回退 'Pull Request !1 : update to 4.2.2'

This commit is contained in:
yanan-rock 2020-01-15 22:29:42 +08:00 committed by Gitee
parent a15ccd606f
commit 8ff43e0ad2
11 changed files with 541 additions and 71 deletions

View File

@ -0,0 +1,49 @@
From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 1/2] Do not use -Werror during build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There are new warnings when setools are built with gcc 7 therefore we
want to suppress -Werror for now
Fixes:
libqpol/policy_extend.c: In function policy_extend:
libqpol/policy_extend.c:161:27: error: %04zd directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=]
snprintf(buff, 9, "@ttr%04zd", i + 1);
^~~~~
libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295]
snprintf(buff, 9, "@ttr%04zd", i + 1);
^~~~~~~~~~~
In file included from /usr/include/stdio.h:939:0,
from /usr/include/sepol/policydb/policydb.h:53,
from libqpol/policy_extend.c:29:
/usr/include/bits/stdio2.h:64:10: note: __builtin___snprintf_chk output between 9 and 15 bytes into a destination of size 9
return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
__bos (__s), __fmt, __va_arg_pack ());
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
error: command 'gcc' failed with exit status 1
---
setup.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/setup.py b/setup.py
index 2ca44c9..9319bf6 100644
--- a/setup.py
+++ b/setup.py
@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol',
'libqpol/policy_scan.c',
'libqpol/xen_query.c'],
include_dirs=include_dirs,
- extra_compile_args=['-Werror', '-Wextra',
+ extra_compile_args=['-Wextra',
'-Waggregate-return',
'-Wfloat-equal',
'-Wformat', '-Wformat=2',
--
2.9.3

View File

@ -0,0 +1,140 @@
From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and
setools.DomainTransitionAnalysis
dta and infoflow modules require networkx which brings lot of dependencies.
These dependencies are not necessary for setools module itself as it's
used in policycoreutils.
Therefore it's better to use setools.infoflow.InfoFlowAnalysis and
setools.dta.DomainTransitionAnalysis and let the package containing
sedta and seinfoflow to require python3-networkx
---
sedta | 3 ++-
seinfoflow | 3 ++-
setools/__init__.py | 4 ++--
setoolsgui/apol/dta.py | 2 +-
setoolsgui/apol/infoflow.py | 2 +-
tests/dta.py | 3 ++-
tests/infoflow.py | 3 ++-
7 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/sedta b/sedta
index 1c76ebb..255ad49 100755
--- a/sedta
+++ b/sedta
@@ -23,6 +23,7 @@ import argparse
import logging
import setools
+import setools.dta
def print_transition(trans):
@@ -111,7 +112,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
- g = setools.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
+ g = setools.dta.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/seinfoflow b/seinfoflow
index b287921..d53bdef 100755
--- a/seinfoflow
+++ b/seinfoflow
@@ -19,6 +19,7 @@
from __future__ import print_function
import setools
+import setools.infoflow
import argparse
import sys
import logging
@@ -79,7 +80,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
m = setools.PermissionMap(args.map)
- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude)
+ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude)
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/setools/__init__.py b/setools/__init__.py
index a84c846..a53c5a7 100644
--- a/setools/__init__.py
+++ b/setools/__init__.py
@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery
from .devicetreeconquery import DevicetreeconQuery
# Information Flow Analysis
-from .infoflow import InfoFlowAnalysis
+# from .infoflow import InfoFlowAnalysis
from .permmap import PermissionMap
# Domain Transition Analysis
-from .dta import DomainTransitionAnalysis
+# from .dta import DomainTransitionAnalysis
# Policy difference
from .diff import PolicyDifference
diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py
index 0aaf13f..5b1ea20 100644
--- a/setoolsgui/apol/dta.py
+++ b/setoolsgui/apol/dta.py
@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
from PyQt5.QtGui import QPalette, QTextCursor
from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
QTreeWidgetItem
-from setools import DomainTransitionAnalysis
+from setools.dta import DomainTransitionAnalysis
from ..logtosignal import LogHandlerToSignal
from .analysistab import AnalysisTab
diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py
index 1ae16de..fdf8f7b 100644
--- a/setoolsgui/apol/infoflow.py
+++ b/setoolsgui/apol/infoflow.py
@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
from PyQt5.QtGui import QPalette, QTextCursor
from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
QTreeWidgetItem
-from setools import InfoFlowAnalysis
+from setools.infoflow import InfoFlowAnalysis
from setools.exception import UnmappedClass, UnmappedPermission
from ..logtosignal import LogHandlerToSignal
diff --git a/tests/dta.py b/tests/dta.py
index 32b9271..2bdd052 100644
--- a/tests/dta.py
+++ b/tests/dta.py
@@ -17,7 +17,8 @@
#
import unittest
-from setools import SELinuxPolicy, DomainTransitionAnalysis
+from setools import SELinuxPolicy
+from setools.dta import DomainTransitionAnalysis
from setools import TERuletype as TERT
from setools.policyrep.exception import InvalidType
from setools.policyrep.typeattr import Type
diff --git a/tests/infoflow.py b/tests/infoflow.py
index 7751dda..a21c683 100644
--- a/tests/infoflow.py
+++ b/tests/infoflow.py
@@ -17,7 +17,8 @@
#
import unittest
-from setools import SELinuxPolicy, InfoFlowAnalysis
+from setools import SELinuxPolicy
+from setools.infoflow import InfoFlowAnalysis
from setools import TERuletype as TERT
from setools.permmap import PermissionMap
from setools.policyrep.exception import InvalidType
--
2.9.3

View File

@ -0,0 +1,26 @@
From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 10 Aug 2017 08:23:47 +0200
Subject: [PATCH] bswap_* macros are defined in byteswap.h
Fixes ImportError on s390x:
/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32
---
libqpol/policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libqpol/policy.c b/libqpol/policy.c
index ae3acb5..e412be0 100644
--- a/libqpol/policy.c
+++ b/libqpol/policy.c
@@ -28,6 +28,7 @@
#include "qpol_internal.h"
#include <assert.h>
+#include <byteswap.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
--
2.13.3

View File

@ -0,0 +1,158 @@
From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Mon, 16 Apr 2018 20:46:20 +0200
Subject: [PATCH] Add support for SCTP protocol
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
libqpol/include/qpol/linux_types.h | 1 +
libqpol/policy_define.c | 5 +++++
setools/perm_map | 36 +++++++++++++++++++++++++++---
setools/policyrep/netcontext.py | 5 +++++
4 files changed, 44 insertions(+), 3 deletions(-)
diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h
index c3c056b..0985162 100644
--- a/libqpol/include/qpol/linux_types.h
+++ b/libqpol/include/qpol/linux_types.h
@@ -12,6 +12,7 @@ typedef uint16_t __u16;
#define s6_addr32 __u6_addr32
#define IPPROTO_DCCP 33
+#define IPPROTO_SCTP 132
#endif
#endif
diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c
index dcc69fc..1e623a3 100644
--- a/libqpol/policy_define.c
+++ b/libqpol/policy_define.c
@@ -44,6 +44,9 @@
#ifndef IPPROTO_DCCP
#define IPPROTO_DCCP 33
#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
#include <arpa/inet.h>
#include <stdlib.h>
#include <limits.h>
@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high)
protocol = IPPROTO_UDP;
} else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) {
protocol = IPPROTO_DCCP;
+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) {
+ protocol = IPPROTO_SCTP;
} else {
yyerror2("unrecognized protocol %s", id);
goto bad;
diff --git a/setools/perm_map b/setools/perm_map
index 0a9f91c..8bd34f5 100644
--- a/setools/perm_map
+++ b/setools/perm_map
@@ -27,7 +27,7 @@
# Look to the examples below for further clarification.
#
# Number of object classes.
-95
+96
class netlink_audit_socket 27
nlmsg_relay w 10
@@ -376,7 +376,7 @@ class file 22
quotaon b 1
swapon b 1
-class node 11
+class node 13
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -385,6 +385,8 @@ class node 11
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
enforce_dest n 1
sendto w 10
recvfrom r 10
@@ -699,6 +701,32 @@ class dccp_socket 24
relabelto w 10
listen r 1
+class sctp_socket 24
+ node_bind n 1
+ name_connect w 10
+ append w 10
+ bind w 1
+ connect w 1
+ create w 1
+ write w 10
+ relabelfrom r 10
+ ioctl n 1
+ name_bind n 1
+ sendto w 10
+ recv_msg r 10
+ send_msg w 10
+ getattr r 7
+ setattr w 7
+ accept r 1
+ getopt r 1
+ read r 10
+ setopt w 1
+ shutdown w 1
+ recvfrom r 10
+ lock n 1
+ relabelto w 10
+ listen r 1
+
class netlink_firewall_socket 24
nlmsg_write w 10
nlmsg_read r 10
@@ -973,7 +1001,7 @@ class key_socket 22
relabelto w 10
listen r 1
-class netif 10
+class netif 12
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -984,6 +1012,8 @@ class netif 10
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
class packet_socket 22
append w 10
diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py
index 9a01fc5..630b42c 100644
--- a/setools/policyrep/netcontext.py
+++ b/setools/policyrep/netcontext.py
@@ -35,6 +35,10 @@ try:
IPPROTO_DCCP = getprotobyname("dccp")
except socket.error:
IPPROTO_DCCP = 33
+try:
+ IPPROTO_SCTP = getprotobyname("sctp")
+except socket.error:
+ IPPROTO_SCTP = 132
def netifcon_factory(policy, name):
@@ -161,6 +165,7 @@ class PortconProtocol(int, PolicyEnum):
tcp = IPPROTO_TCP
udp = IPPROTO_UDP
dccp = IPPROTO_DCCP
+ sctp = IPPROTO_SCTP
class Portcon(NetContext):
--
2.18.0

BIN
4.1.1.tar.gz Normal file

Binary file not shown.

11
apol.desktop Normal file
View File

@ -0,0 +1,11 @@
[Desktop Entry]
Name=SELinux Policy Analysis
GenericName=SELinux Policy Analysis Tool
Comment=This tool can examine, search, and relate policy components and policy rules
Icon=apol
Exec=/usr/bin/apol
Type=Application
Terminal=false
Categories=System;
X-Desktop-File-Install-Version=0.2
StartupNotify=true

View File

@ -0,0 +1,25 @@
From 2082f25320e97c32d9a912908f4c50d4399b213f Mon Sep 17 00:00:00 2001
From: Chris PeBenito <pebenito@ieee.org>
Date: Fri, 29 Dec 2017 10:55:40 -0500
Subject: [PATCH 034/212] iomemconquery: Fix IomemconRange import.
---
setools/iomemconquery.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/setools/iomemconquery.py b/setools/iomemconquery.py
index 9756d8e..876252c 100644
--- a/setools/iomemconquery.py
+++ b/setools/iomemconquery.py
@@ -19,7 +19,7 @@
import logging
from .mixins import MatchContext
-from .policyrep.xencontext import IomemconRange
+from .policyrep import IomemconRange
from .query import PolicyQuery
from .util import match_range
--
2.19.1

View File

@ -0,0 +1,30 @@
From 70445d45ad0f9238b87981016a723ee9470bf8fe Mon Sep 17 00:00:00 2001
From: Chris PeBenito <pebenito@ieee.org>
Date: Wed, 5 Dec 2018 14:38:14 -0500
Subject: [PATCH 193/212] sediff: Fix bug in rendering modified nodecons.
---
sediff | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/sediff b/sediff
index 515208e..372bb5a 100755
--- a/sediff
+++ b/sediff
@@ -1328,10 +1328,9 @@ try:
print(" - {0}".format(n))
if diff.modified_nodecons and not args.stats:
print(" Modified Nodecons: {0}".format(len(diff.modified_nodecons)))
- for con, added_context, removed_context in sorted(diff.modified_nodecons,
- key=lambda x: x.rule):
- print(" * nodecon {0.address} {0.netmask} +[{1}] -[{2}];".format(
- con, added_context, removed_context))
+ for entry in sorted(diff.modified_nodecons, key=lambda x: x.rule):
+ print(" * nodecon {0} +[{1.added_context}] -[{1.removed_context}];".format(
+ entry.rule.network.with_netmask.replace("/", " "), entry))
print()
del diff.added_nodecons
--
2.19.1

Binary file not shown.

4
setools.pam Normal file
View File

@ -0,0 +1,4 @@
#%PAM-1.0
auth include config-util
account include config-util
session include config-util

View File

@ -1,121 +1,148 @@
%global sepol_ver 2.9-1
%global selinux_ver 2.9-1
%global debug_package %{nil}
Name: setools
Version: 4.1.1
Release: 15
Summary: Policy Analysis Tools for SELinux
License: GPLv2
URL: https://github.com/SELinuxProject/setools/wiki
Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz
Source1: setools.pam
Source2: apol.desktop
Name: setools
Version: 4.2.2
Release: 2
Summary: Policy analysis tools for SELinux
License: GPLv2
URL: https://github.com/SELinuxProject/setools/wiki
Source0: https://github.com/SELinuxProject/setools/archive/%{name}-%{version}.tar.gz
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
BuildRequires: flex bison glibc-devel gcc git qt5-qtbase-devel swig
BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver}
BuildRequires: python3-Cython python3-devel python3-setuptools libselinux-devel
Requires: python3-%{name} = %{version}-%{release}
Patch1: 0001-Do-not-use-Werror-during-build.patch
Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch
Patch4: 0004-Add-support-for-SCTP-protocol.patch
Patch6000: iomemconquery-Fix-IomemconRange-import.patch
Patch6001: sediff-Fix-bug-in-rendering-modified-nodecons.patch
BuildRequires: flex bison glibc-devel gcc swig git python3-setuptools
BuildRequires: qt5-qtbase-devel python2-devel python2-setuptools python3-devel
BuildRequires: libsepol-devel >= 2.8-1 libsepol-static >= 2.8-1
Requires: python3-setools = %{version}-%{release}
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
%description
SETools is a collection of graphical tools, command-line tools, and
Python modules designed to facilitate SELinux policy analysis.
SETools consists of a number of SELinux policy analysis tools, both graphical
and command line.
%package console
Summary: Policy analysis command-line tools for SELinux
License: GPLv2
Requires: python3-setools = %{version}-%{release} libselinux >= %{selinux_ver}
%package console
Summary: Console packages for setools
License: GPLv2
Requires: python3-setools = %{version}-%{release} libselinux >= 2.8-1
%description console
SETools is a collection of graphical tools, command-line tools, and
libraries designed to facilitate SELinux policy analysis.
%description console
Console packages for setools.
This package includes the following console tools:
%package console-analyses
Summary: Analyses files for setools-console
License: GPLv2
Requires: python3-setools = %{version}-%{release}
Requires: libselinux >= 2.8-1 python3-networkx
sediff Compare two policies to find differences.
seinfo List policy components.
sesearch Search rules (allow, type_transition, etc.)
%description console-analyses
Analyses files for setools-console.
%package console-analyses
Summary: Policy analysis command-line tools for SELinux
License: GPLv2
Requires: python3-setools = %{version}-%{release}
Requires: libselinux >= %{selinux_ver} python3-networkx
%package -n python2-setools
Summary: Python2 package for setools
Requires: python2-enum34 python2-setuptools
Provides: setools-python = %{version}-%{release}
Obsoletes: setools-python < %{version}-%{release}
Recommends: python2-libselinux
%{?python_provide:%python_provide python2-setools}
%description console-analyses
SETools is a collection of graphical tools, command-line tools, and
libraries designed to facilitate SELinux policy analysis.
%description -n python2-setools
Python2 package for setools
This package includes the following console tools:
sedta Perform domain transition analyses.
seinfoflow Perform information flow analyses.
%package -n python3-setools
Summary: Policy analysis tools for SELinux
Obsoletes: setools-libs < 4.0.0
Recommends: libselinux-python3
%package -n python3-setools
Summary: Python3 package for setools
Requires: python3-setuptools
Provides: setools-python3 = %{version}-%{release}
Obsoletes: setools-libs < 4.0.0
Obsoletes: setools-python3 < %{version}-%{release}
Recommends: libselinux-python3
%{?python_provide:%python_provide python3-setools}
Requires: python3-setuptools
%description -n python3-setools
SETools is a collection of graphical tools, command-line tools, and
Python 3 modules designed to facilitate SELinux policy analysis.
Python3 package for setools.
%package gui
Summary: Policy analysis graphical tools for SELinux
Requires: python3-setools = %{version}-%{release}
Requires: python3-qt5 python3-networkx
%package gui
Summary: Gui packages for setools
Requires: python3-setools = %{version}-%{release}
Requires: python3-qt5 python3-networkx
%description gui
SETools is a collection of graphical tools, command-line tools, and
Python modules designed to facilitate SELinux policy analysis.
%description gui
Gui packages for setools.
%package_help
%prep
%autosetup -n setools-%{version} -p1
%autosetup -n setools-%{version} -p1
cp -a ../setools-%{version} ../setools-%{version}-python2
%build
%py3_build
%{__python3} setup.py build
pushd ../setools-%{version}-python2
%{__python2} setup.py build
popd
%install
%py3_install
pushd ../setools-%{version}-python2
%{__python2} setup.py install --root %{buildroot}
popd
rm -rf %{buildroot}%{_bindir}
%{__python3} setup.py install --root %{buildroot}
%check
%if %{?_with_check:1}%{!?_with_check:0}
%{__python3} setup.py test
pushd ../setools-%{version}-python2
%{__python2} setup.py test
popd
%endif
%files
%files console
%files console
%defattr(-,root,root)
%{_bindir}/sediff
%{_bindir}/seinfo
%{_bindir}/sesearch
%files console-analyses
%files console-analyses
%defattr(-,root,root)
%{_bindir}/sedta
%{_bindir}/seinfoflow
%files -n python3-setools
%files -n python2-setools
%defattr(-,root,root)
%license COPYING COPYING.GPL COPYING.LGPL
%{python2_sitearch}/*
%files -n python3-setools
%defattr(-,root,root)
%license COPYING COPYING.GPL COPYING.LGPL
%{python3_sitearch}/setools
%{python3_sitearch}/setools-*
%{python3_sitearch}/setools-%{version}-*
%files gui
%files gui
%defattr(-,root,root)
%{_bindir}/apol
%{python3_sitearch}/setoolsgui
%files help
%{_mandir}/man1/apol*
%{_mandir}/man1/sedta*
%{_mandir}/man1/seinfoflow*
%{_mandir}/man1/sediff*
%{_mandir}/man1/seinfo*
%{_mandir}/man1/sesearch*
%files help
%defattr(-,root,root)
%{_mandir}/man1/*
%changelog
* Thu Jan 9 2020 openEuler Buildteam <buildteam@openeuler.org> - 4.2.2-2
- update to 4.2.2
* Wed Oct 30 2019 yanan <yanan@huawei.com> - 4.1.1-15
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:add global marco of debug_package
* Tue Sep 17 2019 openEuler Buildteam <buildteam@openeuler.org> - 4.1.1-14
- Package init