,7 +85,7 @@ index bef759c..4663321 100644
|
|||
static void expand_state_init(expand_state_t * state)
|
||||
{
|
||||
memset(state, 0, sizeof(expand_state_t));
|
||||
@@ -1352,10 +1425,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
|
||||
@@ -1352,10 +1428,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
|
||||
static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules)
|
||||
{
|
||||
unsigned int i, j;
|
||||
|
|
@ -116,7 +107,7 @@ index bef759c..4663321 100644
|
|||
|
||||
cur_rule = rules;
|
||||
while (cur_rule) {
|
||||
@@ -1378,6 +1461,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
@@ -1378,6 +1464,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
|
||||
mapped_otype = state->typemap[cur_rule->otype - 1];
|
||||
|
||||
|
|
@ -131,7 +122,7 @@ index bef759c..4663321 100644
|
|||
ebitmap_for_each_bit(&stypes, snode, i) {
|
||||
if (!ebitmap_node_get_bit(snode, i))
|
||||
continue;
|
||||
@@ -1385,16 +1476,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
@@ -1385,16 +1479,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
if (!ebitmap_node_get_bit(tnode, j))
|
||||
continue;
|
||||
|
||||
|
|
@ -151,7 +142,7 @@ index bef759c..4663321 100644
|
|||
ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s",
|
||||
cur_trans->name,
|
||||
state->out->p_type_val_to_name[i],
|
||||
@@ -1402,7 +1491,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
@@ -1402,7 +1494,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
state->out->p_class_val_to_name[cur_trans->tclass - 1],
|
||||
state->out->p_type_val_to_name[cur_trans->otype - 1],
|
||||
state->out->p_type_val_to_name[mapped_otype - 1]);
|
||||
|
|
@ -160,7 +151,7 @@ index bef759c..4663321 100644
|
|||
return -1;
|
||||
}
|
||||
cur_trans = cur_trans->next;
|
||||
@@ -1417,8 +1506,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
@@ -1417,8 +1509,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
return -1;
|
||||
}
|
||||
memset(new_trans, 0, sizeof(*new_trans));
|
||||
|
|
@ -169,7 +160,7 @@ index bef759c..4663321 100644
|
|||
|
||||
new_trans->name = strdup(cur_rule->name);
|
||||
if (!new_trans->name) {
|
||||
@@ -1429,9 +1516,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
@@ -1429,9 +1519,16 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
|
||||
new_trans->ttype = j + 1;
|
||||
new_trans->tclass = cur_rule->tclass;
|
||||
new_trans->otype = mapped_otype;
|
||||
|
|
@ -178,83 +169,11 @@ index bef759c..4663321 100644
|
|||
}
|
||||
|
||||
+ cur_trans = linear_probe_dump(&probe, &end);
|
||||
+ end->next = state->out->filename_trans;
|
||||
+ state->out->filename_trans = cur_trans;
|
||||
+ if (cur_trans != NULL) {
|
||||
+ end->next = state->out->filename_trans;
|
||||
+ state->out->filename_trans = cur_trans;
|
||||
+ }
|
||||
+
|
||||
ebitmap_destroy(&stypes);
|
||||
ebitmap_destroy(&ttypes);
|
||||
|
||||
@@ -2032,13 +2124,14 @@ static int ocontext_copy_xen(expand_state_t *state)
|
||||
else
|
||||
state->out->ocontexts[i] = n;
|
||||
l = n;
|
||||
- if (context_copy(&n->context[0], &c->context[0],
|
||||
- state)) {
|
||||
- ERR(state->handle, "Out of memory!");
|
||||
- return -1;
|
||||
- }
|
||||
switch (i) {
|
||||
case OCON_XEN_ISID:
|
||||
+ if (c->context[0].user == 0) {
|
||||
+ ERR(state->handle,
|
||||
+ "Missing context for %s initial sid",
|
||||
+ c->u.name);
|
||||
+ return -1;
|
||||
+ }
|
||||
n->sid[0] = c->sid[0];
|
||||
break;
|
||||
case OCON_XEN_PIRQ:
|
||||
@@ -2061,6 +2154,11 @@ static int ocontext_copy_xen(expand_state_t *state)
|
||||
ERR(state->handle, "Unknown ocontext");
|
||||
return -1;
|
||||
}
|
||||
+ if (context_copy(&n->context[0], &c->context[0],
|
||||
+ state)) {
|
||||
+ ERR(state->handle, "Out of memory!");
|
||||
+ return -1;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
@@ -2085,12 +2183,14 @@ static int ocontext_copy_selinux(expand_state_t *state)
|
||||
else
|
||||
state->out->ocontexts[i] = n;
|
||||
l = n;
|
||||
- if (context_copy(&n->context[0], &c->context[0], state)) {
|
||||
- ERR(state->handle, "Out of memory!");
|
||||
- return -1;
|
||||
- }
|
||||
switch (i) {
|
||||
case OCON_ISID:
|
||||
+ if (c->context[0].user == 0) {
|
||||
+ ERR(state->handle,
|
||||
+ "Missing context for %s initial sid",
|
||||
+ c->u.name);
|
||||
+ return -1;
|
||||
+ }
|
||||
n->sid[0] = c->sid[0];
|
||||
break;
|
||||
case OCON_FS: /* FALLTHROUGH */
|
||||
@@ -2134,6 +2234,10 @@ static int ocontext_copy_selinux(expand_state_t *state)
|
||||
ERR(state->handle, "Unknown ocontext");
|
||||
return -1;
|
||||
}
|
||||
+ if (context_copy(&n->context[0], &c->context[0], state)) {
|
||||
+ ERR(state->handle, "Out of memory!");
|
||||
+ return -1;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
|
||||
index bcaef0c..43a71a7 100644
|
||||
--- a/libsepol/src/polcaps.c
|
||||
+++ b/libsepol/src/polcaps.c
|
||||
@@ -9,6 +9,7 @@ static const char *polcap_names[] = {
|
||||
"network_peer_controls", /* POLICYDB_CAPABILITY_NETPEER */
|
||||
"open_perms", /* POLICYDB_CAPABILITY_OPENPERM */
|
||||
"redhat1", /* POLICYDB_CAPABILITY_REDHAT1, aka ptrace_child */
|
||||
+ "always_check_network", /* POLICYDB_CAPABILITY_ALWAYSNETWORK */
|
||||
NULL
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,6 @@ License: LGPLv2+
|
|||
Group: System Environment/Libraries
|
||||
Source: http://www.nsa.gov/selinux/archives/libsepol-%{version}.tgz
|
||||
Patch: libsepol-rhat.patch
|
||||
Patch1: libsepol-emptytable.patch
|
||||
URL: http://www.selinuxproject.org
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||
|
||||
|
|
@ -47,7 +46,6 @@ needed for developing applications that manipulate binary policies.
|
|||
%prep
|
||||
%setup -q
|
||||
%patch -p2 -b .rhat
|
||||
%patch1 -p1 -b .empty
|
||||
|
||||
# sparc64 is an -fPIC arch, so we need to fix it here
|
||||
%ifarch sparc64
|
||||
|
|
|
|||
Loading…
Reference in New Issue