update to 4.2.2

This commit is contained in:
zhangrui 2020-01-09 19:37:01 +08:00
parent c0fe17cb0e
commit e7d603882b
11 changed files with 71 additions and 541 deletions

View File

@ -1,49 +0,0 @@
From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 1/2] Do not use -Werror during build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There are new warnings when setools are built with gcc 7 therefore we
want to suppress -Werror for now
Fixes:
libqpol/policy_extend.c: In function policy_extend:
libqpol/policy_extend.c:161:27: error: %04zd directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=]
snprintf(buff, 9, "@ttr%04zd", i + 1);
^~~~~
libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295]
snprintf(buff, 9, "@ttr%04zd", i + 1);
^~~~~~~~~~~
In file included from /usr/include/stdio.h:939:0,
from /usr/include/sepol/policydb/policydb.h:53,
from libqpol/policy_extend.c:29:
/usr/include/bits/stdio2.h:64:10: note: __builtin___snprintf_chk output between 9 and 15 bytes into a destination of size 9
return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
__bos (__s), __fmt, __va_arg_pack ());
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
error: command 'gcc' failed with exit status 1
---
setup.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/setup.py b/setup.py
index 2ca44c9..9319bf6 100644
--- a/setup.py
+++ b/setup.py
@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol',
'libqpol/policy_scan.c',
'libqpol/xen_query.c'],
include_dirs=include_dirs,
- extra_compile_args=['-Werror', '-Wextra',
+ extra_compile_args=['-Wextra',
'-Waggregate-return',
'-Wfloat-equal',
'-Wformat', '-Wformat=2',
--
2.9.3

View File

@ -1,140 +0,0 @@
From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Feb 2017 08:17:07 +0100
Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and
setools.DomainTransitionAnalysis
dta and infoflow modules require networkx which brings lot of dependencies.
These dependencies are not necessary for setools module itself as it's
used in policycoreutils.
Therefore it's better to use setools.infoflow.InfoFlowAnalysis and
setools.dta.DomainTransitionAnalysis and let the package containing
sedta and seinfoflow to require python3-networkx
---
sedta | 3 ++-
seinfoflow | 3 ++-
setools/__init__.py | 4 ++--
setoolsgui/apol/dta.py | 2 +-
setoolsgui/apol/infoflow.py | 2 +-
tests/dta.py | 3 ++-
tests/infoflow.py | 3 ++-
7 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/sedta b/sedta
index 1c76ebb..255ad49 100755
--- a/sedta
+++ b/sedta
@@ -23,6 +23,7 @@ import argparse
import logging
import setools
+import setools.dta
def print_transition(trans):
@@ -111,7 +112,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
- g = setools.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
+ g = setools.dta.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/seinfoflow b/seinfoflow
index b287921..d53bdef 100755
--- a/seinfoflow
+++ b/seinfoflow
@@ -19,6 +19,7 @@
from __future__ import print_function
import setools
+import setools.infoflow
import argparse
import sys
import logging
@@ -79,7 +80,7 @@ else:
try:
p = setools.SELinuxPolicy(args.policy)
m = setools.PermissionMap(args.map)
- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude)
+ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude)
if args.shortest_path or args.all_paths:
if args.shortest_path:
diff --git a/setools/__init__.py b/setools/__init__.py
index a84c846..a53c5a7 100644
--- a/setools/__init__.py
+++ b/setools/__init__.py
@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery
from .devicetreeconquery import DevicetreeconQuery
# Information Flow Analysis
-from .infoflow import InfoFlowAnalysis
+# from .infoflow import InfoFlowAnalysis
from .permmap import PermissionMap
# Domain Transition Analysis
-from .dta import DomainTransitionAnalysis
+# from .dta import DomainTransitionAnalysis
# Policy difference
from .diff import PolicyDifference
diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py
index 0aaf13f..5b1ea20 100644
--- a/setoolsgui/apol/dta.py
+++ b/setoolsgui/apol/dta.py
@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
from PyQt5.QtGui import QPalette, QTextCursor
from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
QTreeWidgetItem
-from setools import DomainTransitionAnalysis
+from setools.dta import DomainTransitionAnalysis
from ..logtosignal import LogHandlerToSignal
from .analysistab import AnalysisTab
diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py
index 1ae16de..fdf8f7b 100644
--- a/setoolsgui/apol/infoflow.py
+++ b/setoolsgui/apol/infoflow.py
@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
from PyQt5.QtGui import QPalette, QTextCursor
from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
QTreeWidgetItem
-from setools import InfoFlowAnalysis
+from setools.infoflow import InfoFlowAnalysis
from setools.exception import UnmappedClass, UnmappedPermission
from ..logtosignal import LogHandlerToSignal
diff --git a/tests/dta.py b/tests/dta.py
index 32b9271..2bdd052 100644
--- a/tests/dta.py
+++ b/tests/dta.py
@@ -17,7 +17,8 @@
#
import unittest
-from setools import SELinuxPolicy, DomainTransitionAnalysis
+from setools import SELinuxPolicy
+from setools.dta import DomainTransitionAnalysis
from setools import TERuletype as TERT
from setools.policyrep.exception import InvalidType
from setools.policyrep.typeattr import Type
diff --git a/tests/infoflow.py b/tests/infoflow.py
index 7751dda..a21c683 100644
--- a/tests/infoflow.py
+++ b/tests/infoflow.py
@@ -17,7 +17,8 @@
#
import unittest
-from setools import SELinuxPolicy, InfoFlowAnalysis
+from setools import SELinuxPolicy
+from setools.infoflow import InfoFlowAnalysis
from setools import TERuletype as TERT
from setools.permmap import PermissionMap
from setools.policyrep.exception import InvalidType
--
2.9.3

View File

@ -1,26 +0,0 @@
From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 10 Aug 2017 08:23:47 +0200
Subject: [PATCH] bswap_* macros are defined in byteswap.h
Fixes ImportError on s390x:
/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32
---
libqpol/policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libqpol/policy.c b/libqpol/policy.c
index ae3acb5..e412be0 100644
--- a/libqpol/policy.c
+++ b/libqpol/policy.c
@@ -28,6 +28,7 @@
#include "qpol_internal.h"
#include <assert.h>
+#include <byteswap.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
--
2.13.3

View File

@ -1,158 +0,0 @@
From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Mon, 16 Apr 2018 20:46:20 +0200
Subject: [PATCH] Add support for SCTP protocol
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
libqpol/include/qpol/linux_types.h | 1 +
libqpol/policy_define.c | 5 +++++
setools/perm_map | 36 +++++++++++++++++++++++++++---
setools/policyrep/netcontext.py | 5 +++++
4 files changed, 44 insertions(+), 3 deletions(-)
diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h
index c3c056b..0985162 100644
--- a/libqpol/include/qpol/linux_types.h
+++ b/libqpol/include/qpol/linux_types.h
@@ -12,6 +12,7 @@ typedef uint16_t __u16;
#define s6_addr32 __u6_addr32
#define IPPROTO_DCCP 33
+#define IPPROTO_SCTP 132
#endif
#endif
diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c
index dcc69fc..1e623a3 100644
--- a/libqpol/policy_define.c
+++ b/libqpol/policy_define.c
@@ -44,6 +44,9 @@
#ifndef IPPROTO_DCCP
#define IPPROTO_DCCP 33
#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
#include <arpa/inet.h>
#include <stdlib.h>
#include <limits.h>
@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high)
protocol = IPPROTO_UDP;
} else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) {
protocol = IPPROTO_DCCP;
+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) {
+ protocol = IPPROTO_SCTP;
} else {
yyerror2("unrecognized protocol %s", id);
goto bad;
diff --git a/setools/perm_map b/setools/perm_map
index 0a9f91c..8bd34f5 100644
--- a/setools/perm_map
+++ b/setools/perm_map
@@ -27,7 +27,7 @@
# Look to the examples below for further clarification.
#
# Number of object classes.
-95
+96
class netlink_audit_socket 27
nlmsg_relay w 10
@@ -376,7 +376,7 @@ class file 22
quotaon b 1
swapon b 1
-class node 11
+class node 13
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -385,6 +385,8 @@ class node 11
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
enforce_dest n 1
sendto w 10
recvfrom r 10
@@ -699,6 +701,32 @@ class dccp_socket 24
relabelto w 10
listen r 1
+class sctp_socket 24
+ node_bind n 1
+ name_connect w 10
+ append w 10
+ bind w 1
+ connect w 1
+ create w 1
+ write w 10
+ relabelfrom r 10
+ ioctl n 1
+ name_bind n 1
+ sendto w 10
+ recv_msg r 10
+ send_msg w 10
+ getattr r 7
+ setattr w 7
+ accept r 1
+ getopt r 1
+ read r 10
+ setopt w 1
+ shutdown w 1
+ recvfrom r 10
+ lock n 1
+ relabelto w 10
+ listen r 1
+
class netlink_firewall_socket 24
nlmsg_write w 10
nlmsg_read r 10
@@ -973,7 +1001,7 @@ class key_socket 22
relabelto w 10
listen r 1
-class netif 10
+class netif 12
rawip_recv r 10
tcp_recv r 10
udp_recv r 10
@@ -984,6 +1012,8 @@ class netif 10
udp_send w 10
dccp_recv r 10
dccp_send w 10
+ sctp_recv r 10
+ sctp_send w 10
class packet_socket 22
append w 10
diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py
index 9a01fc5..630b42c 100644
--- a/setools/policyrep/netcontext.py
+++ b/setools/policyrep/netcontext.py
@@ -35,6 +35,10 @@ try:
IPPROTO_DCCP = getprotobyname("dccp")
except socket.error:
IPPROTO_DCCP = 33
+try:
+ IPPROTO_SCTP = getprotobyname("sctp")
+except socket.error:
+ IPPROTO_SCTP = 132
def netifcon_factory(policy, name):
@@ -161,6 +165,7 @@ class PortconProtocol(int, PolicyEnum):
tcp = IPPROTO_TCP
udp = IPPROTO_UDP
dccp = IPPROTO_DCCP
+ sctp = IPPROTO_SCTP
class Portcon(NetContext):
--
2.18.0

Binary file not shown.

View File

@ -1,11 +0,0 @@
[Desktop Entry]
Name=SELinux Policy Analysis
GenericName=SELinux Policy Analysis Tool
Comment=This tool can examine, search, and relate policy components and policy rules
Icon=apol
Exec=/usr/bin/apol
Type=Application
Terminal=false
Categories=System;
X-Desktop-File-Install-Version=0.2
StartupNotify=true

View File

@ -1,25 +0,0 @@
From 2082f25320e97c32d9a912908f4c50d4399b213f Mon Sep 17 00:00:00 2001
From: Chris PeBenito <pebenito@ieee.org>
Date: Fri, 29 Dec 2017 10:55:40 -0500
Subject: [PATCH 034/212] iomemconquery: Fix IomemconRange import.
---
setools/iomemconquery.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/setools/iomemconquery.py b/setools/iomemconquery.py
index 9756d8e..876252c 100644
--- a/setools/iomemconquery.py
+++ b/setools/iomemconquery.py
@@ -19,7 +19,7 @@
import logging
from .mixins import MatchContext
-from .policyrep.xencontext import IomemconRange
+from .policyrep import IomemconRange
from .query import PolicyQuery
from .util import match_range
--
2.19.1

View File

@ -1,30 +0,0 @@
From 70445d45ad0f9238b87981016a723ee9470bf8fe Mon Sep 17 00:00:00 2001
From: Chris PeBenito <pebenito@ieee.org>
Date: Wed, 5 Dec 2018 14:38:14 -0500
Subject: [PATCH 193/212] sediff: Fix bug in rendering modified nodecons.
---
sediff | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/sediff b/sediff
index 515208e..372bb5a 100755
--- a/sediff
+++ b/sediff
@@ -1328,10 +1328,9 @@ try:
print(" - {0}".format(n))
if diff.modified_nodecons and not args.stats:
print(" Modified Nodecons: {0}".format(len(diff.modified_nodecons)))
- for con, added_context, removed_context in sorted(diff.modified_nodecons,
- key=lambda x: x.rule):
- print(" * nodecon {0.address} {0.netmask} +[{1}] -[{2}];".format(
- con, added_context, removed_context))
+ for entry in sorted(diff.modified_nodecons, key=lambda x: x.rule):
+ print(" * nodecon {0} +[{1.added_context}] -[{1.removed_context}];".format(
+ entry.rule.network.with_netmask.replace("/", " "), entry))
print()
del diff.added_nodecons
--
2.19.1

BIN
setools-4.2.2.tar.gz Normal file

Binary file not shown.

View File

@ -1,4 +0,0 @@
#%PAM-1.0
auth include config-util
account include config-util
session include config-util

View File

@ -1,148 +1,121 @@
%global debug_package %{nil} %global sepol_ver 2.9-1
Name: setools %global selinux_ver 2.9-1
Version: 4.1.1
Release: 15
Summary: Policy Analysis Tools for SELinux
License: GPLv2
URL: https://github.com/SELinuxProject/setools/wiki
Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz
Source1: setools.pam
Source2: apol.desktop
Patch1: 0001-Do-not-use-Werror-during-build.patch Name: setools
Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Version: 4.2.2
Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch Release: 2
Patch4: 0004-Add-support-for-SCTP-protocol.patch Summary: Policy analysis tools for SELinux
Patch6000: iomemconquery-Fix-IomemconRange-import.patch License: GPLv2
Patch6001: sediff-Fix-bug-in-rendering-modified-nodecons.patch URL: https://github.com/SELinuxProject/setools/wiki
Source0: https://github.com/SELinuxProject/setools/archive/%{name}-%{version}.tar.gz
BuildRequires: flex bison glibc-devel gcc swig git python3-setuptools Obsoletes: setools < 4.0.0, setools-devel < 4.0.0
BuildRequires: qt5-qtbase-devel python2-devel python2-setuptools python3-devel BuildRequires: flex bison glibc-devel gcc git qt5-qtbase-devel swig
BuildRequires: libsepol-devel >= 2.8-1 libsepol-static >= 2.8-1 BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver}
Requires: python3-setools = %{version}-%{release} BuildRequires: python3-Cython python3-devel python3-setuptools libselinux-devel
Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 Requires: python3-%{name} = %{version}-%{release}
%description %description
SETools consists of a number of SELinux policy analysis tools, both graphical SETools is a collection of graphical tools, command-line tools, and
and command line. Python modules designed to facilitate SELinux policy analysis.
%package console %package console
Summary: Console packages for setools Summary: Policy analysis command-line tools for SELinux
License: GPLv2 License: GPLv2
Requires: python3-setools = %{version}-%{release} libselinux >= 2.8-1 Requires: python3-setools = %{version}-%{release} libselinux >= %{selinux_ver}
%description console %description console
Console packages for setools. SETools is a collection of graphical tools, command-line tools, and
libraries designed to facilitate SELinux policy analysis.
%package console-analyses This package includes the following console tools:
Summary: Analyses files for setools-console
License: GPLv2
Requires: python3-setools = %{version}-%{release}
Requires: libselinux >= 2.8-1 python3-networkx
%description console-analyses sediff Compare two policies to find differences.
Analyses files for setools-console. seinfo List policy components.
sesearch Search rules (allow, type_transition, etc.)
%package -n python2-setools %package console-analyses
Summary: Python2 package for setools Summary: Policy analysis command-line tools for SELinux
Requires: python2-enum34 python2-setuptools License: GPLv2
Provides: setools-python = %{version}-%{release} Requires: python3-setools = %{version}-%{release}
Obsoletes: setools-python < %{version}-%{release} Requires: libselinux >= %{selinux_ver} python3-networkx
Recommends: python2-libselinux
%{?python_provide:%python_provide python2-setools}
%description -n python2-setools %description console-analyses
Python2 package for setools SETools is a collection of graphical tools, command-line tools, and
libraries designed to facilitate SELinux policy analysis.
%package -n python3-setools This package includes the following console tools:
Summary: Python3 package for setools
Requires: python3-setuptools sedta Perform domain transition analyses.
Provides: setools-python3 = %{version}-%{release} seinfoflow Perform information flow analyses.
Obsoletes: setools-libs < 4.0.0
Obsoletes: setools-python3 < %{version}-%{release} %package -n python3-setools
Recommends: libselinux-python3 Summary: Policy analysis tools for SELinux
Obsoletes: setools-libs < 4.0.0
Recommends: libselinux-python3
%{?python_provide:%python_provide python3-setools} %{?python_provide:%python_provide python3-setools}
Requires: python3-setuptools
%description -n python3-setools %description -n python3-setools
Python3 package for setools. SETools is a collection of graphical tools, command-line tools, and
Python 3 modules designed to facilitate SELinux policy analysis.
%package gui %package gui
Summary: Gui packages for setools Summary: Policy analysis graphical tools for SELinux
Requires: python3-setools = %{version}-%{release} Requires: python3-setools = %{version}-%{release}
Requires: python3-qt5 python3-networkx Requires: python3-qt5 python3-networkx
%description gui %description gui
Gui packages for setools. SETools is a collection of graphical tools, command-line tools, and
Python modules designed to facilitate SELinux policy analysis.
%package_help %package_help
%prep %prep
%autosetup -n setools-%{version} -p1 %autosetup -n setools-%{version} -p1
cp -a ../setools-%{version} ../setools-%{version}-python2
%build %build
%{__python3} setup.py build %py3_build
pushd ../setools-%{version}-python2
%{__python2} setup.py build
popd
%install %install
pushd ../setools-%{version}-python2 %py3_install
%{__python2} setup.py install --root %{buildroot}
popd
rm -rf %{buildroot}%{_bindir}
%{__python3} setup.py install --root %{buildroot}
%check %check
%if %{?_with_check:1}%{!?_with_check:0} %if %{?_with_check:1}%{!?_with_check:0}
%{__python3} setup.py test %{__python3} setup.py test
pushd ../setools-%{version}-python2
%{__python2} setup.py test
popd
%endif %endif
%files %files
%files console %files console
%defattr(-,root,root) %defattr(-,root,root)
%{_bindir}/sediff %{_bindir}/sediff
%{_bindir}/seinfo %{_bindir}/seinfo
%{_bindir}/sesearch %{_bindir}/sesearch
%files console-analyses %files console-analyses
%defattr(-,root,root) %defattr(-,root,root)
%{_bindir}/sedta %{_bindir}/sedta
%{_bindir}/seinfoflow %{_bindir}/seinfoflow
%files -n python2-setools %files -n python3-setools
%defattr(-,root,root)
%license COPYING COPYING.GPL COPYING.LGPL
%{python2_sitearch}/*
%files -n python3-setools
%defattr(-,root,root) %defattr(-,root,root)
%license COPYING COPYING.GPL COPYING.LGPL %license COPYING COPYING.GPL COPYING.LGPL
%{python3_sitearch}/setools %{python3_sitearch}/setools
%{python3_sitearch}/setools-%{version}-* %{python3_sitearch}/setools-*
%files gui %files gui
%defattr(-,root,root) %defattr(-,root,root)
%{_bindir}/apol %{_bindir}/apol
%{python3_sitearch}/setoolsgui %{python3_sitearch}/setoolsgui
%files help %files help
%defattr(-,root,root) %{_mandir}/man1/apol*
%{_mandir}/man1/* %{_mandir}/man1/sedta*
%{_mandir}/man1/seinfoflow*
%{_mandir}/man1/sediff*
%{_mandir}/man1/seinfo*
%{_mandir}/man1/sesearch*
%changelog %changelog
* Wed Oct 30 2019 yanan <yanan@huawei.com> - 4.1.1-15 * Thu Jan 9 2020 openEuler Buildteam <buildteam@openeuler.org> - 4.2.2-2
- Type:bugfix - update to 4.2.2
- ID:NA
- SUG:NA
- DESC:add global marco of debug_package
* Tue Sep 17 2019 openEuler Buildteam <buildteam@openeuler.org> - 4.1.1-14
- Package init