Compare commits
11 Commits
Author | SHA1 | Date | |
---|---|---|---|
|
392fa03072 | ||
|
17d137e658 | ||
|
d8501aad3c | ||
|
69eb1aef5e | ||
|
8b928d80e8 | ||
|
9a9e7b5d7e | ||
|
493b35df7b | ||
|
c77a77e39c | ||
|
cd558df935 | ||
|
5785621283 | ||
|
396291943b |
90
0001-Make-seinfo-output-predictable.patch
Normal file
90
0001-Make-seinfo-output-predictable.patch
Normal file
@ -0,0 +1,90 @@
|
|||||||
|
From 8ed316d6bfb65e5e9b57f3761ea8490022ab3a05 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
Date: Thu, 18 Nov 2021 13:59:08 +0100
|
||||||
|
Subject: [PATCH] Make seinfo output predictable
|
||||||
|
|
||||||
|
There are few places where frozenset is used. Given that frozenset is an unordered
|
||||||
|
collection the output generated from this is unpredictable.
|
||||||
|
|
||||||
|
The following command outputs are fixed using sorted() on frozensets:
|
||||||
|
|
||||||
|
seinfo --constrain
|
||||||
|
seinfo --common
|
||||||
|
seinfo -c -x
|
||||||
|
seinfo -r -x
|
||||||
|
seinfo -u -x
|
||||||
|
|
||||||
|
Fixes: https://github.com/SELinuxProject/setools/issues/65
|
||||||
|
|
||||||
|
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
---
|
||||||
|
setools/policyrep/constraint.pxi | 2 +-
|
||||||
|
setools/policyrep/objclass.pxi | 4 ++--
|
||||||
|
setools/policyrep/role.pxi | 2 +-
|
||||||
|
setools/policyrep/user.pxi | 2 +-
|
||||||
|
4 files changed, 5 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/setools/policyrep/constraint.pxi b/setools/policyrep/constraint.pxi
|
||||||
|
index 01c63d87425b..0b4c5b9bcf6a 100644
|
||||||
|
--- a/setools/policyrep/constraint.pxi
|
||||||
|
+++ b/setools/policyrep/constraint.pxi
|
||||||
|
@@ -72,7 +72,7 @@ cdef class Constraint(BaseConstraint):
|
||||||
|
|
||||||
|
def statement(self):
|
||||||
|
if len(self.perms) > 1:
|
||||||
|
- perms = "{{ {0} }}".format(' '.join(self.perms))
|
||||||
|
+ perms = "{{ {0} }}".format(' '.join(sorted(self.perms)))
|
||||||
|
else:
|
||||||
|
# convert to list since sets cannot be indexed
|
||||||
|
perms = list(self.perms)[0]
|
||||||
|
diff --git a/setools/policyrep/objclass.pxi b/setools/policyrep/objclass.pxi
|
||||||
|
index b7ec7b7de5c3..8ed2be5a9bed 100644
|
||||||
|
--- a/setools/policyrep/objclass.pxi
|
||||||
|
+++ b/setools/policyrep/objclass.pxi
|
||||||
|
@@ -75,7 +75,7 @@ cdef class Common(PolicySymbol):
|
||||||
|
return other in self.perms
|
||||||
|
|
||||||
|
def statement(self):
|
||||||
|
- return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(self.perms))
|
||||||
|
+ return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(sorted(self.perms)))
|
||||||
|
|
||||||
|
|
||||||
|
cdef class ObjClass(PolicySymbol):
|
||||||
|
@@ -204,7 +204,7 @@ cdef class ObjClass(PolicySymbol):
|
||||||
|
|
||||||
|
# a class that inherits may not have additional permissions
|
||||||
|
if len(self.perms) > 0:
|
||||||
|
- stmt += "{{\n\t{0}\n}}".format('\n\t'.join(self.perms))
|
||||||
|
+ stmt += "{{\n\t{0}\n}}".format('\n\t'.join(sorted(self.perms)))
|
||||||
|
|
||||||
|
return stmt
|
||||||
|
|
||||||
|
diff --git a/setools/policyrep/role.pxi b/setools/policyrep/role.pxi
|
||||||
|
index 9a0dd39f27d9..3af8a3f72a1f 100644
|
||||||
|
--- a/setools/policyrep/role.pxi
|
||||||
|
+++ b/setools/policyrep/role.pxi
|
||||||
|
@@ -58,7 +58,7 @@ cdef class Role(PolicySymbol):
|
||||||
|
if count == 1:
|
||||||
|
stmt += " types {0}".format(types[0])
|
||||||
|
else:
|
||||||
|
- stmt += " types {{ {0} }}".format(' '.join(types))
|
||||||
|
+ stmt += " types {{ {0} }}".format(' '.join(sorted(types)))
|
||||||
|
|
||||||
|
stmt += ";"
|
||||||
|
return stmt
|
||||||
|
diff --git a/setools/policyrep/user.pxi b/setools/policyrep/user.pxi
|
||||||
|
index 9c82aa92eb72..e37af2939820 100644
|
||||||
|
--- a/setools/policyrep/user.pxi
|
||||||
|
+++ b/setools/policyrep/user.pxi
|
||||||
|
@@ -81,7 +81,7 @@ cdef class User(PolicySymbol):
|
||||||
|
if count == 1:
|
||||||
|
stmt += roles[0]
|
||||||
|
else:
|
||||||
|
- stmt += "{{ {0} }}".format(' '.join(roles))
|
||||||
|
+ stmt += "{{ {0} }}".format(' '.join(sorted(roles)))
|
||||||
|
|
||||||
|
if self._level:
|
||||||
|
stmt += " level {0.mls_level} range {0.mls_range};".format(self)
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
3
rpminspect.yaml
Normal file
3
rpminspect.yaml
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
emptyrpm:
|
||||||
|
expected_empty:
|
||||||
|
- setools
|
28
setools.spec
28
setools.spec
@ -1,9 +1,9 @@
|
|||||||
%global sepol_ver 3.2-1
|
%global sepol_ver 3.4-1
|
||||||
%global selinux_ver 3.2-1
|
%global selinux_ver 3.4-1
|
||||||
|
|
||||||
Name: setools
|
Name: setools
|
||||||
Version: 4.4.0
|
Version: 4.4.0
|
||||||
Release: 3%{?dist}
|
Release: 9%{?dist}
|
||||||
Summary: Policy analysis tools for SELinux
|
Summary: Policy analysis tools for SELinux
|
||||||
|
|
||||||
License: GPLv2
|
License: GPLv2
|
||||||
@ -11,6 +11,7 @@ URL: https://github.com/SELinuxProject/setools/wiki
|
|||||||
Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz
|
Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz
|
||||||
Source1: setools.pam
|
Source1: setools.pam
|
||||||
Source2: apol.desktop
|
Source2: apol.desktop
|
||||||
|
Patch0001: 0001-Make-seinfo-output-predictable.patch
|
||||||
Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
|
Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
|
||||||
Patch1003: 1003-Require-networkx-on-package-level.patch
|
Patch1003: 1003-Require-networkx-on-package-level.patch
|
||||||
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
|
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
|
||||||
@ -69,7 +70,6 @@ This package includes the following console tools:
|
|||||||
%package -n python3-setools
|
%package -n python3-setools
|
||||||
Summary: Policy analysis tools for SELinux
|
Summary: Policy analysis tools for SELinux
|
||||||
Obsoletes: setools-libs < 4.0.0
|
Obsoletes: setools-libs < 4.0.0
|
||||||
Recommends: libselinux-python3
|
|
||||||
%{?python_provide:%python_provide python3-setools}
|
%{?python_provide:%python_provide python3-setools}
|
||||||
Requires: python3-setuptools
|
Requires: python3-setuptools
|
||||||
|
|
||||||
@ -141,6 +141,26 @@ Python modules designed to facilitate SELinux policy analysis.
|
|||||||
%{_mandir}/ru/man1/apol*
|
%{_mandir}/ru/man1/apol*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-9
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jun 16 2022 Python Maint <python-maint@redhat.com> - 4.4.0-8
|
||||||
|
- Rebuilt for Python 3.11
|
||||||
|
|
||||||
|
* Mon Jun 13 2022 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-7
|
||||||
|
- Update required userspace versions to 3.4
|
||||||
|
- Drop unnecessary Recommends
|
||||||
|
|
||||||
|
* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 4.4.0-6
|
||||||
|
- Rebuilt for Python 3.11
|
||||||
|
|
||||||
|
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-5
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||||
|
|
||||||
|
* Fri Nov 19 2021 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-4
|
||||||
|
- Make seinfo output predictable
|
||||||
|
https://github.com/SELinuxProject/setools/issues/65
|
||||||
|
|
||||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-3
|
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-3
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||||
|
|
||||||
|
64
tests/Sanity/seinfo-consistent-output/Makefile
Normal file
64
tests/Sanity/seinfo-consistent-output/Makefile
Normal file
@ -0,0 +1,64 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of Sanity/seinfo-consistent-output
|
||||||
|
# Description: Check whether different 2 or more runs of same seinfo commands produce same output
|
||||||
|
# Author: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2021 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=Sanity/seinfo-consistent-output
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Petr Lautrbach <plautrba@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Check whether different 2 or more runs of same seinfo commands produce same output" >> $(METADATA)
|
||||||
|
@echo "Type: Sanity" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: setools" >> $(METADATA)
|
||||||
|
@echo "Requires: setools-console" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Bug: 2019962" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
3
tests/Sanity/seinfo-consistent-output/PURPOSE
Normal file
3
tests/Sanity/seinfo-consistent-output/PURPOSE
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
PURPOSE of Sanity/seinfo-consistent-output
|
||||||
|
Description: Check whether different 2 or more runs of same seinfo commands produce same output
|
||||||
|
Author: Petr Lautrbach <plautrba@redhat.com>
|
64
tests/Sanity/seinfo-consistent-output/runtest.sh
Executable file
64
tests/Sanity/seinfo-consistent-output/runtest.sh
Executable file
@ -0,0 +1,64 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of Sanity/seinfo-consistent-output
|
||||||
|
# Description: Check whether different 2 or more runs of same seinfo commands produce same output
|
||||||
|
# Author: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2021 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="setools-console"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
commands=(
|
||||||
|
"seinfo --all -x"
|
||||||
|
"seinfo --constrain"
|
||||||
|
"seinfo --common"
|
||||||
|
"seinfo -c -x"
|
||||||
|
"seinfo -r -x"
|
||||||
|
"seinfo -u -x"
|
||||||
|
)
|
||||||
|
|
||||||
|
for c in "${commands[@]}"; do
|
||||||
|
|
||||||
|
rlPhaseStartTest "$c"
|
||||||
|
rlRun "$c > 1.out"
|
||||||
|
rlRun "$c > 2.out"
|
||||||
|
rlRun "cmp 1.out 2.out" 0
|
||||||
|
rlPhaseEnd
|
||||||
|
done
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
@ -19,3 +19,4 @@
|
|||||||
tests:
|
tests:
|
||||||
- Sanity/sedta
|
- Sanity/sedta
|
||||||
- Regression/The-setools-package-doesn-t-install-any-tools
|
- Regression/The-setools-package-doesn-t-install-any-tools
|
||||||
|
- Sanity/seinfo-consistent-output
|
||||||
|
Loading…
Reference in New Issue
Block a user