Commit graph

3419 commits

Author SHA1 Message Date
Joshua Brindle
a73f32c3e3 bump policycoreutils to 2.0.80 2010-03-07 10:04:24 -05:00
Joshua Brindle
e6bfff4372 bump libsemanage to 2.0.45 and libselinux to 2.0.92 2010-03-06 18:10:51 -05:00
Daniel J Walsh
7420787817 updated libselinux pkgconfig does not work correctly on lib64 machines.
On 02/24/2010 02:24 PM, Daniel J Walsh wrote:
>
Ignore the first patch it was missing pc.in files.

Acked-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Signed-off-by: Joshua Brindle <method@manicmethod.com>
2010-03-06 18:06:43 -05:00
Joshua Brindle
d03b941136 regenerate swig wrappers 2010-03-06 17:56:25 -05:00
Joshua Brindle
c1323f22c7 fixes to commit 847d27b8385ce77ac71df8aa58a2d298b33d1ea4
- implicit declaration of semanage_module_enabled()
- added nicer error messages when disabling or enabling modules already disabled or enabled
- fix comment

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2010-03-06 17:56:25 -05:00
Daniel J Walsh
654dcb897e Last attempt at upstreaming semodule_disable patch.
This patch allows you to disable/Enable policy modules.

It never seems to get upstreamed.  :^(

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2010-03-06 17:56:24 -05:00
Daniel J Walsh
660f70f4c4 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Fix memory leak on disabled selinux machines.
Date: Wed, 24 Feb 2010 14:15:31 -0500

I think this patch originally came from Eric Paris and was updated by
others but has not been adopted yet.  Not sure why.

Always free buf on exit.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2010-03-06 17:56:24 -05:00
Daniel J Walsh
c8d100bb03 Patch to run genhomedircon without looking at /etc/passwd
I want to change the default of libsemanage to not look for home
directories in getpwent.  This patch allows you to set the flag
usepasswd=false in the semanage.conf file. and genhomedircon will only
setup the labeling of /home, /export/home and any confined users homedirs.

If this patch is not acceptable because libsemanage is being rewritten,
I would like the functionality to be added to the new libsemanage.
2010-03-06 17:56:23 -05:00
Stephen Smalley
955f8d8e28 libselinux 2.0.91 2010-02-22 15:35:02 -05:00
Stephen Smalley
070505f16f label_file.c:434: error: implicit declaration of function 'fstat'
On Mon, 2010-02-15 at 14:19 -0800, Justin Mattock wrote:
> this is new:
>
>
> make[2]: Leaving directory `/home/kernel/selinux/libselinux/include'
> make -C src install
> make[2]: Entering directory `/home/kernel/selinux/libselinux/src'
> cc -Werror -Wall -W -Wundef -Wshadow -Wmissing-noreturn
> -Wmissing-format-attribute -I../include -I/usr/include -D_GNU_SOURCE
> -D_FILE_OFFSET_BITS=64   -c -o label_file.o label_file.c
> cc1: warnings being treated as errors
> label_file.c: In function 'init':
> label_file.c:434: error: implicit declaration of function 'fstat'
> label_file.c:436: error: implicit declaration of function 'S_ISREG'
> make[2]: *** [label_file.o] Error 1
> make[2]: Leaving directory `/home/kernel/selinux/libselinux/src'
> make[1]: *** [install] Error 2
> make[1]: Leaving directory `/home/kernel/selinux/libselinux'
> make: *** [install] Error 1
>
> three areas where this could of been created
> update glibc
> updated kernel
> update userspace(altohugh there was not vary many commits in the pull).

Newer glibc headers expose a failure to #include the required headers
for stat(2).  Also exposes a conflict in redefining close() in that
file.  Patch below should fix.
2010-02-22 15:32:20 -05:00
Stephen Smalley
0fc6c7762c libselinux: Only audit permissions specified by the policy
Only audit the permissions specified by the policy, excluding any
permissions specified via dontaudit or not specified via auditallow.
This only shows up when a single avc_has_perm() call is made with
multiple permissions where some of those permissions are dontaudit'd or
auditallow'd while others are not.  The corresponding kernel patch has
already been applied, see:
http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=b6cac5a30b325e14cda425670bb3568d3cad0aa8

Signed-off-by:  Stephen D. Smalley <sds@tycho.nsa.gov>
2010-02-22 15:32:05 -05:00
Stephen Smalley
9a1814832b libsemanage 2.0.44 2010-02-02 15:34:16 -05:00
Stephen Smalley
0b2f9ef8f3 bzip support in libsemanage and out of memory (userspace ticket 7)
On Sun, 2010-01-24 at 21:29 +0100, Guido Trentalancia wrote:
> Hi !
>
> Has anybody had any time to look at this ticket:
> http://userspace.selinuxproject.org/trac/ticket/7 ?
>
> I have experienced the same issue and verified that the problem is actually triggered by the bzip support (as pointed out by Stephen Smalley back in August). In fact, if I use bzip-blocksize=0 in semanage.conf then the problem disappears...
>
> Otherwise with a default semanage.conf and bzip enabled, I get:
>
> libsepol.module_package_read_offsets: offset greater than file size (at 4, offset 200478 -> 8192 (No such file or directory).
> libsemanage.semanage_load_module: Error while reading from module file /etc/selinux/refpolicy/modules/tmp/base.pp. (No such file or directory).
> semodule:  Failed!
>
> I am using libsepol-2.0.41 and libsemanage-2.0.42.

Looking into this more closely, I believe this is another manifestation
of:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543915#17

which was ultimately traced down to two issues:
1) A missing offset check in libsepol (fixed in libsepol 2.0.38), and
2) A bug / lack of binary mode support in the fmemopen implementation in
glibc that was later fixed, see:
http://sourceware.org/bugzilla/show_bug.cgi?id=6544

Maybe you have the older glibc still?

Looking at the libsemanage code though, I think we could in fact avoid
any dependency on fmemopen by using the native libsepol support for
operating on a memory region via sepol_policy_file_set_mem(), ala:

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2010-02-02 15:31:28 -05:00
Chad Sellers
aafcaeb751 bump policycoreutils to 2.0.79 2010-01-26 16:56:04 -05:00
Chad Sellers
3084b9a1f9 Fix double free in newrole when it fails to exec.
Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-12-30 16:59:48 -05:00
Joshua Brindle
32cf5d539b bump checkpolicy to 2.0.21, libselinux to 2.0.90 and sepolgen to 1.0.19 2009-11-27 15:03:02 -05:00
Manoj Srivastava
a69fb97edd exception.sh contains bashisms
Hi folks,

   The script, src/exception.sh, contains so called bashisms
 (constructs not supported by POSIX, but present as bash
 extensions). This means when trying to build on systems where /bin/sh
 is not bash, the build fails with an error. This patch uses bash to
 run exception.sh. This bug affects a significant subset of Debian and
 Debian derivative machines.

	manoj

Signed-off-by: Manoj Srivastava <srivasta@debian.org>
Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 14:57:44 -05:00
Joshua Brindle
48412c3930 Author: Guido Trentalancia
Email: guido@trentalancia.com
Subject: Contributed manual pages for libselinux
Date: Sat, 21 Nov 2009 20:51:17 +0100

Hello Eamon !

On Fri, 2009-11-20 at 21:42 -0500, Eamon Walsh wrote:

> Hi, thanks for doing this.  Some quick review below.

You are welcome, I suppose it was a boring task for many...

Thanks very much for reviewing the changes. And please accept my
apologies for not placing "[PATCH]" in the subject of the original post.
I had just subscribed to the list.

I left you cc address intact here...

> There is too much in matchpathcon(3) now.  It's going to need to be
> split up into different pages, perhaps the init/fini/teardown stuff in
> one page, the lookup calls in another, and the non-matchpathcon prefixed
> calls in a third page.
>
> Also, .so manpage links are needed for all the calls here.

Yes, matchpathcon is a mess. Following your guidelines, I have now
splitted the huge and messy page in several different man pages. It's
easier to consult and easier to maintain.

The first part (page) is strictly related to _init, its variant
_init_index, _fini, matchpathcon and its variant matchpathcon_index.
Nice and concise. References are provided in the "SEE ALSO" section to
the rest.

The second page describes the auxiliary lookup calls
(matchpathcon_checkmatches) and the inode associations functions
(matchpathcon_filespec_{add,destroy,eval}). The reference section points
to the main matchpathcon page.

A third page has been created for the functions that are used to set the
flags (set_matchpathcon_flags) or to configure the behaviour of the main
matchpathcon functions (set_matchpathcon_invalidcon and
set_matchpathcon_printf).

A fourth and fifth page is devoted to functions that should never had
ended up in matchpathcon (selinux_file_context_cmp and
selinux_file_context_verify in one page and selinux_lsetfilecon_default
in another one): we do not really need to save electrons needed for new
pages...

>
>
> > * print_access_vector
> >
>
> Looks good.

No modifications.

> > * security_disable
> >
>
> See the selinux.h comments for this.  It needs to be documented that
> this function can only be called at startup time.

Ok. I have stressed that now and also mentioned that after the policy
has been loaded at startup, then only "setenforce" can be used to alter
(not disable) the mode of the SELinux kernel code (for example by
placing it into "permissive" mode).

> > * security_set_boolean_list
> >
>
> a RETURN VALUE section is needed in this page, documenting at least this
> call if not the others in that page.

I have now added a "RETURN VALUE" section.

Also, to avoid confusion, I have rephrased the word "returns" in
"provides" when not strictly referring the to the return value of the
function (take for example security_get_boolean_names(), strictly
speaking the function returns an integer representing 0=success or
-1=failure, although from a conceptual point of view it also returns a
list trough modification of one of its parameters passed by reference).

Usually when an application developer looks at the "RETURN VALUE"
section it is because he/she has already planned/coded the call to the
function (and thus also the handling to parameters passed by reference)
and only needs to check for the function exit status so that it can be
handled properly at the call point.

> > * selinux_check_passwd_access
> >
>
> This is a replacement for the inconsistently named "checkPasswdAccess"
> function.  So, the existing description of checkPasswdAccess should be
> moved to this function, and checkPasswdAccess should be changed to "this
> is a deprecated alias for selinux_check_passwd_access".

Yes, I have now mentioned that checkPasswdAccess is deprecated. We are
referring to file security_compute_av.3 as the description of these two
functions lives there...

By the way, it has been pointed out that this function should not
hard-code a string. I also agree with him, there is a generic constant
for such "passwd" object class, it is defined in flask.h could be used
instead of the string, thus avoiding hard-coding and also allowing to
save a few cycles and be theoretically future-proof (if ever the name
would change, say to "password", "auth-token" or anything else).

libselinux/src/checkAccess.c.orig   2009-11-21 20:07:21.000000000
libselinux/src/checkAccess.c        2009-11-21 20:08:36.000000000
@@ -13,17 +13,12 @@ int selinux_check_passwd_access(access_v
        if (is_selinux_enabled() == 0)
                return 0;
        if (getprevcon_raw(&user_context) == 0) {
-               security_class_t passwd_class;
                struct av_decision avd;
                int retval;

-               passwd_class = string_to_security_class("passwd");
-               if (passwd_class == 0)
-                       return 0;
-
                retval = security_compute_av_raw(user_context,
                                                     user_context,
-                                                    passwd_class,
+                                                    SECCLASS_PASSWD,
                                                     requested,
                                                     &avd);

Note that the above code, should really live in the application and not
in the selinux library. It used to be like that, then for some reason it
has been introduced. Redhat's passwd and cronie are calling the library
function and thus at the moment they rely on it. But for example,
util-linux-ng has the code in it and does not call this function, as I
believe it should be. A very minor issue anyway...

> > * selinux_init_load_policy
> >
>
> A paragraph break is needed in the DESCRIPTION section before this function.

Done. I have also added a note to the already mentioned fact that after
initial policy load, SELinux cannot be anymore disabled using calls to
security_disable(3).

> > * selinux_lsetfilecon_default
> >
>
> See notes above about the matchpathcon manpage.

Yes, separate man page now.

> > * selinux_mkload_policy
> >
>
> Looks good.

No modifications.

> > * set_selinuxmnt
> >
>
> This manpage includes two static functions that are not part of the
> libselinux API (at least, not anymore) and should be removed.
>
> Also, I'm not comfortable with the description given.  Instead, use the
> comments in selinux.h, which are more accurate and verbose.
>

Please let me know if things are any better now.

I did also provide on the same day a patch for beautifying and improving
the command-line option parsing of a few utilities (a ticket had been
created by somebody). That patch provides those improvement according to
GNU-style parsing of "help" and "version" options (including long-option
variants). I think it also fixes a couple of typos here and there. Feel
free to include that patch too if you like it, so that the ticket can be
closed ! I will attach it again in another separate message: it has been
slightly modified in order to apply cleanly to the latest git snapshot.

More important, I was also thinking about fingerprinting (and
subsequently checking) the libraries with some cryptographic hash
function such as the NIST-recommended SHA2. It is beginning to be done
for security-related projects like OpenSSL, so I believe it is even more
essential for SELinux. Ever thought about anything like that ?

Best regards,

Guido

Signed-off-By: Joshua Brindle <method@manicmethod.com>
2009-11-27 14:44:41 -05:00
Guido Trentalancia
bf57d2349e Patch for Ticket #1 [1672486] (checkpolicy/checkmodule)
This patch is proposed to solve Ticket #1 [1672486] (command line
binaries should support --version and --help).

It adds handling of -h, -V and the long formats --help and --version to
all binaries (checkpolicy/checkmodule).

It also adds handling of long options for some of the available options.

Manual pages have also been updated accordingly (and a few undocumented
options have been documented).

Guido Trentalancia

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 13:39:03 -05:00
Stephen Smalley
a3ccf607a2 policycoreutils: audit2allow -l doesn't work with dmesg pipe
On Mon, 2009-08-24 at 23:37 +1000, Russell Coker wrote:
> On Mon, 24 Aug 2009, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > >>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503252
> > >>
> > >> audit2allow -l is looking for the load_policy message which does not go
> > >> to the dmesg, /var/log/messages.  Therefore the tool has no idea when
> > >> policy was last loaded.
> > >
> > > That would be a kernel bug then.
> >
> > Well I believe the messages that are intercepted by the audit.log do not go
> > into dmesg, by design. Although Steve, James or Eric could probably say for
> > sure.
>
> When auditd is not running on a Debian system with CentOS kernel
> 2.6.18-92.1.13.el5xen or Debian/Lenny kernel 2.6.26-2-xen-686 then nothing
> goes to the kernel message log which is interpreted by audit2allow as a
> candidate for the "-l" functionality.
>
> It's OK if all the AVC messages go to the audit log and "dmesg|audit2allow -l"
> gives no output.  But if all AVC messages other than the load_policy message
> go to the kernel message log then it's a bug.

Originally audit2allow used the avc: allowed message generated by
auditallow statement for load_policy to identify policy reloads.  Later
it was switched to use the MAC_POLICY_LOAD events generated by the audit
framework.  Those events should still get logged via printk if auditd is
not running, but it appears that the code (audit_printk_skb) will then
log the type= field as an integer rather than a string, and
audit2allow/sepolgen only looks for the string MAC_POLICY_LOAD.

So I suspect that this would be resolved by modifying sepolgen/audit.py
to also match on type=1403 for load messages.  Try this:

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 13:33:52 -05:00
Joshua Brindle
7b9904bef3 bump libsemanage to 2.0.43 and policycoreutils to 2.0.78 2009-11-27 13:02:43 -05:00
Manoj Srivastava
a6700ba05f libsemanage: Fix the format of the NAME lines
Each manual page should start with a "NAME" section, which lists the
name and a brief description of the page separated by "\-". These
sections are parsed by "mandb" and stored in a database for the use of
"apropos" and "whatis", so they must be in a certain format. These
manual pages apparently use the wrong format and cannot be parsed by
"mandb". This commit fixes that.

Signed-off-by: Manoj Srivastava <srivasta@debian.org>
Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:51:57 -05:00
Daniel J Walsh
70849975f8 This patch removes OUTPUT from fixfiles which was never used and was broken
Patches come from

Moray.Henderson@ict.om.org

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:44:16 -05:00
Joshua Brindle
55648ccca9 /lib/libsemanage.so.1 links to /usr/lib/libustr-1.0.so.1
Manoj Srivastava wrote:
> Hi,
>
>          As demonstrated by
>
> $ ldd /lib/libsemanage.so.1
>          linux-gate.so.1 =>   (0xb8092000)
>          libsepol.so.1 =>  /lib/libsepol.so.1 (0xb8015000)
>          libselinux.so.1 =>  /lib/libselinux.so.1 (0xb7ffa000)
>          libbz2.so.1.0 =>  /lib/libbz2.so.1.0 (0xb7fe9000)
>          libustr-1.0.so.1 =>  /usr/lib/libustr-1.0.so.1 (0xb7fbf000)
>          libc.so.6 =>  /lib/i686/cmov/libc.so.6 (0xb7e60000)
>          libdl.so.2 =>  /lib/i686/cmov/libdl.so.2 (0xb7e5c000)
>          /lib/ld-linux.so.2 (0xb8093000)
>
> 	libsemanage1 links to libustr which is located under the,
>   possible separate or external, /usr partition, which would render
>   libsemanage unusable in such setups. (This dependency has been around
>   since 2.0.9).
>
>          Should we move libsemanage1 to /usr/lib? The only reason for it
>   to be in /lib would be for early boot, where /usr might not be
>   available, but at this point, it is likely not usable without /usr
>   anyway.
>
>          manoj

Yes, I'm not sure why you'd need libsemanage during early boot, we
probably should apply this:

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:37:43 -05:00
Daniel J Walsh
0e84ca614a Small fixes for chcat in policycoreutils
chcat can generate oserror exception so need to catch and add chcat to the Makefile.

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-27 12:14:40 -05:00
Chad Sellers
3d2f8e21d2 Bump policycoreutils to 2.0.77
Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-19 17:16:03 -05:00
Chad Sellers
ae50dd55e0 Fix bug in semanage fcontext
Apparently I failed to split out the whitespace changes from a
previous patchset, and a bit of the equivalence patch of the
day snuck in. This causes a stack trace when you execute
semanage fcontext -l. This patch reverts the accidentally
included code.

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-19 15:01:13 -05:00
Chad Sellers
32ae03e8a7 semanage node -a bug
This patch fixes a bug that causes semanage node -a to not work
(failing with a python traceback). You can test the bug with any
semanage node -a command, such as:

semanage node -a -t node_t -p ipv4 -M 255.255.255.0 192.168.1.0

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-19 14:32:42 -05:00
Chad Sellers
88a57ca14b Bump policycoreutils to 2.0.76
Bump libsepol to 2.0.41
Bump libsemanage to 2.0.42
2009-11-18 16:44:55 -05:00
Daniel J Walsh
eb014c79f1 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Add modules support to semanage
Date: Thu, 12 Nov 2009 11:23:15 -0500

On 11/11/2009 01:52 PM, Chad Sellers wrote:
> On 9/30/09 2:33 PM, "Daniel J Walsh" <dwalsh@redhat.com> wrote:
>
>> Includes enable and disable.
>>
> I presume I should hold off on this patch until you have a chance to
> resubmit the libsemanage support that it relies on. Let me know if that's
> not the case.
>
> Thanks,
> Chad
>
Lets do this patch.

Moves load_policy from /usr/sbin to /sbin

Removed cruft.

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-18 15:33:00 -05:00
Manoj Srivastava
8627ab66a7 Author: Manoj Srivastava
Email: srivasta@debian.org
Subject: cannnot -> cannot and suport -> support
Date: Tue, 17 Nov 2009 10:27:57 -0600

This was reported after a lintian check found this on any package
linked with libsepol.  Closes: #556390

Signed-off-by: Manoj Srivastava <srivasta@debian.org>
Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-18 14:46:03 -05:00
Daniel J Walsh
b946922238 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: Remove setrans management from semanage
Date: Wed, 30 Sep 2009 14:07:49 -0400

This will not work correctly using the current mcstrans code base.  I believe an admin has to edit this code directly and probably should have never been added to semanage.

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-10 17:35:20 -05:00
Chad Sellers
08de9ab134 Bump policycoreutils to 2.0.75 2009-11-02 17:07:54 -05:00
Thomas Liu
2a1933d830 Author: Thomas Liu
Email: tliu@redhat.com
Subject: policycoreutils: share setfiles restore function with restorecond
Date: Wed, 19 Aug 2009 15:51:44 -0400

This is the first of two patches.

This patch splits all of the restore functionality in setfiles
into another two files, restore.c and restore.h.

The reason for this is shown in the next patch, which patches
restorecond to share this code.

To use it, instantiate a restore_opts struct with the proper options
and then pass a pointer to it into restore_init, and call restore_destroy
later.

Signed-off-by: Thomas Liu <tliu@redhat.com>
Signed-off-by: Dan Walsh <dwalsh@redhat.com>

I've rebased this so that it will apply to current trunk.

Signed-off-by: Chad Sellers <csellers@tresys.com>
2009-11-02 17:02:25 -05:00
Eamon Walsh
7cdfd6e659 Bump libsepol to 2.0.40, libselinux to 2.0.89, libsemanage to 2.0.41. 2009-10-29 15:33:37 -04:00
Eamon Walsh
12777502c6 Add pkgconfig files for libsepol, libselinux, and libsemanage.
Having a pkgconfig files allows the pkg-config tool to be used to
query the presence of the library (or a particular version of it),
and to obtain the C flags and linker arguments to build with it.

Based on Debian patches by Manoj Srivastava <srivasta@debian.org>.

Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2009-10-22 14:50:07 -04:00
Chad Sellers
6f4660679f Bump libselinux to 2.0.88 and libsemanage to 2.0.40 2009-10-22 14:00:10 -04:00
Chad Sellers
bd74c23c7b libsemanage: Add function to turn off file contexts validation
This patch adds a function to turn off file contexts validation.
We need this for cross-installs in rpm, where we install policy
into a chroot that has binaries of a different architecture which
cannot be executed on the build system. So, we would like to use
this function to disable executing setfiles. This of course means
the file contexts could be invalid, but we're willing to take
that risk.

Signed-off-by:  Chad Sellers <csellers@tresys.com>
2009-10-22 13:53:19 -04:00
Chad Sellers
7d19f9df51 libselinux: Export reset_selinux_config()
In integrating SELinux policy into rpm, we have a need to be
able to reset the configuration data (e.g. policy type) loaded
into libselinux. These values are currently loaded lazily by a
number of different functions (e.g. matchpatchcon_init()).
Since we are changing rpm to install policy, including initial
base policy, we need to be able to reload these configuration
items after the policy has been installed.

reset_selinux_config() already exists and is used by
selinux_init_load_policy() for a similar reason, but it is not
exported. This was probably intentionaly since it is not thread
safe at all. That said, rpm needs to do the same thing. This
patch makes the function public, and places a warning in the
header comment that it is not thread safe.

Signed-off-by:  Chad Sellers <csellers@tresys.com>
2009-10-21 19:41:59 -04:00
Eamon Walsh
0857e3e478 Add subdirectory .gitignore files.
These take care of executables and generated source files.

Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2009-10-20 21:25:55 -04:00
Eamon Walsh
c6fdb52eb7 Add top-level .gitignore file.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2009-10-20 17:25:59 -04:00
Joshua Brindle
f3c3bbd16a bump checkpolicy to 2.0.20, libsepol to 2.0.39, sepolgen to 1.0.18 2009-10-14 15:54:16 -04:00
Joshua Brindle
f830d96a48 Author: Joshua Brindle
Email: method@manicmethod.com
Subject: libsepol: Add support for multiple target OSes
Date: Tue, 13 Oct 2009 15:56:39 -0400

Paul Nuzzi wrote:
> On Wed, 2009-09-16 at 09:58 -0400, Joshua Brindle wrote:
>> I'd rather have separate ocontext structs for each system. That way it
>> is very easy to understand which ones apply to which system and you
>> don't get a crazy out of context ocontext struct.
>>
>
> I looked into having separate ocontext structs but that would involve
> changing a lot of files making the patch much larger and more intrusive.
>
>>>    	} u;
>>>    	union {
>>>    		uint32_t sclass;	/* security class for genfs */
>>> @@ -313,6 +323,17 @@ typedef struct genfs {
>>>    #define OCON_NODE6 6		/* IPv6 nodes */
>>>    #define OCON_NUM   7
>>>
>>> +/* object context array indices for Xen */
>>> +#define OCON_ISID    0    /* initial SIDs */
>>> +#define OCON_PIRQ    1    /* physical irqs */
>>> +#define OCON_IOPORT  2    /* io ports */
>>> +#define OCON_IOMEM   3    /* io memory */
>>> +#define OCON_DEVICE  4    /* pci devices */
>>> +#define OCON_DUMMY1  5    /* reserved */
>>> +#define OCON_DUMMY2  6    /* reserved */
>>> +#define OCON_NUM     7
>>> +
>>> +
>>>
>> Should these be namespaced? What if<random other system>  has io port
>> objects? You'd have to align them with each other and you have a mess of
>> keeping the numbers the same (you already do this with OCON_ISID)
>
> Variables have been namespaced and there is no more overlap with
> OCON_ISID.
>
>> Also we are relying on having the same number of OCON's which isn't good
>> I don't think. As much as I hate the policydb_compat_info (read: alot)
>> why aren't we using that to say how many ocons a xen policy really has?
>
> OCON_NUM is now dynamically read through policydb_compat_info.
>
>
>> This is messy, why not an ocontext_selinux_free() and
>> ocontext_xen_free() (note: I realize the xen_free() one won't do
>> anything except freep the ocontext_t)
>>
>
> done.
>
>>>    	len = buf[1];
>>> -	if (len != strlen(target_str)&&
>>> -	    (!alt_target_str || len != strlen(alt_target_str))) {
>>> -		ERR(fp->handle, "policydb string length %zu does not match "
>>> -		    "expected length %zu", len, strlen(target_str));
>>> +	if (len>   32) {
>>>
>> magic number 32?
>
> #defined.
>
> Thanks for your input.  Below is the updated patch for libsepol.
>

Acked-by: Joshua Brindle <method@manicmethod.com>

for the entire patchset with the following diff on top:

diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
index 76d8ed3..e76bb1a 100644
--- a/checkpolicy/checkpolicy.c
+++ b/checkpolicy/checkpolicy.c
@@ -100,8 +100,8 @@ unsigned int policyvers = POLICYDB_VERSION_MAX;
 void usage(char *progname)
 {
 	printf
-	    ("usage:  %s [-b] [-d] [-U handle_unknown (allow,deny,reject) [-M]"
-	     "[-c policyvers (%d-%d)] [-o output_file] [-t platform]"
+	    ("usage:  %s [-b] [-d] [-U handle_unknown (allow,deny,reject)] [-M]"
+	     "[-c policyvers (%d-%d)] [-o output_file] [-t target_platform (selinux,xen)]"
 	     "[input_file]\n",
 	     progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
 	exit(1);

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-10-14 15:49:25 -04:00
pjnuzzi
6341f6a492 sepolgen: Add support for multiple target OSes
Add support to sepolgen for new Xen ocontext identifiers.

Signed-off-by: Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-10-14 15:46:14 -04:00
Paul Nuzzi
79d10a8f98 checkpolicy: Add support for multiple target OSes
Updated patch of checkpolicy based on input.

On Tue, 2009-09-15 at 12:37 -0400, pjnuzzi wrote:
> Add support for multiple target OSes by adding the -t target option to
> checkpolicy.  Implemented the new Xen ocontext identifiers pirqcon,
> pcidevicecon, iomemcon and ioportcon.
>
> Signed-off-by: Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
>
> ---

 checkpolicy/checkpolicy.c   |   20 ++-
 checkpolicy/policy_define.c |  272
++++++++++++++++++++++++++++++++++++++++++++
 checkpolicy/policy_define.h |    4
 checkpolicy/policy_parse.y  |   29 ++++
 checkpolicy/policy_scan.l   |   10 +
 5 files changed, 330 insertions(+), 5 deletions(-)

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-10-14 15:46:09 -04:00
Paul Nuzzi
505c75aad7 libsepol: Add support for multiple target OSes
On Wed, 2009-09-16 at 09:58 -0400, Joshua Brindle wrote:
> I'd rather have separate ocontext structs for each system. That way it
> is very easy to understand which ones apply to which system and you
> don't get a crazy out of context ocontext struct.
>

I looked into having separate ocontext structs but that would involve
changing a lot of files making the patch much larger and more intrusive.

> >   	} u;
> >   	union {
> >   		uint32_t sclass;	/* security class for genfs */
> > @@ -313,6 +323,17 @@ typedef struct genfs {
> >   #define OCON_NODE6 6		/* IPv6 nodes */
> >   #define OCON_NUM   7
> >
> > +/* object context array indices for Xen */
> > +#define OCON_ISID    0    /* initial SIDs */
> > +#define OCON_PIRQ    1    /* physical irqs */
> > +#define OCON_IOPORT  2    /* io ports */
> > +#define OCON_IOMEM   3    /* io memory */
> > +#define OCON_DEVICE  4    /* pci devices */
> > +#define OCON_DUMMY1  5    /* reserved */
> > +#define OCON_DUMMY2  6    /* reserved */
> > +#define OCON_NUM     7
> > +
> > +
> >
> Should these be namespaced? What if <random other system> has io port
> objects? You'd have to align them with each other and you have a mess of
> keeping the numbers the same (you already do this with OCON_ISID)

Variables have been namespaced and there is no more overlap with
OCON_ISID.

> Also we are relying on having the same number of OCON's which isn't good
> I don't think. As much as I hate the policydb_compat_info (read: alot)
> why aren't we using that to say how many ocons a xen policy really has?

OCON_NUM is now dynamically read through policydb_compat_info.

> This is messy, why not an ocontext_selinux_free() and
> ocontext_xen_free() (note: I realize the xen_free() one won't do
> anything except freep the ocontext_t)
>

done.

> >
> >   	len = buf[1];
> > -	if (len != strlen(target_str)&&
> > -	    (!alt_target_str || len != strlen(alt_target_str))) {
> > -		ERR(fp->handle, "policydb string length %zu does not match "
> > -		    "expected length %zu", len, strlen(target_str));
> > +	if (len>  32) {
> >
>
> magic number 32?

#defined.

Thanks for your input.  Below is the updated patch for libsepol.

----

 libsepol/include/sepol/policydb/policydb.h |   28 ++
 libsepol/src/expand.c                      |   85 +++++++-
 libsepol/src/policydb.c                    |  295
+++++++++++++++++++++++------
 libsepol/src/policydb_internal.h           |    1
 libsepol/src/private.h                     |    4
 libsepol/src/write.c                       |   93 ++++++++-
 6 files changed, 443 insertions(+), 63 deletions(-)

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-10-14 15:45:46 -04:00
Joshua Brindle
0e421afd55 bump libselinux to 2.0.87 and libsemanage to 2.0.39 2009-09-28 16:17:30 -04:00
Daniel J Walsh
00f0d550d5 Author: Daniel J Walsh
Email: dwalsh@redhat.com
Subject: refpolicy: nsalibselinux_utils_matchpathcon.c changes
Date: Tue, 07 Jul 2009 12:30:52 -0400

--text follows this line--

Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-09-28 16:17:23 -04:00
Joshua Brindle
94c51ba3b1 make swigify 2009-09-28 16:17:11 -04:00
Joshua Brindle
8569b09417 This updates commit 66d0760007
This seems to work better on my system (aux-info on temp.c didn't do anything)

Also it fixes the noted Makefile issues
2009-09-28 16:17:04 -04:00