Commit Graph

63 Commits

Author SHA1 Message Date
Dan Walsh
2b7d10b4f0 Update to upstream
* Properly build the swig exception file from Laurent Bigonville.
	* Fix man pages from Laurent Bigonville.
	* Support overriding PATH and INITDIR in Makefile from Laurent Bigonville.
	* Fix LDFLAGS usage from Laurent Bigonville.
	* Fix init_policy warning from Laurent Bigonville.
	* Fix semanage logging from Laurent Bigonville.
	* Open newrole stdin as read/write from Sven Vermeulen.
	* Fix sepolicy transition from Sven Vermeulen.
	* Support overriding CFLAGS from Simon Ruderich.
	* Create correct man directory for run_init from Russell Coker.
	* restorecon GLOB_BRACE change from Michal Trunecka.
	* Extend audit2why to report additional constraint information.
	* Catch IOError errors within audit2allow from Dan Walsh.
	* semanage export/import fixes from Dan Walsh.
	* Improve setfiles progress reporting from Dan Walsh.
	* Document setfiles -o option in usage from Dan Walsh.
	* Change setfiles to always return -1 on failure from Dan Walsh.
	* Improve setsebool error r eporting from Dan Walsh.
	* Major overhaul of gui from Dan Walsh.
	* Fix sepolicy handling of non-MLS policy from Dan Walsh.
	* Support returning type aliases from Dan Walsh.
	* Add sepolicy tests from Dan Walsh.
	* Add org.selinux.config.policy from Dan Walsh.
	* Improve range and user input checking by semanage from Dan Walsh.
	* Prevent source or target arguments that end with / for substitutions from Dan Walsh.
	* Allow use of <<none>> for semanage fcontext from Dan Walsh.
        * Report customized user levels from Dan Walsh.
	* Support deleteall for restoring disabled modules from Dan Walsh.
	* Improve semanage error reporting from Dan Walsh.
	* Only list disabled modules for module locallist from Dan Walsh.
	* Fix logging from Dan Walsh.
	* Define new constants for file type character codes from Dan Walsh.
	* Improve bash completions from Dan Walsh.
	* Convert semanage to argparse from Dan Walsh (originally by Dave Quigley).
	* Add semanage tests from Dan Walsh.
	* Split semanage man pages from Dan Walsh.
	* Move bash completion scripts from Dan Walsh.
	* Replace genhomedircon script with a link to semodule from Dan Walsh.
	* Fix fixfiles from Dan Walsh.
	* Add support for systemd service for restorecon from Dan Walsh.
	* Spelling corrections from Dan Walsh.
	* Improve sandbox support for home dir symlinks and file caps from Dan Walsh.
	* Switch sandbox to openbox window manager from Dan Walsh.
	* Coalesce audit2why and audit2allow from Dan Walsh.
	* Change audit2allow to append to output file from Dan Walsh.
	* Update translations from Dan Walsh.
	* Change audit2why to use selinux_current_policy_path from Dan Walsh.
2013-10-31 10:06:05 -04:00
Dan Walsh
e9b167e78d Fix audit2allow output to better align analysys with the allow rules
- Apply Miroslav Grepl patch to clean up sepolicy generate usage
- Apply Miroslav Grepl patch to fixupt handing of admin_user generation
- Update Tranlslations
2013-03-27 14:00:16 -04:00
Dan Walsh
c1e35cdc89 sepolgen-ifgen needs to handle filename transition rules containing ":" 2013-03-21 10:52:00 -04:00
Dan Walsh
71f3efb73d sepolicy manpage:
-   use nroff instead of man2html
-   Remove checking for name of person who created the man page
- audit2allow
-   Fix output to show the level that is different.
2013-03-19 17:00:25 -04:00
Dan Walsh
8be0816a98 sepolicy manpage:
-   use nroff instead of man2html
-   Remove checking for name of person who created the man page
- audit2allow
-   Fix output to show the level that is different.
2013-03-19 16:58:35 -04:00
Dan Walsh
0e639a9ea0 Update to upstream 2013-02-08 09:44:20 -05:00
Dan Walsh
eef44bd006 Additional changes for bash completsion and generate man page to match the w
-  Add newtype as a new qualifier to sepolicy generate.  This new mechanism wil
-  a policy write to generate types after the initial policy has been written a
-  will autogenerate all of the interfaces.
-  I also added a -w options to allow policy writers from the command line to s
-  the writable directories of files.
-
-  Modify network.py to include interface definitions for newly created port type
-  Standardize of te_types just like all of the other templates.
2013-01-21 13:37:48 -06:00
Dan Walsh
06ab21ffa7 Additional patch from Miroslav to handle role attributes 2013-01-09 12:08:37 -05:00
Dan Walsh
422fcbbd1a Update with Miroslav patch to handle role attributes
- Update Translations
- import sepolicy will only throw exception on missing policy iff selinux is enabled
2013-01-09 08:37:32 -05:00
rhatdan
655a2656e3 Add Miroslav Grepl patch to generate html man pages
- Update Translations
- Add option to sandbox to shred files before deleting
2012-10-25 13:58:08 -04:00
rhatdan
775d48fd41 Update to upstream
* genhomedircon: manual page improvements
	* setfiles/restorecon minor improvements
	* run_init: If open_init_pty is not available then just use exec
	* newrole: do not drop capabilities when newrole is run as
	* restorecon: only update type by default
	* scripts: Don't syslog setfiles changes on a fixfiles restore
	* setfiles: do not syslog if no changes
	* Disable user restorecond by default
	* Make restorecon return 0 when a file has changed context
	* setfiles: Fix process_glob error handling
	* semanage: allow enable/disable under -m
	* add .tx to gitignore
	* translations: commit translations from Fedora community
	* po: silence build process
	* gui: Checking in policy to support polgengui and sepolgen.
	* gui: polgen: search for systemd subpackage when generating policy
	* gui: for exploring booleans
	* gui: system-config-selinux gui
	* Add Makefiles to support new gui code
	* gui: remove lockdown wizard
	* return equivalency records in fcontext customized
	* semanage: option to not load new policy into kernel after
	* sandbox: manpage update to describe standard types
	* setsebool: -N should not reload policy on changes
	* semodule: Add -N qualifier to no reload kernel policy
	* gui: polgen: sort selinux types of user controls
	* gui: polgen: follow symlinks and get the real path to
	* gui: Fix missing error function
	* setfiles: return errors when bad paths are given
	* fixfiles: tell restorecon to ignore missing paths
	* setsebool: error when setting multiple options
	* semanage: use boolean subs.
	* sandbox: Make sure Xephyr never listens on tcp ports
	* sepolgen: return and output constraint violation information
	* semanage: skip comments while reading external configuration files
	* restorecond: relabel all mount runtime files in the restorecond example
	* genhomedircon: dynamically create genhomedircon
	* Allow returning of bastard matches
	* sepolgen: return and output constraint violation information
	* audit2allow: one role/type pair per line
2012-09-15 08:34:36 -04:00
Dan Walsh
634c0824af Fix sepolgen/audit2allow to handle multiple role/types in avc messages properly 2012-07-27 09:42:59 -04:00
Dan Walsh
7e579fc0a2 userapps is generating sandbox code in polgengui 2012-07-19 13:21:49 -04:00
Dan Walsh
f35df462e0 Update to upstream
- policycoreutils
	* restorecond: wrong options should exit with non-zero error code
	* restorecond: Add -h option to get usage command
	* resorecond: user: fix fd leak
	* mcstrans: add -f to run in foreground
	* semanage: fix man page range and level defaults
	* semanage: bash completion for modules should include -a,-m, -d
	* semanage: manpage update for -e
	* semanage: dontaudit off should work
	* semanage: locallist option does not take an argument
	* sepolgen: Make use of setools optional within sepolgen
   - sepolgen
	* Make use of setools optional within sepolgen
	* We need to support files that have a + in them
2012-07-04 07:41:05 -04:00
Dan Walsh
186fd9068c Allow filename transitions to use + in a file name 2012-04-03 18:58:26 -04:00
Dan Walsh
273033cb24 Update to upstream
- policycoreutils
	* sandbox: do not propogate inside mounts outside
	* sandbox: Removing sandbox init script, should no longer be necessary
	* restorecond: Stop using deprecated interfaces for g_io
	* semanage: proper auditting of user changes for LSPP
	* semanage: audit message to show what record(s) and item(s) have chaged
	* scripts: Update Makefiles to handle /usrmove
	* mcstrans: Version should have been bumped on last check in
	* seunshare: Only drop caps not the Bounding Set from seunshare
	* Add bash-completion scripts for setsebool and semanage
	* newrole: Use correct capng calls in newrole
	* Fix infinite loop with inotify on 2.6.31 kernels
	* fix ftbfs with hardening flags
	* Only run setfiles if we found read-write filesystems to run it on
	* update .po files
	* remove empty po files
	* do not fail to install if unable to make load_policy lnk file
2012-03-30 15:18:42 -04:00
Dan Walsh
a0ea1de748 Add unit_file.py for sepolgen 2012-02-01 08:44:52 -05:00
Dan Walsh
685c820b6d fix sepolgen to not crash on echo "" | audit2allow
Remove sandbox init script, should no longer be necessary
2012-01-18 16:43:57 -05:00
Dan Walsh
414b6a904d Update to upstream
sepolgen
	* better analysis of why things broke
policycoreutils
	* Remove excess whitespace
	* sandbox: Add back in . functions to sandbox.init script
	* Fix Makefile to match other policycoreutils Makefiles
	* semanage: drop unused translation getopt
2011-12-21 18:18:01 +00:00
Dan Walsh
076ffc0b0a Upgrade to upstream
* sandbox: move sandbox.conf.5 to just sandbox.5
	* po: Makefile use -p to preserve times to allow multilib simultatious installs
	* of po files
	* sandbox: Allow user to specify the DPI value for X in a sandbox
	* sandbox: make sure the domain launching sandbox has at least 100 categories
	* sandbox: do not try forever to find available category set
	* sandbox: only complain if sandbox unable to launch
	* sandbox: init script run twice is still successful
	* semanage: print local and dristo equiv rules
	* semanage: check file equivalence rules for conflict
	* semanage: Make sure semanage fcontext -l -C prints even if local keys
	* are not defined
	* semanage: change src,dst to target,substitute for equivalency
	* sestatus: Updated sestatus and man pages.
	* Added SELinux config file man page.
	* add clean target to man Makefile
2011-12-06 19:30:28 -05:00
Dan Walsh
97d6c28e36 Allow ~ as a valid part of a filename in sepolgen 2011-11-16 11:26:11 -05:00
Dan Walsh
2c4e323ce5 Upgrade to policycoreutils upstream
* sandbox: Maintain the LANG environment into the sandbox
	* audit2allow: use audit2why internally
	* fixfiles: label /root but not /var/lib/BackupPC
	* semanage: update local boolean settings is dealing with localstore
	* semanage: missing modify=True
	* semanage: set modified correctly
	* restorecond: make restorecond dbuss-able
	* restorecon: Always check return code on asprintf
	* restorecond: make restorecond -u exit when terminal closes
	* sandbox: introduce package name and language stuff
	* semodule_package: remove semodule_unpackage on clean
	* fix sandbox Makefile to support DESTDIR
	* semanage: Add -o description to the semanage man page
	* make use of the new realpath_not_final function
	* setfiles: close /proc/mounts file when finished
	* semodule: Document semodule -p in man page
	* setfiles: fix use before initialized
	* restorecond: Add .local/share as a directory to watch
Upgrade to sepolgen upstream
	* Ignore permissive qualifier if found in an interface
	* Return name field in avc data
2011-11-04 10:47:42 -04:00
Dan Walsh
4f4e4913d7 Have sepolgen return name field in AVC 2011-10-13 13:29:56 -04:00
Dan Walsh
b6236f9023 Ignore permissive commands in interfaces 2011-09-29 10:56:39 -04:00
Dan Walsh
b91e98e2c2 Update to upstream
policycoreutils-2.1.6
	* sepolgen-ifgen: new attr-helper does something
	* audit2allow: use alternate policy file
	* audit2allow: sepolgen-ifgen use the attr helper
	* setfiles: switch from stat to stat64
	* setfiles: Fix potential crash using dereferenced ftsent
	* setfiles: do not wrap * output at 80 characters
	* sandbox: add -Wall and -Werror to makefile
	* sandbox: add sandbox cgroup support
	* sandbox: rewrite /tmp handling
	* sandbox: do not bind mount so much
	* sandbox: add level based kill option
	* sandbox: cntrl-c should kill entire process control group
	* Create a new preserve_tunables flag in sepol_handle_t.
	* semanage: show running and disk setting for booleans
	* semanage: Dont print heading if no items selected
	* sepolgen: audit2allow is mistakakenly not allowing valid module names
	* semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled
	* More files to ignore
	* tree: default make target to all not install
	* sandbox: do not load unused generic init functions
sepolgen-1.1.2
	* src: sepolgen: add attribute storing infrastructure
	* Change perm-map and add open to try to get better results on
	* look for booleans that might solve problems
	* sepolgen: audit2allow is mistakakenly not allowing valid module names
	* tree: default make target to all not install
2011-09-19 07:40:39 -04:00
Dan Walsh
42466e2b7e Update to upstream
* policycoreutils
	* setfiles: Fix process_glob to handle error situations
	* sandbox: Allow seunshare to run as root
	* sandbox: trap sigterm to make sure sandbox
	* sandbox: pass DPI from the desktop
	* sandbox: seunshare: introduce helper spawn_command
	* sandbox: seunshare: introduce new filesystem helpers
	* sandbox: add -C option to not drop
	* sandbox: split seunshare caps dropping
	* sandbox: use dbus-launch
	* sandbox: numerous simple updates to sandbox
	* sandbox: do not require selinux context
	* sandbox: Makefile: new man pages
	* sandbox: rename dir to srcdir
	* sandbox: allow users specify sandbox window size
	* sandbox: check for paths up front
	* sandbox: use defined values for paths rather
	* sandbox: move seunshare globals to the top
	* sandbox: whitespace fix
	* semodule_package: Add semodule_unpackage executable
	* setfiles: get rid of some stupid globals
	* setfiles: move exclude_non_seclabel_mounts to a generic location
* sepolgen
	* refparser: include open among valid permissions
	* refparser: add support for filename_trans rules
2011-08-30 16:32:33 -04:00
Dan Walsh
93a347a42a Fix var_spool template read_spool_files
Fix sepolgen to handle filename transitions
2011-05-25 16:20:29 -04:00
Daniel J Walsh
b467ef31d0 * Tue Jun 15 2010 Dan Walsh <dwalsh@redhat.com> 2.0.83-1
- Update to upstream
	* Add sandbox support from Dan Walsh with modifications from Steve Lawrence.
2010-06-21 14:11:31 +00:00
Daniel J Walsh
d98a8977c6 * Wed Jun 2 2010 Dan Walsh <dwalsh@redhat.com> 2.0.82-26
- Fix listing of booleans from audit2allow
2010-06-02 15:48:11 +00:00
Daniel J Walsh
829762e693 * Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 2.0.82-24
- Man page fixes
- sandbox fixes
Resolves: #595796
- Move seunshare to base package
2010-05-27 21:23:08 +00:00
Daniel J Walsh
6c22c6b1f6 * Fri Jan 8 2010 Dan Walsh <dwalsh@redhat.com> 2.0.78-9
- Add -e to semanage man page
- Add -D qualifier to audit2allow to generate dontaudit rules
2010-01-08 14:37:32 +00:00
Daniel J Walsh
6ed2be87b5 * Wed Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 2.0.78-8
- Speed up audit2allow processing of audit2why comments
2010-01-06 20:49:27 +00:00
Daniel J Walsh
a1bf0daa6c * Wed Dec 16 2009 Dan Walsh <dwalsh@redhat.com> 2.0.78-5
- If restorecond running as a user has no files to watch then it should exit.  (NFS Homedirs)
2009-12-16 13:21:49 +00:00
Daniel J Walsh
79944fd474 * Tue Dec 8 2009 Dan Walsh <dwalsh@redhat.com> 2.0.78-3
- Fix audit2allow to report constraints, dontaudits, types, booleans
2009-12-09 21:33:50 +00:00
Daniel J Walsh
3fbc112632 * Tue Dec 1 2009 Dan Walsh <dwalsh@redhat.com> 2.0.78-1
- Update to upstream
	* Remove non-working OUTFILE from fixfiles from Dan Walsh.
	* Additional exception handling in chcat from Dan Walsh.
2009-12-01 21:17:45 +00:00
Daniel J Walsh
48ee7275f3 * Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 2.0.71-5
- Fix sepolgen again
2009-08-19 19:02:29 +00:00
Daniel J Walsh
8efd3b07e1 * Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 2.0.71-4
- Add --boot flag to audit2allow to get all AVC messages since last boot
2009-08-19 13:08:28 +00:00
Daniel J Walsh
e96c403a63 * Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 2.0.71-4
- Add --boot flag to audit2allow to get all AVC messages since last boot
2009-08-18 19:25:04 +00:00
Daniel J Walsh
a66c52cf6b * Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 2.0.71-2
- exclude unconfined.if from sepolgen
2009-08-13 22:22:35 +00:00
Daniel J Walsh
7bb7784c7d * Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 2.0.71-1
- Fix chcat to report error on non existing file
- Update to upstream
	* Modify setfiles/restorecon checking of exclude paths.  Only check
	user-supplied exclude paths (not automatically generated ones based on
	lack of seclabel support), don't require them to be directories, and
	ignore permission denied errors on them (it is ok to exclude a path to
	which the caller lacks permission).
2009-08-13 21:55:27 +00:00
Daniel J Walsh
b61040e0cd * Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 2.0.62-14
- Fix audit2allow -a to retun /var/log/messages
2009-05-05 18:51:52 +00:00
Daniel J Walsh
28aeded808 * Wed Apr 8 2009 Dan Walsh <dwalsh@redhat.com> 2.0.62-8
- Update po files
- Add --equiv command for semanage
2009-04-09 02:05:21 +00:00
Daniel J Walsh
badeadc2fc * Wed Feb 18 2009 Dan Walsh <dwalsh@redhat.com> 2.0.62-1
- Update to upstream
	* Add btrfs to fixfiles from Dan Walsh.
	* Remove restorecond error for matching globs with multiple hard links
 	  and fix some error messages from Dan Walsh.
	* Make removing a non-existant module a warning rather than an error
	  from Dan Walsh.
	* Man page fixes from Dan Walsh.
2009-02-18 21:54:32 +00:00
Daniel J Walsh
f689b5c1ff * Tue Jan 13 2009 Dan Walsh <dwalsh@redhat.com> 2.0.61-1
- Update to upstream
	* chcat: cut categories at arbitrary point (25) from Dan Walsh
	* semodule: use new interfaces in libsemanage for compressed files
	  from Dan Walsh
	* audit2allow: string changes for usage
2009-01-13 14:09:47 +00:00
Daniel J Walsh
114d182b28 * Tue Jan 13 2009 Dan Walsh <dwalsh@redhat.com> 2.0.61-1
- Update to upstream
	* chcat: cut categories at arbitrary point (25) from Dan Walsh
	* semodule: use new interfaces in libsemanage for compressed files
	  from Dan Walsh
	* audit2allow: string changes for usage
2009-01-13 14:01:10 +00:00
Daniel J Walsh
c65f316b59 * Sat Dec 6 2008 Dan Walsh <dwalsh@redhat.com> 2.0.60-4
- Change md5 to hashlib.md5 in sepolgen
2008-12-06 12:28:04 +00:00
Daniel J Walsh
461604839c * Mon Dec 1 2008 Dan Walsh <dwalsh@redhat.com> 2.0.60-1
- Update to upstream
	* semanage: use semanage_mls_enabled() from Stephen Smalley.
2008-12-01 16:49:49 +00:00
Daniel J Walsh
8bd2afcec2 * Thu Sep 11 2008 Dan Walsh <dwalsh@redhat.com> 2.0.55-8
- Only call gen_requires once in sepolgen
2008-09-11 13:55:11 +00:00
Daniel J Walsh
e6df70d44d * Tue Jul 29 2008 Dan Walsh <dwalsh@redhat.com> 2.0.52-6
- Fix boolean handling
- Upgrade to latest sepolgen
- Update po patch
2008-07-29 14:40:15 +00:00
Daniel J Walsh
1e4d97ba6c * Tue Jul 29 2008 Dan Walsh <dwalsh@redhat.com> 2.0.52-6
- Fix boolean handling
- Upgrade to latest sepolgen
- Update po patch
2008-07-29 13:30:54 +00:00