Commit Graph

883 Commits

Author SHA1 Message Date
Dan Walsh
01c8a3601e Fix semanage fcontext -E to extract the equivalance customizations. 2012-04-30 15:05:24 -04:00
Dan Walsh
e6f13dc63b Add mgrepl patch to have sepolgen search for -systemd rpm packages 2012-04-26 13:55:39 -04:00
Dan Walsh
bd477696df Apply Stef Walter patch for semanage man page 2012-04-24 11:23:12 -04:00
Dan Walsh
e8601ffa5d Apply Stef Walter patch for semanage man page 2012-04-24 11:21:59 -04:00
Dan Walsh
5e219f960d Rebuild to get latest libsepol which fixes the file_name transition problems
- Update translations
- Fix calls to close fd for restorecond
2012-04-23 21:56:23 -04:00
Dan Walsh
9b6eb5adbc Rebuild to get latest libsepol which fixes the file_name transition problems
- Update translations
- Fix calls to close fd for restorecond
2012-04-23 21:16:16 -04:00
Dan Walsh
90329f9593 Update translations
- Fix sepolgen to discover unit files in /lib/systemd/
2012-04-13 10:49:46 -04:00
Dan Walsh
697e7c645d Update translations
- Fix segfault on restorecon
2012-04-05 10:16:30 -04:00
Dan Walsh
186fd9068c Allow filename transitions to use + in a file name 2012-04-03 18:58:26 -04:00
Dan Walsh
071409ede1 Change policycoreutils-python to require -devel package 2012-03-30 15:39:04 -04:00
Dan Walsh
273033cb24 Update to upstream
- policycoreutils
	* sandbox: do not propogate inside mounts outside
	* sandbox: Removing sandbox init script, should no longer be necessary
	* restorecond: Stop using deprecated interfaces for g_io
	* semanage: proper auditting of user changes for LSPP
	* semanage: audit message to show what record(s) and item(s) have chaged
	* scripts: Update Makefiles to handle /usrmove
	* mcstrans: Version should have been bumped on last check in
	* seunshare: Only drop caps not the Bounding Set from seunshare
	* Add bash-completion scripts for setsebool and semanage
	* newrole: Use correct capng calls in newrole
	* Fix infinite loop with inotify on 2.6.31 kernels
	* fix ftbfs with hardening flags
	* Only run setfiles if we found read-write filesystems to run it on
	* update .po files
	* remove empty po files
	* do not fail to install if unable to make load_policy lnk file
2012-03-30 15:18:42 -04:00
Dan Walsh
821c8a5d61 On full relabels we will now show a estimated percent complete rather then
just *s.
2012-02-03 12:14:36 -05:00
Dan Walsh
a0ea1de748 Add unit_file.py for sepolgen 2012-02-01 08:44:52 -05:00
Dan Walsh
d4088bfa91 Stop syslogging on full restore
- Stop syslogging when restorecon is not changing values
2012-01-31 10:58:23 -05:00
Dan Walsh
662a1ad3a8 Change semanage to produce proper audit records for Common Criteria
- Cleanup packaging for usrmove
2012-01-27 14:09:12 -05:00
Dan Walsh
132b0f633b Add ability to send proper audit messages to semanage 2012-01-27 13:24:08 -05:00
Harald Hoyer
1eac07342c fixed load_policy location 2012-01-26 18:20:15 +01:00
Harald Hoyer
f8bca8aa02 fixed load_policy location 2012-01-26 18:05:23 +01:00
Harald Hoyer
626dd026d1 fixed load_policy location 2012-01-26 17:23:18 +01:00
Harald Hoyer
05b05a3209 add filesystem guard 2012-01-25 21:12:58 +01:00
Harald Hoyer
b4f656f9ce removed ln -s /sbin/restorecon /usr/sbin/restorecon 2012-01-25 14:34:39 +01:00
Harald Hoyer
53f4a4c7dc install everything in /usr
This patch is needed for the /usr-move feature
https://fedoraproject.org/wiki/Features/UsrMove

This package requires now 'filesystem' >= 3, which is only installable
on a system which has /bin, /sbin, /lib, /lib64 as symlinks to /usr and
not regular directories. The 'filesystem' package acts as a guard, to
prevent *this* package to be installed on old unconverted systems.

New installations will have the 'filesystem' >=3 layout right away, old
installations need to be converted with anaconda or dracut first; only
after that, the 'filesystem' package, and also *this* package can be
installed.

Packages *should* not install files in /bin, /sbin, /lib, /lib64, but
only in the corresponding directories in /usr. Packages *must* not
install conflicting files with the same names in the corresponding
directories in / and /usr. Especially compatibilty symlinks must not be
installed.

Feel free to modify any of the changes to the spec file, but keep the
above in mind.
2012-01-25 14:22:37 +01:00
Dan Walsh
acc953768b restorecond fixes:
Stop using depracated g_io interfaces
  Exit with non zero exit code if wrong options given
  Add -h option
2012-01-24 11:26:46 -05:00
Dan Walsh
68264eb77e Eliminate not needed Requires 2012-01-19 09:38:34 -05:00
Dan Walsh
685c820b6d fix sepolgen to not crash on echo "" | audit2allow
Remove sandbox init script, should no longer be necessary
2012-01-18 16:43:57 -05:00
Dan Walsh
3886f5e4a9 Remove sandbox init script, should no longer be necessary 2012-01-16 14:40:22 -05:00
Dan Walsh
6312df65b6 Add unit file support to sepolgen, and cleanup some of the output. 2012-01-15 16:51:27 -05:00
Dan Walsh
db51c1ef98 Fix English in templates for sepolgen 2012-01-09 16:30:19 -05:00
Dan Walsh
e1a62b20ba Fix english in templates 2012-01-09 16:28:48 -05:00
Dan Walsh
42e269dd3c Fix the handling of namespaces in seunshare/sandbox.
Currently mounting of directories within sandbox is propogating to the
parent namesspace.
2011-12-23 10:08:38 +00:00
Dan Walsh
6525007747 Add umount code to seunshare to cleanup left over mounts of /var/tmp 2011-12-22 18:59:59 +00:00
Dan Walsh
414b6a904d Update to upstream
sepolgen
	* better analysis of why things broke
policycoreutils
	* Remove excess whitespace
	* sandbox: Add back in . functions to sandbox.init script
	* Fix Makefile to match other policycoreutils Makefiles
	* semanage: drop unused translation getopt
2011-12-21 18:18:01 +00:00
Dan Walsh
1bf48c8679 Bump libsepol version requires rebuild 2011-12-16 06:23:26 -05:00
Dan Walsh
977eb87438 Bump libsepol version requires rebuild 2011-12-15 16:35:47 -05:00
Dan Walsh
1bb3b98779 Add back accidently dropped patches for semanage 2011-12-07 09:40:36 -05:00
Dan Walsh
076ffc0b0a Upgrade to upstream
* sandbox: move sandbox.conf.5 to just sandbox.5
	* po: Makefile use -p to preserve times to allow multilib simultatious installs
	* of po files
	* sandbox: Allow user to specify the DPI value for X in a sandbox
	* sandbox: make sure the domain launching sandbox has at least 100 categories
	* sandbox: do not try forever to find available category set
	* sandbox: only complain if sandbox unable to launch
	* sandbox: init script run twice is still successful
	* semanage: print local and dristo equiv rules
	* semanage: check file equivalence rules for conflict
	* semanage: Make sure semanage fcontext -l -C prints even if local keys
	* are not defined
	* semanage: change src,dst to target,substitute for equivalency
	* sestatus: Updated sestatus and man pages.
	* Added SELinux config file man page.
	* add clean target to man Makefile
2011-12-06 19:30:28 -05:00
Dan Walsh
6b9bc0eb8f Fix dpi handling in sandbox
Make sure semanage fcontext -l -C prints if only local equiv have changed
2011-11-29 15:58:56 -05:00
Dan Walsh
656414a035 Fix dpi handling in sandbox 2011-11-29 15:35:54 -05:00
Dan Walsh
c165d4c12a Fix dpi handling in sandbox 2011-11-29 15:25:50 -05:00
Dan Walsh
e0ffc386e8 Add listing of distribution equivalence class from semanage fcontext -l
Add checking to semanage fcontext -a to guarantee a file specification will not be masked by an equivalence

Allow ~ as a valid part of a filename in sepolgen
2011-11-16 15:41:18 -05:00
Dan Walsh
97d6c28e36 Allow ~ as a valid part of a filename in sepolgen 2011-11-16 11:26:11 -05:00
Dan Walsh
35a1c24b59 sandbox init script should always return 0
sandbox command needs to check range of categories and report error if not big enough
2011-11-11 15:25:44 -05:00
Dan Walsh
e71cb0d5d0 Allow user to specify DPI when running sandbox 2011-11-07 15:56:15 -05:00
Dan Walsh
6119a6b9f8 Add Miroslav patch to return all attributes 2011-11-07 15:15:28 -05:00
Dan Walsh
2c4e323ce5 Upgrade to policycoreutils upstream
* sandbox: Maintain the LANG environment into the sandbox
	* audit2allow: use audit2why internally
	* fixfiles: label /root but not /var/lib/BackupPC
	* semanage: update local boolean settings is dealing with localstore
	* semanage: missing modify=True
	* semanage: set modified correctly
	* restorecond: make restorecond dbuss-able
	* restorecon: Always check return code on asprintf
	* restorecond: make restorecond -u exit when terminal closes
	* sandbox: introduce package name and language stuff
	* semodule_package: remove semodule_unpackage on clean
	* fix sandbox Makefile to support DESTDIR
	* semanage: Add -o description to the semanage man page
	* make use of the new realpath_not_final function
	* setfiles: close /proc/mounts file when finished
	* semodule: Document semodule -p in man page
	* setfiles: fix use before initialized
	* restorecond: Add .local/share as a directory to watch
Upgrade to sepolgen upstream
	* Ignore permissive qualifier if found in an interface
	* Return name field in avc data
2011-11-04 10:47:42 -04:00
Dan Walsh
2392ca1483 A couple of minor coverity fixes for a potential leaked file descriptor
An an unchecked return code.
Add ~/.local/share/* to restorecond_user watches
2011-10-28 16:47:40 -04:00
Dan Walsh
4f4e4913d7 Have sepolgen return name field in AVC 2011-10-13 13:29:56 -04:00
Dan Walsh
6c13d007c9 restorecond -u needs to watch terminal for exit if run outside of dbus. 2011-10-06 16:07:50 -04:00
Dan Walsh
ebadcd67f7 Do not drop capabilities if running newrole as root 2011-10-04 08:36:06 -04:00
Dan Walsh
3507aa6632 Update to upstream
* semanage: fix indentation error in seobject
2011-09-30 09:28:53 -04:00