Commit Graph

893 Commits

Author SHA1 Message Date
Dan Walsh
97d6c28e36 Allow ~ as a valid part of a filename in sepolgen 2011-11-16 11:26:11 -05:00
Dan Walsh
35a1c24b59 sandbox init script should always return 0
sandbox command needs to check range of categories and report error if not big enough
2011-11-11 15:25:44 -05:00
Dan Walsh
e71cb0d5d0 Allow user to specify DPI when running sandbox 2011-11-07 15:56:15 -05:00
Dan Walsh
6119a6b9f8 Add Miroslav patch to return all attributes 2011-11-07 15:15:28 -05:00
Dan Walsh
2c4e323ce5 Upgrade to policycoreutils upstream
* sandbox: Maintain the LANG environment into the sandbox
	* audit2allow: use audit2why internally
	* fixfiles: label /root but not /var/lib/BackupPC
	* semanage: update local boolean settings is dealing with localstore
	* semanage: missing modify=True
	* semanage: set modified correctly
	* restorecond: make restorecond dbuss-able
	* restorecon: Always check return code on asprintf
	* restorecond: make restorecond -u exit when terminal closes
	* sandbox: introduce package name and language stuff
	* semodule_package: remove semodule_unpackage on clean
	* fix sandbox Makefile to support DESTDIR
	* semanage: Add -o description to the semanage man page
	* make use of the new realpath_not_final function
	* setfiles: close /proc/mounts file when finished
	* semodule: Document semodule -p in man page
	* setfiles: fix use before initialized
	* restorecond: Add .local/share as a directory to watch
Upgrade to sepolgen upstream
	* Ignore permissive qualifier if found in an interface
	* Return name field in avc data
2011-11-04 10:47:42 -04:00
Dan Walsh
2392ca1483 A couple of minor coverity fixes for a potential leaked file descriptor
An an unchecked return code.
Add ~/.local/share/* to restorecond_user watches
2011-10-28 16:47:40 -04:00
Dan Walsh
4f4e4913d7 Have sepolgen return name field in AVC 2011-10-13 13:29:56 -04:00
Dan Walsh
6c13d007c9 restorecond -u needs to watch terminal for exit if run outside of dbus. 2011-10-06 16:07:50 -04:00
Dan Walsh
ebadcd67f7 Do not drop capabilities if running newrole as root 2011-10-04 08:36:06 -04:00
Dan Walsh
3507aa6632 Update to upstream
* semanage: fix indentation error in seobject
2011-09-30 09:28:53 -04:00
Dan Walsh
b6236f9023 Ignore permissive commands in interfaces 2011-09-29 10:56:39 -04:00
Dan Walsh
e5b91b64fc Remove gnome requirement from polgengui 2011-09-29 10:09:48 -04:00
Dan Walsh
b91e98e2c2 Update to upstream
policycoreutils-2.1.6
	* sepolgen-ifgen: new attr-helper does something
	* audit2allow: use alternate policy file
	* audit2allow: sepolgen-ifgen use the attr helper
	* setfiles: switch from stat to stat64
	* setfiles: Fix potential crash using dereferenced ftsent
	* setfiles: do not wrap * output at 80 characters
	* sandbox: add -Wall and -Werror to makefile
	* sandbox: add sandbox cgroup support
	* sandbox: rewrite /tmp handling
	* sandbox: do not bind mount so much
	* sandbox: add level based kill option
	* sandbox: cntrl-c should kill entire process control group
	* Create a new preserve_tunables flag in sepol_handle_t.
	* semanage: show running and disk setting for booleans
	* semanage: Dont print heading if no items selected
	* sepolgen: audit2allow is mistakakenly not allowing valid module names
	* semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled
	* More files to ignore
	* tree: default make target to all not install
	* sandbox: do not load unused generic init functions
sepolgen-1.1.2
	* src: sepolgen: add attribute storing infrastructure
	* Change perm-map and add open to try to get better results on
	* look for booleans that might solve problems
	* sepolgen: audit2allow is mistakakenly not allowing valid module names
	* tree: default make target to all not install
2011-09-19 07:40:39 -04:00
Dan Walsh
64a1a56e71 Change separator on -L from ; to : 2011-09-14 22:08:19 -04:00
Dan Walsh
2d6eafee19 Add back lockdown wizard for booleans using pywebkitgtk 2011-09-08 09:47:43 -04:00
Dan Walsh
78175de296 Maintain the LANG environment Variable into the sandbox
Change restorecon/setfiles to only change type part of the context unless
f qualifier is given
2011-09-07 14:23:19 -04:00
Dan Walsh
fb1cfc265c Remove lockdown wizard, since gtkhtml2 is no longer supported. 2011-09-06 13:19:19 -04:00
Dan Walsh
04b2851781 Allow setfiles and restorecon to use labeledprefix to speed up processing
and limit memory.
2011-09-02 09:24:40 -04:00
Dan Walsh
42466e2b7e Update to upstream
* policycoreutils
	* setfiles: Fix process_glob to handle error situations
	* sandbox: Allow seunshare to run as root
	* sandbox: trap sigterm to make sure sandbox
	* sandbox: pass DPI from the desktop
	* sandbox: seunshare: introduce helper spawn_command
	* sandbox: seunshare: introduce new filesystem helpers
	* sandbox: add -C option to not drop
	* sandbox: split seunshare caps dropping
	* sandbox: use dbus-launch
	* sandbox: numerous simple updates to sandbox
	* sandbox: do not require selinux context
	* sandbox: Makefile: new man pages
	* sandbox: rename dir to srcdir
	* sandbox: allow users specify sandbox window size
	* sandbox: check for paths up front
	* sandbox: use defined values for paths rather
	* sandbox: move seunshare globals to the top
	* sandbox: whitespace fix
	* semodule_package: Add semodule_unpackage executable
	* setfiles: get rid of some stupid globals
	* setfiles: move exclude_non_seclabel_mounts to a generic location
* sepolgen
	* refparser: include open among valid permissions
	* refparser: add support for filename_trans rules
2011-08-30 16:32:33 -04:00
Dan Walsh
8b0727dc56 Fix bug in glob handling for restorecon 2011-08-23 17:13:19 -04:00
Dan Walsh
dafba41234 Update to upstream
2.1.4 2011-08-17
	* run_init: clarification of the usage in the
	* semanage: fix usage header around booleans
	* semanage: remove useless empty lines
	* semanage: update man page with new examples
	* semanage: update usage text
	* semanage: introduce file context equivalencies
	* semanage: enable and disable modules
	* semanage: output all local modifications
	* semanage: introduce extraction of local configuration
	* semanage: cleanup error on invalid operation
	* semanage: handle being called with no arguments
	* semanage: return sooner to save CPU time
	* semanage: surround getopt with try/except
	* semanage: use define/raise instead of lots of
	* semanage: some options are only valid for
	* semanage: introduce better deleteall support
	* semanage: do not allow spaces in file
	* semanage: distinguish between builtin and local permissive
	* semanage: centralized ip node handling
	* setfiles: make the restore function exclude() non-static
	* setfiles: use glob to handle ~ and
	* fixfiles: do not hard code types
	* fixfiles: stop trying to be smart about
	* fixfiles: use new kernel seclabel option
	* fixfiles: pipe everything to cat before sending
	* fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs
	* semodule: support for alternative root paths
2011-08-22 13:35:58 -04:00
Dan Walsh
831d6fd46c Update to upstream
2.1.4 2011-08-17
	* run_init: clarification of the usage in the
	* semanage: fix usage header around booleans
	* semanage: remove useless empty lines
	* semanage: update man page with new examples
	* semanage: update usage text
	* semanage: introduce file context equivalencies
	* semanage: enable and disable modules
	* semanage: output all local modifications
	* semanage: introduce extraction of local configuration
	* semanage: cleanup error on invalid operation
	* semanage: handle being called with no arguments
	* semanage: return sooner to save CPU time
	* semanage: surround getopt with try/except
	* semanage: use define/raise instead of lots of
	* semanage: some options are only valid for
	* semanage: introduce better deleteall support
	* semanage: do not allow spaces in file
	* semanage: distinguish between builtin and local permissive
	* semanage: centralized ip node handling
	* setfiles: make the restore function exclude() non-static
	* setfiles: use glob to handle ~ and
	* fixfiles: do not hard code types
	* fixfiles: stop trying to be smart about
	* fixfiles: use new kernel seclabel option
	* fixfiles: pipe everything to cat before sending
	* fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs
	* semodule: support for alternative root paths
2011-08-18 07:23:59 -04:00
Dan Walsh
a648c6f239 Change seunshare to send kill signals to the childs session.
Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown.
2011-07-07 14:53:37 -04:00
Dan Walsh
af0f4926da Change seunshare to send kill signals to the childs session.
Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown.
2011-07-07 14:37:24 -04:00
Dan Walsh
8dbd4d49f6 dd new restorecond service 2011-07-05 17:18:12 -04:00
Dan Walsh
759501823b Add -C option to sandbox and seunshare to maintain capabilities, otherwise
the bounding set will be dropped.
Change --cgroups short name -c rather then -C for consistancy
Fix memory and fd leaks in seunshare
2011-07-05 16:51:18 -04:00
Dan Walsh
173e9f90db Do not drop capability bounding set in seunshare, this allows sandbox to
run setuid apps.
2011-06-13 13:37:04 -04:00
Dan Walsh
24d29a5015 Add semanage-bash-completion.sh script 2011-06-10 16:33:08 -04:00
Dan Walsh
299d98087e Remove mount -o bind calls from sandbox init script
pam_namespace now has this built in.
2011-06-07 13:58:41 -04:00
Dan Walsh
dc86b007cf Pass desktop dpi to sandbox Xephyr window 2011-06-07 08:37:18 -04:00
Dan Walsh
c2ef4a0bea Allow semodule to pick alternate root for selinux files
Add ~/.config/* to restorcond_user.conf, so restorecond will watch for mislabeled files in this directory.
2011-06-06 13:01:14 -04:00
Dan Walsh
93a347a42a Fix var_spool template read_spool_files
Fix sepolgen to handle filename transitions
2011-05-25 16:20:29 -04:00
Dan Walsh
ed0051b493 Templates cleanedup by Dominic Grift 2011-05-23 17:05:41 -04:00
Dan Walsh
a7dd92d42a Clean up some of the templates for sepolgen 2011-04-29 11:54:00 -04:00
Dan Walsh
0b324049b3 Clean up some of the templates for sepolgen 2011-04-29 11:50:14 -04:00
Dan Walsh
4a56398540 Apply patches from Christoph A.
* fix sandbox title
* stop xephyr from li
Also ignore errors on sandbox include of directory missing files
2011-04-22 07:06:23 -04:00
Dan Walsh
e1285d4541 rebuild versus latest libsepol 2011-04-21 12:02:06 -04:00
Dan Walsh
588030fc2c Change fixfiles restore to delete unlabeled sockets in /tmp 2011-04-18 13:18:18 -04:00
Dan Walsh
61f1bc2068 Change fixfiles restore to delete unlabeled sockets in /tmp 2011-04-18 12:47:15 -04:00
Dan Walsh
822e503b13 rebuild versus latest libsepol 2011-04-18 09:28:27 -04:00
Dan Walsh
9f65a26864 Update to upstream
* Use correct color range in mcstrand by Richard Haines.
2011-04-13 16:52:53 -04:00
Dan Walsh
5898ea81d9 rsynccmd should run outside of execcon 2011-04-04 14:54:20 -04:00
Dan Walsh
8acc019498 rsynccmd should run outside of execcon 2011-04-01 13:29:38 -04:00
Dan Walsh
1da0399e25 rsynccmd should run outside of execcon 2011-03-30 14:42:36 -04:00
Dan Walsh
be38aa471e Rewrite seunshare to make sure /tmp is mounted stickybit owned by root 2011-03-03 13:35:37 -05:00
Dennis Gilmore
b855a50ea5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild 2011-02-09 09:39:07 -06:00
Dan Walsh
a710a4e711 - Fix sandbox policy creation with udp connect ports 2011-02-03 17:05:41 -05:00
Dan Walsh
433953b033 - Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name
- Cleanup chcat man page
2011-02-03 16:15:43 -05:00
Dan Walsh
331e9ad06d - Report full errors on OSError on Sandbox 2011-02-02 13:34:22 -05:00
Dan Walsh
e764b2d2b6 - Fix newrole hanlding of pcap 2011-01-21 15:11:31 -05:00