Commit Graph

823 Commits

Author SHA1 Message Date
rhatdan
2d7c6d02f4 Allow fixfiles to specify -v, so they can get verbosity rather then progress.
- Fix load_file Makefile to use SBINDIR rather then real OS.
- Fix man pages in setfiles and restorecon to reflect what happens when you relabel the entire OS.
2012-09-17 14:56:05 -04:00
rhatdan
6e9d4c92ea Use systemd post install scriptlets 2012-09-17 12:37:51 -04:00
rhatdan
775d48fd41 Update to upstream
* genhomedircon: manual page improvements
	* setfiles/restorecon minor improvements
	* run_init: If open_init_pty is not available then just use exec
	* newrole: do not drop capabilities when newrole is run as
	* restorecon: only update type by default
	* scripts: Don't syslog setfiles changes on a fixfiles restore
	* setfiles: do not syslog if no changes
	* Disable user restorecond by default
	* Make restorecon return 0 when a file has changed context
	* setfiles: Fix process_glob error handling
	* semanage: allow enable/disable under -m
	* add .tx to gitignore
	* translations: commit translations from Fedora community
	* po: silence build process
	* gui: Checking in policy to support polgengui and sepolgen.
	* gui: polgen: search for systemd subpackage when generating policy
	* gui: for exploring booleans
	* gui: system-config-selinux gui
	* Add Makefiles to support new gui code
	* gui: remove lockdown wizard
	* return equivalency records in fcontext customized
	* semanage: option to not load new policy into kernel after
	* sandbox: manpage update to describe standard types
	* setsebool: -N should not reload policy on changes
	* semodule: Add -N qualifier to no reload kernel policy
	* gui: polgen: sort selinux types of user controls
	* gui: polgen: follow symlinks and get the real path to
	* gui: Fix missing error function
	* setfiles: return errors when bad paths are given
	* fixfiles: tell restorecon to ignore missing paths
	* setsebool: error when setting multiple options
	* semanage: use boolean subs.
	* sandbox: Make sure Xephyr never listens on tcp ports
	* sepolgen: return and output constraint violation information
	* semanage: skip comments while reading external configuration files
	* restorecond: relabel all mount runtime files in the restorecond example
	* genhomedircon: dynamically create genhomedircon
	* Allow returning of bastard matches
	* sepolgen: return and output constraint violation information
	* audit2allow: one role/type pair per line
2012-09-15 08:34:36 -04:00
rhatdan
92907b214d Change polgen to generate dbus apps as optional so they can compile on minimal policy system, patch from Miroslav Grepl 2012-08-08 09:25:33 -04:00
Dan Walsh
634c0824af Fix sepolgen/audit2allow to handle multiple role/types in avc messages properly 2012-07-27 09:42:59 -04:00
Dan Walsh
7e579fc0a2 userapps is generating sandbox code in polgengui 2012-07-19 13:21:49 -04:00
Dan Walsh
9c3e56bd25 userapps is generating sandbox code in polgengui 2012-07-11 10:51:38 -04:00
Dan Walsh
4ab9c398e5 Remove load_policy symbolic link on usrmove systems this breaks the system 2012-07-05 05:56:49 -04:00
Dan Walsh
f35df462e0 Update to upstream
- policycoreutils
	* restorecond: wrong options should exit with non-zero error code
	* restorecond: Add -h option to get usage command
	* resorecond: user: fix fd leak
	* mcstrans: add -f to run in foreground
	* semanage: fix man page range and level defaults
	* semanage: bash completion for modules should include -a,-m, -d
	* semanage: manpage update for -e
	* semanage: dontaudit off should work
	* semanage: locallist option does not take an argument
	* sepolgen: Make use of setools optional within sepolgen
   - sepolgen
	* Make use of setools optional within sepolgen
	* We need to support files that have a + in them
2012-07-04 07:41:05 -04:00
Dan Walsh
b97e271674 Make restorecon exit with an error on a bad path 2012-05-24 11:39:55 -04:00
Dan Walsh
f7d5cb7960 Fix setsebool command, handling of = broken.
- Add missing error option in booleansPage
2012-05-24 08:59:33 -04:00
Dan Walsh
03b8834355 Fix setsebool command, handling of = broken.
- Add missing error option in booleansPage
2012-05-24 05:55:35 -04:00
Dan Walsh
1b634710d1 Allow stream sock_files to be stored in /tmp and etc_rw_t directories by sepolgen
- Trigger on selinux-policy needs to change to selinux-policy-devel
- Update translations
- Fix semanage dontaudit off/on exception
2012-05-18 11:42:50 -04:00
Dan Walsh
9d30639944 Trigger on selinux-policy needs to change to selinux-policy-devel 2012-05-18 11:14:21 -04:00
Dan Walsh
31cb4ccac2 Update translations
- Fix semanage dontaudit off/on exception
2012-05-18 09:58:36 -04:00
Dan Walsh
4f5186ec4f Add -N qualifier to semanage, setsebool and semodule to allow you to update
- policy without reloading it into the kernel.
2012-05-08 16:32:53 -04:00
Dan Walsh
3348eaa82b add some definition to the standard types available for sandboxes 2012-05-03 19:34:17 -04:00
Dan Walsh
9d3be2cefc Remove lockdown wizard 2012-05-01 16:14:29 -04:00
Dan Walsh
c938748d91 Remove lockdown wizard 2012-05-01 16:13:35 -04:00
Dan Walsh
01c8a3601e Fix semanage fcontext -E to extract the equivalance customizations. 2012-04-30 15:05:24 -04:00
Dan Walsh
e6f13dc63b Add mgrepl patch to have sepolgen search for -systemd rpm packages 2012-04-26 13:55:39 -04:00
Dan Walsh
bd477696df Apply Stef Walter patch for semanage man page 2012-04-24 11:23:12 -04:00
Dan Walsh
e8601ffa5d Apply Stef Walter patch for semanage man page 2012-04-24 11:21:59 -04:00
Dan Walsh
9b6eb5adbc Rebuild to get latest libsepol which fixes the file_name transition problems
- Update translations
- Fix calls to close fd for restorecond
2012-04-23 21:16:16 -04:00
Dan Walsh
90329f9593 Update translations
- Fix sepolgen to discover unit files in /lib/systemd/
2012-04-13 10:49:46 -04:00
Dan Walsh
697e7c645d Update translations
- Fix segfault on restorecon
2012-04-05 10:16:30 -04:00
Dan Walsh
186fd9068c Allow filename transitions to use + in a file name 2012-04-03 18:58:26 -04:00
Dan Walsh
071409ede1 Change policycoreutils-python to require -devel package 2012-03-30 15:39:04 -04:00
Dan Walsh
273033cb24 Update to upstream
- policycoreutils
	* sandbox: do not propogate inside mounts outside
	* sandbox: Removing sandbox init script, should no longer be necessary
	* restorecond: Stop using deprecated interfaces for g_io
	* semanage: proper auditting of user changes for LSPP
	* semanage: audit message to show what record(s) and item(s) have chaged
	* scripts: Update Makefiles to handle /usrmove
	* mcstrans: Version should have been bumped on last check in
	* seunshare: Only drop caps not the Bounding Set from seunshare
	* Add bash-completion scripts for setsebool and semanage
	* newrole: Use correct capng calls in newrole
	* Fix infinite loop with inotify on 2.6.31 kernels
	* fix ftbfs with hardening flags
	* Only run setfiles if we found read-write filesystems to run it on
	* update .po files
	* remove empty po files
	* do not fail to install if unable to make load_policy lnk file
2012-03-30 15:18:42 -04:00
Dan Walsh
821c8a5d61 On full relabels we will now show a estimated percent complete rather then
just *s.
2012-02-03 12:14:36 -05:00
Dan Walsh
a0ea1de748 Add unit_file.py for sepolgen 2012-02-01 08:44:52 -05:00
Dan Walsh
d4088bfa91 Stop syslogging on full restore
- Stop syslogging when restorecon is not changing values
2012-01-31 10:58:23 -05:00
Dan Walsh
662a1ad3a8 Change semanage to produce proper audit records for Common Criteria
- Cleanup packaging for usrmove
2012-01-27 14:09:12 -05:00
Dan Walsh
132b0f633b Add ability to send proper audit messages to semanage 2012-01-27 13:24:08 -05:00
Harald Hoyer
1eac07342c fixed load_policy location 2012-01-26 18:20:15 +01:00
Harald Hoyer
f8bca8aa02 fixed load_policy location 2012-01-26 18:05:23 +01:00
Harald Hoyer
626dd026d1 fixed load_policy location 2012-01-26 17:23:18 +01:00
Harald Hoyer
05b05a3209 add filesystem guard 2012-01-25 21:12:58 +01:00
Harald Hoyer
b4f656f9ce removed ln -s /sbin/restorecon /usr/sbin/restorecon 2012-01-25 14:34:39 +01:00
Harald Hoyer
53f4a4c7dc install everything in /usr
This patch is needed for the /usr-move feature
https://fedoraproject.org/wiki/Features/UsrMove

This package requires now 'filesystem' >= 3, which is only installable
on a system which has /bin, /sbin, /lib, /lib64 as symlinks to /usr and
not regular directories. The 'filesystem' package acts as a guard, to
prevent *this* package to be installed on old unconverted systems.

New installations will have the 'filesystem' >=3 layout right away, old
installations need to be converted with anaconda or dracut first; only
after that, the 'filesystem' package, and also *this* package can be
installed.

Packages *should* not install files in /bin, /sbin, /lib, /lib64, but
only in the corresponding directories in /usr. Packages *must* not
install conflicting files with the same names in the corresponding
directories in / and /usr. Especially compatibilty symlinks must not be
installed.

Feel free to modify any of the changes to the spec file, but keep the
above in mind.
2012-01-25 14:22:37 +01:00
Dan Walsh
acc953768b restorecond fixes:
Stop using depracated g_io interfaces
  Exit with non zero exit code if wrong options given
  Add -h option
2012-01-24 11:26:46 -05:00
Dan Walsh
68264eb77e Eliminate not needed Requires 2012-01-19 09:38:34 -05:00
Dan Walsh
685c820b6d fix sepolgen to not crash on echo "" | audit2allow
Remove sandbox init script, should no longer be necessary
2012-01-18 16:43:57 -05:00
Dan Walsh
3886f5e4a9 Remove sandbox init script, should no longer be necessary 2012-01-16 14:40:22 -05:00
Dan Walsh
6312df65b6 Add unit file support to sepolgen, and cleanup some of the output. 2012-01-15 16:51:27 -05:00
Dan Walsh
db51c1ef98 Fix English in templates for sepolgen 2012-01-09 16:30:19 -05:00
Dan Walsh
42e269dd3c Fix the handling of namespaces in seunshare/sandbox.
Currently mounting of directories within sandbox is propogating to the
parent namesspace.
2011-12-23 10:08:38 +00:00
Dan Walsh
6525007747 Add umount code to seunshare to cleanup left over mounts of /var/tmp 2011-12-22 18:59:59 +00:00
Dan Walsh
414b6a904d Update to upstream
sepolgen
	* better analysis of why things broke
policycoreutils
	* Remove excess whitespace
	* sandbox: Add back in . functions to sandbox.init script
	* Fix Makefile to match other policycoreutils Makefiles
	* semanage: drop unused translation getopt
2011-12-21 18:18:01 +00:00
Dan Walsh
1bf48c8679 Bump libsepol version requires rebuild 2011-12-16 06:23:26 -05:00