From e68faf500b289ff9120062a08016c57ea3023e58 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 22 Feb 2022 10:07:05 +0100 Subject: [PATCH 01/79] policycoreutils-3.3-5 - Improve error message when selabel_open fails --- ...Improve-error-message-when-selabel_o.patch | 41 +++++++++++++++++++ policycoreutils.spec | 6 ++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 0026-policycoreutils-Improve-error-message-when-selabel_o.patch diff --git a/0026-policycoreutils-Improve-error-message-when-selabel_o.patch b/0026-policycoreutils-Improve-error-message-when-selabel_o.patch new file mode 100644 index 0000000..46617fe --- /dev/null +++ b/0026-policycoreutils-Improve-error-message-when-selabel_o.patch @@ -0,0 +1,41 @@ +From d83caa39d7ff497bddabb54619a8985227ad1264 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 10 Jan 2022 18:35:27 +0100 +Subject: [PATCH] policycoreutils: Improve error message when selabel_open + fails + +When selabel_open fails to locate file_context files and +selabel_opt_path is not specified (e.g. when the policy type is +missconfigured in /etc/selinux/config), perror only prints +"No such file or directory". +This can be confusing in case of "restorecon" since it's +not apparent that the issue is in policy store. + +Before: + \# restorecon -v /tmp/foo.txt + No such file or directory +After: + \# restorecon -v /tmp/foo.txt + /etc/selinux/yolo/contexts/files/file_contexts: No such file or directory + +Signed-off-by: Vit Mojzis +--- + policycoreutils/setfiles/restore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c +index 74d48bb3752d..e9ae33ad039a 100644 +--- a/policycoreutils/setfiles/restore.c ++++ b/policycoreutils/setfiles/restore.c +@@ -29,7 +29,7 @@ void restore_init(struct restore_opts *opts) + + opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3); + if (!opts->hnd) { +- perror(opts->selabel_opt_path); ++ perror(opts->selabel_opt_path ? opts->selabel_opt_path : selinux_file_context_path()); + exit(1); + } + +-- +2.35.1 + diff --git a/policycoreutils.spec b/policycoreutils.spec index bff54d6..afd4a43 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.3 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.3/selinux-3.3.tar.gz @@ -56,6 +56,7 @@ Patch0022: 0022-semodule-Don-t-forget-to-munmap-data.patch Patch0023: 0023-semodule-libsemanage-move-module-hashing-into-libsem.patch Patch0024: 0024-semodule-add-command-line-option-to-detect-module-ch.patch Patch0025: 0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch +Patch0026: 0026-policycoreutils-Improve-error-message-when-selabel_o.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -482,6 +483,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue Feb 22 2022 Petr Lautrbach - 3.3-5 +- Improve error message when selabel_open fails + * Sat Feb 19 2022 Petr Lautrbach - 3.3-4 - semodule: add command-line option to detect module changes - fixfiles: Use parallel relabeling From 013d1dc731a4985c9461aa23014e645d0c66defc Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 13 Apr 2022 12:59:04 +0200 Subject: [PATCH 02/79] policycoreutils-3.4-0.rc1.1 - SELinux userspace 3.4-rc1 release --- .gitignore | 1 + ...t-to-Xephyr-as-it-works-better-with-.patch | 5 +- ...RD_FILE_CONTEXT-section-in-man-pages.patch | 7 +- ...xecutable-we-don-t-want-to-print-a-p.patch | 7 +- ...sepolicy-manpage-web-functionality.-.patch | 9 +- ...e-the-trailing-newline-for-etc-syste.patch | 7 +- ...-in-manpage.py-to-not-contain-online.patch | 7 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 9 +- ...d-interface-file_type_is_executable-.patch | 63 - ...rate-Handle-more-reserved-port-types.patch | 5 +- ...hbox-window-manager-instead-of-openb.patch | 5 +- ...her-small-optimization-for-mcs-types.patch | 53 - ...ion-files-into-the-right-sub-directo.patch | 515 -- ...h => 0010-Use-SHA-2-instead-of-SHA-1.patch | 21 +- ...brary-and-binding-versions-to-3.4-rc.patch | 27 + ...ettext-domains-in-python-gui-sandbox.patch | 306 -- ...al-.pot-files-for-gui-python-sandbox.patch | 4532 ----------------- ...setfiles-Improve-description-of-d-sw.patch | 30 - ...ix-RESOURCE_LEAK-coverity-scan-defec.patch | 24 - ...-flake8-warnings-in-Fedora-only-code.patch | 46 - ...storecon-support-parallel-relabeling.patch | 253 - 0020-semodule-add-m-checksum-option.patch | 674 --- 0021-semodule-Fix-lang_ext-column-index.patch | 29 - ...semodule-Don-t-forget-to-munmap-data.patch | 32 - ...nage-move-module-hashing-into-libsem.patch | 539 -- ...mand-line-option-to-detect-module-ch.patch | 144 - ...ils-fixfiles-Use-parallel-relabeling.patch | 180 - ...Improve-error-message-when-selabel_o.patch | 41 - policycoreutils.spec | 51 +- sources | 3 +- 30 files changed, 95 insertions(+), 7530 deletions(-) delete mode 100644 0008-sepolicy-Drop-old-interface-file_type_is_executable-.patch rename 0014-sepolicy-generate-Handle-more-reserved-port-types.patch => 0008-sepolicy-generate-Handle-more-reserved-port-types.patch (96%) rename 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch => 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch (96%) delete mode 100644 0009-sepolicy-Another-small-optimization-for-mcs-types.patch delete mode 100644 0010-Move-po-translation-files-into-the-right-sub-directo.patch rename 0018-Use-SHA-2-instead-of-SHA-1.patch => 0010-Use-SHA-2-instead-of-SHA-1.patch (97%) create mode 100644 0011-Update-python-library-and-binding-versions-to-3.4-rc.patch delete mode 100644 0011-Use-correct-gettext-domains-in-python-gui-sandbox.patch delete mode 100644 0012-Initial-.pot-files-for-gui-python-sandbox.patch delete mode 100644 0013-policycoreutils-setfiles-Improve-description-of-d-sw.patch delete mode 100644 0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch delete mode 100644 0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch delete mode 100644 0019-setfiles-restorecon-support-parallel-relabeling.patch delete mode 100644 0020-semodule-add-m-checksum-option.patch delete mode 100644 0021-semodule-Fix-lang_ext-column-index.patch delete mode 100644 0022-semodule-Don-t-forget-to-munmap-data.patch delete mode 100644 0023-semodule-libsemanage-move-module-hashing-into-libsem.patch delete mode 100644 0024-semodule-add-command-line-option-to-detect-module-ch.patch delete mode 100644 0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch delete mode 100644 0026-policycoreutils-Improve-error-message-when-selabel_o.patch diff --git a/.gitignore b/.gitignore index 2293863..15feec5 100644 --- a/.gitignore +++ b/.gitignore @@ -340,3 +340,4 @@ policycoreutils-2.0.83.tgz /selinux-3.3-rc2.tar.gz /selinux-3.3-rc3.tar.gz /selinux-3.3.tar.gz +/selinux-3.4-rc1.tar.gz diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index 67d6dc3..92d7aed 100644 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,8 +1,9 @@ -From ec3bf6f3e5468ba7b5164cc588ef5746454808a5 Mon Sep 17 00:00:00 2001 +From 3c7290a99b22de343611dd61e8cd6d5b1bfb9825 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in recent Fedoras +Content-type: text/plain --- sandbox/sandboxX.sh | 2 +- @@ -22,5 +23,5 @@ index eaa500d08143..4774528027ef 100644 cat > ~/seremote << __EOF #!/bin/sh -- -2.32.0 +2.35.1 diff --git a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch b/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch index 73b45fd..157bdb9 100644 --- a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch +++ b/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch @@ -1,7 +1,8 @@ -From 7a548cae4303f8429040ba6be67be182b7f9a943 Mon Sep 17 00:00:00 2001 +From a7d5ba145b86f48e6ebb3964ac64feebd062025a Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Mon, 21 Apr 2014 13:54:40 -0400 Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages +Content-type: text/plain Signed-off-by: Miroslav Grepl --- @@ -9,7 +10,7 @@ Signed-off-by: Miroslav Grepl 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 2f847abb87e2..dccd778ed4be 100755 +index 3e61e333193f..82338aeeef32 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -737,10 +737,13 @@ Default Defined Ports:""") @@ -42,5 +43,5 @@ index 2f847abb87e2..dccd778ed4be 100755 self.fd.write(r""" .I The following file types are defined for %(domainname)s: -- -2.32.0 +2.35.1 diff --git a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch b/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch index 9ff8301..2eb393d 100644 --- a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch +++ b/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch @@ -1,15 +1,16 @@ -From b3cb362afe86278c600d6e97cc7abf9c0b102071 Mon Sep 17 00:00:00 2001 +From 25a80e4bfa1c0b9814ddaaae119b694f7e7a33d7 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Mon, 12 May 2014 14:11:22 +0200 Subject: [PATCH] If there is no executable we don't want to print a part of STANDARD FILE CONTEXT +Content-type: text/plain --- python/sepolicy/sepolicy/manpage.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index dccd778ed4be..81333928d552 100755 +index 82338aeeef32..c9a6291a8b40 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -795,7 +795,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d @@ -23,5 +24,5 @@ index dccd778ed4be..81333928d552 100755 .B STANDARD FILE CONTEXT -- -2.32.0 +2.35.1 diff --git a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch b/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch index 87b58c2..e567b95 100644 --- a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch +++ b/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch @@ -1,9 +1,10 @@ -From b954ff8379e03714f707daa85111f6bf2f265772 Mon Sep 17 00:00:00 2001 +From 874b3757c4a7c7faa3166f66a897a21630faf55e Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Thu, 19 Feb 2015 17:45:15 +0100 Subject: [PATCH] Simplication of sepolicy-manpage web functionality. system_release is no longer hardcoded and it creates only index.html and html man pages in the directory for the system release. +Content-type: text/plain --- python/sepolicy/sepolicy/__init__.py | 25 +++-------- @@ -11,7 +12,7 @@ Subject: [PATCH] Simplication of sepolicy-manpage web functionality. 2 files changed, 13 insertions(+), 77 deletions(-) diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index e8654abbceb3..a2475d22547a 100644 +index 203ca25f4210..9447812b7450 100644 --- a/python/sepolicy/sepolicy/__init__.py +++ b/python/sepolicy/sepolicy/__init__.py @@ -1225,27 +1225,14 @@ def boolean_desc(boolean): @@ -49,7 +50,7 @@ index e8654abbceb3..a2475d22547a 100644 def reinit(): diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 81333928d552..dc3e5207c57c 100755 +index c9a6291a8b40..d0c9bb840b26 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -151,10 +151,6 @@ def prettyprint(f, trim): @@ -165,5 +166,5 @@ index 81333928d552..dc3e5207c57c 100755 if len(self.manpage_roles[letter]): fd.write(""" -- -2.32.0 +2.35.1 diff --git a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch b/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch index 7d20801..5f091c9 100644 --- a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch +++ b/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch @@ -1,15 +1,16 @@ -From 7572bbec8b6a422e722864348a53d5e0f855e7f6 Mon Sep 17 00:00:00 2001 +From aba96cf4c6f692b4cdd60bf9097f02409a11a996 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Fri, 20 Feb 2015 16:42:01 +0100 Subject: [PATCH] We want to remove the trailing newline for /etc/system_release. +Content-type: text/plain --- python/sepolicy/sepolicy/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index a2475d22547a..8055a12f6020 100644 +index 9447812b7450..aa8beda313c8 100644 --- a/python/sepolicy/sepolicy/__init__.py +++ b/python/sepolicy/sepolicy/__init__.py @@ -1228,7 +1228,7 @@ def get_os_version(): @@ -22,5 +23,5 @@ index a2475d22547a..8055a12f6020 100644 system_release = "Misc" -- -2.32.0 +2.35.1 diff --git a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch b/0006-Fix-title-in-manpage.py-to-not-contain-online.patch index 8af8682..0221da4 100644 --- a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch +++ b/0006-Fix-title-in-manpage.py-to-not-contain-online.patch @@ -1,14 +1,15 @@ -From a4d59dcce863a02895fe40e487176149f3a4ad5b Mon Sep 17 00:00:00 2001 +From 852c8eb32fb2d0f224cdfec211f4c483c4423a8b Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Fri, 20 Feb 2015 16:42:53 +0100 Subject: [PATCH] Fix title in manpage.py to not contain 'online'. +Content-type: text/plain --- python/sepolicy/sepolicy/manpage.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index dc3e5207c57c..6420ebe2e08e 100755 +index d0c9bb840b26..581b5e85652c 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -222,7 +222,7 @@ class HTMLManPages: @@ -21,5 +22,5 @@ index dc3e5207c57c..6420ebe2e08e 100755

SELinux man pages for %s

-- -2.32.0 +2.35.1 diff --git a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index 216cdb2..0795825 100644 --- a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,14 +1,15 @@ -From f183dd36c66069c95726e1dab47639e76077d86a Mon Sep 17 00:00:00 2001 +From add9d39a077e4288c71b00e9e92e5bf673070ac2 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty +Content-type: text/plain --- policycoreutils/scripts/fixfiles | 1 + 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 6fb12e0451a9..cb20002ab613 100755 +index 7df4303a7ad3..dfd8929b4bbc 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { @@ -17,8 +18,8 @@ index 6fb12e0451a9..cb20002ab613 100755 VERBOSE="-p" +[ -t 1 ] || VERBOSE="" FORCEFLAG="" + THREADS="" RPMFILES="" - PREFC="" -- -2.32.0 +2.35.1 diff --git a/0008-sepolicy-Drop-old-interface-file_type_is_executable-.patch b/0008-sepolicy-Drop-old-interface-file_type_is_executable-.patch deleted file mode 100644 index 20bf928..0000000 --- a/0008-sepolicy-Drop-old-interface-file_type_is_executable-.patch +++ /dev/null @@ -1,63 +0,0 @@ -From fae31a306e7b6084710c02b658ace668766fc004 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 27 Feb 2017 17:12:39 +0100 -Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and - file_type_is_entrypoint(f) - -- use direct queries -- load exec_types and entry_types only once ---- - python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++-- - 1 file changed, 20 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 6420ebe2e08e..d15522135288 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -127,8 +127,24 @@ def gen_domains(): - domains.sort() - return domains - --types = None - -+exec_types = None -+ -+def _gen_exec_types(): -+ global exec_types -+ if exec_types is None: -+ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"] -+ return exec_types -+ -+entry_types = None -+ -+def _gen_entry_types(): -+ global entry_types -+ if entry_types is None: -+ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"] -+ return entry_types -+ -+types = None - - def _gen_types(): - global types -@@ -374,6 +390,8 @@ class ManPage: - self.all_file_types = sepolicy.get_all_file_types() - self.role_allows = sepolicy.get_all_role_allows() - self.types = _gen_types() -+ self.exec_types = _gen_exec_types() -+ self.entry_types = _gen_entry_types() - - if self.source_files: - self.fcpath = self.root + "file_contexts" -@@ -691,7 +709,7 @@ Default Defined Ports:""") - for f in self.all_file_types: - if f.startswith(self.domainname): - flist.append(f) -- if not file_type_is_executable(f) or not file_type_is_entrypoint(f): -+ if not f in self.exec_types or not f in self.entry_types: - flist_non_exec.append(f) - if f in self.fcdict: - mpaths = mpaths + self.fcdict[f]["regex"] --- -2.32.0 - diff --git a/0014-sepolicy-generate-Handle-more-reserved-port-types.patch b/0008-sepolicy-generate-Handle-more-reserved-port-types.patch similarity index 96% rename from 0014-sepolicy-generate-Handle-more-reserved-port-types.patch rename to 0008-sepolicy-generate-Handle-more-reserved-port-types.patch index d64acff..8dc4941 100644 --- a/0014-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0008-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,7 +1,8 @@ -From 53c27e891b9053a9bbbbca5a854deb4fc526a8a2 Mon Sep 17 00:00:00 2001 +From f901c512886ecddcda6f165e24c95de718cc0cc7 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types +Content-type: text/plain Currently only reserved_port_t, port_t and hi_reserved_port_t are handled as special when making a ports-dictionary. However, as fas as @@ -67,5 +68,5 @@ index 43180ca6fda4..d60a08e1d72c 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.32.0 +2.35.1 diff --git a/0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch similarity index 96% rename from 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch rename to 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 6ab6f4a..8a56b2d 100644 --- a/0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,7 +1,8 @@ -From be804ecd456a52803067e1aa11e20ef69788221c Mon Sep 17 00:00:00 2001 +From f53d7f95833fa2fbf11400e477c1fbce9ca4e0aa Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox +Content-type: text/plain --- sandbox/sandbox | 4 ++-- @@ -70,5 +71,5 @@ index 4774528027ef..c211ebc14549 100644 export DISPLAY=:$D cat > ~/seremote << __EOF -- -2.32.0 +2.35.1 diff --git a/0009-sepolicy-Another-small-optimization-for-mcs-types.patch b/0009-sepolicy-Another-small-optimization-for-mcs-types.patch deleted file mode 100644 index 35d2276..0000000 --- a/0009-sepolicy-Another-small-optimization-for-mcs-types.patch +++ /dev/null @@ -1,53 +0,0 @@ -From afe686ec783ccf442c8e2bbcb9dbdb7650328253 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 28 Feb 2017 21:29:46 +0100 -Subject: [PATCH] sepolicy: Another small optimization for mcs types - ---- - python/sepolicy/sepolicy/manpage.py | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index d15522135288..ffcedb547993 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -144,6 +144,15 @@ def _gen_entry_types(): - entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"] - return entry_types - -+mcs_constrained_types = None -+ -+def _gen_mcs_constrained_types(): -+ global mcs_constrained_types -+ if mcs_constrained_types is None: -+ mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type")) -+ return mcs_constrained_types -+ -+ - types = None - - def _gen_types(): -@@ -392,6 +401,7 @@ class ManPage: - self.types = _gen_types() - self.exec_types = _gen_exec_types() - self.entry_types = _gen_entry_types() -+ self.mcs_constrained_types = _gen_mcs_constrained_types() - - if self.source_files: - self.fcpath = self.root + "file_contexts" -@@ -946,11 +956,7 @@ All executables with the default executable label, usually stored in /usr/bin an - %s""" % ", ".join(paths)) - - def _mcs_types(self): -- try: -- mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type")) -- except StopIteration: -- return -- if self.type not in mcs_constrained_type['types']: -+ if self.type not in self.mcs_constrained_types['types']: - return - self.fd.write (""" - .SH "MCS Constrained" --- -2.32.0 - diff --git a/0010-Move-po-translation-files-into-the-right-sub-directo.patch b/0010-Move-po-translation-files-into-the-right-sub-directo.patch deleted file mode 100644 index 49a1477..0000000 --- a/0010-Move-po-translation-files-into-the-right-sub-directo.patch +++ /dev/null @@ -1,515 +0,0 @@ -From 28879b771a804242d00a8a978bdbc4b85210814d Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 6 Aug 2018 13:23:00 +0200 -Subject: [PATCH] Move po/ translation files into the right sub-directories - -When policycoreutils was split into policycoreutils/ python/ gui/ and sandbox/ -sub-directories, po/ translation files stayed in policycoreutils/. - -This commit split original policycoreutils/po directory into -policycoreutils/po -python/po -gui/po -sandbox/po - -See https://github.com/fedora-selinux/selinux/issues/43 ---- - gui/Makefile | 3 ++ - gui/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++ - gui/po/POTFILES | 17 ++++++++ - policycoreutils/po/Makefile | 70 ++----------------------------- - policycoreutils/po/POTFILES | 9 ++++ - python/Makefile | 2 +- - python/po/Makefile | 83 +++++++++++++++++++++++++++++++++++++ - python/po/POTFILES | 10 +++++ - sandbox/Makefile | 2 + - sandbox/po/Makefile | 82 ++++++++++++++++++++++++++++++++++++ - sandbox/po/POTFILES | 1 + - 11 files changed, 293 insertions(+), 68 deletions(-) - create mode 100644 gui/po/Makefile - create mode 100644 gui/po/POTFILES - create mode 100644 policycoreutils/po/POTFILES - create mode 100644 python/po/Makefile - create mode 100644 python/po/POTFILES - create mode 100644 sandbox/po/Makefile - create mode 100644 sandbox/po/POTFILES - -diff --git a/gui/Makefile b/gui/Makefile -index ca965c942912..5a5bf6dcae19 100644 ---- a/gui/Makefile -+++ b/gui/Makefile -@@ -22,6 +22,7 @@ system-config-selinux.ui \ - usersPage.py - - all: $(TARGETS) system-config-selinux.py polgengui.py -+ (cd po && $(MAKE) $@) - - install: all - -mkdir -p $(DESTDIR)$(MANDIR)/man8 -@@ -54,6 +55,8 @@ install: all - install -m 644 sepolicy_$${i}.png $(DESTDIR)$(DATADIR)/icons/hicolor/$${i}x$${i}/apps/sepolicy.png; \ - done - install -m 644 org.selinux.config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions/ -+ (cd po && $(MAKE) $@) -+ - clean: - - indent: -diff --git a/gui/po/Makefile b/gui/po/Makefile -new file mode 100644 -index 000000000000..a0f5439f2d1c ---- /dev/null -+++ b/gui/po/Makefile -@@ -0,0 +1,82 @@ -+# -+# Makefile for the PO files (translation) catalog -+# -+ -+PREFIX ?= /usr -+ -+# What is this package? -+NLSPACKAGE = gui -+POTFILE = $(NLSPACKAGE).pot -+INSTALL = /usr/bin/install -c -p -+INSTALL_DATA = $(INSTALL) -m 644 -+INSTALL_DIR = /usr/bin/install -d -+ -+# destination directory -+INSTALL_NLS_DIR = $(PREFIX)/share/locale -+ -+# PO catalog handling -+MSGMERGE = msgmerge -+MSGMERGE_FLAGS = -q -+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE) -+MSGFMT = msgfmt -+ -+# All possible linguas -+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po))) -+ -+# Only the files matching what the user has set in LINGUAS -+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS)) -+ -+# if no valid LINGUAS, build all languages -+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS)) -+ -+POFILES = $(patsubst %,%.po,$(USE_LINGUAS)) -+MOFILES = $(patsubst %.po,%.mo,$(POFILES)) -+POTFILES = $(shell cat POTFILES) -+ -+#default:: clean -+ -+all:: $(MOFILES) -+ -+$(POTFILE): $(POTFILES) -+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES) -+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \ -+ rm -f $(NLSPACKAGE).po; \ -+ else \ -+ mv -f $(NLSPACKAGE).po $(POTFILE); \ -+ fi; \ -+ -+ -+refresh-po: Makefile -+ for cat in $(POFILES); do \ -+ lang=`basename $$cat .po`; \ -+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \ -+ mv -f $$lang.pot $$lang.po ; \ -+ echo "$(MSGMERGE) of $$lang succeeded" ; \ -+ else \ -+ echo "$(MSGMERGE) of $$lang failed" ; \ -+ rm -f $$lang.pot ; \ -+ fi \ -+ done -+ -+clean: -+ @rm -fv *mo *~ .depend -+ @rm -rf tmp -+ -+install: $(MOFILES) -+ @for n in $(MOFILES); do \ -+ l=`basename $$n .mo`; \ -+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \ -+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \ -+ done -+ -+%.mo: %.po -+ $(MSGFMT) -o $@ $< -+report: -+ @for cat in $(wildcard *.po); do \ -+ echo -n "$$cat: "; \ -+ msgfmt -v --statistics -o /dev/null $$cat; \ -+ done -+ -+.PHONY: missing depend -+ -+relabel: -diff --git a/gui/po/POTFILES b/gui/po/POTFILES -new file mode 100644 -index 000000000000..1795c5c1951b ---- /dev/null -+++ b/gui/po/POTFILES -@@ -0,0 +1,17 @@ -+../booleansPage.py -+../domainsPage.py -+../fcontextPage.py -+../loginsPage.py -+../modulesPage.py -+../org.selinux.config.policy -+../polgengui.py -+../polgen.ui -+../portsPage.py -+../selinux-polgengui.desktop -+../semanagePage.py -+../sepolicy.desktop -+../statusPage.py -+../system-config-selinux.desktop -+../system-config-selinux.py -+../system-config-selinux.ui -+../usersPage.py -diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile -index 575e143122e6..18bc1dff8d1f 100644 ---- a/policycoreutils/po/Makefile -+++ b/policycoreutils/po/Makefile -@@ -3,7 +3,6 @@ - # - - PREFIX ?= /usr --TOP = ../.. - - # What is this package? - NLSPACKAGE = policycoreutils -@@ -32,74 +31,13 @@ USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS)) - - POFILES = $(patsubst %,%.po,$(USE_LINGUAS)) - MOFILES = $(patsubst %.po,%.mo,$(POFILES)) --POTFILES = \ -- ../run_init/open_init_pty.c \ -- ../run_init/run_init.c \ -- ../semodule_link/semodule_link.c \ -- ../audit2allow/audit2allow \ -- ../semanage/seobject.py \ -- ../setsebool/setsebool.c \ -- ../newrole/newrole.c \ -- ../load_policy/load_policy.c \ -- ../sestatus/sestatus.c \ -- ../semodule/semodule.c \ -- ../setfiles/setfiles.c \ -- ../semodule_package/semodule_package.c \ -- ../semodule_deps/semodule_deps.c \ -- ../semodule_expand/semodule_expand.c \ -- ../scripts/chcat \ -- ../scripts/fixfiles \ -- ../restorecond/stringslist.c \ -- ../restorecond/restorecond.h \ -- ../restorecond/utmpwatcher.h \ -- ../restorecond/stringslist.h \ -- ../restorecond/restorecond.c \ -- ../restorecond/utmpwatcher.c \ -- ../gui/booleansPage.py \ -- ../gui/fcontextPage.py \ -- ../gui/loginsPage.py \ -- ../gui/mappingsPage.py \ -- ../gui/modulesPage.py \ -- ../gui/polgen.glade \ -- ../gui/polgengui.py \ -- ../gui/portsPage.py \ -- ../gui/semanagePage.py \ -- ../gui/statusPage.py \ -- ../gui/system-config-selinux.glade \ -- ../gui/system-config-selinux.py \ -- ../gui/usersPage.py \ -- ../secon/secon.c \ -- booleans.py \ -- ../sepolicy/sepolicy.py \ -- ../sepolicy/sepolicy/communicate.py \ -- ../sepolicy/sepolicy/__init__.py \ -- ../sepolicy/sepolicy/network.py \ -- ../sepolicy/sepolicy/generate.py \ -- ../sepolicy/sepolicy/sepolicy.glade \ -- ../sepolicy/sepolicy/gui.py \ -- ../sepolicy/sepolicy/manpage.py \ -- ../sepolicy/sepolicy/transition.py \ -- ../sepolicy/sepolicy/templates/executable.py \ -- ../sepolicy/sepolicy/templates/__init__.py \ -- ../sepolicy/sepolicy/templates/network.py \ -- ../sepolicy/sepolicy/templates/rw.py \ -- ../sepolicy/sepolicy/templates/script.py \ -- ../sepolicy/sepolicy/templates/semodule.py \ -- ../sepolicy/sepolicy/templates/tmp.py \ -- ../sepolicy/sepolicy/templates/user.py \ -- ../sepolicy/sepolicy/templates/var_lib.py \ -- ../sepolicy/sepolicy/templates/var_log.py \ -- ../sepolicy/sepolicy/templates/var_run.py \ -- ../sepolicy/sepolicy/templates/var_spool.py -+POTFILES = $(shell cat POTFILES) - - #default:: clean - --all:: $(MOFILES) -+all:: $(POTFILE) $(MOFILES) - --booleans.py: -- sepolicy booleans -a > booleans.py -- --$(POTFILE): $(POTFILES) booleans.py -+$(POTFILE): $(POTFILES) - $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES) - @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \ - rm -f $(NLSPACKAGE).po; \ -@@ -107,8 +45,6 @@ $(POTFILE): $(POTFILES) booleans.py - mv -f $(NLSPACKAGE).po $(POTFILE); \ - fi; \ - --update-po: Makefile $(POTFILE) refresh-po -- @rm -f booleans.py - - refresh-po: Makefile - for cat in $(POFILES); do \ -diff --git a/policycoreutils/po/POTFILES b/policycoreutils/po/POTFILES -new file mode 100644 -index 000000000000..12237dc61ee4 ---- /dev/null -+++ b/policycoreutils/po/POTFILES -@@ -0,0 +1,9 @@ -+../run_init/open_init_pty.c -+../run_init/run_init.c -+../setsebool/setsebool.c -+../newrole/newrole.c -+../load_policy/load_policy.c -+../sestatus/sestatus.c -+../semodule/semodule.c -+../setfiles/setfiles.c -+../secon/secon.c -diff --git a/python/Makefile b/python/Makefile -index 9b66d52fbd4d..00312dbdb5c6 100644 ---- a/python/Makefile -+++ b/python/Makefile -@@ -1,4 +1,4 @@ --SUBDIRS = sepolicy audit2allow semanage sepolgen chcat -+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po - - all install relabel clean indent test: - @for subdir in $(SUBDIRS); do \ -diff --git a/python/po/Makefile b/python/po/Makefile -new file mode 100644 -index 000000000000..4e052d5a2bd7 ---- /dev/null -+++ b/python/po/Makefile -@@ -0,0 +1,83 @@ -+# -+# Makefile for the PO files (translation) catalog -+# -+ -+PREFIX ?= /usr -+ -+# What is this package? -+NLSPACKAGE = python -+POTFILE = $(NLSPACKAGE).pot -+INSTALL = /usr/bin/install -c -p -+INSTALL_DATA = $(INSTALL) -m 644 -+INSTALL_DIR = /usr/bin/install -d -+ -+# destination directory -+INSTALL_NLS_DIR = $(PREFIX)/share/locale -+ -+# PO catalog handling -+MSGMERGE = msgmerge -+MSGMERGE_FLAGS = -q -+XGETTEXT = xgettext --default-domain=$(NLSPACKAGE) -+MSGFMT = msgfmt -+ -+# All possible linguas -+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po))) -+ -+# Only the files matching what the user has set in LINGUAS -+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS)) -+ -+# if no valid LINGUAS, build all languages -+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS)) -+ -+POFILES = $(patsubst %,%.po,$(USE_LINGUAS)) -+MOFILES = $(patsubst %.po,%.mo,$(POFILES)) -+POTFILES = $(shell cat POTFILES) -+ -+#default:: clean -+ -+all:: $(MOFILES) -+ -+$(POTFILE): $(POTFILES) -+ $(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES) -+ $(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade -+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \ -+ rm -f $(NLSPACKAGE).po; \ -+ else \ -+ mv -f $(NLSPACKAGE).po $(POTFILE); \ -+ fi; \ -+ -+ -+refresh-po: Makefile -+ for cat in $(POFILES); do \ -+ lang=`basename $$cat .po`; \ -+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \ -+ mv -f $$lang.pot $$lang.po ; \ -+ echo "$(MSGMERGE) of $$lang succeeded" ; \ -+ else \ -+ echo "$(MSGMERGE) of $$lang failed" ; \ -+ rm -f $$lang.pot ; \ -+ fi \ -+ done -+ -+clean: -+ @rm -fv *mo *~ .depend -+ @rm -rf tmp -+ -+install: $(MOFILES) -+ @for n in $(MOFILES); do \ -+ l=`basename $$n .mo`; \ -+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \ -+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \ -+ done -+ -+%.mo: %.po -+ $(MSGFMT) -o $@ $< -+report: -+ @for cat in $(wildcard *.po); do \ -+ echo -n "$$cat: "; \ -+ msgfmt -v --statistics -o /dev/null $$cat; \ -+ done -+ -+.PHONY: missing depend -+ -+relabel: -diff --git a/python/po/POTFILES b/python/po/POTFILES -new file mode 100644 -index 000000000000..128eb870a69e ---- /dev/null -+++ b/python/po/POTFILES -@@ -0,0 +1,10 @@ -+../audit2allow/audit2allow -+../chcat/chcat -+../semanage/semanage -+../semanage/seobject.py -+../sepolgen/src/sepolgen/interfaces.py -+../sepolicy/sepolicy/generate.py -+../sepolicy/sepolicy/gui.py -+../sepolicy/sepolicy/__init__.py -+../sepolicy/sepolicy/interface.py -+../sepolicy/sepolicy.py -diff --git a/sandbox/Makefile b/sandbox/Makefile -index 9da5e58db9e6..b817824e2102 100644 ---- a/sandbox/Makefile -+++ b/sandbox/Makefile -@@ -13,6 +13,7 @@ override LDLIBS += -lselinux -lcap-ng - SEUNSHARE_OBJS = seunshare.o - - all: sandbox seunshare sandboxX.sh start -+ (cd po && $(MAKE) $@) - - seunshare: $(SEUNSHARE_OBJS) - -@@ -39,6 +40,7 @@ install: all - install -m 755 start $(DESTDIR)$(SHAREDIR) - -mkdir -p $(DESTDIR)$(SYSCONFDIR) - install -m 644 sandbox.conf $(DESTDIR)$(SYSCONFDIR)/sandbox -+ (cd po && $(MAKE) $@) - - test: - @$(PYTHON) test_sandbox.py -v -diff --git a/sandbox/po/Makefile b/sandbox/po/Makefile -new file mode 100644 -index 000000000000..0556bbe953f0 ---- /dev/null -+++ b/sandbox/po/Makefile -@@ -0,0 +1,82 @@ -+# -+# Makefile for the PO files (translation) catalog -+# -+ -+PREFIX ?= /usr -+ -+# What is this package? -+NLSPACKAGE = sandbox -+POTFILE = $(NLSPACKAGE).pot -+INSTALL = /usr/bin/install -c -p -+INSTALL_DATA = $(INSTALL) -m 644 -+INSTALL_DIR = /usr/bin/install -d -+ -+# destination directory -+INSTALL_NLS_DIR = $(PREFIX)/share/locale -+ -+# PO catalog handling -+MSGMERGE = msgmerge -+MSGMERGE_FLAGS = -q -+XGETTEXT = xgettext -L Python --default-domain=$(NLSPACKAGE) -+MSGFMT = msgfmt -+ -+# All possible linguas -+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po))) -+ -+# Only the files matching what the user has set in LINGUAS -+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS)) -+ -+# if no valid LINGUAS, build all languages -+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS)) -+ -+POFILES = $(patsubst %,%.po,$(USE_LINGUAS)) -+MOFILES = $(patsubst %.po,%.mo,$(POFILES)) -+POTFILES = $(shell cat POTFILES) -+ -+#default:: clean -+ -+all:: $(POTFILE) $(MOFILES) -+ -+$(POTFILE): $(POTFILES) -+ $(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES) -+ @if cmp -s $(NLSPACKAGE).po $(POTFILE); then \ -+ rm -f $(NLSPACKAGE).po; \ -+ else \ -+ mv -f $(NLSPACKAGE).po $(POTFILE); \ -+ fi; \ -+ -+ -+refresh-po: Makefile -+ for cat in $(POFILES); do \ -+ lang=`basename $$cat .po`; \ -+ if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \ -+ mv -f $$lang.pot $$lang.po ; \ -+ echo "$(MSGMERGE) of $$lang succeeded" ; \ -+ else \ -+ echo "$(MSGMERGE) of $$lang failed" ; \ -+ rm -f $$lang.pot ; \ -+ fi \ -+ done -+ -+clean: -+ @rm -fv *mo *~ .depend -+ @rm -rf tmp -+ -+install: $(MOFILES) -+ @for n in $(MOFILES); do \ -+ l=`basename $$n .mo`; \ -+ $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \ -+ $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \ -+ done -+ -+%.mo: %.po -+ $(MSGFMT) -o $@ $< -+report: -+ @for cat in $(wildcard *.po); do \ -+ echo -n "$$cat: "; \ -+ msgfmt -v --statistics -o /dev/null $$cat; \ -+ done -+ -+.PHONY: missing depend -+ -+relabel: -diff --git a/sandbox/po/POTFILES b/sandbox/po/POTFILES -new file mode 100644 -index 000000000000..deff3f2f4656 ---- /dev/null -+++ b/sandbox/po/POTFILES -@@ -0,0 +1 @@ -+../sandbox --- -2.32.0 - diff --git a/0018-Use-SHA-2-instead-of-SHA-1.patch b/0010-Use-SHA-2-instead-of-SHA-1.patch similarity index 97% rename from 0018-Use-SHA-2-instead-of-SHA-1.patch rename to 0010-Use-SHA-2-instead-of-SHA-1.patch index 143f805..97e5761 100644 --- a/0018-Use-SHA-2-instead-of-SHA-1.patch +++ b/0010-Use-SHA-2-instead-of-SHA-1.patch @@ -1,7 +1,8 @@ -From ec1b147076345478636de763ce5d4e8daa69afd6 Mon Sep 17 00:00:00 2001 +From f55d88aafd92a1a2a0bcb8d03e5197a488a0c7a9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 +Content-type: text/plain The use of SHA-1 in RHEL9 is deprecated --- @@ -15,10 +16,10 @@ The use of SHA-1 in RHEL9 is deprecated 7 files changed, 33 insertions(+), 33 deletions(-) diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index 668486f66113..a8900f02b3f3 100644 +index e07db2c87dc4..dbd55ce7c512 100644 --- a/policycoreutils/setfiles/restorecon.8 +++ b/policycoreutils/setfiles/restorecon.8 -@@ -93,14 +93,14 @@ display usage information and exit. +@@ -95,14 +95,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -36,7 +37,7 @@ index 668486f66113..a8900f02b3f3 100644 enable usage of the .IR security.sehash extended attribute. -@@ -191,7 +191,7 @@ the +@@ -200,7 +200,7 @@ the .B \-D option to .B restorecon @@ -45,7 +46,7 @@ index 668486f66113..a8900f02b3f3 100644 attribute named .IR security.sehash on each directory specified in -@@ -208,7 +208,7 @@ for further details. +@@ -217,7 +217,7 @@ for further details. .sp The .B \-I @@ -253,10 +254,10 @@ index 910101452625..7f2daa09191b 100644 , и, при условии, что НЕ установлен параметр .B \-n diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 8e6c4ab94841..0692121f2f4d 100644 +index 15f939d1bee0..ffa76a89842d 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 -@@ -85,14 +85,14 @@ display usage information and exit. +@@ -87,14 +87,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -274,7 +275,7 @@ index 8e6c4ab94841..0692121f2f4d 100644 enable usage of the .IR security.sehash extended attribute. -@@ -230,7 +230,7 @@ the +@@ -239,7 +239,7 @@ the .B \-D option to .B setfiles @@ -283,7 +284,7 @@ index 8e6c4ab94841..0692121f2f4d 100644 .B spec_file set in an extended attribute named .IR security.sehash -@@ -251,7 +251,7 @@ for further details. +@@ -260,7 +260,7 @@ for further details. .sp The .B \-I @@ -293,5 +294,5 @@ index 8e6c4ab94841..0692121f2f4d 100644 and provided the .B \-n -- -2.32.0 +2.35.1 diff --git a/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch b/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch new file mode 100644 index 0000000..8f5a87c --- /dev/null +++ b/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch @@ -0,0 +1,27 @@ +From 9ce501c15bf91108f768e5255d89b28c0e2b906e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 12 Apr 2022 12:28:00 +0200 +Subject: [PATCH] Update python library and binding versions to 3.4-rc1 +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py +index e81b6cc73380..62cf7dc47c5c 100644 +--- a/python/sepolicy/setup.py ++++ b/python/sepolicy/setup.py +@@ -6,7 +6,7 @@ from distutils.core import setup + + setup( + name="sepolicy", +- version="3.3", ++ version="3.4-rc1", + description="Python SELinux Policy Analyses bindings", + author="Daniel Walsh", + author_email="dwalsh@redhat.com", +-- +2.35.1 + diff --git a/0011-Use-correct-gettext-domains-in-python-gui-sandbox.patch b/0011-Use-correct-gettext-domains-in-python-gui-sandbox.patch deleted file mode 100644 index fa55c2e..0000000 --- a/0011-Use-correct-gettext-domains-in-python-gui-sandbox.patch +++ /dev/null @@ -1,306 +0,0 @@ -From a8cacf2944ddd803909d2111bdf2d43ab90e1111 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 6 Aug 2018 13:37:07 +0200 -Subject: [PATCH] Use correct gettext domains in python/ gui/ sandbox/ - -https://github.com/fedora-selinux/selinux/issues/43 ---- - gui/booleansPage.py | 2 +- - gui/domainsPage.py | 2 +- - gui/fcontextPage.py | 2 +- - gui/loginsPage.py | 2 +- - gui/modulesPage.py | 2 +- - gui/polgengui.py | 2 +- - gui/portsPage.py | 2 +- - gui/semanagePage.py | 2 +- - gui/statusPage.py | 2 +- - gui/system-config-selinux.py | 2 +- - gui/usersPage.py | 2 +- - python/chcat/chcat | 2 +- - python/semanage/semanage | 2 +- - python/semanage/seobject.py | 2 +- - python/sepolgen/src/sepolgen/sepolgeni18n.py | 2 +- - python/sepolicy/sepolicy.py | 2 +- - python/sepolicy/sepolicy/__init__.py | 2 +- - python/sepolicy/sepolicy/generate.py | 2 +- - python/sepolicy/sepolicy/gui.py | 2 +- - python/sepolicy/sepolicy/interface.py | 2 +- - sandbox/sandbox | 2 +- - 21 files changed, 21 insertions(+), 21 deletions(-) - -diff --git a/gui/booleansPage.py b/gui/booleansPage.py -index 7849bea26a06..dd12b6d6ab86 100644 ---- a/gui/booleansPage.py -+++ b/gui/booleansPage.py -@@ -38,7 +38,7 @@ DISABLED = 2 - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/domainsPage.py b/gui/domainsPage.py -index bad5140d8c59..6bbe4de5884f 100644 ---- a/gui/domainsPage.py -+++ b/gui/domainsPage.py -@@ -30,7 +30,7 @@ from semanagePage import * - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py -index d26aa1b405a9..52292cae01d2 100644 ---- a/gui/fcontextPage.py -+++ b/gui/fcontextPage.py -@@ -47,7 +47,7 @@ class context: - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/loginsPage.py b/gui/loginsPage.py -index b67eb8bc42af..cbfb0cc23f65 100644 ---- a/gui/loginsPage.py -+++ b/gui/loginsPage.py -@@ -29,7 +29,7 @@ from semanagePage import * - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/modulesPage.py b/gui/modulesPage.py -index 0584acf9b3a4..35a0129bab9c 100644 ---- a/gui/modulesPage.py -+++ b/gui/modulesPage.py -@@ -30,7 +30,7 @@ from semanagePage import * - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/polgengui.py b/gui/polgengui.py -index d284ded65279..01f541bafae8 100644 ---- a/gui/polgengui.py -+++ b/gui/polgengui.py -@@ -63,7 +63,7 @@ def get_all_modules(): - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/portsPage.py b/gui/portsPage.py -index 30f58383bc1d..a537ecc8c0a1 100644 ---- a/gui/portsPage.py -+++ b/gui/portsPage.py -@@ -35,7 +35,7 @@ from semanagePage import * - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/semanagePage.py b/gui/semanagePage.py -index 4127804fbbee..5361d69c1313 100644 ---- a/gui/semanagePage.py -+++ b/gui/semanagePage.py -@@ -22,7 +22,7 @@ from gi.repository import Gdk, Gtk - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/statusPage.py b/gui/statusPage.py -index 766854b19cba..a8f079b9b163 100644 ---- a/gui/statusPage.py -+++ b/gui/statusPage.py -@@ -35,7 +35,7 @@ RELABELFILE = "/.autorelabel" - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py -index 3f70122b87e8..8c46c987b974 100644 ---- a/gui/system-config-selinux.py -+++ b/gui/system-config-selinux.py -@@ -45,7 +45,7 @@ import selinux - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/gui/usersPage.py b/gui/usersPage.py -index 26794ed5c3f3..d15d4c5a71dd 100644 ---- a/gui/usersPage.py -+++ b/gui/usersPage.py -@@ -29,7 +29,7 @@ from semanagePage import * - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-gui" - try: - import gettext - kwargs = {} -diff --git a/python/chcat/chcat b/python/chcat/chcat -index fdd2e46ee3f9..839ddd3b54b6 100755 ---- a/python/chcat/chcat -+++ b/python/chcat/chcat -@@ -30,7 +30,7 @@ import getopt - import selinux - import seobject - --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/semanage/semanage b/python/semanage/semanage -index 18a2710531ca..0980aecb6311 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -30,7 +30,7 @@ import seobject - import sys - import traceback - --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index 21adbf6eb74f..69e60db80060 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -29,7 +29,7 @@ import sys - import stat - import socket - from semanage import * --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - import sepolicy - from setools.policyrep import SELinuxPolicy - from setools.typequery import TypeQuery -diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py -index 998c4356415c..56ebd807c69c 100644 ---- a/python/sepolgen/src/sepolgen/sepolgeni18n.py -+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py -@@ -19,7 +19,7 @@ - - try: - import gettext -- t = gettext.translation( 'yumex' ) -+ t = gettext.translation( 'selinux-python' ) - _ = t.gettext - except: - def _(str): -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index 7b2230651099..32956e58f52e 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -28,7 +28,7 @@ import sepolicy - from multiprocessing import Pool - from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text - import argparse --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 8055a12f6020..aa8beda313c8 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -23,7 +23,7 @@ from setools.typeattrquery import TypeAttributeQuery - from setools.typequery import TypeQuery - from setools.userquery import UserQuery - --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 4e1ed4e9dc31..43180ca6fda4 100644 ---- a/python/sepolicy/sepolicy/generate.py -+++ b/python/sepolicy/sepolicy/generate.py -@@ -48,7 +48,7 @@ import sepolgen.defaults as defaults - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py -index 1e86422b864a..c9ca158ddd09 100644 ---- a/python/sepolicy/sepolicy/gui.py -+++ b/python/sepolicy/sepolicy/gui.py -@@ -41,7 +41,7 @@ import os - import re - import unicodedata - --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py -index bdffb770f364..9d40aea1498d 100644 ---- a/python/sepolicy/sepolicy/interface.py -+++ b/python/sepolicy/sepolicy/interface.py -@@ -30,7 +30,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us - ## - ## I18N - ## --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-python" - try: - import gettext - kwargs = {} -diff --git a/sandbox/sandbox b/sandbox/sandbox -index ca5f1e030a51..16c43b51eaaa 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -37,7 +37,7 @@ import sepolicy - - SEUNSHARE = "/usr/sbin/seunshare" - SANDBOXSH = "/usr/share/sandbox/sandboxX.sh" --PROGNAME = "policycoreutils" -+PROGNAME = "selinux-sandbox" - try: - import gettext - kwargs = {} --- -2.32.0 - diff --git a/0012-Initial-.pot-files-for-gui-python-sandbox.patch b/0012-Initial-.pot-files-for-gui-python-sandbox.patch deleted file mode 100644 index 9a6b2e8..0000000 --- a/0012-Initial-.pot-files-for-gui-python-sandbox.patch +++ /dev/null @@ -1,4532 +0,0 @@ -From a4183d4c2d335fca940f741bec1f1839394ea783 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 6 Aug 2018 14:23:19 +0200 -Subject: [PATCH] Initial .pot files for gui/ python/ sandbox/ - -https://github.com/fedora-selinux/selinux/issues/43 ---- - gui/po/gui.pot | 964 ++++++++++++ - python/po/python.pot | 3375 ++++++++++++++++++++++++++++++++++++++++ - sandbox/po/sandbox.pot | 157 ++ - 3 files changed, 4496 insertions(+) - create mode 100644 gui/po/gui.pot - create mode 100644 python/po/python.pot - create mode 100644 sandbox/po/sandbox.pot - -diff --git a/gui/po/gui.pot b/gui/po/gui.pot -new file mode 100644 -index 000000000000..1663b4caa7c3 ---- /dev/null -+++ b/gui/po/gui.pot -@@ -0,0 +1,964 @@ -+# SOME DESCRIPTIVE TITLE. -+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER -+# This file is distributed under the same license as the PACKAGE package. -+# FIRST AUTHOR , YEAR. -+# -+#, fuzzy -+msgid "" -+msgstr "" -+"Project-Id-Version: PACKAGE VERSION\n" -+"Report-Msgid-Bugs-To: \n" -+"POT-Creation-Date: 2018-08-06 14:22+0200\n" -+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -+"Last-Translator: FULL NAME \n" -+"Language-Team: LANGUAGE \n" -+"Language: \n" -+"MIME-Version: 1.0\n" -+"Content-Type: text/plain; charset=CHARSET\n" -+"Content-Transfer-Encoding: 8bit\n" -+ -+#: ../booleansPage.py:198 ../system-config-selinux.ui:1025 -+msgid "Boolean" -+msgstr "" -+ -+#: ../booleansPage.py:248 ../semanagePage.py:166 -+msgid "all" -+msgstr "" -+ -+#: ../booleansPage.py:250 ../semanagePage.py:168 -+#: ../system-config-selinux.ui:961 ../system-config-selinux.ui:1097 -+#: ../system-config-selinux.ui:1506 -+msgid "Customized" -+msgstr "" -+ -+#: ../domainsPage.py:55 ../system-config-selinux.ui:1834 -+msgid "Process Domain" -+msgstr "" -+ -+#: ../domainsPage.py:63 -+msgid "Domain Name" -+msgstr "" -+ -+#: ../domainsPage.py:68 -+msgid "Mode" -+msgstr "" -+ -+#: ../domainsPage.py:101 ../domainsPage.py:112 ../domainsPage.py:156 -+#: ../statusPage.py:73 ../system-config-selinux.ui:622 -+#: ../system-config-selinux.ui:1755 -+msgid "Permissive" -+msgstr "" -+ -+#: ../fcontextPage.py:72 ../system-config-selinux.ui:1160 -+msgid "File Labeling" -+msgstr "" -+ -+#: ../fcontextPage.py:82 -+msgid "" -+"File\n" -+"Specification" -+msgstr "" -+ -+#: ../fcontextPage.py:89 -+msgid "" -+"Selinux\n" -+"File Type" -+msgstr "" -+ -+#: ../fcontextPage.py:96 -+msgid "" -+"File\n" -+"Type" -+msgstr "" -+ -+#: ../loginsPage.py:55 ../system-config-selinux.ui:1281 -+msgid "User Mapping" -+msgstr "" -+ -+#: ../loginsPage.py:59 -+msgid "" -+"Login\n" -+"Name" -+msgstr "" -+ -+#: ../loginsPage.py:63 ../usersPage.py:60 -+msgid "" -+"SELinux\n" -+"User" -+msgstr "" -+ -+#: ../loginsPage.py:66 ../usersPage.py:65 -+msgid "" -+"MLS/\n" -+"MCS Range" -+msgstr "" -+ -+#: ../loginsPage.py:135 -+#, python-format -+msgid "Login '%s' is required" -+msgstr "" -+ -+#: ../modulesPage.py:55 ../system-config-selinux.ui:1722 -+msgid "Policy Module" -+msgstr "" -+ -+#: ../modulesPage.py:65 -+msgid "Module Name" -+msgstr "" -+ -+#: ../modulesPage.py:70 -+msgid "Priority" -+msgstr "" -+ -+#: ../modulesPage.py:79 -+msgid "Kind" -+msgstr "" -+ -+#: ../modulesPage.py:147 -+msgid "Disable Audit" -+msgstr "" -+ -+#: ../modulesPage.py:150 ../system-config-selinux.ui:1659 -+msgid "Enable Audit" -+msgstr "" -+ -+#: ../modulesPage.py:175 -+msgid "Load Policy Module" -+msgstr "" -+ -+#: ../org.selinux.config.policy:11 -+msgid "Run System Config SELinux" -+msgstr "" -+ -+#: ../org.selinux.config.policy:12 -+msgid "Authentication is required to run system-config-selinux" -+msgstr "" -+ -+#: ../polgengui.py:288 ../polgen.ui:728 -+msgid "Name" -+msgstr "" -+ -+#: ../polgengui.py:290 ../polgen.ui:111 -+msgid "Description" -+msgstr "" -+ -+#: ../polgengui.py:298 -+msgid "Role" -+msgstr "" -+ -+#: ../polgengui.py:305 -+msgid "Existing_User" -+msgstr "" -+ -+#: ../polgengui.py:319 ../polgengui.py:327 ../polgengui.py:341 -+msgid "Application" -+msgstr "" -+ -+#: ../polgengui.py:386 -+#, python-format -+msgid "%s must be a directory" -+msgstr "" -+ -+#: ../polgengui.py:446 ../polgengui.py:727 -+msgid "You must select a user" -+msgstr "" -+ -+#: ../polgengui.py:576 -+msgid "Select executable file to be confined." -+msgstr "" -+ -+#: ../polgengui.py:587 -+msgid "Select init script file to be confined." -+msgstr "" -+ -+#: ../polgengui.py:597 -+msgid "Select file(s) that confined application creates or writes" -+msgstr "" -+ -+#: ../polgengui.py:604 -+msgid "Select directory(s) that the confined application owns and writes into" -+msgstr "" -+ -+#: ../polgengui.py:666 -+msgid "Select directory to generate policy files in" -+msgstr "" -+ -+#: ../polgengui.py:683 -+#, python-format -+msgid "" -+"Type %s_t already defined in current policy.\n" -+"Do you want to continue?" -+msgstr "" -+ -+#: ../polgengui.py:683 ../polgengui.py:687 -+msgid "Verify Name" -+msgstr "" -+ -+#: ../polgengui.py:687 -+#, python-format -+msgid "" -+"Module %s already loaded in current policy.\n" -+"Do you want to continue?" -+msgstr "" -+ -+#: ../polgengui.py:733 -+msgid "" -+"You must add a name made up of letters and numbers and containing no spaces." -+msgstr "" -+ -+#: ../polgengui.py:747 -+msgid "You must enter a executable" -+msgstr "" -+ -+#: ../polgengui.py:772 ../system-config-selinux.py:184 -+msgid "Configue SELinux" -+msgstr "" -+ -+#: ../polgen.ui:9 -+msgid "Red Hat 2007" -+msgstr "" -+ -+#: ../polgen.ui:11 -+msgid "GPL" -+msgstr "" -+ -+#. TRANSLATORS: Replace this string with your names, one name per line. -+#: ../polgen.ui:13 ../system-config-selinux.ui:15 -+msgid "translator-credits" -+msgstr "" -+ -+#: ../polgen.ui:34 -+msgid "Add Booleans Dialog" -+msgstr "" -+ -+#: ../polgen.ui:99 -+msgid "Boolean Name" -+msgstr "" -+ -+#: ../polgen.ui:234 ../selinux-polgengui.desktop:3 -+msgid "SELinux Policy Generation Tool" -+msgstr "" -+ -+#: ../polgen.ui:255 -+msgid "" -+"Select the policy type for the application or user role you want to " -+"confine:" -+msgstr "" -+ -+#: ../polgen.ui:288 -+msgid "Applications" -+msgstr "" -+ -+#: ../polgen.ui:320 -+msgid "Standard Init Daemon" -+msgstr "" -+ -+#: ../polgen.ui:324 ../polgen.ui:340 -+msgid "" -+"Standard Init Daemon are daemons started on boot via init scripts. Usually " -+"requires a script in /etc/rc.d/init.d" -+msgstr "" -+ -+#: ../polgen.ui:336 -+msgid "DBUS System Daemon" -+msgstr "" -+ -+#: ../polgen.ui:353 -+msgid "Internet Services Daemon (inetd)" -+msgstr "" -+ -+#: ../polgen.ui:357 -+msgid "Internet Services Daemon are daemons started by xinetd" -+msgstr "" -+ -+#: ../polgen.ui:370 -+msgid "Web Application/Script (CGI)" -+msgstr "" -+ -+#: ../polgen.ui:374 -+msgid "" -+"Web Applications/Script (CGI) CGI scripts started by the web server (apache)" -+msgstr "" -+ -+#: ../polgen.ui:387 -+msgid "User Application" -+msgstr "" -+ -+#: ../polgen.ui:391 ../polgen.ui:408 -+msgid "" -+"User Application are any application that you would like to confine that is " -+"started by a user" -+msgstr "" -+ -+#: ../polgen.ui:404 -+msgid "Sandbox" -+msgstr "" -+ -+#: ../polgen.ui:450 -+msgid "Login Users" -+msgstr "" -+ -+#: ../polgen.ui:482 -+msgid "Existing User Roles" -+msgstr "" -+ -+#: ../polgen.ui:486 -+msgid "Modify an existing login user record." -+msgstr "" -+ -+#: ../polgen.ui:499 -+msgid "Minimal Terminal User Role" -+msgstr "" -+ -+#: ../polgen.ui:503 -+msgid "" -+"This user will login to a machine only via a terminal or remote login. By " -+"default this user will have no setuid, no networking, no su, no sudo." -+msgstr "" -+ -+#: ../polgen.ui:516 -+msgid "Minimal X Windows User Role" -+msgstr "" -+ -+#: ../polgen.ui:520 -+msgid "" -+"This user can login to a machine via X or terminal. By default this user " -+"will have no setuid, no networking, no sudo, no su" -+msgstr "" -+ -+#: ../polgen.ui:533 -+msgid "User Role" -+msgstr "" -+ -+#: ../polgen.ui:537 -+msgid "" -+"User with full networking, no setuid applications without transition, no " -+"sudo, no su." -+msgstr "" -+ -+#: ../polgen.ui:550 -+msgid "Admin User Role" -+msgstr "" -+ -+#: ../polgen.ui:554 -+msgid "" -+"User with full networking, no setuid applications without transition, no su, " -+"can sudo to Root Administration Roles" -+msgstr "" -+ -+#: ../polgen.ui:596 -+msgid "Root Users" -+msgstr "" -+ -+#: ../polgen.ui:627 -+msgid "Root Admin User Role" -+msgstr "" -+ -+#: ../polgen.ui:631 -+msgid "" -+"Select Root Administrator User Role, if this user will be used to administer " -+"the machine while running as root. This user will not be able to login to " -+"the system directly." -+msgstr "" -+ -+#: ../polgen.ui:705 -+msgid "Enter name of application or user role:" -+msgstr "" -+ -+#: ../polgen.ui:739 -+msgid "Enter complete path for executable to be confined." -+msgstr "" -+ -+#: ../polgen.ui:756 ../polgen.ui:838 ../polgen.ui:2317 -+msgid "..." -+msgstr "" -+ -+#: ../polgen.ui:776 -+msgid "Enter unique name for the confined application or user role." -+msgstr "" -+ -+#: ../polgen.ui:794 -+msgid "Executable" -+msgstr "" -+ -+#: ../polgen.ui:808 -+msgid "Init script" -+msgstr "" -+ -+#: ../polgen.ui:821 -+msgid "" -+"Enter complete path to init script used to start the confined application." -+msgstr "" -+ -+#: ../polgen.ui:883 -+msgid "Select existing role to modify:" -+msgstr "" -+ -+#: ../polgen.ui:904 -+#, python-format -+msgid "Select the user roles that will transiton to the %s domain." -+msgstr "" -+ -+#: ../polgen.ui:921 -+msgid "role tab" -+msgstr "" -+ -+#: ../polgen.ui:937 -+#, python-format -+msgid "Select roles that %s will transition to:" -+msgstr "" -+ -+#: ../polgen.ui:955 -+#, python-format -+msgid "Select applications domains that %s will transition to." -+msgstr "" -+ -+#: ../polgen.ui:972 -+msgid "" -+"transition \n" -+"role tab" -+msgstr "" -+ -+#: ../polgen.ui:989 -+#, python-format -+msgid "Select the user_roles that will transition to %s:" -+msgstr "" -+ -+#: ../polgen.ui:1007 -+msgid "Select the user roles that will transiton to this applications domains." -+msgstr "" -+ -+#: ../polgen.ui:1040 -+#, python-format -+msgid "Select domains that %s will administer:" -+msgstr "" -+ -+#: ../polgen.ui:1058 ../polgen.ui:1109 -+msgid "Select the domains that you would like this user administer." -+msgstr "" -+ -+#: ../polgen.ui:1091 -+#, python-format -+msgid "Select additional roles for %s:" -+msgstr "" -+ -+#: ../polgen.ui:1142 -+#, python-format -+msgid "Enter network ports that %s binds on:" -+msgstr "" -+ -+#: ../polgen.ui:1162 ../polgen.ui:1529 -+msgid "TCP Ports" -+msgstr "" -+ -+#: ../polgen.ui:1199 ../polgen.ui:1366 ../polgen.ui:1561 ../polgen.ui:1670 -+msgid "All" -+msgstr "" -+ -+#: ../polgen.ui:1203 ../polgen.ui:1370 -+#, python-format -+msgid "Allows %s to bind to any udp port" -+msgstr "" -+ -+#: ../polgen.ui:1216 ../polgen.ui:1383 -+msgid "600-1024" -+msgstr "" -+ -+#: ../polgen.ui:1220 ../polgen.ui:1387 -+#, python-format -+msgid "Allow %s to call bindresvport with 0. Binding to port 600-1024" -+msgstr "" -+ -+#: ../polgen.ui:1233 ../polgen.ui:1400 -+msgid "Unreserved Ports (>1024)" -+msgstr "" -+ -+#: ../polgen.ui:1237 ../polgen.ui:1404 -+#, python-format -+msgid "" -+"Enter a comma separated list of udp ports or ranges of ports that %s binds " -+"to. Example: 612, 650-660" -+msgstr "" -+ -+#: ../polgen.ui:1265 ../polgen.ui:1432 ../polgen.ui:1581 ../polgen.ui:1690 -+msgid "Select Ports" -+msgstr "" -+ -+#: ../polgen.ui:1278 ../polgen.ui:1445 -+#, python-format -+msgid "Allows %s to bind to any udp ports > 1024" -+msgstr "" -+ -+#: ../polgen.ui:1329 ../polgen.ui:1638 -+msgid "UDP Ports" -+msgstr "" -+ -+#: ../polgen.ui:1492 -+msgid "" -+"Network\n" -+"Bind tab" -+msgstr "" -+ -+#: ../polgen.ui:1509 -+#, python-format -+msgid "Select network ports that %s connects to:" -+msgstr "" -+ -+#: ../polgen.ui:1565 -+#, python-format -+msgid "Allows %s to connect to any tcp port" -+msgstr "" -+ -+#: ../polgen.ui:1594 -+#, python-format -+msgid "" -+"Enter a comma separated list of tcp ports or ranges of ports that %s " -+"connects to. Example: 612, 650-660" -+msgstr "" -+ -+#: ../polgen.ui:1674 -+#, python-format -+msgid "Allows %s to connect to any udp port" -+msgstr "" -+ -+#: ../polgen.ui:1703 -+#, python-format -+msgid "" -+"Enter a comma separated list of udp ports or ranges of ports that %s " -+"connects to. Example: 612, 650-660" -+msgstr "" -+ -+#: ../polgen.ui:1760 -+#, python-format -+msgid "Select common application traits for %s:" -+msgstr "" -+ -+#: ../polgen.ui:1777 -+msgid "Writes syslog messages\t" -+msgstr "" -+ -+#: ../polgen.ui:1792 -+msgid "Create/Manipulate temporary files in /tmp" -+msgstr "" -+ -+#: ../polgen.ui:1807 -+msgid "Uses Pam for authentication" -+msgstr "" -+ -+#: ../polgen.ui:1822 -+msgid "Uses nsswitch or getpw* calls" -+msgstr "" -+ -+#: ../polgen.ui:1837 -+msgid "Uses dbus" -+msgstr "" -+ -+#: ../polgen.ui:1852 -+msgid "Sends audit messages" -+msgstr "" -+ -+#: ../polgen.ui:1867 -+msgid "Interacts with the terminal" -+msgstr "" -+ -+#: ../polgen.ui:1882 -+msgid "Sends email" -+msgstr "" -+ -+#: ../polgen.ui:1925 -+#, python-format -+msgid "Add files/directories that %s manages" -+msgstr "" -+ -+#: ../polgen.ui:2086 -+#, python-format -+msgid "" -+"Files/Directories which the %s \"manages\". Pid Files, Log Files, /var/lib " -+"Files ..." -+msgstr "" -+ -+#: ../polgen.ui:2126 -+#, python-format -+msgid "Add booleans from the %s policy:" -+msgstr "" -+ -+#: ../polgen.ui:2234 -+#, python-format -+msgid "Add/Remove booleans used by the %s domain" -+msgstr "" -+ -+#: ../polgen.ui:2272 -+#, python-format -+msgid "Which directory you will generate the %s policy?" -+msgstr "" -+ -+#: ../polgen.ui:2290 -+msgid "Policy Directory" -+msgstr "" -+ -+#: ../portsPage.py:60 ../system-config-selinux.ui:1570 -+msgid "Network Port" -+msgstr "" -+ -+#: ../portsPage.py:95 -+msgid "" -+"SELinux Port\n" -+"Type" -+msgstr "" -+ -+#: ../portsPage.py:101 ../system-config-selinux.ui:294 -+msgid "Protocol" -+msgstr "" -+ -+#: ../portsPage.py:106 ../system-config-selinux.ui:355 -+msgid "" -+"MLS/MCS\n" -+"Level" -+msgstr "" -+ -+#: ../portsPage.py:111 -+msgid "Port" -+msgstr "" -+ -+#: ../portsPage.py:213 -+#, python-format -+msgid "Port number \"%s\" is not valid. 0 < PORT_NUMBER < 65536 " -+msgstr "" -+ -+#: ../portsPage.py:258 -+msgid "List View" -+msgstr "" -+ -+#: ../portsPage.py:261 ../system-config-selinux.ui:1492 -+msgid "Group View" -+msgstr "" -+ -+#: ../selinux-polgengui.desktop:32 ../sepolicy.desktop:4 -+msgid "Generate SELinux policy modules" -+msgstr "" -+ -+#: ../selinux-polgengui.desktop:62 ../system-config-selinux.desktop:62 -+msgid "system-config-selinux" -+msgstr "" -+ -+#: ../semanagePage.py:130 -+#, python-format -+msgid "Are you sure you want to delete %s '%s'?" -+msgstr "" -+ -+#: ../semanagePage.py:130 -+#, python-format -+msgid "Delete %s" -+msgstr "" -+ -+#: ../semanagePage.py:138 -+#, python-format -+msgid "Add %s" -+msgstr "" -+ -+#: ../semanagePage.py:152 -+#, python-format -+msgid "Modify %s" -+msgstr "" -+ -+#: ../sepolicy.desktop:3 -+msgid "SELinux Policy Management Tool" -+msgstr "" -+ -+#: ../sepolicy.desktop:5 -+msgid "sepolicy" -+msgstr "" -+ -+#: ../sepolicy.desktop:11 -+msgid "policy;security;selinux;avc;permission;mac;" -+msgstr "" -+ -+#: ../statusPage.py:74 ../system-config-selinux.ui:625 -+#: ../system-config-selinux.ui:1770 -+msgid "Enforcing" -+msgstr "" -+ -+#: ../statusPage.py:79 ../system-config-selinux.ui:619 -+msgid "Disabled" -+msgstr "" -+ -+#: ../statusPage.py:98 -+msgid "Status" -+msgstr "" -+ -+#: ../statusPage.py:137 -+msgid "" -+"Changing the policy type will cause a relabel of the entire file system on " -+"the next boot. Relabeling takes a long time depending on the size of the " -+"file system. Do you wish to continue?" -+msgstr "" -+ -+#: ../statusPage.py:151 -+msgid "" -+"Changing to SELinux disabled requires a reboot. It is not recommended. If " -+"you later decide to turn SELinux back on, the system will be required to " -+"relabel. If you just want to see if SELinux is causing a problem on your " -+"system, you can go to permissive mode which will only log errors and not " -+"enforce SELinux policy. Permissive mode does not require a reboot Do you " -+"wish to continue?" -+msgstr "" -+ -+#: ../statusPage.py:156 -+msgid "" -+"Changing to SELinux enabled will cause a relabel of the entire file system " -+"on the next boot. Relabeling takes a long time depending on the size of the " -+"file system. Do you wish to continue?" -+msgstr "" -+ -+#: ../system-config-selinux.desktop:3 -+msgid "SELinux Management" -+msgstr "" -+ -+#: ../system-config-selinux.desktop:32 -+msgid "Configure SELinux in a graphical setting" -+msgstr "" -+ -+#: ../system-config-selinux.ui:11 -+msgid "" -+"Copyright (c)2006 Red Hat, Inc.\n" -+"Copyright (c) 2006 Dan Walsh " -+msgstr "" -+ -+#: ../system-config-selinux.ui:53 ../system-config-selinux.ui:433 -+msgid "Add SELinux Login Mapping" -+msgstr "" -+ -+#: ../system-config-selinux.ui:117 -+msgid "Login Name" -+msgstr "" -+ -+#: ../system-config-selinux.ui:128 ../system-config-selinux.ui:1402 -+#: ../system-config-selinux.ui:1937 ../usersPage.py:54 -+msgid "SELinux User" -+msgstr "" -+ -+#: ../system-config-selinux.ui:139 ../system-config-selinux.ui:1948 -+msgid "MLS/MCS Range" -+msgstr "" -+ -+#: ../system-config-selinux.ui:219 -+msgid "Add SELinux Network Ports" -+msgstr "" -+ -+#: ../system-config-selinux.ui:283 -+msgid "Port Number" -+msgstr "" -+ -+#: ../system-config-selinux.ui:305 ../system-config-selinux.ui:519 -+msgid "SELinux Type" -+msgstr "" -+ -+#: ../system-config-selinux.ui:406 -+msgid "all files" -+msgstr "" -+ -+#: ../system-config-selinux.ui:409 -+msgid "regular file" -+msgstr "" -+ -+#: ../system-config-selinux.ui:412 -+msgid "directory" -+msgstr "" -+ -+#: ../system-config-selinux.ui:415 -+msgid "character device" -+msgstr "" -+ -+#: ../system-config-selinux.ui:418 -+msgid "block device" -+msgstr "" -+ -+#: ../system-config-selinux.ui:421 -+msgid "socket file" -+msgstr "" -+ -+#: ../system-config-selinux.ui:424 -+msgid "symbolic link" -+msgstr "" -+ -+#: ../system-config-selinux.ui:427 -+msgid "named pipe" -+msgstr "" -+ -+#: ../system-config-selinux.ui:497 -+msgid "File Specification" -+msgstr "" -+ -+#: ../system-config-selinux.ui:508 -+msgid "File Type" -+msgstr "" -+ -+#: ../system-config-selinux.ui:569 -+msgid "MLS" -+msgstr "" -+ -+#: ../system-config-selinux.ui:631 -+msgid "SELinux Administration" -+msgstr "" -+ -+#: ../system-config-selinux.ui:648 -+msgid "_File" -+msgstr "" -+ -+#: ../system-config-selinux.ui:656 -+msgid "_Add" -+msgstr "" -+ -+#: ../system-config-selinux.ui:668 -+msgid "_Properties" -+msgstr "" -+ -+#: ../system-config-selinux.ui:680 -+msgid "_Delete" -+msgstr "" -+ -+#: ../system-config-selinux.ui:707 -+msgid "_Help" -+msgstr "" -+ -+#: ../system-config-selinux.ui:754 -+msgid "Select Management Object" -+msgstr "" -+ -+#: ../system-config-selinux.ui:767 -+msgid "Select:" -+msgstr "" -+ -+#: ../system-config-selinux.ui:797 -+msgid "System Default Enforcing Mode" -+msgstr "" -+ -+#: ../system-config-selinux.ui:826 -+msgid "Current Enforcing Mode" -+msgstr "" -+ -+#: ../system-config-selinux.ui:848 -+msgid "System Default Policy Type: " -+msgstr "" -+ -+#: ../system-config-selinux.ui:871 -+msgid "" -+"Select if you wish to relabel then entire file system on next reboot. " -+"Relabeling can take a very long time, depending on the size of the system. " -+"If you are changing policy types or going from disabled to enforcing, a " -+"relabel is required." -+msgstr "" -+ -+#: ../system-config-selinux.ui:903 -+msgid "Relabel on next reboot." -+msgstr "" -+ -+#: ../system-config-selinux.ui:947 -+msgid "Revert boolean setting to system default" -+msgstr "" -+ -+#: ../system-config-selinux.ui:960 -+msgid "Toggle between Customized and All Booleans" -+msgstr "" -+ -+#: ../system-config-selinux.ui:986 ../system-config-selinux.ui:1122 -+#: ../system-config-selinux.ui:1242 ../system-config-selinux.ui:1363 -+#: ../system-config-selinux.ui:1531 ../system-config-selinux.ui:1683 -+#: ../system-config-selinux.ui:1795 -+msgid "Filter" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1057 -+msgid "Add File Context" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1070 -+msgid "Modify File Context" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1083 -+msgid "Delete File Context" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1096 -+msgid "Toggle between all and customized file context" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1192 -+msgid "Add SELinux User Mapping" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1205 -+msgid "Modify SELinux User Mapping" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1218 -+msgid "Delete SELinux User Mapping" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1313 -+msgid "Add User" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1326 -+msgid "Modify User" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1339 -+msgid "Delete User" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1434 -+msgid "Add Network Port" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1447 -+msgid "Edit Network Port" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1460 -+msgid "Delete Network Port" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1491 ../system-config-selinux.ui:1505 -+msgid "Toggle between Customized and All Ports" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1602 -+msgid "Generate new policy module" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1614 -+msgid "Load policy module" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1627 -+msgid "Remove loadable policy module" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1658 -+msgid "" -+"Enable/Disable additional audit rules, that are normally not reported in the " -+"log files." -+msgstr "" -+ -+#: ../system-config-selinux.ui:1754 -+msgid "Change process mode to permissive." -+msgstr "" -+ -+#: ../system-config-selinux.ui:1769 -+msgid "Change process mode to enforcing" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1873 -+msgid "Add SELinux User" -+msgstr "" -+ -+#: ../system-config-selinux.ui:1970 ../usersPage.py:69 -+msgid "SELinux Roles" -+msgstr "" -+ -+#: ../usersPage.py:142 -+#, python-format -+msgid "SELinux user '%s' is required" -+msgstr "" -diff --git a/python/po/python.pot b/python/po/python.pot -new file mode 100644 -index 000000000000..a279b0e8d540 ---- /dev/null -+++ b/python/po/python.pot -@@ -0,0 +1,3375 @@ -+# SOME DESCRIPTIVE TITLE. -+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER -+# This file is distributed under the same license as the PACKAGE package. -+# FIRST AUTHOR , YEAR. -+# -+#, fuzzy -+msgid "" -+msgstr "" -+"Project-Id-Version: PACKAGE VERSION\n" -+"Report-Msgid-Bugs-To: \n" -+"POT-Creation-Date: 2018-08-06 14:22+0200\n" -+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -+"Last-Translator: FULL NAME \n" -+"Language-Team: LANGUAGE \n" -+"Language: \n" -+"MIME-Version: 1.0\n" -+"Content-Type: text/plain; charset=CHARSET\n" -+"Content-Transfer-Encoding: 8bit\n" -+ -+#: ../audit2allow/audit2allow:237 -+msgid "******************** IMPORTANT ***********************\n" -+msgstr "" -+ -+#: ../audit2allow/audit2allow:238 -+#, python-format -+msgid "" -+"To make this policy package active, execute:\n" -+"\n" -+"semodule -i %s\n" -+"\n" -+msgstr "" -+ -+#: ../chcat/chcat:115 ../chcat/chcat:194 -+msgid "Requires at least one category" -+msgstr "" -+ -+#: ../chcat/chcat:129 ../chcat/chcat:208 -+#, python-format -+msgid "Can not modify sensitivity levels using '+' on %s" -+msgstr "" -+ -+#: ../chcat/chcat:133 -+#, python-format -+msgid "%s is already in %s" -+msgstr "" -+ -+#: ../chcat/chcat:213 ../chcat/chcat:223 -+#, python-format -+msgid "%s is not in %s" -+msgstr "" -+ -+#: ../chcat/chcat:295 ../chcat/chcat:300 -+msgid "Can not combine +/- with other types of categories" -+msgstr "" -+ -+#: ../chcat/chcat:350 -+msgid "Can not have multiple sensitivities" -+msgstr "" -+ -+#: ../chcat/chcat:357 -+#, python-format -+msgid "Usage %s CATEGORY File ..." -+msgstr "" -+ -+#: ../chcat/chcat:358 -+#, python-format -+msgid "Usage %s -l CATEGORY user ..." -+msgstr "" -+ -+#: ../chcat/chcat:359 -+#, python-format -+msgid "Usage %s [[+|-]CATEGORY],...] File ..." -+msgstr "" -+ -+#: ../chcat/chcat:360 -+#, python-format -+msgid "Usage %s -l [[+|-]CATEGORY],...] user ..." -+msgstr "" -+ -+#: ../chcat/chcat:361 -+#, python-format -+msgid "Usage %s -d File ..." -+msgstr "" -+ -+#: ../chcat/chcat:362 -+#, python-format -+msgid "Usage %s -l -d user ..." -+msgstr "" -+ -+#: ../chcat/chcat:363 -+#, python-format -+msgid "Usage %s -L" -+msgstr "" -+ -+#: ../chcat/chcat:364 -+#, python-format -+msgid "Usage %s -L -l user" -+msgstr "" -+ -+#: ../chcat/chcat:365 -+msgid "Use -- to end option list. For example" -+msgstr "" -+ -+#: ../chcat/chcat:366 -+msgid "chcat -- -CompanyConfidential /docs/businessplan.odt" -+msgstr "" -+ -+#: ../chcat/chcat:367 -+msgid "chcat -l +CompanyConfidential juser" -+msgstr "" -+ -+#: ../chcat/chcat:436 -+#, python-format -+msgid "Options Error %s " -+msgstr "" -+ -+#: ../semanage/semanage:203 -+msgid "Select an alternate SELinux Policy Store to manage" -+msgstr "" -+ -+#: ../semanage/semanage:207 -+msgid "Select a priority for module operations" -+msgstr "" -+ -+#: ../semanage/semanage:211 -+#, python-format -+msgid "Do not print heading when listing %s object types" -+msgstr "" -+ -+#: ../semanage/semanage:215 -+msgid "Do not reload policy after commit" -+msgstr "" -+ -+#: ../semanage/semanage:219 -+#, python-format -+msgid "List %s local customizations" -+msgstr "" -+ -+#: ../semanage/semanage:223 -+#, python-format -+msgid "Add a record of the %s object type" -+msgstr "" -+ -+#: ../semanage/semanage:227 -+msgid "SELinux Type for the object" -+msgstr "" -+ -+#: ../semanage/semanage:231 -+msgid "" -+"Default SELinux Level for SELinux user, s0 Default. (MLS/MCS Systems only)" -+msgstr "" -+ -+#: ../semanage/semanage:236 -+msgid "" -+"\n" -+"MLS/MCS Security Range (MLS/MCS Systems only)\n" -+"SELinux Range for SELinux login mapping\n" -+"defaults to the SELinux user record range.\n" -+"SELinux Range for SELinux user defaults to s0.\n" -+msgstr "" -+ -+#: ../semanage/semanage:245 -+msgid "" -+"\n" -+" Protocol for the specified port (tcp|udp) or internet protocol\n" -+" version for the specified node (ipv4|ipv6).\n" -+msgstr "" -+ -+#: ../semanage/semanage:251 -+msgid "" -+"\n" -+" Subnet prefix for the specified infiniband ibpkey.\n" -+msgstr "" -+ -+#: ../semanage/semanage:256 -+msgid "" -+"\n" -+" Name for the specified infiniband end port.\n" -+msgstr "" -+ -+#: ../semanage/semanage:261 -+#, python-format -+msgid "Modify a record of the %s object type" -+msgstr "" -+ -+#: ../semanage/semanage:265 -+#, python-format -+msgid "List records of the %s object type" -+msgstr "" -+ -+#: ../semanage/semanage:269 -+#, python-format -+msgid "Delete a record of the %s object type" -+msgstr "" -+ -+#: ../semanage/semanage:273 -+msgid "Extract customizable commands, for use within a transaction" -+msgstr "" -+ -+#: ../semanage/semanage:277 -+#, python-format -+msgid "Remove all %s objects local customizations" -+msgstr "" -+ -+#: ../semanage/semanage:281 -+msgid "SELinux user name" -+msgstr "" -+ -+#: ../semanage/semanage:286 -+msgid "Manage login mappings between linux users and SELinux confined users" -+msgstr "" -+ -+#: ../semanage/semanage:303 -+#, python-format -+msgid "login_name | %%groupname" -+msgstr "" -+ -+#: ../semanage/semanage:355 -+msgid "Manage file context mapping definitions" -+msgstr "" -+ -+#: ../semanage/semanage:369 -+msgid "" -+"Substitute target path with sourcepath when generating default\n" -+" label. " -+"This is used with fcontext. Requires source and target\n" -+" path " -+"arguments. The context labeling for the target subtree is\n" -+" made " -+"equivalent to that defined for the source." -+msgstr "" -+ -+#: ../semanage/semanage:377 -+msgid "file_spec" -+msgstr "" -+ -+#: ../semanage/semanage:405 -+msgid "Manage SELinux confined users (Roles and levels for an SELinux user)" -+msgstr "" -+ -+#: ../semanage/semanage:423 -+msgid "" -+"\n" -+"SELinux Roles. You must enclose multiple roles within " -+"quotes, separate by spaces. Or specify -R multiple times.\n" -+msgstr "" -+ -+#: ../semanage/semanage:427 -+msgid "selinux_name" -+msgstr "" -+ -+#: ../semanage/semanage:455 -+msgid "Manage network port type definitions" -+msgstr "" -+ -+#: ../semanage/semanage:471 -+msgid "port | port_range" -+msgstr "" -+ -+#: ../semanage/semanage:500 -+msgid "Manage infiniband ibpkey type definitions" -+msgstr "" -+ -+#: ../semanage/semanage:516 -+msgid "pkey | pkey_range" -+msgstr "" -+ -+#: ../semanage/semanage:543 -+msgid "Manage infiniband end port type definitions" -+msgstr "" -+ -+#: ../semanage/semanage:559 -+msgid "ibendport" -+msgstr "" -+ -+#: ../semanage/semanage:586 -+msgid "Manage network interface type definitions" -+msgstr "" -+ -+#: ../semanage/semanage:601 -+msgid "interface_spec" -+msgstr "" -+ -+#: ../semanage/semanage:625 -+msgid "Manage SELinux policy modules" -+msgstr "" -+ -+#: ../semanage/semanage:637 -+msgid "Remove a module" -+msgstr "" -+ -+#: ../semanage/semanage:638 -+msgid "Disable a module" -+msgstr "" -+ -+#: ../semanage/semanage:639 -+msgid "Enable a module" -+msgstr "" -+ -+#: ../semanage/semanage:640 -+msgid "Name of the module to act on" -+msgstr "" -+ -+#: ../semanage/semanage:667 -+msgid "Manage network node type definitions" -+msgstr "" -+ -+#: ../semanage/semanage:681 -+msgid "Network Mask" -+msgstr "" -+ -+#: ../semanage/semanage:685 -+msgid "node" -+msgstr "" -+ -+#: ../semanage/semanage:710 -+msgid "Manage booleans to selectively enable functionality" -+msgstr "" -+ -+#: ../semanage/semanage:715 -+msgid "boolean" -+msgstr "" -+ -+#: ../semanage/semanage:725 -+msgid "Enable the boolean" -+msgstr "" -+ -+#: ../semanage/semanage:726 -+msgid "Disable the boolean" -+msgstr "" -+ -+#: ../semanage/semanage:743 -+msgid "semanage permissive: error: the following argument is required: type\n" -+msgstr "" -+ -+#: ../semanage/semanage:748 -+msgid "Manage process type enforcement mode" -+msgstr "" -+ -+#: ../semanage/semanage:760 ../semanage/seobject.py:2611 -+msgid "type" -+msgstr "" -+ -+#: ../semanage/semanage:771 -+msgid "Disable/Enable dontaudit rules in policy" -+msgstr "" -+ -+#: ../semanage/semanage:791 -+msgid "Output local customizations" -+msgstr "" -+ -+#: ../semanage/semanage:793 -+msgid "Output file" -+msgstr "" -+ -+#: ../semanage/semanage:871 -+msgid "Import local customizations" -+msgstr "" -+ -+#: ../semanage/semanage:874 -+msgid "Input file" -+msgstr "" -+ -+#: ../semanage/seobject.py:274 -+msgid "Could not create semanage handle" -+msgstr "" -+ -+#: ../semanage/seobject.py:282 -+msgid "SELinux policy is not managed or store cannot be accessed." -+msgstr "" -+ -+#: ../semanage/seobject.py:287 -+msgid "Cannot read policy store." -+msgstr "" -+ -+#: ../semanage/seobject.py:292 -+msgid "Could not establish semanage connection" -+msgstr "" -+ -+#: ../semanage/seobject.py:297 -+msgid "Could not test MLS enabled status" -+msgstr "" -+ -+#: ../semanage/seobject.py:303 ../semanage/seobject.py:319 -+msgid "Not yet implemented" -+msgstr "" -+ -+#: ../semanage/seobject.py:307 -+msgid "Semanage transaction already in progress" -+msgstr "" -+ -+#: ../semanage/seobject.py:316 -+msgid "Could not start semanage transaction" -+msgstr "" -+ -+#: ../semanage/seobject.py:330 -+msgid "Could not commit semanage transaction" -+msgstr "" -+ -+#: ../semanage/seobject.py:335 -+msgid "Semanage transaction not in progress" -+msgstr "" -+ -+#: ../semanage/seobject.py:349 ../semanage/seobject.py:469 -+msgid "Could not list SELinux modules" -+msgstr "" -+ -+#: ../semanage/seobject.py:356 -+msgid "Could not get module name" -+msgstr "" -+ -+#: ../semanage/seobject.py:360 -+msgid "Could not get module enabled" -+msgstr "" -+ -+#: ../semanage/seobject.py:364 -+msgid "Could not get module priority" -+msgstr "" -+ -+#: ../semanage/seobject.py:368 -+msgid "Could not get module lang_ext" -+msgstr "" -+ -+#: ../semanage/seobject.py:389 -+msgid "Module Name" -+msgstr "" -+ -+#: ../semanage/seobject.py:389 -+msgid "Priority" -+msgstr "" -+ -+#: ../semanage/seobject.py:389 -+msgid "Language" -+msgstr "" -+ -+#: ../semanage/seobject.py:392 ../sepolicy/sepolicy/sepolicy.glade:3431 -+msgid "Disabled" -+msgstr "" -+ -+#: ../semanage/seobject.py:401 -+#, python-format -+msgid "Module does not exist: %s " -+msgstr "" -+ -+#: ../semanage/seobject.py:405 ../semanage/seobject.py:432 -+#, python-format -+msgid "Invalid priority %d (needs to be between 1 and 999)" -+msgstr "" -+ -+#: ../semanage/seobject.py:415 -+msgid "Could not create module key" -+msgstr "" -+ -+#: ../semanage/seobject.py:419 -+msgid "Could not set module key name" -+msgstr "" -+ -+#: ../semanage/seobject.py:424 -+#, python-format -+msgid "Could not enable module %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:426 -+#, python-format -+msgid "Could not disable module %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:437 -+#, python-format -+msgid "Could not remove module %s (remove failed)" -+msgstr "" -+ -+#: ../semanage/seobject.py:454 -+msgid "dontaudit requires either 'on' or 'off'" -+msgstr "" -+ -+#: ../semanage/seobject.py:484 -+msgid "Builtin Permissive Types" -+msgstr "" -+ -+#: ../semanage/seobject.py:494 -+msgid "Customized Permissive Types" -+msgstr "" -+ -+#: ../semanage/seobject.py:502 -+msgid "" -+"The sepolgen python module is required to setup permissive domains.\n" -+"In some distributions it is included in the policycoreutils-devel package.\n" -+"# yum install policycoreutils-devel\n" -+"Or similar for your distro." -+msgstr "" -+ -+#: ../semanage/seobject.py:512 -+#, python-format -+msgid "Could not set permissive domain %s (module installation failed)" -+msgstr "" -+ -+#: ../semanage/seobject.py:518 -+#, python-format -+msgid "Could not remove permissive domain %s (remove failed)" -+msgstr "" -+ -+#: ../semanage/seobject.py:555 ../semanage/seobject.py:627 -+#: ../semanage/seobject.py:674 ../semanage/seobject.py:794 -+#: ../semanage/seobject.py:824 ../semanage/seobject.py:889 -+#: ../semanage/seobject.py:945 ../semanage/seobject.py:1209 -+#: ../semanage/seobject.py:1468 ../semanage/seobject.py:2442 -+#: ../semanage/seobject.py:2512 ../semanage/seobject.py:2536 -+#: ../semanage/seobject.py:2664 ../semanage/seobject.py:2715 -+#, python-format -+msgid "Could not create a key for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:559 ../semanage/seobject.py:631 -+#: ../semanage/seobject.py:678 ../semanage/seobject.py:684 -+#, python-format -+msgid "Could not check if login mapping for %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:561 -+#, python-format -+msgid "Login mapping for %s is already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:566 -+#, python-format -+msgid "Linux Group %s does not exist" -+msgstr "" -+ -+#: ../semanage/seobject.py:571 -+#, python-format -+msgid "Linux User %s does not exist" -+msgstr "" -+ -+#: ../semanage/seobject.py:575 -+#, python-format -+msgid "Could not create login mapping for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:579 ../semanage/seobject.py:838 -+#, python-format -+msgid "Could not set name for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:584 ../semanage/seobject.py:848 -+#, python-format -+msgid "Could not set MLS range for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:588 -+#, python-format -+msgid "Could not set SELinux user for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:592 -+#, python-format -+msgid "Could not add login mapping for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:610 -+msgid "Requires seuser or serange" -+msgstr "" -+ -+#: ../semanage/seobject.py:633 ../semanage/seobject.py:680 -+#, python-format -+msgid "Login mapping for %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:637 -+#, python-format -+msgid "Could not query seuser for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:652 -+#, python-format -+msgid "Could not modify login mapping for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:686 -+#, python-format -+msgid "Login mapping for %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:690 -+#, python-format -+msgid "Could not delete login mapping for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:712 ../semanage/seobject.py:745 -+#: ../semanage/seobject.py:988 -+msgid "Could not list login mappings" -+msgstr "" -+ -+#: ../semanage/seobject.py:769 ../semanage/seobject.py:781 -+#: ../sepolicy/sepolicy/sepolicy.glade:1162 -+#: ../sepolicy/sepolicy/sepolicy.glade:3156 -+msgid "Login Name" -+msgstr "" -+ -+#: ../semanage/seobject.py:769 ../semanage/seobject.py:781 -+#: ../semanage/seobject.py:1035 ../semanage/seobject.py:1040 -+#: ../sepolicy/sepolicy/sepolicy.glade:1188 -+#: ../sepolicy/sepolicy/sepolicy.glade:3174 -+#: ../sepolicy/sepolicy/sepolicy.glade:3260 -+#: ../sepolicy/sepolicy/sepolicy.glade:4915 -+msgid "SELinux User" -+msgstr "" -+ -+#: ../semanage/seobject.py:769 -+msgid "MLS/MCS Range" -+msgstr "" -+ -+#: ../semanage/seobject.py:769 -+msgid "Service" -+msgstr "" -+ -+#: ../semanage/seobject.py:797 ../semanage/seobject.py:828 -+#: ../semanage/seobject.py:893 ../semanage/seobject.py:949 -+#: ../semanage/seobject.py:955 -+#, python-format -+msgid "Could not check if SELinux user %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:800 ../semanage/seobject.py:899 -+#: ../semanage/seobject.py:961 -+#, python-format -+msgid "Could not query user for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:820 -+#, python-format -+msgid "You must add at least one role for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:830 -+#, python-format -+msgid "SELinux user %s is already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:834 -+#, python-format -+msgid "Could not create SELinux user for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:843 -+#, python-format -+msgid "Could not add role %s for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:852 -+#, python-format -+msgid "Could not set MLS level for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:855 -+#, python-format -+msgid "Could not add prefix %s for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:858 -+#, python-format -+msgid "Could not extract key for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:862 -+#, python-format -+msgid "Could not add SELinux user %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:883 -+msgid "Requires prefix, roles, level or range" -+msgstr "" -+ -+#: ../semanage/seobject.py:885 -+msgid "Requires prefix or roles" -+msgstr "" -+ -+#: ../semanage/seobject.py:895 ../semanage/seobject.py:951 -+#, python-format -+msgid "SELinux user %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:924 -+#, python-format -+msgid "Could not modify SELinux user %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:957 -+#, python-format -+msgid "SELinux user %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:968 -+#, python-format -+msgid "Could not delete SELinux user %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1006 -+msgid "Could not list SELinux users" -+msgstr "" -+ -+#: ../semanage/seobject.py:1012 -+#, python-format -+msgid "Could not list roles for user %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1034 -+msgid "Labeling" -+msgstr "" -+ -+#: ../semanage/seobject.py:1034 -+msgid "MLS/" -+msgstr "" -+ -+#: ../semanage/seobject.py:1035 -+msgid "Prefix" -+msgstr "" -+ -+#: ../semanage/seobject.py:1035 -+msgid "MCS Level" -+msgstr "" -+ -+#: ../semanage/seobject.py:1035 -+msgid "MCS Range" -+msgstr "" -+ -+#: ../semanage/seobject.py:1035 ../semanage/seobject.py:1040 -+#: ../sepolicy/sepolicy/sepolicy.glade:3280 -+#: ../sepolicy/sepolicy/sepolicy.glade:5251 -+#: ../sepolicy/sepolicy/sepolicy.glade:5400 -+msgid "SELinux Roles" -+msgstr "" -+ -+#: ../semanage/seobject.py:1061 -+msgid "Protocol udp or tcp is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1063 -+msgid "Port is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1073 -+msgid "Invalid Port" -+msgstr "" -+ -+#: ../semanage/seobject.py:1077 ../semanage/seobject.py:1345 -+#, python-format -+msgid "Could not create a key for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1088 ../semanage/seobject.py:1356 -+#: ../semanage/seobject.py:1604 -+msgid "Type is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1091 ../semanage/seobject.py:1155 -+#, python-format -+msgid "Type %s is invalid, must be a port type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1097 ../semanage/seobject.py:1161 -+#: ../semanage/seobject.py:1227 ../semanage/seobject.py:1233 -+#, python-format -+msgid "Could not check if port %s/%s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1099 -+#, python-format -+msgid "Port %s/%s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1103 -+#, python-format -+msgid "Could not create port for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1109 ../semanage/seobject.py:1377 -+#: ../semanage/seobject.py:1624 -+#, python-format -+msgid "Could not create context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1113 -+#, python-format -+msgid "Could not set user in port context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1117 -+#, python-format -+msgid "Could not set role in port context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1121 -+#, python-format -+msgid "Could not set type in port context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1126 -+#, python-format -+msgid "Could not set mls fields in port context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1130 -+#, python-format -+msgid "Could not set port context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1134 -+#, python-format -+msgid "Could not add port %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1150 ../semanage/seobject.py:1416 -+#: ../semanage/seobject.py:1663 ../semanage/seobject.py:1923 -+#: ../semanage/seobject.py:2125 -+msgid "Requires setype or serange" -+msgstr "" -+ -+#: ../semanage/seobject.py:1152 ../semanage/seobject.py:1418 -+#: ../semanage/seobject.py:1665 -+msgid "Requires setype" -+msgstr "" -+ -+#: ../semanage/seobject.py:1163 ../semanage/seobject.py:1229 -+#, python-format -+msgid "Port %s/%s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1167 -+#, python-format -+msgid "Could not query port %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1181 -+#, python-format -+msgid "Could not modify port %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1196 -+msgid "Could not list the ports" -+msgstr "" -+ -+#: ../semanage/seobject.py:1213 -+#, python-format -+msgid "Could not delete the port %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1235 -+#, python-format -+msgid "Port %s/%s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:1239 -+#, python-format -+msgid "Could not delete port %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1257 ../semanage/seobject.py:1277 -+msgid "Could not list ports" -+msgstr "" -+ -+#: ../semanage/seobject.py:1311 ../sepolicy/sepolicy/sepolicy.glade:2676 -+#: ../sepolicy/sepolicy/sepolicy.glade:2774 -+#: ../sepolicy/sepolicy/sepolicy.glade:4648 -+msgid "SELinux Port Type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1311 -+msgid "Proto" -+msgstr "" -+ -+#: ../semanage/seobject.py:1311 ../semanage/seobject.py:1801 -+#: ../sepolicy/sepolicy/sepolicy.glade:1413 -+msgid "Port Number" -+msgstr "" -+ -+#: ../semanage/seobject.py:1331 -+msgid "Subnet Prefix is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1341 -+msgid "Invalid Pkey" -+msgstr "" -+ -+#: ../semanage/seobject.py:1359 ../semanage/seobject.py:1421 -+#, python-format -+msgid "Type %s is invalid, must be a ibpkey type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1365 ../semanage/seobject.py:1427 -+#: ../semanage/seobject.py:1481 ../semanage/seobject.py:1487 -+#, python-format -+msgid "Could not check if ibpkey %s/%s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1367 -+#, python-format -+msgid "ibpkey %s/%s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1371 -+#, python-format -+msgid "Could not create ibpkey for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1381 -+#, python-format -+msgid "Could not set user in ibpkey context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1385 -+#, python-format -+msgid "Could not set role in ibpkey context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1389 -+#, python-format -+msgid "Could not set type in ibpkey context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1394 -+#, python-format -+msgid "Could not set mls fields in ibpkey context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1398 -+#, python-format -+msgid "Could not set ibpkey context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1402 -+#, python-format -+msgid "Could not add ibpkey %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1429 ../semanage/seobject.py:1483 -+#, python-format -+msgid "ibpkey %s/%s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1433 -+#, python-format -+msgid "Could not query ibpkey %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1444 -+#, python-format -+msgid "Could not modify ibpkey %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1457 -+msgid "Could not list the ibpkeys" -+msgstr "" -+ -+#: ../semanage/seobject.py:1472 -+#, python-format -+msgid "Could not delete the ibpkey %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1489 -+#, python-format -+msgid "ibpkey %s/%s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:1493 -+#, python-format -+msgid "Could not delete ibpkey %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1509 ../semanage/seobject.py:1530 -+msgid "Could not list ibpkeys" -+msgstr "" -+ -+#: ../semanage/seobject.py:1564 -+msgid "SELinux IB Pkey Type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1564 -+msgid "Subnet_Prefix" -+msgstr "" -+ -+#: ../semanage/seobject.py:1564 -+msgid "Pkey Number" -+msgstr "" -+ -+#: ../semanage/seobject.py:1584 -+msgid "IB device name is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1589 -+msgid "Invalid Port Number" -+msgstr "" -+ -+#: ../semanage/seobject.py:1593 -+#, python-format -+msgid "Could not create a key for ibendport %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1607 ../semanage/seobject.py:1668 -+#, python-format -+msgid "Type %s is invalid, must be an ibendport type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1612 ../semanage/seobject.py:1674 -+#: ../semanage/seobject.py:1726 ../semanage/seobject.py:1732 -+#, python-format -+msgid "Could not check if ibendport %s/%s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1614 -+#, python-format -+msgid "ibendport %s/%s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1618 -+#, python-format -+msgid "Could not create ibendport for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1628 -+#, python-format -+msgid "Could not set user in ibendport context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1632 -+#, python-format -+msgid "Could not set role in ibendport context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1636 -+#, python-format -+msgid "Could not set type in ibendport context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1641 -+#, python-format -+msgid "Could not set mls fields in ibendport context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1645 -+#, python-format -+msgid "Could not set ibendport context for %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1649 -+#, python-format -+msgid "Could not add ibendport %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1676 ../semanage/seobject.py:1728 -+#, python-format -+msgid "ibendport %s/%s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1680 -+#, python-format -+msgid "Could not query ibendport %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1691 -+#, python-format -+msgid "Could not modify ibendport %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1704 -+msgid "Could not list the ibendports" -+msgstr "" -+ -+#: ../semanage/seobject.py:1713 -+#, python-format -+msgid "Could not create a key for %s/%d" -+msgstr "" -+ -+#: ../semanage/seobject.py:1717 -+#, python-format -+msgid "Could not delete the ibendport %s/%d" -+msgstr "" -+ -+#: ../semanage/seobject.py:1734 -+#, python-format -+msgid "ibendport %s/%s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:1738 -+#, python-format -+msgid "Could not delete ibendport %s/%s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1754 ../semanage/seobject.py:1774 -+msgid "Could not list ibendports" -+msgstr "" -+ -+#: ../semanage/seobject.py:1801 -+msgid "SELinux IB End Port Type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1801 -+msgid "IB Device Name" -+msgstr "" -+ -+#: ../semanage/seobject.py:1825 -+msgid "Node Address is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1840 -+msgid "Unknown or missing protocol" -+msgstr "" -+ -+#: ../semanage/seobject.py:1854 -+msgid "SELinux node type is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:1857 ../semanage/seobject.py:1926 -+#, python-format -+msgid "Type %s is invalid, must be a node type" -+msgstr "" -+ -+#: ../semanage/seobject.py:1861 ../semanage/seobject.py:1930 -+#: ../semanage/seobject.py:1968 ../semanage/seobject.py:2066 -+#: ../semanage/seobject.py:2129 ../semanage/seobject.py:2165 -+#: ../semanage/seobject.py:2377 -+#, python-format -+msgid "Could not create key for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1863 ../semanage/seobject.py:1934 -+#: ../semanage/seobject.py:1972 ../semanage/seobject.py:1978 -+#, python-format -+msgid "Could not check if addr %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1867 -+#, python-format -+msgid "Addr %s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1871 -+#, python-format -+msgid "Could not create addr for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1877 ../semanage/seobject.py:2081 -+#: ../semanage/seobject.py:2333 -+#, python-format -+msgid "Could not create context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1881 -+#, python-format -+msgid "Could not set mask for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1885 -+#, python-format -+msgid "Could not set user in addr context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1889 -+#, python-format -+msgid "Could not set role in addr context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1893 -+#, python-format -+msgid "Could not set type in addr context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1898 -+#, python-format -+msgid "Could not set mls fields in addr context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1902 -+#, python-format -+msgid "Could not set addr context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1906 -+#, python-format -+msgid "Could not add addr %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1936 ../semanage/seobject.py:1974 -+#, python-format -+msgid "Addr %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:1940 -+#, python-format -+msgid "Could not query addr %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1950 -+#, python-format -+msgid "Could not modify addr %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1980 -+#, python-format -+msgid "Addr %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:1984 -+#, python-format -+msgid "Could not delete addr %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:1998 -+msgid "Could not deleteall node mappings" -+msgstr "" -+ -+#: ../semanage/seobject.py:2012 -+msgid "Could not list addrs" -+msgstr "" -+ -+#: ../semanage/seobject.py:2062 ../semanage/seobject.py:2370 -+msgid "SELinux Type is required" -+msgstr "" -+ -+#: ../semanage/seobject.py:2070 ../semanage/seobject.py:2133 -+#: ../semanage/seobject.py:2169 ../semanage/seobject.py:2175 -+#, python-format -+msgid "Could not check if interface %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2072 -+#, python-format -+msgid "Interface %s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2076 -+#, python-format -+msgid "Could not create interface for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2085 -+#, python-format -+msgid "Could not set user in interface context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2089 -+#, python-format -+msgid "Could not set role in interface context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2093 -+#, python-format -+msgid "Could not set type in interface context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2098 -+#, python-format -+msgid "Could not set mls fields in interface context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2102 -+#, python-format -+msgid "Could not set interface context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2106 -+#, python-format -+msgid "Could not set message context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2110 -+#, python-format -+msgid "Could not add interface %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2135 ../semanage/seobject.py:2171 -+#, python-format -+msgid "Interface %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2139 -+#, python-format -+msgid "Could not query interface %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2150 -+#, python-format -+msgid "Could not modify interface %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2177 -+#, python-format -+msgid "Interface %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:2181 -+#, python-format -+msgid "Could not delete interface %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2195 -+msgid "Could not delete all interface mappings" -+msgstr "" -+ -+#: ../semanage/seobject.py:2209 -+msgid "Could not list interfaces" -+msgstr "" -+ -+#: ../semanage/seobject.py:2231 -+msgid "SELinux Interface" -+msgstr "" -+ -+#: ../semanage/seobject.py:2231 ../semanage/seobject.py:2611 -+msgid "Context" -+msgstr "" -+ -+#: ../semanage/seobject.py:2299 -+#, python-format -+msgid "Target %s is not valid. Target is not allowed to end with '/'" -+msgstr "" -+ -+#: ../semanage/seobject.py:2302 -+#, python-format -+msgid "Substiture %s is not valid. Substitute is not allowed to end with '/'" -+msgstr "" -+ -+#: ../semanage/seobject.py:2305 -+#, python-format -+msgid "Equivalence class for %s already exists" -+msgstr "" -+ -+#: ../semanage/seobject.py:2311 -+#, python-format -+msgid "File spec %s conflicts with equivalency rule '%s %s'" -+msgstr "" -+ -+#: ../semanage/seobject.py:2322 -+#, python-format -+msgid "Equivalence class for %s does not exist" -+msgstr "" -+ -+#: ../semanage/seobject.py:2339 -+#, python-format -+msgid "Could not set user in file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2343 -+#, python-format -+msgid "Could not set role in file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2348 ../semanage/seobject.py:2406 -+#, python-format -+msgid "Could not set mls fields in file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2354 -+msgid "Invalid file specification" -+msgstr "" -+ -+#: ../semanage/seobject.py:2356 -+msgid "File specification can not include spaces" -+msgstr "" -+ -+#: ../semanage/seobject.py:2361 -+#, python-format -+msgid "" -+"File spec %s conflicts with equivalency rule '%s %s'; Try adding '%s' instead" -+msgstr "" -+ -+#: ../semanage/seobject.py:2373 ../semanage/seobject.py:2436 -+#, python-format -+msgid "Type %s is invalid, must be a file or device type" -+msgstr "" -+ -+#: ../semanage/seobject.py:2381 ../semanage/seobject.py:2386 -+#: ../semanage/seobject.py:2446 ../semanage/seobject.py:2540 -+#: ../semanage/seobject.py:2544 -+#, python-format -+msgid "Could not check if file context for %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2389 -+#, python-format -+msgid "File context for %s already defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2393 -+#, python-format -+msgid "Could not create file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2401 -+#, python-format -+msgid "Could not set type in file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2409 ../semanage/seobject.py:2476 -+#: ../semanage/seobject.py:2480 -+#, python-format -+msgid "Could not set file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2415 -+#, python-format -+msgid "Could not add file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2434 -+msgid "Requires setype, serange or seuser" -+msgstr "" -+ -+#: ../semanage/seobject.py:2450 ../semanage/seobject.py:2548 -+#, python-format -+msgid "File context for %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2458 -+#, python-format -+msgid "Could not query file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2484 -+#, python-format -+msgid "Could not modify file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2502 -+msgid "Could not list the file contexts" -+msgstr "" -+ -+#: ../semanage/seobject.py:2516 -+#, python-format -+msgid "Could not delete the file context %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2546 -+#, python-format -+msgid "File context for %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:2552 -+#, python-format -+msgid "Could not delete file context for %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2569 -+msgid "Could not list file contexts" -+msgstr "" -+ -+#: ../semanage/seobject.py:2573 -+msgid "Could not list file contexts for home directories" -+msgstr "" -+ -+#: ../semanage/seobject.py:2577 -+msgid "Could not list local file contexts" -+msgstr "" -+ -+#: ../semanage/seobject.py:2611 -+msgid "SELinux fcontext" -+msgstr "" -+ -+#: ../semanage/seobject.py:2624 -+msgid "" -+"\n" -+"SELinux Distribution fcontext Equivalence \n" -+msgstr "" -+ -+#: ../semanage/seobject.py:2629 -+msgid "" -+"\n" -+"SELinux Local fcontext Equivalence \n" -+msgstr "" -+ -+#: ../semanage/seobject.py:2667 ../semanage/seobject.py:2718 -+#: ../semanage/seobject.py:2724 -+#, python-format -+msgid "Could not check if boolean %s is defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2669 ../semanage/seobject.py:2720 -+#, python-format -+msgid "Boolean %s is not defined" -+msgstr "" -+ -+#: ../semanage/seobject.py:2673 -+#, python-format -+msgid "Could not query file context %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2678 -+#, python-format -+msgid "You must specify one of the following values: %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2683 -+#, python-format -+msgid "Could not set active value of boolean %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2686 -+#, python-format -+msgid "Could not modify boolean %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2702 -+#, python-format -+msgid "Bad format %s: Record %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2726 -+#, python-format -+msgid "Boolean %s is defined in policy, cannot be deleted" -+msgstr "" -+ -+#: ../semanage/seobject.py:2730 -+#, python-format -+msgid "Could not delete boolean %s" -+msgstr "" -+ -+#: ../semanage/seobject.py:2742 ../semanage/seobject.py:2759 -+msgid "Could not list booleans" -+msgstr "" -+ -+#: ../semanage/seobject.py:2792 -+msgid "off" -+msgstr "" -+ -+#: ../semanage/seobject.py:2792 -+msgid "on" -+msgstr "" -+ -+#: ../semanage/seobject.py:2804 -+msgid "SELinux boolean" -+msgstr "" -+ -+#: ../semanage/seobject.py:2804 -+msgid "State" -+msgstr "" -+ -+#: ../semanage/seobject.py:2804 -+msgid "Default" -+msgstr "" -+ -+#: ../semanage/seobject.py:2804 ../sepolicy/sepolicy/sepolicy.glade:2148 -+#: ../sepolicy/sepolicy/sepolicy.glade:2518 -+#: ../sepolicy/sepolicy/sepolicy.glade:5117 -+msgid "Description" -+msgstr "" -+ -+#: ../sepolgen/src/sepolgen/interfaces.py:486 -+msgid "Found circular interface class" -+msgstr "" -+ -+#: ../sepolgen/src/sepolgen/interfaces.py:491 -+#, python-format -+msgid "Missing interface definition for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:141 -+msgid "Standard Init Daemon" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:142 -+msgid "DBUS System Daemon" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:143 -+msgid "Internet Services Daemon" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:144 -+msgid "Web Application/Script (CGI)" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:145 -+msgid "Sandbox" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:146 -+msgid "User Application" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:147 -+msgid "Existing Domain Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:148 -+msgid "Minimal Terminal Login User Role" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:149 -+msgid "Minimal X Windows Login User Role" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:150 -+msgid "Desktop Login User Role" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:151 -+msgid "Administrator Login User Role" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:152 -+msgid "Confined Root Administrator Role" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:153 -+msgid "Module information for a new type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:159 -+msgid "Valid Types:\n" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:194 -+#, python-format -+msgid "Ports must be numbers or ranges of numbers from 1 to %d " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:206 -+msgid "You must enter a valid policy type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:209 -+#, python-format -+msgid "You must enter a name for your policy module for your '%s'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:347 -+msgid "" -+"Name must be alpha numberic with no spaces. Consider using option \"-n " -+"MODULENAME\"" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:439 -+msgid "User Role types can not be assigned executables." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:445 -+msgid "Only Daemon apps can use an init script.." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:463 -+msgid "use_resolve must be a boolean value " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:469 -+msgid "use_syslog must be a boolean value " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:475 -+msgid "use_kerberos must be a boolean value " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:481 -+msgid "manage_krb5_rcache must be a boolean value " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:511 -+msgid "USER Types automatically get a tmp type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:848 -+#, python-format -+msgid "'%s' policy modules require existing domains" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:873 -+msgid "Type field required" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:886 -+#, python-format -+msgid "" -+"You need to define a new type which ends with: \n" -+" %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1114 -+msgid "You must enter the executable path for your confined process" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1381 -+msgid "Type Enforcement file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1382 -+msgid "Interface file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1383 -+msgid "File Contexts file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1386 -+msgid "Spec file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/generate.py:1387 -+msgid "Setup Script" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:68 ../sepolicy/sepolicy/sepolicy.glade:3742 -+#: ../sepolicy/sepolicy/sepolicy.glade:3844 -+#: ../sepolicy/sepolicy/sepolicy.glade:3907 -+#: ../sepolicy/sepolicy/sepolicy.glade:3970 -+msgid "No" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:68 ../sepolicy/sepolicy/sepolicy.glade:3725 -+#: ../sepolicy/sepolicy/sepolicy.glade:3826 -+#: ../sepolicy/sepolicy/sepolicy.glade:3890 -+#: ../sepolicy/sepolicy/sepolicy.glade:3953 -+msgid "Yes" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:69 -+msgid "Disable" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:69 -+msgid "Enable" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:82 ../sepolicy/sepolicy/sepolicy.glade:726 -+#: ../sepolicy/sepolicy/sepolicy.glade:1467 -+#: ../sepolicy/sepolicy/sepolicy.glade:3511 -+msgid "Advanced >>" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:82 -+msgid "Advanced <<" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:83 ../sepolicy/sepolicy/sepolicy.glade:80 -+msgid "Advanced Search >>" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:83 -+msgid "Advanced Search <<" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:108 -+msgid "" -+"\n" -+"To change from Disabled to Enforcing mode\n" -+"- Change the system mode from Disabled to Permissive\n" -+"- Reboot, so that the system can relabel\n" -+"- Once the system is working as planned\n" -+" * Change the system mode to Enforcing\n" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:503 -+#, python-format -+msgid "%s is not a valid domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:652 -+msgid "System Status: Disabled" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:750 -+msgid "Help: Start Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:754 -+msgid "Help: Booleans Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:760 -+msgid "Help: Executable Files Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:763 -+msgid "Help: Writable Files Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:766 -+msgid "Help: Application Types Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:771 -+msgid "Help: Outbound Network Connections Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:774 -+msgid "Help: Inbound Network Connections Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:780 -+msgid "Help: Transition from application Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:783 -+msgid "Help: Transition into application Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:786 -+msgid "Help: Transition application file Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:790 -+msgid "Help: Systems Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:794 -+msgid "Help: Lockdown Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:798 -+msgid "Help: Login Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:802 -+msgid "Help: SELinux User Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:806 -+msgid "Help: File Equivalence Page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:951 ../sepolicy/sepolicy/gui.py:1242 -+#: ../sepolicy/sepolicy/gui.py:1682 ../sepolicy/sepolicy/gui.py:1929 -+#: ../sepolicy/sepolicy/gui.py:2717 -+msgid "More..." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1059 -+#, python-format -+msgid "File path used to enter the '%s' domain." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1060 -+#, python-format -+msgid "Files to which the '%s' domain can write." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1061 -+#, python-format -+msgid "Network Ports to which the '%s' is allowed to connect." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1062 -+#, python-format -+msgid "Network Ports to which the '%s' is allowed to listen." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1063 -+#, python-format -+msgid "File Types defined for the '%s'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1064 -+#, python-format -+msgid "" -+"Display boolean information that can be used to modify the policy for the " -+"'%s'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1065 -+#, python-format -+msgid "Display file type information that can be used by the '%s'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1066 -+#, python-format -+msgid "Display network ports to which the '%s' can connect or listen to." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1067 -+#, python-format -+msgid "Application Transitions Into '%s'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1068 -+#, python-format -+msgid "Application Transitions From '%s'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1069 -+#, python-format -+msgid "File Transitions From '%s'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1070 -+#, python-format -+msgid "" -+"Executables which will transition to '%s', when executing selected domains " -+"entrypoint." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1071 -+#, python-format -+msgid "" -+"Executables which will transition to a different domain, when '%s' executes " -+"them." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1072 -+#, python-format -+msgid "Files by '%s' with transitions to a different label." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1073 -+#, python-format -+msgid "Display applications that can transition into or out of the '%s'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1167 ../sepolicy/sepolicy/__init__.py:74 -+msgid "all files" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1181 -+msgid "MISSING FILE PATH" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1296 -+#, python-format -+msgid "To disable this transition, go to the %sBoolean section%s." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1298 -+#, python-format -+msgid "To enable this transition, go to the %sBoolean section%s." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1355 -+msgid "executable" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1358 -+msgid "writable" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1361 -+msgid "application" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1362 -+#, python-format -+msgid "Add new %(TYPE)s file path for '%(DOMAIN)s' domains." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1363 -+#, python-format -+msgid "Delete %(TYPE)s file paths for '%(DOMAIN)s' domain." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1364 -+#, python-format -+msgid "" -+"Modify %(TYPE)s file path for '%(DOMAIN)s' domain. Only bolded items in the " -+"list can be selected, this indicates they were modified previously." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1376 -+msgid "connect" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1379 -+msgid "listen for inbound connections" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1381 -+#, python-format -+msgid "" -+"Add new port definition to which the '%(APP)s' domain is allowed to %(PERM)s." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1382 -+#, python-format -+msgid "" -+"Delete modified port definitions to which the '%(APP)s' domain is allowed to " -+"%(PERM)s." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1383 -+#, python-format -+msgid "" -+"Modify port definitions to which the '%(APP)s' domain is allowed to %(PERM)s." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1412 -+msgid "Add new SELinux User/Role definition." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1413 -+msgid "Delete modified SELinux User/Role definitions." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1414 -+msgid "Modify selected modified SELinux User/Role definitions." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1421 -+msgid "Add new Login Mapping definition." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1422 -+msgid "Delete modified Login Mapping definitions." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1423 -+msgid "Modify selected modified Login Mapping definitions." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1430 -+msgid "Add new File Equivalence definition." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1431 -+msgid "Delete modified File Equivalence definitions." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1432 -+msgid "" -+"Modify selected modified File Equivalence definitions. Only bolded items in " -+"the list can be selected, this indicates they were modified previously." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1460 -+#, python-format -+msgid "Boolean %s Allow Rules" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1473 -+#, python-format -+msgid "Add Network Port for %s. Ports will be created when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1474 -+#, python-format -+msgid "Add Network Port for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1479 -+#, python-format -+msgid "" -+"Add File Labeling for %s. File labels will be created when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1480 ../sepolicy/sepolicy/gui.py:1533 -+#, python-format -+msgid "Add File Labeling for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1490 -+msgid "Add Login Mapping. User Mapping will be created when Update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1491 -+msgid "Add Login Mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1496 -+msgid "" -+"Add SELinux User Role. SELinux user roles will be created when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1497 -+msgid "Add SELinux Users" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1504 -+msgid "" -+"Add File Equivalency Mapping. Mapping will be created when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1505 -+msgid "Add SELinux File Equivalency" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1532 -+#, python-format -+msgid "" -+"Modify File Labeling for %s. File labels will be created when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1588 -+msgid "" -+"Modify SELinux User Role. SELinux user roles will be modified when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1589 -+msgid "Modify SELinux Users" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1597 -+msgid "" -+"Modify Login Mapping. Login Mapping will be modified when Update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1598 -+msgid "Modify Login Mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1604 -+msgid "" -+"Modify File Equivalency Mapping. Mapping will be created when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1605 -+msgid "Modify SELinux File Equivalency" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1690 -+#, python-format -+msgid "" -+"Modify Network Port for %s. Ports will be created when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1691 -+#, python-format -+msgid "Modify Network Port for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1910 -+#, python-format -+msgid "The entry '%s' is not a valid path. Paths must begin with a '/'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:1923 -+msgid "Port number must be between 1 and 65536" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2203 -+#, python-format -+msgid "SELinux name: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2214 -+#, python-format -+msgid "Add file labeling for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2216 -+#, python-format -+msgid "Delete file labeling for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2218 -+#, python-format -+msgid "Modify file labeling for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2222 -+#, python-format -+msgid "File path: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2225 -+#, python-format -+msgid "File class: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2228 ../sepolicy/sepolicy/gui.py:2252 -+#, python-format -+msgid "SELinux file type: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2237 -+#, python-format -+msgid "Add ports for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2239 -+#, python-format -+msgid "Delete ports for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2241 -+#, python-format -+msgid "Modify ports for %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2244 -+#, python-format -+msgid "Network ports: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2247 -+#, python-format -+msgid "Network protocol: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2261 -+msgid "Add user" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2263 -+msgid "Delete user" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2265 -+msgid "Modify user" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2268 -+#, python-format -+msgid "SELinux User : %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2273 -+#, python-format -+msgid "Roles: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2277 ../sepolicy/sepolicy/gui.py:2302 -+#, python-format -+msgid "MLS/MCS Range: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2286 -+msgid "Add login mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2288 -+msgid "Delete login mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2290 -+msgid "Modify login mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2294 -+#, python-format -+msgid "Login Name : %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2298 -+#, python-format -+msgid "SELinux User: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2311 -+msgid "Add file equiv labeling." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2313 -+msgid "Delete file equiv labeling." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2315 -+msgid "Modify file equiv labeling." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2319 -+#, python-format -+msgid "File path : %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2323 -+#, python-format -+msgid "Equivalence: %s" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2354 ../sepolicy/sepolicy/sepolicy.glade:129 -+#: ../sepolicy/sepolicy/sepolicy.glade:1898 -+#: ../sepolicy/sepolicy/sepolicy.glade:3803 -+msgid "System" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2363 ../sepolicy/sepolicy/sepolicy.glade:95 -+msgid "File Equivalence" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2373 ../sepolicy/sepolicy/sepolicy.glade:112 -+msgid "Users" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2426 -+#, python-format -+msgid "" -+"Run restorecon on %(PATH)s to change its type from %(CUR_CONTEXT)s to the " -+"default %(DEF_CONTEXT)s?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2436 ../sepolicy/sepolicy/sepolicy.glade:4226 -+msgid "Update" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2438 -+msgid "Update Changes" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2440 -+msgid "Revert Changes" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2571 -+msgid "System Status: Enforcing" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2574 -+msgid "System Status: Permissive" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2638 -+msgid "" -+"Changing the policy type will cause a relabel of the entire file system on " -+"the next boot. Relabeling takes a long time depending on the size of the " -+"file system. Do you wish to continue?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2768 -+msgid "" -+"Changing to SELinux disabled requires a reboot. It is not recommended. If " -+"you later decide to turn SELinux back on, the system will be required to " -+"relabel. If you just want to see if SELinux is causing a problem on your " -+"system, you can go to permissive mode which will only log errors and not " -+"enforce SELinux policy. Permissive mode does not require a reboot. Do you " -+"wish to continue?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2772 -+msgid "" -+"Changing to SELinux enabled will cause a relabel of the entire file system " -+"on the next boot. Relabeling takes a long time depending on the size of the " -+"file system. Do you wish to continue?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2802 -+msgid "" -+"You are attempting to close the application without applying your changes.\n" -+" * To apply changes you have made during this session, click No and " -+"click Update.\n" -+" * To leave the application without applying your changes, click Yes. " -+"All changes that you have made during this session will be lost." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/gui.py:2802 -+msgid "Loss of data Dialog" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:75 -+msgid "regular file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:76 -+msgid "directory" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:77 -+msgid "character device" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:78 -+msgid "block device" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:79 -+msgid "socket file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:80 -+msgid "symbolic link" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:81 -+msgid "named pipe" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:130 -+msgid "No SELinux Policy installed" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:157 -+#, python-format -+msgid "Failed to read %s policy file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:418 -+#, python-format -+msgid "-- Allowed %s [ %s ]" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:831 -+msgid "You must regenerate interface info by running /usr/bin/sepolgen-ifgen" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/__init__.py:1150 -+msgid "unknown" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/interface.py:223 -+#, python-format -+msgid "Compiling %s interface" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/interface.py:231 -+#, python-format -+msgid "" -+"\n" -+"Compile test for %s failed.\n" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/interface.py:234 -+#, python-format -+msgid "" -+"\n" -+"Compile test for %s has not run. %s\n" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/interface.py:240 -+#, python-format -+msgid "" -+"\n" -+"Compiling of %s interface is not supported." -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:227 -+#, python-format -+msgid "Interface %s does not exist." -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:324 -+msgid "You need to install policycoreutils-gui package to use the gui option" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:329 -+msgid "Graphical User Interface for SELinux Policy" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:332 ../sepolicy/sepolicy.py:380 -+msgid "Domain name(s) of man pages to be created" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:345 -+msgid "Alternative root needs to be setup" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:362 -+msgid "Generate SELinux man pages" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:365 -+msgid "path in which the generated SELinux man pages will be stored" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:367 -+msgid "name of the OS for man pages" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:369 -+msgid "Generate HTML man pages structure for selected SELinux man page" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:371 -+msgid "Alternate root directory, defaults to /" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:373 -+msgid "" -+"With this flag, alternative root path needs to include file context files " -+"and policy.xml file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:377 -+msgid "All domains" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:386 -+msgid "Query SELinux policy network information" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:391 -+msgid "list all SELinux port types" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:394 -+msgid "show SELinux type related to the port" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:397 -+msgid "Show ports defined for this SELinux type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:400 -+msgid "show ports to which this domain can bind and/or connect" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:403 -+msgid "show ports to which this application can bind and/or connect" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:420 -+msgid "query SELinux policy to see if domains can communicate with each other" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:423 -+msgid "Source Domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:426 -+msgid "Target Domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:447 -+msgid "query SELinux Policy to see description of booleans" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:451 -+msgid "get all booleans descriptions" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:454 -+msgid "boolean to get description" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:466 -+msgid "" -+"query SELinux Policy to see how a source process domain can transition to " -+"the target process domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:469 -+msgid "source process domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:472 -+msgid "target process domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:517 -+#, python-format -+msgid "sepolicy generate: error: one of the arguments %s is required" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:522 -+msgid "Command required for this type of policy" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:533 -+#, python-format -+msgid "" -+"-t option can not be used with '%s' domains. Read usage for more details." -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:538 -+#, python-format -+msgid "" -+"-d option can not be used with '%s' domains. Read usage for more details." -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:542 -+#, python-format -+msgid "" -+"-a option can not be used with '%s' domains. Read usage for more details." -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:546 -+msgid "-w option can not be used with the --newtype option" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:567 -+msgid "List SELinux Policy interfaces" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:587 -+msgid "Enter interface names, you wish to query" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:597 -+msgid "Generate SELinux Policy module template" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:600 -+msgid "Enter domain type which you will be extending" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:603 -+msgid "Enter SELinux user(s) which will transition to this domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:606 -+msgid "Enter SELinux role(s) to which the administror domain will transition" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:609 -+msgid "Enter domain(s) which this confined admin will administrate" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:612 -+msgid "name of policy to generate" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:619 -+msgid "path in which the generated policy files will be stored" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:621 -+msgid "path to which the confined processes will need to write" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:622 -+msgid "Policy types which require a command" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:626 ../sepolicy/sepolicy.py:629 -+#: ../sepolicy/sepolicy.py:632 ../sepolicy/sepolicy.py:635 -+#: ../sepolicy/sepolicy.py:638 ../sepolicy/sepolicy.py:644 -+#: ../sepolicy/sepolicy.py:647 ../sepolicy/sepolicy.py:650 -+#: ../sepolicy/sepolicy.py:656 ../sepolicy/sepolicy.py:659 -+#: ../sepolicy/sepolicy.py:662 ../sepolicy/sepolicy.py:665 -+#, python-format -+msgid "Generate '%s' policy" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:653 -+#, python-format -+msgid "Generate '%s' policy " -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:667 -+msgid "executable to confine" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:672 -+msgid "commands" -+msgstr "" -+ -+#: ../sepolicy/sepolicy.py:675 -+msgid "Alternate SELinux policy, defaults to /sys/fs/selinux/policy" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:25 -+#: ../sepolicy/sepolicy/sepolicy.glade:4330 -+msgid "Applications" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:52 -+msgid "Select domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:189 -+#: ../sepolicy/sepolicy/sepolicy.glade:4367 -+#: ../sepolicy/sepolicy/sepolicy.glade:4460 -+#: ../sepolicy/sepolicy/sepolicy.glade:4606 -+#: ../sepolicy/sepolicy/sepolicy.glade:4755 -+#: ../sepolicy/sepolicy/sepolicy.glade:4889 -+#: ../sepolicy/sepolicy/sepolicy.glade:5030 -+#: ../sepolicy/sepolicy/sepolicy.glade:5103 -+#: ../sepolicy/sepolicy/sepolicy.glade:5238 -+msgid "Select" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:204 -+#: ../sepolicy/sepolicy/sepolicy.glade:539 -+#: ../sepolicy/sepolicy/sepolicy.glade:684 -+#: ../sepolicy/sepolicy/sepolicy.glade:1239 -+#: ../sepolicy/sepolicy/sepolicy.glade:1535 -+#: ../sepolicy/sepolicy/sepolicy.glade:4540 -+#: ../sepolicy/sepolicy/sepolicy.glade:4690 -+#: ../sepolicy/sepolicy/sepolicy.glade:4821 -+#: ../sepolicy/sepolicy/sepolicy.glade:4955 -+#: ../sepolicy/sepolicy/sepolicy.glade:5173 -+#: ../sepolicy/sepolicy/sepolicy.glade:5304 -+#: ../sepolicy/sepolicy/sepolicy.glade:5464 -+msgid "Cancel" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:332 -+msgid "" -+"The entry that was entered is incorrect. Please try again in the " -+"ex:/.../... format." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:358 -+msgid "Retry" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:442 -+#: ../sepolicy/sepolicy/sepolicy.glade:1120 -+#: ../sepolicy/sepolicy/sepolicy.glade:1368 -+#: ../sepolicy/sepolicy/sepolicy.glade:5332 -+msgid "Network Port Definitions" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:458 -+msgid "" -+"Add file Equivalence Mapping. Mapping will be created when Update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:483 -+#: ../sepolicy/sepolicy/sepolicy.glade:4046 -+msgid "Path" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:493 -+#: ../sepolicy/sepolicy/sepolicy.glade:5384 -+msgid "" -+"Specify a new SELinux user name. By convention SELinux User names usually " -+"end in an _u." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:497 -+msgid "Enter the path to which you want to setup an equivalence label." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:510 -+#: ../sepolicy/sepolicy/sepolicy.glade:4063 -+#: ../sepolicy/sepolicy/sepolicy.glade:4781 -+msgid "Equivalence Path" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:524 -+#: ../sepolicy/sepolicy/sepolicy.glade:669 -+#: ../sepolicy/sepolicy/sepolicy.glade:1224 -+#: ../sepolicy/sepolicy/sepolicy.glade:1520 -+#: ../sepolicy/sepolicy/sepolicy.glade:5449 -+msgid "Save to update" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:564 -+msgid "" -+"Specify the mapping between the new path and the equivalence path. " -+"Everything under this new path will be labeled as if they were under the " -+"equivalence path." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:621 -+msgid "Add a file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:638 -+msgid "" -+" File Labeling for . File labels will be created " -+"when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:711 -+#: ../sepolicy/sepolicy/sepolicy.glade:1485 -+msgid "MLS" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:747 -+#: ../sepolicy/sepolicy/sepolicy.glade:2306 -+#: ../sepolicy/sepolicy/sepolicy.glade:2418 -+#: ../sepolicy/sepolicy/sepolicy.glade:2540 -+#: ../sepolicy/sepolicy/sepolicy.glade:4500 -+msgid "Class" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:763 -+msgid "Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:777 -+msgid "" -+"Select the file class to which this label will be applied. Defaults to all " -+"classes." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:804 -+msgid "Make Path Recursive" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:808 -+msgid "" -+"Select Make Path Recursive if you want to apply this label to all children " -+"of the specified directory path. objects under the directory to have this " -+"label." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:821 -+msgid "Browse" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:825 -+msgid "Browse to select the file/directory for labeling." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:869 -+msgid "Path " -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:880 -+msgid "" -+"Specify the path using regular expressions that you would like to modify the " -+"labeling." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:902 -+msgid "Select the SELinux file type to assign to this path." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:929 -+msgid "Enter the MLS Label to assign to this file path." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:933 -+msgid "SELinux MLS Label you wish to assign to this path." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1070 -+msgid "Analyzing Policy..." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1137 -+msgid "" -+"Add Login Mapping. Login Mapping will be created when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1172 -+msgid "" -+"Enter the login user name of the user to which you wish to add SELinux User " -+"confinement." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1201 -+msgid "" -+"Select the SELinux User to assign to this login user. Login users by " -+"default get assigned by the __default__ user." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1264 -+msgid "" -+"Enter MLS/MCS Range for this login User. Defaults to the range for the " -+"Selected SELinux User." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1267 -+#: ../sepolicy/sepolicy/sepolicy.glade:3192 -+#: ../sepolicy/sepolicy/sepolicy.glade:3313 -+#: ../sepolicy/sepolicy/sepolicy.glade:5414 -+msgid "MLS Range" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1279 -+msgid "" -+"Specify the MLS Range for this user to login in with. Defaults to the " -+"selected SELinux Users MLS Range." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1385 -+msgid "" -+" Network Port for . Ports will be created when " -+"update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1423 -+msgid "Enter the port number or range to which you want to add a port type." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1439 -+#: ../sepolicy/sepolicy/sepolicy.glade:2658 -+#: ../sepolicy/sepolicy/sepolicy.glade:2756 -+#: ../sepolicy/sepolicy/sepolicy.glade:4633 -+msgid "Protocol" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1453 -+msgid "Port Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1498 -+msgid "Select the port type you want to assign to the specified port number." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1562 -+msgid "tcp" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1566 -+msgid "" -+"Select tcp if the port type should be assigned to tcp port numbers." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1579 -+msgid "udp" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1583 -+msgid "" -+"Select udp if the port type should be assigned to udp port numbers." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1605 -+msgid "Enter the MLS Label to assign to this port." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1707 -+msgid "SELinux Configuration" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1743 -+msgid "Select..." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1792 -+#: ../sepolicy/sepolicy/sepolicy.glade:2212 -+msgid "Booleans" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1796 -+msgid "" -+"Display boolean information that can be used to modify the policy for the " -+"'selected domain'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1810 -+#: ../sepolicy/sepolicy/sepolicy.glade:2597 -+msgid "Files" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1814 -+msgid "" -+"Display file type information that can be used by the 'selected domain'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1828 -+#: ../sepolicy/sepolicy/sepolicy.glade:2830 -+msgid "Network" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1832 -+msgid "" -+"Display network ports to which the 'selected domain' can connect or listen " -+"to." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1846 -+#: ../sepolicy/sepolicy/sepolicy.glade:3121 -+msgid "Transitions" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1850 -+msgid "" -+"Display applications that can transition into or out of the 'selected " -+"domain'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1864 -+#: ../sepolicy/sepolicy/sepolicy.glade:3222 -+msgid "Login Mapping" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1867 -+#: ../sepolicy/sepolicy/sepolicy.glade:1884 -+#: ../sepolicy/sepolicy/sepolicy.glade:1901 -+msgid "Manage the SELinux configuration" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1881 -+#: ../sepolicy/sepolicy/sepolicy.glade:3344 -+msgid "SELinux Users" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1915 -+#: ../sepolicy/sepolicy/sepolicy.glade:4016 -+msgid "Lockdown" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1918 -+msgid "" -+"Lockdown the SELinux System.\n" -+"This screen can be used to turn up the SELinux Protections." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1933 -+msgid "radiobutton" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:1993 -+msgid "Filter" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2021 -+msgid "Show Modified Only" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2060 -+msgid "Mislabeled files exist" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2080 -+msgid "Show mislabeled files only" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2120 -+#: ../sepolicy/sepolicy/sepolicy.glade:3244 -+msgid "" -+"If-Then-Else rules written in policy that can\n" -+"allow alternative access control." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2132 -+msgid "Enabled" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2183 -+msgid "Name" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2252 -+#: ../sepolicy/sepolicy/sepolicy.glade:2364 -+#: ../sepolicy/sepolicy/sepolicy.glade:2482 -+#: ../sepolicy/sepolicy/sepolicy.glade:4473 -+#: ../sepolicy/sepolicy/sepolicy.glade:4768 -+msgid "File Path" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2288 -+#: ../sepolicy/sepolicy/sepolicy.glade:2399 -+msgid "SELinux File Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2332 -+msgid "File path used to enter the 'selected domain'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2333 -+msgid "Executable Files" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2448 -+msgid "Files to which the 'selected domain' can write." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2449 -+msgid "Writable files" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2571 -+msgid "File Types defined for the 'selected domain'." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2572 -+msgid "Application File Types" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2639 -+#: ../sepolicy/sepolicy/sepolicy.glade:2738 -+#: ../sepolicy/sepolicy/sepolicy.glade:4619 -+msgid "Port" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2704 -+msgid "Network Ports to which the 'selected domain' is allowed to connect." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2705 -+msgid "Outbound" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2804 -+msgid "Network Ports to which the 'selected domain' is allowed to listen." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2805 -+msgid "Inbound" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2866 -+#: ../sepolicy/sepolicy/sepolicy.glade:2956 -+msgid "" -+"Boolean\n" -+"Enabled" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2892 -+msgid "Boolean name" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2909 -+msgid "SELinux Application Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2930 -+msgid "" -+"Executables which will transition to a different domain, when the 'selected " -+"domain' executes them." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2933 -+msgid "Application Transitions From 'select domain'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2972 -+msgid "Calling Process Domain" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:2988 -+msgid "Executable File" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3012 -+msgid "" -+"Executables which will transition to the 'selected domain', when executing a " -+"selected domains entrypoint." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3013 -+msgid "Application Transitions Into 'select domain'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3028 -+msgid "" -+"File Transitions define what happens when the current domain creates the " -+"content of a particular class in a directory of the destination type. " -+"Optionally a file name could be specified for the transition." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3036 -+msgid "SELinux Directory Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3049 -+msgid "Destination Class" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3063 -+msgid "SELinux Destination Type" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3076 -+msgid "File Name" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3098 -+msgid "File Transitions From 'select domain'" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3297 -+#: ../sepolicy/sepolicy/sepolicy.glade:5508 -+msgid "Default Level" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3383 -+msgid "Select the system mode when the system first boots up" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3395 -+#: ../sepolicy/sepolicy/sepolicy.glade:3469 -+msgid "Enforcing" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3414 -+#: ../sepolicy/sepolicy/sepolicy.glade:3487 -+msgid "Permissive" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3456 -+msgid "Select the system mode for the current session" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3533 -+msgid "System Policy Type:" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3594 -+msgid "System Mode" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3632 -+msgid "Import system settings from another machine" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3640 -+msgid "Import" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3659 -+msgid "Export system settings to a file" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3669 -+msgid "Export" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3688 -+msgid "Relabel all files back to system defaults on reboot" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3783 -+msgid "System Configuration" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3830 -+#: ../sepolicy/sepolicy/sepolicy.glade:3848 -+msgid "" -+"An unconfined domain is a process label that allows the process to do what " -+"it wants, without SELinux interfering. Applications started at boot by the " -+"init system that SELinux do not have defined SELinux policy will run as " -+"unconfined if this module is enabled. Disabling it means all daemons will " -+"now be confined. To disable the unconfined_t user you must first remove " -+"unconfined_t from the users/login screens." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3866 -+msgid "Disable ability to run unconfined system processes?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3894 -+#: ../sepolicy/sepolicy/sepolicy.glade:3911 -+#: ../sepolicy/sepolicy/sepolicy.glade:3957 -+#: ../sepolicy/sepolicy/sepolicy.glade:3974 -+msgid "" -+"A permissive domain is a process label that allows the process to do what it " -+"wants, with SELinux only logging the denials, but not enforcing them. " -+"Usually permissive domains indicate experimental policy, disabling the " -+"module could cause SELinux to deny access to a domain, that should be " -+"allowed." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3929 -+msgid "Disable all permissive processes?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:3995 -+msgid "Deny all processes from ptracing or debugging other processes?" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4032 -+msgid "" -+"File equivalence cause the system to label content under the new path as if " -+"it were under the equivalence path." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4088 -+msgid "Files Equivalence" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4101 -+msgid "...SELECT TO VIEW DATA..." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4132 -+msgid "Delete" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4148 -+msgid "Modify" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4163 -+msgid "Add" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4209 -+msgid "Revert" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4214 -+msgid "" -+"Revert button will launch a dialog window which allows you to revert changes " -+"within the current transaction." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4231 -+msgid "Commit all changes in your current transaction to the server." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4279 -+msgid "Applications - Advanced Search" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4344 -+msgid "Process Types" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4385 -+msgid "More Details" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4421 -+#: ../sepolicy/sepolicy/sepolicy.glade:4715 -+msgid "Delete Modified File Labeling" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4439 -+msgid "" -+"Select file labeling to delete. File labeling will be deleted when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4486 -+msgid "SELinux File Label" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4525 -+#: ../sepolicy/sepolicy/sepolicy.glade:4675 -+#: ../sepolicy/sepolicy/sepolicy.glade:4806 -+#: ../sepolicy/sepolicy/sepolicy.glade:4940 -+#: ../sepolicy/sepolicy/sepolicy.glade:5289 -+msgid "Save to Update" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4565 -+msgid "Delete Modified Ports" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4583 -+msgid "Select ports to delete. Ports will be deleted when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4733 -+msgid "" -+"Select file equivalence labeling to delete. File equivalence labeling will " -+"be deleted when update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4849 -+#: ../sepolicy/sepolicy/sepolicy.glade:5198 -+msgid "Delete Modified Users Mapping." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4867 -+msgid "" -+"Select login user mapping to delete. Login user mapping will be deleted when " -+"update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4902 -+msgid "Login name" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:4983 -+msgid "More Types" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5010 -+msgid "Types" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5069 -+msgid "" -+"Review the updates you have made before committing them to the system. To " -+"reset an item, uncheck the checkbox. All items checked will be updated in " -+"the system when you select update." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5132 -+msgid "Action" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5158 -+msgid "Apply" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5216 -+msgid "" -+"Select users mapping to delete.Users mapping will be deleted when update is " -+"applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5264 -+msgid "SELinux Username" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5349 -+msgid "" -+"Add User Roles. SELinux User Roles will be created when Update is applied." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5374 -+msgid "SELinux User Name" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5489 -+msgid "" -+"Enter MLS/MCS Range for this SELinux User.\n" -+"s0-s0:c1023" -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5520 -+msgid "" -+"Specify the default level that you would like this SELinux user to login " -+"with. Defaults to s0." -+msgstr "" -+ -+#: ../sepolicy/sepolicy/sepolicy.glade:5524 -+msgid "Enter Default Level for SELinux User to login with. Default s0" -+msgstr "" -diff --git a/sandbox/po/sandbox.pot b/sandbox/po/sandbox.pot -new file mode 100644 -index 000000000000..328b4f0159d3 ---- /dev/null -+++ b/sandbox/po/sandbox.pot -@@ -0,0 +1,157 @@ -+# SOME DESCRIPTIVE TITLE. -+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER -+# This file is distributed under the same license as the PACKAGE package. -+# FIRST AUTHOR , YEAR. -+# -+#, fuzzy -+msgid "" -+msgstr "" -+"Project-Id-Version: PACKAGE VERSION\n" -+"Report-Msgid-Bugs-To: \n" -+"POT-Creation-Date: 2018-08-06 14:22+0200\n" -+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -+"Last-Translator: FULL NAME \n" -+"Language-Team: LANGUAGE \n" -+"Language: \n" -+"MIME-Version: 1.0\n" -+"Content-Type: text/plain; charset=CHARSET\n" -+"Content-Transfer-Encoding: 8bit\n" -+ -+#: ../sandbox:119 -+#, python-format -+msgid "Do you want to save changes to '%s' (Y/N): " -+msgstr "" -+ -+#: ../sandbox:120 -+msgid "Sandbox Message" -+msgstr "" -+ -+#: ../sandbox:132 -+#, python-format -+msgid "Do you want to save changes to '%s' (y/N): " -+msgstr "" -+ -+#: ../sandbox:133 -+msgid "[yY]" -+msgstr "" -+ -+#: ../sandbox:156 -+msgid "User account must be setup with an MCS Range" -+msgstr "" -+ -+#: ../sandbox:184 -+msgid "" -+"Failed to find any unused category sets. Consider a larger MCS range for " -+"this user." -+msgstr "" -+ -+#: ../sandbox:215 -+msgid "Homedir and tempdir required for level mounts" -+msgstr "" -+ -+#: ../sandbox:218 ../sandbox:229 ../sandbox:234 -+#, python-format -+msgid "" -+"\n" -+"%s is required for the action you want to perform.\n" -+msgstr "" -+ -+#: ../sandbox:305 -+#, python-format -+msgid "" -+"\n" -+"Policy defines the following types for use with the -t:\n" -+"\t%s\n" -+msgstr "" -+ -+#: ../sandbox:312 -+#, python-format -+msgid "" -+"\n" -+"sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I " -+"includefile ] [-W windowmanager ] [ -w windowsize ] [[-i file ] ...] [ -t " -+"type ] command\n" -+"\n" -+"sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I " -+"includefile ] [-W windowmanager ] [ -w windowsize ] [[-i file ] ...] [ -t " -+"type ] -S\n" -+"%s\n" -+msgstr "" -+ -+#: ../sandbox:324 -+msgid "include file in sandbox" -+msgstr "" -+ -+#: ../sandbox:327 -+msgid "read list of files to include in sandbox from INCLUDEFILE" -+msgstr "" -+ -+#: ../sandbox:329 -+msgid "run sandbox with SELinux type" -+msgstr "" -+ -+#: ../sandbox:332 -+msgid "mount new home and/or tmp directory" -+msgstr "" -+ -+#: ../sandbox:336 -+msgid "dots per inch for X display" -+msgstr "" -+ -+#: ../sandbox:339 -+msgid "run complete desktop session within sandbox" -+msgstr "" -+ -+#: ../sandbox:342 -+msgid "Shred content before tempory directories are removed" -+msgstr "" -+ -+#: ../sandbox:346 -+msgid "run X application within a sandbox" -+msgstr "" -+ -+#: ../sandbox:352 -+msgid "alternate home directory to use for mounting" -+msgstr "" -+ -+#: ../sandbox:357 -+msgid "alternate /tmp directory to use for mounting" -+msgstr "" -+ -+#: ../sandbox:366 -+msgid "alternate window manager" -+msgstr "" -+ -+#: ../sandbox:369 -+msgid "MCS/MLS level for the sandbox" -+msgstr "" -+ -+#: ../sandbox:385 -+msgid "" -+"Sandbox Policy is not currently installed.\n" -+"You need to install the selinux-policy-sandbox package in order to run this " -+"command" -+msgstr "" -+ -+#: ../sandbox:397 -+msgid "" -+"You must specify a Homedir and tempdir when setting up a session sandbox" -+msgstr "" -+ -+#: ../sandbox:399 -+msgid "Commands are not allowed in a session sandbox" -+msgstr "" -+ -+#: ../sandbox:409 -+msgid "Command required" -+msgstr "" -+ -+#: ../sandbox:412 -+#, python-format -+msgid "%s is not an executable" -+msgstr "" -+ -+#: ../sandbox:535 -+#, python-format -+msgid "Invalid value %s" -+msgstr "" --- -2.32.0 - diff --git a/0013-policycoreutils-setfiles-Improve-description-of-d-sw.patch b/0013-policycoreutils-setfiles-Improve-description-of-d-sw.patch deleted file mode 100644 index f4d6b78..0000000 --- a/0013-policycoreutils-setfiles-Improve-description-of-d-sw.patch +++ /dev/null @@ -1,30 +0,0 @@ -From f5045f645cfa10fed01b4225d26d98ea9f81f085 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Wed, 21 Mar 2018 08:51:31 +0100 -Subject: [PATCH] policycoreutils/setfiles: Improve description of -d switch - -The "-q" switch is becoming obsolete (completely unused in fedora) and -debug output ("-d" switch) makes sense in any scenario. Therefore both -options can be specified at once. - -Resolves: rhbz#1271327 ---- - policycoreutils/setfiles/setfiles.8 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 4d28bc9a95c1..8e6c4ab94841 100644 ---- a/policycoreutils/setfiles/setfiles.8 -+++ b/policycoreutils/setfiles/setfiles.8 -@@ -57,7 +57,7 @@ option will force a replacement of the entire context. - check the validity of the contexts against the specified binary policy. - .TP - .B \-d --show what specification matched each file. -+show what specification matched each file. Not affected by "\-q". - .TP - .BI \-e \ directory - directory to exclude (repeat option for more than one directory). --- -2.32.0 - diff --git a/0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch b/0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch deleted file mode 100644 index e39c750..0000000 --- a/0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch +++ /dev/null @@ -1,24 +0,0 @@ -From f1acc9a3057e199d62c6b8ec6e77fc33ca3db1d1 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 8 Nov 2018 09:20:58 +0100 -Subject: [PATCH] semodule-utils: Fix RESOURCE_LEAK coverity scan defects - ---- - semodule-utils/semodule_package/semodule_package.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/semodule-utils/semodule_package/semodule_package.c b/semodule-utils/semodule_package/semodule_package.c -index 3515234e36de..7b75b3fd9bb4 100644 ---- a/semodule-utils/semodule_package/semodule_package.c -+++ b/semodule-utils/semodule_package/semodule_package.c -@@ -74,6 +74,7 @@ static int file_to_data(const char *path, char **data, size_t * len) - } - if (!sb.st_size) { - *len = 0; -+ close(fd); - return 0; - } - --- -2.32.0 - diff --git a/0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch b/0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch deleted file mode 100644 index 1a3e957..0000000 --- a/0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 0e40b5541773c6daf58bba7048fae6918d74de74 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 28 Jul 2020 14:37:13 +0200 -Subject: [PATCH] sepolicy: Fix flake8 warnings in Fedora-only code - -Fixes: -$ PATH="$VIRTUAL_ENV/bin:$PATH" ./scripts/run-flake8 -Analyzing 187 Python scripts -./installdir/usr/lib/python3.8/site-packages/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in' -./installdir/usr/lib/python3.8/site-packages/sepolicy/manpage.py:774:17: E117 over-indented -./python/sepolicy/build/lib/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in' -./python/sepolicy/build/lib/sepolicy/manpage.py:774:17: E117 over-indented -./python/sepolicy/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in' -./python/sepolicy/sepolicy/manpage.py:774:17: E117 over-indented -The command "PATH="$VIRTUAL_ENV/bin:$PATH" ./scripts/run-flake8" exited with 1. - -Signed-off-by: Ondrej Mosnacek ---- - python/sepolicy/sepolicy/manpage.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index ffcedb547993..c013c0d48502 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -719,7 +719,7 @@ Default Defined Ports:""") - for f in self.all_file_types: - if f.startswith(self.domainname): - flist.append(f) -- if not f in self.exec_types or not f in self.entry_types: -+ if f not in self.exec_types or f not in self.entry_types: - flist_non_exec.append(f) - if f in self.fcdict: - mpaths = mpaths + self.fcdict[f]["regex"] -@@ -773,7 +773,7 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d - """ % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]}) - - if flist_non_exec: -- self.fd.write(r""" -+ self.fd.write(r""" - .PP - .B STANDARD FILE CONTEXT - --- -2.32.0 - diff --git a/0019-setfiles-restorecon-support-parallel-relabeling.patch b/0019-setfiles-restorecon-support-parallel-relabeling.patch deleted file mode 100644 index ad7d65c..0000000 --- a/0019-setfiles-restorecon-support-parallel-relabeling.patch +++ /dev/null @@ -1,253 +0,0 @@ -From fba88f42bf8490a23fa6dcd33de2ccd59170009b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 26 Oct 2021 13:52:39 +0200 -Subject: [PATCH] setfiles/restorecon: support parallel relabeling - -Use the newly introduced selinux_restorecon_parallel(3) in -setfiles/restorecon and a -T option to both to allow enabling parallel -relabeling. The default behavior without specifying the -T option is to -use 1 thread; parallel relabeling must be requested explicitly by -passing -T 0 (which will use as many threads as there are available CPU -cores) or -T , which will use threads. - -=== Benchmarks === -As measured on a 32-core cloud VM with Fedora 34. Not a fully -representative environment, but still the scaling is quite good. - -WITHOUT PATCHES: -$ time restorecon -rn /usr - -real 0m21.689s -user 0m21.070s -sys 0m0.494s - -WITH PATCHES: -$ time restorecon -rn /usr - -real 0m23.940s -user 0m23.127s -sys 0m0.653s -$ time restorecon -rn -T 2 /usr - -real 0m13.145s -user 0m25.306s -sys 0m0.695s -$ time restorecon -rn -T 4 /usr - -real 0m7.559s -user 0m28.470s -sys 0m1.099s -$ time restorecon -rn -T 8 /usr - -real 0m5.186s -user 0m37.450s -sys 0m2.094s -$ time restorecon -rn -T 16 /usr - -real 0m3.831s -user 0m51.220s -sys 0m4.895s -$ time restorecon -rn -T 32 /usr - -real 0m2.650s -user 1m5.136s -sys 0m6.614s - -Note that the benchmarks were performed in read-only mode (-n), so the -labels were only read and looked up in the database, not written. When -fixing labels on a heavily mislabeled system, the scaling would likely -be event better, since a larger % of work could be done in parallel. - -Signed-off-by: Ondrej Mosnacek ---- - policycoreutils/setfiles/Makefile | 2 +- - policycoreutils/setfiles/restore.c | 7 ++++--- - policycoreutils/setfiles/restore.h | 2 +- - policycoreutils/setfiles/restorecon.8 | 9 +++++++++ - policycoreutils/setfiles/setfiles.8 | 9 +++++++++ - policycoreutils/setfiles/setfiles.c | 28 ++++++++++++++++----------- - 6 files changed, 41 insertions(+), 16 deletions(-) - -diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile -index 63d818509791..d7670a8ff54b 100644 ---- a/policycoreutils/setfiles/Makefile -+++ b/policycoreutils/setfiles/Makefile -@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man - AUDITH ?= $(shell test -f /usr/include/libaudit.h && echo y) - - CFLAGS ?= -g -Werror -Wall -W --override LDLIBS += -lselinux -lsepol -+override LDLIBS += -lselinux -lsepol -lpthread - - ifeq ($(AUDITH), y) - override CFLAGS += -DUSE_AUDIT -diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c -index 9d688c609f79..74d48bb3752d 100644 ---- a/policycoreutils/setfiles/restore.c -+++ b/policycoreutils/setfiles/restore.c -@@ -72,7 +72,7 @@ void restore_finish(void) - } - } - --int process_glob(char *name, struct restore_opts *opts) -+int process_glob(char *name, struct restore_opts *opts, size_t nthreads) - { - glob_t globbuf; - size_t i = 0; -@@ -91,8 +91,9 @@ int process_glob(char *name, struct restore_opts *opts) - continue; - if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0) - continue; -- rc = selinux_restorecon(globbuf.gl_pathv[i], -- opts->restorecon_flags); -+ rc = selinux_restorecon_parallel(globbuf.gl_pathv[i], -+ opts->restorecon_flags, -+ nthreads); - if (rc < 0) - errors = rc; - } -diff --git a/policycoreutils/setfiles/restore.h b/policycoreutils/setfiles/restore.h -index ac6ad6809f4f..bb35a1db9e34 100644 ---- a/policycoreutils/setfiles/restore.h -+++ b/policycoreutils/setfiles/restore.h -@@ -49,7 +49,7 @@ struct restore_opts { - void restore_init(struct restore_opts *opts); - void restore_finish(void); - void add_exclude(const char *directory); --int process_glob(char *name, struct restore_opts *opts); -+int process_glob(char *name, struct restore_opts *opts, size_t nthreads); - extern char **exclude_list; - - #endif -diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index a8900f02b3f3..dbd55ce7c512 100644 ---- a/policycoreutils/setfiles/restorecon.8 -+++ b/policycoreutils/setfiles/restorecon.8 -@@ -33,6 +33,8 @@ restorecon \- restore file(s) default SELinux security contexts. - .RB [ \-W ] - .RB [ \-I | \-D ] - .RB [ \-x ] -+.RB [ \-T -+.IR nthreads ] - - .SH "DESCRIPTION" - This manual page describes the -@@ -160,6 +162,13 @@ prevent - .B restorecon - from crossing file system boundaries. - .TP -+.BI \-T \ nthreads -+use up to -+.I nthreads -+threads. Specify 0 to create as many threads as there are available -+CPU cores; 1 to use only a single thread (default); or any positive -+number to use the given number of threads (if possible). -+.TP - .SH "ARGUMENTS" - .IR pathname \ ... - The pathname for the file(s) to be relabeled. -diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 0692121f2f4d..8ef9f602e843 100644 ---- a/policycoreutils/setfiles/setfiles.8 -+++ b/policycoreutils/setfiles/setfiles.8 -@@ -19,6 +19,8 @@ setfiles \- set SELinux file security contexts. - .RB [ \-W ] - .RB [ \-F ] - .RB [ \-I | \-D ] -+.RB [ \-T -+.IR nthreads ] - .I spec_file - .IR pathname \ ... - -@@ -161,6 +163,13 @@ quote marks or backslashes. The - option of GNU - .B find - produces input suitable for this mode. -+.TP -+.BI \-T \ nthreads -+use up to -+.I nthreads -+threads. Specify 0 to create as many threads as there are available -+CPU cores; 1 to use only a single thread (default); or any positive -+number to use the given number of threads (if possible). - - .SH "ARGUMENTS" - .TP -diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c -index f018d161aa9e..2313a21fa0f3 100644 ---- a/policycoreutils/setfiles/setfiles.c -+++ b/policycoreutils/setfiles/setfiles.c -@@ -1,4 +1,5 @@ - #include "restore.h" -+#include - #include - #include - #include -@@ -34,14 +35,14 @@ static __attribute__((__noreturn__)) void usage(const char *const name) - { - if (iamrestorecon) { - fprintf(stderr, -- "usage: %s [-iIDFmnprRv0x] [-e excludedir] pathname...\n" -- "usage: %s [-iIDFmnprRv0x] [-e excludedir] -f filename\n", -+ "usage: %s [-iIDFmnprRv0xT] [-e excludedir] pathname...\n" -+ "usage: %s [-iIDFmnprRv0xT] [-e excludedir] -f filename\n", - name, name); - } else { - fprintf(stderr, -- "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" -- "usage: %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" -- "usage: %s -s [-diIDlmnpqvFW] spec_file\n", -+ "usage: %s [-diIDlmnpqvEFWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" -+ "usage: %s [-diIDlmnpqvEFWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" -+ "usage: %s -s [-diIDlmnpqvFWT] spec_file\n", - name, name, name); - } - exit(-1); -@@ -144,12 +145,12 @@ int main(int argc, char **argv) - int opt, i = 0; - const char *input_filename = NULL; - int use_input_file = 0; -- char *buf = NULL; -- size_t buf_len; -+ char *buf = NULL, *endptr; -+ size_t buf_len, nthreads = 1; - const char *base; - int errors = 0; -- const char *ropts = "e:f:hiIDlmno:pqrsvFRW0x"; -- const char *sopts = "c:de:f:hiIDlmno:pqr:svEFR:W0"; -+ const char *ropts = "e:f:hiIDlmno:pqrsvFRW0xT:"; -+ const char *sopts = "c:de:f:hiIDlmno:pqr:svEFR:W0T:"; - const char *opts; - union selinux_callback cb; - -@@ -370,6 +371,11 @@ int main(int argc, char **argv) - usage(argv[0]); - } - break; -+ case 'T': -+ nthreads = strtoull(optarg, &endptr, 10); -+ if (*optarg == '\0' || *endptr != '\0') -+ usage(argv[0]); -+ break; - case 'h': - case '?': - usage(argv[0]); -@@ -448,13 +454,13 @@ int main(int argc, char **argv) - buf[len - 1] = 0; - if (!strcmp(buf, "/")) - r_opts.mass_relabel = SELINUX_RESTORECON_MASS_RELABEL; -- errors |= process_glob(buf, &r_opts) < 0; -+ errors |= process_glob(buf, &r_opts, nthreads) < 0; - } - if (strcmp(input_filename, "-") != 0) - fclose(f); - } else { - for (i = optind; i < argc; i++) -- errors |= process_glob(argv[i], &r_opts) < 0; -+ errors |= process_glob(argv[i], &r_opts, nthreads) < 0; - } - - maybe_audit_mass_relabel(r_opts.mass_relabel, errors); --- -2.33.1 - diff --git a/0020-semodule-add-m-checksum-option.patch b/0020-semodule-add-m-checksum-option.patch deleted file mode 100644 index afee33a..0000000 --- a/0020-semodule-add-m-checksum-option.patch +++ /dev/null @@ -1,674 +0,0 @@ -From 4e6165719d3315b6502f3d290a549f9fa14c3238 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 16 Nov 2021 14:27:11 +0100 -Subject: [PATCH] semodule: add -m | --checksum option - -Since cil doesn't store module name and module version in module itself, -there's no simple way how to compare that installed module is the same -version as the module which is supposed to be installed. Even though the -version was not used by semodule itself, it was apparently used by some -team. - -With `semodule -l --checksum` users get SHA256 hashes of modules and -could compare them with their files which is faster than installing -modules again and again. - -E.g. - - # time ( - semodule -l --checksum | grep localmodule - /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum - ) - localmodule db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd - db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd - - - real 0m0.876s - user 0m0.849s - sys 0m0.028s - -vs - - # time semodule -i localmodule.pp - - real 0m6.147s - user 0m5.800s - sys 0m0.231s - -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - policycoreutils/semodule/Makefile | 2 +- - policycoreutils/semodule/semodule.8 | 6 + - policycoreutils/semodule/semodule.c | 95 ++++++++- - policycoreutils/semodule/sha256.c | 294 ++++++++++++++++++++++++++++ - policycoreutils/semodule/sha256.h | 89 +++++++++ - 5 files changed, 480 insertions(+), 6 deletions(-) - create mode 100644 policycoreutils/semodule/sha256.c - create mode 100644 policycoreutils/semodule/sha256.h - -diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile -index 73801e487a76..9875ac383280 100644 ---- a/policycoreutils/semodule/Makefile -+++ b/policycoreutils/semodule/Makefile -@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man - - CFLAGS ?= -Werror -Wall -W - override LDLIBS += -lsepol -lselinux -lsemanage --SEMODULE_OBJS = semodule.o -+SEMODULE_OBJS = semodule.o sha256.o - - all: semodule genhomedircon - -diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 -index 18d4f708661c..3a2fb21c2481 100644 ---- a/policycoreutils/semodule/semodule.8 -+++ b/policycoreutils/semodule/semodule.8 -@@ -95,6 +95,9 @@ only modules listed in \-\-extract after this option. - .B \-H,\-\-hll - Extract module as an HLL file. This only affects the \-\-extract option and - only modules listed in \-\-extract after this option. -+.TP -+.B \-m,\-\-checksum -+Add SHA256 checksum of modules to the list output. - - .SH EXAMPLE - .nf -@@ -130,6 +133,9 @@ $ semodule \-B \-S "/tmp/var/lib/selinux" - # Write the HLL version of puppet and the CIL version of wireshark - # modules at priority 400 to the current working directory - $ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark -+# Check whether a module in "localmodule.pp" file is same as installed module "localmodule" -+$ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum -+$ semodule -l -m | grep localmodule - .fi - - .SH SEE ALSO -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index c815f01546b4..ddbf10455abf 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -25,6 +25,8 @@ - #include - #include - -+#include "sha256.h" -+ - enum client_modes { - NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M, - LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M -@@ -57,6 +59,7 @@ static semanage_handle_t *sh = NULL; - static char *store; - static char *store_root; - int extract_cil = 0; -+static int checksum = 0; - - extern char *optarg; - extern int optind; -@@ -147,6 +150,7 @@ static void usage(char *progname) - printf(" -S,--store-path use an alternate path for the policy store root\n"); - printf(" -c, --cil extract module as cil. This only affects module extraction.\n"); - printf(" -H, --hll extract module as hll. This only affects module extraction.\n"); -+ printf(" -m, --checksum print module checksum (SHA256).\n"); - } - - /* Sets the global mode variable to new_mode, but only if no other -@@ -200,6 +204,7 @@ static void parse_command_line(int argc, char **argv) - {"disable", required_argument, NULL, 'd'}, - {"path", required_argument, NULL, 'p'}, - {"store-path", required_argument, NULL, 'S'}, -+ {"checksum", 0, NULL, 'm'}, - {NULL, 0, NULL, 0} - }; - int extract_selected = 0; -@@ -210,7 +215,7 @@ static void parse_command_line(int argc, char **argv) - no_reload = 0; - priority = 400; - while ((i = -- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cH", opts, -+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts, - NULL)) != -1) { - switch (i) { - case 'b': -@@ -287,6 +292,9 @@ static void parse_command_line(int argc, char **argv) - case 'd': - set_mode(DISABLE_M, optarg); - break; -+ case 'm': -+ checksum = 1; -+ break; - case '?': - default:{ - usage(argv[0]); -@@ -338,6 +346,61 @@ static void parse_command_line(int argc, char **argv) - } - } - -+/* Get module checksum */ -+static char *hash_module_data(const char *module_name, const int prio) { -+ semanage_module_info_t *extract_info = NULL; -+ semanage_module_key_t *modkey = NULL; -+ Sha256Context context; -+ uint8_t sha256_hash[SHA256_HASH_SIZE]; -+ char *sha256_buf = NULL; -+ void *data; -+ size_t data_len = 0, i; -+ int result; -+ -+ result = semanage_module_key_create(sh, &modkey); -+ if (result != 0) { -+ goto cleanup_extract; -+ } -+ -+ result = semanage_module_key_set_name(sh, modkey, module_name); -+ if (result != 0) { -+ goto cleanup_extract; -+ } -+ -+ result = semanage_module_key_set_priority(sh, modkey, prio); -+ if (result != 0) { -+ goto cleanup_extract; -+ } -+ -+ result = semanage_module_extract(sh, modkey, 1, &data, &data_len, -+ &extract_info); -+ if (result != 0) { -+ goto cleanup_extract; -+ } -+ -+ Sha256Initialise(&context); -+ Sha256Update(&context, data, data_len); -+ -+ Sha256Finalise(&context, (SHA256_HASH *)sha256_hash); -+ -+ sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1); -+ -+ if (sha256_buf == NULL) -+ goto cleanup_extract; -+ -+ for (i = 0; i < SHA256_HASH_SIZE; i++) { -+ sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]); -+ } -+ sha256_buf[i * 2] = 0; -+ -+cleanup_extract: -+ semanage_module_info_destroy(sh, extract_info); -+ free(extract_info); -+ semanage_module_key_destroy(sh, modkey); -+ free(modkey); -+ return sha256_buf; -+} -+ - int main(int argc, char *argv[]) - { - int i, commit = 0; -@@ -546,6 +609,8 @@ cleanup_extract: - int modinfos_len = 0; - semanage_module_info_t *m = NULL; - int j = 0; -+ char *module_checksum = NULL; -+ uint16_t pri = 0; - - if (verbose) { - printf -@@ -570,7 +635,18 @@ cleanup_extract: - result = semanage_module_info_get_name(sh, m, &name); - if (result != 0) goto cleanup_list; - -- printf("%s\n", name); -+ result = semanage_module_info_get_priority(sh, m, &pri); -+ if (result != 0) goto cleanup_list; -+ -+ printf("%s", name); -+ if (checksum) { -+ module_checksum = hash_module_data(name, pri); -+ if (module_checksum) { -+ printf(" %s", module_checksum); -+ free(module_checksum); -+ } -+ } -+ printf("\n"); - } - } - else if (strcmp(mode_arg, "full") == 0) { -@@ -585,11 +661,12 @@ cleanup_extract: - } - - /* calculate column widths */ -- size_t column[4] = { 0, 0, 0, 0 }; -+ size_t column[5] = { 0, 0, 0, 0, 0 }; - - /* fixed width columns */ - column[0] = sizeof("000") - 1; - column[3] = sizeof("disabled") - 1; -+ column[4] = 64; /* SHA256_HASH_SIZE * 2 */ - - /* variable width columns */ - const char *tmp = NULL; -@@ -612,7 +689,6 @@ cleanup_extract: - - /* print out each module */ - for (j = 0; j < modinfos_len; j++) { -- uint16_t pri = 0; - const char *name = NULL; - int enabled = 0; - const char *lang_ext = NULL; -@@ -631,11 +707,20 @@ cleanup_extract: - result = semanage_module_info_get_lang_ext(sh, m, &lang_ext); - if (result != 0) goto cleanup_list; - -- printf("%0*u %-*s %-*s %-*s\n", -+ printf("%0*u %-*s %-*s %-*s", - (int)column[0], pri, - (int)column[1], name, - (int)column[2], lang_ext, - (int)column[3], enabled ? "" : "disabled"); -+ if (checksum) { -+ module_checksum = hash_module_data(name, pri); -+ if (module_checksum) { -+ printf(" %-*s", (int)column[4], module_checksum); -+ free(module_checksum); -+ } -+ } -+ printf("\n"); -+ - } - } - else { -diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c -new file mode 100644 -index 000000000000..fe2aeef07f53 ---- /dev/null -+++ b/policycoreutils/semodule/sha256.c -@@ -0,0 +1,294 @@ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// WjCryptLib_Sha256 -+// -+// Implementation of SHA256 hash function. -+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org -+// Modified by WaterJuice retaining Public Domain license. -+// -+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// IMPORTS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+#include "sha256.h" -+#include -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// MACROS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits)))) -+ -+#define MIN(x, y) ( ((x)<(y))?(x):(y) ) -+ -+#define STORE32H(x, y) \ -+ { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \ -+ (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); } -+ -+#define LOAD32H(x, y) \ -+ { x = ((uint32_t)((y)[0] & 255)<<24) | \ -+ ((uint32_t)((y)[1] & 255)<<16) | \ -+ ((uint32_t)((y)[2] & 255)<<8) | \ -+ ((uint32_t)((y)[3] & 255)); } -+ -+#define STORE64H(x, y) \ -+ { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \ -+ (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \ -+ (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \ -+ (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); } -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// CONSTANTS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+// The K array -+static const uint32_t K[64] = { -+ 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL, -+ 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL, -+ 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, -+ 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL, -+ 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL, -+ 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL, -+ 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, -+ 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL, -+ 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL, -+ 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL, -+ 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, -+ 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL, -+ 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL -+}; -+ -+#define BLOCK_SIZE 64 -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// INTERNAL FUNCTIONS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+// Various logical functions -+#define Ch( x, y, z ) (z ^ (x & (y ^ z))) -+#define Maj( x, y, z ) (((x | y) & z) | (x & y)) -+#define S( x, n ) ror((x),(n)) -+#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n)) -+#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) -+#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) -+#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) -+#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) -+ -+#define Sha256Round( a, b, c, d, e, f, g, h, i ) \ -+ t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ -+ t1 = Sigma0(a) + Maj(a, b, c); \ -+ d += t0; \ -+ h = t0 + t1; -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// TransformFunction -+// -+// Compress 512-bits -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+static -+void -+ TransformFunction -+ ( -+ Sha256Context* Context, -+ uint8_t const* Buffer -+ ) -+{ -+ uint32_t S[8]; -+ uint32_t W[64]; -+ uint32_t t0; -+ uint32_t t1; -+ uint32_t t; -+ int i; -+ -+ // Copy state into S -+ for( i=0; i<8; i++ ) -+ { -+ S[i] = Context->state[i]; -+ } -+ -+ // Copy the state into 512-bits into W[0..15] -+ for( i=0; i<16; i++ ) -+ { -+ LOAD32H( W[i], Buffer + (4*i) ); -+ } -+ -+ // Fill W[16..63] -+ for( i=16; i<64; i++ ) -+ { -+ W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16]; -+ } -+ -+ // Compress -+ for( i=0; i<64; i++ ) -+ { -+ Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i ); -+ t = S[7]; -+ S[7] = S[6]; -+ S[6] = S[5]; -+ S[5] = S[4]; -+ S[4] = S[3]; -+ S[3] = S[2]; -+ S[2] = S[1]; -+ S[1] = S[0]; -+ S[0] = t; -+ } -+ -+ // Feedback -+ for( i=0; i<8; i++ ) -+ { -+ Context->state[i] = Context->state[i] + S[i]; -+ } -+} -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// PUBLIC FUNCTIONS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Initialise -+// -+// Initialises a SHA256 Context. Use this to initialise/reset a context. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Initialise -+ ( -+ Sha256Context* Context // [out] -+ ) -+{ -+ Context->curlen = 0; -+ Context->length = 0; -+ Context->state[0] = 0x6A09E667UL; -+ Context->state[1] = 0xBB67AE85UL; -+ Context->state[2] = 0x3C6EF372UL; -+ Context->state[3] = 0xA54FF53AUL; -+ Context->state[4] = 0x510E527FUL; -+ Context->state[5] = 0x9B05688CUL; -+ Context->state[6] = 0x1F83D9ABUL; -+ Context->state[7] = 0x5BE0CD19UL; -+} -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Update -+// -+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on -+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Update -+ ( -+ Sha256Context* Context, // [in out] -+ void const* Buffer, // [in] -+ uint32_t BufferSize // [in] -+ ) -+{ -+ uint32_t n; -+ -+ if( Context->curlen > sizeof(Context->buf) ) -+ { -+ return; -+ } -+ -+ while( BufferSize > 0 ) -+ { -+ if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE ) -+ { -+ TransformFunction( Context, (uint8_t*)Buffer ); -+ Context->length += BLOCK_SIZE * 8; -+ Buffer = (uint8_t*)Buffer + BLOCK_SIZE; -+ BufferSize -= BLOCK_SIZE; -+ } -+ else -+ { -+ n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) ); -+ memcpy( Context->buf + Context->curlen, Buffer, (size_t)n ); -+ Context->curlen += n; -+ Buffer = (uint8_t*)Buffer + n; -+ BufferSize -= n; -+ if( Context->curlen == BLOCK_SIZE ) -+ { -+ TransformFunction( Context, Context->buf ); -+ Context->length += 8*BLOCK_SIZE; -+ Context->curlen = 0; -+ } -+ } -+ } -+} -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Finalise -+// -+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After -+// calling this, Sha256Initialised must be used to reuse the context. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Finalise -+ ( -+ Sha256Context* Context, // [in out] -+ SHA256_HASH* Digest // [out] -+ ) -+{ -+ int i; -+ -+ if( Context->curlen >= sizeof(Context->buf) ) -+ { -+ return; -+ } -+ -+ // Increase the length of the message -+ Context->length += Context->curlen * 8; -+ -+ // Append the '1' bit -+ Context->buf[Context->curlen++] = (uint8_t)0x80; -+ -+ // if the length is currently above 56 bytes we append zeros -+ // then compress. Then we can fall back to padding zeros and length -+ // encoding like normal. -+ if( Context->curlen > 56 ) -+ { -+ while( Context->curlen < 64 ) -+ { -+ Context->buf[Context->curlen++] = (uint8_t)0; -+ } -+ TransformFunction(Context, Context->buf); -+ Context->curlen = 0; -+ } -+ -+ // Pad up to 56 bytes of zeroes -+ while( Context->curlen < 56 ) -+ { -+ Context->buf[Context->curlen++] = (uint8_t)0; -+ } -+ -+ // Store length -+ STORE64H( Context->length, Context->buf+56 ); -+ TransformFunction( Context, Context->buf ); -+ -+ // Copy output -+ for( i=0; i<8; i++ ) -+ { -+ STORE32H( Context->state[i], Digest->bytes+(4*i) ); -+ } -+} -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Calculate -+// -+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the -+// buffer. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Calculate -+ ( -+ void const* Buffer, // [in] -+ uint32_t BufferSize, // [in] -+ SHA256_HASH* Digest // [in] -+ ) -+{ -+ Sha256Context context; -+ -+ Sha256Initialise( &context ); -+ Sha256Update( &context, Buffer, BufferSize ); -+ Sha256Finalise( &context, Digest ); -+} -diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h -new file mode 100644 -index 000000000000..406ed869cd82 ---- /dev/null -+++ b/policycoreutils/semodule/sha256.h -@@ -0,0 +1,89 @@ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// WjCryptLib_Sha256 -+// -+// Implementation of SHA256 hash function. -+// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org -+// Modified by WaterJuice retaining Public Domain license. -+// -+// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+#pragma once -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// IMPORTS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+#include -+#include -+ -+typedef struct -+{ -+ uint64_t length; -+ uint32_t state[8]; -+ uint32_t curlen; -+ uint8_t buf[64]; -+} Sha256Context; -+ -+#define SHA256_HASH_SIZE ( 256 / 8 ) -+ -+typedef struct -+{ -+ uint8_t bytes [SHA256_HASH_SIZE]; -+} SHA256_HASH; -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// PUBLIC FUNCTIONS -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Initialise -+// -+// Initialises a SHA256 Context. Use this to initialise/reset a context. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Initialise -+ ( -+ Sha256Context* Context // [out] -+ ); -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Update -+// -+// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on -+// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Update -+ ( -+ Sha256Context* Context, // [in out] -+ void const* Buffer, // [in] -+ uint32_t BufferSize // [in] -+ ); -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Finalise -+// -+// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After -+// calling this, Sha256Initialised must be used to reuse the context. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Finalise -+ ( -+ Sha256Context* Context, // [in out] -+ SHA256_HASH* Digest // [out] -+ ); -+ -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+// Sha256Calculate -+// -+// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the -+// buffer. -+//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -+void -+ Sha256Calculate -+ ( -+ void const* Buffer, // [in] -+ uint32_t BufferSize, // [in] -+ SHA256_HASH* Digest // [in] -+ ); --- -2.33.1 - diff --git a/0021-semodule-Fix-lang_ext-column-index.patch b/0021-semodule-Fix-lang_ext-column-index.patch deleted file mode 100644 index 2c0581b..0000000 --- a/0021-semodule-Fix-lang_ext-column-index.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 7537374e7f5802852c0c64b4cb2a9646402e3cba Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 16 Nov 2021 16:11:22 +0100 -Subject: [PATCH] semodule: Fix lang_ext column index - -lang_ext is 3. column - index number 2. - -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - policycoreutils/semodule/semodule.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index ddbf10455abf..57f005ce2c62 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -684,7 +684,7 @@ cleanup_extract: - if (result != 0) goto cleanup_list; - - size = strlen(tmp); -- if (size > column[3]) column[3] = size; -+ if (size > column[2]) column[2] = size; - } - - /* print out each module */ --- -2.33.1 - diff --git a/0022-semodule-Don-t-forget-to-munmap-data.patch b/0022-semodule-Don-t-forget-to-munmap-data.patch deleted file mode 100644 index fa7fcd2..0000000 --- a/0022-semodule-Don-t-forget-to-munmap-data.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 0c4e5d70fde006977e798d6cc7d80db2e8af7bb9 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 23 Nov 2021 17:38:51 +0100 -Subject: [PATCH] semodule: Don't forget to munmap() data - -semanage_module_extract() mmap()'s the module raw data but it leaves on -the caller to munmap() them. - -Reported-by: Ondrej Mosnacek -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - policycoreutils/semodule/semodule.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index 57f005ce2c62..94a9d131bb79 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -394,6 +394,9 @@ static char *hash_module_data(const char *module_name, const int prio) { - sha256_buf[i * 2] = 0; - - cleanup_extract: -+ if (data_len > 0) { -+ munmap(data, data_len); -+ } - semanage_module_info_destroy(sh, extract_info); - free(extract_info); - semanage_module_key_destroy(sh, modkey); --- -2.33.1 - diff --git a/0023-semodule-libsemanage-move-module-hashing-into-libsem.patch b/0023-semodule-libsemanage-move-module-hashing-into-libsem.patch deleted file mode 100644 index 8fcd481..0000000 --- a/0023-semodule-libsemanage-move-module-hashing-into-libsem.patch +++ /dev/null @@ -1,539 +0,0 @@ -From 7809f29b68e17a455478990ae9b22728381a126b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Thu, 3 Feb 2022 17:53:23 +0100 -Subject: [PATCH] semodule,libsemanage: move module hashing into libsemanage - -The main goal of this move is to have the SHA-256 implementation under -libsemanage, since upcoming patches will make use of SHA-256 for a -different (but similar) purpose in libsemanage. Having the hashing code -in libsemanage will reduce code duplication and allow for easier hash -algorithm upgrade in the future. - -Note that libselinux currently also contains a hash function -implementation (for yet another different purpose). This patch doesn't -make any effort to address that duplicity yet. - -This patch also changes the format of the hash string printed by -semodule to include the name of the hash. The intent is to avoid -ambiguity and potential collisions when the algorithm is potentially -changed in the future. - -Signed-off-by: Ondrej Mosnacek ---- - policycoreutils/semodule/Makefile | 2 +- - policycoreutils/semodule/semodule.c | 53 ++--- - policycoreutils/semodule/sha256.c | 294 ---------------------------- - policycoreutils/semodule/sha256.h | 89 --------- - 4 files changed, 17 insertions(+), 421 deletions(-) - delete mode 100644 policycoreutils/semodule/sha256.c - delete mode 100644 policycoreutils/semodule/sha256.h - -diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile -index 9875ac383280..73801e487a76 100644 ---- a/policycoreutils/semodule/Makefile -+++ b/policycoreutils/semodule/Makefile -@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man - - CFLAGS ?= -Werror -Wall -W - override LDLIBS += -lsepol -lselinux -lsemanage --SEMODULE_OBJS = semodule.o sha256.o -+SEMODULE_OBJS = semodule.o - - all: semodule genhomedircon - -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index 94a9d131bb79..f4a76289efa3 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -25,8 +25,6 @@ - #include - #include - --#include "sha256.h" -- - enum client_modes { - NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M, - LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M -@@ -348,60 +346,38 @@ static void parse_command_line(int argc, char **argv) - - /* Get module checksum */ - static char *hash_module_data(const char *module_name, const int prio) { -- semanage_module_info_t *extract_info = NULL; - semanage_module_key_t *modkey = NULL; -- Sha256Context context; -- uint8_t sha256_hash[SHA256_HASH_SIZE]; -- char *sha256_buf = NULL; -- void *data; -- size_t data_len = 0, i; -+ char *hash_str = NULL; -+ void *hash = NULL; -+ size_t hash_len = 0; - int result; - - result = semanage_module_key_create(sh, &modkey); - if (result != 0) { -- goto cleanup_extract; -+ goto cleanup; - } - - result = semanage_module_key_set_name(sh, modkey, module_name); - if (result != 0) { -- goto cleanup_extract; -+ goto cleanup; - } - - result = semanage_module_key_set_priority(sh, modkey, prio); - if (result != 0) { -- goto cleanup_extract; -+ goto cleanup; - } - -- result = semanage_module_extract(sh, modkey, 1, &data, &data_len, -- &extract_info); -+ result = semanage_module_compute_checksum(sh, modkey, 1, &hash_str, -+ &hash_len); - if (result != 0) { -- goto cleanup_extract; -- } -- -- Sha256Initialise(&context); -- Sha256Update(&context, data, data_len); -- -- Sha256Finalise(&context, (SHA256_HASH *)sha256_hash); -- -- sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1); -- -- if (sha256_buf == NULL) -- goto cleanup_extract; -- -- for (i = 0; i < SHA256_HASH_SIZE; i++) { -- sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]); -+ goto cleanup; - } -- sha256_buf[i * 2] = 0; - --cleanup_extract: -- if (data_len > 0) { -- munmap(data, data_len); -- } -- semanage_module_info_destroy(sh, extract_info); -- free(extract_info); -+cleanup: -+ free(hash); - semanage_module_key_destroy(sh, modkey); - free(modkey); -- return sha256_buf; -+ return hash_str; - } - - int main(int argc, char *argv[]) -@@ -669,7 +645,10 @@ cleanup_extract: - /* fixed width columns */ - column[0] = sizeof("000") - 1; - column[3] = sizeof("disabled") - 1; -- column[4] = 64; /* SHA256_HASH_SIZE * 2 */ -+ -+ result = semanage_module_compute_checksum(sh, NULL, 0, NULL, -+ &column[4]); -+ if (result != 0) goto cleanup_list; - - /* variable width columns */ - const char *tmp = NULL; -diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c -deleted file mode 100644 -index fe2aeef07f53..000000000000 ---- a/policycoreutils/semodule/sha256.c -+++ /dev/null -@@ -1,294 +0,0 @@ --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// WjCryptLib_Sha256 --// --// Implementation of SHA256 hash function. --// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org --// Modified by WaterJuice retaining Public Domain license. --// --// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// IMPORTS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --#include "sha256.h" --#include -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// MACROS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits)))) -- --#define MIN(x, y) ( ((x)<(y))?(x):(y) ) -- --#define STORE32H(x, y) \ -- { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255); \ -- (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); } -- --#define LOAD32H(x, y) \ -- { x = ((uint32_t)((y)[0] & 255)<<24) | \ -- ((uint32_t)((y)[1] & 255)<<16) | \ -- ((uint32_t)((y)[2] & 255)<<8) | \ -- ((uint32_t)((y)[3] & 255)); } -- --#define STORE64H(x, y) \ -- { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255); \ -- (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255); \ -- (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255); \ -- (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); } -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// CONSTANTS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --// The K array --static const uint32_t K[64] = { -- 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL, -- 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL, -- 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, -- 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL, -- 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL, -- 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL, -- 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, -- 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL, -- 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL, -- 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL, -- 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, -- 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL, -- 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL --}; -- --#define BLOCK_SIZE 64 -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// INTERNAL FUNCTIONS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --// Various logical functions --#define Ch( x, y, z ) (z ^ (x & (y ^ z))) --#define Maj( x, y, z ) (((x | y) & z) | (x & y)) --#define S( x, n ) ror((x),(n)) --#define R( x, n ) (((x)&0xFFFFFFFFUL)>>(n)) --#define Sigma0( x ) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) --#define Sigma1( x ) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) --#define Gamma0( x ) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) --#define Gamma1( x ) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) -- --#define Sha256Round( a, b, c, d, e, f, g, h, i ) \ -- t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \ -- t1 = Sigma0(a) + Maj(a, b, c); \ -- d += t0; \ -- h = t0 + t1; -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// TransformFunction --// --// Compress 512-bits --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --static --void -- TransformFunction -- ( -- Sha256Context* Context, -- uint8_t const* Buffer -- ) --{ -- uint32_t S[8]; -- uint32_t W[64]; -- uint32_t t0; -- uint32_t t1; -- uint32_t t; -- int i; -- -- // Copy state into S -- for( i=0; i<8; i++ ) -- { -- S[i] = Context->state[i]; -- } -- -- // Copy the state into 512-bits into W[0..15] -- for( i=0; i<16; i++ ) -- { -- LOAD32H( W[i], Buffer + (4*i) ); -- } -- -- // Fill W[16..63] -- for( i=16; i<64; i++ ) -- { -- W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16]; -- } -- -- // Compress -- for( i=0; i<64; i++ ) -- { -- Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i ); -- t = S[7]; -- S[7] = S[6]; -- S[6] = S[5]; -- S[5] = S[4]; -- S[4] = S[3]; -- S[3] = S[2]; -- S[2] = S[1]; -- S[1] = S[0]; -- S[0] = t; -- } -- -- // Feedback -- for( i=0; i<8; i++ ) -- { -- Context->state[i] = Context->state[i] + S[i]; -- } --} -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// PUBLIC FUNCTIONS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Initialise --// --// Initialises a SHA256 Context. Use this to initialise/reset a context. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Initialise -- ( -- Sha256Context* Context // [out] -- ) --{ -- Context->curlen = 0; -- Context->length = 0; -- Context->state[0] = 0x6A09E667UL; -- Context->state[1] = 0xBB67AE85UL; -- Context->state[2] = 0x3C6EF372UL; -- Context->state[3] = 0xA54FF53AUL; -- Context->state[4] = 0x510E527FUL; -- Context->state[5] = 0x9B05688CUL; -- Context->state[6] = 0x1F83D9ABUL; -- Context->state[7] = 0x5BE0CD19UL; --} -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Update --// --// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on --// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Update -- ( -- Sha256Context* Context, // [in out] -- void const* Buffer, // [in] -- uint32_t BufferSize // [in] -- ) --{ -- uint32_t n; -- -- if( Context->curlen > sizeof(Context->buf) ) -- { -- return; -- } -- -- while( BufferSize > 0 ) -- { -- if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE ) -- { -- TransformFunction( Context, (uint8_t*)Buffer ); -- Context->length += BLOCK_SIZE * 8; -- Buffer = (uint8_t*)Buffer + BLOCK_SIZE; -- BufferSize -= BLOCK_SIZE; -- } -- else -- { -- n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) ); -- memcpy( Context->buf + Context->curlen, Buffer, (size_t)n ); -- Context->curlen += n; -- Buffer = (uint8_t*)Buffer + n; -- BufferSize -= n; -- if( Context->curlen == BLOCK_SIZE ) -- { -- TransformFunction( Context, Context->buf ); -- Context->length += 8*BLOCK_SIZE; -- Context->curlen = 0; -- } -- } -- } --} -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Finalise --// --// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After --// calling this, Sha256Initialised must be used to reuse the context. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Finalise -- ( -- Sha256Context* Context, // [in out] -- SHA256_HASH* Digest // [out] -- ) --{ -- int i; -- -- if( Context->curlen >= sizeof(Context->buf) ) -- { -- return; -- } -- -- // Increase the length of the message -- Context->length += Context->curlen * 8; -- -- // Append the '1' bit -- Context->buf[Context->curlen++] = (uint8_t)0x80; -- -- // if the length is currently above 56 bytes we append zeros -- // then compress. Then we can fall back to padding zeros and length -- // encoding like normal. -- if( Context->curlen > 56 ) -- { -- while( Context->curlen < 64 ) -- { -- Context->buf[Context->curlen++] = (uint8_t)0; -- } -- TransformFunction(Context, Context->buf); -- Context->curlen = 0; -- } -- -- // Pad up to 56 bytes of zeroes -- while( Context->curlen < 56 ) -- { -- Context->buf[Context->curlen++] = (uint8_t)0; -- } -- -- // Store length -- STORE64H( Context->length, Context->buf+56 ); -- TransformFunction( Context, Context->buf ); -- -- // Copy output -- for( i=0; i<8; i++ ) -- { -- STORE32H( Context->state[i], Digest->bytes+(4*i) ); -- } --} -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Calculate --// --// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the --// buffer. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Calculate -- ( -- void const* Buffer, // [in] -- uint32_t BufferSize, // [in] -- SHA256_HASH* Digest // [in] -- ) --{ -- Sha256Context context; -- -- Sha256Initialise( &context ); -- Sha256Update( &context, Buffer, BufferSize ); -- Sha256Finalise( &context, Digest ); --} -diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h -deleted file mode 100644 -index 406ed869cd82..000000000000 ---- a/policycoreutils/semodule/sha256.h -+++ /dev/null -@@ -1,89 +0,0 @@ --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// WjCryptLib_Sha256 --// --// Implementation of SHA256 hash function. --// Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org --// Modified by WaterJuice retaining Public Domain license. --// --// This is free and unencumbered software released into the public domain - June 2013 waterjuice.org --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --#pragma once -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// IMPORTS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --#include --#include -- --typedef struct --{ -- uint64_t length; -- uint32_t state[8]; -- uint32_t curlen; -- uint8_t buf[64]; --} Sha256Context; -- --#define SHA256_HASH_SIZE ( 256 / 8 ) -- --typedef struct --{ -- uint8_t bytes [SHA256_HASH_SIZE]; --} SHA256_HASH; -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// PUBLIC FUNCTIONS --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Initialise --// --// Initialises a SHA256 Context. Use this to initialise/reset a context. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Initialise -- ( -- Sha256Context* Context // [out] -- ); -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Update --// --// Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on --// calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Update -- ( -- Sha256Context* Context, // [in out] -- void const* Buffer, // [in] -- uint32_t BufferSize // [in] -- ); -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Finalise --// --// Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After --// calling this, Sha256Initialised must be used to reuse the context. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Finalise -- ( -- Sha256Context* Context, // [in out] -- SHA256_HASH* Digest // [out] -- ); -- --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --// Sha256Calculate --// --// Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the --// buffer. --//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// --void -- Sha256Calculate -- ( -- void const* Buffer, // [in] -- uint32_t BufferSize, // [in] -- SHA256_HASH* Digest // [in] -- ); --- -2.34.1 - diff --git a/0024-semodule-add-command-line-option-to-detect-module-ch.patch b/0024-semodule-add-command-line-option-to-detect-module-ch.patch deleted file mode 100644 index 93b5421..0000000 --- a/0024-semodule-add-command-line-option-to-detect-module-ch.patch +++ /dev/null @@ -1,144 +0,0 @@ -From 9341da3478625bb2ba2e7d4f3e227735cc9c8198 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Thu, 3 Feb 2022 17:53:27 +0100 -Subject: [PATCH] semodule: add command-line option to detect module changes - -Add a new command-line option "--rebuild-if-modules-changed" to control -the newly introduced check_ext_changes libsemanage flag. - -For example, running `semodule --rebuild-if-modules-changed` will ensure -that any externally added/removed modules (e.g. by an RPM transaction) -are reflected in the compiled policy, while skipping the most expensive -part of the rebuild if no module change was deteceted since the last -libsemanage transaction. - -Signed-off-by: Ondrej Mosnacek ---- - policycoreutils/semodule/semodule.8 | 7 +++++++ - policycoreutils/semodule/semodule.c | 32 ++++++++++++++++++++++------- - 2 files changed, 32 insertions(+), 7 deletions(-) - -diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 -index 3a2fb21c2481..d1735d216276 100644 ---- a/policycoreutils/semodule/semodule.8 -+++ b/policycoreutils/semodule/semodule.8 -@@ -23,6 +23,13 @@ force a reload of policy - .B \-B, \-\-build - force a rebuild of policy (also reloads unless \-n is used) - .TP -+.B \-\-rebuild-if-modules-changed -+Force a rebuild of the policy if any changes to module content are detected -+(by comparing with checksum from the last transaction). One can use this -+instead of \-B to ensure that any changes to the module store done by an -+external tool (e.g. a package manager) are applied, while automatically -+skipping the rebuild if there are no new changes. -+.TP - .B \-D, \-\-disable_dontaudit - Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt - .TP -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index f4a76289efa3..1ed8e69054e0 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -47,6 +47,7 @@ static int verbose; - static int reload; - static int no_reload; - static int build; -+static int check_ext_changes; - static int disable_dontaudit; - static int preserve_tunables; - static int ignore_module_cache; -@@ -149,6 +150,9 @@ static void usage(char *progname) - printf(" -c, --cil extract module as cil. This only affects module extraction.\n"); - printf(" -H, --hll extract module as hll. This only affects module extraction.\n"); - printf(" -m, --checksum print module checksum (SHA256).\n"); -+ printf(" --rebuild-if-modules-changed\n" -+ " force policy rebuild if module content changed since\n" -+ " last rebuild (based on checksum)\n"); - } - - /* Sets the global mode variable to new_mode, but only if no other -@@ -180,6 +184,7 @@ static void set_mode(enum client_modes new_mode, char *arg) - static void parse_command_line(int argc, char **argv) - { - static struct option opts[] = { -+ {"rebuild-if-modules-changed", 0, NULL, '\0'}, - {"store", required_argument, NULL, 's'}, - {"base", required_argument, NULL, 'b'}, - {"help", 0, NULL, 'h'}, -@@ -207,15 +212,26 @@ static void parse_command_line(int argc, char **argv) - }; - int extract_selected = 0; - int cil_hll_set = 0; -- int i; -+ int i, longind; - verbose = 0; - reload = 0; - no_reload = 0; -+ check_ext_changes = 0; - priority = 400; - while ((i = -- getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts, -- NULL)) != -1) { -+ getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", -+ opts, &longind)) != -1) { - switch (i) { -+ case '\0': -+ switch(longind) { -+ case 0: /* --rebuild-if-modules-changed */ -+ check_ext_changes = 1; -+ break; -+ default: -+ usage(argv[0]); -+ exit(1); -+ } -+ break; - case 'b': - fprintf(stderr, "The --base option is deprecated. Use --install instead.\n"); - set_mode(INSTALL_M, optarg); -@@ -300,13 +316,13 @@ static void parse_command_line(int argc, char **argv) - } - } - } -- if ((build || reload) && num_commands) { -+ if ((build || reload || check_ext_changes) && num_commands) { - fprintf(stderr, - "build or reload should not be used with other commands\n"); - usage(argv[0]); - exit(1); - } -- if (num_commands == 0 && reload == 0 && build == 0) { -+ if (num_commands == 0 && reload == 0 && build == 0 && check_ext_changes == 0) { - fprintf(stderr, "At least one mode must be specified.\n"); - usage(argv[0]); - exit(1); -@@ -395,7 +411,7 @@ int main(int argc, char *argv[]) - - cil_set_log_level(CIL_ERR + verbose); - -- if (build) -+ if (build || check_ext_changes) - commit = 1; - - sh = semanage_handle_create(); -@@ -434,7 +450,7 @@ int main(int argc, char *argv[]) - } - } - -- if (build) { -+ if (build || check_ext_changes) { - if ((result = semanage_begin_transaction(sh)) < 0) { - fprintf(stderr, "%s: Could not begin transaction: %s\n", - argv[0], errno ? strerror(errno) : ""); -@@ -807,6 +823,8 @@ cleanup_disable: - semanage_set_reload(sh, 0); - if (build) - semanage_set_rebuild(sh, 1); -+ if (check_ext_changes) -+ semanage_set_check_ext_changes(sh, 1); - if (disable_dontaudit) - semanage_set_disable_dontaudit(sh, 1); - else if (build) --- -2.34.1 - diff --git a/0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch b/0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch deleted file mode 100644 index ff2de09..0000000 --- a/0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch +++ /dev/null @@ -1,180 +0,0 @@ -From 09f700e9f953769d1697c46179faba32e4b80c0f Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 4 Feb 2022 13:41:12 +0100 -Subject: [PATCH] policycoreutils/fixfiles: Use parallel relabeling - -Commit 93902fc8340f ("setfiles/restorecon: support parallel relabeling") -implemented support for parallel relabeling in setfiles. This is -available for fixfiles now. - -Signed-off-by: Petr Lautrbach ---- - policycoreutils/scripts/fixfiles | 35 +++++++++++++++++------------- - policycoreutils/scripts/fixfiles.8 | 17 ++++++++++----- - 2 files changed, 31 insertions(+), 21 deletions(-) - -diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index cb20002ab613..a4a419ab62de 100755 ---- a/policycoreutils/scripts/fixfiles -+++ b/policycoreutils/scripts/fixfiles -@@ -110,6 +110,7 @@ BOOTTIME="" - VERBOSE="-p" - [ -t 1 ] || VERBOSE="" - FORCEFLAG="" -+THREADS="" - RPMFILES="" - PREFC="" - RESTORE_MODE="" -@@ -153,7 +154,7 @@ newer() { - shift - LogReadOnly - for m in `echo $FILESYSTEMSRW`; do -- find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${FORCEFLAG} ${VERBOSE} $* -i -0 -f - -+ find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${FORCEFLAG} ${VERBOSE} ${THREADS} $* -i -0 -f - - done; - } - -@@ -197,7 +198,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then - esac; \ - fi; \ - done | \ -- ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -i -R -f -; \ -+ ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -i -R -f -; \ - rm -f ${TEMPFILE} ${PREFCTEMPFILE} - fi - } -@@ -235,11 +236,11 @@ LogExcluded - case "$RESTORE_MODE" in - RPMFILES) - for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do -- rpmlist $i | ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -i -R -f - -+ rpmlist $i | ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -i -R -f - - done - ;; - FILEPATH) -- ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -R -- "$FILEPATH" -+ ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -R -- "$FILEPATH" - ;; - *) - if [ -n "${FILESYSTEMSRW}" ]; then -@@ -247,7 +248,7 @@ case "$RESTORE_MODE" in - echo "${OPTION}ing `echo ${FILESYSTEMSRW}`" - - if [ -z "$BIND_MOUNT_FILESYSTEMS" ]; then -- ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} ${FILESYSTEMSRW} -+ ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${THREADS} ${FC} ${FILESYSTEMSRW} - else - # we bind mount so we can fix the labels of files that have already been - # mounted over -@@ -257,7 +258,7 @@ case "$RESTORE_MODE" in - - mkdir -p "${TMP_MOUNT}${m}" || exit 1 - mount --bind "${m}" "${TMP_MOUNT}${m}" || exit 1 -- ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}" -+ ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}" - umount "${TMP_MOUNT}${m}" || exit 1 - rm -rf "${TMP_MOUNT}" || echo "Error cleaning up." - done; -@@ -330,8 +331,9 @@ case "$1" in - fi - > /.autorelabel || exit $? - [ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel -- [ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel -- [ -z "$BIND_MOUNT_FILESYSTEMS" ] || echo "-M" >> /.autorelabel -+ [ -z "$BOOTTIME" ] || echo -n "-N $BOOTTIME " >> /.autorelabel -+ [ -z "$BIND_MOUNT_FILESYSTEMS" ] || echo -n "-M " >> /.autorelabel -+ [ -z "$THREADS" ] || echo -n "$THREADS " >> /.autorelabel - # Force full relabel if SELinux is not enabled - selinuxenabled || echo -F > /.autorelabel - echo "System will relabel on next boot" -@@ -343,17 +345,17 @@ esac - } - usage() { - echo $""" --Usage: $0 [-v] [-F] [-M] [-f] relabel -+Usage: $0 [-v] [-F] [-M] [-f] [-T nthreads] relabel - or --Usage: $0 [-v] [-F] [-B | -N time ] { check | restore | verify } -+Usage: $0 [-v] [-F] [-B | -N time ] [-T nthreads] { check | restore | verify } - or --Usage: $0 [-v] [-F] { check | restore | verify } dir/file ... -+Usage: $0 [-v] [-F] [-T nthreads] { check | restore | verify } dir/file ... - or --Usage: $0 [-v] [-F] -R rpmpackage[,rpmpackage...] { check | restore | verify } -+Usage: $0 [-v] [-F] [-T nthreads] -R rpmpackage[,rpmpackage...] { check | restore | verify } - or --Usage: $0 [-v] [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify } -+Usage: $0 [-v] [-F] [-T nthreads] -C PREVIOUS_FILECONTEXT { check | restore | verify } - or --Usage: $0 [-F] [-M] [-B] onboot -+Usage: $0 [-F] [-M] [-B] [-T nthreads] onboot - """ - } - -@@ -372,7 +374,7 @@ set_restore_mode() { - } - - # See how we were called. --while getopts "N:BC:FfR:l:vM" i; do -+while getopts "N:BC:FfR:l:vMT:" i; do - case "$i" in - B) - BOOTTIME=`/bin/who -b | awk '{print $3}'` -@@ -407,6 +409,9 @@ while getopts "N:BC:FfR:l:vM" i; do - f) - fullFlag=1 - ;; -+ T) -+ THREADS="-T $OPTARG" -+ ;; - *) - usage - exit 1 -diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8 -index c4e894e56e8f..9a317d9181e2 100644 ---- a/policycoreutils/scripts/fixfiles.8 -+++ b/policycoreutils/scripts/fixfiles.8 -@@ -6,22 +6,22 @@ fixfiles \- fix file SELinux security contexts. - .na - - .B fixfiles --.I [\-v] [\-F] [-M] [\-f] relabel -+.I [\-v] [\-F] [-M] [\-f] [\-T nthreads] relabel - - .B fixfiles --.I [\-v] [\-F] { check | restore | verify } dir/file ... -+.I [\-v] [\-F] [\-T nthreads] { check | restore | verify } dir/file ... - - .B fixfiles --.I [\-v] [\-F] [\-B | \-N time ] { check | restore | verify } -+.I [\-v] [\-F] [\-B | \-N time ] [\-T nthreads] { check | restore | verify } - - .B fixfiles --.I [\-v] [\-F] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify } -+.I [\-v] [\-F] [\-T nthreads] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify } - - .B fixfiles --.I [\-v] [\-F] \-C PREVIOUS_FILECONTEXT { check | restore | verify } -+.I [\-v] [\-F] [\-T nthreads] \-C PREVIOUS_FILECONTEXT { check | restore | verify } - - .B fixfiles --.I [-F] [-M] [-B] onboot -+.I [-F] [-M] [-B] [\-T nthreads] onboot - - .ad - -@@ -76,6 +76,11 @@ Bind mount filesystems before relabeling them, this allows fixing the context of - .B -v - Modify verbosity from progress to verbose. (Run restorecon with \-v instead of \-p) - -+.TP -+.B \-T nthreads -+Use parallel relabeling, see -+.B setfiles(8) -+ - .SH "ARGUMENTS" - One of: - .TP --- -2.34.1 - diff --git a/0026-policycoreutils-Improve-error-message-when-selabel_o.patch b/0026-policycoreutils-Improve-error-message-when-selabel_o.patch deleted file mode 100644 index 46617fe..0000000 --- a/0026-policycoreutils-Improve-error-message-when-selabel_o.patch +++ /dev/null @@ -1,41 +0,0 @@ -From d83caa39d7ff497bddabb54619a8985227ad1264 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 10 Jan 2022 18:35:27 +0100 -Subject: [PATCH] policycoreutils: Improve error message when selabel_open - fails - -When selabel_open fails to locate file_context files and -selabel_opt_path is not specified (e.g. when the policy type is -missconfigured in /etc/selinux/config), perror only prints -"No such file or directory". -This can be confusing in case of "restorecon" since it's -not apparent that the issue is in policy store. - -Before: - \# restorecon -v /tmp/foo.txt - No such file or directory -After: - \# restorecon -v /tmp/foo.txt - /etc/selinux/yolo/contexts/files/file_contexts: No such file or directory - -Signed-off-by: Vit Mojzis ---- - policycoreutils/setfiles/restore.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c -index 74d48bb3752d..e9ae33ad039a 100644 ---- a/policycoreutils/setfiles/restore.c -+++ b/policycoreutils/setfiles/restore.c -@@ -29,7 +29,7 @@ void restore_init(struct restore_opts *opts) - - opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3); - if (!opts->hnd) { -- perror(opts->selabel_opt_path); -+ perror(opts->selabel_opt_path ? opts->selabel_opt_path : selinux_file_context_path()); - exit(1); - } - --- -2.35.1 - diff --git a/policycoreutils.spec b/policycoreutils.spec index afd4a43..a0e59b7 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.3-1 -%global libsemanagever 3.3-3 -%global libselinuxver 3.3-2 +%global libsepolver 3.4-0 +%global libsemanagever 3.4-0 +%global libselinuxver 3.4-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,11 +10,11 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.3 -Release: 5%{?dist} +Version: 3.4 +Release: 0.rc.1%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.3/selinux-3.3.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc1/selinux-3.4-rc1.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.3 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.4-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -38,25 +38,10 @@ Patch0004: 0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch Patch0005: 0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch Patch0006: 0006-Fix-title-in-manpage.py-to-not-contain-online.patch Patch0007: 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0008: 0008-sepolicy-Drop-old-interface-file_type_is_executable-.patch -Patch0009: 0009-sepolicy-Another-small-optimization-for-mcs-types.patch -Patch0010: 0010-Move-po-translation-files-into-the-right-sub-directo.patch -Patch0011: 0011-Use-correct-gettext-domains-in-python-gui-sandbox.patch -Patch0012: 0012-Initial-.pot-files-for-gui-python-sandbox.patch -Patch0013: 0013-policycoreutils-setfiles-Improve-description-of-d-sw.patch -Patch0014: 0014-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0015: 0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch -Patch0016: 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0017: 0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch -Patch0018: 0018-Use-SHA-2-instead-of-SHA-1.patch -Patch0019: 0019-setfiles-restorecon-support-parallel-relabeling.patch -Patch0020: 0020-semodule-add-m-checksum-option.patch -Patch0021: 0021-semodule-Fix-lang_ext-column-index.patch -Patch0022: 0022-semodule-Don-t-forget-to-munmap-data.patch -Patch0023: 0023-semodule-libsemanage-move-module-hashing-into-libsem.patch -Patch0024: 0024-semodule-add-command-line-option-to-detect-module-ch.patch -Patch0025: 0025-policycoreutils-fixfiles-Use-parallel-relabeling.patch -Patch0026: 0026-policycoreutils-Improve-error-message-when-selabel_o.patch +Patch0008: 0008-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0009: 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0010: 0010-Use-SHA-2-instead-of-SHA-1.patch +Patch0011: 0011-Update-python-library-and-binding-versions-to-3.4-rc.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -92,18 +77,19 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -n selinux-%{version} -p 1 +%autosetup -n selinux-%{version}-rc1 -p 1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ +# Temporary disabled since upstream updated translations in this release # Since patches containing translation changes were too big, translations were moved to separate tarballs # For more information see README.translations # First remove old translation files -rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po -tar -x -f %{SOURCE20} -C policycoreutils -z -tar -x -f %{SOURCE21} -C python -z -tar -x -f %{SOURCE22} -C gui -z +# rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po +# tar -x -f %{SOURCE20} -C policycoreutils -z +# tar -x -f %{SOURCE21} -C python -z +# tar -x -f %{SOURCE22} -C gui -z tar -x -f %{SOURCE23} -C sandbox -z %build @@ -483,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed Apr 13 2022 Petr Lautrbach - 3.4-0.rc.1 +- SELinux userspace 3.4-rc1 release + * Tue Feb 22 2022 Petr Lautrbach - 3.3-5 - Improve error message when selabel_open fails diff --git a/sources b/sources index 8f4779e..1268603 100644 --- a/sources +++ b/sources @@ -1,6 +1,5 @@ -SHA512 (selinux-3.3-rc3.tar.gz) = 239a10ce5ab31233dbd4fccf3668c2643df66e6b19065a0e57396a2b277cf4769985292613df67011b82afa25ff8dbd02123bd09d59cd8984b8b5d4d572284bc SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda7bef3679943a22db62709907d48f8a331d67edc5efed3e2638b53e379959b14077b4ea SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.3.tar.gz) = 3d1ad92e63484a7533257ae65e4d35d7acb2c9f17b3900240dbfa61c7a7aa4cdf7d7c0c4077e66b30cada26026f9d2ca1ca7d194bfa990d04b0259aef53af100 +SHA512 (selinux-3.4-rc1.tar.gz) = 06b94fe7552a65369a907bbd649a80a8f663940579e5fb0e7e0e3f41536564c2408963afa21deb6aee8aee99080e4771a89f704e4ad0e04145ee1a585f88ed56 From 5dcaf7576157a10ab7853a7cbc399689eebf5ca0 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 21 Apr 2022 20:31:39 +0200 Subject: [PATCH 03/79] policycoreutils-3.4-0.rc2.1 - SELinux userspace 3.4-rc2 release --- .gitignore | 1 + ...t-to-Xephyr-as-it-works-better-with-.patch | 2 +- ...RD_FILE_CONTEXT-section-in-man-pages.patch | 2 +- ...xecutable-we-don-t-want-to-print-a-p.patch | 6 +- ...sepolicy-manpage-web-functionality.-.patch | 4 +- ...e-the-trailing-newline-for-etc-syste.patch | 2 +- ...-in-manpage.py-to-not-contain-online.patch | 4 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 2 +- ...hbox-window-manager-instead-of-openb.patch | 2 +- 0010-Use-SHA-2-instead-of-SHA-1.patch | 4 +- ...brary-and-binding-versions-to-3.4-rc.patch | 27 -------- ...d-interface-file_type_is_executable-.patch | 64 +++++++++++++++++++ policycoreutils.spec | 13 ++-- sources | 2 +- 15 files changed, 90 insertions(+), 49 deletions(-) delete mode 100644 0011-Update-python-library-and-binding-versions-to-3.4-rc.patch create mode 100644 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch diff --git a/.gitignore b/.gitignore index 15feec5..3157a6e 100644 --- a/.gitignore +++ b/.gitignore @@ -341,3 +341,4 @@ policycoreutils-2.0.83.tgz /selinux-3.3-rc3.tar.gz /selinux-3.3.tar.gz /selinux-3.4-rc1.tar.gz +/selinux-3.4-rc2.tar.gz diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index 92d7aed..1b5b9c9 100644 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,4 +1,4 @@ -From 3c7290a99b22de343611dd61e8cd6d5b1bfb9825 Mon Sep 17 00:00:00 2001 +From f361ee407490bc74b43ec408b1edc70cd647d4e0 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in diff --git a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch b/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch index 157bdb9..998345e 100644 --- a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch +++ b/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch @@ -1,4 +1,4 @@ -From a7d5ba145b86f48e6ebb3964ac64feebd062025a Mon Sep 17 00:00:00 2001 +From 71a2f14767c0ec70c23ecce43d7cbc5404c95552 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Mon, 21 Apr 2014 13:54:40 -0400 Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages diff --git a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch b/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch index 2eb393d..aca9199 100644 --- a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch +++ b/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch @@ -1,4 +1,4 @@ -From 25a80e4bfa1c0b9814ddaaae119b694f7e7a33d7 Mon Sep 17 00:00:00 2001 +From d55a06c002641dce1301b9b5639bd8e206460724 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Mon, 12 May 2014 14:11:22 +0200 Subject: [PATCH] If there is no executable we don't want to print a part of @@ -10,7 +10,7 @@ Content-type: text/plain 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 82338aeeef32..c9a6291a8b40 100755 +index 82338aeeef32..ec8aa1cb94a2 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -795,7 +795,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d @@ -19,7 +19,7 @@ index 82338aeeef32..c9a6291a8b40 100755 - self.fd.write(r""" + if flist_non_exec: -+ self.fd.write(r""" ++ self.fd.write(r""" .PP .B STANDARD FILE CONTEXT diff --git a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch b/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch index e567b95..045c033 100644 --- a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch +++ b/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch @@ -1,4 +1,4 @@ -From 874b3757c4a7c7faa3166f66a897a21630faf55e Mon Sep 17 00:00:00 2001 +From b180f7679c5e09535416f47d48afd0c0738f5fa9 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Thu, 19 Feb 2015 17:45:15 +0100 Subject: [PATCH] Simplication of sepolicy-manpage web functionality. @@ -50,7 +50,7 @@ index 203ca25f4210..9447812b7450 100644 def reinit(): diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index c9a6291a8b40..d0c9bb840b26 100755 +index ec8aa1cb94a2..c632d05dbb1b 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -151,10 +151,6 @@ def prettyprint(f, trim): diff --git a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch b/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch index 5f091c9..948881f 100644 --- a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch +++ b/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch @@ -1,4 +1,4 @@ -From aba96cf4c6f692b4cdd60bf9097f02409a11a996 Mon Sep 17 00:00:00 2001 +From 1747f59fece8183772e5591ce5b5feb5f421f602 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Fri, 20 Feb 2015 16:42:01 +0100 Subject: [PATCH] We want to remove the trailing newline for diff --git a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch b/0006-Fix-title-in-manpage.py-to-not-contain-online.patch index 0221da4..9b31464 100644 --- a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch +++ b/0006-Fix-title-in-manpage.py-to-not-contain-online.patch @@ -1,4 +1,4 @@ -From 852c8eb32fb2d0f224cdfec211f4c483c4423a8b Mon Sep 17 00:00:00 2001 +From 0bd28bc715034c644405d3c03f160d69ae710500 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Fri, 20 Feb 2015 16:42:53 +0100 Subject: [PATCH] Fix title in manpage.py to not contain 'online'. @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index d0c9bb840b26..581b5e85652c 100755 +index c632d05dbb1b..3ae2f42b2fdf 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py @@ -222,7 +222,7 @@ class HTMLManPages: diff --git a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index 0795825..ba39b4d 100644 --- a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From add9d39a077e4288c71b00e9e92e5bf673070ac2 Mon Sep 17 00:00:00 2001 +From f204dd292340689c2d7ab75612b9fd81337fcbc3 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 7df4303a7ad3..dfd8929b4bbc 100755 +index c72ca0eb9d61..163ebcd1f232 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { diff --git a/0008-sepolicy-generate-Handle-more-reserved-port-types.patch b/0008-sepolicy-generate-Handle-more-reserved-port-types.patch index 8dc4941..0e45be3 100644 --- a/0008-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0008-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From f901c512886ecddcda6f165e24c95de718cc0cc7 Mon Sep 17 00:00:00 2001 +From d8f51aa7d299383247213b69ec7cbb68c1fa3bc4 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types diff --git a/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 8a56b2d..e8a52b2 100644 --- a/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From f53d7f95833fa2fbf11400e477c1fbce9ca4e0aa Mon Sep 17 00:00:00 2001 +From 8054dc44cf105b959864a1424fe857fac3ba3d73 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox diff --git a/0010-Use-SHA-2-instead-of-SHA-1.patch b/0010-Use-SHA-2-instead-of-SHA-1.patch index 97e5761..812028f 100644 --- a/0010-Use-SHA-2-instead-of-SHA-1.patch +++ b/0010-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From f55d88aafd92a1a2a0bcb8d03e5197a488a0c7a9 Mon Sep 17 00:00:00 2001 +From 53d085d8d6edc05886d473e412a8025b7f8d9ce4 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -254,7 +254,7 @@ index 910101452625..7f2daa09191b 100644 , и, при условии, что НЕ установлен параметр .B \-n diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 15f939d1bee0..ffa76a89842d 100644 +index 19b59a2cc90d..bad9f37a9ac4 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 @@ -87,14 +87,14 @@ display usage information and exit. diff --git a/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch b/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch deleted file mode 100644 index 8f5a87c..0000000 --- a/0011-Update-python-library-and-binding-versions-to-3.4-rc.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 9ce501c15bf91108f768e5255d89b28c0e2b906e Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 12 Apr 2022 12:28:00 +0200 -Subject: [PATCH] Update python library and binding versions to 3.4-rc1 -Content-type: text/plain - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py -index e81b6cc73380..62cf7dc47c5c 100644 ---- a/python/sepolicy/setup.py -+++ b/python/sepolicy/setup.py -@@ -6,7 +6,7 @@ from distutils.core import setup - - setup( - name="sepolicy", -- version="3.3", -+ version="3.4-rc1", - description="Python SELinux Policy Analyses bindings", - author="Daniel Walsh", - author_email="dwalsh@redhat.com", --- -2.35.1 - diff --git a/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch b/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch new file mode 100644 index 0000000..c4e1fe1 --- /dev/null +++ b/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch @@ -0,0 +1,64 @@ +From 3748b7eab7434698998edfcf613fe738cf19d5c9 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 27 Feb 2017 17:12:39 +0100 +Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and + file_type_is_entrypoint(f) +Content-type: text/plain + +- use direct queries +- load exec_types and entry_types only once +--- + python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py +index 3ae2f42b2fdf..5a434bd360ae 100755 +--- a/python/sepolicy/sepolicy/manpage.py ++++ b/python/sepolicy/sepolicy/manpage.py +@@ -127,8 +127,24 @@ def gen_domains(): + domains.sort() + return domains + +-types = None + ++exec_types = None ++ ++def _gen_exec_types(): ++ global exec_types ++ if exec_types is None: ++ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"] ++ return exec_types ++ ++entry_types = None ++ ++def _gen_entry_types(): ++ global entry_types ++ if entry_types is None: ++ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"] ++ return entry_types ++ ++types = None + + def _gen_types(): + global types +@@ -374,6 +390,8 @@ class ManPage: + self.all_file_types = sepolicy.get_all_file_types() + self.role_allows = sepolicy.get_all_role_allows() + self.types = _gen_types() ++ self.exec_types = _gen_exec_types() ++ self.entry_types = _gen_entry_types() + + if self.source_files: + self.fcpath = self.root + "file_contexts" +@@ -691,7 +709,7 @@ Default Defined Ports:""") + for f in self.all_file_types: + if f.startswith(self.domainname): + flist.append(f) +- if not file_type_is_executable(f) or not file_type_is_entrypoint(f): ++ if f not in self.exec_types or f not in self.entry_types: + flist_non_exec.append(f) + if f in self.fcdict: + mpaths = mpaths + self.fcdict[f]["regex"] +-- +2.35.1 + diff --git a/policycoreutils.spec b/policycoreutils.spec index a0e59b7..96a36b3 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 0.rc.1%{?dist} +Release: 0.rc2.1%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc1/selinux-3.4-rc1.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc2/selinux-3.4-rc2.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.4-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.4-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -41,7 +41,7 @@ Patch0007: 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch Patch0008: 0008-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0009: 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0010: 0010-Use-SHA-2-instead-of-SHA-1.patch -Patch0011: 0011-Update-python-library-and-binding-versions-to-3.4-rc.patch +Patch0011: 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -77,7 +77,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -n selinux-%{version}-rc1 -p 1 +%autosetup -n selinux-%{version}-rc2 -p 1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Apr 21 2022 Petr Lautrbach - 3.4-0.rc.1 +- SELinux userspace 3.4-rc2 release + * Wed Apr 13 2022 Petr Lautrbach - 3.4-0.rc.1 - SELinux userspace 3.4-rc1 release diff --git a/sources b/sources index 1268603..c681b9d 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.4-rc1.tar.gz) = 06b94fe7552a65369a907bbd649a80a8f663940579e5fb0e7e0e3f41536564c2408963afa21deb6aee8aee99080e4771a89f704e4ad0e04145ee1a585f88ed56 +SHA512 (selinux-3.4-rc2.tar.gz) = 1a9cfb0622acf1c8cdfa4a85696445dd50f3cb86e509aee3a78d435798a098da62ad0af8bed217aadff9ddde21421eb90a4c54b0c548e9e7d51ed6e99d3a8b3a From 3119f59e530d463775ee239ac5d2a367b7dc9db7 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 10 May 2022 17:30:55 +0200 Subject: [PATCH 04/79] SELinux userspace 3.4-rc3 release --- .gitignore | 1 + policycoreutils.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 3157a6e..dc7a74b 100644 --- a/.gitignore +++ b/.gitignore @@ -342,3 +342,4 @@ policycoreutils-2.0.83.tgz /selinux-3.3.tar.gz /selinux-3.4-rc1.tar.gz /selinux-3.4-rc2.tar.gz +/selinux-3.4-rc3.tar.gz diff --git a/policycoreutils.spec b/policycoreutils.spec index 96a36b3..9699e8c 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 0.rc2.1%{?dist} +Release: 0.rc3.1%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc2/selinux-3.4-rc2.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc3/selinux-3.4-rc3.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.4-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.4-rc3 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -77,7 +77,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -n selinux-%{version}-rc2 -p 1 +%autosetup -n selinux-%{version}-rc3 -p 1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue May 10 2022 Petr Lautrbach - 3.4-0.rc3.1 +- SELinux userspace 3.4-rc3 release + * Thu Apr 21 2022 Petr Lautrbach - 3.4-0.rc.1 - SELinux userspace 3.4-rc2 release diff --git a/sources b/sources index c681b9d..ba29005 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.4-rc2.tar.gz) = 1a9cfb0622acf1c8cdfa4a85696445dd50f3cb86e509aee3a78d435798a098da62ad0af8bed217aadff9ddde21421eb90a4c54b0c548e9e7d51ed6e99d3a8b3a +SHA512 (selinux-3.4-rc3.tar.gz) = 706a8f45e4b966ec4e3b18aa552b6550cc67c412cd4fedf6052e3f6e39f92054278caffa11f448c2e054c60dc896dd95ff06796c72e20ebf94d04eab00c2e7aa From 3fb36808c0da92c44e133192cfb7c5bf07b7d2d4 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 19 May 2022 15:54:02 +0200 Subject: [PATCH 05/79] SELinux userspace 3.4 release --- .gitignore | 1 + policycoreutils.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index dc7a74b..f582aad 100644 --- a/.gitignore +++ b/.gitignore @@ -343,3 +343,4 @@ policycoreutils-2.0.83.tgz /selinux-3.4-rc1.tar.gz /selinux-3.4-rc2.tar.gz /selinux-3.4-rc3.tar.gz +/selinux-3.4.tar.gz diff --git a/policycoreutils.spec b/policycoreutils.spec index 9699e8c..1ecffc1 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.4-0 -%global libsemanagever 3.4-0 -%global libselinuxver 3.4-0 +%global libsepolver 3.4-1 +%global libsemanagever 3.4-1 +%global libselinuxver 3.4-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 0.rc3.1%{?dist} +Release: 1%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4-rc3/selinux-3.4-rc3.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.4-rc3 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.4 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -77,7 +77,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -n selinux-%{version}-rc3 -p 1 +%autosetup -n selinux-%{version} -p 1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu May 19 2022 Petr Lautrbach - 3.4-1 +- SELinux userspace 3.4 release + * Tue May 10 2022 Petr Lautrbach - 3.4-0.rc3.1 - SELinux userspace 3.4-rc3 release diff --git a/sources b/sources index ba29005..c617bc5 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.4-rc3.tar.gz) = 706a8f45e4b966ec4e3b18aa552b6550cc67c412cd4fedf6052e3f6e39f92054278caffa11f448c2e054c60dc896dd95ff06796c72e20ebf94d04eab00c2e7aa +SHA512 (selinux-3.4.tar.gz) = 9b619f6b2c632cc5cfebf5e9a9c1aa4130ef1efe9b85954d5a9da4f7a9bc15e82b9efcb4aa9c7ba2e16bac79cf116163a5d4d9cb7cbba3c96c88e01509bd60ab From 11a3f105c4664698f6413e6640cf3ce2b0582757 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 25 May 2022 16:52:53 +0200 Subject: [PATCH 06/79] Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 1ecffc1..3a124b6 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed May 25 2022 Petr Lautrbach - 3.4-2 +- rebuilt + * Thu May 19 2022 Petr Lautrbach - 3.4-1 - SELinux userspace 3.4 release From 37088605ae37ee9e68acf781e88e39fbdfb2a1a1 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 13 Jun 2022 14:53:19 +0200 Subject: [PATCH 07/79] Rebuilt for Python 3.11 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 3a124b6..a9b0848 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Jun 13 2022 Python Maint - 3.4-3 +- Rebuilt for Python 3.11 + * Wed May 25 2022 Petr Lautrbach - 3.4-2 - rebuilt From a8c0d4388c6227b98ac6371566966b5dc4bb525c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 15:10:52 +0000 Subject: [PATCH 08/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index a9b0848..85f3372 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -469,6 +469,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 3.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Mon Jun 13 2022 Python Maint - 3.4-3 - Rebuilt for Python 3.11 From 7732783e1fa41ac1e2c38090c7e2aee6020532cb Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 7 Jul 2022 16:20:13 +0200 Subject: [PATCH 09/79] selinux-autorelabel: Do not force reboot Forced reboot ends up NOT triggering normal unit shutdown, but only sends TERM signal, then KILL later. Some processes such as dmeventd do not quit on receiving TERM signal (protected), which means they are killed after a long delay by systemd using the KILL signal. In case the normal reboot doesn't go through, "reboot.target" will be triggered after a timeout and send the KILL signal anyway. Resolves: rhbz#2093133 --- selinux-autorelabel | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-autorelabel b/selinux-autorelabel index 22c2143..f0b5cfa 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -63,7 +63,7 @@ relabel_selinux() { grub2-editenv - incr boot_indeterminate >/dev/null 2>&1 fi sync - systemctl --force reboot + systemctl reboot } # Check to see if a full relabel is needed From 2a7fa6a48ca28bb5c93984a0f2e82fb1212a9dda Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 25 Jul 2022 18:05:51 +0200 Subject: [PATCH 10/79] policycoreutils-3.4-5 - gettext: handle unsupported languages properly (#2100378) - semodule: rename --rebuild-if-modules-changed to --refresh - python: Split "semanage import" into two transactions (#2063353) - selinux-autorelabel: Do not force reboot (#2093133) --- ...andle-unsupported-languages-properly.patch | 349 ++++++++++++++++++ ...rebuild-if-modules-changed-to-refres.patch | 82 ++++ ...emanage-import-into-two-transactions.patch | 65 ++++ policycoreutils.spec | 11 +- 4 files changed, 506 insertions(+), 1 deletion(-) create mode 100644 0012-gettext-handle-unsupported-languages-properly.patch create mode 100644 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch create mode 100644 0014-python-Split-semanage-import-into-two-transactions.patch diff --git a/0012-gettext-handle-unsupported-languages-properly.patch b/0012-gettext-handle-unsupported-languages-properly.patch new file mode 100644 index 0000000..8c72c26 --- /dev/null +++ b/0012-gettext-handle-unsupported-languages-properly.patch @@ -0,0 +1,349 @@ +From ff2aba6d202f49749cbb19a84bf0e1cdae54c5e9 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 24 Jun 2022 16:24:25 +0200 +Subject: [PATCH] gettext: handle unsupported languages properly +Content-type: text/plain + +With "fallback=True" gettext.translation behaves the same as +gettext.install and uses NullTranslations in case the +translation file for given language was not found (as opposed to +throwing an exception). + +Fixes: + # LANG is set to any "unsupported" language, e.g. en_US.UTF-8 + $ chcat --help + Traceback (most recent call last): + File "/usr/bin/chcat", line 39, in + t = gettext.translation(PROGNAME, + File "/usr/lib64/python3.9/gettext.py", line 592, in translation + raise FileNotFoundError(ENOENT, + FileNotFoundError: [Errno 2] No translation file found for domain: 'selinux-python' + +Signed-off-by: Vit Mojzis +Reviewed-by: Daniel Burgener +Acked-by: Petr Lautrbach +--- + gui/booleansPage.py | 3 ++- + gui/domainsPage.py | 3 ++- + gui/fcontextPage.py | 3 ++- + gui/loginsPage.py | 3 ++- + gui/modulesPage.py | 3 ++- + gui/polgengui.py | 3 ++- + gui/portsPage.py | 3 ++- + gui/semanagePage.py | 3 ++- + gui/statusPage.py | 3 ++- + gui/system-config-selinux.py | 3 ++- + gui/usersPage.py | 3 ++- + python/chcat/chcat | 5 +++-- + python/semanage/semanage | 3 ++- + python/semanage/seobject.py | 3 ++- + python/sepolgen/src/sepolgen/sepolgeni18n.py | 4 +++- + python/sepolicy/sepolicy.py | 3 ++- + python/sepolicy/sepolicy/__init__.py | 3 ++- + python/sepolicy/sepolicy/generate.py | 3 ++- + python/sepolicy/sepolicy/gui.py | 3 ++- + python/sepolicy/sepolicy/interface.py | 3 ++- + sandbox/sandbox | 3 ++- + 21 files changed, 44 insertions(+), 22 deletions(-) + +diff --git a/gui/booleansPage.py b/gui/booleansPage.py +index 5beec58bc360..ad11a9b24c79 100644 +--- a/gui/booleansPage.py ++++ b/gui/booleansPage.py +@@ -46,7 +46,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/domainsPage.py b/gui/domainsPage.py +index e08f34b4d3a9..e6eadd61c1bc 100644 +--- a/gui/domainsPage.py ++++ b/gui/domainsPage.py +@@ -38,7 +38,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py +index bac2bec3ebbd..767664f26ec8 100644 +--- a/gui/fcontextPage.py ++++ b/gui/fcontextPage.py +@@ -55,7 +55,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/loginsPage.py b/gui/loginsPage.py +index 18b93d8c9756..7e08232a90b5 100644 +--- a/gui/loginsPage.py ++++ b/gui/loginsPage.py +@@ -37,7 +37,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/modulesPage.py b/gui/modulesPage.py +index c546d455d4cd..02b79f150a13 100644 +--- a/gui/modulesPage.py ++++ b/gui/modulesPage.py +@@ -38,7 +38,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/polgengui.py b/gui/polgengui.py +index a18f1cba17b9..7a3ecd50c91c 100644 +--- a/gui/polgengui.py ++++ b/gui/polgengui.py +@@ -71,7 +71,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/portsPage.py b/gui/portsPage.py +index 54aa80ded327..bee2bdf17b99 100644 +--- a/gui/portsPage.py ++++ b/gui/portsPage.py +@@ -43,7 +43,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/semanagePage.py b/gui/semanagePage.py +index 1371d4e7dabe..efad14d9b375 100644 +--- a/gui/semanagePage.py ++++ b/gui/semanagePage.py +@@ -30,7 +30,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/statusPage.py b/gui/statusPage.py +index c241ef83dfa0..832849e60d60 100644 +--- a/gui/statusPage.py ++++ b/gui/statusPage.py +@@ -43,7 +43,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py +index 1b460c99363b..9f53b7fe9020 100644 +--- a/gui/system-config-selinux.py ++++ b/gui/system-config-selinux.py +@@ -53,7 +53,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/gui/usersPage.py b/gui/usersPage.py +index d51bd968b77e..9acd3b844056 100644 +--- a/gui/usersPage.py ++++ b/gui/usersPage.py +@@ -37,7 +37,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/chcat/chcat b/python/chcat/chcat +index e779fcc6ebd7..952cb8187599 100755 +--- a/python/chcat/chcat ++++ b/python/chcat/chcat +@@ -38,9 +38,10 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext +-except ImportError: ++except: + try: + import builtins + builtins.__dict__['_'] = str +diff --git a/python/semanage/semanage b/python/semanage/semanage +index 8f4e44a7a9cd..f45061a601f9 100644 +--- a/python/semanage/semanage ++++ b/python/semanage/semanage +@@ -38,7 +38,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index ff8f4e9c3008..0782c082dc0c 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -42,7 +42,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py +index 56ebd807c69c..1ff307d9b27d 100644 +--- a/python/sepolgen/src/sepolgen/sepolgeni18n.py ++++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py +@@ -19,7 +19,9 @@ + + try: + import gettext +- t = gettext.translation( 'selinux-python' ) ++ t = gettext.translation("selinux-python", ++ localedir="/usr/share/locale", ++ fallback=True) + _ = t.gettext + except: + def _(str): +diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py +index 7ebe0efa88a1..c7a70e094b0c 100755 +--- a/python/sepolicy/sepolicy.py ++++ b/python/sepolicy/sepolicy.py +@@ -36,7 +36,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py +index 95520f9bc35d..6bde1971fd7c 100644 +--- a/python/sepolicy/sepolicy/__init__.py ++++ b/python/sepolicy/sepolicy/__init__.py +@@ -31,7 +31,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index 3e8b9f9c291d..eff3a8973917 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -56,7 +56,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py +index b0263740a79f..5bdbfebade1d 100644 +--- a/python/sepolicy/sepolicy/gui.py ++++ b/python/sepolicy/sepolicy/gui.py +@@ -49,7 +49,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py +index 599f97fdc6e7..43f86443f2c8 100644 +--- a/python/sepolicy/sepolicy/interface.py ++++ b/python/sepolicy/sepolicy/interface.py +@@ -38,7 +38,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +diff --git a/sandbox/sandbox b/sandbox/sandbox +index 3ef444a12561..53cc504149c9 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -45,7 +45,8 @@ try: + kwargs['unicode'] = True + t = gettext.translation(PROGNAME, + localedir="/usr/share/locale", +- **kwargs) ++ **kwargs, ++ fallback=True) + _ = t.gettext + except: + try: +-- +2.36.1 + diff --git a/0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch b/0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch new file mode 100644 index 0000000..abb3572 --- /dev/null +++ b/0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch @@ -0,0 +1,82 @@ +From afafe02fa9b6b7fdcce883c5e873d46b9d811d66 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Wed, 8 Jun 2022 19:09:54 +0200 +Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh +Content-type: text/plain + +After the last commit this option's name and description no longer +matches the semantic, so give it a new one and update the descriptions. +The old name is still recognized and aliased to the new one for +backwards compatibility. + +Signed-off-by: Ondrej Mosnacek +Acked-by: Nicolas Iooss +--- + policycoreutils/semodule/semodule.8 | 12 ++++++------ + policycoreutils/semodule/semodule.c | 13 ++++++++++--- + 2 files changed, 16 insertions(+), 9 deletions(-) + +diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 +index d1735d216276..c56e580f27b8 100644 +--- a/policycoreutils/semodule/semodule.8 ++++ b/policycoreutils/semodule/semodule.8 +@@ -23,12 +23,12 @@ force a reload of policy + .B \-B, \-\-build + force a rebuild of policy (also reloads unless \-n is used) + .TP +-.B \-\-rebuild-if-modules-changed +-Force a rebuild of the policy if any changes to module content are detected +-(by comparing with checksum from the last transaction). One can use this +-instead of \-B to ensure that any changes to the module store done by an +-external tool (e.g. a package manager) are applied, while automatically +-skipping the rebuild if there are no new changes. ++.B \-\-refresh ++Like \-\-build, but reuses existing linked policy if no changes to module ++files are detected (by comparing with checksum from the last transaction). ++One can use this instead of \-B to ensure that any changes to the module ++store done by an external tool (e.g. a package manager) are applied, while ++automatically skipping the module re-linking if there are no module changes. + .TP + .B \-D, \-\-disable_dontaudit + Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt +diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c +index 1ed8e69054e0..ec0794866daa 100644 +--- a/policycoreutils/semodule/semodule.c ++++ b/policycoreutils/semodule/semodule.c +@@ -150,9 +150,12 @@ static void usage(char *progname) + printf(" -c, --cil extract module as cil. This only affects module extraction.\n"); + printf(" -H, --hll extract module as hll. This only affects module extraction.\n"); + printf(" -m, --checksum print module checksum (SHA256).\n"); +- printf(" --rebuild-if-modules-changed\n" +- " force policy rebuild if module content changed since\n" +- " last rebuild (based on checksum)\n"); ++ printf(" --refresh like --build, but reuses existing linked policy if no\n" ++ " changes to module files are detected (via checksum)\n"); ++ printf("Deprecated options:\n"); ++ printf(" -b,--base same as --install\n"); ++ printf(" --rebuild-if-modules-changed\n" ++ " same as --refresh\n"); + } + + /* Sets the global mode variable to new_mode, but only if no other +@@ -185,6 +188,7 @@ static void parse_command_line(int argc, char **argv) + { + static struct option opts[] = { + {"rebuild-if-modules-changed", 0, NULL, '\0'}, ++ {"refresh", 0, NULL, '\0'}, + {"store", required_argument, NULL, 's'}, + {"base", required_argument, NULL, 'b'}, + {"help", 0, NULL, 'h'}, +@@ -225,6 +229,9 @@ static void parse_command_line(int argc, char **argv) + case '\0': + switch(longind) { + case 0: /* --rebuild-if-modules-changed */ ++ fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n"); ++ /* fallthrough */ ++ case 1: /* --refresh */ + check_ext_changes = 1; + break; + default: +-- +2.36.1 + diff --git a/0014-python-Split-semanage-import-into-two-transactions.patch b/0014-python-Split-semanage-import-into-two-transactions.patch new file mode 100644 index 0000000..2cb27e6 --- /dev/null +++ b/0014-python-Split-semanage-import-into-two-transactions.patch @@ -0,0 +1,65 @@ +From 4a53c0c3ee0edba37ba8e62064175c4928f761a8 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 30 May 2022 14:20:21 +0200 +Subject: [PATCH] python: Split "semanage import" into two transactions +Content-type: text/plain + +First transaction applies all deletion operations, so that there are no +collisions when applying the rest of the changes. + +Fixes: + # semanage port -a -t http_cache_port_t -r s0 -p tcp 3024 + # semanage export | semanage import + ValueError: Port tcp/3024 already defined + +Signed-off-by: Vit Mojzis +--- + python/semanage/semanage | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/python/semanage/semanage b/python/semanage/semanage +index f45061a601f9..4e8d64d6863a 100644 +--- a/python/semanage/semanage ++++ b/python/semanage/semanage +@@ -853,10 +853,29 @@ def handleImport(args): + trans = seobject.semanageRecords(args) + trans.start() + ++ deleteCommands = [] ++ commands = [] ++ # separate commands for deletion from the rest so they can be ++ # applied in a separate transaction + for l in sys.stdin.readlines(): + if len(l.strip()) == 0: + continue ++ if "-d" in l or "-D" in l: ++ deleteCommands.append(l) ++ else: ++ commands.append(l) ++ ++ if deleteCommands: ++ importHelper(deleteCommands) ++ trans.finish() ++ trans.start() ++ ++ importHelper(commands) ++ trans.finish() + ++ ++def importHelper(commands): ++ for l in commands: + try: + commandParser = createCommandParser() + args = commandParser.parse_args(mkargv(l)) +@@ -870,8 +889,6 @@ def handleImport(args): + except KeyboardInterrupt: + sys.exit(0) + +- trans.finish() +- + + def setupImportParser(subparsers): + importParser = subparsers.add_parser('import', help=_('Import local customizations')) +-- +2.36.1 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 85f3372..633fc69 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -42,6 +42,9 @@ Patch0008: 0008-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0009: 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0010: 0010-Use-SHA-2-instead-of-SHA-1.patch Patch0011: 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch +Patch0012: 0012-gettext-handle-unsupported-languages-properly.patch +Patch0013: 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch +Patch0014: 0014-python-Split-semanage-import-into-two-transactions.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -469,6 +472,12 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Jul 25 2022 Petr Lautrbach - 3.4- +- gettext: handle unsupported languages properly (#2100378) +- semodule: rename --rebuild-if-modules-changed to --refresh +- python: Split "semanage import" into two transactions (#2063353) +- selinux-autorelabel: Do not force reboot (#2093133) + * Fri Jul 22 2022 Fedora Release Engineering - 3.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 24691294b1b5e4e61f911eef377002508d9f0ea4 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 27 Jul 2022 11:21:12 +0200 Subject: [PATCH 11/79] Run autorelabel in parallel by default https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel --- selinux-autorelabel | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/selinux-autorelabel b/selinux-autorelabel index f0b5cfa..5290c8c 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -51,9 +51,15 @@ relabel_selinux() { echo $"*** Relabeling could take a very long time, depending on file" echo $"*** system size and speed of hard drives." - FORCE=`cat /.autorelabel` - [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug - /sbin/fixfiles $FORCE restore + OPTS=`cat /.autorelabel` + # by default, use as many threads as there are available + # another -T X in $OPTS will override the default value + OPTS="-T 0 $OPTS" + + [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug + echo + echo $"Running: /sbin/fixfiles $OPTS restore" + /sbin/fixfiles $OPTS restore fi rm -f /.autorelabel From c3299a8a50c37546869d1cef908de1e10f240f49 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 2 Aug 2022 09:35:15 +0200 Subject: [PATCH 12/79] policycoreutils-3.4-6 - Run autorelabel in parallel by default https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel --- policycoreutils.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 633fc69..dd1049d 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2 # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -472,7 +472,11 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Mon Jul 25 2022 Petr Lautrbach - 3.4- +* Tue Aug 2 2022 Petr Lautrbach - 3.4-6 +- Run autorelabel in parallel by default + https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel + +* Mon Jul 25 2022 Petr Lautrbach - 3.4-5 - gettext: handle unsupported languages properly (#2100378) - semodule: rename --rebuild-if-modules-changed to --refresh - python: Split "semanage import" into two transactions (#2063353) From 603c2165fdebea50944a445b7da968503d03650c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 9 Nov 2022 17:24:08 +0100 Subject: [PATCH 13/79] Migrate License tag to SPDX https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- policycoreutils.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index dd1049d..5eaa33a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -12,7 +12,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 Release: 6%{?dist} -License: GPLv2 +License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz URL: https://github.com/SELinuxProject/selinux From b82a2a44d78189732af3383de1de32fc355ed4be Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 10 Nov 2022 17:21:15 +0100 Subject: [PATCH 14/79] run tests via TMT/FMF --- .fmf/version | 1 + plans/selinux.fmf | 7 + .../CIL-modules-without-compilation/Makefile | 64 --- tests/CIL-modules-without-compilation/PURPOSE | 5 - .../runtest.sh | 73 ---- .../linux-system-roles.selinux-tests/Makefile | 63 --- .../linux-system-roles.selinux-tests/PURPOSE | 4 - .../runtest.sh | 57 --- tests/load_policy/Makefile | 64 --- tests/load_policy/PURPOSE | 5 - tests/load_policy/runtest.sh | 79 ---- tests/restorecon/Makefile | 70 ---- tests/restorecon/PURPOSE | 5 - tests/restorecon/runtest.sh | 367 ------------------ tests/restorecon/testpolicy.fc | 2 - tests/restorecon/testpolicy.te | 19 - tests/semanage-interface/Makefile | 65 ---- tests/semanage-interface/PURPOSE | 4 - tests/semanage-interface/runtest.sh | 69 ---- tests/semanage-login/Makefile | 65 ---- tests/semanage-login/PURPOSE | 4 - tests/semanage-login/runtest.sh | 67 ---- tests/semanage-permissive-d-problems/Makefile | 70 ---- tests/semanage-permissive-d-problems/PURPOSE | 5 - .../semanage-permissive-d-problems/runtest.sh | 93 ----- .../Makefile | 71 ---- .../semanage-port-add-delete-problems/PURPOSE | 5 - .../runtest.sh | 137 ------- tests/semanage-user/Makefile | 65 ---- tests/semanage-user/PURPOSE | 4 - tests/semanage-user/runtest.sh | 76 ---- tests/semanage-user/testpolicy.te | 11 - tests/sepolicy-generate/Makefile | 64 --- tests/sepolicy-generate/PURPOSE | 3 - tests/sepolicy-generate/runtest.sh | 115 ------ tests/sestatus/Makefile | 67 ---- tests/sestatus/PURPOSE | 4 - tests/sestatus/runtest.sh | 114 ------ tests/setsebool/Makefile | 65 ---- tests/setsebool/PURPOSE | 5 - tests/setsebool/runtest.sh | 151 ------- tests/tests.yml | 23 -- 42 files changed, 8 insertions(+), 2299 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/selinux.fmf delete mode 100644 tests/CIL-modules-without-compilation/Makefile delete mode 100644 tests/CIL-modules-without-compilation/PURPOSE delete mode 100755 tests/CIL-modules-without-compilation/runtest.sh delete mode 100644 tests/linux-system-roles.selinux-tests/Makefile delete mode 100644 tests/linux-system-roles.selinux-tests/PURPOSE delete mode 100755 tests/linux-system-roles.selinux-tests/runtest.sh delete mode 100644 tests/load_policy/Makefile delete mode 100644 tests/load_policy/PURPOSE delete mode 100755 tests/load_policy/runtest.sh delete mode 100644 tests/restorecon/Makefile delete mode 100644 tests/restorecon/PURPOSE delete mode 100755 tests/restorecon/runtest.sh delete mode 100644 tests/restorecon/testpolicy.fc delete mode 100644 tests/restorecon/testpolicy.te delete mode 100644 tests/semanage-interface/Makefile delete mode 100644 tests/semanage-interface/PURPOSE delete mode 100755 tests/semanage-interface/runtest.sh delete mode 100644 tests/semanage-login/Makefile delete mode 100644 tests/semanage-login/PURPOSE delete mode 100755 tests/semanage-login/runtest.sh delete mode 100644 tests/semanage-permissive-d-problems/Makefile delete mode 100644 tests/semanage-permissive-d-problems/PURPOSE delete mode 100755 tests/semanage-permissive-d-problems/runtest.sh delete mode 100644 tests/semanage-port-add-delete-problems/Makefile delete mode 100644 tests/semanage-port-add-delete-problems/PURPOSE delete mode 100755 tests/semanage-port-add-delete-problems/runtest.sh delete mode 100644 tests/semanage-user/Makefile delete mode 100644 tests/semanage-user/PURPOSE delete mode 100755 tests/semanage-user/runtest.sh delete mode 100644 tests/semanage-user/testpolicy.te delete mode 100644 tests/sepolicy-generate/Makefile delete mode 100644 tests/sepolicy-generate/PURPOSE delete mode 100755 tests/sepolicy-generate/runtest.sh delete mode 100644 tests/sestatus/Makefile delete mode 100644 tests/sestatus/PURPOSE delete mode 100644 tests/sestatus/runtest.sh delete mode 100644 tests/setsebool/Makefile delete mode 100644 tests/setsebool/PURPOSE delete mode 100755 tests/setsebool/runtest.sh delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/selinux.fmf b/plans/selinux.fmf new file mode 100644 index 0000000..c093b2e --- /dev/null +++ b/plans/selinux.fmf @@ -0,0 +1,7 @@ +summary: selinux tests - Tier 1 | policycoreutils +discover: + how: fmf + url: https://src.fedoraproject.org/tests/selinux + filter: "tier: 1 | component: policycoreutils & tags: generic, fedora" +execute: + how: tmt diff --git a/tests/CIL-modules-without-compilation/Makefile b/tests/CIL-modules-without-compilation/Makefile deleted file mode 100644 index 2d8a660..0000000 --- a/tests/CIL-modules-without-compilation/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation -# Description: What the test does -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: What the test does" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL6 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/CIL-modules-without-compilation/PURPOSE b/tests/CIL-modules-without-compilation/PURPOSE deleted file mode 100644 index a9c7d54..0000000 --- a/tests/CIL-modules-without-compilation/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation -Author: Milos Malik - -Is it possible to manage policy modules written in CIL without any compilation? Does semanage and semodule understand them? - diff --git a/tests/CIL-modules-without-compilation/runtest.sh b/tests/CIL-modules-without-compilation/runtest.sh deleted file mode 100755 index 451461a..0000000 --- a/tests/CIL-modules-without-compilation/runtest.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation -# Description: What the test does -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "echo '()' > empty.cil" - rlRun "echo '(())' > invalid.cil" - rlPhaseEnd - - rlPhaseStartTest "empty CIL module" - rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 - rlRun "semodule -i empty.cil" - rlRun "semodule -lfull | grep '400.*empty.*cil'" - rlRun "semodule -r empty" - rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 - rlRun "semanage module -l | grep 'empty.*400.*cil'" 1 - rlRun "semanage module -a empty.cil" - rlRun "semanage module -l | grep 'empty.*400.*cil'" - rlRun "semanage module -r empty" - rlRun "semanage module -l | grep 'empty.*400.*cil'" 1 - rlPhaseEnd - - rlPhaseStartTest "invalid CIL module" - rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 - rlRun "semodule -i invalid.cil" 1 - rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 - rlRun "semodule -r invalid" 1 - rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 - rlRun "semanage module -l | grep 'invalid.*400.*cil'" 1 - rlRun "semanage module -a invalid.cil" 1 - rlRun "semanage module -l | grep 'invalid.*400.*cil'" 1 - rlRun "semanage module -r invalid" 1 - rlRun "semanage module -l | grep 'invalid.*400.*cil'" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f empty.cil invalid.cil" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/linux-system-roles.selinux-tests/Makefile b/tests/linux-system-roles.selinux-tests/Makefile deleted file mode 100644 index eed0222..0000000 --- a/tests/linux-system-roles.selinux-tests/Makefile +++ /dev/null @@ -1,63 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of selinux-ansible-playbook -# Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2018 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=linux-system-roles.selinux-tests -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Petr Lautrbach " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils ansible git" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/linux-system-roles.selinux-tests/PURPOSE b/tests/linux-system-roles.selinux-tests/PURPOSE deleted file mode 100644 index 0494ab0..0000000 --- a/tests/linux-system-roles.selinux-tests/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of selinux-ansible-playbook -Author: Petr Lautrbach - -Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests diff --git a/tests/linux-system-roles.selinux-tests/runtest.sh b/tests/linux-system-roles.selinux-tests/runtest.sh deleted file mode 100755 index 95485af..0000000 --- a/tests/linux-system-roles.selinux-tests/runtest.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests -# Author: Petr Lautrbach -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2018 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlAssertRpm "git" - rlAssertRpm "ansible" - - rlPhaseEnd - - rlPhaseStartTest - rlRun "git clone https://github.com/linux-system-roles/selinux.git" - rlRun "cd selinux/test" - - for ansible_test in test_*.yml; do - rlRun "ansible-playbook -i localhost, -c local -v $ansible_test" - done - - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "cd ../../" - rlRun "rm -rf selinux" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/load_policy/Makefile b/tests/load_policy/Makefile deleted file mode 100644 index ffee588..0000000 --- a/tests/load_policy/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/load_policy -# Description: Does load_policy work as expected? Does it produce correct audit messages? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/load_policy -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does load_policy work as expected? Does it produce correct audit messages?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: audit policycoreutils selinux-policy-targeted" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/load_policy/PURPOSE b/tests/load_policy/PURPOSE deleted file mode 100644 index a5984d3..0000000 --- a/tests/load_policy/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/load_policy -Author: Milos Malik - -Does load_policy work as expected? Does it produce correct audit messages? - diff --git a/tests/load_policy/runtest.sh b/tests/load_policy/runtest.sh deleted file mode 100755 index 2a77654..0000000 --- a/tests/load_policy/runtest.sh +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/load_policy -# Description: Does load_policy work as expected? Does it produce correct audit messages? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" -if rlIsRHEL 6 ; then - SELINUX_FS_MOUNT="/selinux" -else # RHEL-7 and above - SELINUX_FS_MOUNT="/sys/fs/selinux" -fi - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "ls -l `which load_policy`" - BINARY_POLICY=`find /etc/selinux/targeted -type f -name policy.?? | sort -n | tail -n 1` - rlRun "ls -l ${BINARY_POLICY}" - rlPhaseEnd - - rlPhaseStartTest - rlRun "load_policy --xyz 2>&1 | grep \"invalid option\"" - rlRun "dmesg | grep -i selinux" 0,1 - rlRun "grep -i selinux /proc/mounts" - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 1 - rlRun "load_policy -q" - rlRun "grep -i selinux /proc/mounts" - sleep 1 - if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" - fi - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" - rlRun "umount ${SELINUX_FS_MOUNT}" - rlRun "grep -i selinux /proc/mounts" 1 - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 1 - rlRun "load_policy -i ${BINARY_POLICY}" - rlRun "grep -i selinux /proc/mounts" - sleep 1 - if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" - fi - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" - rlRun "dmesg | grep -i selinux" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/restorecon/Makefile b/tests/restorecon/Makefile deleted file mode 100644 index 991e8f9..0000000 --- a/tests/restorecon/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/restorecon -# Description: does restorecon work correctly ? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/restorecon -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te testpolicy.fc - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh;: - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: does restorecon work correctly ?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: e2fsprogs" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: selinux-policy-devel" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/restorecon/PURPOSE b/tests/restorecon/PURPOSE deleted file mode 100644 index d029be8..0000000 --- a/tests/restorecon/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/restorecon -Author: Milos Malik - -Does restorecon work correctly? - diff --git a/tests/restorecon/runtest.sh b/tests/restorecon/runtest.sh deleted file mode 100755 index b16d4c0..0000000 --- a/tests/restorecon/runtest.sh +++ /dev/null @@ -1,367 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/restorecon -# Description: does restorecon work correctly ? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlServiceStop mcstrans mcstransd - rlRun "rpm -qf `which restorecon` | grep ${PACKAGE}" - rlRun "setenforce 1" - rlRun "sestatus" - rlRun "setsebool allow_domain_fd_use on" - rlPhaseEnd - - rlPhaseStartTest "Functional test" - - TESTDIR="/opt/restorecon_testdir" - DIRS="correct.dir incorrect1.dir incorrect2.dir customizable.dir" - FILES="correct.file incorrect.file customizable.file" - - rlRun "make -f /usr/share/selinux/devel/Makefile" - rlRun "semodule -i testpolicy.pp" - - rlFileBackup /etc/selinux/targeted/contexts/customizable_types - rlRun "echo 'customizable_t' >> /etc/selinux/targeted/contexts/customizable_types" - - # Here is the testing dirs and files structure - # all the files have initial context corresponding to their names - - # ./ - # correct.file - # incorrect.file - # customizable.file - - # correct.dir/ - # correct.file - # incorrect.file - # customizable.file - - # incorrect1.dir/ - # correct.file - # incorrect.file - # customizable.file - - # incorrect2.dir/ - # correct.file - # incorrect.file - # customizable.file - - # customizable.dir/ - # correct.file - # incorrect.file - # customizable.file - - # Function to set initial contexts - function set_contexts { - # Set the intended contexts - rlLog "Setting initial contexts of testing dirs..." - restorecon -R $TESTDIR - for ITEM in `find . -name 'incorrect*'`; do - chcon -t incorrect_t $ITEM - done - for ITEM in `find . -name 'customizable*'`; do - chcon -t customizable_t $ITEM - done - } - - # Check that files in dir $1 have the initial contexts - function check_initial_contexts { - if echo $1 | grep -q 'incorrect.dir'; then - rlRun "ls -ladZ $1 | grep :incorrect_t" - elif echo $1 | grep -q 'correct.dir'; then - rlRun "ls -ladZ $1 | grep :correct_t" - elif echo $1 | grep -q 'customizable.dir'; then - rlRun "ls -ladZ $1 | grep :customizable_t" - fi - rlRun "ls -ladZ $1/* | grep '\ ../file_list < -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-interface -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does semanage interface ... work correctly?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils policycoreutils-python-utils grep selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/semanage-interface/PURPOSE b/tests/semanage-interface/PURPOSE deleted file mode 100644 index 86bd3ab..0000000 --- a/tests/semanage-interface/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/semanage-interface -Description: Does semanage interface ... work correctly? -Author: Milos Malik - diff --git a/tests/semanage-interface/runtest.sh b/tests/semanage-interface/runtest.sh deleted file mode 100755 index ba8608b..0000000 --- a/tests/semanage-interface/runtest.sh +++ /dev/null @@ -1,69 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-interface -# Description: Does semanage interface ... work correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlPhaseEnd - - rlPhaseStartTest - rlRun "semanage interface --help" 0,1 - for POLICY_TYPE in minimum mls targeted ; do - if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then - continue - fi - rlRun "semanage interface -l -S ${POLICY_TYPE}" - done - if ! rlIsRHEL 5; then - rlRun "semanage interface -l -S unknown 2>&1 | grep \"store cannot be accessed\"" - fi - rlRun "semanage interface -a -t xyz_t xyz 2>&1 | grep -i -e 'not defined' -e 'error' -e 'could not'" - rlRun "semanage interface -m xyz" 1,2 - rlRun "semanage interface -d xyz" 1 - rlRun "semanage interface -a -t netif_t xyz" - if rlIsRHEL 5 6; then - rlRun "semanage interface -m -r s0 xyz" - else - rlRun "semanage interface -m -t netif_t -r s0 xyz" - fi - rlRun "semanage interface -l | grep \"xyz.*:netif_t:s0\"" - rlRun "semanage interface -d xyz" - rlRun "semanage interface -l | grep xyz" 1 - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/semanage-login/Makefile b/tests/semanage-login/Makefile deleted file mode 100644 index 1172ca9..0000000 --- a/tests/semanage-login/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/semanage-login -# Description: Does semanage login ... work correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-login -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does semanage login ... work correctly?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils policycoreutils-python-utils grep shadow-utils selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/semanage-login/PURPOSE b/tests/semanage-login/PURPOSE deleted file mode 100644 index b8f26c6..0000000 --- a/tests/semanage-login/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/semanage-login -Description: Does semanage login ... work correctly? -Author: Milos Malik - diff --git a/tests/semanage-login/runtest.sh b/tests/semanage-login/runtest.sh deleted file mode 100755 index daf074c..0000000 --- a/tests/semanage-login/runtest.sh +++ /dev/null @@ -1,67 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-login -# Description: Does semanage login ... work correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlPhaseEnd - - rlPhaseStartTest - rlRun "semanage login --help" 0,1 - for POLICY_TYPE in minimum mls targeted ; do - if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then - continue - fi - rlRun "semanage login -l -S ${POLICY_TYPE}" - done - if ! rlIsRHEL 5; then - rlRun "semanage login -l -S unknown 2>&1 | grep \"store cannot be accessed\"" - fi - rlRun "semanage login -a -s xyz_u xyz 2>&1 | grep -i -e 'does not exist' -e 'mapping.*invalid' -e 'could not query'" - rlRun "semanage login -m xyz" 1 - rlRun "semanage login -d xyz" 1 - rlRun "useradd xyz" - rlRun "semanage login -a -s user_u xyz" - rlRun "semanage login -m -r s0 xyz" - rlRun "semanage login -l | grep \"xyz.*user_u.*s0\"" - rlRun "semanage login -d xyz" - rlRun "semanage login -l | grep xyz" 1 - rlRun "userdel -rf xyz" - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/semanage-permissive-d-problems/Makefile b/tests/semanage-permissive-d-problems/Makefile deleted file mode 100644 index a5bffc2..0000000 --- a/tests/semanage-permissive-d-problems/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -# Description: semanage permissive -d accepts more than domain types, its behavior is not reliable -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh; : - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: semanage permissive -d accepts more than domain types, its behavior is not reliable" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils-python-utils" >> $(METADATA) - @echo "Requires: policycoreutils-devel" >> $(METADATA) - @echo "Requires: selinux-policy-devel" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: coreutils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/semanage-permissive-d-problems/PURPOSE b/tests/semanage-permissive-d-problems/PURPOSE deleted file mode 100644 index f0d5e6f..0000000 --- a/tests/semanage-permissive-d-problems/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -Author: Milos Malik - -Does semanage permissive work correctly? - diff --git a/tests/semanage-permissive-d-problems/runtest.sh b/tests/semanage-permissive-d-problems/runtest.sh deleted file mode 100755 index 61ccc4f..0000000 --- a/tests/semanage-permissive-d-problems/runtest.sh +++ /dev/null @@ -1,93 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems -# Description: semanage permissive -d accepts more than domain types, its behavior is not reliable -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "rpm -qf /usr/sbin/semanage" - OUTPUT_FILE=`mktemp` - rlRun "sestatus" - rlPhaseEnd - - if selinuxenabled ; then - rlPhaseStartTest - if rlIsRHEL 7 ; then - rlFileBackup /usr/share/selinux/default/Makefile - rlRun "rm -rf /usr/share/selinux/default/Makefile" - fi - rlRun "semanage permissive -l | grep fenced" 1 - rlRun "semanage permissive -a fenced_t" - rlRun "semanage permissive -l | grep fenced" - rlRun "semanage permissive -d fenced_t" - rlRun "semanage permissive -l | grep fenced" 1 - if rlIsRHEL 7 ; then - rlFileRestore - fi - rlPhaseEnd - - rlPhaseStartTest - rlRun "semanage permissive -l 2>&1 | grep -e ypserv_t -e ypbind_t | tee ${OUTPUT_FILE}" - rlRun "wc -l < ${OUTPUT_FILE} | grep ^0$" - rlRun "semanage permissive -a ypbind_t" - rlRun "semanage permissive -a ypserv_t" - rlRun "semanage permissive -l 2>&1 | grep -e ypserv_t -e ypbind_t | tee ${OUTPUT_FILE}" - rlRun "wc -l < ${OUTPUT_FILE} | grep ^2$" - rlRun "semanage permissive -d yp" 1-255 - rlRun "semanage permissive -l 2>&1 | grep -e ypserv_t -e ypbind_t | tee ${OUTPUT_FILE}" - rlRun "wc -l < ${OUTPUT_FILE} | grep ^2$" - rlRun "semanage permissive -d ypbind_t" - rlRun "semanage permissive -d ypserv_t" - rlRun "semanage permissive -l 2>&1 | grep -e ypserv_t -e ypbind_t | tee ${OUTPUT_FILE}" - rlRun "wc -l < ${OUTPUT_FILE} | grep ^0$" - rlPhaseEnd - - rlPhaseStartTest - rlRun -s "semanage permissive -d" 1 - rlAssertNotGrep 'traceback' $rlRun_LOG -iEq - rlAssertGrep 'error: the following argument is required: type' $rlRun_LOG -iEq - rm -f $rlRun_LOG - rlPhaseEnd - else - rlPhaseStartTest - rlRun "semanage permissive -l >& ${OUTPUT_FILE}" 0,1 - rlRun "grep -C 32 -i -e exception -e traceback -e error ${OUTPUT_FILE}" 1 - rlPhaseEnd - fi - - rlPhaseStartCleanup - rm -f ${OUTPUT_FILE} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/semanage-port-add-delete-problems/Makefile b/tests/semanage-port-add-delete-problems/Makefile deleted file mode 100644 index 263da02..0000000 --- a/tests/semanage-port-add-delete-problems/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -# Description: semanage accepts invalid port numbers and then cannot delete them -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh;: - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: semanage accepts invalid port numbers and then cannot delete them" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils-python-utils" >> $(METADATA) - @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: coreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/semanage-port-add-delete-problems/PURPOSE b/tests/semanage-port-add-delete-problems/PURPOSE deleted file mode 100644 index a59e74f..0000000 --- a/tests/semanage-port-add-delete-problems/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -Author: Milos Malik - -semanage accepts invalid port numbers and then cannot delete them - diff --git a/tests/semanage-port-add-delete-problems/runtest.sh b/tests/semanage-port-add-delete-problems/runtest.sh deleted file mode 100755 index 2bd9c9a..0000000 --- a/tests/semanage-port-add-delete-problems/runtest.sh +++ /dev/null @@ -1,137 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/rhts-library/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems -# Description: semanage accepts invalid port numbers and then cannot delete them -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" -PORT_NAME="ldap_port_t" -BAD_PORT_NUMBER="123456" -GOOD_PORT_NUMBER="1389" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "rpm -qf /usr/sbin/semanage" - rlRun "rpm -qf /usr/bin/seinfo" - OUTPUT_FILE=`mktemp` - rlRun "setenforce 1" - rlRun "sestatus" - rlPhaseEnd - - rlPhaseStartTest - rlRun "semanage port -l | grep ${PORT_NAME}" - - rlRun "semanage port -l | grep ${PORT_NAME} | tee -a ${OUTPUT_FILE}" - rlRun "semanage port -a -t ${PORT_NAME} -p tcp ${BAD_PORT_NUMBER}" 1 - rlRun "semanage port -l | grep ${PORT_NAME} | tee -a ${OUTPUT_FILE}" - rlRun "semanage port -d -t ${PORT_NAME} -p tcp ${BAD_PORT_NUMBER}" 1 - rlRun "semanage port -l | grep ${PORT_NAME} | tee -a ${OUTPUT_FILE}" - #rlRun "sort ${OUTPUT_FILE} | uniq | wc -l | grep '^2$'" - - rlRun "semanage port -l | grep ${PORT_NAME} | grep ${GOOD_PORT_NUMBER}" 1 - rlRun "semanage port -a -t ${PORT_NAME} -p tcp ${GOOD_PORT_NUMBER}" - rlRun "semanage port -l | grep ${PORT_NAME} | grep ${GOOD_PORT_NUMBER}" - rlRun "semanage port -d -t ${PORT_NAME} -p tcp ${GOOD_PORT_NUMBER}" - rlRun "semanage port -l | grep ${PORT_NAME} | grep ${GOOD_PORT_NUMBER}" 1 - rlPhaseEnd - - rlPhaseStartTest - rlRun "semanage port -a -t syslogd_port_t -p tcp 60514-60516 2>&1 | grep -i traceback" 1 - rlRun "semanage port -l | grep syslogd_port_t" - rlRun "semanage port -d -t syslogd_port_t -p tcp 60514-60516 2>&1 | grep -i traceback" 1 - rlPhaseEnd - - if rlIsRHEL ; then - rlPhaseStartTest - rlRun "ps -efZ | grep -v grep | grep \"auditd_t.*auditd\"" - if rlIsRHEL 5 6; then - PORT_TYPE="syslogd_port_t" - else - PORT_TYPE="commplex_link_port_t" - fi - - # adding a port number to a type - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 1 - rlRun "semanage port -a -p tcp -t $PORT_TYPE 5005" - sleep 2 - - # Check for user_avc - rlRun "ausearch -m user_avc -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1 - LINE_COUNT=`wc -l < ${OUTPUT_FILE}` - rlRun "cat ${OUTPUT_FILE}" - rlAssert0 "number of lines in ${OUTPUT_FILE} should be 0" ${LINE_COUNT} - - # deleting a port number from a type - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 1 - rlRun "semanage port -d -p tcp -t $PORT_TYPE 5005" - sleep 2 - - # Check for user_avc - rlRun "ausearch -m user_avc -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1 - LINE_COUNT=`wc -l < ${OUTPUT_FILE}` - rlRun "cat ${OUTPUT_FILE}" - rlAssert0 "number of lines in ${OUTPUT_FILE} should be 0" ${LINE_COUNT} - rlPhaseEnd - fi - - if ! rlIsRHEL 5 ; then - rlPhaseStartTest - rlRun "seinfo --portcon | grep :hi_reserved_port_t:" - rlRun "seinfo --portcon | grep :reserved_port_t:" - rlRun "semanage port -l | grep ^hi_reserved_port_t" - rlRun "semanage port -l | grep ^reserved_port_t" - if ! rlIsRHEL 6 ; then - rlRun "seinfo --portcon | grep :unreserved_port_t:" - rlRun "semanage port -l | grep ^unreserved_port_t" - fi - rlPhaseEnd - fi - - rlPhaseStartTest "manipulation with hard-wired ports" - rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" - rlRun "semanage port -a -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* already defined" ${OUTPUT_FILE} -i - rlRun "semanage port -a -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* already defined" ${OUTPUT_FILE} -i - rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" - rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i - rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i - rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" - rlPhaseEnd - - rlPhaseStartCleanup - rm -f ${OUTPUT_FILE} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/semanage-user/Makefile b/tests/semanage-user/Makefile deleted file mode 100644 index 5ab248d..0000000 --- a/tests/semanage-user/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Regression/semanage-user -# Description: Does semanage user ... work correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Regression/semanage-user -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - test -x runtest.sh || chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Does semanage user ... work correctly?" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils policycoreutils-python-utils grep selinux-policy-devel selinux-policy-minimum selinux-policy-mls selinux-policy-targeted selinux-policy-devel" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/semanage-user/PURPOSE b/tests/semanage-user/PURPOSE deleted file mode 100644 index 8089db8..0000000 --- a/tests/semanage-user/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Regression/semanage-user -Description: Does semanage user ... work correctly? -Author: Milos Malik - diff --git a/tests/semanage-user/runtest.sh b/tests/semanage-user/runtest.sh deleted file mode 100755 index b2413fb..0000000 --- a/tests/semanage-user/runtest.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-user -# Description: Does semanage user ... work correctly? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "make -f /usr/share/selinux/devel/Makefile" - rlRun "ls -l testpolicy.pp" - rlPhaseEnd - - rlPhaseStartTest - if rlIsRHEL 5 6; then - rlRun "semanage user --help" 1 - else - rlRun "semanage user --help" 0 - # semanage: list option can not be used with --level ("semanage user -l") - rlRun "semanage user --help | grep fcontext" 1 - fi - for POLICY_TYPE in minimum mls targeted ; do - if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then - continue - fi - rlRun "semanage user -l -S ${POLICY_TYPE}" - done - if ! rlIsRHEL 5; then - rlRun "semanage user -l -S unknown 2>&1 | grep \"store cannot be accessed\"" - fi - rlRun "semanage user -a -P user -R xyz_r xyz_u 2>&1 | grep -i -e 'undefined' -e 'error' -e 'could not'" - rlRun "semanage user -m xyz_u" 1 - rlRun "semanage user -d xyz_u" 1 - rlRun "semodule -i testpolicy.pp" - rlRun "semanage user -a -P user -R xyz_r xyz_u" - rlRun "semanage user -m -r s0 xyz_u" - rlRun "semanage user -l | grep \"xyz_u.*s0.*s0.*xyz_r\"" - rlRun "semanage user -d xyz_u" - rlRun "semanage user -l | grep xyz_u" 1 - rlRun "semodule -r testpolicy" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf tmp testpolicy.{fc,if,pp}" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/semanage-user/testpolicy.te b/tests/semanage-user/testpolicy.te deleted file mode 100644 index b854bef..0000000 --- a/tests/semanage-user/testpolicy.te +++ /dev/null @@ -1,11 +0,0 @@ -module testpolicy 1.0; - -type xyz_t; -role xyz_r; - -require { - type xyz_t; -} - -role xyz_r types xyz_t; - diff --git a/tests/sepolicy-generate/Makefile b/tests/sepolicy-generate/Makefile deleted file mode 100644 index 9e1a9b7..0000000 --- a/tests/sepolicy-generate/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/sepolicy-generate -# Description: sepolicy generate sanity test -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/sepolicy-generate -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Michal Trunecka " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: sepolicy generate sanity test" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 115m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils policycoreutils-devel rpm-build" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/sepolicy-generate/PURPOSE b/tests/sepolicy-generate/PURPOSE deleted file mode 100644 index a069ff2..0000000 --- a/tests/sepolicy-generate/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/sepolicy-generate -Description: sepolicy generate sanity test -Author: Michal Trunecka diff --git a/tests/sepolicy-generate/runtest.sh b/tests/sepolicy-generate/runtest.sh deleted file mode 100755 index 5da10b8..0000000 --- a/tests/sepolicy-generate/runtest.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/sepolicy-generate -# Description: sepolicy generate sanity test -# Author: Michal Trunecka -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="policycoreutils" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlCheckRequirements ${PACKAGES[*]}" || rlDie "cannot continue" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlPhaseEnd - - rlPhaseStartTest - rlRun "mkdir mypolicy" - rlRun "sepolicy generate --customize -p mypolicy -n testpolicy -d httpd_sys_script_t -w /home" - rlRun "grep 'manage_dirs_pattern(httpd_sys_script_t' mypolicy/testpolicy.te" - rlRun "rm -rf mypolicy" - rlPhaseEnd - - rlPhaseStartTest - rlRun "mkdir mypolicy" - rlRun "touch /usr/bin/testpolicy" - for VARIANT in " -n testpolicy --admin_user -r webadm_r" \ - " --application /usr/bin/testpolicy " \ - " -n testpolicy --confined_admin -a firewalld " \ - " -n testpolicy --confined_admin " \ - " -n testpolicy --customize -d httpd_t -a firewalld " \ - " -n testpolicy --customize -d httpd_t" \ - " --dbus /usr/bin/testpolicy " \ - " -n testpolicy --desktop_user " \ - " --inetd /usr/bin/testpolicy " \ - " --init /usr/bin/testpolicy " \ - " -n testpolicy --newtype -t newtype_var_log_t " \ - " -n testpolicy --newtype -t newtype_unit_file_t " \ - " -n testpolicy --newtype -t newtype_var_run_t " \ - " -n testpolicy --newtype -t newtype_var_cache_t " \ - " -n testpolicy --newtype -t newtype_tmp_t " \ - " -n testpolicy --newtype -t newtype_port_t " \ - " -n testpolicy --newtype -t newtype_var_spool_t " \ - " -n testpolicy --newtype -t newtype_var_lib_t " \ - " -n testpolicy --sandbox " \ - " -n testpolicy --term_user " \ - " -n testpolicy --x_user " -# " --cgi /usr/bin/testpolicy " - do - rlRun "sepolicy generate -p mypolicy $VARIANT" - rlRun "cat mypolicy/testpolicy.te" - rlRun "cat mypolicy/testpolicy.if" - rlRun "cat mypolicy/testpolicy.fc" - if echo "$VARIANT" | grep -q newtype; then - rlAssertNotExists "mypolicy/testpolicy.sh" - rlAssertNotExists "mypolicy/testpolicy.spec" - else - rlRun "mypolicy/testpolicy.sh" - rlRun "semodule -l | grep testpolicy" - rlRun "semanage user -d testpolicy_u" 0-255 - rlRun "semodule -r testpolicy" - fi - - rlRun "rm -rf mypolicy/*" - rlRun "sleep 1" - - if ! echo "$VARIANT" | grep -q newtype; then - rlRun "sepolicy generate -p mypolicy -w /home $VARIANT" - rlRun "cat mypolicy/testpolicy.te" - rlRun "cat mypolicy/testpolicy.if" - rlRun "cat mypolicy/testpolicy.fc" - - rlRun "mypolicy/testpolicy.sh" - rlRun "semodule -l | grep testpolicy" - rlRun "semanage user -d testpolicy_u" 0-255 - rlRun "semodule -r testpolicy" - - rlRun "rm -rf mypolicy/*" - rlRun "sleep 1" - fi - done - rlRun "rm -rf mypolicy" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/sestatus/Makefile b/tests/sestatus/Makefile deleted file mode 100644 index e45db0d..0000000 --- a/tests/sestatus/Makefile +++ /dev/null @@ -1,67 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/sestatus -# Description: tests everything about sestatus -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/sestatus -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: tests everything about sestatus" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) - @echo "Requires: man" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/sestatus/PURPOSE b/tests/sestatus/PURPOSE deleted file mode 100644 index cacee0f..0000000 --- a/tests/sestatus/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/sestatus -Description: tests everything about sestatus -Author: Milos Malik - diff --git a/tests/sestatus/runtest.sh b/tests/sestatus/runtest.sh deleted file mode 100644 index b91b948..0000000 --- a/tests/sestatus/runtest.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/sestatus -# Description: tests everything about sestatus -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="policycoreutils" -if rlIsRHEL 5 6 ; then - SELINUX_FS_MOUNT="/selinux" -else # RHEL-7 and above - SELINUX_FS_MOUNT="/sys/fs/selinux" -fi - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlFileBackup /etc/sestatus.conf - rlRun "mount | grep -i selinux" 0,1 - OUTPUT_FILE=`mktemp` - rlPhaseEnd - - rlPhaseStartTest "basic use" - rlRun "sestatus" - rlRun "sestatus -b 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "policy booleans" ${OUTPUT_FILE} -i - rlRun "sestatus -v 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "process contexts" ${OUTPUT_FILE} -i - rlAssertGrep "file contexts" ${OUTPUT_FILE} -i - rlAssertGrep "current context" ${OUTPUT_FILE} -i - rlAssertGrep "init context" ${OUTPUT_FILE} -i - rlAssertGrep "controlling term" ${OUTPUT_FILE} -i - rlRun "sestatus --xyz 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "invalid option" ${OUTPUT_FILE} -i - rlPhaseEnd - - rlPhaseStartTest "extreme cases" - # pretend that the config file contains an invalid section - rlRun "sed -i 's/files/xyz/' /etc/sestatus.conf" - rlRun "sestatus -v 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "line not in a section" ${OUTPUT_FILE} -i - rlRun "rm -f /etc/sestatus.conf" - rlRun "mkdir /etc/sestatus.conf" # intentionally replaced a file with a directory - rlRun "sestatus -v" - # pretend that the config file is missing - rlRun "rm -rf /etc/sestatus.conf" - for OPTION in "-bv" "-v" ; do - rlRun "sestatus ${OPTION} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "unable to open /etc/sestatus.conf" ${OUTPUT_FILE} -i - done - rlFileRestore - # pretend that SELinux is disabled - rlRun "umount ${SELINUX_FS_MOUNT}" - for OPTION in "" "-b" "-v" "-bv" ; do - rlRun "sestatus ${OPTION} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "selinux status.*disabled" ${OUTPUT_FILE} -i - done - rlRun "mount -t selinuxfs none ${SELINUX_FS_MOUNT}" - # pretend that no booleans are defined - rlRun "mkdir ./booleans" - rlRun "mount --bind ./booleans ${SELINUX_FS_MOUNT}/booleans" - rlRun "sestatus -b 2>&1 | tee ${OUTPUT_FILE}" - rlRun "umount ${SELINUX_FS_MOUNT}/booleans" - rlAssertNotGrep "booleans" ${OUTPUT_FILE} -i - rlRun "rmdir ./booleans" - rlPhaseEnd - - # This bug is not worth fixing in RHEL-5 - if ! rlIsRHEL 5 ; then - rlPhaseStartTest - rlRun "rpm -ql ${PACKAGE} | grep /usr/sbin/sestatus" - rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/man8/sestatus.8" - for OPTION in b v ; do - rlRun "sestatus --help 2>&1 | grep -- -${OPTION}" - rlRun "man sestatus | col -b | grep -- -${OPTION}" - done - if ! rlIsRHEL 6 ; then - rlRun "man -w sestatus.conf" - fi - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlFileRestore - rm -f ${OUTPUT_FILE} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/setsebool/Makefile b/tests/setsebool/Makefile deleted file mode 100644 index 0730993..0000000 --- a/tests/setsebool/Makefile +++ /dev/null @@ -1,65 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/policycoreutils/Sanity/setsebool -# Description: does setsebool work correctly ? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/policycoreutils/Sanity/setsebool -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: does setsebool work correctly ?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 45m" >> $(METADATA) - @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: audit policycoreutils libselinux-utils shadow-utils grep" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4" >> $(METADATA) - - rhts-lint $(METADATA) - diff --git a/tests/setsebool/PURPOSE b/tests/setsebool/PURPOSE deleted file mode 100644 index 07ce0bf..0000000 --- a/tests/setsebool/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/policycoreutils/Sanity/setsebool -Author: Milos Malik - -Does setsebool work as expected? Does it produce correct audit messages? - diff --git a/tests/setsebool/runtest.sh b/tests/setsebool/runtest.sh deleted file mode 100755 index 04040d1..0000000 --- a/tests/setsebool/runtest.sh +++ /dev/null @@ -1,151 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/policycoreutils/Sanity/setsebool -# Description: does setsebool work correctly ? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="policycoreutils" -USER_NAME="user${RANDOM}" -USER_SECRET="s3kr3t${RANDOM}" -BOOLEAN="ftpd_connect_db" -if rlIsRHEL 5 6 ; then - SELINUX_FS_MOUNT="/selinux" -else # RHEL-7 and above - SELINUX_FS_MOUNT="/sys/fs/selinux" -fi - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - OUTPUT_FILE=`mktemp` - chcon -t tmp_t ${OUTPUT_FILE} - - rlRun "useradd ${USER_NAME}" - rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlPhaseEnd - - rlPhaseStartTest - for OPTION in "" "-P" ; do - for OPERATOR in " " "=" ; do - for VALUE in 0 1 false true off on ; do - rlRun "setsebool ${OPTION} ${BOOLEAN}${OPERATOR}${VALUE} | grep -i -e illegal -e usage -e invalid" 1 - if [ ${VALUE} == "0" -o ${VALUE} == "false" ] ; then - SHOWN_VALUE="off" - elif [ ${VALUE} == "1" -o ${VALUE} == "true" ] ; then - SHOWN_VALUE="on" - else - SHOWN_VALUE=${VALUE} - fi - rlRun "getsebool -a | grep \"^${BOOLEAN}.*${SHOWN_VALUE}\"" - done - done - done - rlPhaseEnd - - rlPhaseStartTest - rlRun "setsebool" 1 - rlRun "setsebool xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\"" - rlRun "setsebool xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\"" - rlRun "setsebool xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\"" - if ! rlIsRHEL 5 6 ; then - rlRun "setsebool -N 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\"" - rlRun "setsebool -P 2>&1 | tee /dev/stderr | grep -i \"boolean.*required\"" - fi - rlRun "setsebool -P xyz=1 2>&1 | tee /dev/stderr | grep -i -e \"invalid boolean\" -e \"not found\" -e \"not defined\"" - rlRun "setsebool -P xyz=-1 2>&1 | tee /dev/stderr | grep -i \"illegal value\"" - rlRun "setsebool -P xyz=2 2>&1 | tee /dev/stderr | grep -i \"illegal value\"" - rlPhaseEnd - - if ! rlIsRHEL 5 6 ; then - rlPhaseStartTest - rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "try as root" ${OUTPUT_FILE} -i - rlRun "su -l -c '/usr/sbin/setsebool allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "try as root" ${OUTPUT_FILE} -i - rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 0' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "try as root" ${OUTPUT_FILE} -i - rlRun "su -l -c '/usr/sbin/setsebool -P allow_ypbind 1' ${USER_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "try as root" ${OUTPUT_FILE} -i - rlPhaseEnd - - rlPhaseStartTest - for OPTION in "" "-P" ; do - rlRun "getsebool allow_ypbind | grep nis_enabled" - rlRun "setsebool ${OPTION} allow_ypbind on" - rlRun "getsebool allow_ypbind | grep \"nis_enabled.*on\"" - rlRun "setsebool ${OPTION} allow_ypbind off" - rlRun "getsebool allow_ypbind | grep \"nis_enabled.*off\"" - done - rlPhaseEnd - - rlPhaseStartTest - # https://fedoraproject.org/wiki/Features/SELinuxBooleansRename - for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do - OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1` - NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2` - rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" - rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" - done - rlPhaseEnd - fi - - rlPhaseStartTest "audit messages" - START_DATE_TIME=`date "+%m/%d/%Y %T"` - sleep 1 - rlRun "setsebool ${BOOLEAN} on" - rlRun "setsebool ${BOOLEAN} off" - rlRun "setsebool ${BOOLEAN} on" - sleep 1 - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" - if rlIsRHEL ; then - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\"" - fi - rlPhaseEnd - - rlPhaseStartTest "extreme cases" - # pretend that no booleans are defined - rlRun "mkdir ./booleans" - rlRun "mount --bind ./booleans ${SELINUX_FS_MOUNT}/booleans" - rlRun "setsebool ${BOOLEAN} on 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i - rlRun "setsebool ${BOOLEAN} off 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not change active booleans" ${OUTPUT_FILE} -i - rlRun "umount ${SELINUX_FS_MOUNT}/booleans" - rlRun "rmdir ./booleans" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "userdel -rf ${USER_NAME}" - rm -f ${OUTPUT_FILE} - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 29e9631..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Tests to run in a classic environment -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/selinux.git" - dest: "selinux" - fmf_filter: "tier: 1 | component: policycoreutils & tags: generic, fedora" - -# Tests for atomic host -- hosts: localhost - tags: - - atomic - # no compatible tests - -# Tests for docker container -- hosts: localhost - tags: - - container - # no compatible tests From 36b92b86ad7a9d316445d73545764d3f737a3028 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 16 Nov 2022 11:18:37 +0100 Subject: [PATCH 15/79] Drop unused files --- make-rhat-patches.sh | 40 ---------------------------------------- zanata.xml | 8 -------- 2 files changed, 48 deletions(-) delete mode 100755 make-rhat-patches.sh delete mode 100644 zanata.xml diff --git a/make-rhat-patches.sh b/make-rhat-patches.sh deleted file mode 100755 index 4721f6e..0000000 --- a/make-rhat-patches.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash - -POLICYCOREUTILS_VERSION=2.4 -SEPOLGEN_VERSION=1.2.2 -BRANCH=master - -REBASEDIR=`mktemp -d rebase.XXXXXX` -pushd $REBASEDIR - -git clone git@github.com:fedora-selinux/selinux.git -pushd selinux; git checkout $BRANCH; COMMIT=`git rev-parse --verify HEAD`; popd - -# prepare policycoreutils-rhat.patch -tar xfz ../policycoreutils-$POLICYCOREUTILS_VERSION.tar.gz -pushd policycoreutils-$POLICYCOREUTILS_VERSION - -git init; git add .; git commit -m "init" -cp -r ../selinux/policycoreutils/* . -git add -A . - -git diff --cached --src-prefix=a/policycoreutils-$POLICYCOREUTILS_VERSION/ --dst-prefix=b/policycoreutils-$POLICYCOREUTILS_VERSION/ > ../../policycoreutils-rhat.patch - -popd - -#prepare sepolgen-rhat.patch -tar xfz ../sepolgen-$SEPOLGEN_VERSION.tar.gz -pushd sepolgen-$SEPOLGEN_VERSION - -git init; git add .; git commit -m "init" -cp -r ../selinux/sepolgen/* . -git add -A . - -git diff --cached --src-prefix=a/sepolgen-$SEPOLGEN_VERSION/ --dst-prefix=b/sepolgen-$SEPOLGEN_VERSION/ > ../../sepolgen-rhat.patch - -popd - -popd -# echo rm -rf $REBASEDIR - -echo policycoreutils-rhat.patch and sepolgen-rhat.patch created from https://github.com/fedora-selinux/selinux/commit/$COMMIT diff --git a/zanata.xml b/zanata.xml deleted file mode 100644 index 1bee19b..0000000 --- a/zanata.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - https://fedora.zanata.org/ - selinux - master - gettext - - From f63d7fa68f611bcff7d3d75d48073f09471fff35 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 16 Nov 2022 11:19:08 +0100 Subject: [PATCH 16/79] Drop obsolete information from README.translation --- README.translations | 42 +----------------------------------------- 1 file changed, 1 insertion(+), 41 deletions(-) diff --git a/README.translations b/README.translations index 34c7750..813fe15 100644 --- a/README.translations +++ b/README.translations @@ -1,41 +1 @@ -policycoreutils translations currently live in the following locations: - -- https://fedora.zanata.org/project/view/selinux - - contains translations for both stable (Red Hat Enterprise Linux) and master (Fedora) branches - - maintains large number of languages (several of which do not actually contain any translated strings) - - updated by community and partially by RH localization effort - -- selinux source repository (https://github.com/fedora-selinux/selinux) - - is kept up-to-date with fedora.zanata - -How to update source files on fedora.zanata: - $ git clone git@github.com:fedora-selinux/selinux.git - $ cd selinux - - # generate new potfile - $ for p in policycoreutils python gui sandbox; do - cd $p/po - make $p.pot - cd - - done - - # Push potfiles to zanata - $ zanata-cli push --push-type source - -How to pull new translations from zanata - $ git clone git@github.com:fedora-selinux/selinux.git - $ cd selinux - # Make sure "zanata.xml" file pointing to corresponding translations branch is present - # Optionally update source files on zanata - # Pull new translations from zanata - $ zanata-cli -e pull --pull-type trans - -How to update translations *-po.tgz files - $ mkdir zanata - $ cd zanata - $ zanata-cli -e pull --project-config ../zanata.xml --pull-type both - $ for p in policycoreutils python gui sandbox; do - cd $p - tar -c -f ../../$p-po.tgz -z . - cd - - done +See https://src.fedoraproject.org/rpms/setroubleshoot/blob/rawhide/f/README.translations From 577b79db7e7fdb69f07cd87189805a246f008a76 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 21 Nov 2022 16:06:48 +0100 Subject: [PATCH 17/79] policycoreutils-3.4-7 - Rebase on upstream f56a72ac9e86 - sepolicy: fix sepolicy manpage -w - sandbox: add -R option to alternate XDG_RUNTIME_DIR - Remove dependency on the Python module distutils --- ...re-return-value-of-context_str-3-con.patch | 36 +++ ...RD_FILE_CONTEXT-section-in-man-pages.patch | 47 ---- ...module-avoid-toctou-on-output-module.patch | 49 ++++ ...xecutable-we-don-t-want-to-print-a-p.patch | 28 -- ...emanage-import-into-two-transactions.patch | 10 +- ...dit2allow-close-file-stream-on-error.patch | 50 ++++ ...e-the-trailing-newline-for-etc-syste.patch | 27 -- ...andle-unsupported-languages-properly.patch | 12 +- ...-in-manpage.py-to-not-contain-online.patch | 26 -- ...rebuild-if-modules-changed-to-refres.patch | 6 +- ...thon-remove-IOError-in-certain-cases.patch | 57 ++++ ...strict-function-prototype-for-defini.patch | 39 +++ ...-egg-info-directories-and-clean-them.patch | 56 ++++ ...ocs-provide-a-top-level-LICENSE-file.patch | 68 +++++ ...d-interface-file_type_is_executable-.patch | 64 ----- 0012-gui-Fix-export-file-chooser-dialog.patch | 38 +++ ...ery-the-local-database-if-the-fconte.patch | 66 +++++ ...-try-to-remove-tmpdir-twice-if-uid-0.patch | 35 +++ ...porary-directory-for-XDG_RUNTIME_DIR.patch | 245 ++++++++++++++++++ ...pendency-on-the-Python-module-distut.patch | 81 ++++++ ...n-Harden-tools-against-rogue-modules.patch | 81 ++++++ ...t-to-Xephyr-as-it-works-better-with-.patch | 4 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 8 +- ...hbox-window-manager-instead-of-openb.patch | 14 +- ...h => 0022-Use-SHA-2-instead-of-SHA-1.patch | 12 +- ...on-Fix-typo-in-audit2allow.1-example.patch | 28 ++ ...thon-sepolicy-Fix-sepolicy-manpage-w.patch | 102 ++++++++ ...-Use-distro-module-to-get-os-version.patch | 57 ++++ ...icy-Simplify-generation-of-man-pages.patch | 97 +++---- ...275-missing-whitespace-after-keyword.patch | 160 ++++++++++++ policycoreutils.spec | 61 +++-- 32 files changed, 1353 insertions(+), 315 deletions(-) create mode 100644 0001-libselinux-declare-return-value-of-context_str-3-con.patch delete mode 100644 0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch create mode 100644 0002-semodule-avoid-toctou-on-output-module.patch delete mode 100644 0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch rename 0014-python-Split-semanage-import-into-two-transactions.patch => 0003-python-Split-semanage-import-into-two-transactions.patch (89%) create mode 100644 0004-python-audit2allow-close-file-stream-on-error.patch delete mode 100644 0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch rename 0012-gettext-handle-unsupported-languages-properly.patch => 0005-gettext-handle-unsupported-languages-properly.patch (98%) delete mode 100644 0006-Fix-title-in-manpage.py-to-not-contain-online.patch rename 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch => 0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch (97%) create mode 100644 0007-python-remove-IOError-in-certain-cases.patch create mode 100644 0008-restorecond-use-strict-function-prototype-for-defini.patch create mode 100644 0009-Ignore-egg-info-directories-and-clean-them.patch create mode 100644 0011-docs-provide-a-top-level-LICENSE-file.patch delete mode 100644 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch create mode 100644 0012-gui-Fix-export-file-chooser-dialog.patch create mode 100644 0013-python-Do-not-query-the-local-database-if-the-fconte.patch create mode 100644 0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch create mode 100644 0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch create mode 100644 0016-python-Remove-dependency-on-the-Python-module-distut.patch create mode 100644 0017-python-Harden-tools-against-rogue-modules.patch rename 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch => 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch (92%) rename 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch => 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch (89%) rename 0008-sepolicy-generate-Handle-more-reserved-port-types.patch => 0020-sepolicy-generate-Handle-more-reserved-port-types.patch (94%) rename 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch => 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch (88%) rename 0010-Use-SHA-2-instead-of-SHA-1.patch => 0022-Use-SHA-2-instead-of-SHA-1.patch (98%) create mode 100644 0023-python-Fix-typo-in-audit2allow.1-example.patch create mode 100644 0024-python-sepolicy-Fix-sepolicy-manpage-w.patch create mode 100644 0025-python-sepolicy-Use-distro-module-to-get-os-version.patch rename 0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch => 0026-python-sepolicy-Simplify-generation-of-man-pages.patch (56%) create mode 100644 0027-Fix-E275-missing-whitespace-after-keyword.patch diff --git a/0001-libselinux-declare-return-value-of-context_str-3-con.patch b/0001-libselinux-declare-return-value-of-context_str-3-con.patch new file mode 100644 index 0000000..bcd29f7 --- /dev/null +++ b/0001-libselinux-declare-return-value-of-context_str-3-con.patch @@ -0,0 +1,36 @@ +From dd98fa322766760c4e1f029cf19d2515a583304f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Fri, 20 May 2022 15:16:10 +0200 +Subject: [PATCH] libselinux: declare return value of context_str(3) const +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-type: text/plain + +context_str(3) returns a string representation of the given context. +This string is owned by the context and free'd on context_free(3). +Declare it const, as already done in the man page, since it must not be +free'd by the caller. + +Signed-off-by: Christian Göttsche +Acked-by: Nicolas Iooss +--- + policycoreutils/newrole/newrole.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c +index ae37d7253761..c2afa37e0ac3 100644 +--- a/policycoreutils/newrole/newrole.c ++++ b/policycoreutils/newrole/newrole.c +@@ -842,7 +842,7 @@ static int parse_command_line_arguments(int argc, char **argv, char *ttyn, + char *type_ptr = NULL; /* stores malloc'd data from get_default_type */ + char *level_s = NULL; /* level spec'd by user in argv[] */ + char *range_ptr = NULL; +- char *new_con = NULL; ++ const char *new_con = NULL; + char *tty_con = NULL; + context_t context = NULL; /* manipulatable form of new_context */ + const struct option long_options[] = { +-- +2.38.1 + diff --git a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch b/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch deleted file mode 100644 index 998345e..0000000 --- a/0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 71a2f14767c0ec70c23ecce43d7cbc5404c95552 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Mon, 21 Apr 2014 13:54:40 -0400 -Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages -Content-type: text/plain - -Signed-off-by: Miroslav Grepl ---- - python/sepolicy/sepolicy/manpage.py | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 3e61e333193f..82338aeeef32 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -737,10 +737,13 @@ Default Defined Ports:""") - - def _file_context(self): - flist = [] -+ flist_non_exec = [] - mpaths = [] - for f in self.all_file_types: - if f.startswith(self.domainname): - flist.append(f) -+ if not file_type_is_executable(f) or not file_type_is_entrypoint(f): -+ flist_non_exec.append(f) - if f in self.fcdict: - mpaths = mpaths + self.fcdict[f]["regex"] - if len(mpaths) == 0: -@@ -799,12 +802,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d - SELinux defines the file context types for the %(domainname)s, if you wanted to - store files with these types in a diffent paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. - --.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?' -+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?' - .br - .B restorecon -R -v /srv/my%(domainname)s_content - - Note: SELinux often uses regular expressions to specify labels that match multiple files. --""" % {'domainname': self.domainname, "type": flist[0]}) -+""" % {'domainname': self.domainname, "type": flist_non_exec[-1]}) - - self.fd.write(r""" - .I The following file types are defined for %(domainname)s: --- -2.35.1 - diff --git a/0002-semodule-avoid-toctou-on-output-module.patch b/0002-semodule-avoid-toctou-on-output-module.patch new file mode 100644 index 0000000..6518d4a --- /dev/null +++ b/0002-semodule-avoid-toctou-on-output-module.patch @@ -0,0 +1,49 @@ +From 6d02b2fa29954e239721907e1fce238f25ea4f2f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Fri, 20 May 2022 15:19:52 +0200 +Subject: [PATCH] semodule: avoid toctou on output module +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-type: text/plain + +Do not check for file existence and open afterwards, open with the +exclusive flag (supported in Glibc and musl 0.9.6 and also standardized +in C11). + +Found by GitHub CodeQL. + +Signed-off-by: Christian Göttsche +Acked-by: Nicolas Iooss +--- + policycoreutils/semodule/semodule.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c +index 1ed8e69054e0..48bc28dd0973 100644 +--- a/policycoreutils/semodule/semodule.c ++++ b/policycoreutils/semodule/semodule.c +@@ -550,15 +550,12 @@ int main(int argc, char *argv[]) + goto cleanup_extract; + } + +- if (access(output_path, F_OK) == 0) { +- fprintf(stderr, "%s: %s is already extracted with extension %s.\n", argv[0], mode_arg, lang_ext); +- result = -1; +- goto cleanup_extract; +- } +- +- output_fd = fopen(output_path, "w"); ++ output_fd = fopen(output_path, "wx"); + if (output_fd == NULL) { +- fprintf(stderr, "%s: Unable to open %s\n", argv[0], output_path); ++ if (errno == EEXIST) ++ fprintf(stderr, "%s: %s is already extracted with extension %s.\n", argv[0], mode_arg, lang_ext); ++ else ++ fprintf(stderr, "%s: Unable to open %s: %s\n", argv[0], output_path, strerror(errno)); + result = -1; + goto cleanup_extract; + } +-- +2.38.1 + diff --git a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch b/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch deleted file mode 100644 index aca9199..0000000 --- a/0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch +++ /dev/null @@ -1,28 +0,0 @@ -From d55a06c002641dce1301b9b5639bd8e206460724 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Mon, 12 May 2014 14:11:22 +0200 -Subject: [PATCH] If there is no executable we don't want to print a part of - STANDARD FILE CONTEXT -Content-type: text/plain - ---- - python/sepolicy/sepolicy/manpage.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 82338aeeef32..ec8aa1cb94a2 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -795,7 +795,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d - .PP - """ % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]}) - -- self.fd.write(r""" -+ if flist_non_exec: -+ self.fd.write(r""" - .PP - .B STANDARD FILE CONTEXT - --- -2.35.1 - diff --git a/0014-python-Split-semanage-import-into-two-transactions.patch b/0003-python-Split-semanage-import-into-two-transactions.patch similarity index 89% rename from 0014-python-Split-semanage-import-into-two-transactions.patch rename to 0003-python-Split-semanage-import-into-two-transactions.patch index 2cb27e6..8506690 100644 --- a/0014-python-Split-semanage-import-into-two-transactions.patch +++ b/0003-python-Split-semanage-import-into-two-transactions.patch @@ -1,4 +1,4 @@ -From 4a53c0c3ee0edba37ba8e62064175c4928f761a8 Mon Sep 17 00:00:00 2001 +From abaf812c3877f6b595eb8643582eacef2dd4df3f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 30 May 2022 14:20:21 +0200 Subject: [PATCH] python: Split "semanage import" into two transactions @@ -18,10 +18,10 @@ Signed-off-by: Vit Mojzis 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/python/semanage/semanage b/python/semanage/semanage -index f45061a601f9..4e8d64d6863a 100644 +index 8f4e44a7a9cd..1d8281281d05 100644 --- a/python/semanage/semanage +++ b/python/semanage/semanage -@@ -853,10 +853,29 @@ def handleImport(args): +@@ -852,10 +852,29 @@ def handleImport(args): trans = seobject.semanageRecords(args) trans.start() @@ -51,7 +51,7 @@ index f45061a601f9..4e8d64d6863a 100644 try: commandParser = createCommandParser() args = commandParser.parse_args(mkargv(l)) -@@ -870,8 +889,6 @@ def handleImport(args): +@@ -869,8 +888,6 @@ def handleImport(args): except KeyboardInterrupt: sys.exit(0) @@ -61,5 +61,5 @@ index f45061a601f9..4e8d64d6863a 100644 def setupImportParser(subparsers): importParser = subparsers.add_parser('import', help=_('Import local customizations')) -- -2.36.1 +2.38.1 diff --git a/0004-python-audit2allow-close-file-stream-on-error.patch b/0004-python-audit2allow-close-file-stream-on-error.patch new file mode 100644 index 0000000..1995aec --- /dev/null +++ b/0004-python-audit2allow-close-file-stream-on-error.patch @@ -0,0 +1,50 @@ +From c14a86af9a2304175e54897634f808b42345325b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Fri, 20 May 2022 14:51:07 +0200 +Subject: [PATCH] python/audit2allow: close file stream on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-type: text/plain + + sepolgen-ifgen-attr-helper.c: In function ‘load_policy’: + sepolgen-ifgen-attr-helper.c:196:17: warning: leak of FILE ‘fp’ [CWE-775] [-Wanalyzer-file-leak] + 196 | fprintf(stderr, "Out of memory!\n"); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Christian Göttsche +Acked-by: James Carter +--- + python/audit2allow/sepolgen-ifgen-attr-helper.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/python/audit2allow/sepolgen-ifgen-attr-helper.c b/python/audit2allow/sepolgen-ifgen-attr-helper.c +index 6f3ba96260de..5e6cffc1887d 100644 +--- a/python/audit2allow/sepolgen-ifgen-attr-helper.c ++++ b/python/audit2allow/sepolgen-ifgen-attr-helper.c +@@ -194,12 +194,14 @@ static policydb_t *load_policy(const char *filename) + policydb = malloc(sizeof(policydb_t)); + if (policydb == NULL) { + fprintf(stderr, "Out of memory!\n"); ++ fclose(fp); + return NULL; + } + + if (policydb_init(policydb)) { + fprintf(stderr, "Out of memory!\n"); + free(policydb); ++ fclose(fp); + return NULL; + } + +@@ -208,6 +210,7 @@ static policydb_t *load_policy(const char *filename) + fprintf(stderr, + "error(s) encountered while parsing configuration\n"); + free(policydb); ++ fclose(fp); + return NULL; + } + +-- +2.38.1 + diff --git a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch b/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch deleted file mode 100644 index 948881f..0000000 --- a/0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 1747f59fece8183772e5591ce5b5feb5f421f602 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 20 Feb 2015 16:42:01 +0100 -Subject: [PATCH] We want to remove the trailing newline for - /etc/system_release. -Content-type: text/plain - ---- - python/sepolicy/sepolicy/__init__.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 9447812b7450..aa8beda313c8 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -1228,7 +1228,7 @@ def get_os_version(): - system_release = "" - try: - with open('/etc/system-release') as f: -- system_release = f.readline() -+ system_release = f.readline().rstrip() - except IOError: - system_release = "Misc" - --- -2.35.1 - diff --git a/0012-gettext-handle-unsupported-languages-properly.patch b/0005-gettext-handle-unsupported-languages-properly.patch similarity index 98% rename from 0012-gettext-handle-unsupported-languages-properly.patch rename to 0005-gettext-handle-unsupported-languages-properly.patch index 8c72c26..c0d405a 100644 --- a/0012-gettext-handle-unsupported-languages-properly.patch +++ b/0005-gettext-handle-unsupported-languages-properly.patch @@ -1,4 +1,4 @@ -From ff2aba6d202f49749cbb19a84bf0e1cdae54c5e9 Mon Sep 17 00:00:00 2001 +From 344463076b2a91e1d2c7f5cc3835dc1a53a05e88 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 24 Jun 2022 16:24:25 +0200 Subject: [PATCH] gettext: handle unsupported languages properly @@ -218,7 +218,7 @@ index e779fcc6ebd7..952cb8187599 100755 import builtins builtins.__dict__['_'] = str diff --git a/python/semanage/semanage b/python/semanage/semanage -index 8f4e44a7a9cd..f45061a601f9 100644 +index 1d8281281d05..4e8d64d6863a 100644 --- a/python/semanage/semanage +++ b/python/semanage/semanage @@ -38,7 +38,8 @@ try: @@ -275,7 +275,7 @@ index 7ebe0efa88a1..c7a70e094b0c 100755 except: try: diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 95520f9bc35d..6bde1971fd7c 100644 +index 7208234b4a4a..9c3caa05b80b 100644 --- a/python/sepolicy/sepolicy/__init__.py +++ b/python/sepolicy/sepolicy/__init__.py @@ -31,7 +31,8 @@ try: @@ -289,7 +289,7 @@ index 95520f9bc35d..6bde1971fd7c 100644 except: try: diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 3e8b9f9c291d..eff3a8973917 100644 +index 67189fc36b99..3717d5d4ed78 100644 --- a/python/sepolicy/sepolicy/generate.py +++ b/python/sepolicy/sepolicy/generate.py @@ -56,7 +56,8 @@ try: @@ -331,7 +331,7 @@ index 599f97fdc6e7..43f86443f2c8 100644 except: try: diff --git a/sandbox/sandbox b/sandbox/sandbox -index 3ef444a12561..53cc504149c9 100644 +index cd5709fb07df..789621e136da 100644 --- a/sandbox/sandbox +++ b/sandbox/sandbox @@ -45,7 +45,8 @@ try: @@ -345,5 +345,5 @@ index 3ef444a12561..53cc504149c9 100644 except: try: -- -2.36.1 +2.38.1 diff --git a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch b/0006-Fix-title-in-manpage.py-to-not-contain-online.patch deleted file mode 100644 index 9b31464..0000000 --- a/0006-Fix-title-in-manpage.py-to-not-contain-online.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 0bd28bc715034c644405d3c03f160d69ae710500 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 20 Feb 2015 16:42:53 +0100 -Subject: [PATCH] Fix title in manpage.py to not contain 'online'. -Content-type: text/plain - ---- - python/sepolicy/sepolicy/manpage.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index c632d05dbb1b..3ae2f42b2fdf 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -222,7 +222,7 @@ class HTMLManPages: - - - -- SELinux man pages online -+ SELinux man pages - - -

SELinux man pages for %s

--- -2.35.1 - diff --git a/0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch b/0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch similarity index 97% rename from 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch rename to 0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch index abb3572..9dbbe35 100644 --- a/0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch +++ b/0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch @@ -1,4 +1,4 @@ -From afafe02fa9b6b7fdcce883c5e873d46b9d811d66 Mon Sep 17 00:00:00 2001 +From 8cc529af51e8aa68a167ce78cf92687604f98619 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 8 Jun 2022 19:09:54 +0200 Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh @@ -40,7 +40,7 @@ index d1735d216276..c56e580f27b8 100644 .B \-D, \-\-disable_dontaudit Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index 1ed8e69054e0..ec0794866daa 100644 +index 48bc28dd0973..ebe062bf4c6c 100644 --- a/policycoreutils/semodule/semodule.c +++ b/policycoreutils/semodule/semodule.c @@ -150,9 +150,12 @@ static void usage(char *progname) @@ -78,5 +78,5 @@ index 1ed8e69054e0..ec0794866daa 100644 break; default: -- -2.36.1 +2.38.1 diff --git a/0007-python-remove-IOError-in-certain-cases.patch b/0007-python-remove-IOError-in-certain-cases.patch new file mode 100644 index 0000000..039293c --- /dev/null +++ b/0007-python-remove-IOError-in-certain-cases.patch @@ -0,0 +1,57 @@ +From ebb4a170c024d4bf0d2773b93d916e77a87393d9 Mon Sep 17 00:00:00 2001 +From: Elijah Conners +Date: Wed, 15 Jun 2022 22:13:31 -0700 +Subject: [PATCH] python: remove IOError in certain cases +Content-type: text/plain + +In certain cases, IOError caused the much more general exception OSError +to be unreachable. + +Signed-off-by: Elijah Conners +Acked-by: Petr Lautrbach +--- + python/semanage/semanage | 7 ++----- + sandbox/sandbox | 2 -- + 2 files changed, 2 insertions(+), 7 deletions(-) + +diff --git a/python/semanage/semanage b/python/semanage/semanage +index 4e8d64d6863a..10ab3fa67d7f 100644 +--- a/python/semanage/semanage ++++ b/python/semanage/semanage +@@ -971,8 +971,8 @@ def do_parser(): + devnull = os.open(os.devnull, os.O_WRONLY) + os.dup2(devnull, sys.stdout.fileno()) + sys.exit(1) +- except IOError as e: +- sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e))) ++ except OSError as e: ++ sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[1])) + sys.exit(1) + except KeyboardInterrupt: + sys.exit(0) +@@ -982,9 +982,6 @@ def do_parser(): + except KeyError as e: + sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[0])) + sys.exit(1) +- except OSError as e: +- sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[1])) +- sys.exit(1) + except RuntimeError as e: + sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[0])) + sys.exit(1) +diff --git a/sandbox/sandbox b/sandbox/sandbox +index 789621e136da..ffac70232875 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -534,8 +534,6 @@ if __name__ == '__main__': + error_exit(error.args[0]) + except KeyError as error: + error_exit(_("Invalid value %s") % error.args[0]) +- except IOError as error: +- error_exit(error) + except KeyboardInterrupt: + rc = 0 + +-- +2.38.1 + diff --git a/0008-restorecond-use-strict-function-prototype-for-defini.patch b/0008-restorecond-use-strict-function-prototype-for-defini.patch new file mode 100644 index 0000000..29a6ea7 --- /dev/null +++ b/0008-restorecond-use-strict-function-prototype-for-defini.patch @@ -0,0 +1,39 @@ +From b5b3afbaed29895d37f6160cc0847ef5de7538ed Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Mon, 8 Aug 2022 19:36:20 +0200 +Subject: [PATCH] restorecond: use strict function prototype for definition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-type: text/plain + +Clang 15 starts to complain about non strict function definitions: + + user.c:172:10: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] + int start() { + ^ + void + +Signed-off-by: Christian Göttsche +Reviewed-by: Daniel Burgener +Acked-by: James Carter +--- + restorecond/user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/restorecond/user.c b/restorecond/user.c +index 47b86823ff79..3ae3ebbb7230 100644 +--- a/restorecond/user.c ++++ b/restorecond/user.c +@@ -169,7 +169,7 @@ io_channel_callback + return TRUE; + } + +-int start() { ++int start(void) { + #ifdef HAVE_DBUS + GDBusConnection *bus; + GError *err = NULL; +-- +2.38.1 + diff --git a/0009-Ignore-egg-info-directories-and-clean-them.patch b/0009-Ignore-egg-info-directories-and-clean-them.patch new file mode 100644 index 0000000..80f7b39 --- /dev/null +++ b/0009-Ignore-egg-info-directories-and-clean-them.patch @@ -0,0 +1,56 @@ +From c2d58b378b3cf350d042a7b657e2b7f5861c5f26 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Mon, 8 Aug 2022 19:36:55 +0200 +Subject: [PATCH] Ignore egg-info directories and clean them +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-type: text/plain + + Test .gitignore and make clean distclean + error: missing .gitignore entry for libselinux/src/selinux.egg-info/ + error: missing .gitignore entry for python/sepolicy/sepolicy.egg-info/ + Error: Process completed with exit code 1. + + error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/PKG-INFO + error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/SOURCES.txt + error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/dependency_links.txt + error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/top_level.txt + error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/PKG-INFO + error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/SOURCES.txt + error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/dependency_links.txt + error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/top_level.txt + Error: Process completed with exit code 1. + +Signed-off-by: Christian Göttsche +Acked-by: James Carter +--- + python/sepolicy/.gitignore | 1 + + python/sepolicy/Makefile | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/python/sepolicy/.gitignore b/python/sepolicy/.gitignore +index 3186c860ec0d..32fb47f92a9d 100644 +--- a/python/sepolicy/.gitignore ++++ b/python/sepolicy/.gitignore +@@ -1,3 +1,4 @@ + build + tmp + *.bak ++sepolicy.egg-info/ +diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile +index 3361be4ef0bc..d983e409e5e6 100644 +--- a/python/sepolicy/Makefile ++++ b/python/sepolicy/Makefile +@@ -18,7 +18,7 @@ python-build: + + clean: + $(PYTHON) setup.py clean +- -rm -rf build *~ \#* *pyc .#* ++ -rm -rf build *~ \#* *pyc .#* sepolicy.egg-info/ + + sepolgen: + ln -sf sepolicy sepolgen +-- +2.38.1 + diff --git a/0011-docs-provide-a-top-level-LICENSE-file.patch b/0011-docs-provide-a-top-level-LICENSE-file.patch new file mode 100644 index 0000000..4234674 --- /dev/null +++ b/0011-docs-provide-a-top-level-LICENSE-file.patch @@ -0,0 +1,68 @@ +From a0a216ff7d86004ddc36d516377f0a6ffe88076c Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Fri, 30 Sep 2022 17:44:12 -0400 +Subject: [PATCH] docs: provide a top level LICENSE file +Content-type: text/plain + +Provide a top level LICENSE file explaining how multiple the SELinux +userspace is released under multiple different licenses. Also ensure +that all the different license files share a consistent file name, +LICENSE, to make it easier for people to identify the license files. + +This is to help meet the OpenSSF Best Practices requirements. + +Signed-off-by: Paul Moore +--- + dbus/{COPYING => LICENSE} | 0 + gui/{COPYING => LICENSE} | 0 + policycoreutils/{COPYING => LICENSE} | 0 + python/{COPYING => LICENSE} | 0 + python/sepolgen/{COPYING => LICENSE} | 0 + restorecond/{COPYING => LICENSE} | 0 + sandbox/{COPYING => LICENSE} | 0 + semodule-utils/{COPYING => LICENSE} | 0 + 8 files changed, 0 insertions(+), 0 deletions(-) + rename dbus/{COPYING => LICENSE} (100%) + rename gui/{COPYING => LICENSE} (100%) + rename policycoreutils/{COPYING => LICENSE} (100%) + rename python/{COPYING => LICENSE} (100%) + rename python/sepolgen/{COPYING => LICENSE} (100%) + rename restorecond/{COPYING => LICENSE} (100%) + rename sandbox/{COPYING => LICENSE} (100%) + rename semodule-utils/{COPYING => LICENSE} (100%) + +diff --git a/dbus/COPYING b/dbus/LICENSE +similarity index 100% +rename from dbus/COPYING +rename to dbus/LICENSE +diff --git a/gui/COPYING b/gui/LICENSE +similarity index 100% +rename from gui/COPYING +rename to gui/LICENSE +diff --git a/policycoreutils/COPYING b/policycoreutils/LICENSE +similarity index 100% +rename from policycoreutils/COPYING +rename to policycoreutils/LICENSE +diff --git a/python/COPYING b/python/LICENSE +similarity index 100% +rename from python/COPYING +rename to python/LICENSE +diff --git a/python/sepolgen/COPYING b/python/sepolgen/LICENSE +similarity index 100% +rename from python/sepolgen/COPYING +rename to python/sepolgen/LICENSE +diff --git a/restorecond/COPYING b/restorecond/LICENSE +similarity index 100% +rename from restorecond/COPYING +rename to restorecond/LICENSE +diff --git a/sandbox/COPYING b/sandbox/LICENSE +similarity index 100% +rename from sandbox/COPYING +rename to sandbox/LICENSE +diff --git a/semodule-utils/COPYING b/semodule-utils/LICENSE +similarity index 100% +rename from semodule-utils/COPYING +rename to semodule-utils/LICENSE +-- +2.38.1 + diff --git a/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch b/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch deleted file mode 100644 index c4e1fe1..0000000 --- a/0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 3748b7eab7434698998edfcf613fe738cf19d5c9 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 27 Feb 2017 17:12:39 +0100 -Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and - file_type_is_entrypoint(f) -Content-type: text/plain - -- use direct queries -- load exec_types and entry_types only once ---- - python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++-- - 1 file changed, 20 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 3ae2f42b2fdf..5a434bd360ae 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -127,8 +127,24 @@ def gen_domains(): - domains.sort() - return domains - --types = None - -+exec_types = None -+ -+def _gen_exec_types(): -+ global exec_types -+ if exec_types is None: -+ exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"] -+ return exec_types -+ -+entry_types = None -+ -+def _gen_entry_types(): -+ global entry_types -+ if entry_types is None: -+ entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"] -+ return entry_types -+ -+types = None - - def _gen_types(): - global types -@@ -374,6 +390,8 @@ class ManPage: - self.all_file_types = sepolicy.get_all_file_types() - self.role_allows = sepolicy.get_all_role_allows() - self.types = _gen_types() -+ self.exec_types = _gen_exec_types() -+ self.entry_types = _gen_entry_types() - - if self.source_files: - self.fcpath = self.root + "file_contexts" -@@ -691,7 +709,7 @@ Default Defined Ports:""") - for f in self.all_file_types: - if f.startswith(self.domainname): - flist.append(f) -- if not file_type_is_executable(f) or not file_type_is_entrypoint(f): -+ if f not in self.exec_types or f not in self.entry_types: - flist_non_exec.append(f) - if f in self.fcdict: - mpaths = mpaths + self.fcdict[f]["regex"] --- -2.35.1 - diff --git a/0012-gui-Fix-export-file-chooser-dialog.patch b/0012-gui-Fix-export-file-chooser-dialog.patch new file mode 100644 index 0000000..4fde689 --- /dev/null +++ b/0012-gui-Fix-export-file-chooser-dialog.patch @@ -0,0 +1,38 @@ +From bba6225abc6c7d8f1642d0c04c819ddc74d426c0 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 11 Oct 2022 16:36:23 +0200 +Subject: [PATCH] gui: Fix export file chooser dialog +Content-type: text/plain + +It wasn't possible to choose a directory in filechooser dialog using +double-click - the dialog returned the directory name instead of +listing the directory. + +Fixes: +Traceback (most recent call last): + File "/usr/lib/python3.10/site-packages/sepolicy/gui.py", line 2593, in on_browse_select + self.export_config(filename) + File "/usr/lib/python3.10/site-packages/sepolicy/gui.py", line 2668, in export_config + fd = open(filename, 'w') +IsADirectoryError: [Errno 21] Is a directory: '/root/Downloads' + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/sepolicy.glade | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/python/sepolicy/sepolicy/sepolicy.glade b/python/sepolicy/sepolicy/sepolicy.glade +index 52407887fcfc..0724d6c8caa4 100644 +--- a/python/sepolicy/sepolicy/sepolicy.glade ++++ b/python/sepolicy/sepolicy/sepolicy.glade +@@ -168,7 +168,6 @@ + + False + vertical +- + + + False +-- +2.38.1 + diff --git a/0013-python-Do-not-query-the-local-database-if-the-fconte.patch b/0013-python-Do-not-query-the-local-database-if-the-fconte.patch new file mode 100644 index 0000000..2f557b0 --- /dev/null +++ b/0013-python-Do-not-query-the-local-database-if-the-fconte.patch @@ -0,0 +1,66 @@ +From 7238ad32a3171d82bba9b99660e55399161236fc Mon Sep 17 00:00:00 2001 +From: James Carter +Date: Wed, 19 Oct 2022 14:20:11 -0400 +Subject: [PATCH] python: Do not query the local database if the fcontext is + non-local +Content-type: text/plain + +Vit Mojzis reports that an error message is produced when modifying +a non-local fcontext. + +He gives the following example: + # semanage fcontext -f f -m -t passwd_file_t /etc/security/opasswd + libsemanage.dbase_llist_query: could not query record value (No such file or directory). + +When modifying an fcontext, the non-local database is checked for the +key and then, if it is not found there, the local database is checked. +If the key doesn't exist, then an error is raised. If the key exists +then the local database is queried first and, if that fails, the non- +local database is queried. + +The error is from querying the local database when the fcontext is in +the non-local database. + +Instead, if the fcontext is in the non-local database, just query +the non-local database. Only query the local database if the +fcontext was found in it. + +Reported-by: Vit Mojzis +Signed-off-by: James Carter +--- + python/semanage/seobject.py | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index 0782c082dc0c..d82da4942987 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -2504,16 +2504,19 @@ class fcontextRecords(semanageRecords): + (rc, exists) = semanage_fcontext_exists(self.sh, k) + if rc < 0: + raise ValueError(_("Could not check if file context for %s is defined") % target) +- if not exists: ++ if exists: ++ try: ++ (rc, fcontext) = semanage_fcontext_query(self.sh, k) ++ except OSError: ++ raise ValueError(_("Could not query file context for %s") % target) ++ else: + (rc, exists) = semanage_fcontext_exists_local(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not check if file context for %s is defined") % target) + if not exists: + raise ValueError(_("File context for %s is not defined") % target) +- +- try: +- (rc, fcontext) = semanage_fcontext_query_local(self.sh, k) +- except OSError: + try: +- (rc, fcontext) = semanage_fcontext_query(self.sh, k) ++ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k) + except OSError: + raise ValueError(_("Could not query file context for %s") % target) + +-- +2.38.1 + diff --git a/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch b/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch new file mode 100644 index 0000000..6b4830a --- /dev/null +++ b/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch @@ -0,0 +1,35 @@ +From 0fb988c86b66ede7723e179699e29f00000fc57b Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 13 Oct 2022 15:23:11 +0200 +Subject: [PATCH] sandbox: Do not try to remove tmpdir twice if uid == 0 +Content-type: text/plain + +If the user is root, tmpdir is already wiped out. + +Fixes: + # sandbox -T /root/tmp -- id + uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:sandbox_t:s0:c696,c756 + Failed to remove directory /tmp/.sandbox-root-KIlB59: No such file or directory + +Signed-off-by: Petr Lautrbach +Acked-by: James Carter +--- + sandbox/seunshare.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index 8917a0f9bd42..dd1d7ddbdc89 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -414,7 +414,7 @@ static int cleanup_tmpdir(const char *tmpdir, const char *src, + rc++; + } + +- if (rmdir(tmpdir) == -1) ++ if (pwd->pw_uid != 0 && rmdir(tmpdir) == -1) + fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno)); + if ((uid_t)setfsuid(pwd->pw_uid) != 0) { + fprintf(stderr, _("unable to switch back to user after clearing tmp dir\n")); +-- +2.38.1 + diff --git a/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch b/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch new file mode 100644 index 0000000..ada2342 --- /dev/null +++ b/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch @@ -0,0 +1,245 @@ +From ecfcb1d6a8ecb914f2a7c72453c872b5f0099f4d Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 13 Oct 2022 15:23:12 +0200 +Subject: [PATCH] sandbox: Use temporary directory for XDG_RUNTIME_DIR +Content-type: text/plain + +XDG_RUNTIME_DIR (/run/user/$UID) is used for user-specific data files +such as sockets, named pipes and so on. Therefore, it should not be +available to sandboxed processes. + +Usage: + # ls -a $XDG_RUNTIME_DIR + . .. bus pipewire-0 systemd + # sandbox -R /root/sandbox/user -- sh -c "ls -a $XDG_RUNTIME_DIR" + . .. + +Signed-off-by: Petr Lautrbach +Acked-by: James Carter +--- + sandbox/sandbox | 15 ++++++++++++++- + sandbox/sandbox.8 | 7 +++++-- + sandbox/seunshare.8 | 3 +++ + sandbox/seunshare.c | 45 +++++++++++++++++++++++++++++++++++---------- + 4 files changed, 57 insertions(+), 13 deletions(-) + +diff --git a/sandbox/sandbox b/sandbox/sandbox +index ffac70232875..770807345858 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -209,6 +209,7 @@ class Sandbox: + self.__level = None + self.__homedir = None + self.__tmpdir = None ++ self.__runuserdir = None + + def __validate_mount(self): + if self.__options.level: +@@ -357,6 +358,11 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + action="callback", callback=self.__validdir, + help=_("alternate /tmp directory to use for mounting")) + ++ parser.add_option("-R", "--runuserdir", dest="runuserdir", ++ type="string", ++ action="callback", callback=self.__validdir, ++ help=_("alternate XDG_RUNTIME_DIR - /run/user/$UID - directory to use for mounting")) ++ + parser.add_option("-w", "--windowsize", dest="windowsize", + type="string", default=DEFAULT_WINDOWSIZE, + help="size of the sandbox window") +@@ -401,10 +407,12 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + self.__options.X_ind = True + self.__homedir = self.__options.homedir + self.__tmpdir = self.__options.tmpdir ++ self.__runuserdir = self.__options.runuserdir + else: + if self.__options.level: + self.__homedir = self.__options.homedir + self.__tmpdir = self.__options.tmpdir ++ self.__runuserdir = self.__options.runuserdir + + if len(cmds) == 0: + self.usage(_("Command required")) +@@ -442,9 +450,14 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + self.__tmpdir = self.__options.tmpdir + else: + self.__tmpdir = mkdtemp(dir="/tmp", prefix=".sandbox_tmp_") ++ if self.__options.runuserdir: ++ self.__runuserdir = self.__options.runuserdir ++ else: ++ self.__runuserdir = mkdtemp(dir="/tmp", prefix=".sandbox_runuser_") + self.__copyfiles() + selinux.chcon(self.__homedir, self.__filecon, recursive=True) + selinux.chcon(self.__tmpdir, self.__filecon, recursive=True) ++ selinux.chcon(self.__runuserdir, self.__filecon, recursive=True) + selinux.setfscreatecon(None) + + def __execute(self): +@@ -453,7 +466,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + if self.__options.usecaps: + cmds.append('-C') + if self.__mount: +- cmds += ["-t", self.__tmpdir, "-h", self.__homedir] ++ cmds += ["-t", self.__tmpdir, "-h", self.__homedir, "-r", self.__runuserdir] + + if self.__options.X_ind: + if self.__options.dpi: +diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 +index d83fee76f335..1ee0ecea96d1 100644 +--- a/sandbox/sandbox.8 ++++ b/sandbox/sandbox.8 +@@ -3,11 +3,11 @@ + sandbox \- Run cmd under an SELinux sandbox + .SH SYNOPSIS + .B sandbox +-[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] cmd ++[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [ \-R runuserdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] cmd + + .br + .B sandbox +-[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] \-S ++[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [ \-R runuserdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] \-S + .br + .SH DESCRIPTION + .PP +@@ -67,6 +67,9 @@ sandbox_net_client_t \- All network ports + \fB\-T\fR \fB\-\-tmpdir\fR + Use alternate temporary directory to mount on /tmp. Defaults to tmpfs. Requires \-X or \-M. + .TP ++\fB\-R\fR \fB\-\-runuserdir\fR ++Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). ++.TP + \fB\-S\fR \fB\-\-session\fR + Run a full desktop session, Requires level, and home and tmpdir. + .TP +diff --git a/sandbox/seunshare.8 b/sandbox/seunshare.8 +index 0da352613485..09cf7feae45d 100644 +--- a/sandbox/seunshare.8 ++++ b/sandbox/seunshare.8 +@@ -18,6 +18,9 @@ Alternate homedir to be used by the application. Homedir must be owned by the u + \fB\-t\ tmpdir + Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user. + .TP ++\fB\-r\ runuserdir ++Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user. ++.TP + \fB\-C --capabilities\fR + Allow apps executed within the namespace to use capabilities. Default is no capabilities. + .TP +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index dd1d7ddbdc89..1d38ea92b9ae 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -52,7 +52,7 @@ + + #define BUF_SIZE 1024 + #define DEFAULT_PATH "/usr/bin:/bin" +-#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z CONTEXT ] -- executable [args] ") ++#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -r runuserdir ] [ -Z CONTEXT ] -- executable [args] ") + + static int verbose = 0; + static int child = 0; +@@ -623,15 +623,20 @@ int main(int argc, char **argv) { + char *homedir_s = NULL; /* homedir spec'd by user in argv[] */ + char *tmpdir_s = NULL; /* tmpdir spec'd by user in argv[] */ + char *tmpdir_r = NULL; /* tmpdir created by seunshare */ ++ char *runuserdir_s = NULL; /* /var/run/user/UID spec'd by user in argv[] */ ++ char *runuserdir_r = NULL; /* /var/run/user/UID created by seunshare */ + + struct stat st_curhomedir; + struct stat st_homedir; + struct stat st_tmpdir_s; + struct stat st_tmpdir_r; ++ struct stat st_runuserdir_s; ++ struct stat st_runuserdir_r; + + const struct option long_options[] = { + {"homedir", 1, 0, 'h'}, + {"tmpdir", 1, 0, 't'}, ++ {"runuserdir", 1, 0, 'r'}, + {"kill", 1, 0, 'k'}, + {"verbose", 1, 0, 'v'}, + {"context", 1, 0, 'Z'}, +@@ -665,7 +670,7 @@ int main(int argc, char **argv) { + } + + while (1) { +- clflag = getopt_long(argc, argv, "Ccvh:t:Z:", long_options, NULL); ++ clflag = getopt_long(argc, argv, "Ccvh:r:t:Z:", long_options, NULL); + if (clflag == -1) + break; + +@@ -679,6 +684,9 @@ int main(int argc, char **argv) { + case 'h': + homedir_s = optarg; + break; ++ case 'r': ++ runuserdir_s = optarg; ++ break; + case 'v': + verbose++; + break; +@@ -729,6 +737,10 @@ int main(int argc, char **argv) { + if (tmpdir_s && ( + verify_directory(tmpdir_s, NULL, &st_tmpdir_s) < 0 || + check_owner_uid(uid, tmpdir_s, &st_tmpdir_s))) return -1; ++ if (runuserdir_s && ( ++ verify_directory(runuserdir_s, NULL, &st_runuserdir_s) < 0 || ++ check_owner_uid(uid, runuserdir_s, &st_runuserdir_s))) return -1; ++ + if ((uid_t)setfsuid(0) != uid) return -1; + + /* create runtime tmpdir */ +@@ -737,6 +749,12 @@ int main(int argc, char **argv) { + fprintf(stderr, _("Failed to create runtime temporary directory\n")); + return -1; + } ++ /* create runtime runuserdir */ ++ if (runuserdir_s && (runuserdir_r = create_tmpdir(runuserdir_s, &st_runuserdir_s, ++ &st_runuserdir_r, pwd, execcon)) == NULL) { ++ fprintf(stderr, _("Failed to create runtime $XDG_RUNTIME_DIR directory\n")); ++ return -1; ++ } + + /* spawn child process */ + child = fork(); +@@ -775,7 +793,21 @@ int main(int argc, char **argv) { + if (check_owner_uid(uid, resolved_path, &st_curhomedir) < 0) + goto childerr; + +- /* mount homedir and tmpdir, in this order */ ++ if ((RUNTIME_DIR = getenv("XDG_RUNTIME_DIR")) != NULL) { ++ if ((RUNTIME_DIR = strdup(RUNTIME_DIR)) == NULL) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ } else { ++ if (asprintf(&RUNTIME_DIR, "/run/user/%d", uid) == -1) { ++ perror(_("Out of memory\n")); ++ goto childerr; ++ } ++ } ++ ++ /* mount homedir, runuserdir and tmpdir, in this order */ ++ if (runuserdir_s && seunshare_mount(runuserdir_s, RUNTIME_DIR, ++ &st_runuserdir_s) != 0) goto childerr; + if (homedir_s && seunshare_mount(homedir_s, resolved_path, + &st_homedir) != 0) goto childerr; + if (tmpdir_s && seunshare_mount(tmpdir_r, "/tmp", +@@ -799,13 +831,6 @@ int main(int argc, char **argv) { + } + } + +- if ((RUNTIME_DIR = getenv("XDG_RUNTIME_DIR")) != NULL) { +- if ((RUNTIME_DIR = strdup(RUNTIME_DIR)) == NULL) { +- perror(_("Out of memory")); +- goto childerr; +- } +- } +- + if ((rc = clearenv()) != 0) { + perror(_("Failed to clear environment")); + goto childerr; +-- +2.38.1 + diff --git a/0016-python-Remove-dependency-on-the-Python-module-distut.patch b/0016-python-Remove-dependency-on-the-Python-module-distut.patch new file mode 100644 index 0000000..81b36c2 --- /dev/null +++ b/0016-python-Remove-dependency-on-the-Python-module-distut.patch @@ -0,0 +1,81 @@ +From c08cf24f39989cfc610a481ae3dc380b61e9ca5f Mon Sep 17 00:00:00 2001 +From: James Carter +Date: Fri, 28 Oct 2022 16:16:22 -0400 +Subject: [PATCH] python: Remove dependency on the Python module distutils +Content-type: text/plain + +The distutils package is deprecated and scheduled to be removed in +Python 3.12. Use the setuptools and sysconfig modules instead. + +Signed-off-by: James Carter +Acked-by: Petr Lautrbach +--- + python/semanage/Makefile | 2 +- + python/sepolgen/src/sepolgen/Makefile | 2 +- + python/sepolicy/sepolicy/gui.py | 4 ++-- + python/sepolicy/setup.py | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/python/semanage/Makefile b/python/semanage/Makefile +index 024e9640fed0..b53ee33db6ac 100644 +--- a/python/semanage/Makefile ++++ b/python/semanage/Makefile +@@ -5,7 +5,7 @@ LINGUAS ?= ru + PREFIX ?= /usr + SBINDIR ?= $(PREFIX)/sbin + MANDIR = $(PREFIX)/share/man +-PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; print(get_python_lib(prefix='$(PREFIX)'))") ++PYTHONLIBDIR ?= $(shell $(PYTHON) -c "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '$(PREFIX)', 'base': '$(PREFIX)'}))") + PACKAGEDIR ?= $(PYTHONLIBDIR) + BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions + +diff --git a/python/sepolgen/src/sepolgen/Makefile b/python/sepolgen/src/sepolgen/Makefile +index cac8def7204e..a10392273181 100644 +--- a/python/sepolgen/src/sepolgen/Makefile ++++ b/python/sepolgen/src/sepolgen/Makefile +@@ -1,6 +1,6 @@ + PREFIX ?= /usr + PYTHON ?= python3 +-PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; print(get_python_lib(prefix='$(PREFIX)'))") ++PYTHONLIBDIR ?= $(shell $(PYTHON) -c "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '$(PREFIX)', 'base': '$(PREFIX)'}))") + PACKAGEDIR ?= /$(PYTHONLIBDIR)/sepolgen + + all: +diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py +index 5bdbfebade1d..335be582b668 100644 +--- a/python/sepolicy/sepolicy/gui.py ++++ b/python/sepolicy/sepolicy/gui.py +@@ -77,7 +77,7 @@ def cmp(a, b): + return 1 + return (a > b) - (a < b) + +-import distutils.sysconfig ++import sysconfig + ADVANCED_LABEL = (_("Advanced >>"), _("Advanced <<")) + ADVANCED_SEARCH_LABEL = (_("Advanced Search >>"), _("Advanced Search <<")) + OUTBOUND_PAGE = 0 +@@ -130,7 +130,7 @@ class SELinuxGui(): + self.application = app + self.filter_txt = "" + builder = Gtk.Builder() # BUILDER OBJ +- self.code_path = distutils.sysconfig.get_python_lib(plat_specific=False) + "/sepolicy/" ++ self.code_path = sysconfig.get_python_lib(plat_specific=False) + "/sepolicy/" + glade_file = self.code_path + "sepolicy.glade" + builder.add_from_file(glade_file) + self.outer_notebook = builder.get_object("outer_notebook") +diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py +index b0f9650df875..c82206647f9b 100644 +--- a/python/sepolicy/setup.py ++++ b/python/sepolicy/setup.py +@@ -2,7 +2,7 @@ + + # Author: Thomas Liu + # Author: Dan Walsh +-from distutils.core import setup ++from setuptools import setup + + setup( + name="sepolicy", +-- +2.38.1 + diff --git a/0017-python-Harden-tools-against-rogue-modules.patch b/0017-python-Harden-tools-against-rogue-modules.patch new file mode 100644 index 0000000..0d2d809 --- /dev/null +++ b/0017-python-Harden-tools-against-rogue-modules.patch @@ -0,0 +1,81 @@ +From 48602370acabffea96759bf66edd00ca829f5d17 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 18 Oct 2022 22:36:59 +0200 +Subject: [PATCH] python: Harden tools against "rogue" modules +Content-type: text/plain + +Python scripts present in "/usr/sbin" override regular modules. +Make sure /usr/sbin is not present in PYTHONPATH. + +Fixes: + #cat > /usr/sbin/audit.py < +Acked-by: James Carter +--- + python/audit2allow/audit2allow | 2 +- + python/audit2allow/sepolgen-ifgen | 2 +- + python/chcat/chcat | 2 +- + python/semanage/semanage | 2 +- + python/sepolicy/sepolicy.py | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow +index 09b06f664bc4..eafeea88aa21 100644 +--- a/python/audit2allow/audit2allow ++++ b/python/audit2allow/audit2allow +@@ -1,4 +1,4 @@ +-#!/usr/bin/python3 -Es ++#!/usr/bin/python3 -EsI + # Authors: Karl MacMillan + # Authors: Dan Walsh + # +diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen +index b7a04c719acc..f2cc0c32f2b0 100644 +--- a/python/audit2allow/sepolgen-ifgen ++++ b/python/audit2allow/sepolgen-ifgen +@@ -1,4 +1,4 @@ +-#!/usr/bin/python3 -Es ++#!/usr/bin/python3 -EsI + # + # Authors: Karl MacMillan + # +diff --git a/python/chcat/chcat b/python/chcat/chcat +index 952cb8187599..68718ec5f102 100755 +--- a/python/chcat/chcat ++++ b/python/chcat/chcat +@@ -1,4 +1,4 @@ +-#!/usr/bin/python3 -Es ++#!/usr/bin/python3 -EsI + # Copyright (C) 2005 Red Hat + # see file 'COPYING' for use and warranty information + # +diff --git a/python/semanage/semanage b/python/semanage/semanage +index 10ab3fa67d7f..b21d1484ab85 100644 +--- a/python/semanage/semanage ++++ b/python/semanage/semanage +@@ -1,4 +1,4 @@ +-#!/usr/bin/python3 -Es ++#!/usr/bin/python3 -EsI + # Copyright (C) 2012-2013 Red Hat + # AUTHOR: Miroslav Grepl + # AUTHOR: David Quigley +diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py +index c7a70e094b0c..733d40484709 100755 +--- a/python/sepolicy/sepolicy.py ++++ b/python/sepolicy/sepolicy.py +@@ -1,4 +1,4 @@ +-#!/usr/bin/python3 -Es ++#!/usr/bin/python3 -EsI + # Copyright (C) 2012 Red Hat + # AUTHOR: Dan Walsh + # see file 'COPYING' for use and warranty information +-- +2.38.1 + diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch similarity index 92% rename from 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch rename to 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index 1b5b9c9..552aa2b 100644 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,4 +1,4 @@ -From f361ee407490bc74b43ec408b1edc70cd647d4e0 Mon Sep 17 00:00:00 2001 +From 1b9bc42461589e49cd68727ea479cc820e55a2d7 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in @@ -23,5 +23,5 @@ index eaa500d08143..4774528027ef 100644 cat > ~/seremote << __EOF #!/bin/sh -- -2.35.1 +2.38.1 diff --git a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch similarity index 89% rename from 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch rename to 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index ba39b4d..a6205ac 100644 --- a/0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From f204dd292340689c2d7ab75612b9fd81337fcbc3 Mon Sep 17 00:00:00 2001 +From 30f3eca067ace9f73ad7612377675e5f777ea869 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -21,5 +21,5 @@ index c72ca0eb9d61..163ebcd1f232 100755 THREADS="" RPMFILES="" -- -2.35.1 +2.38.1 diff --git a/0008-sepolicy-generate-Handle-more-reserved-port-types.patch b/0020-sepolicy-generate-Handle-more-reserved-port-types.patch similarity index 94% rename from 0008-sepolicy-generate-Handle-more-reserved-port-types.patch rename to 0020-sepolicy-generate-Handle-more-reserved-port-types.patch index 0e45be3..7668c70 100644 --- a/0008-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0020-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From d8f51aa7d299383247213b69ec7cbb68c1fa3bc4 Mon Sep 17 00:00:00 2001 +From f2a1b0dc836ebcf2ef418cd0c85fcea949b556eb Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -53,10 +53,10 @@ https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redha 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 43180ca6fda4..d60a08e1d72c 100644 +index 3717d5d4ed78..eff3a8973917 100644 --- a/python/sepolicy/sepolicy/generate.py +++ b/python/sepolicy/sepolicy/generate.py -@@ -99,7 +99,9 @@ def get_all_ports(): +@@ -100,7 +100,9 @@ def get_all_ports(): for p in sepolicy.info(sepolicy.PORT): if p['type'] == "reserved_port_t" or \ p['type'] == "port_t" or \ @@ -68,5 +68,5 @@ index 43180ca6fda4..d60a08e1d72c 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.35.1 +2.38.1 diff --git a/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch similarity index 88% rename from 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch rename to 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index e8a52b2..63c81d3 100644 --- a/0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 8054dc44cf105b959864a1424fe857fac3ba3d73 Mon Sep 17 00:00:00 2001 +From 239f039edd2c4030d373baa31f42651075b5927b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -11,10 +11,10 @@ Content-type: text/plain 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/sandbox/sandbox b/sandbox/sandbox -index 16c43b51eaaa..7709a6585665 100644 +index 770807345858..df3af9260c7f 100644 --- a/sandbox/sandbox +++ b/sandbox/sandbox -@@ -268,7 +268,7 @@ class Sandbox: +@@ -270,7 +270,7 @@ class Sandbox: copyfile(f, "/tmp", self.__tmpdir) copyfile(f, "/var/tmp", self.__tmpdir) @@ -23,7 +23,7 @@ index 16c43b51eaaa..7709a6585665 100644 execfile = self.__homedir + "/.sandboxrc" fd = open(execfile, "w+") if self.__options.session: -@@ -362,7 +362,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- +@@ -369,7 +369,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- parser.add_option("-W", "--windowmanager", dest="wm", type="string", @@ -33,10 +33,10 @@ index 16c43b51eaaa..7709a6585665 100644 parser.add_option("-l", "--level", dest="level", diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 -index d83fee76f335..90ef4951c8c2 100644 +index 1ee0ecea96d1..775e4b231204 100644 --- a/sandbox/sandbox.8 +++ b/sandbox/sandbox.8 -@@ -77,7 +77,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz +@@ -80,7 +80,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz \fB\-W\fR \fB\-\-windowmanager\fR Select alternative window manager to run within .B sandbox \-X. @@ -71,5 +71,5 @@ index 4774528027ef..c211ebc14549 100644 export DISPLAY=:$D cat > ~/seremote << __EOF -- -2.35.1 +2.38.1 diff --git a/0010-Use-SHA-2-instead-of-SHA-1.patch b/0022-Use-SHA-2-instead-of-SHA-1.patch similarity index 98% rename from 0010-Use-SHA-2-instead-of-SHA-1.patch rename to 0022-Use-SHA-2-instead-of-SHA-1.patch index 812028f..48c4627 100644 --- a/0010-Use-SHA-2-instead-of-SHA-1.patch +++ b/0022-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 53d085d8d6edc05886d473e412a8025b7f8d9ce4 Mon Sep 17 00:00:00 2001 +From e5a015f1edd5e7ed87f6f4ec6ddb45637fa178ab Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -254,10 +254,10 @@ index 910101452625..7f2daa09191b 100644 , и, при условии, что НЕ установлен параметр .B \-n diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 19b59a2cc90d..bad9f37a9ac4 100644 +index bf26e161a71d..36fe6b369548 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 -@@ -87,14 +87,14 @@ display usage information and exit. +@@ -95,14 +95,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -275,7 +275,7 @@ index 19b59a2cc90d..bad9f37a9ac4 100644 enable usage of the .IR security.sehash extended attribute. -@@ -239,7 +239,7 @@ the +@@ -261,7 +261,7 @@ the .B \-D option to .B setfiles @@ -284,7 +284,7 @@ index 19b59a2cc90d..bad9f37a9ac4 100644 .B spec_file set in an extended attribute named .IR security.sehash -@@ -260,7 +260,7 @@ for further details. +@@ -282,7 +282,7 @@ for further details. .sp The .B \-I @@ -294,5 +294,5 @@ index 19b59a2cc90d..bad9f37a9ac4 100644 and provided the .B \-n -- -2.35.1 +2.38.1 diff --git a/0023-python-Fix-typo-in-audit2allow.1-example.patch b/0023-python-Fix-typo-in-audit2allow.1-example.patch new file mode 100644 index 0000000..31b0081 --- /dev/null +++ b/0023-python-Fix-typo-in-audit2allow.1-example.patch @@ -0,0 +1,28 @@ +From 5e9f9478cc6eeaa46e0e8172a458a49e49d4e258 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 9 Nov 2022 11:53:28 +0100 +Subject: [PATCH] python: Fix typo in audit2allow.1 example +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +Acked-by: James Carter +--- + python/audit2allow/audit2allow.1 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/audit2allow/audit2allow.1 b/python/audit2allow/audit2allow.1 +index c61067b33688..04ec32398011 100644 +--- a/python/audit2allow/audit2allow.1 ++++ b/python/audit2allow/audit2allow.1 +@@ -151,7 +151,7 @@ policy_module(local, 1.0) + gen_require(` + type myapp_t; + type etc_t; +- }; ++\[aq]) + + files_read_etc_files(myapp_t) + +-- +2.38.1 + diff --git a/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch b/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch new file mode 100644 index 0000000..97a224e --- /dev/null +++ b/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch @@ -0,0 +1,102 @@ +From 762090ae1a67b040b37cc4863f1ceb0b45c66717 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Fri, 18 Nov 2022 13:51:52 +0100 +Subject: [PATCH] python/sepolicy: Fix sepolicy manpage -w ... +Content-type: text/plain + +Commit 7494bb1298b3 ("sepolicy: generate man pages in parallel") +improved sepolicy performance but broke `sepolicy manpage -w ...` as it +didn't collect data about domains and roles from ManPage() and so +HTMLManPages() generated only empty page. This is fixed now, domains +and roles are being collected and used for HTML pages. + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy.py | 13 +++++++++++-- + python/sepolicy/sepolicy/manpage.py | 12 +++++------- + 2 files changed, 16 insertions(+), 9 deletions(-) + +diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py +index 733d40484709..82ff6af2bc2d 100755 +--- a/python/sepolicy/sepolicy.py ++++ b/python/sepolicy/sepolicy.py +@@ -332,9 +332,10 @@ def manpage_work(domain, path, root, source_files, web): + from sepolicy.manpage import ManPage + m = ManPage(domain, path, root, source_files, web) + print(m.get_man_page_path()) ++ return (m.manpage_domains, m.manpage_roles) + + def manpage(args): +- from sepolicy.manpage import HTMLManPages, manpage_domains, manpage_roles, gen_domains ++ from sepolicy.manpage import HTMLManPages, gen_domains + + path = args.path + if not args.policy and args.root != "/": +@@ -347,9 +348,17 @@ def manpage(args): + else: + test_domains = args.domain + ++ manpage_domains = set() ++ manpage_roles = set() + p = Pool() ++ async_results = [] + for domain in test_domains: +- p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web]) ++ async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) ++ for result in async_results: ++ domains, roles = result.get() ++ manpage_domains.update(domains) ++ manpage_roles.update(roles) ++ + p.close() + p.join() + +diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py +index 3e61e333193f..de72cb6cda5f 100755 +--- a/python/sepolicy/sepolicy/manpage.py ++++ b/python/sepolicy/sepolicy/manpage.py +@@ -21,7 +21,7 @@ + # 02111-1307 USA + # + # +-__all__ = ['ManPage', 'HTMLManPages', 'manpage_domains', 'manpage_roles', 'gen_domains'] ++__all__ = ['ManPage', 'HTMLManPages', 'gen_domains'] + + import string + import selinux +@@ -147,10 +147,6 @@ def _gen_types(): + def prettyprint(f, trim): + return " ".join(f[:-len(trim)].split("_")) + +-# for HTML man pages +-manpage_domains = [] +-manpage_roles = [] +- + fedora_releases = ["Fedora17", "Fedora18"] + rhel_releases = ["RHEL6", "RHEL7"] + +@@ -408,6 +404,8 @@ class ManPage: + """ + modules_dict = None + enabled_str = ["Disabled", "Enabled"] ++ manpage_domains = [] ++ manpage_roles = [] + + def __init__(self, domainname, path="/tmp", root="/", source_files=False, html=False): + self.html = html +@@ -453,10 +451,10 @@ class ManPage: + if self.domainname + "_r" in self.all_roles: + self.__gen_user_man_page() + if self.html: +- manpage_roles.append(self.man_page_path) ++ self.manpage_roles.append(self.man_page_path) + else: + if self.html: +- manpage_domains.append(self.man_page_path) ++ self.manpage_domains.append(self.man_page_path) + self.__gen_man_page() + self.fd.close() + +-- +2.38.1 + diff --git a/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch b/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch new file mode 100644 index 0000000..606207b --- /dev/null +++ b/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch @@ -0,0 +1,57 @@ +From fe825bf76f7a6727a3654c96e7bc55ddc7069b76 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Fri, 18 Nov 2022 13:51:53 +0100 +Subject: [PATCH] python/sepolicy: Use distro module to get os version +Content-type: text/plain + +distro module uses /etc/os-release file which contains operating system +identification data, see os-release(5). Given that the mechanism doesn't +use `rpm` it should be possible to generate man pages on other +distributions. + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/__init__.py | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py +index 9c3caa05b80b..baa4c8e62e97 100644 +--- a/python/sepolicy/sepolicy/__init__.py ++++ b/python/sepolicy/sepolicy/__init__.py +@@ -1226,27 +1226,14 @@ def boolean_desc(boolean): + + + def get_os_version(): +- os_version = "" +- pkg_name = "selinux-policy" ++ system_release = "" + try: +- try: +- from commands import getstatusoutput +- except ImportError: +- from subprocess import getstatusoutput +- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name) +- if rc == 0: +- os_version = output.split(".")[-2] +- except: +- os_version = "" +- +- if os_version[0:2] == "fc": +- os_version = "Fedora" + os_version[2:] +- elif os_version[0:2] == "el": +- os_version = "RHEL" + os_version[2:] +- else: +- os_version = "" ++ import distro ++ system_release = distro.name(pretty=True) ++ except IOError: ++ system_release = "Misc" + +- return os_version ++ return system_release + + + def reinit(): +-- +2.38.1 + diff --git a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch b/0026-python-sepolicy-Simplify-generation-of-man-pages.patch similarity index 56% rename from 0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch rename to 0026-python-sepolicy-Simplify-generation-of-man-pages.patch index 045c033..1835db5 100644 --- a/0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch +++ b/0026-python-sepolicy-Simplify-generation-of-man-pages.patch @@ -1,70 +1,31 @@ -From b180f7679c5e09535416f47d48afd0c0738f5fa9 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Thu, 19 Feb 2015 17:45:15 +0100 -Subject: [PATCH] Simplication of sepolicy-manpage web functionality. - system_release is no longer hardcoded and it creates only index.html and html - man pages in the directory for the system release. +From 1fad73e62fdda5290e3939464df09796fca6871d Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Fri, 18 Nov 2022 13:51:55 +0100 +Subject: [PATCH] python/sepolicy: Simplify generation of man pages Content-type: text/plain ---- - python/sepolicy/sepolicy/__init__.py | 25 +++-------- - python/sepolicy/sepolicy/manpage.py | 65 +++------------------------- - 2 files changed, 13 insertions(+), 77 deletions(-) +And do not hardcode Fedora and RHEL versions. + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/manpage.py | 71 ++++------------------------- + 1 file changed, 8 insertions(+), 63 deletions(-) -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 203ca25f4210..9447812b7450 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -1225,27 +1225,14 @@ def boolean_desc(boolean): - - - def get_os_version(): -- os_version = "" -- pkg_name = "selinux-policy" -+ system_release = "" - try: -- try: -- from commands import getstatusoutput -- except ImportError: -- from subprocess import getstatusoutput -- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name) -- if rc == 0: -- os_version = output.split(".")[-2] -- except: -- os_version = "" -- -- if os_version[0:2] == "fc": -- os_version = "Fedora" + os_version[2:] -- elif os_version[0:2] == "el": -- os_version = "RHEL" + os_version[2:] -- else: -- os_version = "" -+ with open('/etc/system-release') as f: -+ system_release = f.readline() -+ except IOError: -+ system_release = "Misc" - -- return os_version -+ return system_release - - - def reinit(): diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index ec8aa1cb94a2..c632d05dbb1b 100755 +index de72cb6cda5f..edeb3b77e759 100755 --- a/python/sepolicy/sepolicy/manpage.py +++ b/python/sepolicy/sepolicy/manpage.py -@@ -151,10 +151,6 @@ def prettyprint(f, trim): - manpage_domains = [] - manpage_roles = [] +@@ -147,9 +147,6 @@ def _gen_types(): + def prettyprint(f, trim): + return " ".join(f[:-len(trim)].split("_")) -fedora_releases = ["Fedora17", "Fedora18"] -rhel_releases = ["RHEL6", "RHEL7"] - -- + def get_alphabet_manpages(manpage_list): alphabet_manpages = dict.fromkeys(string.ascii_letters, []) - for i in string.ascii_letters: -@@ -184,7 +180,7 @@ def convert_manpage_to_html(html_manpage, manpage): +@@ -180,7 +177,7 @@ def convert_manpage_to_html(html_manpage, manpage): class HTMLManPages: """ @@ -73,19 +34,20 @@ index ec8aa1cb94a2..c632d05dbb1b 100755 """ def __init__(self, manpage_roles, manpage_domains, path, os_version): -@@ -192,9 +188,9 @@ class HTMLManPages: +@@ -188,18 +185,12 @@ class HTMLManPages: self.manpage_domains = get_alphabet_manpages(manpage_domains) self.os_version = os_version self.old_path = path + "/" - self.new_path = self.old_path + self.os_version + "/" -+ self.new_path = self.old_path - +- - if self.os_version in fedora_releases or self.os_version in rhel_releases: -+ if self.os_version: - self.__gen_html_manpages() - else: - print("SELinux HTML man pages can not be generated for this %s" % os_version) -@@ -203,7 +199,6 @@ class HTMLManPages: +- self.__gen_html_manpages() +- else: +- print("SELinux HTML man pages can not be generated for this %s" % os_version) +- exit(1) ++ self.new_path = self.old_path ++ self.__gen_html_manpages() + def __gen_html_manpages(self): self._write_html_manpage() self._gen_index() @@ -93,7 +55,7 @@ index ec8aa1cb94a2..c632d05dbb1b 100755 self._gen_css() def _write_html_manpage(self): -@@ -221,67 +216,21 @@ class HTMLManPages: +@@ -217,67 +208,21 @@ class HTMLManPages: convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r) def _gen_index(self): @@ -143,7 +105,8 @@ index ec8aa1cb94a2..c632d05dbb1b 100755 - print("%s has been created" % index) - - def _gen_body(self): - html = self.new_path + self.os_version + ".html" +- html = self.new_path + self.os_version + ".html" ++ html = self.new_path + "index.html" fd = open(html, 'w') fd.write(""" @@ -151,7 +114,7 @@ index ec8aa1cb94a2..c632d05dbb1b 100755 - - Linux man-pages online for Fedora18 + -+ SELinux man pages online ++ SELinux man pages -

SELinux man pages for Fedora18

@@ -166,5 +129,5 @@ index ec8aa1cb94a2..c632d05dbb1b 100755 if len(self.manpage_roles[letter]): fd.write(""" -- -2.35.1 +2.38.1 diff --git a/0027-Fix-E275-missing-whitespace-after-keyword.patch b/0027-Fix-E275-missing-whitespace-after-keyword.patch new file mode 100644 index 0000000..e86d3c6 --- /dev/null +++ b/0027-Fix-E275-missing-whitespace-after-keyword.patch @@ -0,0 +1,160 @@ +From 3fb03f54d0dad5119cdd3e1d2b13370b8296040b Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 21 Nov 2022 11:39:32 +0100 +Subject: [PATCH] Fix E275 missing whitespace after keyword +Content-type: text/plain + +Fixes: + ./gui/polgengui.py:484:18: E275 missing whitespace after keyword + ./gui/polgengui.py:530:18: E275 missing whitespace after keyword + ./python/sepolgen/src/sepolgen/policygen.py:327:19: E275 missing whitespace after keyword + ./python/sepolgen/src/sepolgen/policygen.py:329:11: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/__init__.py:453:15: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/generate.py:1351:28: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/generate.py:1353:28: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/gui.py:638:24: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/gui.py:863:23: E275 missing whitespace after keyword + ./python/sepolicy/sepolicy/gui.py:2177:16: E275 missing whitespace after keyword + ./sandbox/sandbox:114:7: E275 missing whitespace after keyword + ./sandbox/sandbox:134:11: E275 missing whitespace after keyword + ./sandbox/sandbox:136:7: E275 missing whitespace after keyword + +Signed-off-by: Petr Lautrbach +--- + gui/polgengui.py | 4 ++-- + python/sepolgen/src/sepolgen/policygen.py | 4 ++-- + python/sepolicy/sepolicy/__init__.py | 4 ++-- + python/sepolicy/sepolicy/generate.py | 4 ++-- + python/sepolicy/sepolicy/gui.py | 6 +++--- + sandbox/sandbox | 6 +++--- + 6 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/gui/polgengui.py b/gui/polgengui.py +index 7a3ecd50c91c..16116ba68b61 100644 +--- a/gui/polgengui.py ++++ b/gui/polgengui.py +@@ -481,7 +481,7 @@ class childWindow: + my_policy = sepolicy.generate.policy(self.get_name(), self.get_type()) + + iter = self.boolean_store.get_iter_first() +- while(iter): ++ while iter: + my_policy.add_boolean(self.boolean_store.get_value(iter, 0), self.boolean_store.get_value(iter, 1)) + iter = self.boolean_store.iter_next(iter) + +@@ -527,7 +527,7 @@ class childWindow: + my_policy.set_out_udp(self.out_udp_all_checkbutton.get_active(), self.out_udp_entry.get_text()) + + iter = self.store.get_iter_first() +- while(iter): ++ while iter: + if self.store.get_value(iter, 1) == FILE: + my_policy.add_file(self.store.get_value(iter, 0)) + else: +diff --git a/python/sepolgen/src/sepolgen/policygen.py b/python/sepolgen/src/sepolgen/policygen.py +index 8f0ce26e4dc7..183b41a93d50 100644 +--- a/python/sepolgen/src/sepolgen/policygen.py ++++ b/python/sepolgen/src/sepolgen/policygen.py +@@ -324,9 +324,9 @@ def call_interface(interface, av): + ifcall.args.append(av.obj_class) + else: + print(params[i].type) +- assert(0) ++ assert 0 + +- assert(len(ifcall.args) > 0) ++ assert len(ifcall.args) > 0 + + return ifcall + +diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py +index baa4c8e62e97..68907a4f9759 100644 +--- a/python/sepolicy/sepolicy/__init__.py ++++ b/python/sepolicy/sepolicy/__init__.py +@@ -450,9 +450,9 @@ def get_conditionals(src, dest, tclass, perm): + tlist.append(tdict) + tdict = {} + except KeyError: +- return(tlist) ++ return tlist + +- return (tlist) ++ return tlist + + + def get_conditionals_format_text(cond): +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index eff3a8973917..36a3ea1196b1 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1348,9 +1348,9 @@ allow %s_t %s_t:%s_socket name_%s; + if len(temp_dirs) != 0: + for i in temp_dirs: + if i in self.dirs.keys(): +- del(self.dirs[i]) ++ del self.dirs[i] + elif i in self.files.keys(): +- del(self.files[i]) ++ del self.files[i] + else: + continue + +diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py +index 335be582b668..c8f33f522a2d 100644 +--- a/python/sepolicy/sepolicy/gui.py ++++ b/python/sepolicy/sepolicy/gui.py +@@ -635,7 +635,7 @@ class SELinuxGui(): + for k in self.cur_dict: + for j in self.cur_dict[k]: + if i == ctr: +- del(self.cur_dict[k][j]) ++ del self.cur_dict[k][j] + return + i += 1 + +@@ -860,7 +860,7 @@ class SELinuxGui(): + if val is True or val is False or val is None: + continue + # Returns true if filter_txt exists within the val +- if(val.find(self.filter_txt) != -1 or val.lower().find(self.filter_txt) != -1): ++ if val.find(self.filter_txt) != -1 or val.lower().find(self.filter_txt) != -1: + return True + except (AttributeError, TypeError): + pass +@@ -2174,7 +2174,7 @@ class SELinuxGui(): + model.set_value(iter, 0, not model.get_value(iter, 0)) + active = model.get_value(iter, 0) + if name in self.cur_dict["boolean"]: +- del(self.cur_dict["boolean"][name]) ++ del self.cur_dict["boolean"][name] + else: + self.cur_dict["boolean"][name] = {"active": active} + self.new_updates() +diff --git a/sandbox/sandbox b/sandbox/sandbox +index df3af9260c7f..a32a33ea3cf6 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -111,7 +111,7 @@ def copyfile(file, srcdir, dest): + + def savefile(new, orig, X_ind): + copy = False +- if(X_ind): ++ if X_ind: + import gi + gi.require_version('Gtk', '3.0') + from gi.repository import Gtk +@@ -131,9 +131,9 @@ def savefile(new, orig, X_ind): + except NameError: + pass + ans = input(_("Do you want to save changes to '%s' (y/N): ") % orig) +- if(re.match(_("[yY]"), ans)): ++ if re.match(_("[yY]"), ans): + copy = True +- if(copy): ++ if copy: + shutil.copy2(new, orig) + + +-- +2.38.1 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 5eaa33a..d87da29 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.4-1 -%global libsemanagever 3.4-1 -%global libselinuxver 3.4-1 +%global libsepolver 3.4-4 +%global libsemanagever 3.4-6 +%global libselinuxver 3.4-6 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -31,20 +31,33 @@ Source23: sandbox-po.tgz # $ git format-patch -N 3.4 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch -Patch0002: 0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch -Patch0003: 0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch -Patch0004: 0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch -Patch0005: 0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch -Patch0006: 0006-Fix-title-in-manpage.py-to-not-contain-online.patch -Patch0007: 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0008: 0008-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0009: 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0010: 0010-Use-SHA-2-instead-of-SHA-1.patch -Patch0011: 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch -Patch0012: 0012-gettext-handle-unsupported-languages-properly.patch -Patch0013: 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch -Patch0014: 0014-python-Split-semanage-import-into-two-transactions.patch +Patch0001: 0001-libselinux-declare-return-value-of-context_str-3-con.patch +Patch0002: 0002-semodule-avoid-toctou-on-output-module.patch +Patch0003: 0003-python-Split-semanage-import-into-two-transactions.patch +Patch0004: 0004-python-audit2allow-close-file-stream-on-error.patch +Patch0005: 0005-gettext-handle-unsupported-languages-properly.patch +Patch0006: 0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch +Patch0007: 0007-python-remove-IOError-in-certain-cases.patch +Patch0008: 0008-restorecond-use-strict-function-prototype-for-defini.patch +Patch0009: 0009-Ignore-egg-info-directories-and-clean-them.patch +# Patch0010: 0010-Update-translations.patch +Patch0011: 0011-docs-provide-a-top-level-LICENSE-file.patch +Patch0012: 0012-gui-Fix-export-file-chooser-dialog.patch +Patch0013: 0013-python-Do-not-query-the-local-database-if-the-fconte.patch +Patch0014: 0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch +Patch0015: 0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch +Patch0016: 0016-python-Remove-dependency-on-the-Python-module-distut.patch +Patch0017: 0017-python-Harden-tools-against-rogue-modules.patch +Patch0018: 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +Patch0019: 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0020: 0020-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0021: 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0022: 0022-Use-SHA-2-instead-of-SHA-1.patch +Patch0023: 0023-python-Fix-typo-in-audit2allow.1-example.patch +Patch0024: 0024-python-sepolicy-Fix-sepolicy-manpage-w.patch +Patch0025: 0025-python-sepolicy-Use-distro-module-to-get-os-version.patch +Patch0026: 0026-python-sepolicy-Simplify-generation-of-man-pages.patch +Patch0027: 0027-Fix-E275-missing-whitespace-after-keyword.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -57,7 +70,7 @@ Provides: /sbin/restorecon BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel dbus-glib-devel -BuildRequires: python3-devel +BuildRequires: python3-devel python3-setuptools BuildRequires: systemd BuildRequires: git-core Requires: util-linux grep gawk diffutils rpm sed @@ -432,7 +445,7 @@ system-config-selinux is a utility for managing the SELinux environment %dir %{_datadir}/bash-completion %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} -%license policycoreutils/COPYING +%license policycoreutils/LICENSE %doc %{_usr}/share/doc/%{name} %package restorecond @@ -454,7 +467,7 @@ The policycoreutils-restorecond package contains the restorecond service. %{_mandir}/ru/man8/restorecond.8* %{!?_licensedir:%global license %%doc} -%license policycoreutils/COPYING +%license policycoreutils/LICENSE %post %systemd_post selinux-autorelabel-mark.service @@ -472,6 +485,12 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Nov 21 2022 Petr Lautrbach - 3.4-7 +- Rebase on upstream f56a72ac9e86 +- sepolicy: fix sepolicy manpage -w +- sandbox: add -R option to alternate XDG_RUNTIME_DIR +- Remove dependency on the Python module distutils + * Tue Aug 2 2022 Petr Lautrbach - 3.4-6 - Run autorelabel in parallel by default https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel From 420643f4346252ce5865742fa3bff241e4186895 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 21 Nov 2022 17:38:59 +0100 Subject: [PATCH 18/79] python3-policycoreutils requires python3-distro --- policycoreutils.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index d87da29..92f075b 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.4 -Release: 7%{?dist} +Release: 7.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz @@ -254,6 +254,7 @@ Requires:python3-libsemanage >= %{libsemanagever} python3-libselinux Requires:audit-libs-python3 >= %{libauditver} Requires: checkpolicy Requires: python3-setools >= 4.4.0 +Requires: python3-distro BuildArch: noarch %description -n python3-policycoreutils @@ -485,7 +486,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Mon Nov 21 2022 Petr Lautrbach - 3.4-7 +* Mon Nov 21 2022 Petr Lautrbach - 3.4-7.1 - Rebase on upstream f56a72ac9e86 - sepolicy: fix sepolicy manpage -w - sandbox: add -R option to alternate XDG_RUNTIME_DIR From 8d6bfd9e4e762b9e870467fa4082796cd1e10de6 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Tue, 1 Nov 2022 07:15:13 +0100 Subject: [PATCH 19/79] Change location of pathfix.py For more info see https://fedoraproject.org/wiki/Changes/Python3.12#pathfix.py_tool_will_be_removed --- policycoreutils.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 92f075b..0908756 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -166,10 +166,10 @@ install -m 755 -p %{SOURCE19} %{buildroot}/%{generatorsdir}/ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ # change /usr/bin/python to %%{__python3} in policycoreutils-python3 -pathfix.py -i "%{__python3} -Es" -p %{buildroot}%{python3_sitelib} +%{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i "%{__python3} -Es" -p %{buildroot}%{python3_sitelib} # change /usr/bin/python to %%{__python3} in policycoreutils-python-utils -pathfix.py -i "%{__python3} -Es" -p \ +%{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i "%{__python3} -Es" -p \ %{buildroot}%{_sbindir}/semanage \ %{buildroot}%{_bindir}/chcat \ %{buildroot}%{_bindir}/sandbox \ From 9c3b4420dac55df2a44472ec9535c37972753911 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 23 Dec 2022 17:33:59 +0100 Subject: [PATCH 20/79] policycoreutils-3.5-0.rc1.1 - SELinux userspace 3.5-rc1 release --- .gitignore | 1 + ...re-return-value-of-context_str-3-con.patch | 36 -- ...t-to-Xephyr-as-it-works-better-with-.patch | 2 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...module-avoid-toctou-on-output-module.patch | 49 --- ...emanage-import-into-two-transactions.patch | 65 ---- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...dit2allow-close-file-stream-on-error.patch | 50 --- ...hbox-window-manager-instead-of-openb.patch | 4 +- ...h => 0005-Use-SHA-2-instead-of-SHA-1.patch | 2 +- ...andle-unsupported-languages-properly.patch | 349 ------------------ ...rebuild-if-modules-changed-to-refres.patch | 82 ---- ...thon-remove-IOError-in-certain-cases.patch | 57 --- ...strict-function-prototype-for-defini.patch | 39 -- ...-egg-info-directories-and-clean-them.patch | 56 --- ...ocs-provide-a-top-level-LICENSE-file.patch | 68 ---- 0012-gui-Fix-export-file-chooser-dialog.patch | 38 -- ...ery-the-local-database-if-the-fconte.patch | 66 ---- ...-try-to-remove-tmpdir-twice-if-uid-0.patch | 35 -- ...porary-directory-for-XDG_RUNTIME_DIR.patch | 245 ------------ ...pendency-on-the-Python-module-distut.patch | 81 ---- ...n-Harden-tools-against-rogue-modules.patch | 81 ---- ...on-Fix-typo-in-audit2allow.1-example.patch | 28 -- ...thon-sepolicy-Fix-sepolicy-manpage-w.patch | 102 ----- ...-Use-distro-module-to-get-os-version.patch | 57 --- ...icy-Simplify-generation-of-man-pages.patch | 133 ------- ...275-missing-whitespace-after-keyword.patch | 160 -------- policycoreutils.spec | 55 +-- sources | 2 +- 29 files changed, 28 insertions(+), 1923 deletions(-) delete mode 100644 0001-libselinux-declare-return-value-of-context_str-3-con.patch rename 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch => 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch (93%) rename 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch => 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch (84%) delete mode 100644 0002-semodule-avoid-toctou-on-output-module.patch delete mode 100644 0003-python-Split-semanage-import-into-two-transactions.patch rename 0020-sepolicy-generate-Handle-more-reserved-port-types.patch => 0003-sepolicy-generate-Handle-more-reserved-port-types.patch (96%) delete mode 100644 0004-python-audit2allow-close-file-stream-on-error.patch rename 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch => 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch (96%) rename 0022-Use-SHA-2-instead-of-SHA-1.patch => 0005-Use-SHA-2-instead-of-SHA-1.patch (99%) delete mode 100644 0005-gettext-handle-unsupported-languages-properly.patch delete mode 100644 0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch delete mode 100644 0007-python-remove-IOError-in-certain-cases.patch delete mode 100644 0008-restorecond-use-strict-function-prototype-for-defini.patch delete mode 100644 0009-Ignore-egg-info-directories-and-clean-them.patch delete mode 100644 0011-docs-provide-a-top-level-LICENSE-file.patch delete mode 100644 0012-gui-Fix-export-file-chooser-dialog.patch delete mode 100644 0013-python-Do-not-query-the-local-database-if-the-fconte.patch delete mode 100644 0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch delete mode 100644 0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch delete mode 100644 0016-python-Remove-dependency-on-the-Python-module-distut.patch delete mode 100644 0017-python-Harden-tools-against-rogue-modules.patch delete mode 100644 0023-python-Fix-typo-in-audit2allow.1-example.patch delete mode 100644 0024-python-sepolicy-Fix-sepolicy-manpage-w.patch delete mode 100644 0025-python-sepolicy-Use-distro-module-to-get-os-version.patch delete mode 100644 0026-python-sepolicy-Simplify-generation-of-man-pages.patch delete mode 100644 0027-Fix-E275-missing-whitespace-after-keyword.patch diff --git a/.gitignore b/.gitignore index f582aad..ed061bc 100644 --- a/.gitignore +++ b/.gitignore @@ -344,3 +344,4 @@ policycoreutils-2.0.83.tgz /selinux-3.4-rc2.tar.gz /selinux-3.4-rc3.tar.gz /selinux-3.4.tar.gz +/selinux-3.5-rc1.tar.gz diff --git a/0001-libselinux-declare-return-value-of-context_str-3-con.patch b/0001-libselinux-declare-return-value-of-context_str-3-con.patch deleted file mode 100644 index bcd29f7..0000000 --- a/0001-libselinux-declare-return-value-of-context_str-3-con.patch +++ /dev/null @@ -1,36 +0,0 @@ -From dd98fa322766760c4e1f029cf19d2515a583304f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Fri, 20 May 2022 15:16:10 +0200 -Subject: [PATCH] libselinux: declare return value of context_str(3) const -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -context_str(3) returns a string representation of the given context. -This string is owned by the context and free'd on context_free(3). -Declare it const, as already done in the man page, since it must not be -free'd by the caller. - -Signed-off-by: Christian Göttsche -Acked-by: Nicolas Iooss ---- - policycoreutils/newrole/newrole.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c -index ae37d7253761..c2afa37e0ac3 100644 ---- a/policycoreutils/newrole/newrole.c -+++ b/policycoreutils/newrole/newrole.c -@@ -842,7 +842,7 @@ static int parse_command_line_arguments(int argc, char **argv, char *ttyn, - char *type_ptr = NULL; /* stores malloc'd data from get_default_type */ - char *level_s = NULL; /* level spec'd by user in argv[] */ - char *range_ptr = NULL; -- char *new_con = NULL; -+ const char *new_con = NULL; - char *tty_con = NULL; - context_t context = NULL; /* manipulatable form of new_context */ - const struct option long_options[] = { --- -2.38.1 - diff --git a/0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch similarity index 93% rename from 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch rename to 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index 552aa2b..c3026ad 100644 --- a/0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,4 +1,4 @@ -From 1b9bc42461589e49cd68727ea479cc820e55a2d7 Mon Sep 17 00:00:00 2001 +From 55bc2013b480f5a33803f4b41505ac2a535d2bdf Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in diff --git a/0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch similarity index 84% rename from 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch rename to 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index a6205ac..0215797 100644 --- a/0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 30f3eca067ace9f73ad7612377675e5f777ea869 Mon Sep 17 00:00:00 2001 +From c803df861395e181ed7476df10c04a5ed0dfcdd8 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index c72ca0eb9d61..163ebcd1f232 100755 +index 166af6f360a2..ebe64563c7d7 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { diff --git a/0002-semodule-avoid-toctou-on-output-module.patch b/0002-semodule-avoid-toctou-on-output-module.patch deleted file mode 100644 index 6518d4a..0000000 --- a/0002-semodule-avoid-toctou-on-output-module.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 6d02b2fa29954e239721907e1fce238f25ea4f2f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Fri, 20 May 2022 15:19:52 +0200 -Subject: [PATCH] semodule: avoid toctou on output module -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -Do not check for file existence and open afterwards, open with the -exclusive flag (supported in Glibc and musl 0.9.6 and also standardized -in C11). - -Found by GitHub CodeQL. - -Signed-off-by: Christian Göttsche -Acked-by: Nicolas Iooss ---- - policycoreutils/semodule/semodule.c | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index 1ed8e69054e0..48bc28dd0973 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -550,15 +550,12 @@ int main(int argc, char *argv[]) - goto cleanup_extract; - } - -- if (access(output_path, F_OK) == 0) { -- fprintf(stderr, "%s: %s is already extracted with extension %s.\n", argv[0], mode_arg, lang_ext); -- result = -1; -- goto cleanup_extract; -- } -- -- output_fd = fopen(output_path, "w"); -+ output_fd = fopen(output_path, "wx"); - if (output_fd == NULL) { -- fprintf(stderr, "%s: Unable to open %s\n", argv[0], output_path); -+ if (errno == EEXIST) -+ fprintf(stderr, "%s: %s is already extracted with extension %s.\n", argv[0], mode_arg, lang_ext); -+ else -+ fprintf(stderr, "%s: Unable to open %s: %s\n", argv[0], output_path, strerror(errno)); - result = -1; - goto cleanup_extract; - } --- -2.38.1 - diff --git a/0003-python-Split-semanage-import-into-two-transactions.patch b/0003-python-Split-semanage-import-into-two-transactions.patch deleted file mode 100644 index 8506690..0000000 --- a/0003-python-Split-semanage-import-into-two-transactions.patch +++ /dev/null @@ -1,65 +0,0 @@ -From abaf812c3877f6b595eb8643582eacef2dd4df3f Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 30 May 2022 14:20:21 +0200 -Subject: [PATCH] python: Split "semanage import" into two transactions -Content-type: text/plain - -First transaction applies all deletion operations, so that there are no -collisions when applying the rest of the changes. - -Fixes: - # semanage port -a -t http_cache_port_t -r s0 -p tcp 3024 - # semanage export | semanage import - ValueError: Port tcp/3024 already defined - -Signed-off-by: Vit Mojzis ---- - python/semanage/semanage | 21 +++++++++++++++++++-- - 1 file changed, 19 insertions(+), 2 deletions(-) - -diff --git a/python/semanage/semanage b/python/semanage/semanage -index 8f4e44a7a9cd..1d8281281d05 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -852,10 +852,29 @@ def handleImport(args): - trans = seobject.semanageRecords(args) - trans.start() - -+ deleteCommands = [] -+ commands = [] -+ # separate commands for deletion from the rest so they can be -+ # applied in a separate transaction - for l in sys.stdin.readlines(): - if len(l.strip()) == 0: - continue -+ if "-d" in l or "-D" in l: -+ deleteCommands.append(l) -+ else: -+ commands.append(l) -+ -+ if deleteCommands: -+ importHelper(deleteCommands) -+ trans.finish() -+ trans.start() -+ -+ importHelper(commands) -+ trans.finish() - -+ -+def importHelper(commands): -+ for l in commands: - try: - commandParser = createCommandParser() - args = commandParser.parse_args(mkargv(l)) -@@ -869,8 +888,6 @@ def handleImport(args): - except KeyboardInterrupt: - sys.exit(0) - -- trans.finish() -- - - def setupImportParser(subparsers): - importParser = subparsers.add_parser('import', help=_('Import local customizations')) --- -2.38.1 - diff --git a/0020-sepolicy-generate-Handle-more-reserved-port-types.patch b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch similarity index 96% rename from 0020-sepolicy-generate-Handle-more-reserved-port-types.patch rename to 0003-sepolicy-generate-Handle-more-reserved-port-types.patch index 7668c70..13cf6c9 100644 --- a/0020-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From f2a1b0dc836ebcf2ef418cd0c85fcea949b556eb Mon Sep 17 00:00:00 2001 +From fb3038c1159ce6bb5094bc2f9feb48554ec8081e Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -53,7 +53,7 @@ https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redha 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 3717d5d4ed78..eff3a8973917 100644 +index b6df3e91160b..36a3ea1196b1 100644 --- a/python/sepolicy/sepolicy/generate.py +++ b/python/sepolicy/sepolicy/generate.py @@ -100,7 +100,9 @@ def get_all_ports(): diff --git a/0004-python-audit2allow-close-file-stream-on-error.patch b/0004-python-audit2allow-close-file-stream-on-error.patch deleted file mode 100644 index 1995aec..0000000 --- a/0004-python-audit2allow-close-file-stream-on-error.patch +++ /dev/null @@ -1,50 +0,0 @@ -From c14a86af9a2304175e54897634f808b42345325b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Fri, 20 May 2022 14:51:07 +0200 -Subject: [PATCH] python/audit2allow: close file stream on error -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - - sepolgen-ifgen-attr-helper.c: In function ‘load_policy’: - sepolgen-ifgen-attr-helper.c:196:17: warning: leak of FILE ‘fp’ [CWE-775] [-Wanalyzer-file-leak] - 196 | fprintf(stderr, "Out of memory!\n"); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Signed-off-by: Christian Göttsche -Acked-by: James Carter ---- - python/audit2allow/sepolgen-ifgen-attr-helper.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/python/audit2allow/sepolgen-ifgen-attr-helper.c b/python/audit2allow/sepolgen-ifgen-attr-helper.c -index 6f3ba96260de..5e6cffc1887d 100644 ---- a/python/audit2allow/sepolgen-ifgen-attr-helper.c -+++ b/python/audit2allow/sepolgen-ifgen-attr-helper.c -@@ -194,12 +194,14 @@ static policydb_t *load_policy(const char *filename) - policydb = malloc(sizeof(policydb_t)); - if (policydb == NULL) { - fprintf(stderr, "Out of memory!\n"); -+ fclose(fp); - return NULL; - } - - if (policydb_init(policydb)) { - fprintf(stderr, "Out of memory!\n"); - free(policydb); -+ fclose(fp); - return NULL; - } - -@@ -208,6 +210,7 @@ static policydb_t *load_policy(const char *filename) - fprintf(stderr, - "error(s) encountered while parsing configuration\n"); - free(policydb); -+ fclose(fp); - return NULL; - } - --- -2.38.1 - diff --git a/0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch similarity index 96% rename from 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch rename to 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 63c81d3..402e931 100644 --- a/0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 239f039edd2c4030d373baa31f42651075b5927b Mon Sep 17 00:00:00 2001 +From 09bf2a4318b44c895ea68d13988cb5c3dfa119ba Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -11,7 +11,7 @@ Content-type: text/plain 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/sandbox/sandbox b/sandbox/sandbox -index 770807345858..df3af9260c7f 100644 +index a2762a7d215a..a32a33ea3cf6 100644 --- a/sandbox/sandbox +++ b/sandbox/sandbox @@ -270,7 +270,7 @@ class Sandbox: diff --git a/0022-Use-SHA-2-instead-of-SHA-1.patch b/0005-Use-SHA-2-instead-of-SHA-1.patch similarity index 99% rename from 0022-Use-SHA-2-instead-of-SHA-1.patch rename to 0005-Use-SHA-2-instead-of-SHA-1.patch index 48c4627..9808935 100644 --- a/0022-Use-SHA-2-instead-of-SHA-1.patch +++ b/0005-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From e5a015f1edd5e7ed87f6f4ec6ddb45637fa178ab Mon Sep 17 00:00:00 2001 +From 7fb581c76b547b20a149c6dad3d7c51075192bd8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 diff --git a/0005-gettext-handle-unsupported-languages-properly.patch b/0005-gettext-handle-unsupported-languages-properly.patch deleted file mode 100644 index c0d405a..0000000 --- a/0005-gettext-handle-unsupported-languages-properly.patch +++ /dev/null @@ -1,349 +0,0 @@ -From 344463076b2a91e1d2c7f5cc3835dc1a53a05e88 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Fri, 24 Jun 2022 16:24:25 +0200 -Subject: [PATCH] gettext: handle unsupported languages properly -Content-type: text/plain - -With "fallback=True" gettext.translation behaves the same as -gettext.install and uses NullTranslations in case the -translation file for given language was not found (as opposed to -throwing an exception). - -Fixes: - # LANG is set to any "unsupported" language, e.g. en_US.UTF-8 - $ chcat --help - Traceback (most recent call last): - File "/usr/bin/chcat", line 39, in - t = gettext.translation(PROGNAME, - File "/usr/lib64/python3.9/gettext.py", line 592, in translation - raise FileNotFoundError(ENOENT, - FileNotFoundError: [Errno 2] No translation file found for domain: 'selinux-python' - -Signed-off-by: Vit Mojzis -Reviewed-by: Daniel Burgener -Acked-by: Petr Lautrbach ---- - gui/booleansPage.py | 3 ++- - gui/domainsPage.py | 3 ++- - gui/fcontextPage.py | 3 ++- - gui/loginsPage.py | 3 ++- - gui/modulesPage.py | 3 ++- - gui/polgengui.py | 3 ++- - gui/portsPage.py | 3 ++- - gui/semanagePage.py | 3 ++- - gui/statusPage.py | 3 ++- - gui/system-config-selinux.py | 3 ++- - gui/usersPage.py | 3 ++- - python/chcat/chcat | 5 +++-- - python/semanage/semanage | 3 ++- - python/semanage/seobject.py | 3 ++- - python/sepolgen/src/sepolgen/sepolgeni18n.py | 4 +++- - python/sepolicy/sepolicy.py | 3 ++- - python/sepolicy/sepolicy/__init__.py | 3 ++- - python/sepolicy/sepolicy/generate.py | 3 ++- - python/sepolicy/sepolicy/gui.py | 3 ++- - python/sepolicy/sepolicy/interface.py | 3 ++- - sandbox/sandbox | 3 ++- - 21 files changed, 44 insertions(+), 22 deletions(-) - -diff --git a/gui/booleansPage.py b/gui/booleansPage.py -index 5beec58bc360..ad11a9b24c79 100644 ---- a/gui/booleansPage.py -+++ b/gui/booleansPage.py -@@ -46,7 +46,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/domainsPage.py b/gui/domainsPage.py -index e08f34b4d3a9..e6eadd61c1bc 100644 ---- a/gui/domainsPage.py -+++ b/gui/domainsPage.py -@@ -38,7 +38,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py -index bac2bec3ebbd..767664f26ec8 100644 ---- a/gui/fcontextPage.py -+++ b/gui/fcontextPage.py -@@ -55,7 +55,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/loginsPage.py b/gui/loginsPage.py -index 18b93d8c9756..7e08232a90b5 100644 ---- a/gui/loginsPage.py -+++ b/gui/loginsPage.py -@@ -37,7 +37,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/modulesPage.py b/gui/modulesPage.py -index c546d455d4cd..02b79f150a13 100644 ---- a/gui/modulesPage.py -+++ b/gui/modulesPage.py -@@ -38,7 +38,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/polgengui.py b/gui/polgengui.py -index a18f1cba17b9..7a3ecd50c91c 100644 ---- a/gui/polgengui.py -+++ b/gui/polgengui.py -@@ -71,7 +71,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/portsPage.py b/gui/portsPage.py -index 54aa80ded327..bee2bdf17b99 100644 ---- a/gui/portsPage.py -+++ b/gui/portsPage.py -@@ -43,7 +43,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/semanagePage.py b/gui/semanagePage.py -index 1371d4e7dabe..efad14d9b375 100644 ---- a/gui/semanagePage.py -+++ b/gui/semanagePage.py -@@ -30,7 +30,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/statusPage.py b/gui/statusPage.py -index c241ef83dfa0..832849e60d60 100644 ---- a/gui/statusPage.py -+++ b/gui/statusPage.py -@@ -43,7 +43,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py -index 1b460c99363b..9f53b7fe9020 100644 ---- a/gui/system-config-selinux.py -+++ b/gui/system-config-selinux.py -@@ -53,7 +53,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/gui/usersPage.py b/gui/usersPage.py -index d51bd968b77e..9acd3b844056 100644 ---- a/gui/usersPage.py -+++ b/gui/usersPage.py -@@ -37,7 +37,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/chcat/chcat b/python/chcat/chcat -index e779fcc6ebd7..952cb8187599 100755 ---- a/python/chcat/chcat -+++ b/python/chcat/chcat -@@ -38,9 +38,10 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext --except ImportError: -+except: - try: - import builtins - builtins.__dict__['_'] = str -diff --git a/python/semanage/semanage b/python/semanage/semanage -index 1d8281281d05..4e8d64d6863a 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -38,7 +38,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index ff8f4e9c3008..0782c082dc0c 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -42,7 +42,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py -index 56ebd807c69c..1ff307d9b27d 100644 ---- a/python/sepolgen/src/sepolgen/sepolgeni18n.py -+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py -@@ -19,7 +19,9 @@ - - try: - import gettext -- t = gettext.translation( 'selinux-python' ) -+ t = gettext.translation("selinux-python", -+ localedir="/usr/share/locale", -+ fallback=True) - _ = t.gettext - except: - def _(str): -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index 7ebe0efa88a1..c7a70e094b0c 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -36,7 +36,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 7208234b4a4a..9c3caa05b80b 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -31,7 +31,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 67189fc36b99..3717d5d4ed78 100644 ---- a/python/sepolicy/sepolicy/generate.py -+++ b/python/sepolicy/sepolicy/generate.py -@@ -56,7 +56,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py -index b0263740a79f..5bdbfebade1d 100644 ---- a/python/sepolicy/sepolicy/gui.py -+++ b/python/sepolicy/sepolicy/gui.py -@@ -49,7 +49,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py -index 599f97fdc6e7..43f86443f2c8 100644 ---- a/python/sepolicy/sepolicy/interface.py -+++ b/python/sepolicy/sepolicy/interface.py -@@ -38,7 +38,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: -diff --git a/sandbox/sandbox b/sandbox/sandbox -index cd5709fb07df..789621e136da 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -45,7 +45,8 @@ try: - kwargs['unicode'] = True - t = gettext.translation(PROGNAME, - localedir="/usr/share/locale", -- **kwargs) -+ **kwargs, -+ fallback=True) - _ = t.gettext - except: - try: --- -2.38.1 - diff --git a/0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch b/0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch deleted file mode 100644 index 9dbbe35..0000000 --- a/0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 8cc529af51e8aa68a167ce78cf92687604f98619 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 8 Jun 2022 19:09:54 +0200 -Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh -Content-type: text/plain - -After the last commit this option's name and description no longer -matches the semantic, so give it a new one and update the descriptions. -The old name is still recognized and aliased to the new one for -backwards compatibility. - -Signed-off-by: Ondrej Mosnacek -Acked-by: Nicolas Iooss ---- - policycoreutils/semodule/semodule.8 | 12 ++++++------ - policycoreutils/semodule/semodule.c | 13 ++++++++++--- - 2 files changed, 16 insertions(+), 9 deletions(-) - -diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 -index d1735d216276..c56e580f27b8 100644 ---- a/policycoreutils/semodule/semodule.8 -+++ b/policycoreutils/semodule/semodule.8 -@@ -23,12 +23,12 @@ force a reload of policy - .B \-B, \-\-build - force a rebuild of policy (also reloads unless \-n is used) - .TP --.B \-\-rebuild-if-modules-changed --Force a rebuild of the policy if any changes to module content are detected --(by comparing with checksum from the last transaction). One can use this --instead of \-B to ensure that any changes to the module store done by an --external tool (e.g. a package manager) are applied, while automatically --skipping the rebuild if there are no new changes. -+.B \-\-refresh -+Like \-\-build, but reuses existing linked policy if no changes to module -+files are detected (by comparing with checksum from the last transaction). -+One can use this instead of \-B to ensure that any changes to the module -+store done by an external tool (e.g. a package manager) are applied, while -+automatically skipping the module re-linking if there are no module changes. - .TP - .B \-D, \-\-disable_dontaudit - Temporarily remove dontaudits from policy. Reverts whenever policy is rebuilt -diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c -index 48bc28dd0973..ebe062bf4c6c 100644 ---- a/policycoreutils/semodule/semodule.c -+++ b/policycoreutils/semodule/semodule.c -@@ -150,9 +150,12 @@ static void usage(char *progname) - printf(" -c, --cil extract module as cil. This only affects module extraction.\n"); - printf(" -H, --hll extract module as hll. This only affects module extraction.\n"); - printf(" -m, --checksum print module checksum (SHA256).\n"); -- printf(" --rebuild-if-modules-changed\n" -- " force policy rebuild if module content changed since\n" -- " last rebuild (based on checksum)\n"); -+ printf(" --refresh like --build, but reuses existing linked policy if no\n" -+ " changes to module files are detected (via checksum)\n"); -+ printf("Deprecated options:\n"); -+ printf(" -b,--base same as --install\n"); -+ printf(" --rebuild-if-modules-changed\n" -+ " same as --refresh\n"); - } - - /* Sets the global mode variable to new_mode, but only if no other -@@ -185,6 +188,7 @@ static void parse_command_line(int argc, char **argv) - { - static struct option opts[] = { - {"rebuild-if-modules-changed", 0, NULL, '\0'}, -+ {"refresh", 0, NULL, '\0'}, - {"store", required_argument, NULL, 's'}, - {"base", required_argument, NULL, 'b'}, - {"help", 0, NULL, 'h'}, -@@ -225,6 +229,9 @@ static void parse_command_line(int argc, char **argv) - case '\0': - switch(longind) { - case 0: /* --rebuild-if-modules-changed */ -+ fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n"); -+ /* fallthrough */ -+ case 1: /* --refresh */ - check_ext_changes = 1; - break; - default: --- -2.38.1 - diff --git a/0007-python-remove-IOError-in-certain-cases.patch b/0007-python-remove-IOError-in-certain-cases.patch deleted file mode 100644 index 039293c..0000000 --- a/0007-python-remove-IOError-in-certain-cases.patch +++ /dev/null @@ -1,57 +0,0 @@ -From ebb4a170c024d4bf0d2773b93d916e77a87393d9 Mon Sep 17 00:00:00 2001 -From: Elijah Conners -Date: Wed, 15 Jun 2022 22:13:31 -0700 -Subject: [PATCH] python: remove IOError in certain cases -Content-type: text/plain - -In certain cases, IOError caused the much more general exception OSError -to be unreachable. - -Signed-off-by: Elijah Conners -Acked-by: Petr Lautrbach ---- - python/semanage/semanage | 7 ++----- - sandbox/sandbox | 2 -- - 2 files changed, 2 insertions(+), 7 deletions(-) - -diff --git a/python/semanage/semanage b/python/semanage/semanage -index 4e8d64d6863a..10ab3fa67d7f 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -971,8 +971,8 @@ def do_parser(): - devnull = os.open(os.devnull, os.O_WRONLY) - os.dup2(devnull, sys.stdout.fileno()) - sys.exit(1) -- except IOError as e: -- sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e))) -+ except OSError as e: -+ sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[1])) - sys.exit(1) - except KeyboardInterrupt: - sys.exit(0) -@@ -982,9 +982,6 @@ def do_parser(): - except KeyError as e: - sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[0])) - sys.exit(1) -- except OSError as e: -- sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[1])) -- sys.exit(1) - except RuntimeError as e: - sys.stderr.write("%s: %s\n" % (e.__class__.__name__, e.args[0])) - sys.exit(1) -diff --git a/sandbox/sandbox b/sandbox/sandbox -index 789621e136da..ffac70232875 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -534,8 +534,6 @@ if __name__ == '__main__': - error_exit(error.args[0]) - except KeyError as error: - error_exit(_("Invalid value %s") % error.args[0]) -- except IOError as error: -- error_exit(error) - except KeyboardInterrupt: - rc = 0 - --- -2.38.1 - diff --git a/0008-restorecond-use-strict-function-prototype-for-defini.patch b/0008-restorecond-use-strict-function-prototype-for-defini.patch deleted file mode 100644 index 29a6ea7..0000000 --- a/0008-restorecond-use-strict-function-prototype-for-defini.patch +++ /dev/null @@ -1,39 +0,0 @@ -From b5b3afbaed29895d37f6160cc0847ef5de7538ed Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Mon, 8 Aug 2022 19:36:20 +0200 -Subject: [PATCH] restorecond: use strict function prototype for definition -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -Clang 15 starts to complain about non strict function definitions: - - user.c:172:10: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] - int start() { - ^ - void - -Signed-off-by: Christian Göttsche -Reviewed-by: Daniel Burgener -Acked-by: James Carter ---- - restorecond/user.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/restorecond/user.c b/restorecond/user.c -index 47b86823ff79..3ae3ebbb7230 100644 ---- a/restorecond/user.c -+++ b/restorecond/user.c -@@ -169,7 +169,7 @@ io_channel_callback - return TRUE; - } - --int start() { -+int start(void) { - #ifdef HAVE_DBUS - GDBusConnection *bus; - GError *err = NULL; --- -2.38.1 - diff --git a/0009-Ignore-egg-info-directories-and-clean-them.patch b/0009-Ignore-egg-info-directories-and-clean-them.patch deleted file mode 100644 index 80f7b39..0000000 --- a/0009-Ignore-egg-info-directories-and-clean-them.patch +++ /dev/null @@ -1,56 +0,0 @@ -From c2d58b378b3cf350d042a7b657e2b7f5861c5f26 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Mon, 8 Aug 2022 19:36:55 +0200 -Subject: [PATCH] Ignore egg-info directories and clean them -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - - Test .gitignore and make clean distclean - error: missing .gitignore entry for libselinux/src/selinux.egg-info/ - error: missing .gitignore entry for python/sepolicy/sepolicy.egg-info/ - Error: Process completed with exit code 1. - - error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/PKG-INFO - error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/SOURCES.txt - error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/dependency_links.txt - error: "make clean distclean" did not remove libselinux/src/selinux.egg-info/top_level.txt - error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/PKG-INFO - error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/SOURCES.txt - error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/dependency_links.txt - error: "make clean distclean" did not remove python/sepolicy/sepolicy.egg-info/top_level.txt - Error: Process completed with exit code 1. - -Signed-off-by: Christian Göttsche -Acked-by: James Carter ---- - python/sepolicy/.gitignore | 1 + - python/sepolicy/Makefile | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/python/sepolicy/.gitignore b/python/sepolicy/.gitignore -index 3186c860ec0d..32fb47f92a9d 100644 ---- a/python/sepolicy/.gitignore -+++ b/python/sepolicy/.gitignore -@@ -1,3 +1,4 @@ - build - tmp - *.bak -+sepolicy.egg-info/ -diff --git a/python/sepolicy/Makefile b/python/sepolicy/Makefile -index 3361be4ef0bc..d983e409e5e6 100644 ---- a/python/sepolicy/Makefile -+++ b/python/sepolicy/Makefile -@@ -18,7 +18,7 @@ python-build: - - clean: - $(PYTHON) setup.py clean -- -rm -rf build *~ \#* *pyc .#* -+ -rm -rf build *~ \#* *pyc .#* sepolicy.egg-info/ - - sepolgen: - ln -sf sepolicy sepolgen --- -2.38.1 - diff --git a/0011-docs-provide-a-top-level-LICENSE-file.patch b/0011-docs-provide-a-top-level-LICENSE-file.patch deleted file mode 100644 index 4234674..0000000 --- a/0011-docs-provide-a-top-level-LICENSE-file.patch +++ /dev/null @@ -1,68 +0,0 @@ -From a0a216ff7d86004ddc36d516377f0a6ffe88076c Mon Sep 17 00:00:00 2001 -From: Paul Moore -Date: Fri, 30 Sep 2022 17:44:12 -0400 -Subject: [PATCH] docs: provide a top level LICENSE file -Content-type: text/plain - -Provide a top level LICENSE file explaining how multiple the SELinux -userspace is released under multiple different licenses. Also ensure -that all the different license files share a consistent file name, -LICENSE, to make it easier for people to identify the license files. - -This is to help meet the OpenSSF Best Practices requirements. - -Signed-off-by: Paul Moore ---- - dbus/{COPYING => LICENSE} | 0 - gui/{COPYING => LICENSE} | 0 - policycoreutils/{COPYING => LICENSE} | 0 - python/{COPYING => LICENSE} | 0 - python/sepolgen/{COPYING => LICENSE} | 0 - restorecond/{COPYING => LICENSE} | 0 - sandbox/{COPYING => LICENSE} | 0 - semodule-utils/{COPYING => LICENSE} | 0 - 8 files changed, 0 insertions(+), 0 deletions(-) - rename dbus/{COPYING => LICENSE} (100%) - rename gui/{COPYING => LICENSE} (100%) - rename policycoreutils/{COPYING => LICENSE} (100%) - rename python/{COPYING => LICENSE} (100%) - rename python/sepolgen/{COPYING => LICENSE} (100%) - rename restorecond/{COPYING => LICENSE} (100%) - rename sandbox/{COPYING => LICENSE} (100%) - rename semodule-utils/{COPYING => LICENSE} (100%) - -diff --git a/dbus/COPYING b/dbus/LICENSE -similarity index 100% -rename from dbus/COPYING -rename to dbus/LICENSE -diff --git a/gui/COPYING b/gui/LICENSE -similarity index 100% -rename from gui/COPYING -rename to gui/LICENSE -diff --git a/policycoreutils/COPYING b/policycoreutils/LICENSE -similarity index 100% -rename from policycoreutils/COPYING -rename to policycoreutils/LICENSE -diff --git a/python/COPYING b/python/LICENSE -similarity index 100% -rename from python/COPYING -rename to python/LICENSE -diff --git a/python/sepolgen/COPYING b/python/sepolgen/LICENSE -similarity index 100% -rename from python/sepolgen/COPYING -rename to python/sepolgen/LICENSE -diff --git a/restorecond/COPYING b/restorecond/LICENSE -similarity index 100% -rename from restorecond/COPYING -rename to restorecond/LICENSE -diff --git a/sandbox/COPYING b/sandbox/LICENSE -similarity index 100% -rename from sandbox/COPYING -rename to sandbox/LICENSE -diff --git a/semodule-utils/COPYING b/semodule-utils/LICENSE -similarity index 100% -rename from semodule-utils/COPYING -rename to semodule-utils/LICENSE --- -2.38.1 - diff --git a/0012-gui-Fix-export-file-chooser-dialog.patch b/0012-gui-Fix-export-file-chooser-dialog.patch deleted file mode 100644 index 4fde689..0000000 --- a/0012-gui-Fix-export-file-chooser-dialog.patch +++ /dev/null @@ -1,38 +0,0 @@ -From bba6225abc6c7d8f1642d0c04c819ddc74d426c0 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 11 Oct 2022 16:36:23 +0200 -Subject: [PATCH] gui: Fix export file chooser dialog -Content-type: text/plain - -It wasn't possible to choose a directory in filechooser dialog using -double-click - the dialog returned the directory name instead of -listing the directory. - -Fixes: -Traceback (most recent call last): - File "/usr/lib/python3.10/site-packages/sepolicy/gui.py", line 2593, in on_browse_select - self.export_config(filename) - File "/usr/lib/python3.10/site-packages/sepolicy/gui.py", line 2668, in export_config - fd = open(filename, 'w') -IsADirectoryError: [Errno 21] Is a directory: '/root/Downloads' - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/sepolicy.glade | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/python/sepolicy/sepolicy/sepolicy.glade b/python/sepolicy/sepolicy/sepolicy.glade -index 52407887fcfc..0724d6c8caa4 100644 ---- a/python/sepolicy/sepolicy/sepolicy.glade -+++ b/python/sepolicy/sepolicy/sepolicy.glade -@@ -168,7 +168,6 @@ - - False - vertical -- - - - False --- -2.38.1 - diff --git a/0013-python-Do-not-query-the-local-database-if-the-fconte.patch b/0013-python-Do-not-query-the-local-database-if-the-fconte.patch deleted file mode 100644 index 2f557b0..0000000 --- a/0013-python-Do-not-query-the-local-database-if-the-fconte.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 7238ad32a3171d82bba9b99660e55399161236fc Mon Sep 17 00:00:00 2001 -From: James Carter -Date: Wed, 19 Oct 2022 14:20:11 -0400 -Subject: [PATCH] python: Do not query the local database if the fcontext is - non-local -Content-type: text/plain - -Vit Mojzis reports that an error message is produced when modifying -a non-local fcontext. - -He gives the following example: - # semanage fcontext -f f -m -t passwd_file_t /etc/security/opasswd - libsemanage.dbase_llist_query: could not query record value (No such file or directory). - -When modifying an fcontext, the non-local database is checked for the -key and then, if it is not found there, the local database is checked. -If the key doesn't exist, then an error is raised. If the key exists -then the local database is queried first and, if that fails, the non- -local database is queried. - -The error is from querying the local database when the fcontext is in -the non-local database. - -Instead, if the fcontext is in the non-local database, just query -the non-local database. Only query the local database if the -fcontext was found in it. - -Reported-by: Vit Mojzis -Signed-off-by: James Carter ---- - python/semanage/seobject.py | 15 +++++++++------ - 1 file changed, 9 insertions(+), 6 deletions(-) - -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index 0782c082dc0c..d82da4942987 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -2504,16 +2504,19 @@ class fcontextRecords(semanageRecords): - (rc, exists) = semanage_fcontext_exists(self.sh, k) - if rc < 0: - raise ValueError(_("Could not check if file context for %s is defined") % target) -- if not exists: -+ if exists: -+ try: -+ (rc, fcontext) = semanage_fcontext_query(self.sh, k) -+ except OSError: -+ raise ValueError(_("Could not query file context for %s") % target) -+ else: - (rc, exists) = semanage_fcontext_exists_local(self.sh, k) -+ if rc < 0: -+ raise ValueError(_("Could not check if file context for %s is defined") % target) - if not exists: - raise ValueError(_("File context for %s is not defined") % target) -- -- try: -- (rc, fcontext) = semanage_fcontext_query_local(self.sh, k) -- except OSError: - try: -- (rc, fcontext) = semanage_fcontext_query(self.sh, k) -+ (rc, fcontext) = semanage_fcontext_query_local(self.sh, k) - except OSError: - raise ValueError(_("Could not query file context for %s") % target) - --- -2.38.1 - diff --git a/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch b/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch deleted file mode 100644 index 6b4830a..0000000 --- a/0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 0fb988c86b66ede7723e179699e29f00000fc57b Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 13 Oct 2022 15:23:11 +0200 -Subject: [PATCH] sandbox: Do not try to remove tmpdir twice if uid == 0 -Content-type: text/plain - -If the user is root, tmpdir is already wiped out. - -Fixes: - # sandbox -T /root/tmp -- id - uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:sandbox_t:s0:c696,c756 - Failed to remove directory /tmp/.sandbox-root-KIlB59: No such file or directory - -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - sandbox/seunshare.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c -index 8917a0f9bd42..dd1d7ddbdc89 100644 ---- a/sandbox/seunshare.c -+++ b/sandbox/seunshare.c -@@ -414,7 +414,7 @@ static int cleanup_tmpdir(const char *tmpdir, const char *src, - rc++; - } - -- if (rmdir(tmpdir) == -1) -+ if (pwd->pw_uid != 0 && rmdir(tmpdir) == -1) - fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno)); - if ((uid_t)setfsuid(pwd->pw_uid) != 0) { - fprintf(stderr, _("unable to switch back to user after clearing tmp dir\n")); --- -2.38.1 - diff --git a/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch b/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch deleted file mode 100644 index ada2342..0000000 --- a/0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch +++ /dev/null @@ -1,245 +0,0 @@ -From ecfcb1d6a8ecb914f2a7c72453c872b5f0099f4d Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 13 Oct 2022 15:23:12 +0200 -Subject: [PATCH] sandbox: Use temporary directory for XDG_RUNTIME_DIR -Content-type: text/plain - -XDG_RUNTIME_DIR (/run/user/$UID) is used for user-specific data files -such as sockets, named pipes and so on. Therefore, it should not be -available to sandboxed processes. - -Usage: - # ls -a $XDG_RUNTIME_DIR - . .. bus pipewire-0 systemd - # sandbox -R /root/sandbox/user -- sh -c "ls -a $XDG_RUNTIME_DIR" - . .. - -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - sandbox/sandbox | 15 ++++++++++++++- - sandbox/sandbox.8 | 7 +++++-- - sandbox/seunshare.8 | 3 +++ - sandbox/seunshare.c | 45 +++++++++++++++++++++++++++++++++++---------- - 4 files changed, 57 insertions(+), 13 deletions(-) - -diff --git a/sandbox/sandbox b/sandbox/sandbox -index ffac70232875..770807345858 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -209,6 +209,7 @@ class Sandbox: - self.__level = None - self.__homedir = None - self.__tmpdir = None -+ self.__runuserdir = None - - def __validate_mount(self): - if self.__options.level: -@@ -357,6 +358,11 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - action="callback", callback=self.__validdir, - help=_("alternate /tmp directory to use for mounting")) - -+ parser.add_option("-R", "--runuserdir", dest="runuserdir", -+ type="string", -+ action="callback", callback=self.__validdir, -+ help=_("alternate XDG_RUNTIME_DIR - /run/user/$UID - directory to use for mounting")) -+ - parser.add_option("-w", "--windowsize", dest="windowsize", - type="string", default=DEFAULT_WINDOWSIZE, - help="size of the sandbox window") -@@ -401,10 +407,12 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - self.__options.X_ind = True - self.__homedir = self.__options.homedir - self.__tmpdir = self.__options.tmpdir -+ self.__runuserdir = self.__options.runuserdir - else: - if self.__options.level: - self.__homedir = self.__options.homedir - self.__tmpdir = self.__options.tmpdir -+ self.__runuserdir = self.__options.runuserdir - - if len(cmds) == 0: - self.usage(_("Command required")) -@@ -442,9 +450,14 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - self.__tmpdir = self.__options.tmpdir - else: - self.__tmpdir = mkdtemp(dir="/tmp", prefix=".sandbox_tmp_") -+ if self.__options.runuserdir: -+ self.__runuserdir = self.__options.runuserdir -+ else: -+ self.__runuserdir = mkdtemp(dir="/tmp", prefix=".sandbox_runuser_") - self.__copyfiles() - selinux.chcon(self.__homedir, self.__filecon, recursive=True) - selinux.chcon(self.__tmpdir, self.__filecon, recursive=True) -+ selinux.chcon(self.__runuserdir, self.__filecon, recursive=True) - selinux.setfscreatecon(None) - - def __execute(self): -@@ -453,7 +466,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - if self.__options.usecaps: - cmds.append('-C') - if self.__mount: -- cmds += ["-t", self.__tmpdir, "-h", self.__homedir] -+ cmds += ["-t", self.__tmpdir, "-h", self.__homedir, "-r", self.__runuserdir] - - if self.__options.X_ind: - if self.__options.dpi: -diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 -index d83fee76f335..1ee0ecea96d1 100644 ---- a/sandbox/sandbox.8 -+++ b/sandbox/sandbox.8 -@@ -3,11 +3,11 @@ - sandbox \- Run cmd under an SELinux sandbox - .SH SYNOPSIS - .B sandbox --[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] cmd -+[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [ \-R runuserdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] cmd - - .br - .B sandbox --[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] \-S -+[\-C] [\-s] [ \-d DPI ] [\-l level ] [[\-M | \-X] \-H homedir \-T tempdir ] [ \-R runuserdir ] [\-I includefile ] [ \-W windowmanager ] [ \-w windowsize ] [[\-i file ]...] [ \-t type ] \-S - .br - .SH DESCRIPTION - .PP -@@ -67,6 +67,9 @@ sandbox_net_client_t \- All network ports - \fB\-T\fR \fB\-\-tmpdir\fR - Use alternate temporary directory to mount on /tmp. Defaults to tmpfs. Requires \-X or \-M. - .TP -+\fB\-R\fR \fB\-\-runuserdir\fR -+Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). -+.TP - \fB\-S\fR \fB\-\-session\fR - Run a full desktop session, Requires level, and home and tmpdir. - .TP -diff --git a/sandbox/seunshare.8 b/sandbox/seunshare.8 -index 0da352613485..09cf7feae45d 100644 ---- a/sandbox/seunshare.8 -+++ b/sandbox/seunshare.8 -@@ -18,6 +18,9 @@ Alternate homedir to be used by the application. Homedir must be owned by the u - \fB\-t\ tmpdir - Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user. - .TP -+\fB\-r\ runuserdir -+Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user. -+.TP - \fB\-C --capabilities\fR - Allow apps executed within the namespace to use capabilities. Default is no capabilities. - .TP -diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c -index dd1d7ddbdc89..1d38ea92b9ae 100644 ---- a/sandbox/seunshare.c -+++ b/sandbox/seunshare.c -@@ -52,7 +52,7 @@ - - #define BUF_SIZE 1024 - #define DEFAULT_PATH "/usr/bin:/bin" --#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z CONTEXT ] -- executable [args] ") -+#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -r runuserdir ] [ -Z CONTEXT ] -- executable [args] ") - - static int verbose = 0; - static int child = 0; -@@ -623,15 +623,20 @@ int main(int argc, char **argv) { - char *homedir_s = NULL; /* homedir spec'd by user in argv[] */ - char *tmpdir_s = NULL; /* tmpdir spec'd by user in argv[] */ - char *tmpdir_r = NULL; /* tmpdir created by seunshare */ -+ char *runuserdir_s = NULL; /* /var/run/user/UID spec'd by user in argv[] */ -+ char *runuserdir_r = NULL; /* /var/run/user/UID created by seunshare */ - - struct stat st_curhomedir; - struct stat st_homedir; - struct stat st_tmpdir_s; - struct stat st_tmpdir_r; -+ struct stat st_runuserdir_s; -+ struct stat st_runuserdir_r; - - const struct option long_options[] = { - {"homedir", 1, 0, 'h'}, - {"tmpdir", 1, 0, 't'}, -+ {"runuserdir", 1, 0, 'r'}, - {"kill", 1, 0, 'k'}, - {"verbose", 1, 0, 'v'}, - {"context", 1, 0, 'Z'}, -@@ -665,7 +670,7 @@ int main(int argc, char **argv) { - } - - while (1) { -- clflag = getopt_long(argc, argv, "Ccvh:t:Z:", long_options, NULL); -+ clflag = getopt_long(argc, argv, "Ccvh:r:t:Z:", long_options, NULL); - if (clflag == -1) - break; - -@@ -679,6 +684,9 @@ int main(int argc, char **argv) { - case 'h': - homedir_s = optarg; - break; -+ case 'r': -+ runuserdir_s = optarg; -+ break; - case 'v': - verbose++; - break; -@@ -729,6 +737,10 @@ int main(int argc, char **argv) { - if (tmpdir_s && ( - verify_directory(tmpdir_s, NULL, &st_tmpdir_s) < 0 || - check_owner_uid(uid, tmpdir_s, &st_tmpdir_s))) return -1; -+ if (runuserdir_s && ( -+ verify_directory(runuserdir_s, NULL, &st_runuserdir_s) < 0 || -+ check_owner_uid(uid, runuserdir_s, &st_runuserdir_s))) return -1; -+ - if ((uid_t)setfsuid(0) != uid) return -1; - - /* create runtime tmpdir */ -@@ -737,6 +749,12 @@ int main(int argc, char **argv) { - fprintf(stderr, _("Failed to create runtime temporary directory\n")); - return -1; - } -+ /* create runtime runuserdir */ -+ if (runuserdir_s && (runuserdir_r = create_tmpdir(runuserdir_s, &st_runuserdir_s, -+ &st_runuserdir_r, pwd, execcon)) == NULL) { -+ fprintf(stderr, _("Failed to create runtime $XDG_RUNTIME_DIR directory\n")); -+ return -1; -+ } - - /* spawn child process */ - child = fork(); -@@ -775,7 +793,21 @@ int main(int argc, char **argv) { - if (check_owner_uid(uid, resolved_path, &st_curhomedir) < 0) - goto childerr; - -- /* mount homedir and tmpdir, in this order */ -+ if ((RUNTIME_DIR = getenv("XDG_RUNTIME_DIR")) != NULL) { -+ if ((RUNTIME_DIR = strdup(RUNTIME_DIR)) == NULL) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ } else { -+ if (asprintf(&RUNTIME_DIR, "/run/user/%d", uid) == -1) { -+ perror(_("Out of memory\n")); -+ goto childerr; -+ } -+ } -+ -+ /* mount homedir, runuserdir and tmpdir, in this order */ -+ if (runuserdir_s && seunshare_mount(runuserdir_s, RUNTIME_DIR, -+ &st_runuserdir_s) != 0) goto childerr; - if (homedir_s && seunshare_mount(homedir_s, resolved_path, - &st_homedir) != 0) goto childerr; - if (tmpdir_s && seunshare_mount(tmpdir_r, "/tmp", -@@ -799,13 +831,6 @@ int main(int argc, char **argv) { - } - } - -- if ((RUNTIME_DIR = getenv("XDG_RUNTIME_DIR")) != NULL) { -- if ((RUNTIME_DIR = strdup(RUNTIME_DIR)) == NULL) { -- perror(_("Out of memory")); -- goto childerr; -- } -- } -- - if ((rc = clearenv()) != 0) { - perror(_("Failed to clear environment")); - goto childerr; --- -2.38.1 - diff --git a/0016-python-Remove-dependency-on-the-Python-module-distut.patch b/0016-python-Remove-dependency-on-the-Python-module-distut.patch deleted file mode 100644 index 81b36c2..0000000 --- a/0016-python-Remove-dependency-on-the-Python-module-distut.patch +++ /dev/null @@ -1,81 +0,0 @@ -From c08cf24f39989cfc610a481ae3dc380b61e9ca5f Mon Sep 17 00:00:00 2001 -From: James Carter -Date: Fri, 28 Oct 2022 16:16:22 -0400 -Subject: [PATCH] python: Remove dependency on the Python module distutils -Content-type: text/plain - -The distutils package is deprecated and scheduled to be removed in -Python 3.12. Use the setuptools and sysconfig modules instead. - -Signed-off-by: James Carter -Acked-by: Petr Lautrbach ---- - python/semanage/Makefile | 2 +- - python/sepolgen/src/sepolgen/Makefile | 2 +- - python/sepolicy/sepolicy/gui.py | 4 ++-- - python/sepolicy/setup.py | 2 +- - 4 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/python/semanage/Makefile b/python/semanage/Makefile -index 024e9640fed0..b53ee33db6ac 100644 ---- a/python/semanage/Makefile -+++ b/python/semanage/Makefile -@@ -5,7 +5,7 @@ LINGUAS ?= ru - PREFIX ?= /usr - SBINDIR ?= $(PREFIX)/sbin - MANDIR = $(PREFIX)/share/man --PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; print(get_python_lib(prefix='$(PREFIX)'))") -+PYTHONLIBDIR ?= $(shell $(PYTHON) -c "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '$(PREFIX)', 'base': '$(PREFIX)'}))") - PACKAGEDIR ?= $(PYTHONLIBDIR) - BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions - -diff --git a/python/sepolgen/src/sepolgen/Makefile b/python/sepolgen/src/sepolgen/Makefile -index cac8def7204e..a10392273181 100644 ---- a/python/sepolgen/src/sepolgen/Makefile -+++ b/python/sepolgen/src/sepolgen/Makefile -@@ -1,6 +1,6 @@ - PREFIX ?= /usr - PYTHON ?= python3 --PYTHONLIBDIR ?= $(shell $(PYTHON) -c "from distutils.sysconfig import *; print(get_python_lib(prefix='$(PREFIX)'))") -+PYTHONLIBDIR ?= $(shell $(PYTHON) -c "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '$(PREFIX)', 'base': '$(PREFIX)'}))") - PACKAGEDIR ?= /$(PYTHONLIBDIR)/sepolgen - - all: -diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py -index 5bdbfebade1d..335be582b668 100644 ---- a/python/sepolicy/sepolicy/gui.py -+++ b/python/sepolicy/sepolicy/gui.py -@@ -77,7 +77,7 @@ def cmp(a, b): - return 1 - return (a > b) - (a < b) - --import distutils.sysconfig -+import sysconfig - ADVANCED_LABEL = (_("Advanced >>"), _("Advanced <<")) - ADVANCED_SEARCH_LABEL = (_("Advanced Search >>"), _("Advanced Search <<")) - OUTBOUND_PAGE = 0 -@@ -130,7 +130,7 @@ class SELinuxGui(): - self.application = app - self.filter_txt = "" - builder = Gtk.Builder() # BUILDER OBJ -- self.code_path = distutils.sysconfig.get_python_lib(plat_specific=False) + "/sepolicy/" -+ self.code_path = sysconfig.get_python_lib(plat_specific=False) + "/sepolicy/" - glade_file = self.code_path + "sepolicy.glade" - builder.add_from_file(glade_file) - self.outer_notebook = builder.get_object("outer_notebook") -diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py -index b0f9650df875..c82206647f9b 100644 ---- a/python/sepolicy/setup.py -+++ b/python/sepolicy/setup.py -@@ -2,7 +2,7 @@ - - # Author: Thomas Liu - # Author: Dan Walsh --from distutils.core import setup -+from setuptools import setup - - setup( - name="sepolicy", --- -2.38.1 - diff --git a/0017-python-Harden-tools-against-rogue-modules.patch b/0017-python-Harden-tools-against-rogue-modules.patch deleted file mode 100644 index 0d2d809..0000000 --- a/0017-python-Harden-tools-against-rogue-modules.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 48602370acabffea96759bf66edd00ca829f5d17 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 18 Oct 2022 22:36:59 +0200 -Subject: [PATCH] python: Harden tools against "rogue" modules -Content-type: text/plain - -Python scripts present in "/usr/sbin" override regular modules. -Make sure /usr/sbin is not present in PYTHONPATH. - -Fixes: - #cat > /usr/sbin/audit.py < -Acked-by: James Carter ---- - python/audit2allow/audit2allow | 2 +- - python/audit2allow/sepolgen-ifgen | 2 +- - python/chcat/chcat | 2 +- - python/semanage/semanage | 2 +- - python/sepolicy/sepolicy.py | 2 +- - 5 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow -index 09b06f664bc4..eafeea88aa21 100644 ---- a/python/audit2allow/audit2allow -+++ b/python/audit2allow/audit2allow -@@ -1,4 +1,4 @@ --#!/usr/bin/python3 -Es -+#!/usr/bin/python3 -EsI - # Authors: Karl MacMillan - # Authors: Dan Walsh - # -diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen -index b7a04c719acc..f2cc0c32f2b0 100644 ---- a/python/audit2allow/sepolgen-ifgen -+++ b/python/audit2allow/sepolgen-ifgen -@@ -1,4 +1,4 @@ --#!/usr/bin/python3 -Es -+#!/usr/bin/python3 -EsI - # - # Authors: Karl MacMillan - # -diff --git a/python/chcat/chcat b/python/chcat/chcat -index 952cb8187599..68718ec5f102 100755 ---- a/python/chcat/chcat -+++ b/python/chcat/chcat -@@ -1,4 +1,4 @@ --#!/usr/bin/python3 -Es -+#!/usr/bin/python3 -EsI - # Copyright (C) 2005 Red Hat - # see file 'COPYING' for use and warranty information - # -diff --git a/python/semanage/semanage b/python/semanage/semanage -index 10ab3fa67d7f..b21d1484ab85 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -1,4 +1,4 @@ --#!/usr/bin/python3 -Es -+#!/usr/bin/python3 -EsI - # Copyright (C) 2012-2013 Red Hat - # AUTHOR: Miroslav Grepl - # AUTHOR: David Quigley -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index c7a70e094b0c..733d40484709 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -1,4 +1,4 @@ --#!/usr/bin/python3 -Es -+#!/usr/bin/python3 -EsI - # Copyright (C) 2012 Red Hat - # AUTHOR: Dan Walsh - # see file 'COPYING' for use and warranty information --- -2.38.1 - diff --git a/0023-python-Fix-typo-in-audit2allow.1-example.patch b/0023-python-Fix-typo-in-audit2allow.1-example.patch deleted file mode 100644 index 31b0081..0000000 --- a/0023-python-Fix-typo-in-audit2allow.1-example.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 5e9f9478cc6eeaa46e0e8172a458a49e49d4e258 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 9 Nov 2022 11:53:28 +0100 -Subject: [PATCH] python: Fix typo in audit2allow.1 example -Content-type: text/plain - -Signed-off-by: Petr Lautrbach -Acked-by: James Carter ---- - python/audit2allow/audit2allow.1 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/audit2allow/audit2allow.1 b/python/audit2allow/audit2allow.1 -index c61067b33688..04ec32398011 100644 ---- a/python/audit2allow/audit2allow.1 -+++ b/python/audit2allow/audit2allow.1 -@@ -151,7 +151,7 @@ policy_module(local, 1.0) - gen_require(` - type myapp_t; - type etc_t; -- }; -+\[aq]) - - files_read_etc_files(myapp_t) - --- -2.38.1 - diff --git a/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch b/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch deleted file mode 100644 index 97a224e..0000000 --- a/0024-python-sepolicy-Fix-sepolicy-manpage-w.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 762090ae1a67b040b37cc4863f1ceb0b45c66717 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 18 Nov 2022 13:51:52 +0100 -Subject: [PATCH] python/sepolicy: Fix sepolicy manpage -w ... -Content-type: text/plain - -Commit 7494bb1298b3 ("sepolicy: generate man pages in parallel") -improved sepolicy performance but broke `sepolicy manpage -w ...` as it -didn't collect data about domains and roles from ManPage() and so -HTMLManPages() generated only empty page. This is fixed now, domains -and roles are being collected and used for HTML pages. - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy.py | 13 +++++++++++-- - python/sepolicy/sepolicy/manpage.py | 12 +++++------- - 2 files changed, 16 insertions(+), 9 deletions(-) - -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index 733d40484709..82ff6af2bc2d 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -332,9 +332,10 @@ def manpage_work(domain, path, root, source_files, web): - from sepolicy.manpage import ManPage - m = ManPage(domain, path, root, source_files, web) - print(m.get_man_page_path()) -+ return (m.manpage_domains, m.manpage_roles) - - def manpage(args): -- from sepolicy.manpage import HTMLManPages, manpage_domains, manpage_roles, gen_domains -+ from sepolicy.manpage import HTMLManPages, gen_domains - - path = args.path - if not args.policy and args.root != "/": -@@ -347,9 +348,17 @@ def manpage(args): - else: - test_domains = args.domain - -+ manpage_domains = set() -+ manpage_roles = set() - p = Pool() -+ async_results = [] - for domain in test_domains: -- p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web]) -+ async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) -+ for result in async_results: -+ domains, roles = result.get() -+ manpage_domains.update(domains) -+ manpage_roles.update(roles) -+ - p.close() - p.join() - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index 3e61e333193f..de72cb6cda5f 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -21,7 +21,7 @@ - # 02111-1307 USA - # - # --__all__ = ['ManPage', 'HTMLManPages', 'manpage_domains', 'manpage_roles', 'gen_domains'] -+__all__ = ['ManPage', 'HTMLManPages', 'gen_domains'] - - import string - import selinux -@@ -147,10 +147,6 @@ def _gen_types(): - def prettyprint(f, trim): - return " ".join(f[:-len(trim)].split("_")) - --# for HTML man pages --manpage_domains = [] --manpage_roles = [] -- - fedora_releases = ["Fedora17", "Fedora18"] - rhel_releases = ["RHEL6", "RHEL7"] - -@@ -408,6 +404,8 @@ class ManPage: - """ - modules_dict = None - enabled_str = ["Disabled", "Enabled"] -+ manpage_domains = [] -+ manpage_roles = [] - - def __init__(self, domainname, path="/tmp", root="/", source_files=False, html=False): - self.html = html -@@ -453,10 +451,10 @@ class ManPage: - if self.domainname + "_r" in self.all_roles: - self.__gen_user_man_page() - if self.html: -- manpage_roles.append(self.man_page_path) -+ self.manpage_roles.append(self.man_page_path) - else: - if self.html: -- manpage_domains.append(self.man_page_path) -+ self.manpage_domains.append(self.man_page_path) - self.__gen_man_page() - self.fd.close() - --- -2.38.1 - diff --git a/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch b/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch deleted file mode 100644 index 606207b..0000000 --- a/0025-python-sepolicy-Use-distro-module-to-get-os-version.patch +++ /dev/null @@ -1,57 +0,0 @@ -From fe825bf76f7a6727a3654c96e7bc55ddc7069b76 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 18 Nov 2022 13:51:53 +0100 -Subject: [PATCH] python/sepolicy: Use distro module to get os version -Content-type: text/plain - -distro module uses /etc/os-release file which contains operating system -identification data, see os-release(5). Given that the mechanism doesn't -use `rpm` it should be possible to generate man pages on other -distributions. - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/__init__.py | 25 ++++++------------------- - 1 file changed, 6 insertions(+), 19 deletions(-) - -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index 9c3caa05b80b..baa4c8e62e97 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -1226,27 +1226,14 @@ def boolean_desc(boolean): - - - def get_os_version(): -- os_version = "" -- pkg_name = "selinux-policy" -+ system_release = "" - try: -- try: -- from commands import getstatusoutput -- except ImportError: -- from subprocess import getstatusoutput -- rc, output = getstatusoutput("rpm -q '%s'" % pkg_name) -- if rc == 0: -- os_version = output.split(".")[-2] -- except: -- os_version = "" -- -- if os_version[0:2] == "fc": -- os_version = "Fedora" + os_version[2:] -- elif os_version[0:2] == "el": -- os_version = "RHEL" + os_version[2:] -- else: -- os_version = "" -+ import distro -+ system_release = distro.name(pretty=True) -+ except IOError: -+ system_release = "Misc" - -- return os_version -+ return system_release - - - def reinit(): --- -2.38.1 - diff --git a/0026-python-sepolicy-Simplify-generation-of-man-pages.patch b/0026-python-sepolicy-Simplify-generation-of-man-pages.patch deleted file mode 100644 index 1835db5..0000000 --- a/0026-python-sepolicy-Simplify-generation-of-man-pages.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 1fad73e62fdda5290e3939464df09796fca6871d Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 18 Nov 2022 13:51:55 +0100 -Subject: [PATCH] python/sepolicy: Simplify generation of man pages -Content-type: text/plain - -And do not hardcode Fedora and RHEL versions. - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/manpage.py | 71 ++++------------------------- - 1 file changed, 8 insertions(+), 63 deletions(-) - -diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py -index de72cb6cda5f..edeb3b77e759 100755 ---- a/python/sepolicy/sepolicy/manpage.py -+++ b/python/sepolicy/sepolicy/manpage.py -@@ -147,9 +147,6 @@ def _gen_types(): - def prettyprint(f, trim): - return " ".join(f[:-len(trim)].split("_")) - --fedora_releases = ["Fedora17", "Fedora18"] --rhel_releases = ["RHEL6", "RHEL7"] -- - - def get_alphabet_manpages(manpage_list): - alphabet_manpages = dict.fromkeys(string.ascii_letters, []) -@@ -180,7 +177,7 @@ def convert_manpage_to_html(html_manpage, manpage): - class HTMLManPages: - - """ -- Generate a HHTML Manpages on an given SELinux domains -+ Generate a HTML Manpages on an given SELinux domains - """ - - def __init__(self, manpage_roles, manpage_domains, path, os_version): -@@ -188,18 +185,12 @@ class HTMLManPages: - self.manpage_domains = get_alphabet_manpages(manpage_domains) - self.os_version = os_version - self.old_path = path + "/" -- self.new_path = self.old_path + self.os_version + "/" -- -- if self.os_version in fedora_releases or self.os_version in rhel_releases: -- self.__gen_html_manpages() -- else: -- print("SELinux HTML man pages can not be generated for this %s" % os_version) -- exit(1) -+ self.new_path = self.old_path -+ self.__gen_html_manpages() - - def __gen_html_manpages(self): - self._write_html_manpage() - self._gen_index() -- self._gen_body() - self._gen_css() - - def _write_html_manpage(self): -@@ -217,67 +208,21 @@ class HTMLManPages: - convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r) - - def _gen_index(self): -- index = self.old_path + "index.html" -- fd = open(index, 'w') -- fd.write(""" -- -- -- -- SELinux man pages online -- -- --

SELinux man pages

--

--Fedora or Red Hat Enterprise Linux Man Pages. --

--
--

Fedora

-- -- --
--
--
--""")
--        for f in fedora_releases:
--            fd.write("""
--%s - SELinux man pages for %s """ % (f, f, f, f))
--
--        fd.write("""
--
--
--

RHEL

-- -- --
--
--
--""")
--        for r in rhel_releases:
--            fd.write("""
--%s - SELinux man pages for %s """ % (r, r, r, r))
--
--        fd.write("""
--
-- """) -- fd.close() -- print("%s has been created" % index) -- -- def _gen_body(self): -- html = self.new_path + self.os_version + ".html" -+ html = self.new_path + "index.html" - fd = open(html, 'w') - fd.write(""" - - -- -- Linux man-pages online for Fedora18 -+ -+ SELinux man pages - - --

SELinux man pages for Fedora18

-+

SELinux man pages for %s

-
- -
-

SELinux roles

--""") -+""" % self.os_version) - for letter in self.manpage_roles: - if len(self.manpage_roles[letter]): - fd.write(""" --- -2.38.1 - diff --git a/0027-Fix-E275-missing-whitespace-after-keyword.patch b/0027-Fix-E275-missing-whitespace-after-keyword.patch deleted file mode 100644 index e86d3c6..0000000 --- a/0027-Fix-E275-missing-whitespace-after-keyword.patch +++ /dev/null @@ -1,160 +0,0 @@ -From 3fb03f54d0dad5119cdd3e1d2b13370b8296040b Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 21 Nov 2022 11:39:32 +0100 -Subject: [PATCH] Fix E275 missing whitespace after keyword -Content-type: text/plain - -Fixes: - ./gui/polgengui.py:484:18: E275 missing whitespace after keyword - ./gui/polgengui.py:530:18: E275 missing whitespace after keyword - ./python/sepolgen/src/sepolgen/policygen.py:327:19: E275 missing whitespace after keyword - ./python/sepolgen/src/sepolgen/policygen.py:329:11: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/__init__.py:453:15: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/generate.py:1351:28: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/generate.py:1353:28: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/gui.py:638:24: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/gui.py:863:23: E275 missing whitespace after keyword - ./python/sepolicy/sepolicy/gui.py:2177:16: E275 missing whitespace after keyword - ./sandbox/sandbox:114:7: E275 missing whitespace after keyword - ./sandbox/sandbox:134:11: E275 missing whitespace after keyword - ./sandbox/sandbox:136:7: E275 missing whitespace after keyword - -Signed-off-by: Petr Lautrbach ---- - gui/polgengui.py | 4 ++-- - python/sepolgen/src/sepolgen/policygen.py | 4 ++-- - python/sepolicy/sepolicy/__init__.py | 4 ++-- - python/sepolicy/sepolicy/generate.py | 4 ++-- - python/sepolicy/sepolicy/gui.py | 6 +++--- - sandbox/sandbox | 6 +++--- - 6 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/gui/polgengui.py b/gui/polgengui.py -index 7a3ecd50c91c..16116ba68b61 100644 ---- a/gui/polgengui.py -+++ b/gui/polgengui.py -@@ -481,7 +481,7 @@ class childWindow: - my_policy = sepolicy.generate.policy(self.get_name(), self.get_type()) - - iter = self.boolean_store.get_iter_first() -- while(iter): -+ while iter: - my_policy.add_boolean(self.boolean_store.get_value(iter, 0), self.boolean_store.get_value(iter, 1)) - iter = self.boolean_store.iter_next(iter) - -@@ -527,7 +527,7 @@ class childWindow: - my_policy.set_out_udp(self.out_udp_all_checkbutton.get_active(), self.out_udp_entry.get_text()) - - iter = self.store.get_iter_first() -- while(iter): -+ while iter: - if self.store.get_value(iter, 1) == FILE: - my_policy.add_file(self.store.get_value(iter, 0)) - else: -diff --git a/python/sepolgen/src/sepolgen/policygen.py b/python/sepolgen/src/sepolgen/policygen.py -index 8f0ce26e4dc7..183b41a93d50 100644 ---- a/python/sepolgen/src/sepolgen/policygen.py -+++ b/python/sepolgen/src/sepolgen/policygen.py -@@ -324,9 +324,9 @@ def call_interface(interface, av): - ifcall.args.append(av.obj_class) - else: - print(params[i].type) -- assert(0) -+ assert 0 - -- assert(len(ifcall.args) > 0) -+ assert len(ifcall.args) > 0 - - return ifcall - -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index baa4c8e62e97..68907a4f9759 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -450,9 +450,9 @@ def get_conditionals(src, dest, tclass, perm): - tlist.append(tdict) - tdict = {} - except KeyError: -- return(tlist) -+ return tlist - -- return (tlist) -+ return tlist - - - def get_conditionals_format_text(cond): -diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index eff3a8973917..36a3ea1196b1 100644 ---- a/python/sepolicy/sepolicy/generate.py -+++ b/python/sepolicy/sepolicy/generate.py -@@ -1348,9 +1348,9 @@ allow %s_t %s_t:%s_socket name_%s; - if len(temp_dirs) != 0: - for i in temp_dirs: - if i in self.dirs.keys(): -- del(self.dirs[i]) -+ del self.dirs[i] - elif i in self.files.keys(): -- del(self.files[i]) -+ del self.files[i] - else: - continue - -diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py -index 335be582b668..c8f33f522a2d 100644 ---- a/python/sepolicy/sepolicy/gui.py -+++ b/python/sepolicy/sepolicy/gui.py -@@ -635,7 +635,7 @@ class SELinuxGui(): - for k in self.cur_dict: - for j in self.cur_dict[k]: - if i == ctr: -- del(self.cur_dict[k][j]) -+ del self.cur_dict[k][j] - return - i += 1 - -@@ -860,7 +860,7 @@ class SELinuxGui(): - if val is True or val is False or val is None: - continue - # Returns true if filter_txt exists within the val -- if(val.find(self.filter_txt) != -1 or val.lower().find(self.filter_txt) != -1): -+ if val.find(self.filter_txt) != -1 or val.lower().find(self.filter_txt) != -1: - return True - except (AttributeError, TypeError): - pass -@@ -2174,7 +2174,7 @@ class SELinuxGui(): - model.set_value(iter, 0, not model.get_value(iter, 0)) - active = model.get_value(iter, 0) - if name in self.cur_dict["boolean"]: -- del(self.cur_dict["boolean"][name]) -+ del self.cur_dict["boolean"][name] - else: - self.cur_dict["boolean"][name] = {"active": active} - self.new_updates() -diff --git a/sandbox/sandbox b/sandbox/sandbox -index df3af9260c7f..a32a33ea3cf6 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -111,7 +111,7 @@ def copyfile(file, srcdir, dest): - - def savefile(new, orig, X_ind): - copy = False -- if(X_ind): -+ if X_ind: - import gi - gi.require_version('Gtk', '3.0') - from gi.repository import Gtk -@@ -131,9 +131,9 @@ def savefile(new, orig, X_ind): - except NameError: - pass - ans = input(_("Do you want to save changes to '%s' (y/N): ") % orig) -- if(re.match(_("[yY]"), ans)): -+ if re.match(_("[yY]"), ans): - copy = True -- if(copy): -+ if copy: - shutil.copy2(new, orig) - - --- -2.38.1 - diff --git a/policycoreutils.spec b/policycoreutils.spec index 0908756..3fa7f23 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.4-4 -%global libsemanagever 3.4-6 -%global libselinuxver 3.4-6 +%global libsepolver 3.5-0 +%global libsemanagever 3.5-0 +%global libselinuxver 3.5-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,11 +10,11 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.4 -Release: 7.1%{?dist} +Version: 3.5 +Release: 0.rc1.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc1/selinux-3.5-rc1.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,36 +28,14 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.4 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.5-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-libselinux-declare-return-value-of-context_str-3-con.patch -Patch0002: 0002-semodule-avoid-toctou-on-output-module.patch -Patch0003: 0003-python-Split-semanage-import-into-two-transactions.patch -Patch0004: 0004-python-audit2allow-close-file-stream-on-error.patch -Patch0005: 0005-gettext-handle-unsupported-languages-properly.patch -Patch0006: 0006-semodule-rename-rebuild-if-modules-changed-to-refres.patch -Patch0007: 0007-python-remove-IOError-in-certain-cases.patch -Patch0008: 0008-restorecond-use-strict-function-prototype-for-defini.patch -Patch0009: 0009-Ignore-egg-info-directories-and-clean-them.patch -# Patch0010: 0010-Update-translations.patch -Patch0011: 0011-docs-provide-a-top-level-LICENSE-file.patch -Patch0012: 0012-gui-Fix-export-file-chooser-dialog.patch -Patch0013: 0013-python-Do-not-query-the-local-database-if-the-fconte.patch -Patch0014: 0014-sandbox-Do-not-try-to-remove-tmpdir-twice-if-uid-0.patch -Patch0015: 0015-sandbox-Use-temporary-directory-for-XDG_RUNTIME_DIR.patch -Patch0016: 0016-python-Remove-dependency-on-the-Python-module-distut.patch -Patch0017: 0017-python-Harden-tools-against-rogue-modules.patch -Patch0018: 0018-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch -Patch0019: 0019-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0020: 0020-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0021: 0021-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0022: 0022-Use-SHA-2-instead-of-SHA-1.patch -Patch0023: 0023-python-Fix-typo-in-audit2allow.1-example.patch -Patch0024: 0024-python-sepolicy-Fix-sepolicy-manpage-w.patch -Patch0025: 0025-python-sepolicy-Use-distro-module-to-get-os-version.patch -Patch0026: 0026-python-sepolicy-Simplify-generation-of-man-pages.patch -Patch0027: 0027-Fix-E275-missing-whitespace-after-keyword.patch +Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -70,7 +48,7 @@ Provides: /sbin/restorecon BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel dbus-glib-devel -BuildRequires: python3-devel python3-setuptools +BuildRequires: python3-devel python3-setuptools python3-pip BuildRequires: systemd BuildRequires: git-core Requires: util-linux grep gawk diffutils rpm sed @@ -93,7 +71,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -n selinux-%{version} -p 1 +%autosetup -p 1 -n selinux-%{version}-rc1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -106,7 +84,7 @@ tar -xvf %{SOURCE14} -C python/sepolicy/ # tar -x -f %{SOURCE20} -C policycoreutils -z # tar -x -f %{SOURCE21} -C python -z # tar -x -f %{SOURCE22} -C gui -z -tar -x -f %{SOURCE23} -C sandbox -z +# tar -x -f %{SOURCE23} -C sandbox -z %build %set_build_flags @@ -486,6 +464,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Dec 23 2022 Petr Lautrbach - 3.5-0.rc1.1 +- SELinux userspace 3.5-rc1 release + * Mon Nov 21 2022 Petr Lautrbach - 3.4-7.1 - Rebase on upstream f56a72ac9e86 - sepolicy: fix sepolicy manpage -w diff --git a/sources b/sources index c617bc5..487300c 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.4.tar.gz) = 9b619f6b2c632cc5cfebf5e9a9c1aa4130ef1efe9b85954d5a9da4f7a9bc15e82b9efcb4aa9c7ba2e16bac79cf116163a5d4d9cb7cbba3c96c88e01509bd60ab +SHA512 (selinux-3.5-rc1.tar.gz) = 82643c99343088c7eb7d96ba9f77d463b15bd900e24f6cdb8a9730ee12db7b87d143da4bb2c706514bc2c3de3e864bc68e13e639212bd1b53acee0f0b562618f From 9bbf1ed093f3524454ef78172a6bed301f1846f9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 27 Dec 2022 11:20:38 +0100 Subject: [PATCH 21/79] Drop pathfix All necessary changes were applied upstream. --- policycoreutils.spec | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 3fa7f23..8195fe0 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -143,27 +143,6 @@ install -m 644 -p %{SOURCE18} %{buildroot}/%{_unitdir}/ install -m 755 -p %{SOURCE19} %{buildroot}/%{generatorsdir}/ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ -# change /usr/bin/python to %%{__python3} in policycoreutils-python3 -%{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i "%{__python3} -Es" -p %{buildroot}%{python3_sitelib} - -# change /usr/bin/python to %%{__python3} in policycoreutils-python-utils -%{__python3} %{_rpmconfigdir}/redhat/pathfix.py -i "%{__python3} -Es" -p \ - %{buildroot}%{_sbindir}/semanage \ - %{buildroot}%{_bindir}/chcat \ - %{buildroot}%{_bindir}/sandbox \ - %{buildroot}%{_datadir}/sandbox/start \ - %{buildroot}%{_bindir}/audit2allow \ - %{buildroot}%{_bindir}/sepolicy \ - %{buildroot}%{_bindir}/sepolgen-ifgen \ - %{buildroot}%{_datadir}/system-config-selinux/system-config-selinux.py \ - %{buildroot}%{_datadir}/system-config-selinux/selinux_server.py \ - %nil - -# clean up ~ files from pathfix - https://bugzilla.redhat.com/show_bug.cgi?id=1546990 -find %{buildroot}%{python3_sitelib} %{buildroot}%{python3_sitearch} \ - %{buildroot}%{_sbindir} %{buildroot}%{_bindir} %{buildroot}%{_datadir} \ - -type f -name '*~' | xargs rm -f - # Manually invoke the python byte compile macro for each path that needs byte # compilation. %py_byte_compile %{__python3} %{buildroot}%{_datadir}/system-config-selinux From 9006a129ff3c848a246c17c9b6bf0c114b950f3b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 16 Jan 2023 11:58:15 +0100 Subject: [PATCH 22/79] SELinux userspace 3.5-rc2 release --- .gitignore | 1 + policycoreutils.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index ed061bc..eafec1a 100644 --- a/.gitignore +++ b/.gitignore @@ -345,3 +345,4 @@ policycoreutils-2.0.83.tgz /selinux-3.4-rc3.tar.gz /selinux-3.4.tar.gz /selinux-3.5-rc1.tar.gz +/selinux-3.5-rc2.tar.gz diff --git a/policycoreutils.spec b/policycoreutils.spec index 8195fe0..f4c12ad 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.5-0 -%global libsemanagever 3.5-0 -%global libselinuxver 3.5-0 +%global libsepolver 3.5-0.rc2 +%global libsemanagever 3.5-0.rc2 +%global libselinuxver 3.5-0.rc2 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc1.1%{?dist} +Release: 0.rc2.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc1/selinux-3.5-rc1.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc2/selinux-3.5-rc2.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.5-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.5-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -71,7 +71,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version}-rc1 +%autosetup -p 1 -n selinux-%{version}-rc2 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -443,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Jan 16 2023 Petr Lautrbach - 3.5-0.rc2.1 +- SELinux userspace 3.5-rc2 release + * Fri Dec 23 2022 Petr Lautrbach - 3.5-0.rc1.1 - SELinux userspace 3.5-rc1 release diff --git a/sources b/sources index 487300c..c7e4e16 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.5-rc1.tar.gz) = 82643c99343088c7eb7d96ba9f77d463b15bd900e24f6cdb8a9730ee12db7b87d143da4bb2c706514bc2c3de3e864bc68e13e639212bd1b53acee0f0b562618f +SHA512 (selinux-3.5-rc2.tar.gz) = 1b4ac2527b76858886c975dbaaae0ee8e30412f63d5c9b0996abf74c215697c4b8faeef4191e46f3faee427e4c96344a064faddaaeacec8e8a54956b3747700a From a1ed6da384a55aa0d3bee6f9ef97255c8ddfe02d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 10:02:43 +0000 Subject: [PATCH 23/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index f4c12ad..2d95789 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc2.1%{?dist} +Release: 0.rc2.1%{?dist}.1 License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc2/selinux-3.5-rc2.tar.gz @@ -443,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 3.5-0.rc2.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Mon Jan 16 2023 Petr Lautrbach - 3.5-0.rc2.1 - SELinux userspace 3.5-rc2 release From 05a6b63e4d35cd482416b1eafee59215a0d17580 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 20 Jan 2023 15:52:53 +0100 Subject: [PATCH 24/79] Update README.translations for use with Weblate Signed-off-by: Vit Mojzis --- README.translations | 50 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/README.translations b/README.translations index 813fe15..b6b5a66 100644 --- a/README.translations +++ b/README.translations @@ -1 +1,49 @@ -See https://src.fedoraproject.org/rpms/setroubleshoot/blob/rawhide/f/README.translations +SELinux translations currently live in the following locations: + +- https://translate.fedoraproject.org/projects/selinux/ + - contains 2 versions of translatable strings rhel8 (latest RHEL 8 release) and main (Fedora and RHEL 9) + - maintains large number of languages (several of which do not actually contain any translated strings) + - updated by community and partially by RH localization effort + +- SELinux source repositories (periodicaly updated from weblate) + - https://github.com/fedora-selinux/selinux + - used for Fedora, latest CentOS and RHEL 9 + - https://github.com/SELinuxProject/selinux + - upstream repository + +How to update source files on weblate: + $ git clone git@github.com:fedora-selinux/selinux.git + $ cd selinux + # generate new potfiles + $ for p in policycoreutils python gui sandbox; do + cd $p/po + rm $p.pot + make $p.pot + sed -i 's/charset=CHARSET/charset=UTF-8/g' $p.pot + cd - + done + # https://translate.fedoraproject.org/projects/selinux/policycoreutils/en/ + # Files -> Upload translations + # Repeat the process for python, gui and sandbox + # or use weblate command line tool (get your API key at https://translate.fedoraproject.org/accounts/profile/#api): + $ for p in policycoreutils python gui sandbox; do + wlc --key --url https://translate.fedoraproject.org/api/ upload --input $p/po/$p.pot selinux/$p/en --method=source + done + +How to pull new translations from weblate + $ git clone git@github.com:fedora-selinux/selinux.git + # https://translate.fedoraproject.org/projects/selinux/policycoreutils + # Files -> Download translation files as ZIP file (save in selinux source directory) + # Repeat the process for python, gui and sandbox + # or use weblate command line tool + $ for p in policycoreutils python gui sandbox; do + wlc --key --url https://translate.fedoraproject.org/api/ download selinux/$p --output selinux + done + # unzip archives + $ cd selinux + $ for p in policycoreutils python gui sandbox; do + unzip -o selinux-$p.zip -d .. + rm selinux-$p.zip + done + $ git add . + $ git commit From df8ecd9392435bafe8b11eefbd149da060f62f07 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 26 Jan 2023 19:18:04 +0100 Subject: [PATCH 25/79] policycoreutils-3.5-0.rc2.2 - python/sepolicy: Cache conditional rule queries --- ...olicy-Cache-conditional-rule-queries.patch | 73 +++++++++++++++++++ policycoreutils.spec | 6 +- 2 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 0006-python-sepolicy-Cache-conditional-rule-queries.patch diff --git a/0006-python-sepolicy-Cache-conditional-rule-queries.patch b/0006-python-sepolicy-Cache-conditional-rule-queries.patch new file mode 100644 index 0000000..e6f9ab5 --- /dev/null +++ b/0006-python-sepolicy-Cache-conditional-rule-queries.patch @@ -0,0 +1,73 @@ +From d2c08d621bf8fb3bfaa4460c31d7189a20fcb9a5 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 24 Jan 2023 21:05:05 +0100 +Subject: [PATCH] python/sepolicy: Cache conditional rule queries + +Commit 7506771e4b630fe0ab853f96574e039055cb72eb +"add missing booleans to man pages" dramatically slowed down +"sepolicy manpage -a" by removing caching of setools rule query. +Re-add said caching and update the query to only return conditional +rules. + +Before commit 7506771e: + #time sepolicy manpage -a + real 1m43.153s + # time sepolicy manpage -d httpd_t + real 0m4.493s + +After commit 7506771e: + #time sepolicy manpage -a + real 1h56m43.153s + # time sepolicy manpage -d httpd_t + real 0m8.352s + +After this commit: + #time sepolicy manpage -a + real 1m41.074s + # time sepolicy manpage -d httpd_t + real 0m7.358s + +Signed-off-by: Vit Mojzis +--- + python/sepolicy/sepolicy/__init__.py | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py +index e2d5c11a..c177cdfc 100644 +--- a/python/sepolicy/sepolicy/__init__.py ++++ b/python/sepolicy/sepolicy/__init__.py +@@ -125,6 +125,7 @@ all_attributes = None + booleans = None + booleans_dict = None + all_allow_rules = None ++all_bool_rules = None + all_transitions = None + + +@@ -1136,6 +1137,14 @@ def get_all_allow_rules(): + all_allow_rules = search([ALLOW]) + return all_allow_rules + ++def get_all_bool_rules(): ++ global all_bool_rules ++ if not all_bool_rules: ++ q = TERuleQuery(_pol, boolean=".*", boolean_regex=True, ++ ruletype=[ALLOW, DONTAUDIT]) ++ all_bool_rules = [_setools_rule_to_dict(x) for x in q.results()] ++ return all_bool_rules ++ + def get_all_transitions(): + global all_transitions + if not all_transitions: +@@ -1146,7 +1155,7 @@ def get_bools(setype): + bools = [] + domainbools = [] + domainname, short_name = gen_short_name(setype) +- for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))): ++ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, get_all_bool_rules())): + for b in i: + if not isinstance(b, tuple): + continue +-- +2.37.3 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 2d95789..d8eaebf 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc2.1%{?dist}.1 +Release: 0.rc2.2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc2/selinux-3.5-rc2.tar.gz @@ -36,6 +36,7 @@ Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch +Patch0006: 0006-python-sepolicy-Cache-conditional-rule-queries.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -443,6 +444,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Jan 26 2023 Vit Mojzis - 3.5-0.rc2.2 +- python/sepolicy: Cache conditional rule queries + * Fri Jan 20 2023 Fedora Release Engineering - 3.5-0.rc2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 0d980e2bffdb95f50799837ad0f3d36f7aaccc5d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 8 Feb 2023 11:27:20 +0100 Subject: [PATCH 26/79] Use StandardInput=tty when AUTORELABEL=0 selinux-autorelabel service can be configured to drop to a shell to allow administrator to manually relabel a filesystem, see selinux_config(5). In this case, the service needs to have a tty attached to stdin. Given that tty should not be attached to the service by default, see https://bugzilla.redhat.com/show_bug.cgi?id=1634661 , the selinux-autorelabel-generator.sh will configure the service to attach tty only if AUTORELABEL=0 Resolves: rhbz#2165508 --- selinux-autorelabel-generator.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/selinux-autorelabel-generator.sh b/selinux-autorelabel-generator.sh index be60487..d9380b8 100644 --- a/selinux-autorelabel-generator.sh +++ b/selinux-autorelabel-generator.sh @@ -18,6 +18,15 @@ fi set_target () { ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target" + AUTORELABEL="1" + source /etc/selinux/config + if [ "$AUTORELABEL" = "0" ]; then + mkdir -p "$earlydir/selinux-autorelabel.service.d" + cat > "$earlydir/selinux-autorelabel.service.d/tty.conf" < Date: Wed, 8 Feb 2023 11:35:14 +0100 Subject: [PATCH 27/79] policycoreutils-3.5-0.rc2.3 - Attach tty to selinux-autorelabel.service when AUTORELABEL=0 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index d8eaebf..97ff718 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc2.2%{?dist} +Release: 0.rc2.3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc2/selinux-3.5-rc2.tar.gz @@ -444,6 +444,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed Feb 8 2023 Petr Lautrbach - 3.5-0.rc2.3 +- Attach tty to selinux-autorelabel.service when AUTORELABEL=0 + * Thu Jan 26 2023 Vit Mojzis - 3.5-0.rc2.2 - python/sepolicy: Cache conditional rule queries From 80ecbcb7eab87adc12619aec7794630ee0cdbda1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 13 Feb 2023 17:01:45 +0100 Subject: [PATCH 28/79] SELinux userspace 3.5-rc3 release --- .gitignore | 1 + ...t-to-Xephyr-as-it-works-better-with-.patch | 4 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 4 +- 0005-Use-SHA-2-instead-of-SHA-1.patch | 4 +- ...olicy-Cache-conditional-rule-queries.patch | 73 ------------------- policycoreutils.spec | 18 +++-- sources | 2 +- 9 files changed, 22 insertions(+), 92 deletions(-) delete mode 100644 0006-python-sepolicy-Cache-conditional-rule-queries.patch diff --git a/.gitignore b/.gitignore index eafec1a..d9e6250 100644 --- a/.gitignore +++ b/.gitignore @@ -346,3 +346,4 @@ policycoreutils-2.0.83.tgz /selinux-3.4.tar.gz /selinux-3.5-rc1.tar.gz /selinux-3.5-rc2.tar.gz +/selinux-3.5-rc3.tar.gz diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index c3026ad..b166f5d 100644 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,4 +1,4 @@ -From 55bc2013b480f5a33803f4b41505ac2a535d2bdf Mon Sep 17 00:00:00 2001 +From eabd9ffb34666ef467106ef10d8a0e98bbe35f79 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in @@ -23,5 +23,5 @@ index eaa500d08143..4774528027ef 100644 cat > ~/seremote << __EOF #!/bin/sh -- -2.38.1 +2.39.1 diff --git a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index 0215797..e38c3d0 100644 --- a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From c803df861395e181ed7476df10c04a5ed0dfcdd8 Mon Sep 17 00:00:00 2001 +From 4affa1d7888b8489058d2942ea4431ff65f2430e Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -21,5 +21,5 @@ index 166af6f360a2..ebe64563c7d7 100755 THREADS="" RPMFILES="" -- -2.38.1 +2.39.1 diff --git a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch index 13cf6c9..0d3a253 100644 --- a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From fb3038c1159ce6bb5094bc2f9feb48554ec8081e Mon Sep 17 00:00:00 2001 +From dbebbe4ff79fe790425ca8740e5ace54396671f2 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index b6df3e91160b..36a3ea1196b1 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.38.1 +2.39.1 diff --git a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 402e931..3b29996 100644 --- a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 09bf2a4318b44c895ea68d13988cb5c3dfa119ba Mon Sep 17 00:00:00 2001 +From 42b676e7677d4efe5383558afb3de962948f7a1d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -71,5 +71,5 @@ index 4774528027ef..c211ebc14549 100644 export DISPLAY=:$D cat > ~/seremote << __EOF -- -2.38.1 +2.39.1 diff --git a/0005-Use-SHA-2-instead-of-SHA-1.patch b/0005-Use-SHA-2-instead-of-SHA-1.patch index 9808935..518980e 100644 --- a/0005-Use-SHA-2-instead-of-SHA-1.patch +++ b/0005-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 7fb581c76b547b20a149c6dad3d7c51075192bd8 Mon Sep 17 00:00:00 2001 +From 74e2d05df2ed090909c0ac6fd7ff7816b94d83ce Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -294,5 +294,5 @@ index bf26e161a71d..36fe6b369548 100644 and provided the .B \-n -- -2.38.1 +2.39.1 diff --git a/0006-python-sepolicy-Cache-conditional-rule-queries.patch b/0006-python-sepolicy-Cache-conditional-rule-queries.patch deleted file mode 100644 index e6f9ab5..0000000 --- a/0006-python-sepolicy-Cache-conditional-rule-queries.patch +++ /dev/null @@ -1,73 +0,0 @@ -From d2c08d621bf8fb3bfaa4460c31d7189a20fcb9a5 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 24 Jan 2023 21:05:05 +0100 -Subject: [PATCH] python/sepolicy: Cache conditional rule queries - -Commit 7506771e4b630fe0ab853f96574e039055cb72eb -"add missing booleans to man pages" dramatically slowed down -"sepolicy manpage -a" by removing caching of setools rule query. -Re-add said caching and update the query to only return conditional -rules. - -Before commit 7506771e: - #time sepolicy manpage -a - real 1m43.153s - # time sepolicy manpage -d httpd_t - real 0m4.493s - -After commit 7506771e: - #time sepolicy manpage -a - real 1h56m43.153s - # time sepolicy manpage -d httpd_t - real 0m8.352s - -After this commit: - #time sepolicy manpage -a - real 1m41.074s - # time sepolicy manpage -d httpd_t - real 0m7.358s - -Signed-off-by: Vit Mojzis ---- - python/sepolicy/sepolicy/__init__.py | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py -index e2d5c11a..c177cdfc 100644 ---- a/python/sepolicy/sepolicy/__init__.py -+++ b/python/sepolicy/sepolicy/__init__.py -@@ -125,6 +125,7 @@ all_attributes = None - booleans = None - booleans_dict = None - all_allow_rules = None -+all_bool_rules = None - all_transitions = None - - -@@ -1136,6 +1137,14 @@ def get_all_allow_rules(): - all_allow_rules = search([ALLOW]) - return all_allow_rules - -+def get_all_bool_rules(): -+ global all_bool_rules -+ if not all_bool_rules: -+ q = TERuleQuery(_pol, boolean=".*", boolean_regex=True, -+ ruletype=[ALLOW, DONTAUDIT]) -+ all_bool_rules = [_setools_rule_to_dict(x) for x in q.results()] -+ return all_bool_rules -+ - def get_all_transitions(): - global all_transitions - if not all_transitions: -@@ -1146,7 +1155,7 @@ def get_bools(setype): - bools = [] - domainbools = [] - domainname, short_name = gen_short_name(setype) -- for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))): -+ for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, get_all_bool_rules())): - for b in i: - if not isinstance(b, tuple): - continue --- -2.37.3 - diff --git a/policycoreutils.spec b/policycoreutils.spec index 97ff718..8eb8309 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.5-0.rc2 -%global libsemanagever 3.5-0.rc2 -%global libselinuxver 3.5-0.rc2 +%global libsepolver 3.5-0.rc3 +%global libsemanagever 3.5-0.rc3 +%global libselinuxver 3.5-0.rc3 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc2.3%{?dist} +Release: 0.rc3.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc2/selinux-3.5-rc2.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc3/selinux-3.5-rc3.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.5-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.5-rc3 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -36,7 +36,6 @@ Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch -Patch0006: 0006-python-sepolicy-Cache-conditional-rule-queries.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -72,7 +71,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version}-rc2 +%autosetup -p 1 -n selinux-%{version}-rc3 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -444,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Feb 13 2023 Petr Lautrbach - 3.5-0.rc3.1 +- SELinux userspace 3.5-rc3 release + * Wed Feb 8 2023 Petr Lautrbach - 3.5-0.rc2.3 - Attach tty to selinux-autorelabel.service when AUTORELABEL=0 diff --git a/sources b/sources index c7e4e16..9c71fc6 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.5-rc2.tar.gz) = 1b4ac2527b76858886c975dbaaae0ee8e30412f63d5c9b0996abf74c215697c4b8faeef4191e46f3faee427e4c96344a064faddaaeacec8e8a54956b3747700a +SHA512 (selinux-3.5-rc3.tar.gz) = 3e542c40fab3fd6480f85acbbd5ca9169c5a50c2d59cf31cba9aca4aea41fdeaec77e81faff375319f8617bc38f91e5497d550f3ad6610c71d743e6ca46d3c77 From e12fe0e4d950a30312eb271f9c2f7d859ba64f11 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 24 Feb 2023 13:02:01 +0100 Subject: [PATCH 29/79] SELinux userspace 3.5 release --- .gitignore | 1 + policycoreutils.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index d9e6250..407d473 100644 --- a/.gitignore +++ b/.gitignore @@ -347,3 +347,4 @@ policycoreutils-2.0.83.tgz /selinux-3.5-rc1.tar.gz /selinux-3.5-rc2.tar.gz /selinux-3.5-rc3.tar.gz +/selinux-3.5.tar.gz diff --git a/policycoreutils.spec b/policycoreutils.spec index 8eb8309..564acb2 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.5-0.rc3 -%global libsemanagever 3.5-0.rc3 -%global libselinuxver 3.5-0.rc3 +%global libsepolver 3.5-1 +%global libsemanagever 3.5-1 +%global libselinuxver 3.5-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 0.rc3.1%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5-rc3/selinux-3.5-rc3.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -28,7 +28,7 @@ Source21: python-po.tgz Source22: gui-po.tgz Source23: sandbox-po.tgz # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.5-rc3 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.5 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -71,7 +71,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version}-rc3 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -443,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Feb 24 2023 Petr Lautrbach - 3.5-1 +- SELinux userspace 3.5 release + * Mon Feb 13 2023 Petr Lautrbach - 3.5-0.rc3.1 - SELinux userspace 3.5-rc3 release diff --git a/sources b/sources index 9c71fc6..62f11e0 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b -SHA512 (selinux-3.5-rc3.tar.gz) = 3e542c40fab3fd6480f85acbbd5ca9169c5a50c2d59cf31cba9aca4aea41fdeaec77e81faff375319f8617bc38f91e5497d550f3ad6610c71d743e6ca46d3c77 +SHA512 (selinux-3.5.tar.gz) = a91b978d7a5f8adc6c4a4fb47ac92e49e73528905b8fe061ecff77d6ad6b316c4f8391e85dfcc7b422ed83076b9b84f592f567e76d862c569ab3a1079100a1fc From 8acd4a7172ca14e289b48031bf86d2cf98af6c4e Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Wed, 10 May 2023 14:38:07 +0200 Subject: [PATCH 30/79] Drop unused BR on dbus-glib-devel and explicitly BR glib2-devel The project has moved away from dbus-glib in version 3.2[0] and the BR is not needed at all. Explicitly add the glib2-devel to BR to fix the build after this change (it got there previously through dbus-glib-devel). [0] - https://github.com/SELinuxProject/selinux/commit/252925ccdffc26b89ff701ae1ae92853b338b1ff --- policycoreutils.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 564acb2..87ba92a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -47,7 +47,7 @@ Provides: /sbin/restorecon BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext -BuildRequires: desktop-file-utils dbus-devel dbus-glib-devel +BuildRequires: desktop-file-utils dbus-devel glib2-devel BuildRequires: python3-devel python3-setuptools python3-pip BuildRequires: systemd BuildRequires: git-core @@ -443,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed May 10 2023 Tomas Popela - 3.5-2 +- Drop unused BR on dbus-glib and explicitly BR glib2 + * Fri Feb 24 2023 Petr Lautrbach - 3.5-1 - SELinux userspace 3.5 release From 3cac2f042891077f5438655cd9b4ed61f9cb263d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Fri, 26 May 2023 11:27:31 +0200 Subject: [PATCH 31/79] Fix build with pip 23.1.2+ Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2209016 --- policycoreutils.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 87ba92a..d8eb819 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -48,7 +48,7 @@ Provides: /sbin/restorecon BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel glib2-devel -BuildRequires: python3-devel python3-setuptools python3-pip +BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip BuildRequires: systemd BuildRequires: git-core Requires: util-linux grep gawk diffutils rpm sed @@ -235,7 +235,7 @@ by python 3 in an SELinux environment. %{python3_sitelib}/sepolicy/network.py* %{python3_sitelib}/sepolicy/transition.py* %{python3_sitelib}/sepolicy/sedbus.py* -%{python3_sitelib}/sepolicy*.egg-info +%{python3_sitelib}/sepolicy*.dist-info/ %{python3_sitelib}/sepolicy/__pycache__ %package devel @@ -443,6 +443,10 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri May 26 2023 Miro Hrončok - 3.5-3 +- Fix build with pip 23.1.2+ +- Fixes: rhbz#2209016 + * Wed May 10 2023 Tomas Popela - 3.5-2 - Drop unused BR on dbus-glib and explicitly BR glib2 From 28f9992604f95fdeaf37984f286f9b0e6e9a9d30 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 29 May 2023 10:36:04 +0200 Subject: [PATCH 32/79] Use /bin/bash instead of /bin/sh Fixes: $ shellcheck -S warning selinux-autorelabel-generator.sh In selinux-autorelabel-generator.sh line 22: source /etc/selinux/config ^------------------------^ SC3046 (warning): In POSIX sh, 'source' in place of '.' is undefined. For more information: https://www.shellcheck.net/wiki/SC3046 -- In POSIX sh, 'source' in place of... https://bugzilla.redhat.com/show_bug.cgi?id=2210593 --- selinux-autorelabel-generator.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-autorelabel-generator.sh b/selinux-autorelabel-generator.sh index d9380b8..fdb4978 100644 --- a/selinux-autorelabel-generator.sh +++ b/selinux-autorelabel-generator.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # This systemd.generator(7) detects if SELinux is running and if the # user requested an autorelabel, and if so sets the default target to From ac0a1ffe5ccc93fb00c632dbf264fc275f3881d3 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 13 Jun 2023 20:25:18 +0200 Subject: [PATCH 33/79] Rebuilt for Python 3.12 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index d8eb819..eb075ab 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -443,6 +443,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue Jun 13 2023 Python Maint - 3.5-4 +- Rebuilt for Python 3.12 + * Fri May 26 2023 Miro Hrončok - 3.5-3 - Fix build with pip 23.1.2+ - Fixes: rhbz#2209016 From 21f11b304ce2e76c62fc0db32874c6d3033fe39a Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 21 Jun 2023 14:39:46 +0200 Subject: [PATCH 34/79] policycoreutils-3.5-5 - python/sepolicy: Fix spec file dependencies - python/sepolicy: Fix template for confined user policy modules - Improve man pages and add examples Signed-off-by: Vit Mojzis --- 0006-python-chcat-Improve-man-pages.patch | 74 +++ ...llow-Add-missing-options-to-man-page.patch | 79 +++ 0008-python-semanage-Improve-man-pages.patch | 464 ++++++++++++++++++ ...dit2allow-Remove-unused-debug-option.patch | 29 ++ ...ycoreutils-Add-examples-to-man-pages.patch | 308 ++++++++++++ 0011-python-sepolicy-Improve-man-pages.patch | 390 +++++++++++++++ 0012-sandbox-Add-examples-to-man-pages.patch | 128 +++++ ...Fix-template-for-confined-user-polic.patch | 93 ++++ ...-sepolicy-Fix-spec-file-dependencies.patch | 47 ++ policycoreutils.spec | 16 +- 10 files changed, 1627 insertions(+), 1 deletion(-) create mode 100644 0006-python-chcat-Improve-man-pages.patch create mode 100644 0007-python-audit2allow-Add-missing-options-to-man-page.patch create mode 100644 0008-python-semanage-Improve-man-pages.patch create mode 100644 0009-python-audit2allow-Remove-unused-debug-option.patch create mode 100644 0010-policycoreutils-Add-examples-to-man-pages.patch create mode 100644 0011-python-sepolicy-Improve-man-pages.patch create mode 100644 0012-sandbox-Add-examples-to-man-pages.patch create mode 100644 0013-python-sepolicy-Fix-template-for-confined-user-polic.patch create mode 100644 0014-python-sepolicy-Fix-spec-file-dependencies.patch diff --git a/0006-python-chcat-Improve-man-pages.patch b/0006-python-chcat-Improve-man-pages.patch new file mode 100644 index 0000000..4672bf8 --- /dev/null +++ b/0006-python-chcat-Improve-man-pages.patch @@ -0,0 +1,74 @@ +From 6c3527eeada62cbec8f58eb1aa55b76bb0e6018d Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 4 May 2023 14:04:47 +0200 +Subject: [PATCH] python/chcat: Improve man pages + +- Explain applying range/list of categories +- "-d" removes all categories of given file/user +- Add examples + +Signed-off-by: Vit Mojzis +Acked-by: James Carter +--- + python/chcat/chcat.8 | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/python/chcat/chcat.8 b/python/chcat/chcat.8 +index d095a255..3e1f7ca2 100644 +--- a/python/chcat/chcat.8 ++++ b/python/chcat/chcat.8 +@@ -1,6 +1,6 @@ + .TH CHCAT "8" "September 2005" "chcat" "User Commands" + .SH NAME +-chcat \- change file SELinux security category ++chcat \- change SELinux security categories of files/users + .SH SYNOPSIS + .B chcat + \fIcategory file\fR... +@@ -25,23 +25,33 @@ chcat \- change file SELinux security category + .br + .SH DESCRIPTION + .PP +-Change/Remove the security \fIcategory\fR for each \fIfile\fR or \fIuser\fR. +-.PP +-Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR. ++Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR (only a single category can be specified at a time). Or specify the desired list/range of categories to be applied (replacing the existing categories). + .PP + .B + Note: +-When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead. ++When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead. + + .TP + \fB\-d\fR +-delete the category from each FILE/USER. ++delete all categories from given FILE/USER. + .TP + \fB\-L\fR + list available categories. + .TP + \fB\-l\fR + Tells chcat to operate on users instead of files. ++ ++.SH EXAMPLE ++.nf ++Replace categories of user "test" with c0.c6 ++# chcat -l c0.c6 test ++Add category c1023 to user "test" ++# chcat -l +c1023 test ++Remove category c5 from file "file" ++# chcat -- -c5 file ++Remove all categories from file "file" ++# chcat -d file ++ + .SH "SEE ALSO" + .TP + chcon(1), selinux(8), semanage(8) +@@ -52,4 +62,3 @@ When operating on files this script wraps the chcon command. + /etc/selinux/{SELINUXTYPE}/setrans.conf + .br + /etc/selinux/{SELINUXTYPE}/seusers +- +-- +2.40.0 + diff --git a/0007-python-audit2allow-Add-missing-options-to-man-page.patch b/0007-python-audit2allow-Add-missing-options-to-man-page.patch new file mode 100644 index 0000000..3c657b7 --- /dev/null +++ b/0007-python-audit2allow-Add-missing-options-to-man-page.patch @@ -0,0 +1,79 @@ +From 11325baab31cec170e01c2548d09e540d6a2e67a Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 4 May 2023 14:04:48 +0200 +Subject: [PATCH] python/audit2allow: Add missing options to man page + +Signed-off-by: Vit Mojzis +--- + python/audit2allow/audit2allow.1 | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/python/audit2allow/audit2allow.1 b/python/audit2allow/audit2allow.1 +index 04ec3239..c31021d3 100644 +--- a/python/audit2allow/audit2allow.1 ++++ b/python/audit2allow/audit2allow.1 +@@ -40,10 +40,10 @@ + Read input from audit and message log, conflicts with \-i + .TP + .B "\-b" | "\-\-boot" +-Read input from audit messages since last boot conflicts with \-i ++Read input from audit messages since last boot, conflicts with \-i + .TP + .B "\-d" | "\-\-dmesg" +-Read input from output of ++Read input from output of + .I /bin/dmesg. + Note that all audit messages are not available via dmesg when + auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead. +@@ -51,15 +51,22 @@ auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead. + .B "\-D" | "\-\-dontaudit" + Generate dontaudit rules (Default: allow) + .TP ++.B "\-e" | "\-\-explain" ++Fully explain generated output ++.TP + .B "\-h" | "\-\-help" + Print a short usage message + .TP + .B "\-i " | "\-\-input " +-read input from ++Read input from + .I + .TP ++.B "\-\-interface-info=" ++Read interface information from ++.I ++.TP + .B "\-l" | "\-\-lastreload" +-read input only after last policy reload ++Read input only after last policy reload + .TP + .B "\-m " | "\-\-module " + Generate module/require output +@@ -70,8 +77,12 @@ Generate loadable module package, conflicts with \-o + .B "\-p " | "\-\-policy " + Policy file to use for analysis + .TP ++.B "\-\-perm-map " ++Read permission map from ++.I ++.TP + .B "\-o " | "\-\-output " +-append output to ++Append output to + .I + .TP + .B "\-r" | "\-\-requires" +@@ -85,6 +96,9 @@ This is the default behavior. + Generate reference policy using installed macros. + This attempts to match denials against interfaces and may be inaccurate. + .TP ++.B "\-t " | "\-\-type=" ++Only process messages with a type that matches this regex ++.TP + .B "\-x" | "\-\-xperms" + Generate extended permission access vector rules + .TP +-- +2.40.0 + diff --git a/0008-python-semanage-Improve-man-pages.patch b/0008-python-semanage-Improve-man-pages.patch new file mode 100644 index 0000000..653e06e --- /dev/null +++ b/0008-python-semanage-Improve-man-pages.patch @@ -0,0 +1,464 @@ +From fe6d5bd9a3043beb4c65b13d675f32bac2bbdaeb Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 4 May 2023 14:04:49 +0200 +Subject: [PATCH] python/semanage: Improve man pages + +- Add missing options +- Add more examples +- Note special cases + +Signed-off-by: Vit Mojzis +--- + python/semanage/semanage-boolean.8 | 9 ++++++--- + python/semanage/semanage-dontaudit.8 | 8 +++++--- + python/semanage/semanage-export.8 | 10 +++++++++- + python/semanage/semanage-fcontext.8 | 17 +++++++++++------ + python/semanage/semanage-ibendport.8 | 6 ++++-- + python/semanage/semanage-ibpkey.8 | 6 ++++-- + python/semanage/semanage-import.8 | 10 +++++++++- + python/semanage/semanage-interface.8 | 8 ++++++-- + python/semanage/semanage-login.8 | 14 ++++++++------ + python/semanage/semanage-module.8 | 15 ++++++++++----- + python/semanage/semanage-node.8 | 16 +++++++++++++--- + python/semanage/semanage-permissive.8 | 8 +++++--- + python/semanage/semanage-port.8 | 10 ++++++---- + python/semanage/semanage-user.8 | 8 +++++--- + 14 files changed, 101 insertions(+), 44 deletions(-) + +diff --git a/python/semanage/semanage-boolean.8 b/python/semanage/semanage-boolean.8 +index 1282d106..3b664023 100644 +--- a/python/semanage/semanage-boolean.8 ++++ b/python/semanage/semanage-boolean.8 +@@ -7,11 +7,14 @@ semanage\-boolean \- SELinux Policy Management boolean tool + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain. ++from policy sources. ++.B semanage boolean ++command controls the settings of booleans in SELinux policy. Booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain. ++ + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -45,7 +48,7 @@ Disable the boolean + + .SH EXAMPLE + .nf +-Turn on the apache can send mail boolean ++Turn on the "apache can send mail" boolean (persistent version of #setsebool httpd_can_sendmail on) + # semanage boolean \-m \-\-on httpd_can_sendmail + + List customized booleans +diff --git a/python/semanage/semanage-dontaudit.8 b/python/semanage/semanage-dontaudit.8 +index 81accc6f..51d1f4b6 100644 +--- a/python/semanage/semanage-dontaudit.8 ++++ b/python/semanage/semanage-dontaudit.8 +@@ -7,13 +7,15 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause +-confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Some times dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turning off dontaudit rules with this command to see if the kernel is blocking an access. ++from policy sources. ++.B semanage dontaudit ++toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause ++confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Sometimes dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turn off dontaudit rules with this command to see if the kernel is blocking an access. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-S STORE, \-\-store STORE + Select an alternate SELinux Policy Store to manage +diff --git a/python/semanage/semanage-export.8 b/python/semanage/semanage-export.8 +index d422683b..51984793 100644 +--- a/python/semanage/semanage-export.8 ++++ b/python/semanage/semanage-export.8 +@@ -7,7 +7,15 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. ++from policy sources. ++.B semanage import ++and ++.B export ++can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using ++.B semanage export ++start with ++.I -D ++for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. + + .SH "OPTIONS" + .TP +diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8 +index 1ebf085f..3e327d88 100644 +--- a/python/semanage/semanage-fcontext.8 ++++ b/python/semanage/semanage-fcontext.8 +@@ -8,8 +8,10 @@ semanage\-fcontext \- SELinux Policy Management file context tool + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage fcontext is used to manage the default +-file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels. ++from policy sources. ++.B semanage fcontext ++is used to manage the default file system labeling on an SELinux system. ++This command maps file paths using regular expressions to SELinux labels. + + FILE_SPEC may contain either a fully qualified path, + or a Perl compatible regular expression (PCRE), +@@ -32,7 +34,7 @@ to avoid unintentionally impacting other parts of the filesystem. + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -82,12 +84,13 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma + + .SH EXAMPLE + .nf +-.I remember to run restorecon after you set the file context +-Add file-context for everything under /web ++.I Remember to run restorecon after you set the file context ++Add file-context httpd_sys_content_t for everything under /web + # semanage fcontext \-a \-t httpd_sys_content_t "/web(/.*)?" + # restorecon \-R \-v /web + + Substitute /home1 with /home when setting file context ++i.e. label everything under /home1 the same way /home is labeled + # semanage fcontext \-a \-e /home /home1 + # restorecon \-R \-v /home1 + +@@ -99,7 +102,9 @@ execute the following commands. + + .SH "SEE ALSO" + .BR selinux (8), +-.BR semanage (8) ++.BR semanage (8), ++.BR restorecon (8), ++.BR selabel_file (5) + + .SH "AUTHOR" + This man page was written by Daniel Walsh +diff --git a/python/semanage/semanage-ibendport.8 b/python/semanage/semanage-ibendport.8 +index 0a29eae1..53fe4ee8 100644 +--- a/python/semanage/semanage-ibendport.8 ++++ b/python/semanage/semanage-ibendport.8 +@@ -5,12 +5,14 @@ + .B semanage ibendport [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-z IBDEV_NAME \-r RANGE port | \-\-delete \-z IBDEV_NAME port | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-z IBDEV_NAME \-r RANGE port ] + + .SH "DESCRIPTION" +-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions. ++semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. ++.B semanage ibendport ++controls the ibendport number to ibendport type definitions. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +diff --git a/python/semanage/semanage-ibpkey.8 b/python/semanage/semanage-ibpkey.8 +index 51f455ab..6cc5e02f 100644 +--- a/python/semanage/semanage-ibpkey.8 ++++ b/python/semanage/semanage-ibpkey.8 +@@ -5,12 +5,14 @@ + .B semanage ibpkey [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range | \-\-delete \-x SUBNET_PREFIX ibpkey_name | ibpkey_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range ] + + .SH "DESCRIPTION" +-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions. ++semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. ++.B semanage ibpkey ++controls the ibpkey number to ibpkey type definitions. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +diff --git a/python/semanage/semanage-import.8 b/python/semanage/semanage-import.8 +index 4a9b3e76..041e9ab0 100644 +--- a/python/semanage/semanage-import.8 ++++ b/python/semanage/semanage-import.8 +@@ -7,7 +7,15 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. ++from policy sources. ++.B semanage import ++and ++.B export ++can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using ++.B semanage export ++start with ++.I -D ++for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. + + .SH "OPTIONS" + .TP +diff --git a/python/semanage/semanage-interface.8 b/python/semanage/semanage-interface.8 +index d9d526dc..080db70b 100644 +--- a/python/semanage/semanage-interface.8 ++++ b/python/semanage/semanage-interface.8 +@@ -7,12 +7,14 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage interface controls the labels assigned to network interfaces. ++from policy sources. ++.B semanage interface ++controls the labels assigned to network interfaces. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -54,6 +56,8 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma + .nf + list all interface definitions + # semanage interface \-l ++Assign type netif_t and MLS/MCS range s0:c0.c1023 to interface eth0 ++# semanage interface \-a \-t netif_t \-r s0:c0.c1023 eth0 + + .SH "SEE ALSO" + .BR selinux (8), +diff --git a/python/semanage/semanage-login.8 b/python/semanage/semanage-login.8 +index f451bdc6..9076a1ed 100644 +--- a/python/semanage/semanage-login.8 ++++ b/python/semanage/semanage-login.8 +@@ -7,12 +7,14 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name. ++from policy sources. ++.B semanage login ++controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -52,11 +54,11 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma + + .SH EXAMPLE + .nf +-Modify the default user on the system to the guest_u user ++Set the default SELinux user on the system to guest_u + # semanage login \-m \-s guest_u __default__ +-Assign gijoe user on an MLS machine a range and to the staff_u user +-# semanage login \-a \-s staff_u \-rSystemLow-Secret gijoe +-Assign all users in the engineering group to the staff_u user ++Map user gijoe to SELinux user staff_u and assign MLS range SystemLow\-Secret ++# semanage login \-a \-s staff_u \-rSystemLow\-Secret gijoe ++Map all users in the engineering group to SELinux user staff_u + # semanage login \-a \-s staff_u %engineering + + .SH "SEE ALSO" +diff --git a/python/semanage/semanage-module.8 b/python/semanage/semanage-module.8 +index e0057167..6913b0cd 100644 +--- a/python/semanage/semanage-module.8 ++++ b/python/semanage/semanage-module.8 +@@ -5,12 +5,14 @@ + .B semanage module [\-h] [\-n] [\-N] [\-S STORE] (\-a | \-r | \-e | \-d | \-\-extract | \-\-list [\-C] | \-\-deleteall) [module_name] + + .SH "DESCRIPTION" +-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables SELinux Policy modules. ++semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. ++.B semanage module ++installs, removes, disables, or enables SELinux Policy modules. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -22,11 +24,14 @@ Do not reload policy after commit + Select an alternate SELinux Policy Store to manage + .TP + .I \-a, \-\-add +-Install specified module ++Install specified module. Accepts both binary policy files (.pp) and CIL source files + .TP + .I \-r, \-\-remove + Remove specified module + .TP ++.I \-D, \-\-deleteall ++Remove all local customizations related to modules ++.TP + .I \-d \-\-disable + Disable specified module + .TP +@@ -48,8 +53,8 @@ List all modules + # semanage module \-l + Disable unconfined module + # semanage module \-\-disable unconfined +-Install custom apache policy module +-# semanage module \-a myapache ++Install custom apache policy module (same as #semodule -i myapache.pp) ++# semanage module \-a myapache.pp + + .SH "SEE ALSO" + .BR selinux (8), +diff --git a/python/semanage/semanage-node.8 b/python/semanage/semanage-node.8 +index a0098221..c78d6c3e 100644 +--- a/python/semanage/semanage-node.8 ++++ b/python/semanage/semanage-node.8 +@@ -7,12 +7,14 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage controls the ipaddress to node type definitions. ++from policy sources. ++.B semanage node ++controls the IP address to node type definitions. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -54,5 +56,13 @@ SELinux type for the object + MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0. + .TP + .I \-p PROTO, \-\-proto PROTO +- + Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6). ++ ++.SH "EXAMPLE" ++.nf ++Apply type node_t to ipv4 node 127.0.0.2 ++# semanage node \-a \-t node_t \-p ipv4 \-M 255.255.255.255 127.0.0.2 ++ ++.SH "SEE ALSO" ++.BR selinux (8), ++.BR semanage (8) +diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8 +index 5c3364fa..0414a850 100644 +--- a/python/semanage/semanage-permissive.8 ++++ b/python/semanage/semanage-permissive.8 +@@ -5,12 +5,14 @@ + .B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list) + + .SH "DESCRIPTION" +-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module. ++semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. ++.B semanage permissive ++adds or removes a SELinux Policy permissive module. Please note that this command can make any domain permissive, but can only remove the permissive property from domains where it was added by semanage permissive ("semanage permissive -d" can only be used on types listed as "Customized Permissive Types" by "semanage permissive -l"). + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-a, \-\-add + Add a record of the specified object type +@@ -38,7 +40,7 @@ Select an alternate SELinux Policy Store to manage + + .SH EXAMPLE + .nf +-List all permissive modules ++List all permissive domains ("Builtin Permissive Types" where set by the system policy, or a custom policy module) + # semanage permissive \-l + Make httpd_t (Web Server) a permissive domain + # semanage permissive \-a httpd_t +diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8 +index 12ec14c2..c6048660 100644 +--- a/python/semanage/semanage-port.8 ++++ b/python/semanage/semanage-port.8 +@@ -5,12 +5,14 @@ + .B semanage port [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range | \-\-delete \-p PROTOCOL port_name | port_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range ] + + .SH "DESCRIPTION" +-semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage port controls the port number to port type definitions. ++semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. ++.B semanage port ++controls the port number to port type definitions. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -55,9 +57,9 @@ Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version + .nf + List all port definitions + # semanage port \-l +-Allow Apache to listen on tcp port 81 ++Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t, which apache is allowed to listen on) + # semanage port \-a \-t http_port_t \-p tcp 81 +-Allow sshd to listen on tcp port 8991 ++Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on) + # semanage port \-a \-t ssh_port_t \-p tcp 8991 + + .SH "SEE ALSO" +diff --git a/python/semanage/semanage-user.8 b/python/semanage/semanage-user.8 +index 23fec698..50d50bea 100644 +--- a/python/semanage/semanage-user.8 ++++ b/python/semanage/semanage-user.8 +@@ -7,12 +7,14 @@ + .SH "DESCRIPTION" + semanage is used to configure certain elements of + SELinux policy without requiring modification to or recompilation +-from policy sources. semanage user controls the mapping between an SELinux User and the roles and MLS/MCS levels. ++from policy sources. ++.B semanage user ++controls the mapping between an SELinux User and the roles and MLS/MCS levels. + + .SH "OPTIONS" + .TP + .I \-h, \-\-help +-show this help message and exit ++Show this help message and exit + .TP + .I \-n, \-\-noheading + Do not print heading when listing the specified object type +@@ -59,7 +61,7 @@ List SELinux users + # semanage user \-l + Modify groups for staff_u user + # semanage user \-m \-R "system_r unconfined_r staff_r" staff_u +-Add level for TopSecret Users ++Assign user topsecret_u role staff_r and range s0\-TopSecret + # semanage user \-a \-R "staff_r" \-rs0\-TopSecret topsecret_u + + .SH "SEE ALSO" +-- +2.40.0 + diff --git a/0009-python-audit2allow-Remove-unused-debug-option.patch b/0009-python-audit2allow-Remove-unused-debug-option.patch new file mode 100644 index 0000000..811cabf --- /dev/null +++ b/0009-python-audit2allow-Remove-unused-debug-option.patch @@ -0,0 +1,29 @@ +From 10fb1da179ab377db96697e79ac45bfdcd251989 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 4 May 2023 14:04:50 +0200 +Subject: [PATCH] python/audit2allow: Remove unused "debug" option + +The option is not referenced anywhere in the code and I couldn't figure +out its purpose from the description. + +Signed-off-by: Vit Mojzis +--- + python/audit2allow/audit2allow | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow +index eafeea88..5587a2db 100644 +--- a/python/audit2allow/audit2allow ++++ b/python/audit2allow/audit2allow +@@ -88,8 +88,6 @@ class AuditToPolicy: + parser.add_option("--interface-info", dest="interface_info", help="file name of interface information") + parser.add_option("-x", "--xperms", action="store_true", dest="xperms", + default=False, help="generate extended permission rules") +- parser.add_option("--debug", dest="debug", action="store_true", default=False, +- help="leave generated modules for -M") + parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=(os.path.basename(sys.argv[0]) == "audit2why"), + help="Translates SELinux audit messages into a description of why the access was denied") + +-- +2.40.0 + diff --git a/0010-policycoreutils-Add-examples-to-man-pages.patch b/0010-policycoreutils-Add-examples-to-man-pages.patch new file mode 100644 index 0000000..4aead05 --- /dev/null +++ b/0010-policycoreutils-Add-examples-to-man-pages.patch @@ -0,0 +1,308 @@ +From 10cfbd2825e12efdc0faa872987d5987e02e7eae Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 1 Jun 2023 16:39:11 +0200 +Subject: [PATCH] policycoreutils: Add examples to man pages + +While at it, remove trailing whitespaces. + +Signed-off-by: Vit Mojzis +Acked-by: Petr Lautrbach +--- + policycoreutils/scripts/fixfiles.8 | 34 +++++++++++++-------- + policycoreutils/secon/secon.1 | 12 ++++++-- + policycoreutils/semodule/semodule.8 | 14 ++++----- + policycoreutils/setfiles/restorecon.8 | 9 ++++++ + policycoreutils/setfiles/restorecon_xattr.8 | 7 +++++ + policycoreutils/setfiles/setfiles.8 | 9 ++++++ + policycoreutils/setsebool/setsebool.8 | 16 +++++++--- + 7 files changed, 74 insertions(+), 27 deletions(-) + +diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8 +index 9a317d91..928b8200 100644 +--- a/policycoreutils/scripts/fixfiles.8 ++++ b/policycoreutils/scripts/fixfiles.8 +@@ -14,7 +14,7 @@ fixfiles \- fix file SELinux security contexts. + .B fixfiles + .I [\-v] [\-F] [\-B | \-N time ] [\-T nthreads] { check | restore | verify } + +-.B fixfiles ++.B fixfiles + .I [\-v] [\-F] [\-T nthreads] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify } + + .B fixfiles +@@ -31,7 +31,7 @@ This manual page describes the + script. + .P + This script is primarily used to correct the security context +-database (extended attributes) on filesystems. ++database (extended attributes) on filesystems. + .P + It can also be run at any time to relabel when adding support for + new policy, or just check whether the file contexts are all +@@ -41,29 +41,29 @@ option. You can use the \-R flag to use rpmpackages as an alternative. + The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories + excluded from relabeling. + .P +-.B fixfiles onboot ++.B fixfiles onboot + will setup the machine to relabel on the next reboot. + + .SH "OPTIONS" +-.TP ++.TP + .B \-B + If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today. + .TP + .B \-F + Force reset of context to match file_context for customizable files + +-.TP ++.TP + .B \-f + Clear /tmp directory with out prompt for removal. + +-.TP ++.TP + .B \-R rpmpackagename[,rpmpackagename...] + Use the rpm database to discover all files within the specified packages and restore the file contexts. + .TP + .B \-C PREVIOUS_FILECONTEXT + Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files. + +-.TP ++.TP + .B \-N time + Only act on files created after the specified date. Date must be specified in + "YYYY\-MM\-DD HH:MM" format. Date field will be passed to find \-\-newermt command. +@@ -83,19 +83,28 @@ Use parallel relabeling, see + + .SH "ARGUMENTS" + One of: +-.TP ++.TP + .B check | verify + print any incorrect file context labels, showing old and new context, but do not change them. +-.TP ++.TP + .B restore + change any incorrect file context labels. +-.TP ++.TP + .B relabel + Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file. +-.TP +-.B [[dir/file] ... ] ++.TP ++.B [[dir/file] ... ] + List of files or directories trees that you wish to check file context on. + ++.SH EXAMPLE ++.nf ++Relabel the whole filesystem, except paths listed in /etc/selinux/fixfiles_exclude_dirs ++# fixfiles relabel ++Schedule the machine to relabel on the next boot and force relabeling of customizable types ++# fixfiles -F onboot ++Check labeling of all files from the samba package (while not changing any labels) ++# fixfiles -R samba check ++ + .SH "AUTHOR" + This man page was written by Richard Hally . + The script was written by Dan Walsh +@@ -103,4 +112,3 @@ The script was written by Dan Walsh + .SH "SEE ALSO" + .BR setfiles (8), + .BR restorecon (8) +- +diff --git a/policycoreutils/secon/secon.1 b/policycoreutils/secon/secon.1 +index 501b5cb8..c0e8b05a 100644 +--- a/policycoreutils/secon/secon.1 ++++ b/policycoreutils/secon/secon.1 +@@ -107,16 +107,24 @@ then the context will be read from stdin. + .br + If there is no argument, + .B secon +-will try reading a context from stdin, if that is not a tty, otherwise ++will try reading a context from stdin, if that is not a tty, otherwise + .B secon + will act as though \fB\-\-self\fR had been passed. + .PP + If none of \fB\-\-user\fR, \fB\-\-role\fR, \fB\-\-type\fR, \fB\-\-level\fR or + \fB\-\-mls\-range\fR is passed. + Then all of them will be output. ++ ++.SH EXAMPLE ++.nf ++Show SElinux context of the init process ++# secon --pid 1 ++Parse the type portion of given security context ++# secon -t system_u:object_r:httpd_sys_rw_content_t:s0 ++ + .PP + .SH SEE ALSO + .BR chcon (1) + .SH AUTHORS + .nf +-James Antill (james.antill@redhat.com) ++James Antill (james.antill@redhat.com) +diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 +index c56e580f..01757b00 100644 +--- a/policycoreutils/semodule/semodule.8 ++++ b/policycoreutils/semodule/semodule.8 +@@ -1,5 +1,5 @@ + .TH SEMODULE "8" "Nov 2005" "Security Enhanced Linux" NSA +-.SH NAME ++.SH NAME + semodule \- Manage SELinux policy modules. + + .SH SYNOPSIS +@@ -8,7 +8,7 @@ semodule \- Manage SELinux policy modules. + .SH DESCRIPTION + .PP + semodule is the tool used to manage SELinux policy modules, +-including installing, upgrading, listing and removing modules. ++including installing, upgrading, listing and removing modules. + semodule may also be used to force a rebuild of policy from the + module store and/or to force a reload of policy without performing + any other transaction. semodule acts on module packages created +@@ -39,7 +39,7 @@ install/replace a module package + .B \-u,\-\-upgrade=MODULE_PKG + deprecated, alias for --install + .TP +-.B \-b,\-\-base=MODULE_PKG ++.B \-b,\-\-base=MODULE_PKG + deprecated, alias for --install + .TP + .B \-r,\-\-remove=MODULE_NAME +@@ -77,7 +77,7 @@ name of the store to operate on + .B \-n,\-\-noreload,\-N + do not reload policy after commit + .TP +-.B \-h,\-\-help ++.B \-h,\-\-help + prints help message and quit + .TP + .B \-P,\-\-preserve_tunables +@@ -92,7 +92,7 @@ Use an alternate path for the policy root + .B \-S,\-\-store-path + Use an alternate path for the policy store root + .TP +-.B \-v,\-\-verbose ++.B \-v,\-\-verbose + be verbose + .TP + .B \-c,\-\-cil +@@ -131,8 +131,6 @@ $ semodule \-B + $ semodule \-d alsa + # Install a module at a specific priority. + $ semodule \-X 100 \-i alsa.pp +-# List all modules. +-$ semodule \-\-list=full + # Set an alternate path for the policy root + $ semodule \-B \-p "/tmp" + # Set an alternate path for the policy store root +@@ -143,6 +141,8 @@ $ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark + # Check whether a module in "localmodule.pp" file is same as installed module "localmodule" + $ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum + $ semodule -l -m | grep localmodule ++# Translate binary module file into CIL (useful for debugging installation errors) ++$ /usr/libexec/selinux/hll/pp alsa.pp > alsa.cil + .fi + + .SH SEE ALSO +diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 +index dbd55ce7..6160aced 100644 +--- a/policycoreutils/setfiles/restorecon.8 ++++ b/policycoreutils/setfiles/restorecon.8 +@@ -224,6 +224,15 @@ and provided the + option is NOT set and recursive mode is set, files will be relabeled as + required with the digests then being updated provided there are no errors. + ++.SH EXAMPLE ++.nf ++Fix labeling of /var/www/ including all sub-directories and list all context changes ++# restorecon -rv /var/www/ ++List mislabeled files in user home directory and what the correct label should be ++# restorecon -nvr ~ ++Fix labeling of files listed in file_list file, ignoring any that do not exist ++# restorecon -vif file_list ++ + .SH "AUTHOR" + This man page was written by Dan Walsh . + Some of the content of this man page was taken from the setfiles +diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8 +index 4b1ce304..09bfd8c4 100644 +--- a/policycoreutils/setfiles/restorecon_xattr.8 ++++ b/policycoreutils/setfiles/restorecon_xattr.8 +@@ -112,6 +112,13 @@ If the option is not specified, then the default file_contexts will be used. + .br + the pathname of the directory tree to be searched. + ++.SH EXAMPLE ++.nf ++List all paths that where assigned a checksum by "restorecon/setfiles -D" ++# restorecon_xattr -r / ++Remove all non-matching checksums ++# restorecon_xattr -rd / ++ + .SH "SEE ALSO" + .BR restorecon (8), + .BR setfiles (8) +diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 +index 36fe6b36..6071d9ba 100644 +--- a/policycoreutils/setfiles/setfiles.8 ++++ b/policycoreutils/setfiles/setfiles.8 +@@ -289,6 +289,15 @@ and provided the + option is NOT set, files will be relabeled as required with the digests then + being updated provided there are no errors. + ++.SH EXAMPLE ++.nf ++Fix labeling of /var/www/ including all sub-directories, using targeted policy file context definitions and list all context changes ++# setfiles -v /etc/selinux/targeted/contexts/files/file_contexts /var/www/ ++List mislabeled files in user home directory and what the label should be based on targeted policy file context definitions ++# setfiles -nv /etc/selinux/targeted/contexts/files/file_contexts ~ ++Fix labeling of files listed in file_list file, ignoring any that do not exist ++# setfiles -vif file_list /etc/selinux/targeted/contexts/files/file_contexts ++ + .SH "AUTHOR" + This man page was written by Russell Coker . + The program was written by Stephen Smalley +diff --git a/policycoreutils/setsebool/setsebool.8 b/policycoreutils/setsebool/setsebool.8 +index 52936f5a..f54664fb 100644 +--- a/policycoreutils/setsebool/setsebool.8 ++++ b/policycoreutils/setsebool/setsebool.8 +@@ -7,13 +7,13 @@ setsebool \- set SELinux boolean value + .I "[ \-PNV ] boolean value | bool1=val1 bool2=val2 ..." + + .SH "DESCRIPTION" +-.B setsebool +-sets the current state of a particular SELinux boolean or a list of booleans +-to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it. ++.B setsebool ++sets the current state of a particular SELinux boolean or a list of booleans ++to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it. + + Without the \-P option, only the current boolean value is +-affected; the boot-time default settings +-are not changed. ++affected; the boot-time default settings ++are not changed. + + If the \-P option is given, all pending values are written to + the policy file on disk. So they will be persistent across reboots. +@@ -22,6 +22,12 @@ If the \-N option is given, the policy on disk is not reloaded into the kernel. + + If the \-V option is given, verbose error messages will be printed from semanage libraries. + ++.SH EXAMPLE ++.nf ++Enable container_use_devices boolean (will return to persistent value after reboot) ++# setsebool container_use_devices 1 ++Persistently enable samba_create_home_dirs and samba_enable_home_dirs booleans ++# setsebool -P samba_create_home_dirs=on samba_enable_home_dirs=on + + .SH AUTHOR + This manual page was written by Dan Walsh . +-- +2.40.0 + diff --git a/0011-python-sepolicy-Improve-man-pages.patch b/0011-python-sepolicy-Improve-man-pages.patch new file mode 100644 index 0000000..4620b3e --- /dev/null +++ b/0011-python-sepolicy-Improve-man-pages.patch @@ -0,0 +1,390 @@ +From 835b208cad02557cf99c3ab7289ca511b8bfa91e Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 1 Jun 2023 16:39:12 +0200 +Subject: [PATCH] python/sepolicy: Improve man pages + +- Add missing options +- Add examples +- Emphasize keywords +- Remove trailing whitespaces + +Signed-off-by: Vit Mojzis +Acked-by: Petr Lautrbach +--- + python/sepolicy/sepolicy-booleans.8 | 15 +++++++++--- + python/sepolicy/sepolicy-communicate.8 | 14 ++++++++--- + python/sepolicy/sepolicy-generate.8 | 34 ++++++++++++-------------- + python/sepolicy/sepolicy-gui.8 | 4 +-- + python/sepolicy/sepolicy-interface.8 | 18 +++++++++++--- + python/sepolicy/sepolicy-manpage.8 | 25 ++++++++++++++----- + python/sepolicy/sepolicy-network.8 | 17 ++++++------- + python/sepolicy/sepolicy-transition.8 | 19 +++++++++----- + 8 files changed, 96 insertions(+), 50 deletions(-) + +diff --git a/python/sepolicy/sepolicy-booleans.8 b/python/sepolicy/sepolicy-booleans.8 +index f8d8b56d..7f4b18e7 100644 +--- a/python/sepolicy/sepolicy-booleans.8 ++++ b/python/sepolicy/sepolicy-booleans.8 +@@ -8,12 +8,16 @@ sepolicy-booleans \- Query SELinux Policy to see description of booleans + .B sepolicy booleans [\-h] [ \-a | \-b booleanname ... ] + + .SH "DESCRIPTION" +-sepolicy booleans will show all booleans and their descriptions, or you can +-choose individual booleans to display ++.B sepolicy booleans ++will show all booleans and their descriptions, or you can ++choose individual booleans to display. ++Please make sure that selinux-policy-devel is present in your system since it contains boolean descriptions extracted from the policy source code. Otherwise ++.B sepolicy booleans ++will only show descriptions generated based on boolean names. + + .SH "OPTIONS" + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP + .I \-a, \-\-all +@@ -22,6 +26,11 @@ Display all boolean descriptions + .I \-b, \-\-boolean + boolean to get description + ++.SH EXAMPLE ++.nf ++List descriptions of samba_create_home_dirs and samba_enable_home_dirs booleans ++# sepolicy booleans -b samba_create_home_dirs samba_enable_home_dirs ++ + .SH "AUTHOR" + This man page was written by Daniel Walsh + +diff --git a/python/sepolicy/sepolicy-communicate.8 b/python/sepolicy/sepolicy-communicate.8 +index 050aa475..5ecf6eff 100644 +--- a/python/sepolicy/sepolicy-communicate.8 ++++ b/python/sepolicy/sepolicy-communicate.8 +@@ -8,7 +8,9 @@ sepolicy-communicate \- Generate a report showing if two SELinux Policy Domains + .B sepolicy communicate [\-h] \-s SOURCE \-t TARGET [\-c TCLASS] [\-S SOURCEACCESS] [\-T TARGETACCESS] + + .SH "DESCRIPTION" +-Use sepolicy communicate to examine SELinux Policy to if a source SELinux Domain can communicate with a target SELinux Domain. ++Use ++.B sepolicy communicate ++to examine SELinux Policy and determine if a source SELinux Domain can communicate with a target SELinux Domain. + The default command looks to see if there are any file types that the source domain can write, which the target domain can read. + + .SH "OPTIONS" +@@ -16,7 +18,7 @@ The default command looks to see if there are any file types that the source dom + .I \-c, \-\-class + Specify the SELinux class which the source domain will attempt to communicate with the target domain. (Default file) + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP + .I \-s, \-\-source +@@ -31,9 +33,15 @@ Specify the target SELinux domain type. + .I \-T, \-\-targetaccess + Specify the list of accesses used by the target SELinux domain type to receive communications from the source domain. Default Open, Read. + ++.SH EXAMPLE ++.nf ++List types that can be used to communicate between samba daemon and apache server ++# sepolicy communicate -s httpd_t -t smbd_t ++Consider a type to be accessible by the source domain when it can be opened and appended to (as opposed to opened and written to) ++# sepolicy communicate -s httpd_t -t smbd_t -S open,append ++ + .SH "AUTHOR" + This man page was written by Daniel Walsh + + .SH "SEE ALSO" + sepolicy(8), selinux(8) +- +diff --git a/python/sepolicy/sepolicy-generate.8 b/python/sepolicy/sepolicy-generate.8 +index 0c5f998f..72d0e8e4 100644 +--- a/python/sepolicy/sepolicy-generate.8 ++++ b/python/sepolicy/sepolicy-generate.8 +@@ -57,32 +57,29 @@ path. \fBsepolicy generate\fP will use the rpm payload of the + application along with \fBnm \-D APPLICATION\fP to help it generate + types and policy rules for your policy files. + +-.B Type Enforcing File NAME.te ++.B NAME.te + .br +-This file can be used to define all the types rules for a particular domain. ++This file can be used to define all the types enforcement rules for a particular domain. + + .I Note: +-Policy generated by \fBsepolicy generate\fP will automatically add a permissive DOMAIN to your te file. When you are satisfied that your policy works, you need to remove the permissive line from the te file to run your domain in enforcing mode. ++Policy generated by \fBsepolicy generate\fP will automatically add a \fIpermissive DOMAIN\fP to your \fB.te\fP file. When you are satisfied that your policy works, you need to remove the permissive line from the \fB.te\fP file to run your domain in enforcing mode. + +-.B Interface File NAME.if ++.B NAME.if + .br +-This file defines the interfaces for the types generated in the te file, which can be used by other policy domains. ++This file defines the interfaces for the types generated in the \fB.te\fP file, which can be used by other policy domains. + +-.B File Context NAME.fc ++.B NAME.fc + .br +-This file defines the default file context for the system, it takes the file types created in the te file and associates ++This file defines the default file context for the system, it takes the file types created in the \fB.te\fP file and associates + file paths to the types. Tools like restorecon and RPM will use these paths to put down labels. + +-.B RPM Spec File NAME_selinux.spec ++.B NAME_selinux.spec + .br +-This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page. ++This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page. + +-.B Shell File NAME.sh ++.B NAME.sh + .br +-This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and +-compile and build an RPM suitable to be installed on other machines +- +-If a generate is possible, this tool will print out all generate paths from the source domain to the target domain ++This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines. + + .SH "OPTIONS" + .TP +@@ -97,10 +94,11 @@ Specify alternate name of policy. The policy will default to the executable or n + .TP + .I \-p, \-\-path + Specify the directory to store the created policy files. (Default to current working directory ) ++.TP + optional arguments: + .TP + .I \-r, \-\-role +-Enter role(s) to which this admin user will transition. ++Enter role(s) to which this admin user will transition + .TP + .I \-t, \-\-type + Enter type(s) for which you will generate new definition and rule(s) +@@ -109,12 +107,12 @@ Enter type(s) for which you will generate new definition and rule(s) + SELinux user(s) which will transition to this domain + .TP + .I \-w, \-\-writepath +-Path(s) which the confined processes need to write ++Path(s) which the confined processes need to write to + .TP + .I \-a, \-\-admin + Domain(s) which the confined admin will administrate + .TP +-.I \-\-admin_user ++.I \-\-admin_user + Generate Policy for Administrator Login User Role + .TP + .I \-\-application +@@ -142,7 +140,7 @@ Generate Policy for Internet Services Daemon + Generate Policy for Standard Init Daemon (Default) + .TP + .I \-\-newtype +-Generate new policy for new types to add to an existing policy. ++Generate new policy for new types to add to an existing policy + .TP + .I \-\-sandbox + Generate Policy for Sandbox +diff --git a/python/sepolicy/sepolicy-gui.8 b/python/sepolicy/sepolicy-gui.8 +index ed744cdb..65b69fab 100644 +--- a/python/sepolicy/sepolicy-gui.8 ++++ b/python/sepolicy/sepolicy-gui.8 +@@ -11,7 +11,7 @@ Common options + .br + + .SH "DESCRIPTION" +-Use \fBsepolicy gui\fP to run a the graphical user interface, which ++Use \fBsepolicy gui\fP to run the graphical user interface, which + allows you to explore how SELinux confines different process domains. + + .SH "OPTIONS" +@@ -20,7 +20,7 @@ allows you to explore how SELinux confines different process domains. + Display help message + .TP + .I \-d, \-\-domain +-Initialize gui to the selected domain. ++Initialize gui to the selected domain + + .SH "AUTHOR" + This man page was written by Daniel Walsh +diff --git a/python/sepolicy/sepolicy-interface.8 b/python/sepolicy/sepolicy-interface.8 +index 3e74ea62..a70a9306 100644 +--- a/python/sepolicy/sepolicy-interface.8 ++++ b/python/sepolicy/sepolicy-interface.8 +@@ -5,10 +5,10 @@ sepolicy-interface \- Print interface information based on the installed SELinux + .SH "SYNOPSIS" + + .br +-.B sepolicy interface [\-h] [\-c] [\-v] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]] ++.B sepolicy interface [\-h] [\-c] [\-v] [\-f FILE] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]] + + .SH "DESCRIPTION" +-Use sepolicy interface to print interfaces information based on SELinux Policy. ++Use \fBsepolicy interface\fP to print interface information based on SELinux Policy. + + .SH "OPTIONS" + .TP +@@ -18,7 +18,7 @@ List all domains with admin interface + .I \-c, \-\-compile + Test compile of interfaces + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP + .I \-i, \-\-interface +@@ -32,6 +32,18 @@ List all domains with SELinux user role interface + .TP + .I \-v, \-\-verbose + Display extended information about the interface including parameters and description if available. ++.TP ++.I \-f, \-\-file ++Interface file to be explored ++ ++.SH EXAMPLE ++.nf ++Show description of given interface ++# sepolicy interface -vi samba_rw_config ++List interfaces in given interface file and show their description ++# sepolicy interface -f my_policy.if -lv ++Run compile test for all interfaces in given file ++# sepolicy interface -f my_policy.if -lc + + .SH "AUTHOR" + This man page was written by Daniel Walsh +diff --git a/python/sepolicy/sepolicy-manpage.8 b/python/sepolicy/sepolicy-manpage.8 +index c05c9430..4991f645 100644 +--- a/python/sepolicy/sepolicy-manpage.8 ++++ b/python/sepolicy/sepolicy-manpage.8 +@@ -8,27 +8,40 @@ sepolicy-manpage \- Generate a man page based on the installed SELinux Policy + .B sepolicy manpage [\-w] [\-h] [\-p PATH ] [\-r ROOTDIR ] [\-a | \-d ] + + .SH "DESCRIPTION" +-Use sepolicy manpage to generate manpages based on SELinux Policy. ++Use \fBsepolicy manpage\fP to generate manpages based on SELinux Policy. + + .SH "OPTIONS" + .TP +-.I \-a, \-\-all ++.I \-a, \-\-all + Generate Man Pages for All Domains + .TP +-.I \-d, \-\-domain ++.I \-d, \-\-domain + Generate a Man Page for the specified domain. (Supports multiple commands) + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP ++.I \-o, \-\-os ++Specify the name of the OS to be used in the man page (only affects HTML man pages) ++.TP + .I \-p, \-\-path + Specify the directory to store the created man pages. (Default to /tmp) + .TP + .I \-r, \-\-root +-Specify alternate root directory to generate man pages from. (Default to /) ++Specify alternative root directory to generate man pages from. (Default to /) ++.TP ++.I \-\-source_files ++Use file_contexts and policy.xml files from the specified root directory (the alternative root needs to include both files) + .TP + .I \-w, \-\-web +-Generate an additional HTML man pages for the specified domain(s). ++Generate an additional HTML man pages for the specified domain(s) ++ ++.SH EXAMPLE ++.nf ++Generate man pages for all available domains ++# sepolicy manpage -a ++Generate an HTML man page for domain alsa_t, setting the OS name to "My_distro" ++# sepolicy manpage -o My_distro -d alsa_t -w + + .SH "AUTHOR" + This man page was written by Daniel Walsh +diff --git a/python/sepolicy/sepolicy-network.8 b/python/sepolicy/sepolicy-network.8 +index dcddec75..6faf60ab 100644 +--- a/python/sepolicy/sepolicy-network.8 ++++ b/python/sepolicy/sepolicy-network.8 +@@ -8,27 +8,27 @@ sepolicy-network \- Examine the SELinux Policy and generate a network report + .B sepolicy network [\-h] (\-l | \-a application [application ...] | \-p PORT [PORT ...] | \-t TYPE [TYPE ...] | \-d DOMAIN [DOMAIN ...]) + + .SH "DESCRIPTION" +-Use sepolicy network to examine SELinux Policy and generate network reports. ++Use \fBsepolicy network\fP to examine SELinux Policy and generate network reports. + + .SH "OPTIONS" + .TP + .I \-a, \-\-application +-Generate a report listing the ports to which the specified init application is allowed to connect and or bind. ++Generate a report listing the ports to which the specified init application is allowed to connect and or bind + .TP +-.I \-d, \-\-domain +-Generate a report listing the ports to which the specified domain is allowed to connect and or bind. ++.I \-d, \-\-domain ++Generate a report listing the ports to which the specified domain is allowed to connect and or bind + .TP +-.I \-l, \-\-list ++.I \-l, \-\-list + List all Network Port Types defined in SELinux Policy + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP + .I \-t, \-\-type +-Generate a report listing the port numbers associate with the specified SELinux port type. ++Generate a report listing the port numbers associate with the specified SELinux port type + .TP + .I \-p, \-\-port +-Generate a report listing the SELinux port types associate with the specified port number. ++Generate a report listing the SELinux port types associate with the specified port number + + .SH "EXAMPLES" + +@@ -88,4 +88,3 @@ This man page was written by Daniel Walsh + + .SH "SEE ALSO" + sepolicy(8), selinux(8), semanage(8) +- +diff --git a/python/sepolicy/sepolicy-transition.8 b/python/sepolicy/sepolicy-transition.8 +index 897f0c4c..9f9ff5a5 100644 +--- a/python/sepolicy/sepolicy-transition.8 ++++ b/python/sepolicy/sepolicy-transition.8 +@@ -11,21 +11,28 @@ sepolicy-transition \- Examine the SELinux Policy and generate a process transit + .B sepolicy transition [\-h] \-s SOURCE \-t TARGET + + .SH "DESCRIPTION" +-sepolicy transition will show all domains that a give SELinux source domain can transition to, including the entrypoint. ++\fBsepolicy transition\fP will show all domains that a given SELinux source domain can transition to, including the entrypoint. + +-If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the +-paths. If a transition is possible, this tool will print out all transition paths from the source domain to the target domain ++If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the ++paths. + + .SH "OPTIONS" + .TP +-.I \-h, \-\-help ++.I \-h, \-\-help + Display help message + .TP + .I \-s, \-\-source +-Specify the source SELinux domain type. ++Specify the source SELinux domain type + .TP + .I \-t, \-\-target +-Specify the target SELinux domain type. ++Specify the target SELinux domain type ++ ++.SH EXAMPLE ++.nf ++List all domain transition paths from init_t to httpd_t ++# sepolicy transition -s init_t -t httpd_t ++List all transitions available from samba domain, including entry points and booleans controlling each transition ++# sepolicy transition -s smbd_t + + .SH "AUTHOR" + This man page was written by Daniel Walsh +-- +2.40.0 + diff --git a/0012-sandbox-Add-examples-to-man-pages.patch b/0012-sandbox-Add-examples-to-man-pages.patch new file mode 100644 index 0000000..28c0e64 --- /dev/null +++ b/0012-sandbox-Add-examples-to-man-pages.patch @@ -0,0 +1,128 @@ +From 0beb84506b86844374d43db32180a4ea17aeb825 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 1 Jun 2023 16:39:13 +0200 +Subject: [PATCH] sandbox: Add examples to man pages + +While at it, remove trailing whitespaces. + +Signed-off-by: Vit Mojzis +Acked-by: Petr Lautrbach +--- + sandbox/sandbox.8 | 28 ++++++++++++++++++---------- + sandbox/seunshare.8 | 21 ++++++++++++++------- + 2 files changed, 32 insertions(+), 17 deletions(-) + +diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 +index 775e4b23..1c187019 100644 +--- a/sandbox/sandbox.8 ++++ b/sandbox/sandbox.8 +@@ -11,12 +11,12 @@ sandbox \- Run cmd under an SELinux sandbox + .br + .SH DESCRIPTION + .PP +-Run the +-.I cmd ++Run the ++.I cmd + application within a tightly confined SELinux domain. The default sandbox domain only allows applications the ability to read and write stdin, stdout and any other file descriptors handed to it. It is not allowed to open any other files. The \-M option will mount an alternate homedir and tmpdir to be used by the sandbox. + +-If you have the +-.I policycoreutils-sandbox ++If you have the ++.I policycoreutils-sandbox + package installed, you can use the \-X option and the \-M option. + .B sandbox \-X + allows you to run X applications within a sandbox. These applications will start up their own X Server and create a temporary home directory and /tmp. The default SELinux policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Files specified on the command that are in the home directory or /tmp will be copied into the sandbox directories. +@@ -78,27 +78,35 @@ Run a full desktop session, Requires level, and home and tmpdir. + Specifies the windowsize when creating an X based Sandbox. The default windowsize is 1000x700. + .TP + \fB\-W\fR \fB\-\-windowmanager\fR +-Select alternative window manager to run within ++Select alternative window manager to run within + .B sandbox \-X. + Default to /usr/bin/matchbox-window-manager. + .TP +-\fB\-X\fR ++\fB\-X\fR + Create an X based Sandbox for gui apps, temporary files for + $HOME and /tmp, secondary Xserver, defaults to sandbox_x_t + .TP + \fB\-d\fR \fB\-\-dpi\fR + Set the DPI value for the sandbox X Server. Defaults to the current X Sever DPI. + .TP +-\fB\-C\fR \fB\-\-capabilities\fR Use capabilities within the +-sandbox. By default applications executed within the sandbox will not +-be allowed to use capabilities (setuid apps), with the \-C flag, you +-can use programs requiring capabilities. ++\fB\-C\fR \fB\-\-capabilities\fR ++Use capabilities within the sandbox. By default applications executed within the sandbox will not be allowed to use capabilities (setuid apps), with the \-C flag, you can use programs requiring capabilities. + .PP + .SH "SEE ALSO" + .TP + runcon(1), seunshare(8), selinux(8) + .PP + ++.SH EXAMPLE ++.nf ++Run a graphical application inside the sandbox ++# sandbox -X evince ++Run a graphical application that requires the use of network ++# sandbox ‑X ‑t sandbox_web_t firefox ++Preserve data from one session to the next ++# mkdir -p ~/sandbox/home ~/sandbox/tmp ++# sandbox -H ~/sandbox/home -T ~/sandbox/tmp -X libreoffice --writer ++ + .SH AUTHOR + This manual page was written by + .I Dan Walsh +diff --git a/sandbox/seunshare.8 b/sandbox/seunshare.8 +index 09cf7fea..5339a3b1 100644 +--- a/sandbox/seunshare.8 ++++ b/sandbox/seunshare.8 +@@ -9,29 +9,36 @@ seunshare \- Run cmd with alternate homedir, tmpdir and/or SELinux context + .PP + Run the + .I executable +-within the specified context, using the alternate home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context. ++within the specified context, using custom home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context. + + .TP + \fB\-h homedir\fR +-Alternate homedir to be used by the application. Homedir must be owned by the user. ++Alternate homedir to be used by the application. Homedir must be owned by the user + .TP + \fB\-t\ tmpdir +-Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user. ++Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user + .TP + \fB\-r\ runuserdir +-Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user. ++Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user + .TP + \fB\-C --capabilities\fR +-Allow apps executed within the namespace to use capabilities. Default is no capabilities. ++Allow apps executed within the namespace to use capabilities. Default is no capabilities + .TP + \fB\-k --kill\fR +-Kill all processes with matching MCS level. ++Kill all processes with matching MCS level + .TP + \fB\-Z\ context +-Use alternate SELinux context while running the executable. ++Use alternate SELinux context while running the executable + .TP + \fB\-v\fR + Verbose output ++ ++.SH EXAMPLE ++.nf ++Run bash with temporary /home and /tmp directory ++# USERHOMEDIR=`mktemp -d /tmp/home.XXXXXX`; USERTEMPDIR=`mktemp -d /tmp/temp.XXXXXX` ++# seunshare -v -h ${USERHOMEDIR} -t ${USERTEMPDIR} -- /bin/bash ++ + .SH "SEE ALSO" + .TP + runcon(1), sandbox(8), selinux(8) +-- +2.40.0 + diff --git a/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch b/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch new file mode 100644 index 0000000..b2271a2 --- /dev/null +++ b/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch @@ -0,0 +1,93 @@ +From 73fd4231024f6241af6263ba74b70459bf9611f1 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 1 Jun 2023 18:34:30 +0200 +Subject: [PATCH] python/sepolicy: Fix template for confined user policy + modules + +The following commit +https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490 +changed the userdom_base_user_template, which now requires a role +corresponding to the user being created to be defined outside of the +template. +Similar change was also done to fedora-selinux/selinux-policy +https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f + +Although I believe the template should define the role (just as it +defines the new user), that will require extensive changes to refpolicy. +In the meantime the role needs to be defined separately. + +Fixes: + # sepolicy generate --term_user -n newuser + Created the following files: + /root/a/test/newuser.te # Type Enforcement file + /root/a/test/newuser.if # Interface file + /root/a/test/newuser.fc # File Contexts file + /root/a/test/newuser_selinux.spec # Spec file + /root/a/test/newuser.sh # Setup Script + + # ./newuser.sh + Building and Loading Policy + + make -f /usr/share/selinux/devel/Makefile newuser.pp + Compiling targeted newuser module + Creating targeted newuser.pp policy package + rm tmp/newuser.mod tmp/newuser.mod.fc + + /usr/sbin/semodule -i newuser.pp + Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8 + Failed to resolve AST + /usr/sbin/semodule: Failed! + +Signed-off-by: Vit Mojzis +Acked-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/templates/user.py | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py +index 1ff9d2ce..7081fbae 100644 +--- a/python/sepolicy/sepolicy/templates/user.py ++++ b/python/sepolicy/sepolicy/templates/user.py +@@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0) + # + # Declarations + # ++role TEMPLATETYPE_r; ++ + userdom_unpriv_user_template(TEMPLATETYPE) + """ + +@@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0) + # + # Declarations + # ++role TEMPLATETYPE_r; ++ + userdom_admin_user_template(TEMPLATETYPE) + """ + +@@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0) + # + # Declarations + # ++role TEMPLATETYPE_r; + + userdom_restricted_user_template(TEMPLATETYPE) + """ +@@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0) + # + # Declarations + # ++role TEMPLATETYPE_r; + + userdom_restricted_xwindows_user_template(TEMPLATETYPE) + """ +@@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false) + # + # Declarations + # ++role TEMPLATETYPE_r; + + userdom_base_user_template(TEMPLATETYPE) + """ +-- +2.40.0 + diff --git a/0014-python-sepolicy-Fix-spec-file-dependencies.patch b/0014-python-sepolicy-Fix-spec-file-dependencies.patch new file mode 100644 index 0000000..0f178b9 --- /dev/null +++ b/0014-python-sepolicy-Fix-spec-file-dependencies.patch @@ -0,0 +1,47 @@ +From 057ea895d85ae8297749778a3dcfc4ff7489ab37 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 30 May 2023 09:07:28 +0200 +Subject: [PATCH] python/sepolicy: Fix spec file dependencies + +semanage is part of policycoreutils-python-utils package, selinuxenabled +is part of libselinux-utils (required by ^^^) and restorecon/load_policy +are part of policycoreutils (also required by policycoreutils-python-utils). + +Signed-off-by: Vit Mojzis +--- + python/sepolicy/sepolicy/templates/spec.py | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/python/sepolicy/sepolicy/templates/spec.py b/python/sepolicy/sepolicy/templates/spec.py +index 16a22081..cb3b2f63 100644 +--- a/python/sepolicy/sepolicy/templates/spec.py ++++ b/python/sepolicy/sepolicy/templates/spec.py +@@ -11,18 +11,20 @@ Version: 1.0 + Release: 1%{?dist} + Summary: SELinux policy module for MODULENAME + +-Group: System Environment/Base +-License: GPLv2+ ++Group: System Environment/Base ++License: GPLv2+ + # This is an example. You will need to change it. ++# For a complete guide on packaging your policy ++# see https://fedoraproject.org/wiki/SELinux/IndependentPolicy + URL: http://HOSTNAME + Source0: MODULENAME.pp + Source1: MODULENAME.if + Source2: DOMAINNAME_selinux.8 + Source3: DOMAINNAME_u + +-Requires: policycoreutils, libselinux-utils +-Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils +-Requires(postun): policycoreutils ++Requires: policycoreutils-python-utils, libselinux-utils ++Requires(post): selinux-policy-base >= %{selinux_policyver}, policycoreutils-python-utils ++Requires(postun): policycoreutils-python-utils + """ + + mid_section="""\ +-- +2.40.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index eb075ab..6cfec73 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -36,6 +36,15 @@ Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch +Patch0006: 0006-python-chcat-Improve-man-pages.patch +Patch0007: 0007-python-audit2allow-Add-missing-options-to-man-page.patch +Patch0008: 0008-python-semanage-Improve-man-pages.patch +Patch0009: 0009-python-audit2allow-Remove-unused-debug-option.patch +Patch0010: 0010-policycoreutils-Add-examples-to-man-pages.patch +Patch0011: 0011-python-sepolicy-Improve-man-pages.patch +Patch0012: 0012-sandbox-Add-examples-to-man-pages.patch +Patch0013: 0013-python-sepolicy-Fix-template-for-confined-user-polic.patch +Patch0014: 0014-python-sepolicy-Fix-spec-file-dependencies.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -443,6 +452,11 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Wed Jun 21 2023 Vit Mojzis - 3.5-5 +- python/sepolicy: Fix spec file dependencies +- python/sepolicy: Fix template for confined user policy modules +- Improve man pages and add examples + * Tue Jun 13 2023 Python Maint - 3.5-4 - Rebuilt for Python 3.12 From aa0a78d0f19f08e466e1a2937be46c9fdc18c21f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 06:01:10 +0000 Subject: [PATCH 35/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 6cfec73..39cb285 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -452,6 +452,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 3.5-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jun 21 2023 Vit Mojzis - 3.5-5 - python/sepolicy: Fix spec file dependencies - python/sepolicy: Fix template for confined user policy modules From 05444f27d021a8a6bede449dc856c07cd07baf42 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 1 Aug 2023 11:38:39 +0200 Subject: [PATCH 36/79] policycoreutils-3.5-7 - python: improve format strings for proper localization - python: Drop hard formating from localized strings - sepolicy: port to dnf4 python API (rhbz#2209404) --- ...ormat-strings-for-proper-localizatio.patch | 455 ++++ ...ard-formating-from-localized-strings.patch | 148 ++ ...rop-unnecessary-import-from-seobject.patch | 32 + 0018-python-update-python.pot.patch | 2009 +++++++++++++++++ 0019-sepolicy-port-to-dnf4-python-API.patch | 84 + policycoreutils.spec | 14 +- 6 files changed, 2740 insertions(+), 2 deletions(-) create mode 100644 0015-python-improve-format-strings-for-proper-localizatio.patch create mode 100644 0016-python-Drop-hard-formating-from-localized-strings.patch create mode 100644 0017-semanage-Drop-unnecessary-import-from-seobject.patch create mode 100644 0018-python-update-python.pot.patch create mode 100644 0019-sepolicy-port-to-dnf4-python-API.patch diff --git a/0015-python-improve-format-strings-for-proper-localizatio.patch b/0015-python-improve-format-strings-for-proper-localizatio.patch new file mode 100644 index 0000000..79f1193 --- /dev/null +++ b/0015-python-improve-format-strings-for-proper-localizatio.patch @@ -0,0 +1,455 @@ +From d55f376b3cdff4e4159db32039175f9a5ea105db Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 16 May 2023 15:45:05 +0200 +Subject: [PATCH] python: improve format strings for proper localization +Content-type: text/plain + +If a string contains more than one unnamed argument it's hard for +translators to proper localize as they don't know which value is +represented by a unnamed argument. It also blocks them to use a +different order of arguments which would make better sense in other +languages. + +Fixes: + + $ xgettext --default-domain=python -L Python --keyword=_ --keyword=N_ ../audit2allow/audit2allow ../chcat/chcat ../semanage/semanage ../semanage/seobject.py ../sepolgen/src/sepolgen/interfaces.py ../sepolicy/sepolicy/generate.py ../sepolicy/sepolicy/gui.py ../sepolicy/sepolicy/__init__.py ../sepolicy/sepolicy/interface.py ../sepolicy/sepolicy.py + ../chcat/chcat:220: warning: 'msgid' format string with unnamed arguments cannot be properly localized: + The translator cannot reorder the arguments. + Please consider using a format string with named arguments, + and a mapping instead of a tuple for the arguments. + ../semanage/seobject.py:1178: warning: 'msgid' format string with unnamed arguments cannot be properly localized: + The translator cannot reorder the arguments. + Please consider using a format string with named arguments, + and a mapping instead of a tuple for the arguments. + ... + +Signed-off-by: Petr Lautrbach +--- + python/chcat/chcat | 6 +- + python/semanage/seobject.py | 130 ++++++++++++++++++------------------ + 2 files changed, 68 insertions(+), 68 deletions(-) + +diff --git a/python/chcat/chcat b/python/chcat/chcat +index 68718ec5f102..c4f592291821 100755 +--- a/python/chcat/chcat ++++ b/python/chcat/chcat +@@ -125,7 +125,7 @@ def chcat_add(orig, newcat, objects, login_ind): + + if len(clist) > 1: + if cat in clist[1:]: +- print(_("%s is already in %s") % (f, orig)) ++ print(_("{target} is already in {category}").format(target=f, category=orig)) + continue + clist.append(cat) + cats = clist[1:] +@@ -207,7 +207,7 @@ def chcat_remove(orig, newcat, objects, login_ind): + + if len(clist) > 1: + if cat not in clist[1:]: +- print(_("%s is not in %s") % (f, orig)) ++ print(_("{target} is not in {category}").format(target=f, category=orig)) + continue + clist.remove(cat) + if len(clist) > 1: +@@ -217,7 +217,7 @@ def chcat_remove(orig, newcat, objects, login_ind): + else: + cat = "" + else: +- print(_("%s is not in %s") % (f, orig)) ++ print(_("{target} is not in {category}").format(target=f, category=orig)) + continue + + if len(cat) == 0: +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index d82da4942987..2b1eb44ce8a3 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -843,7 +843,7 @@ class seluserRecords(semanageRecords): + for r in roles: + rc = semanage_user_add_role(self.sh, u, r) + if rc < 0: +- raise ValueError(_("Could not add role %s for %s") % (r, name)) ++ raise ValueError(_("Could not add role {role} for {name}").format(role=r, name=name)) + + if is_mls_enabled == 1: + rc = semanage_user_set_mlsrange(self.sh, u, serange) +@@ -855,7 +855,7 @@ class seluserRecords(semanageRecords): + raise ValueError(_("Could not set MLS level for %s") % name) + rc = semanage_user_set_prefix(self.sh, u, prefix) + if rc < 0: +- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix)) ++ raise ValueError(_("Could not add prefix {prefix} for {role}").format(role=r, prefix=prefix)) + (rc, key) = semanage_user_key_extract(self.sh, u) + if rc < 0: + raise ValueError(_("Could not extract key for %s") % name) +@@ -1088,7 +1088,7 @@ class portRecords(semanageRecords): + + (rc, k) = semanage_port_key_create(self.sh, low, high, proto_d) + if rc < 0: +- raise ValueError(_("Could not create a key for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not create a key for {proto}/{port}").format(proto=proto, port=port)) + return (k, proto_d, low, high) + + def __add(self, port, proto, serange, type): +@@ -1110,44 +1110,44 @@ class portRecords(semanageRecords): + + (rc, exists) = semanage_port_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) ++ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) + if exists: +- raise ValueError(_("Port %s/%s already defined") % (proto, port)) ++ raise ValueError(_("Port {proto}/{port} already defined").format(proto=proto, port=port)) + + (rc, p) = semanage_port_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create port for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not create port for {proto}/{port}").format(proto=proto, port=port)) + + semanage_port_set_proto(p, proto_d) + semanage_port_set_range(p, low, high) + (rc, con) = semanage_context_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not create context for {proto}/{port}").format(proto=proto, port=port)) + + rc = semanage_context_set_user(self.sh, con, "system_u") + if rc < 0: +- raise ValueError(_("Could not set user in port context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not set user in port context for {proto}/{port}").format(proto=proto, port=port)) + + rc = semanage_context_set_role(self.sh, con, "object_r") + if rc < 0: +- raise ValueError(_("Could not set role in port context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not set role in port context for {proto}/{port}").format(proto=proto, port=port)) + + rc = semanage_context_set_type(self.sh, con, type) + if rc < 0: +- raise ValueError(_("Could not set type in port context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not set type in port context for {proto}/{port}").format(proto=proto, port=port)) + + if (is_mls_enabled == 1) and (serange != ""): + rc = semanage_context_set_mls(self.sh, con, serange) + if rc < 0: +- raise ValueError(_("Could not set mls fields in port context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not set mls fields in port context for {proto}/{port}").format(proto=proto, port=port)) + + rc = semanage_port_set_con(self.sh, p, con) + if rc < 0: +- raise ValueError(_("Could not set port context for %s/%s") % (proto, port)) ++ raise ValueError(_("Could not set port context for {proto}/{port}").format(proto=proto, port=port)) + + rc = semanage_port_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not add port %s/%s") % (proto, port)) ++ raise ValueError(_("Could not add port {proto}/{port}").format(proto=proto, port=port)) + + semanage_context_free(con) + semanage_port_key_free(k) +@@ -1175,13 +1175,13 @@ class portRecords(semanageRecords): + + (rc, exists) = semanage_port_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) ++ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) + if not exists: +- raise ValueError(_("Port %s/%s is not defined") % (proto, port)) ++ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port)) + + (rc, p) = semanage_port_query(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not query port %s/%s") % (proto, port)) ++ raise ValueError(_("Could not query port {proto}/{port}").format(proto=proto, port=port)) + + con = semanage_port_get_con(p) + +@@ -1195,7 +1195,7 @@ class portRecords(semanageRecords): + + rc = semanage_port_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not modify port %s/%s") % (proto, port)) ++ raise ValueError(_("Could not modify port {proto}/{port}").format(proto=proto, port=port)) + + semanage_port_key_free(k) + semanage_port_free(p) +@@ -1241,19 +1241,19 @@ class portRecords(semanageRecords): + (k, proto_d, low, high) = self.__genkey(port, proto) + (rc, exists) = semanage_port_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) ++ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) + if not exists: +- raise ValueError(_("Port %s/%s is not defined") % (proto, port)) ++ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port)) + + (rc, exists) = semanage_port_exists_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) ++ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) + if not exists: +- raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port)) ++ raise ValueError(_("Port {proto}/{port} is defined in policy, cannot be deleted").format(proto=proto, port=port)) + + rc = semanage_port_del_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not delete port %s/%s") % (proto, port)) ++ raise ValueError(_("Could not delete port {proto}/{port}").format(proto=proto, port=port)) + + semanage_port_key_free(k) + +@@ -1362,7 +1362,7 @@ class ibpkeyRecords(semanageRecords): + + (rc, k) = semanage_ibpkey_key_create(self.sh, subnet_prefix, low, high) + if rc < 0: +- raise ValueError(_("Could not create a key for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not create a key for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + return (k, subnet_prefix, low, high) + + def __add(self, pkey, subnet_prefix, serange, type): +@@ -1384,44 +1384,44 @@ class ibpkeyRecords(semanageRecords): + + (rc, exists) = semanage_ibpkey_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").formnat(subnet_prefix=subnet_prefix, pkey=pkey)) + if exists: +- raise ValueError(_("ibpkey %s/%s already defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} already defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + (rc, p) = semanage_ibpkey_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create ibpkey for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not create ibpkey for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + semanage_ibpkey_set_subnet_prefix(self.sh, p, subnet_prefix) + semanage_ibpkey_set_range(p, low, high) + (rc, con) = semanage_context_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not create context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_context_set_user(self.sh, con, "system_u") + if rc < 0: +- raise ValueError(_("Could not set user in ibpkey context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not set user in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_context_set_role(self.sh, con, "object_r") + if rc < 0: +- raise ValueError(_("Could not set role in ibpkey context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not set role in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_context_set_type(self.sh, con, type) + if rc < 0: +- raise ValueError(_("Could not set type in ibpkey context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not set type in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + if (is_mls_enabled == 1) and (serange != ""): + rc = semanage_context_set_mls(self.sh, con, serange) + if rc < 0: +- raise ValueError(_("Could not set mls fields in ibpkey context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not set mls fields in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_ibpkey_set_con(self.sh, p, con) + if rc < 0: +- raise ValueError(_("Could not set ibpkey context for %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not set ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_ibpkey_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not add ibpkey %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not add ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + semanage_context_free(con) + semanage_ibpkey_key_free(k) +@@ -1448,13 +1448,13 @@ class ibpkeyRecords(semanageRecords): + + (rc, exists) = semanage_ibpkey_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + if not exists: +- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + (rc, p) = semanage_ibpkey_query(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not query ibpkey %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not query ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + con = semanage_ibpkey_get_con(p) + +@@ -1465,7 +1465,7 @@ class ibpkeyRecords(semanageRecords): + + rc = semanage_ibpkey_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not modify ibpkey %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not modify ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + semanage_ibpkey_key_free(k) + semanage_ibpkey_free(p) +@@ -1502,19 +1502,19 @@ class ibpkeyRecords(semanageRecords): + (k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix) + (rc, exists) = semanage_ibpkey_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + if not exists: +- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + (rc, exists) = semanage_ibpkey_exists_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) + if not exists: +- raise ValueError(_("ibpkey %s/%s is defined in policy, cannot be deleted") % (subnet_prefix, pkey)) ++ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deleted").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + rc = semanage_ibpkey_del_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not delete ibpkey %s/%s") % (subnet_prefix, pkey)) ++ raise ValueError(_("Could not delete ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) + + semanage_ibpkey_key_free(k) + +@@ -1617,7 +1617,7 @@ class ibendportRecords(semanageRecords): + + (rc, k) = semanage_ibendport_key_create(self.sh, ibdev_name, port) + if rc < 0: +- raise ValueError(_("Could not create a key for ibendport %s/%s") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not create a key for ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) + return (k, ibdev_name, port) + + def __add(self, ibendport, ibdev_name, serange, type): +@@ -1638,44 +1638,44 @@ class ibendportRecords(semanageRecords): + + (rc, exists) = semanage_ibendport_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, port)) ++ raise ValueError(_("Could not check if ibendport {ibdev_name}/{port} is defined").format(ibdev_name=ibdev_name, port=port)) + if exists: +- raise ValueError(_("ibendport %s/%s already defined") % (ibdev_name, port)) ++ raise ValueError(_("ibendport {ibdev_name}/{port} already defined").format(ibdev_name=ibdev_name, port=port)) + + (rc, p) = semanage_ibendport_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create ibendport for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not create ibendport for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + semanage_ibendport_set_ibdev_name(self.sh, p, ibdev_name) + semanage_ibendport_set_port(p, port) + (rc, con) = semanage_context_create(self.sh) + if rc < 0: +- raise ValueError(_("Could not create context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not create context for {ibendport}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_context_set_user(self.sh, con, "system_u") + if rc < 0: +- raise ValueError(_("Could not set user in ibendport context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not set user in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_context_set_role(self.sh, con, "object_r") + if rc < 0: +- raise ValueError(_("Could not set role in ibendport context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not set role in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_context_set_type(self.sh, con, type) + if rc < 0: +- raise ValueError(_("Could not set type in ibendport context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not set type in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + if (is_mls_enabled == 1) and (serange != ""): + rc = semanage_context_set_mls(self.sh, con, serange) + if rc < 0: +- raise ValueError(_("Could not set mls fields in ibendport context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not set mls fields in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_ibendport_set_con(self.sh, p, con) + if rc < 0: +- raise ValueError(_("Could not set ibendport context for %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not set ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_ibendport_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not add ibendport %s/%s") % (ibdev_name, port)) ++ raise ValueError(_("Could not add ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + semanage_context_free(con) + semanage_ibendport_key_free(k) +@@ -1702,13 +1702,13 @@ class ibendportRecords(semanageRecords): + + (rc, exists) = semanage_ibendport_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) + if not exists: +- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport)) ++ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + (rc, p) = semanage_ibendport_query(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not query ibendport %s/%s") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not query ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + con = semanage_ibendport_get_con(p) + +@@ -1719,7 +1719,7 @@ class ibendportRecords(semanageRecords): + + rc = semanage_ibendport_modify_local(self.sh, k, p) + if rc < 0: +- raise ValueError(_("Could not modify ibendport %s/%s") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not modify ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + semanage_ibendport_key_free(k) + semanage_ibendport_free(p) +@@ -1741,11 +1741,11 @@ class ibendportRecords(semanageRecords): + port = semanage_ibendport_get_port(ibendport) + (k, ibdev_name, port) = self.__genkey(str(port), ibdev_name) + if rc < 0: +- raise ValueError(_("Could not create a key for %s/%d") % (ibdevname, port)) ++ raise ValueError(_("Could not create a key for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + + rc = semanage_ibendport_del_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not delete the ibendport %s/%d") % (ibdev_name, port)) ++ raise ValueError(_("Could not delete the ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) + semanage_ibendport_key_free(k) + + self.commit() +@@ -1754,19 +1754,19 @@ class ibendportRecords(semanageRecords): + (k, ibdev_name, port) = self.__genkey(ibendport, ibdev_name) + (rc, exists) = semanage_ibendport_exists(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) + if not exists: +- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport)) ++ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + (rc, exists) = semanage_ibendport_exists_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) + if not exists: +- raise ValueError(_("ibendport %s/%s is defined in policy, cannot be deleted") % (ibdev_name, ibendport)) ++ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deleted").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + rc = semanage_ibendport_del_local(self.sh, k) + if rc < 0: +- raise ValueError(_("Could not delete ibendport %s/%s") % (ibdev_name, ibendport)) ++ raise ValueError(_("Could not delete ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) + + semanage_ibendport_key_free(k) + +@@ -2765,7 +2765,7 @@ class booleanRecords(semanageRecords): + try: + boolname, val = b.split("=") + except ValueError: +- raise ValueError(_("Bad format %s: Record %s" % (name, b))) ++ raise ValueError(_("Bad format {filename}: Record {record}").format(filename=name, record=b)) + self.__mod(boolname.strip(), val.strip()) + fd.close() + else: +-- +2.41.0 + diff --git a/0016-python-Drop-hard-formating-from-localized-strings.patch b/0016-python-Drop-hard-formating-from-localized-strings.patch new file mode 100644 index 0000000..612a03b --- /dev/null +++ b/0016-python-Drop-hard-formating-from-localized-strings.patch @@ -0,0 +1,148 @@ +From 9de7df951d5c54de2a58e728a2089a0837f0c72e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 17 May 2023 12:18:54 +0200 +Subject: [PATCH] python: Drop hard formating from localized strings +Content-type: text/plain + +It confuses translators and new lines are dropped by parser module anyway. + +Signed-off-by: Petr Lautrbach +--- + python/audit2allow/audit2allow | 14 ++++++-- + python/semanage/semanage | 60 +++++++++++++--------------------- + 2 files changed, 34 insertions(+), 40 deletions(-) + +diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow +index 5587a2dbb006..35b0b151ac86 100644 +--- a/python/audit2allow/audit2allow ++++ b/python/audit2allow/audit2allow +@@ -234,9 +234,17 @@ class AuditToPolicy: + print(e) + sys.exit(1) + +- sys.stdout.write(_("******************** IMPORTANT ***********************\n")) +- sys.stdout.write((_("To make this policy package active, execute:" + +- "\n\nsemodule -i %s\n\n") % packagename)) ++ sys.stdout.write( ++"""******************** {important} *********************** ++{text} ++ ++semodule -i {packagename} ++ ++""".format( ++ important=_("IMPORTANT"), ++ text=_("To make this policy package active, execute:"), ++ packagename=packagename ++)) + + def __output_audit2why(self): + import selinux +diff --git a/python/semanage/semanage b/python/semanage/semanage +index e0bd98a95c77..4fdb490f7df4 100644 +--- a/python/semanage/semanage ++++ b/python/semanage/semanage +@@ -238,30 +238,22 @@ def parser_add_level(parser, name): + + + def parser_add_range(parser, name): +- parser.add_argument('-r', '--range', default='', +- help=_(''' +-MLS/MCS Security Range (MLS/MCS Systems only) +-SELinux Range for SELinux login mapping +-defaults to the SELinux user record range. +-SELinux Range for SELinux user defaults to s0. +-''')) ++ parser.add_argument('-r', '--range', default='', help=_( ++ "MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. \ ++SELinux Range for SELinux user defaults to s0." ++ )) + + + def parser_add_proto(parser, name): +- parser.add_argument('-p', '--proto', help=_(''' +- Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol +- version for the specified node (ipv4|ipv6). +-''')) ++ parser.add_argument('-p', '--proto', help=_( ++ "Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6)." ++ )) + + def parser_add_subnet_prefix(parser, name): +- parser.add_argument('-x', '--subnet_prefix', help=_(''' +- Subnet prefix for the specified infiniband ibpkey. +-''')) ++ parser.add_argument('-x', '--subnet_prefix', help=_('Subnet prefix for the specified infiniband ibpkey.')) + + def parser_add_ibdev_name(parser, name): +- parser.add_argument('-z', '--ibdev_name', help=_(''' +- Name for the specified infiniband end port. +-''')) ++ parser.add_argument('-z', '--ibdev_name', help=_("Name for the specified infiniband end port.")) + + def parser_add_modify(parser, name): + parser.add_argument('-m', '--modify', dest='action', action='store_const', const='modify', help=_("Modify a record of the %s object type") % name) +@@ -348,15 +340,6 @@ def handleFcontext(args): + + + def setupFcontextParser(subparsers): +- ftype_help = ''' +-File Type. This is used with fcontext. Requires a file type +-as shown in the mode field by ls, e.g. use d to match only +-directories or f to match only regular files. The following +-file type options can be passed: +-f (regular file),d (directory),c (character device), +-b (block device),s (socket),l (symbolic link),p (named pipe) +-If you do not specify a file type, the file type will default to "all files". +-''' + generate_usage = generate_custom_usage(usage_fcontext, usage_fcontext_dict) + fcontextParser = subparsers.add_parser('fcontext', usage=generate_usage, help=_("Manage file context mapping definitions")) + parser_add_locallist(fcontextParser, "fcontext") +@@ -372,11 +355,16 @@ If you do not specify a file type, the file type will default to "all files". + parser_add_extract(fcontext_action, "fcontext") + parser_add_deleteall(fcontext_action, "fcontext") + +- fcontextParser.add_argument('-e', '--equal', help=_('''Substitute target path with sourcepath when generating default +- label. This is used with fcontext. Requires source and target +- path arguments. The context labeling for the target subtree is +- made equivalent to that defined for the source.''')) +- fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_(ftype_help)) ++ fcontextParser.add_argument('-e', '--equal', help=_( ++ 'Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target \ ++path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.' ++ )) ++ fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_( ++ 'File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use d to match only \ ++directories or f to match only regular files. The following file type options can be passed: f (regular file), d (directory), \ ++c (character device), b (block device), s (socket), l (symbolic link), p (named pipe). \ ++If you do not specify a file type, the file type will default to "all files".' ++ )) + parser_add_seuser(fcontextParser, "fcontext") + parser_add_type(fcontextParser, "fcontext") + parser_add_range(fcontextParser, "fcontext") +@@ -426,9 +414,7 @@ def setupUserParser(subparsers): + parser_add_range(userParser, "user") + userParser.add_argument('-R', '--roles', default=[], + action=CheckRole, +- help=_(''' +-SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times. +-''')) ++ help=_("SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times.")) + userParser.add_argument('-P', '--prefix', default="user", help=argparse.SUPPRESS) + userParser.add_argument('selinux_name', nargs='?', default=None, help=_('selinux_name')) + userParser.set_defaults(func=handleUser) +@@ -901,9 +887,9 @@ def setupImportParser(subparsers): + def createCommandParser(): + commandParser = seParser(prog='semanage', + formatter_class=argparse.ArgumentDefaultsHelpFormatter, +- description='''semanage is used to configure certain elements +- of SELinux policy with-out requiring modification +- to or recompilation from policy source.''') ++ description=_( ++ "semanage is used to configure certain elements of SELinux policy with-out requiring modification or recompilation from policy source." ++ )) + + #To add a new subcommand define the parser for it in a function above and call it here. + subparsers = commandParser.add_subparsers(dest='subcommand') +-- +2.41.0 + diff --git a/0017-semanage-Drop-unnecessary-import-from-seobject.patch b/0017-semanage-Drop-unnecessary-import-from-seobject.patch new file mode 100644 index 0000000..03fb543 --- /dev/null +++ b/0017-semanage-Drop-unnecessary-import-from-seobject.patch @@ -0,0 +1,32 @@ +From 74b849c9405f1b751e696c7fb2e419fcbd491fab Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 17 May 2023 13:09:58 +0200 +Subject: [PATCH] semanage: Drop unnecessary import from seobject +Content-type: text/plain + +sepolgen.module is not used for permissive domains + +Signed-off-by: Petr Lautrbach +--- + python/semanage/seobject.py | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index 2b1eb44ce8a3..361205d11c10 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -504,11 +504,6 @@ class permissiveRecords(semanageRecords): + print(t) + + def add(self, type): +- try: +- import sepolgen.module as module +- except ImportError: +- raise ValueError(_("The sepolgen python module is required to setup permissive domains.\nIn some distributions it is included in the policycoreutils-devel package.\n# yum install policycoreutils-devel\nOr similar for your distro.")) +- + name = "permissive_%s" % type + modtxt = "(typepermissive %s)" % type + +-- +2.41.0 + diff --git a/0018-python-update-python.pot.patch b/0018-python-update-python.pot.patch new file mode 100644 index 0000000..e928a89 --- /dev/null +++ b/0018-python-update-python.pot.patch @@ -0,0 +1,2009 @@ +From 7f00d6b53f73ee501fa4c6e48f85e641841efcc1 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 17 May 2023 13:52:22 +0200 +Subject: [PATCH] python: update python.pot +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +--- + python/po/python.pot | 963 ++++++++++++++++++++++--------------------- + 1 file changed, 487 insertions(+), 476 deletions(-) + +diff --git a/python/po/python.pot b/python/po/python.pot +index 16d04eb0f18e..435a1b764e34 100644 +--- a/python/po/python.pot ++++ b/python/po/python.pot +@@ -8,7 +8,7 @@ msgid "" + msgstr "" + "Project-Id-Version: PACKAGE VERSION\n" + "Report-Msgid-Bugs-To: \n" +-"POT-Creation-Date: 2023-01-18 11:57+0100\n" ++"POT-Creation-Date: 2023-06-12 18:13+0200\n" + "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" + "Last-Translator: FULL NAME \n" + "Language-Team: LANGUAGE \n" +@@ -17,17 +17,12 @@ msgstr "" + "Content-Type: text/plain; charset=UTF-8\n" + "Content-Transfer-Encoding: 8bit\n" + +-#: ../audit2allow/audit2allow:239 +-msgid "******************** IMPORTANT ***********************\n" ++#: ../audit2allow/audit2allow:244 ++msgid "IMPORTANT" + msgstr "" + +-#: ../audit2allow/audit2allow:240 +-#, python-format +-msgid "" +-"To make this policy package active, execute:\n" +-"\n" +-"semodule -i %s\n" +-"\n" ++#: ../audit2allow/audit2allow:245 ++msgid "To make this policy package active, execute:" + msgstr "" + + #: ../chcat/chcat:111 ../chcat/chcat:191 +@@ -40,13 +35,13 @@ msgid "Can not modify sensitivity levels using '+' on %s" + msgstr "" + + #: ../chcat/chcat:128 +-#, python-format +-msgid "%s is already in %s" ++#, python-brace-format ++msgid "{target} is already in {category}" + msgstr "" + + #: ../chcat/chcat:210 ../chcat/chcat:220 +-#, python-format +-msgid "%s is not in %s" ++#, python-brace-format ++msgid "{target} is not in {category}" + msgstr "" + + #: ../chcat/chcat:291 ../chcat/chcat:296 +@@ -152,218 +147,222 @@ msgstr "" + + #: ../semanage/semanage:242 + msgid "" +-"\n" +-"MLS/MCS Security Range (MLS/MCS Systems only)\n" +-"SELinux Range for SELinux login mapping\n" +-"defaults to the SELinux user record range.\n" +-"SELinux Range for SELinux user defaults to s0.\n" ++"MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux " ++"login mapping defaults to the SELinux user record range. SELinux Range for " ++"SELinux user defaults to s0." + msgstr "" + +-#: ../semanage/semanage:251 ++#: ../semanage/semanage:249 + msgid "" +-"\n" +-" Protocol for the specified port (tcp|udp|dccp|sctp) or internet " +-"protocol\n" +-" version for the specified node (ipv4|ipv6).\n" ++"Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol " ++"version for the specified node (ipv4|ipv6)." + msgstr "" + +-#: ../semanage/semanage:257 +-msgid "" +-"\n" +-" Subnet prefix for the specified infiniband ibpkey.\n" ++#: ../semanage/semanage:253 ++msgid "Subnet prefix for the specified infiniband ibpkey." + msgstr "" + +-#: ../semanage/semanage:262 +-msgid "" +-"\n" +-" Name for the specified infiniband end port.\n" ++#: ../semanage/semanage:256 ++msgid "Name for the specified infiniband end port." + msgstr "" + +-#: ../semanage/semanage:267 ++#: ../semanage/semanage:259 + #, python-format + msgid "Modify a record of the %s object type" + msgstr "" + +-#: ../semanage/semanage:271 ++#: ../semanage/semanage:263 + #, python-format + msgid "List records of the %s object type" + msgstr "" + +-#: ../semanage/semanage:275 ++#: ../semanage/semanage:267 + #, python-format + msgid "Delete a record of the %s object type" + msgstr "" + +-#: ../semanage/semanage:279 ++#: ../semanage/semanage:271 + msgid "Extract customizable commands, for use within a transaction" + msgstr "" + +-#: ../semanage/semanage:283 ++#: ../semanage/semanage:275 + #, python-format + msgid "Remove all %s objects local customizations" + msgstr "" + +-#: ../semanage/semanage:287 ++#: ../semanage/semanage:279 + msgid "SELinux user name" + msgstr "" + +-#: ../semanage/semanage:292 ++#: ../semanage/semanage:284 + msgid "Manage login mappings between linux users and SELinux confined users" + msgstr "" + +-#: ../semanage/semanage:309 ++#: ../semanage/semanage:301 + #, python-format + msgid "login_name | %%groupname" + msgstr "" + +-#: ../semanage/semanage:361 ++#: ../semanage/semanage:344 + msgid "Manage file context mapping definitions" + msgstr "" + +-#: ../semanage/semanage:375 ++#: ../semanage/semanage:359 ++msgid "" ++"Substitute target path with sourcepath when generating default label. This " ++"is used with fcontext. Requires source and target path arguments. The " ++"context labeling for the target subtree is made equivalent to that defined " ++"for the source." ++msgstr "" ++ ++#: ../semanage/semanage:363 + msgid "" +-"Substitute target path with sourcepath when generating default\n" +-" label. " +-"This is used with fcontext. Requires source and target\n" +-" path " +-"arguments. The context labeling for the target subtree is\n" +-" made " +-"equivalent to that defined for the source." ++"File Type. This is used with fcontext. Requires a file type as shown in the " ++"mode field by ls, e.g. use d to match only directories or f to match only " ++"regular files. The following file type options can be passed: f (regular " ++"file), d (directory), c (character device), b (block device), s (socket), l " ++"(symbolic link), p (named pipe). If you do not specify a file type, the file " ++"type will default to \"all files\"." + msgstr "" + +-#: ../semanage/semanage:383 ++#: ../semanage/semanage:371 + msgid "" + "Path to be labeled (may be in the form of a Perl compatible regular " + "expression)" + msgstr "" + +-#: ../semanage/semanage:411 ++#: ../semanage/semanage:399 + msgid "Manage SELinux confined users (Roles and levels for an SELinux user)" + msgstr "" + +-#: ../semanage/semanage:429 ++#: ../semanage/semanage:417 + msgid "" +-"\n" +-"SELinux Roles. You must enclose multiple roles within quotes, separate by " +-"spaces. Or specify -R multiple times.\n" ++"SELinux Roles. You must enclose multiple roles within quotes, separate by " ++"spaces. Or specify -R multiple times." + msgstr "" + +-#: ../semanage/semanage:433 ++#: ../semanage/semanage:419 + msgid "selinux_name" + msgstr "" + +-#: ../semanage/semanage:461 ++#: ../semanage/semanage:447 + msgid "Manage network port type definitions" + msgstr "" + +-#: ../semanage/semanage:477 ++#: ../semanage/semanage:463 + msgid "port | port_range" + msgstr "" + +-#: ../semanage/semanage:506 ++#: ../semanage/semanage:492 + msgid "Manage infiniband ibpkey type definitions" + msgstr "" + +-#: ../semanage/semanage:522 ++#: ../semanage/semanage:508 + msgid "pkey | pkey_range" + msgstr "" + +-#: ../semanage/semanage:549 ++#: ../semanage/semanage:535 + msgid "Manage infiniband end port type definitions" + msgstr "" + +-#: ../semanage/semanage:565 ++#: ../semanage/semanage:551 + msgid "ibendport" + msgstr "" + +-#: ../semanage/semanage:592 ++#: ../semanage/semanage:578 + msgid "Manage network interface type definitions" + msgstr "" + +-#: ../semanage/semanage:607 ++#: ../semanage/semanage:593 + msgid "interface_spec" + msgstr "" + +-#: ../semanage/semanage:631 ++#: ../semanage/semanage:617 + msgid "Manage SELinux policy modules" + msgstr "" + +-#: ../semanage/semanage:642 ++#: ../semanage/semanage:628 + msgid "Add a module" + msgstr "" + +-#: ../semanage/semanage:643 ++#: ../semanage/semanage:629 + msgid "Remove a module" + msgstr "" + +-#: ../semanage/semanage:644 ++#: ../semanage/semanage:630 + msgid "Disable a module" + msgstr "" + +-#: ../semanage/semanage:645 ++#: ../semanage/semanage:631 + msgid "Enable a module" + msgstr "" + +-#: ../semanage/semanage:672 ++#: ../semanage/semanage:658 + msgid "Manage network node type definitions" + msgstr "" + +-#: ../semanage/semanage:686 ++#: ../semanage/semanage:672 + msgid "Network Mask" + msgstr "" + +-#: ../semanage/semanage:690 ++#: ../semanage/semanage:676 + msgid "node" + msgstr "" + +-#: ../semanage/semanage:715 ++#: ../semanage/semanage:701 + msgid "Manage booleans to selectively enable functionality" + msgstr "" + +-#: ../semanage/semanage:720 ++#: ../semanage/semanage:706 + msgid "boolean" + msgstr "" + +-#: ../semanage/semanage:730 ++#: ../semanage/semanage:716 + msgid "Enable the boolean" + msgstr "" + +-#: ../semanage/semanage:731 ++#: ../semanage/semanage:717 + msgid "Disable the boolean" + msgstr "" + +-#: ../semanage/semanage:752 ++#: ../semanage/semanage:738 + msgid "semanage permissive: error: the following argument is required: type\n" + msgstr "" + +-#: ../semanage/semanage:756 ++#: ../semanage/semanage:742 + msgid "Manage process type enforcement mode" + msgstr "" + +-#: ../semanage/semanage:768 ../semanage/seobject.py:2677 ++#: ../semanage/semanage:754 ../semanage/seobject.py:2672 + msgid "type" + msgstr "" + +-#: ../semanage/semanage:779 ++#: ../semanage/semanage:765 + msgid "Disable/Enable dontaudit rules in policy" + msgstr "" + +-#: ../semanage/semanage:799 ++#: ../semanage/semanage:785 + msgid "Output local customizations" + msgstr "" + +-#: ../semanage/semanage:801 ++#: ../semanage/semanage:787 + msgid "Output file" + msgstr "" + +-#: ../semanage/semanage:894 ++#: ../semanage/semanage:880 + msgid "Import local customizations" + msgstr "" + +-#: ../semanage/semanage:897 ++#: ../semanage/semanage:883 + msgid "Input file" + msgstr "" + ++#: ../semanage/semanage:891 ++msgid "" ++"semanage is used to configure certain elements of SELinux policy with-out " ++"requiring modification or recompilation from policy source." ++msgstr "" ++ + #: ../semanage/seobject.py:279 + msgid "Could not create semanage handle" + msgstr "" +@@ -485,123 +484,115 @@ msgstr "" + msgid "Customized Permissive Types" + msgstr "" + +-#: ../semanage/seobject.py:510 +-msgid "" +-"The sepolgen python module is required to setup permissive domains.\n" +-"In some distributions it is included in the policycoreutils-devel package.\n" +-"# yum install policycoreutils-devel\n" +-"Or similar for your distro." +-msgstr "" +- +-#: ../semanage/seobject.py:520 ++#: ../semanage/seobject.py:515 + #, python-format + msgid "Could not set permissive domain %s (module installation failed)" + msgstr "" + +-#: ../semanage/seobject.py:526 ++#: ../semanage/seobject.py:521 + #, python-format + msgid "Could not remove permissive domain %s (remove failed)" + msgstr "" + +-#: ../semanage/seobject.py:563 ../semanage/seobject.py:633 +-#: ../semanage/seobject.py:678 ../semanage/seobject.py:797 +-#: ../semanage/seobject.py:827 ../semanage/seobject.py:892 +-#: ../semanage/seobject.py:948 ../semanage/seobject.py:1226 +-#: ../semanage/seobject.py:1492 ../semanage/seobject.py:2502 +-#: ../semanage/seobject.py:2575 ../semanage/seobject.py:2599 +-#: ../semanage/seobject.py:2730 ../semanage/seobject.py:2781 ++#: ../semanage/seobject.py:558 ../semanage/seobject.py:628 ++#: ../semanage/seobject.py:673 ../semanage/seobject.py:792 ++#: ../semanage/seobject.py:822 ../semanage/seobject.py:887 ++#: ../semanage/seobject.py:943 ../semanage/seobject.py:1221 ++#: ../semanage/seobject.py:1487 ../semanage/seobject.py:2497 ++#: ../semanage/seobject.py:2570 ../semanage/seobject.py:2594 ++#: ../semanage/seobject.py:2725 ../semanage/seobject.py:2776 + #, python-format + msgid "Could not create a key for %s" + msgstr "" + +-#: ../semanage/seobject.py:567 ../semanage/seobject.py:637 +-#: ../semanage/seobject.py:682 ../semanage/seobject.py:688 ++#: ../semanage/seobject.py:562 ../semanage/seobject.py:632 ++#: ../semanage/seobject.py:677 ../semanage/seobject.py:683 + #, python-format + msgid "Could not check if login mapping for %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:569 ++#: ../semanage/seobject.py:564 + #, python-format + msgid "Login mapping for %s is already defined" + msgstr "" + +-#: ../semanage/seobject.py:574 ++#: ../semanage/seobject.py:569 + #, python-format + msgid "Linux Group %s does not exist" + msgstr "" + +-#: ../semanage/seobject.py:579 ++#: ../semanage/seobject.py:574 + #, python-format + msgid "Linux User %s does not exist" + msgstr "" + +-#: ../semanage/seobject.py:583 ++#: ../semanage/seobject.py:578 + #, python-format + msgid "Could not create login mapping for %s" + msgstr "" + +-#: ../semanage/seobject.py:587 ../semanage/seobject.py:841 ++#: ../semanage/seobject.py:582 ../semanage/seobject.py:836 + #, python-format + msgid "Could not set name for %s" + msgstr "" + +-#: ../semanage/seobject.py:592 ../semanage/seobject.py:851 ++#: ../semanage/seobject.py:587 ../semanage/seobject.py:846 + #, python-format + msgid "Could not set MLS range for %s" + msgstr "" + +-#: ../semanage/seobject.py:596 ++#: ../semanage/seobject.py:591 + #, python-format + msgid "Could not set SELinux user for %s" + msgstr "" + +-#: ../semanage/seobject.py:600 ++#: ../semanage/seobject.py:595 + #, python-format + msgid "Could not add login mapping for %s" + msgstr "" + +-#: ../semanage/seobject.py:616 ++#: ../semanage/seobject.py:611 + msgid "Requires seuser or serange" + msgstr "" + +-#: ../semanage/seobject.py:639 ../semanage/seobject.py:684 ++#: ../semanage/seobject.py:634 ../semanage/seobject.py:679 + #, python-format + msgid "Login mapping for %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:643 ++#: ../semanage/seobject.py:638 + #, python-format + msgid "Could not query seuser for %s" + msgstr "" + +-#: ../semanage/seobject.py:658 ++#: ../semanage/seobject.py:653 + #, python-format + msgid "Could not modify login mapping for %s" + msgstr "" + +-#: ../semanage/seobject.py:690 ++#: ../semanage/seobject.py:685 + #, python-format + msgid "Login mapping for %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:694 ++#: ../semanage/seobject.py:689 + #, python-format + msgid "Could not delete login mapping for %s" + msgstr "" + +-#: ../semanage/seobject.py:713 ../semanage/seobject.py:745 +-#: ../semanage/seobject.py:991 ++#: ../semanage/seobject.py:708 ../semanage/seobject.py:740 ++#: ../semanage/seobject.py:986 + msgid "Could not list login mappings" + msgstr "" + +-#: ../semanage/seobject.py:772 ../semanage/seobject.py:784 ++#: ../semanage/seobject.py:767 ../semanage/seobject.py:779 + #: ../sepolicy/sepolicy/sepolicy.glade:1156 + #: ../sepolicy/sepolicy/sepolicy.glade:3138 + msgid "Login Name" + msgstr "" + +-#: ../semanage/seobject.py:772 ../semanage/seobject.py:784 +-#: ../semanage/seobject.py:1041 ../semanage/seobject.py:1046 ++#: ../semanage/seobject.py:767 ../semanage/seobject.py:779 ++#: ../semanage/seobject.py:1036 ../semanage/seobject.py:1041 + #: ../sepolicy/sepolicy/sepolicy.glade:1182 + #: ../sepolicy/sepolicy/sepolicy.glade:3156 + #: ../sepolicy/sepolicy/sepolicy.glade:3242 +@@ -609,938 +600,958 @@ msgstr "" + msgid "SELinux User" + msgstr "" + +-#: ../semanage/seobject.py:772 ++#: ../semanage/seobject.py:767 + msgid "MLS/MCS Range" + msgstr "" + +-#: ../semanage/seobject.py:772 ++#: ../semanage/seobject.py:767 + msgid "Service" + msgstr "" + +-#: ../semanage/seobject.py:800 ../semanage/seobject.py:831 +-#: ../semanage/seobject.py:896 ../semanage/seobject.py:952 +-#: ../semanage/seobject.py:958 ++#: ../semanage/seobject.py:795 ../semanage/seobject.py:826 ++#: ../semanage/seobject.py:891 ../semanage/seobject.py:947 ++#: ../semanage/seobject.py:953 + #, python-format + msgid "Could not check if SELinux user %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:803 ../semanage/seobject.py:902 +-#: ../semanage/seobject.py:964 ++#: ../semanage/seobject.py:798 ../semanage/seobject.py:897 ++#: ../semanage/seobject.py:959 + #, python-format + msgid "Could not query user for %s" + msgstr "" + +-#: ../semanage/seobject.py:823 ++#: ../semanage/seobject.py:818 + #, python-format + msgid "You must add at least one role for %s" + msgstr "" + +-#: ../semanage/seobject.py:833 ++#: ../semanage/seobject.py:828 + #, python-format + msgid "SELinux user %s is already defined" + msgstr "" + +-#: ../semanage/seobject.py:837 ++#: ../semanage/seobject.py:832 + #, python-format + msgid "Could not create SELinux user for %s" + msgstr "" + +-#: ../semanage/seobject.py:846 +-#, python-format +-msgid "Could not add role %s for %s" ++#: ../semanage/seobject.py:841 ++#, python-brace-format ++msgid "Could not add role {role} for {name}" + msgstr "" + +-#: ../semanage/seobject.py:855 ++#: ../semanage/seobject.py:850 + #, python-format + msgid "Could not set MLS level for %s" + msgstr "" + +-#: ../semanage/seobject.py:858 +-#, python-format +-msgid "Could not add prefix %s for %s" ++#: ../semanage/seobject.py:853 ++#, python-brace-format ++msgid "Could not add prefix {prefix} for {role}" + msgstr "" + +-#: ../semanage/seobject.py:861 ++#: ../semanage/seobject.py:856 + #, python-format + msgid "Could not extract key for %s" + msgstr "" + +-#: ../semanage/seobject.py:865 ++#: ../semanage/seobject.py:860 + #, python-format + msgid "Could not add SELinux user %s" + msgstr "" + +-#: ../semanage/seobject.py:886 ++#: ../semanage/seobject.py:881 + msgid "Requires prefix, roles, level or range" + msgstr "" + +-#: ../semanage/seobject.py:888 ++#: ../semanage/seobject.py:883 + msgid "Requires prefix or roles" + msgstr "" + +-#: ../semanage/seobject.py:898 ../semanage/seobject.py:954 ++#: ../semanage/seobject.py:893 ../semanage/seobject.py:949 + #, python-format + msgid "SELinux user %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:927 ++#: ../semanage/seobject.py:922 + #, python-format + msgid "Could not modify SELinux user %s" + msgstr "" + +-#: ../semanage/seobject.py:960 ++#: ../semanage/seobject.py:955 + #, python-format + msgid "SELinux user %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:971 ++#: ../semanage/seobject.py:966 + #, python-format + msgid "Could not delete SELinux user %s" + msgstr "" + +-#: ../semanage/seobject.py:1009 ++#: ../semanage/seobject.py:1004 + msgid "Could not list SELinux users" + msgstr "" + +-#: ../semanage/seobject.py:1015 ++#: ../semanage/seobject.py:1010 + #, python-format + msgid "Could not list roles for user %s" + msgstr "" + +-#: ../semanage/seobject.py:1040 ++#: ../semanage/seobject.py:1035 + msgid "Labeling" + msgstr "" + +-#: ../semanage/seobject.py:1040 ++#: ../semanage/seobject.py:1035 + msgid "MLS/" + msgstr "" + +-#: ../semanage/seobject.py:1041 ++#: ../semanage/seobject.py:1036 + msgid "Prefix" + msgstr "" + +-#: ../semanage/seobject.py:1041 ++#: ../semanage/seobject.py:1036 + msgid "MCS Level" + msgstr "" + +-#: ../semanage/seobject.py:1041 ++#: ../semanage/seobject.py:1036 + msgid "MCS Range" + msgstr "" + +-#: ../semanage/seobject.py:1041 ../semanage/seobject.py:1046 ++#: ../semanage/seobject.py:1036 ../semanage/seobject.py:1041 + #: ../sepolicy/sepolicy/sepolicy.glade:3262 + #: ../sepolicy/sepolicy/sepolicy.glade:5233 + #: ../sepolicy/sepolicy/sepolicy.glade:5382 + msgid "SELinux Roles" + msgstr "" + +-#: ../semanage/seobject.py:1071 ++#: ../semanage/seobject.py:1066 + msgid "Protocol has to be one of udp, tcp, dccp or sctp" + msgstr "" + +-#: ../semanage/seobject.py:1073 ++#: ../semanage/seobject.py:1068 + msgid "Port is required" + msgstr "" + +-#: ../semanage/seobject.py:1087 ++#: ../semanage/seobject.py:1082 + msgid "Invalid Port" + msgstr "" + +-#: ../semanage/seobject.py:1091 ../semanage/seobject.py:1365 +-#, python-format +-msgid "Could not create a key for %s/%s" ++#: ../semanage/seobject.py:1086 ++#, python-brace-format ++msgid "Could not create a key for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1102 ../semanage/seobject.py:1376 +-#: ../semanage/seobject.py:1631 ++#: ../semanage/seobject.py:1097 ../semanage/seobject.py:1371 ++#: ../semanage/seobject.py:1626 + msgid "Type is required" + msgstr "" + +-#: ../semanage/seobject.py:1107 ../semanage/seobject.py:1172 ++#: ../semanage/seobject.py:1102 ../semanage/seobject.py:1167 + #, python-format + msgid "Type %s is invalid, must be a port type" + msgstr "" + +-#: ../semanage/seobject.py:1113 ../semanage/seobject.py:1178 +-#: ../semanage/seobject.py:1244 ../semanage/seobject.py:1250 +-#, python-format +-msgid "Could not check if port %s/%s is defined" ++#: ../semanage/seobject.py:1108 ../semanage/seobject.py:1173 ++#: ../semanage/seobject.py:1239 ../semanage/seobject.py:1245 ++#, python-brace-format ++msgid "Could not check if port {proto}/{port} is defined" + msgstr "" + +-#: ../semanage/seobject.py:1115 +-#, python-format +-msgid "Port %s/%s already defined" ++#: ../semanage/seobject.py:1110 ++#, python-brace-format ++msgid "Port {proto}/{port} already defined" + msgstr "" + +-#: ../semanage/seobject.py:1119 +-#, python-format +-msgid "Could not create port for %s/%s" ++#: ../semanage/seobject.py:1114 ++#, python-brace-format ++msgid "Could not create port for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1125 ../semanage/seobject.py:1399 +-#: ../semanage/seobject.py:1653 +-#, python-format +-msgid "Could not create context for %s/%s" ++#: ../semanage/seobject.py:1120 ++#, python-brace-format ++msgid "Could not create context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1129 +-#, python-format +-msgid "Could not set user in port context for %s/%s" ++#: ../semanage/seobject.py:1124 ++#, python-brace-format ++msgid "Could not set user in port context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1133 +-#, python-format +-msgid "Could not set role in port context for %s/%s" ++#: ../semanage/seobject.py:1128 ++#, python-brace-format ++msgid "Could not set role in port context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1137 +-#, python-format +-msgid "Could not set type in port context for %s/%s" ++#: ../semanage/seobject.py:1132 ++#, python-brace-format ++msgid "Could not set type in port context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1142 +-#, python-format +-msgid "Could not set mls fields in port context for %s/%s" ++#: ../semanage/seobject.py:1137 ++#, python-brace-format ++msgid "Could not set mls fields in port context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1146 +-#, python-format +-msgid "Could not set port context for %s/%s" ++#: ../semanage/seobject.py:1141 ++#, python-brace-format ++msgid "Could not set port context for {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1150 +-#, python-format +-msgid "Could not add port %s/%s" ++#: ../semanage/seobject.py:1145 ++#, python-brace-format ++msgid "Could not add port {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1166 ../semanage/seobject.py:1438 +-#: ../semanage/seobject.py:1692 ../semanage/seobject.py:1970 +-#: ../semanage/seobject.py:2176 ++#: ../semanage/seobject.py:1161 ../semanage/seobject.py:1433 ++#: ../semanage/seobject.py:1687 ../semanage/seobject.py:1965 ++#: ../semanage/seobject.py:2171 + msgid "Requires setype or serange" + msgstr "" + +-#: ../semanage/seobject.py:1168 ../semanage/seobject.py:1440 +-#: ../semanage/seobject.py:1694 ++#: ../semanage/seobject.py:1163 ../semanage/seobject.py:1435 ++#: ../semanage/seobject.py:1689 + msgid "Requires setype" + msgstr "" + +-#: ../semanage/seobject.py:1180 ../semanage/seobject.py:1246 +-#, python-format +-msgid "Port %s/%s is not defined" ++#: ../semanage/seobject.py:1175 ../semanage/seobject.py:1241 ++#, python-brace-format ++msgid "Port {proto}/{port} is not defined" + msgstr "" + +-#: ../semanage/seobject.py:1184 +-#, python-format +-msgid "Could not query port %s/%s" ++#: ../semanage/seobject.py:1179 ++#, python-brace-format ++msgid "Could not query port {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1198 +-#, python-format +-msgid "Could not modify port %s/%s" ++#: ../semanage/seobject.py:1193 ++#, python-brace-format ++msgid "Could not modify port {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1213 ++#: ../semanage/seobject.py:1208 + msgid "Could not list the ports" + msgstr "" + +-#: ../semanage/seobject.py:1230 ++#: ../semanage/seobject.py:1225 + #, python-format + msgid "Could not delete the port %s" + msgstr "" + +-#: ../semanage/seobject.py:1252 +-#, python-format +-msgid "Port %s/%s is defined in policy, cannot be deleted" ++#: ../semanage/seobject.py:1247 ++#, python-brace-format ++msgid "Port {proto}/{port} is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:1256 +-#, python-format +-msgid "Could not delete port %s/%s" ++#: ../semanage/seobject.py:1251 ++#, python-brace-format ++msgid "Could not delete port {proto}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1274 ../semanage/seobject.py:1294 ++#: ../semanage/seobject.py:1269 ../semanage/seobject.py:1289 + msgid "Could not list ports" + msgstr "" + +-#: ../semanage/seobject.py:1329 ../sepolicy/sepolicy/sepolicy.glade:2668 ++#: ../semanage/seobject.py:1324 ../sepolicy/sepolicy/sepolicy.glade:2668 + #: ../sepolicy/sepolicy/sepolicy.glade:2766 + #: ../sepolicy/sepolicy/sepolicy.glade:4630 + msgid "SELinux Port Type" + msgstr "" + +-#: ../semanage/seobject.py:1329 ++#: ../semanage/seobject.py:1324 + msgid "Proto" + msgstr "" + +-#: ../semanage/seobject.py:1329 ../semanage/seobject.py:1835 ++#: ../semanage/seobject.py:1324 ../semanage/seobject.py:1830 + #: ../sepolicy/sepolicy/sepolicy.glade:1407 + msgid "Port Number" + msgstr "" + +-#: ../semanage/seobject.py:1351 ++#: ../semanage/seobject.py:1346 + msgid "Subnet Prefix is required" + msgstr "" + +-#: ../semanage/seobject.py:1361 ++#: ../semanage/seobject.py:1356 + msgid "Invalid Pkey" + msgstr "" + +-#: ../semanage/seobject.py:1381 ../semanage/seobject.py:1445 ++#: ../semanage/seobject.py:1360 ++#, python-brace-format ++msgid "Could not create a key for {subnet_prefix}/{pkey}" ++msgstr "" ++ ++#: ../semanage/seobject.py:1376 ../semanage/seobject.py:1440 + #, python-format + msgid "Type %s is invalid, must be a ibpkey type" + msgstr "" + +-#: ../semanage/seobject.py:1387 ../semanage/seobject.py:1451 +-#: ../semanage/seobject.py:1505 ../semanage/seobject.py:1511 +-#, python-format +-msgid "Could not check if ibpkey %s/%s is defined" ++#: ../semanage/seobject.py:1382 ../semanage/seobject.py:1446 ++#: ../semanage/seobject.py:1500 ../semanage/seobject.py:1506 ++#, python-brace-format ++msgid "Could not check if ibpkey {subnet_prefix}/{pkey} is defined" + msgstr "" + +-#: ../semanage/seobject.py:1389 +-#, python-format +-msgid "ibpkey %s/%s already defined" ++#: ../semanage/seobject.py:1384 ++#, python-brace-format ++msgid "ibpkey {subnet_prefix}/{pkey} already defined" + msgstr "" + +-#: ../semanage/seobject.py:1393 +-#, python-format +-msgid "Could not create ibpkey for %s/%s" ++#: ../semanage/seobject.py:1388 ++#, python-brace-format ++msgid "Could not create ibpkey for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1403 +-#, python-format +-msgid "Could not set user in ibpkey context for %s/%s" ++#: ../semanage/seobject.py:1394 ++#, python-brace-format ++msgid "Could not create context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1407 +-#, python-format +-msgid "Could not set role in ibpkey context for %s/%s" ++#: ../semanage/seobject.py:1398 ++#, python-brace-format ++msgid "Could not set user in ibpkey context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1411 +-#, python-format +-msgid "Could not set type in ibpkey context for %s/%s" ++#: ../semanage/seobject.py:1402 ++#, python-brace-format ++msgid "Could not set role in ibpkey context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1416 +-#, python-format +-msgid "Could not set mls fields in ibpkey context for %s/%s" ++#: ../semanage/seobject.py:1406 ++#, python-brace-format ++msgid "Could not set type in ibpkey context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1420 +-#, python-format +-msgid "Could not set ibpkey context for %s/%s" ++#: ../semanage/seobject.py:1411 ++#, python-brace-format ++msgid "Could not set mls fields in ibpkey context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1424 +-#, python-format +-msgid "Could not add ibpkey %s/%s" ++#: ../semanage/seobject.py:1415 ++#, python-brace-format ++msgid "Could not set ibpkey context for {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1453 ../semanage/seobject.py:1507 +-#, python-format +-msgid "ibpkey %s/%s is not defined" ++#: ../semanage/seobject.py:1419 ++#, python-brace-format ++msgid "Could not add ibpkey {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1457 +-#, python-format +-msgid "Could not query ibpkey %s/%s" ++#: ../semanage/seobject.py:1448 ../semanage/seobject.py:1502 ++#, python-brace-format ++msgid "ibpkey {subnet_prefix}/{pkey} is not defined" + msgstr "" + +-#: ../semanage/seobject.py:1468 +-#, python-format +-msgid "Could not modify ibpkey %s/%s" ++#: ../semanage/seobject.py:1452 ++#, python-brace-format ++msgid "Could not query ibpkey {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1481 ++#: ../semanage/seobject.py:1463 ++#, python-brace-format ++msgid "Could not modify ibpkey {subnet_prefix}/{pkey}" ++msgstr "" ++ ++#: ../semanage/seobject.py:1476 + msgid "Could not list the ibpkeys" + msgstr "" + +-#: ../semanage/seobject.py:1496 ++#: ../semanage/seobject.py:1491 + #, python-format + msgid "Could not delete the ibpkey %s" + msgstr "" + +-#: ../semanage/seobject.py:1513 +-#, python-format +-msgid "ibpkey %s/%s is defined in policy, cannot be deleted" ++#: ../semanage/seobject.py:1508 ++#, python-brace-format ++msgid "ibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:1517 +-#, python-format +-msgid "Could not delete ibpkey %s/%s" ++#: ../semanage/seobject.py:1512 ++#, python-brace-format ++msgid "Could not delete ibpkey {subnet_prefix}/{pkey}" + msgstr "" + +-#: ../semanage/seobject.py:1533 ../semanage/seobject.py:1554 ++#: ../semanage/seobject.py:1528 ../semanage/seobject.py:1549 + msgid "Could not list ibpkeys" + msgstr "" + +-#: ../semanage/seobject.py:1589 ++#: ../semanage/seobject.py:1584 + msgid "SELinux IB Pkey Type" + msgstr "" + +-#: ../semanage/seobject.py:1589 ++#: ../semanage/seobject.py:1584 + msgid "Subnet_Prefix" + msgstr "" + +-#: ../semanage/seobject.py:1589 ++#: ../semanage/seobject.py:1584 + msgid "Pkey Number" + msgstr "" + +-#: ../semanage/seobject.py:1611 ++#: ../semanage/seobject.py:1606 + msgid "IB device name is required" + msgstr "" + +-#: ../semanage/seobject.py:1616 ++#: ../semanage/seobject.py:1611 + msgid "Invalid Port Number" + msgstr "" + +-#: ../semanage/seobject.py:1620 +-#, python-format +-msgid "Could not create a key for ibendport %s/%s" ++#: ../semanage/seobject.py:1615 ++#, python-brace-format ++msgid "Could not create a key for ibendport {ibdev_name}/{ibendport}" + msgstr "" + +-#: ../semanage/seobject.py:1636 ../semanage/seobject.py:1699 ++#: ../semanage/seobject.py:1631 ../semanage/seobject.py:1694 + #, python-format + msgid "Type %s is invalid, must be an ibendport type" + msgstr "" + +-#: ../semanage/seobject.py:1641 ../semanage/seobject.py:1705 +-#: ../semanage/seobject.py:1757 ../semanage/seobject.py:1763 +-#, python-format +-msgid "Could not check if ibendport %s/%s is defined" ++#: ../semanage/seobject.py:1636 ++#, python-brace-format ++msgid "Could not check if ibendport {ibdev_name}/{port} is defined" + msgstr "" + +-#: ../semanage/seobject.py:1643 +-#, python-format +-msgid "ibendport %s/%s already defined" ++#: ../semanage/seobject.py:1638 ++#, python-brace-format ++msgid "ibendport {ibdev_name}/{port} already defined" + msgstr "" + +-#: ../semanage/seobject.py:1647 +-#, python-format +-msgid "Could not create ibendport for %s/%s" ++#: ../semanage/seobject.py:1642 ++#, python-brace-format ++msgid "Could not create ibendport for {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1657 +-#, python-format +-msgid "Could not set user in ibendport context for %s/%s" ++#: ../semanage/seobject.py:1648 ++#, python-brace-format ++msgid "Could not create context for {ibendport}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1661 +-#, python-format +-msgid "Could not set role in ibendport context for %s/%s" ++#: ../semanage/seobject.py:1652 ++#, python-brace-format ++msgid "Could not set user in ibendport context for {ibdev_name}/{port}" ++msgstr "" ++ ++#: ../semanage/seobject.py:1656 ++#, python-brace-format ++msgid "Could not set role in ibendport context for {ibdev_name}/{port}" ++msgstr "" ++ ++#: ../semanage/seobject.py:1660 ++#, python-brace-format ++msgid "Could not set type in ibendport context for {ibdev_name}/{port}" + msgstr "" + + #: ../semanage/seobject.py:1665 +-#, python-format +-msgid "Could not set type in ibendport context for %s/%s" ++#, python-brace-format ++msgid "Could not set mls fields in ibendport context for {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1670 +-#, python-format +-msgid "Could not set mls fields in ibendport context for %s/%s" ++#: ../semanage/seobject.py:1669 ++#, python-brace-format ++msgid "Could not set ibendport context for {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1674 +-#, python-format +-msgid "Could not set ibendport context for %s/%s" ++#: ../semanage/seobject.py:1673 ++#, python-brace-format ++msgid "Could not add ibendport {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1678 +-#, python-format +-msgid "Could not add ibendport %s/%s" ++#: ../semanage/seobject.py:1700 ../semanage/seobject.py:1752 ++#: ../semanage/seobject.py:1758 ++#, python-brace-format ++msgid "Could not check if ibendport {ibdev_name}/{ibendport} is defined" + msgstr "" + +-#: ../semanage/seobject.py:1707 ../semanage/seobject.py:1759 +-#, python-format +-msgid "ibendport %s/%s is not defined" ++#: ../semanage/seobject.py:1702 ../semanage/seobject.py:1754 ++#, python-brace-format ++msgid "ibendport {ibdev_name}/{ibendport} is not defined" + msgstr "" + +-#: ../semanage/seobject.py:1711 +-#, python-format +-msgid "Could not query ibendport %s/%s" ++#: ../semanage/seobject.py:1706 ++#, python-brace-format ++msgid "Could not query ibendport {ibdev_name}/{ibendport}" + msgstr "" + +-#: ../semanage/seobject.py:1722 +-#, python-format +-msgid "Could not modify ibendport %s/%s" ++#: ../semanage/seobject.py:1717 ++#, python-brace-format ++msgid "Could not modify ibendport {ibdev_name}/{ibendport}" + msgstr "" + +-#: ../semanage/seobject.py:1735 ++#: ../semanage/seobject.py:1730 + msgid "Could not list the ibendports" + msgstr "" + +-#: ../semanage/seobject.py:1744 +-#, python-format +-msgid "Could not create a key for %s/%d" ++#: ../semanage/seobject.py:1739 ++#, python-brace-format ++msgid "Could not create a key for {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1748 +-#, python-format +-msgid "Could not delete the ibendport %s/%d" ++#: ../semanage/seobject.py:1743 ++#, python-brace-format ++msgid "Could not delete the ibendport {ibdev_name}/{port}" + msgstr "" + +-#: ../semanage/seobject.py:1765 +-#, python-format +-msgid "ibendport %s/%s is defined in policy, cannot be deleted" ++#: ../semanage/seobject.py:1760 ++#, python-brace-format ++msgid "" ++"ibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:1769 +-#, python-format +-msgid "Could not delete ibendport %s/%s" ++#: ../semanage/seobject.py:1764 ++#, python-brace-format ++msgid "Could not delete ibendport {ibdev_name}/{ibendport}" + msgstr "" + +-#: ../semanage/seobject.py:1785 ../semanage/seobject.py:1805 ++#: ../semanage/seobject.py:1780 ../semanage/seobject.py:1800 + msgid "Could not list ibendports" + msgstr "" + +-#: ../semanage/seobject.py:1835 ++#: ../semanage/seobject.py:1830 + msgid "SELinux IB End Port Type" + msgstr "" + +-#: ../semanage/seobject.py:1835 ++#: ../semanage/seobject.py:1830 + msgid "IB Device Name" + msgstr "" + +-#: ../semanage/seobject.py:1861 ++#: ../semanage/seobject.py:1856 + msgid "Node Address is required" + msgstr "" + +-#: ../semanage/seobject.py:1873 ../semanage/seobject.py:1885 ++#: ../semanage/seobject.py:1868 ../semanage/seobject.py:1880 + msgid "Unknown or missing protocol" + msgstr "" + +-#: ../semanage/seobject.py:1899 ++#: ../semanage/seobject.py:1894 + msgid "SELinux node type is required" + msgstr "" + +-#: ../semanage/seobject.py:1904 ../semanage/seobject.py:1975 ++#: ../semanage/seobject.py:1899 ../semanage/seobject.py:1970 + #, python-format + msgid "Type %s is invalid, must be a node type" + msgstr "" + +-#: ../semanage/seobject.py:1908 ../semanage/seobject.py:1979 +-#: ../semanage/seobject.py:2016 ../semanage/seobject.py:2117 +-#: ../semanage/seobject.py:2180 ../semanage/seobject.py:2216 +-#: ../semanage/seobject.py:2435 ++#: ../semanage/seobject.py:1903 ../semanage/seobject.py:1974 ++#: ../semanage/seobject.py:2011 ../semanage/seobject.py:2112 ++#: ../semanage/seobject.py:2175 ../semanage/seobject.py:2211 ++#: ../semanage/seobject.py:2430 + #, python-format + msgid "Could not create key for %s" + msgstr "" + +-#: ../semanage/seobject.py:1912 ../semanage/seobject.py:1983 +-#: ../semanage/seobject.py:2020 ../semanage/seobject.py:2026 ++#: ../semanage/seobject.py:1907 ../semanage/seobject.py:1978 ++#: ../semanage/seobject.py:2015 ../semanage/seobject.py:2021 + #, python-format + msgid "Could not check if addr %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:1914 ++#: ../semanage/seobject.py:1909 + #, python-format + msgid "Addr %s already defined" + msgstr "" + +-#: ../semanage/seobject.py:1918 ++#: ../semanage/seobject.py:1913 + #, python-format + msgid "Could not create addr for %s" + msgstr "" + +-#: ../semanage/seobject.py:1924 ../semanage/seobject.py:2132 +-#: ../semanage/seobject.py:2389 ++#: ../semanage/seobject.py:1919 ../semanage/seobject.py:2127 ++#: ../semanage/seobject.py:2384 + #, python-format + msgid "Could not create context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1928 ++#: ../semanage/seobject.py:1923 + #, python-format + msgid "Could not set mask for %s" + msgstr "" + +-#: ../semanage/seobject.py:1932 ++#: ../semanage/seobject.py:1927 + #, python-format + msgid "Could not set user in addr context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1936 ++#: ../semanage/seobject.py:1931 + #, python-format + msgid "Could not set role in addr context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1940 ++#: ../semanage/seobject.py:1935 + #, python-format + msgid "Could not set type in addr context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1945 ++#: ../semanage/seobject.py:1940 + #, python-format + msgid "Could not set mls fields in addr context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1949 ++#: ../semanage/seobject.py:1944 + #, python-format + msgid "Could not set addr context for %s" + msgstr "" + +-#: ../semanage/seobject.py:1953 ++#: ../semanage/seobject.py:1948 + #, python-format + msgid "Could not add addr %s" + msgstr "" + +-#: ../semanage/seobject.py:1985 ../semanage/seobject.py:2022 ++#: ../semanage/seobject.py:1980 ../semanage/seobject.py:2017 + #, python-format + msgid "Addr %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:1989 ++#: ../semanage/seobject.py:1984 + #, python-format + msgid "Could not query addr %s" + msgstr "" + +-#: ../semanage/seobject.py:1999 ++#: ../semanage/seobject.py:1994 + #, python-format + msgid "Could not modify addr %s" + msgstr "" + +-#: ../semanage/seobject.py:2028 ++#: ../semanage/seobject.py:2023 + #, python-format + msgid "Addr %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:2032 ++#: ../semanage/seobject.py:2027 + #, python-format + msgid "Could not delete addr %s" + msgstr "" + +-#: ../semanage/seobject.py:2046 ++#: ../semanage/seobject.py:2041 + msgid "Could not deleteall node mappings" + msgstr "" + +-#: ../semanage/seobject.py:2060 ++#: ../semanage/seobject.py:2055 + msgid "Could not list addrs" + msgstr "" + +-#: ../semanage/seobject.py:2113 ../semanage/seobject.py:2426 ++#: ../semanage/seobject.py:2108 ../semanage/seobject.py:2421 + msgid "SELinux Type is required" + msgstr "" + +-#: ../semanage/seobject.py:2121 ../semanage/seobject.py:2184 +-#: ../semanage/seobject.py:2220 ../semanage/seobject.py:2226 ++#: ../semanage/seobject.py:2116 ../semanage/seobject.py:2179 ++#: ../semanage/seobject.py:2215 ../semanage/seobject.py:2221 + #, python-format + msgid "Could not check if interface %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:2123 ++#: ../semanage/seobject.py:2118 + #, python-format + msgid "Interface %s already defined" + msgstr "" + +-#: ../semanage/seobject.py:2127 ++#: ../semanage/seobject.py:2122 + #, python-format + msgid "Could not create interface for %s" + msgstr "" + +-#: ../semanage/seobject.py:2136 ++#: ../semanage/seobject.py:2131 + #, python-format + msgid "Could not set user in interface context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2140 ++#: ../semanage/seobject.py:2135 + #, python-format + msgid "Could not set role in interface context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2144 ++#: ../semanage/seobject.py:2139 + #, python-format + msgid "Could not set type in interface context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2149 ++#: ../semanage/seobject.py:2144 + #, python-format + msgid "Could not set mls fields in interface context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2153 ++#: ../semanage/seobject.py:2148 + #, python-format + msgid "Could not set interface context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2157 ++#: ../semanage/seobject.py:2152 + #, python-format + msgid "Could not set message context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2161 ++#: ../semanage/seobject.py:2156 + #, python-format + msgid "Could not add interface %s" + msgstr "" + +-#: ../semanage/seobject.py:2186 ../semanage/seobject.py:2222 ++#: ../semanage/seobject.py:2181 ../semanage/seobject.py:2217 + #, python-format + msgid "Interface %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:2190 ++#: ../semanage/seobject.py:2185 + #, python-format + msgid "Could not query interface %s" + msgstr "" + +-#: ../semanage/seobject.py:2201 ++#: ../semanage/seobject.py:2196 + #, python-format + msgid "Could not modify interface %s" + msgstr "" + +-#: ../semanage/seobject.py:2228 ++#: ../semanage/seobject.py:2223 + #, python-format + msgid "Interface %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:2232 ++#: ../semanage/seobject.py:2227 + #, python-format + msgid "Could not delete interface %s" + msgstr "" + +-#: ../semanage/seobject.py:2246 ++#: ../semanage/seobject.py:2241 + msgid "Could not delete all interface mappings" + msgstr "" + +-#: ../semanage/seobject.py:2260 ++#: ../semanage/seobject.py:2255 + msgid "Could not list interfaces" + msgstr "" + +-#: ../semanage/seobject.py:2285 ++#: ../semanage/seobject.py:2280 + msgid "SELinux Interface" + msgstr "" + +-#: ../semanage/seobject.py:2285 ../semanage/seobject.py:2677 ++#: ../semanage/seobject.py:2280 ../semanage/seobject.py:2672 + msgid "Context" + msgstr "" + +-#: ../semanage/seobject.py:2355 ++#: ../semanage/seobject.py:2350 + #, python-format + msgid "Target %s is not valid. Target is not allowed to end with '/'" + msgstr "" + +-#: ../semanage/seobject.py:2358 ++#: ../semanage/seobject.py:2353 + #, python-format + msgid "Substitute %s is not valid. Substitute is not allowed to end with '/'" + msgstr "" + +-#: ../semanage/seobject.py:2361 ++#: ../semanage/seobject.py:2356 + #, python-format + msgid "Equivalence class for %s already exists" + msgstr "" + +-#: ../semanage/seobject.py:2367 ++#: ../semanage/seobject.py:2362 + #, python-format + msgid "File spec %s conflicts with equivalency rule '%s %s'" + msgstr "" + +-#: ../semanage/seobject.py:2378 ++#: ../semanage/seobject.py:2373 + #, python-format + msgid "Equivalence class for %s does not exist" + msgstr "" + +-#: ../semanage/seobject.py:2395 ++#: ../semanage/seobject.py:2390 + #, python-format + msgid "Could not set user in file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2399 ++#: ../semanage/seobject.py:2394 + #, python-format + msgid "Could not set role in file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2404 ../semanage/seobject.py:2464 ++#: ../semanage/seobject.py:2399 ../semanage/seobject.py:2459 + #, python-format + msgid "Could not set mls fields in file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2410 ++#: ../semanage/seobject.py:2405 + msgid "Invalid file specification" + msgstr "" + +-#: ../semanage/seobject.py:2412 ++#: ../semanage/seobject.py:2407 + msgid "File specification can not include spaces" + msgstr "" + +-#: ../semanage/seobject.py:2417 ++#: ../semanage/seobject.py:2412 + #, python-format + msgid "" + "File spec %s conflicts with equivalency rule '%s %s'; Try adding '%s' instead" + msgstr "" + +-#: ../semanage/seobject.py:2431 ../semanage/seobject.py:2496 ++#: ../semanage/seobject.py:2426 ../semanage/seobject.py:2491 + #, python-format + msgid "Type %s is invalid, must be a file or device type" + msgstr "" + +-#: ../semanage/seobject.py:2439 ../semanage/seobject.py:2444 +-#: ../semanage/seobject.py:2506 ../semanage/seobject.py:2515 +-#: ../semanage/seobject.py:2603 ../semanage/seobject.py:2607 ++#: ../semanage/seobject.py:2434 ../semanage/seobject.py:2439 ++#: ../semanage/seobject.py:2501 ../semanage/seobject.py:2510 ++#: ../semanage/seobject.py:2598 ../semanage/seobject.py:2602 + #, python-format + msgid "Could not check if file context for %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:2447 ++#: ../semanage/seobject.py:2442 + #, python-format + msgid "File context for %s already defined" + msgstr "" + +-#: ../semanage/seobject.py:2451 ++#: ../semanage/seobject.py:2446 + #, python-format + msgid "Could not create file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2459 ++#: ../semanage/seobject.py:2454 + #, python-format + msgid "Could not set type in file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2467 ../semanage/seobject.py:2539 +-#: ../semanage/seobject.py:2543 ++#: ../semanage/seobject.py:2462 ../semanage/seobject.py:2534 ++#: ../semanage/seobject.py:2538 + #, python-format + msgid "Could not set file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2473 ++#: ../semanage/seobject.py:2468 + #, python-format + msgid "Could not add file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2492 ++#: ../semanage/seobject.py:2487 + msgid "Requires setype, serange or seuser" + msgstr "" + +-#: ../semanage/seobject.py:2511 ../semanage/seobject.py:2521 ++#: ../semanage/seobject.py:2506 ../semanage/seobject.py:2516 + #, python-format + msgid "Could not query file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2517 ../semanage/seobject.py:2611 ++#: ../semanage/seobject.py:2512 ../semanage/seobject.py:2606 + #, python-format + msgid "File context for %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:2547 ++#: ../semanage/seobject.py:2542 + #, python-format + msgid "Could not modify file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2565 ++#: ../semanage/seobject.py:2560 + msgid "Could not list the file contexts" + msgstr "" + +-#: ../semanage/seobject.py:2579 ++#: ../semanage/seobject.py:2574 + #, python-format + msgid "Could not delete the file context %s" + msgstr "" + +-#: ../semanage/seobject.py:2609 ++#: ../semanage/seobject.py:2604 + #, python-format + msgid "File context for %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:2615 ++#: ../semanage/seobject.py:2610 + #, python-format + msgid "Could not delete file context for %s" + msgstr "" + +-#: ../semanage/seobject.py:2632 ++#: ../semanage/seobject.py:2627 + msgid "Could not list file contexts" + msgstr "" + +-#: ../semanage/seobject.py:2636 ++#: ../semanage/seobject.py:2631 + msgid "Could not list file contexts for home directories" + msgstr "" + +-#: ../semanage/seobject.py:2640 ++#: ../semanage/seobject.py:2635 + msgid "Could not list local file contexts" + msgstr "" + +-#: ../semanage/seobject.py:2677 ++#: ../semanage/seobject.py:2672 + msgid "SELinux fcontext" + msgstr "" + +-#: ../semanage/seobject.py:2690 ++#: ../semanage/seobject.py:2685 + msgid "" + "\n" + "SELinux Distribution fcontext Equivalence \n" + msgstr "" + +-#: ../semanage/seobject.py:2695 ++#: ../semanage/seobject.py:2690 + msgid "" + "\n" + "SELinux Local fcontext Equivalence \n" + msgstr "" + +-#: ../semanage/seobject.py:2733 ../semanage/seobject.py:2784 +-#: ../semanage/seobject.py:2790 ++#: ../semanage/seobject.py:2728 ../semanage/seobject.py:2779 ++#: ../semanage/seobject.py:2785 + #, python-format + msgid "Could not check if boolean %s is defined" + msgstr "" + +-#: ../semanage/seobject.py:2735 ../semanage/seobject.py:2786 ++#: ../semanage/seobject.py:2730 ../semanage/seobject.py:2781 + #, python-format + msgid "Boolean %s is not defined" + msgstr "" + +-#: ../semanage/seobject.py:2739 ++#: ../semanage/seobject.py:2734 + #, python-format + msgid "Could not query file context %s" + msgstr "" + +-#: ../semanage/seobject.py:2744 ++#: ../semanage/seobject.py:2739 + #, python-format + msgid "You must specify one of the following values: %s" + msgstr "" + +-#: ../semanage/seobject.py:2749 ++#: ../semanage/seobject.py:2744 + #, python-format + msgid "Could not set active value of boolean %s" + msgstr "" + +-#: ../semanage/seobject.py:2752 ++#: ../semanage/seobject.py:2747 + #, python-format + msgid "Could not modify boolean %s" + msgstr "" + +-#: ../semanage/seobject.py:2768 +-#, python-format +-msgid "Bad format %s: Record %s" ++#: ../semanage/seobject.py:2763 ++#, python-brace-format ++msgid "Bad format {filename}: Record {record}" + msgstr "" + +-#: ../semanage/seobject.py:2792 ++#: ../semanage/seobject.py:2787 + #, python-format + msgid "Boolean %s is defined in policy, cannot be deleted" + msgstr "" + +-#: ../semanage/seobject.py:2796 ++#: ../semanage/seobject.py:2791 + #, python-format + msgid "Could not delete boolean %s" + msgstr "" + +-#: ../semanage/seobject.py:2808 ../semanage/seobject.py:2825 ++#: ../semanage/seobject.py:2803 ../semanage/seobject.py:2820 + msgid "Could not list booleans" + msgstr "" + +-#: ../semanage/seobject.py:2858 ++#: ../semanage/seobject.py:2853 + msgid "off" + msgstr "" + +-#: ../semanage/seobject.py:2858 ++#: ../semanage/seobject.py:2853 + msgid "on" + msgstr "" + +-#: ../semanage/seobject.py:2870 ++#: ../semanage/seobject.py:2865 + msgid "SELinux boolean" + msgstr "" + +-#: ../semanage/seobject.py:2870 ++#: ../semanage/seobject.py:2865 + msgid "State" + msgstr "" + +-#: ../semanage/seobject.py:2870 ++#: ../semanage/seobject.py:2865 + msgid "Default" + msgstr "" + +-#: ../semanage/seobject.py:2870 ../sepolicy/sepolicy/sepolicy.glade:2140 ++#: ../semanage/seobject.py:2865 ../sepolicy/sepolicy/sepolicy.glade:2140 + #: ../sepolicy/sepolicy/sepolicy.glade:2510 + #: ../sepolicy/sepolicy/sepolicy.glade:5099 + msgid "Description" +@@ -1555,151 +1566,151 @@ msgstr "" + msgid "Missing interface definition for %s" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:140 ++#: ../sepolicy/sepolicy/generate.py:138 + msgid "Standard Init Daemon" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:141 ++#: ../sepolicy/sepolicy/generate.py:139 + msgid "DBUS System Daemon" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:142 ++#: ../sepolicy/sepolicy/generate.py:140 + msgid "Internet Services Daemon" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:143 ++#: ../sepolicy/sepolicy/generate.py:141 + msgid "Web Application/Script (CGI)" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:144 ++#: ../sepolicy/sepolicy/generate.py:142 + msgid "Sandbox" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:145 ++#: ../sepolicy/sepolicy/generate.py:143 + msgid "User Application" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:146 ++#: ../sepolicy/sepolicy/generate.py:144 + msgid "Existing Domain Type" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:147 ++#: ../sepolicy/sepolicy/generate.py:145 + msgid "Minimal Terminal Login User Role" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:148 ++#: ../sepolicy/sepolicy/generate.py:146 + msgid "Minimal X Windows Login User Role" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:149 ++#: ../sepolicy/sepolicy/generate.py:147 + msgid "Desktop Login User Role" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:150 ++#: ../sepolicy/sepolicy/generate.py:148 + msgid "Administrator Login User Role" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:151 ++#: ../sepolicy/sepolicy/generate.py:149 + msgid "Confined Root Administrator Role" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:152 ++#: ../sepolicy/sepolicy/generate.py:150 + msgid "Module information for a new type" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:158 ++#: ../sepolicy/sepolicy/generate.py:156 + msgid "Valid Types:\n" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:193 ++#: ../sepolicy/sepolicy/generate.py:191 + #, python-format + msgid "Ports must be numbers or ranges of numbers from 1 to %d " + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:205 ++#: ../sepolicy/sepolicy/generate.py:203 + msgid "You must enter a valid policy type" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:208 ++#: ../sepolicy/sepolicy/generate.py:206 + #, python-format + msgid "You must enter a name for your policy module for your '%s'." + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:346 ++#: ../sepolicy/sepolicy/generate.py:344 + msgid "" + "Name must be alphanumeric with no spaces. Consider using option \"-n " + "MODULENAME\"" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:438 ++#: ../sepolicy/sepolicy/generate.py:436 + msgid "User Role types can not be assigned executables." + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:444 ++#: ../sepolicy/sepolicy/generate.py:442 + msgid "Only Daemon apps can use an init script." + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:462 ++#: ../sepolicy/sepolicy/generate.py:460 + msgid "use_resolve must be a boolean value " + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:468 ++#: ../sepolicy/sepolicy/generate.py:466 + msgid "use_syslog must be a boolean value " + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:474 ++#: ../sepolicy/sepolicy/generate.py:472 + msgid "use_kerberos must be a boolean value " + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:480 ++#: ../sepolicy/sepolicy/generate.py:478 + msgid "manage_krb5_rcache must be a boolean value " + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:510 ++#: ../sepolicy/sepolicy/generate.py:508 + msgid "USER Types automatically get a tmp type" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:847 ++#: ../sepolicy/sepolicy/generate.py:845 + #, python-format + msgid "'%s' policy modules require existing domains" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:872 ++#: ../sepolicy/sepolicy/generate.py:870 + msgid "Type field required" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:885 ++#: ../sepolicy/sepolicy/generate.py:883 + #, python-format + msgid "" + "You need to define a new type which ends with: \n" + " %s" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1113 ++#: ../sepolicy/sepolicy/generate.py:1111 + msgid "You must enter the executable path for your confined process" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1378 ++#: ../sepolicy/sepolicy/generate.py:1376 + msgid "Created the following files:\n" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1379 ++#: ../sepolicy/sepolicy/generate.py:1377 + msgid "Type Enforcement file" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1380 ++#: ../sepolicy/sepolicy/generate.py:1378 + msgid "Interface file" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1381 ++#: ../sepolicy/sepolicy/generate.py:1379 + msgid "File Contexts file" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1383 ++#: ../sepolicy/sepolicy/generate.py:1381 + msgid "Spec file" + msgstr "" + +-#: ../sepolicy/sepolicy/generate.py:1384 ++#: ../sepolicy/sepolicy/generate.py:1382 + msgid "Setup Script" + msgstr "" + +@@ -2367,29 +2378,29 @@ msgstr "" + msgid "named pipe" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:148 ++#: ../sepolicy/sepolicy/__init__.py:149 + msgid "No SELinux Policy installed" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:184 ++#: ../sepolicy/sepolicy/__init__.py:185 + #, python-format + msgid "Failed to read %s policy file" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:470 ++#: ../sepolicy/sepolicy/__init__.py:471 + #, python-format + msgid "-- Allowed %s [ %s ]" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:896 ++#: ../sepolicy/sepolicy/__init__.py:897 + msgid "You must regenerate interface info by running /usr/bin/sepolgen-ifgen" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:1221 ++#: ../sepolicy/sepolicy/__init__.py:1230 + msgid "unknown" + msgstr "" + +-#: ../sepolicy/sepolicy/__init__.py:1230 ++#: ../sepolicy/sepolicy/__init__.py:1239 + #, python-brace-format + msgid "Allow {subject} to {rest}" + msgstr "" +-- +2.41.0 + diff --git a/0019-sepolicy-port-to-dnf4-python-API.patch b/0019-sepolicy-port-to-dnf4-python-API.patch new file mode 100644 index 0000000..bc62ff3 --- /dev/null +++ b/0019-sepolicy-port-to-dnf4-python-API.patch @@ -0,0 +1,84 @@ +From d925b00da35384331df9bf31935398c37117f895 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Sat, 29 Jul 2023 20:33:06 +0200 +Subject: [PATCH] sepolicy: port to dnf4 python API +Content-type: text/plain + +yum module is not available since RHEL 7. + +Drop -systemd related code as it's obsoleted these days - only 2 +packages ship their .service in -systemd subpackage + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/generate.py | 38 ++++++++++++---------------- + 1 file changed, 16 insertions(+), 22 deletions(-) + +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index 36a3ea1196b1..48602a736953 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1264,13 +1264,20 @@ allow %s_t %s_t:%s_socket name_%s; + return fcfile + + def __extract_rpms(self): +- import yum +- yb = yum.YumBase() +- yb.setCacheDir() ++ import dnf + +- for pkg in yb.rpmdb.searchProvides(self.program): ++ base = dnf.Base() ++ base.read_all_repos() ++ base.fill_sack(load_system_repo=True) ++ ++ query = base.sack.query() ++ ++ pq = query.available() ++ pq = pq.filter(file=self.program) ++ ++ for pkg in pq: + self.rpms.append(pkg.name) +- for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist: ++ for fname in pkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": + continue +@@ -1279,9 +1286,10 @@ allow %s_t %s_t:%s_socket name_%s; + self.add_file(fname) + else: + self.add_dir(fname) +- +- for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]): +- for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist: ++ sq = query.available() ++ sq = sq.filter(provides=pkg.source_name) ++ for bpkg in sq: ++ for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": + continue +@@ -1291,20 +1299,6 @@ allow %s_t %s_t:%s_socket name_%s; + else: + self.add_dir(fname) + +- # some packages have own systemd subpackage +- # tor-systemd for example +- binary_name = self.program.split("/")[-1] +- for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]): +- for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist: +- for b in self.DEFAULT_DIRS: +- if b == "/etc": +- continue +- if fname.startswith(b): +- if os.path.isfile(fname): +- self.add_file(fname) +- else: +- self.add_dir(fname) +- + def gen_writeable(self): + try: + self.__extract_rpms() +-- +2.41.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 39cb285..fb54f95 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -45,6 +45,11 @@ Patch0011: 0011-python-sepolicy-Improve-man-pages.patch Patch0012: 0012-sandbox-Add-examples-to-man-pages.patch Patch0013: 0013-python-sepolicy-Fix-template-for-confined-user-polic.patch Patch0014: 0014-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0015: 0015-python-improve-format-strings-for-proper-localizatio.patch +Patch0016: 0016-python-Drop-hard-formating-from-localized-strings.patch +Patch0017: 0017-semanage-Drop-unnecessary-import-from-seobject.patch +Patch0018: 0018-python-update-python.pot.patch +Patch0019: 0019-sepolicy-port-to-dnf4-python-API.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -250,7 +255,7 @@ by python 3 in an SELinux environment. %package devel Summary: SELinux policy core policy devel utilities Requires: policycoreutils-python-utils = %{version}-%{release} -Requires: /usr/bin/make dnf +Requires: /usr/bin/make python3-dnf Requires: (selinux-policy-devel if selinux-policy) %description devel @@ -452,6 +457,11 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue Aug 1 2023 Petr Lautrbach - 3.5-7 +- python: improve format strings for proper localization +- python: Drop hard formating from localized strings +- sepolicy: port to dnf4 python API (rhbz#2209404) + * Fri Jul 21 2023 Fedora Release Engineering - 3.5-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 4b1f77eef98d40a4419c883ef3e964cbb63154c8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 30 Oct 2023 16:18:33 +0100 Subject: [PATCH 37/79] policycoreutils-3.5-8 - Update translations https://translate.fedoraproject.org/projects/selinux/ --- .gitignore | 4 ++++ policycoreutils.spec | 27 ++++++++++++++++++++++----- sources | 8 ++++---- 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 407d473..90492d8 100644 --- a/.gitignore +++ b/.gitignore @@ -348,3 +348,7 @@ policycoreutils-2.0.83.tgz /selinux-3.5-rc2.tar.gz /selinux-3.5-rc3.tar.gz /selinux-3.5.tar.gz +/selinux-policycoreutils.zip +/selinux-python.zip +/selinux-sandbox.zip +/selinux-gui.zip diff --git a/policycoreutils.spec b/policycoreutils.spec index fb54f95..e6eb739 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.5 -Release: 7%{?dist} +Release: 8%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz @@ -23,10 +23,15 @@ Source16: selinux-autorelabel.service Source17: selinux-autorelabel-mark.service Source18: selinux-autorelabel.target Source19: selinux-autorelabel-generator.sh -Source20: policycoreutils-po.tgz -Source21: python-po.tgz -Source22: gui-po.tgz -Source23: sandbox-po.tgz +# Drop this when upstream updates translations and the package is rebased +# wlc --key --url https://translate.fedoraproject.org/api/ download selinux/policycoreutils --output ./ +Source20: selinux-policycoreutils.zip +# wlc --key --url https://translate.fedoraproject.org/api/ download selinux/python --output ./ +Source21: selinux-python.zip +# wlc --key --url https://translate.fedoraproject.org/api/ download selinux/gui --output ./ +Source22: selinux-gui.zip +# wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ +Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux # $ git format-patch -N 3.5 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done @@ -99,6 +104,14 @@ tar -xvf %{SOURCE14} -C python/sepolicy/ # tar -x -f %{SOURCE21} -C python -z # tar -x -f %{SOURCE22} -C gui -z # tar -x -f %{SOURCE23} -C sandbox -z +unzip %{SOURCE20} +cp -r selinux/policycoreutils/po policycoreutils +unzip %{SOURCE21} +cp -r selinux/python/po python +unzip %{SOURCE22} +cp -r selinux/gui/po gui +unzip %{SOURCE23} +cp -r selinux/sandbox/po sandbox %build %set_build_flags @@ -457,6 +470,10 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Oct 30 2023 Petr Lautrbach - 3.5-8 +- Update translations + https://translate.fedoraproject.org/projects/selinux/ + * Tue Aug 1 2023 Petr Lautrbach - 3.5-7 - python: improve format strings for proper localization - python: Drop hard formating from localized strings diff --git a/sources b/sources index 62f11e0..c428c60 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda7bef3679943a22db62709907d48f8a331d67edc5efed3e2638b53e379959b14077b4ea -SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72 -SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be -SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b SHA512 (selinux-3.5.tar.gz) = a91b978d7a5f8adc6c4a4fb47ac92e49e73528905b8fe061ecff77d6ad6b316c4f8391e85dfcc7b422ed83076b9b84f592f567e76d862c569ab3a1079100a1fc +SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918 +SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd +SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 +SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 From 907549e21fb729a50bd9f886ce3c5f6e9ac7b584 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 14 Nov 2023 20:40:57 +0100 Subject: [PATCH 38/79] SELinux userspace 3.6-rc1 release --- .gitignore | 1 + ...t-to-Xephyr-as-it-works-better-with-.patch | 4 +- ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 10 +- 0005-Use-SHA-2-instead-of-SHA-1.patch | 140 +- 0006-python-chcat-Improve-man-pages.patch | 74 - ...-sepolicy-Fix-spec-file-dependencies.patch | 7 +- ...llow-Add-missing-options-to-man-page.patch | 79 - ...007-sepolicy-port-to-dnf4-python-API.patch | 2 +- 0008-python-semanage-Improve-man-pages.patch | 464 ---- ...dit2allow-Remove-unused-debug-option.patch | 29 - ...ycoreutils-Add-examples-to-man-pages.patch | 308 --- 0011-python-sepolicy-Improve-man-pages.patch | 390 ---- 0012-sandbox-Add-examples-to-man-pages.patch | 128 -- ...Fix-template-for-confined-user-polic.patch | 93 - ...ormat-strings-for-proper-localizatio.patch | 455 ---- ...ard-formating-from-localized-strings.patch | 148 -- ...rop-unnecessary-import-from-seobject.patch | 32 - 0018-python-update-python.pot.patch | 2009 ----------------- policycoreutils.spec | 89 +- sources | 2 +- 22 files changed, 49 insertions(+), 4423 deletions(-) delete mode 100644 0006-python-chcat-Improve-man-pages.patch rename 0014-python-sepolicy-Fix-spec-file-dependencies.patch => 0006-python-sepolicy-Fix-spec-file-dependencies.patch (92%) delete mode 100644 0007-python-audit2allow-Add-missing-options-to-man-page.patch rename 0019-sepolicy-port-to-dnf4-python-API.patch => 0007-sepolicy-port-to-dnf4-python-API.patch (97%) delete mode 100644 0008-python-semanage-Improve-man-pages.patch delete mode 100644 0009-python-audit2allow-Remove-unused-debug-option.patch delete mode 100644 0010-policycoreutils-Add-examples-to-man-pages.patch delete mode 100644 0011-python-sepolicy-Improve-man-pages.patch delete mode 100644 0012-sandbox-Add-examples-to-man-pages.patch delete mode 100644 0013-python-sepolicy-Fix-template-for-confined-user-polic.patch delete mode 100644 0015-python-improve-format-strings-for-proper-localizatio.patch delete mode 100644 0016-python-Drop-hard-formating-from-localized-strings.patch delete mode 100644 0017-semanage-Drop-unnecessary-import-from-seobject.patch delete mode 100644 0018-python-update-python.pot.patch diff --git a/.gitignore b/.gitignore index 90492d8..f4b9319 100644 --- a/.gitignore +++ b/.gitignore @@ -352,3 +352,4 @@ policycoreutils-2.0.83.tgz /selinux-python.zip /selinux-sandbox.zip /selinux-gui.zip +/selinux-3.6-rc1.tar.gz diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch index b166f5d..ed3f2a4 100644 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -1,4 +1,4 @@ -From eabd9ffb34666ef467106ef10d8a0e98bbe35f79 Mon Sep 17 00:00:00 2001 +From 10542b4fde99a089950126b008105c14b9452da1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Aug 2015 12:58:41 +0200 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in @@ -23,5 +23,5 @@ index eaa500d08143..4774528027ef 100644 cat > ~/seremote << __EOF #!/bin/sh -- -2.39.1 +2.41.0 diff --git a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index e38c3d0..87f5561 100644 --- a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 4affa1d7888b8489058d2942ea4431ff65f2430e Mon Sep 17 00:00:00 2001 +From 5dd7c8460230bd27170725bbb27014855652f356 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -21,5 +21,5 @@ index 166af6f360a2..ebe64563c7d7 100755 THREADS="" RPMFILES="" -- -2.39.1 +2.41.0 diff --git a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch index 0d3a253..20134a1 100644 --- a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0003-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From dbebbe4ff79fe790425ca8740e5ace54396671f2 Mon Sep 17 00:00:00 2001 +From 6213773ec3a6364cac48eb39d8ecfb11b5addc12 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index b6df3e91160b..36a3ea1196b1 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.39.1 +2.41.0 diff --git a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 3b29996..a920866 100644 --- a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 42b676e7677d4efe5383558afb3de962948f7a1d Mon Sep 17 00:00:00 2001 +From 7bf4ac2438df52b259b9d3d539b9a9e889cc7424 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -33,17 +33,17 @@ index a2762a7d215a..a32a33ea3cf6 100644 parser.add_option("-l", "--level", dest="level", diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 -index 1ee0ecea96d1..775e4b231204 100644 +index 095b9e27042d..1c1870190e51 100644 --- a/sandbox/sandbox.8 +++ b/sandbox/sandbox.8 @@ -80,7 +80,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz \fB\-W\fR \fB\-\-windowmanager\fR - Select alternative window manager to run within + Select alternative window manager to run within .B sandbox \-X. -Default to /usr/bin/openbox. +Default to /usr/bin/matchbox-window-manager. .TP - \fB\-X\fR + \fB\-X\fR Create an X based Sandbox for gui apps, temporary files for diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh index 4774528027ef..c211ebc14549 100644 @@ -71,5 +71,5 @@ index 4774528027ef..c211ebc14549 100644 export DISPLAY=:$D cat > ~/seremote << __EOF -- -2.39.1 +2.41.0 diff --git a/0005-Use-SHA-2-instead-of-SHA-1.patch b/0005-Use-SHA-2-instead-of-SHA-1.patch index 518980e..7025395 100644 --- a/0005-Use-SHA-2-instead-of-SHA-1.patch +++ b/0005-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 74e2d05df2ed090909c0ac6fd7ff7816b94d83ce Mon Sep 17 00:00:00 2001 +From 94859162dbf9d2ccd4ffb923720c654a4cb9150a Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -6,17 +6,14 @@ Content-type: text/plain The use of SHA-1 in RHEL9 is deprecated --- - policycoreutils/setfiles/restorecon.8 | 10 +++++----- - policycoreutils/setfiles/restorecon_xattr.8 | 8 ++++---- - policycoreutils/setfiles/restorecon_xattr.c | 12 ++++++------ - policycoreutils/setfiles/ru/restorecon.8 | 8 ++++---- - policycoreutils/setfiles/ru/restorecon_xattr.8 | 10 +++++----- - policycoreutils/setfiles/ru/setfiles.8 | 8 ++++---- - policycoreutils/setfiles/setfiles.8 | 10 +++++----- - 7 files changed, 33 insertions(+), 33 deletions(-) + policycoreutils/setfiles/restorecon.8 | 10 +++++----- + policycoreutils/setfiles/restorecon_xattr.8 | 8 ++++---- + policycoreutils/setfiles/restorecon_xattr.c | 12 ++++++------ + policycoreutils/setfiles/setfiles.8 | 10 +++++----- + 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index e07db2c87dc4..dbd55ce7c512 100644 +index c3cc5c9b0e52..6160aced5922 100644 --- a/policycoreutils/setfiles/restorecon.8 +++ b/policycoreutils/setfiles/restorecon.8 @@ -95,14 +95,14 @@ display usage information and exit. @@ -56,7 +53,7 @@ index e07db2c87dc4..dbd55ce7c512 100644 and provided the .B \-n diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8 -index e04528e60824..4b1ce304d995 100644 +index 51d12a4dbb80..09bfd8c40ab4 100644 --- a/policycoreutils/setfiles/restorecon_xattr.8 +++ b/policycoreutils/setfiles/restorecon_xattr.8 @@ -23,7 +23,7 @@ or @@ -136,125 +133,8 @@ index 31fb82fd2099..bc22d3fd4560 100644 printf("\n"); } -diff --git a/policycoreutils/setfiles/ru/restorecon.8 b/policycoreutils/setfiles/ru/restorecon.8 -index 9be3a63db356..745135020f4b 100644 ---- a/policycoreutils/setfiles/ru/restorecon.8 -+++ b/policycoreutils/setfiles/ru/restorecon.8 -@@ -82,11 +82,11 @@ restorecon \- восстановить SELinux-контексты безопас - игнорировать файлы, которые не существуют. - .TP - .B \-I --игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA1 соответствует дайджесту SHA1 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе -+игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA256 соответствует дайджесту SHA256 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе - .B ПРИМЕЧАНИЯ. - .TP - .B \-D --установить или обновить дайджесты SHA1 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута -+установить или обновить дайджесты SHA256 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута - .IR security.restorecon_last. - .TP - .B \-m -@@ -159,7 +159,7 @@ GNU - .B \-D - команды - .B restorecon --обеспечит сохранение дайджеста SHA1 файлов спецификации по умолчанию в расширенном атрибуте с именем -+обеспечит сохранение дайджеста SHA256 файлов спецификации по умолчанию в расширенном атрибуте с именем - .IR security.restorecon_last - для каталогов, указанных в соответствующих путях - .IR pathname \ ... -@@ -173,7 +173,7 @@ GNU - .sp - Параметр - .B \-I --позволяет игнорировать дайджест SHA1 из каждого каталога, указанного в -+позволяет игнорировать дайджест SHA256 из каждого каталога, указанного в - .IR pathname \ ... - , и, при условии, что НЕ установлен параметр - .B \-n -diff --git a/policycoreutils/setfiles/ru/restorecon_xattr.8 b/policycoreutils/setfiles/ru/restorecon_xattr.8 -index 41c441b8c5c2..25c4c3033334 100644 ---- a/policycoreutils/setfiles/ru/restorecon_xattr.8 -+++ b/policycoreutils/setfiles/ru/restorecon_xattr.8 -@@ -23,7 +23,7 @@ restorecon_xattr \- управление записями расширенных - - .SH "ОПИСАНИЕ" - .B restorecon_xattr --покажет дайджесты SHA1, добавленные в расширенные атрибуты -+покажет дайджесты SHA256, добавленные в расширенные атрибуты - .I security.restorecon_last, - или полностью удалит эти атрибуты. Эти атрибуты устанавливаются командой - .BR restorecon (8) -@@ -47,11 +47,11 @@ restorecon_xattr \- управление записями расширенных - .sp - По умолчанию - .B restorecon_xattr --показывает дайджесты SHA1, добавляя в конце "Match", если они соответствуют установленному по умолчанию файлу спецификации или файлу спецификации -+показывает дайджесты SHA256, добавляя в конце "Match", если они соответствуют установленному по умолчанию файлу спецификации или файлу спецификации - .I specfile, - который установлен с помощью параметра - .B \-f. --Несоответствующие дайджесты SHA1 будут показаны с добавлением "No Match" в конце. -+Несоответствующие дайджесты SHA256 будут показаны с добавлением "No Match" в конце. - Эту возможность можно отключить с помощью параметра - .B \-n. - -@@ -81,7 +81,7 @@ restorecon_xattr \- управление записями расширенных - рекурсивно спускаться по каталогам. - .TP - .B \-v --показать дайджест SHA1, созданный установленным файлом спецификации. -+показать дайджест SHA256, созданный установленным файлом спецификации. - .TP - .B \-e - .I directory -@@ -97,7 +97,7 @@ restorecon_xattr \- управление записями расширенных - .BR file_contexts (5). - Он будет использоваться - .BR selabel_open (3) --для получения набора записей меток; получение дайджеста SHA1 выполняется с помощью -+для получения набора записей меток; получение дайджеста SHA256 выполняется с помощью - .BR selabel_digest (3). - Если этот параметр не указан, будет использоваться файл file_contexts по умолчанию. - -diff --git a/policycoreutils/setfiles/ru/setfiles.8 b/policycoreutils/setfiles/ru/setfiles.8 -index 910101452625..7f2daa09191b 100644 ---- a/policycoreutils/setfiles/ru/setfiles.8 -+++ b/policycoreutils/setfiles/ru/setfiles.8 -@@ -69,11 +69,11 @@ setfiles \- установить SELinux-контексты безопаснос - игнорировать файлы, которые не существуют. - .TP - .B \-I --игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA1 соответствует дайджесту SHA1 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе -+игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA256 соответствует дайджесту SHA256 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе - .B ПРИМЕЧАНИЯ. - .TP - .B \-D --установить или обновить дайджесты SHA1 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута -+установить или обновить дайджесты SHA256 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута - .IR security.restorecon_last. - .TP - .B \-l -@@ -186,7 +186,7 @@ GNU - .B \-D - команды - .B setfiles . --Он обеспечивает сохранение дайджеста SHA1 файла спецификации -+Он обеспечивает сохранение дайджеста SHA256 файла спецификации - .B spec_file - в расширенном атрибуте с именем - .IR security.restorecon_last -@@ -204,7 +204,7 @@ GNU - .sp - Параметр - .B \-I --позволяет игнорировать дайджест SHA1 из каждого каталога, указанного в -+позволяет игнорировать дайджест SHA256 из каждого каталога, указанного в - .IR pathname \ ... - , и, при условии, что НЕ установлен параметр - .B \-n diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index bf26e161a71d..36fe6b369548 100644 +index ee01725050bb..57c663a99d67 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 @@ -95,14 +95,14 @@ display usage information and exit. @@ -294,5 +174,5 @@ index bf26e161a71d..36fe6b369548 100644 and provided the .B \-n -- -2.39.1 +2.41.0 diff --git a/0006-python-chcat-Improve-man-pages.patch b/0006-python-chcat-Improve-man-pages.patch deleted file mode 100644 index 4672bf8..0000000 --- a/0006-python-chcat-Improve-man-pages.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 6c3527eeada62cbec8f58eb1aa55b76bb0e6018d Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 4 May 2023 14:04:47 +0200 -Subject: [PATCH] python/chcat: Improve man pages - -- Explain applying range/list of categories -- "-d" removes all categories of given file/user -- Add examples - -Signed-off-by: Vit Mojzis -Acked-by: James Carter ---- - python/chcat/chcat.8 | 23 ++++++++++++++++------- - 1 file changed, 16 insertions(+), 7 deletions(-) - -diff --git a/python/chcat/chcat.8 b/python/chcat/chcat.8 -index d095a255..3e1f7ca2 100644 ---- a/python/chcat/chcat.8 -+++ b/python/chcat/chcat.8 -@@ -1,6 +1,6 @@ - .TH CHCAT "8" "September 2005" "chcat" "User Commands" - .SH NAME --chcat \- change file SELinux security category -+chcat \- change SELinux security categories of files/users - .SH SYNOPSIS - .B chcat - \fIcategory file\fR... -@@ -25,23 +25,33 @@ chcat \- change file SELinux security category - .br - .SH DESCRIPTION - .PP --Change/Remove the security \fIcategory\fR for each \fIfile\fR or \fIuser\fR. --.PP --Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR. -+Use +/- to add/remove categories from a \fIfile\fR or \fIuser\fR (only a single category can be specified at a time). Or specify the desired list/range of categories to be applied (replacing the existing categories). - .PP - .B - Note: --When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead. -+When removing a category you must specify '\-\-' on the command line before using the \-Category syntax. This tells the command that you have finished entering options and are now specifying a category name instead. - - .TP - \fB\-d\fR --delete the category from each FILE/USER. -+delete all categories from given FILE/USER. - .TP - \fB\-L\fR - list available categories. - .TP - \fB\-l\fR - Tells chcat to operate on users instead of files. -+ -+.SH EXAMPLE -+.nf -+Replace categories of user "test" with c0.c6 -+# chcat -l c0.c6 test -+Add category c1023 to user "test" -+# chcat -l +c1023 test -+Remove category c5 from file "file" -+# chcat -- -c5 file -+Remove all categories from file "file" -+# chcat -d file -+ - .SH "SEE ALSO" - .TP - chcon(1), selinux(8), semanage(8) -@@ -52,4 +62,3 @@ When operating on files this script wraps the chcon command. - /etc/selinux/{SELINUXTYPE}/setrans.conf - .br - /etc/selinux/{SELINUXTYPE}/seusers -- --- -2.40.0 - diff --git a/0014-python-sepolicy-Fix-spec-file-dependencies.patch b/0006-python-sepolicy-Fix-spec-file-dependencies.patch similarity index 92% rename from 0014-python-sepolicy-Fix-spec-file-dependencies.patch rename to 0006-python-sepolicy-Fix-spec-file-dependencies.patch index 0f178b9..817224b 100644 --- a/0014-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0006-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,7 +1,8 @@ -From 057ea895d85ae8297749778a3dcfc4ff7489ab37 Mon Sep 17 00:00:00 2001 +From f364324e66cb2bf014362c5c1d1b6a2bcf98d6ff Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies +Content-type: text/plain semanage is part of policycoreutils-python-utils package, selinuxenabled is part of libselinux-utils (required by ^^^) and restorecon/load_policy @@ -13,7 +14,7 @@ Signed-off-by: Vit Mojzis 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/python/sepolicy/sepolicy/templates/spec.py b/python/sepolicy/sepolicy/templates/spec.py -index 16a22081..cb3b2f63 100644 +index 433c298a17e0..a6d4508bb670 100644 --- a/python/sepolicy/sepolicy/templates/spec.py +++ b/python/sepolicy/sepolicy/templates/spec.py @@ -11,18 +11,20 @@ Version: 1.0 @@ -43,5 +44,5 @@ index 16a22081..cb3b2f63 100644 mid_section="""\ -- -2.40.0 +2.41.0 diff --git a/0007-python-audit2allow-Add-missing-options-to-man-page.patch b/0007-python-audit2allow-Add-missing-options-to-man-page.patch deleted file mode 100644 index 3c657b7..0000000 --- a/0007-python-audit2allow-Add-missing-options-to-man-page.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 11325baab31cec170e01c2548d09e540d6a2e67a Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 4 May 2023 14:04:48 +0200 -Subject: [PATCH] python/audit2allow: Add missing options to man page - -Signed-off-by: Vit Mojzis ---- - python/audit2allow/audit2allow.1 | 24 +++++++++++++++++++----- - 1 file changed, 19 insertions(+), 5 deletions(-) - -diff --git a/python/audit2allow/audit2allow.1 b/python/audit2allow/audit2allow.1 -index 04ec3239..c31021d3 100644 ---- a/python/audit2allow/audit2allow.1 -+++ b/python/audit2allow/audit2allow.1 -@@ -40,10 +40,10 @@ - Read input from audit and message log, conflicts with \-i - .TP - .B "\-b" | "\-\-boot" --Read input from audit messages since last boot conflicts with \-i -+Read input from audit messages since last boot, conflicts with \-i - .TP - .B "\-d" | "\-\-dmesg" --Read input from output of -+Read input from output of - .I /bin/dmesg. - Note that all audit messages are not available via dmesg when - auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead. -@@ -51,15 +51,22 @@ auditd is running; use "ausearch \-m avc | audit2allow" or "\-a" instead. - .B "\-D" | "\-\-dontaudit" - Generate dontaudit rules (Default: allow) - .TP -+.B "\-e" | "\-\-explain" -+Fully explain generated output -+.TP - .B "\-h" | "\-\-help" - Print a short usage message - .TP - .B "\-i " | "\-\-input " --read input from -+Read input from - .I - .TP -+.B "\-\-interface-info=" -+Read interface information from -+.I -+.TP - .B "\-l" | "\-\-lastreload" --read input only after last policy reload -+Read input only after last policy reload - .TP - .B "\-m " | "\-\-module " - Generate module/require output -@@ -70,8 +77,12 @@ Generate loadable module package, conflicts with \-o - .B "\-p " | "\-\-policy " - Policy file to use for analysis - .TP -+.B "\-\-perm-map " -+Read permission map from -+.I -+.TP - .B "\-o " | "\-\-output " --append output to -+Append output to - .I - .TP - .B "\-r" | "\-\-requires" -@@ -85,6 +96,9 @@ This is the default behavior. - Generate reference policy using installed macros. - This attempts to match denials against interfaces and may be inaccurate. - .TP -+.B "\-t " | "\-\-type=" -+Only process messages with a type that matches this regex -+.TP - .B "\-x" | "\-\-xperms" - Generate extended permission access vector rules - .TP --- -2.40.0 - diff --git a/0019-sepolicy-port-to-dnf4-python-API.patch b/0007-sepolicy-port-to-dnf4-python-API.patch similarity index 97% rename from 0019-sepolicy-port-to-dnf4-python-API.patch rename to 0007-sepolicy-port-to-dnf4-python-API.patch index bc62ff3..7410ccd 100644 --- a/0019-sepolicy-port-to-dnf4-python-API.patch +++ b/0007-sepolicy-port-to-dnf4-python-API.patch @@ -1,4 +1,4 @@ -From d925b00da35384331df9bf31935398c37117f895 Mon Sep 17 00:00:00 2001 +From 4417766f66fb5a1d41503c2d1f0008823ae11269 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 29 Jul 2023 20:33:06 +0200 Subject: [PATCH] sepolicy: port to dnf4 python API diff --git a/0008-python-semanage-Improve-man-pages.patch b/0008-python-semanage-Improve-man-pages.patch deleted file mode 100644 index 653e06e..0000000 --- a/0008-python-semanage-Improve-man-pages.patch +++ /dev/null @@ -1,464 +0,0 @@ -From fe6d5bd9a3043beb4c65b13d675f32bac2bbdaeb Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 4 May 2023 14:04:49 +0200 -Subject: [PATCH] python/semanage: Improve man pages - -- Add missing options -- Add more examples -- Note special cases - -Signed-off-by: Vit Mojzis ---- - python/semanage/semanage-boolean.8 | 9 ++++++--- - python/semanage/semanage-dontaudit.8 | 8 +++++--- - python/semanage/semanage-export.8 | 10 +++++++++- - python/semanage/semanage-fcontext.8 | 17 +++++++++++------ - python/semanage/semanage-ibendport.8 | 6 ++++-- - python/semanage/semanage-ibpkey.8 | 6 ++++-- - python/semanage/semanage-import.8 | 10 +++++++++- - python/semanage/semanage-interface.8 | 8 ++++++-- - python/semanage/semanage-login.8 | 14 ++++++++------ - python/semanage/semanage-module.8 | 15 ++++++++++----- - python/semanage/semanage-node.8 | 16 +++++++++++++--- - python/semanage/semanage-permissive.8 | 8 +++++--- - python/semanage/semanage-port.8 | 10 ++++++---- - python/semanage/semanage-user.8 | 8 +++++--- - 14 files changed, 101 insertions(+), 44 deletions(-) - -diff --git a/python/semanage/semanage-boolean.8 b/python/semanage/semanage-boolean.8 -index 1282d106..3b664023 100644 ---- a/python/semanage/semanage-boolean.8 -+++ b/python/semanage/semanage-boolean.8 -@@ -7,11 +7,14 @@ semanage\-boolean \- SELinux Policy Management boolean tool - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage boolean command controls the settings of booleans in SELinux policy. booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain. -+from policy sources. -+.B semanage boolean -+command controls the settings of booleans in SELinux policy. Booleans are if\-then\-else rules written in SELinux Policy. They can be used to customize the way that SELinux Policy rules effect a confined domain. -+ - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -45,7 +48,7 @@ Disable the boolean - - .SH EXAMPLE - .nf --Turn on the apache can send mail boolean -+Turn on the "apache can send mail" boolean (persistent version of #setsebool httpd_can_sendmail on) - # semanage boolean \-m \-\-on httpd_can_sendmail - - List customized booleans -diff --git a/python/semanage/semanage-dontaudit.8 b/python/semanage/semanage-dontaudit.8 -index 81accc6f..51d1f4b6 100644 ---- a/python/semanage/semanage-dontaudit.8 -+++ b/python/semanage/semanage-dontaudit.8 -@@ -7,13 +7,15 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage dontaudit toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause --confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Some times dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turning off dontaudit rules with this command to see if the kernel is blocking an access. -+from policy sources. -+.B semanage dontaudit -+toggles whether or not dontaudit rules will be in the policy. Policy writers use dontaudit rules to cause -+confined applications to use alternative paths. Dontaudit rules are denied but not reported in the logs. Sometimes dontaudit rules can cause bugs in applications but policy writers will not realize it since the AVC is not audited. Turn off dontaudit rules with this command to see if the kernel is blocking an access. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-S STORE, \-\-store STORE - Select an alternate SELinux Policy Store to manage -diff --git a/python/semanage/semanage-export.8 b/python/semanage/semanage-export.8 -index d422683b..51984793 100644 ---- a/python/semanage/semanage-export.8 -+++ b/python/semanage/semanage-export.8 -@@ -7,7 +7,15 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. -+from policy sources. -+.B semanage import -+and -+.B export -+can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using -+.B semanage export -+start with -+.I -D -+for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. - - .SH "OPTIONS" - .TP -diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8 -index 1ebf085f..3e327d88 100644 ---- a/python/semanage/semanage-fcontext.8 -+++ b/python/semanage/semanage-fcontext.8 -@@ -8,8 +8,10 @@ semanage\-fcontext \- SELinux Policy Management file context tool - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage fcontext is used to manage the default --file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels. -+from policy sources. -+.B semanage fcontext -+is used to manage the default file system labeling on an SELinux system. -+This command maps file paths using regular expressions to SELinux labels. - - FILE_SPEC may contain either a fully qualified path, - or a Perl compatible regular expression (PCRE), -@@ -32,7 +34,7 @@ to avoid unintentionally impacting other parts of the filesystem. - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -82,12 +84,13 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma - - .SH EXAMPLE - .nf --.I remember to run restorecon after you set the file context --Add file-context for everything under /web -+.I Remember to run restorecon after you set the file context -+Add file-context httpd_sys_content_t for everything under /web - # semanage fcontext \-a \-t httpd_sys_content_t "/web(/.*)?" - # restorecon \-R \-v /web - - Substitute /home1 with /home when setting file context -+i.e. label everything under /home1 the same way /home is labeled - # semanage fcontext \-a \-e /home /home1 - # restorecon \-R \-v /home1 - -@@ -99,7 +102,9 @@ execute the following commands. - - .SH "SEE ALSO" - .BR selinux (8), --.BR semanage (8) -+.BR semanage (8), -+.BR restorecon (8), -+.BR selabel_file (5) - - .SH "AUTHOR" - This man page was written by Daniel Walsh -diff --git a/python/semanage/semanage-ibendport.8 b/python/semanage/semanage-ibendport.8 -index 0a29eae1..53fe4ee8 100644 ---- a/python/semanage/semanage-ibendport.8 -+++ b/python/semanage/semanage-ibendport.8 -@@ -5,12 +5,14 @@ - .B semanage ibendport [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-z IBDEV_NAME \-r RANGE port | \-\-delete \-z IBDEV_NAME port | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-z IBDEV_NAME \-r RANGE port ] - - .SH "DESCRIPTION" --semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibendport controls the ibendport number to ibendport type definitions. -+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. -+.B semanage ibendport -+controls the ibendport number to ibendport type definitions. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -diff --git a/python/semanage/semanage-ibpkey.8 b/python/semanage/semanage-ibpkey.8 -index 51f455ab..6cc5e02f 100644 ---- a/python/semanage/semanage-ibpkey.8 -+++ b/python/semanage/semanage-ibpkey.8 -@@ -5,12 +5,14 @@ - .B semanage ibpkey [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range | \-\-delete \-x SUBNET_PREFIX ibpkey_name | ibpkey_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-x SUBNET_PREFIX \-r RANGE ibpkey_name | ibpkey_range ] - - .SH "DESCRIPTION" --semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage ibpkey controls the ibpkey number to ibpkey type definitions. -+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. -+.B semanage ibpkey -+controls the ibpkey number to ibpkey type definitions. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -diff --git a/python/semanage/semanage-import.8 b/python/semanage/semanage-import.8 -index 4a9b3e76..041e9ab0 100644 ---- a/python/semanage/semanage-import.8 -+++ b/python/semanage/semanage-import.8 -@@ -7,7 +7,15 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage import and export can be used to extract the SELinux modifications from one machine and apply them to another. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. -+from policy sources. -+.B semanage import -+and -+.B export -+can be used to extract the SELinux modifications from one machine and apply them to another. Please note that this will remove all current semanage customizations on the second machine as the command list generated using -+.B semanage export -+start with -+.I -D -+for all semanage sub-commands. You can put a whole group of semanage commands within a file and apply them to a machine in a single transaction. - - .SH "OPTIONS" - .TP -diff --git a/python/semanage/semanage-interface.8 b/python/semanage/semanage-interface.8 -index d9d526dc..080db70b 100644 ---- a/python/semanage/semanage-interface.8 -+++ b/python/semanage/semanage-interface.8 -@@ -7,12 +7,14 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage interface controls the labels assigned to network interfaces. -+from policy sources. -+.B semanage interface -+controls the labels assigned to network interfaces. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -54,6 +56,8 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma - .nf - list all interface definitions - # semanage interface \-l -+Assign type netif_t and MLS/MCS range s0:c0.c1023 to interface eth0 -+# semanage interface \-a \-t netif_t \-r s0:c0.c1023 eth0 - - .SH "SEE ALSO" - .BR selinux (8), -diff --git a/python/semanage/semanage-login.8 b/python/semanage/semanage-login.8 -index f451bdc6..9076a1ed 100644 ---- a/python/semanage/semanage-login.8 -+++ b/python/semanage/semanage-login.8 -@@ -7,12 +7,14 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage login controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name. -+from policy sources. -+.B semanage login -+controls the mapping between a Linux User and the SELinux User. It can be used to turn on confined users. For example you could define that a particular user or group of users will login to a system as the user_u user. Prefix the group name with a '%' sign to indicate a group name. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -52,11 +54,11 @@ MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login ma - - .SH EXAMPLE - .nf --Modify the default user on the system to the guest_u user -+Set the default SELinux user on the system to guest_u - # semanage login \-m \-s guest_u __default__ --Assign gijoe user on an MLS machine a range and to the staff_u user --# semanage login \-a \-s staff_u \-rSystemLow-Secret gijoe --Assign all users in the engineering group to the staff_u user -+Map user gijoe to SELinux user staff_u and assign MLS range SystemLow\-Secret -+# semanage login \-a \-s staff_u \-rSystemLow\-Secret gijoe -+Map all users in the engineering group to SELinux user staff_u - # semanage login \-a \-s staff_u %engineering - - .SH "SEE ALSO" -diff --git a/python/semanage/semanage-module.8 b/python/semanage/semanage-module.8 -index e0057167..6913b0cd 100644 ---- a/python/semanage/semanage-module.8 -+++ b/python/semanage/semanage-module.8 -@@ -5,12 +5,14 @@ - .B semanage module [\-h] [\-n] [\-N] [\-S STORE] (\-a | \-r | \-e | \-d | \-\-extract | \-\-list [\-C] | \-\-deleteall) [module_name] - - .SH "DESCRIPTION" --semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage module installs, removes, disables SELinux Policy modules. -+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. -+.B semanage module -+installs, removes, disables, or enables SELinux Policy modules. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -22,11 +24,14 @@ Do not reload policy after commit - Select an alternate SELinux Policy Store to manage - .TP - .I \-a, \-\-add --Install specified module -+Install specified module. Accepts both binary policy files (.pp) and CIL source files - .TP - .I \-r, \-\-remove - Remove specified module - .TP -+.I \-D, \-\-deleteall -+Remove all local customizations related to modules -+.TP - .I \-d \-\-disable - Disable specified module - .TP -@@ -48,8 +53,8 @@ List all modules - # semanage module \-l - Disable unconfined module - # semanage module \-\-disable unconfined --Install custom apache policy module --# semanage module \-a myapache -+Install custom apache policy module (same as #semodule -i myapache.pp) -+# semanage module \-a myapache.pp - - .SH "SEE ALSO" - .BR selinux (8), -diff --git a/python/semanage/semanage-node.8 b/python/semanage/semanage-node.8 -index a0098221..c78d6c3e 100644 ---- a/python/semanage/semanage-node.8 -+++ b/python/semanage/semanage-node.8 -@@ -7,12 +7,14 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage controls the ipaddress to node type definitions. -+from policy sources. -+.B semanage node -+controls the IP address to node type definitions. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -54,5 +56,13 @@ SELinux type for the object - MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. SELinux Range for SELinux user defaults to s0. - .TP - .I \-p PROTO, \-\-proto PROTO -- - Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6). -+ -+.SH "EXAMPLE" -+.nf -+Apply type node_t to ipv4 node 127.0.0.2 -+# semanage node \-a \-t node_t \-p ipv4 \-M 255.255.255.255 127.0.0.2 -+ -+.SH "SEE ALSO" -+.BR selinux (8), -+.BR semanage (8) -diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8 -index 5c3364fa..0414a850 100644 ---- a/python/semanage/semanage-permissive.8 -+++ b/python/semanage/semanage-permissive.8 -@@ -5,12 +5,14 @@ - .B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list) - - .SH "DESCRIPTION" --semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage permissive adds or removes a SELinux Policy permissive module. -+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. -+.B semanage permissive -+adds or removes a SELinux Policy permissive module. Please note that this command can make any domain permissive, but can only remove the permissive property from domains where it was added by semanage permissive ("semanage permissive -d" can only be used on types listed as "Customized Permissive Types" by "semanage permissive -l"). - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-a, \-\-add - Add a record of the specified object type -@@ -38,7 +40,7 @@ Select an alternate SELinux Policy Store to manage - - .SH EXAMPLE - .nf --List all permissive modules -+List all permissive domains ("Builtin Permissive Types" where set by the system policy, or a custom policy module) - # semanage permissive \-l - Make httpd_t (Web Server) a permissive domain - # semanage permissive \-a httpd_t -diff --git a/python/semanage/semanage-port.8 b/python/semanage/semanage-port.8 -index 12ec14c2..c6048660 100644 ---- a/python/semanage/semanage-port.8 -+++ b/python/semanage/semanage-port.8 -@@ -5,12 +5,14 @@ - .B semanage port [\-h] [\-n] [\-N] [\-S STORE] [ \-\-add \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range | \-\-delete \-p PROTOCOL port_name | port_range | \-\-deleteall | \-\-extract | \-\-list [\-C] | \-\-modify \-t TYPE \-p PROTOCOL \-r RANGE port_name | port_range ] - - .SH "DESCRIPTION" --semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. semanage port controls the port number to port type definitions. -+semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources. -+.B semanage port -+controls the port number to port type definitions. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -55,9 +57,9 @@ Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version - .nf - List all port definitions - # semanage port \-l --Allow Apache to listen on tcp port 81 -+Allow Apache to listen on tcp port 81 (i.e. assign tcp port 81 label http_port_t, which apache is allowed to listen on) - # semanage port \-a \-t http_port_t \-p tcp 81 --Allow sshd to listen on tcp port 8991 -+Allow sshd to listen on tcp port 8991 (i.e. assign tcp port 8991 label ssh_port_t, which sshd is allowed to listen on) - # semanage port \-a \-t ssh_port_t \-p tcp 8991 - - .SH "SEE ALSO" -diff --git a/python/semanage/semanage-user.8 b/python/semanage/semanage-user.8 -index 23fec698..50d50bea 100644 ---- a/python/semanage/semanage-user.8 -+++ b/python/semanage/semanage-user.8 -@@ -7,12 +7,14 @@ - .SH "DESCRIPTION" - semanage is used to configure certain elements of - SELinux policy without requiring modification to or recompilation --from policy sources. semanage user controls the mapping between an SELinux User and the roles and MLS/MCS levels. -+from policy sources. -+.B semanage user -+controls the mapping between an SELinux User and the roles and MLS/MCS levels. - - .SH "OPTIONS" - .TP - .I \-h, \-\-help --show this help message and exit -+Show this help message and exit - .TP - .I \-n, \-\-noheading - Do not print heading when listing the specified object type -@@ -59,7 +61,7 @@ List SELinux users - # semanage user \-l - Modify groups for staff_u user - # semanage user \-m \-R "system_r unconfined_r staff_r" staff_u --Add level for TopSecret Users -+Assign user topsecret_u role staff_r and range s0\-TopSecret - # semanage user \-a \-R "staff_r" \-rs0\-TopSecret topsecret_u - - .SH "SEE ALSO" --- -2.40.0 - diff --git a/0009-python-audit2allow-Remove-unused-debug-option.patch b/0009-python-audit2allow-Remove-unused-debug-option.patch deleted file mode 100644 index 811cabf..0000000 --- a/0009-python-audit2allow-Remove-unused-debug-option.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 10fb1da179ab377db96697e79ac45bfdcd251989 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 4 May 2023 14:04:50 +0200 -Subject: [PATCH] python/audit2allow: Remove unused "debug" option - -The option is not referenced anywhere in the code and I couldn't figure -out its purpose from the description. - -Signed-off-by: Vit Mojzis ---- - python/audit2allow/audit2allow | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow -index eafeea88..5587a2db 100644 ---- a/python/audit2allow/audit2allow -+++ b/python/audit2allow/audit2allow -@@ -88,8 +88,6 @@ class AuditToPolicy: - parser.add_option("--interface-info", dest="interface_info", help="file name of interface information") - parser.add_option("-x", "--xperms", action="store_true", dest="xperms", - default=False, help="generate extended permission rules") -- parser.add_option("--debug", dest="debug", action="store_true", default=False, -- help="leave generated modules for -M") - parser.add_option("-w", "--why", dest="audit2why", action="store_true", default=(os.path.basename(sys.argv[0]) == "audit2why"), - help="Translates SELinux audit messages into a description of why the access was denied") - --- -2.40.0 - diff --git a/0010-policycoreutils-Add-examples-to-man-pages.patch b/0010-policycoreutils-Add-examples-to-man-pages.patch deleted file mode 100644 index 4aead05..0000000 --- a/0010-policycoreutils-Add-examples-to-man-pages.patch +++ /dev/null @@ -1,308 +0,0 @@ -From 10cfbd2825e12efdc0faa872987d5987e02e7eae Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 1 Jun 2023 16:39:11 +0200 -Subject: [PATCH] policycoreutils: Add examples to man pages - -While at it, remove trailing whitespaces. - -Signed-off-by: Vit Mojzis -Acked-by: Petr Lautrbach ---- - policycoreutils/scripts/fixfiles.8 | 34 +++++++++++++-------- - policycoreutils/secon/secon.1 | 12 ++++++-- - policycoreutils/semodule/semodule.8 | 14 ++++----- - policycoreutils/setfiles/restorecon.8 | 9 ++++++ - policycoreutils/setfiles/restorecon_xattr.8 | 7 +++++ - policycoreutils/setfiles/setfiles.8 | 9 ++++++ - policycoreutils/setsebool/setsebool.8 | 16 +++++++--- - 7 files changed, 74 insertions(+), 27 deletions(-) - -diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8 -index 9a317d91..928b8200 100644 ---- a/policycoreutils/scripts/fixfiles.8 -+++ b/policycoreutils/scripts/fixfiles.8 -@@ -14,7 +14,7 @@ fixfiles \- fix file SELinux security contexts. - .B fixfiles - .I [\-v] [\-F] [\-B | \-N time ] [\-T nthreads] { check | restore | verify } - --.B fixfiles -+.B fixfiles - .I [\-v] [\-F] [\-T nthreads] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify } - - .B fixfiles -@@ -31,7 +31,7 @@ This manual page describes the - script. - .P - This script is primarily used to correct the security context --database (extended attributes) on filesystems. -+database (extended attributes) on filesystems. - .P - It can also be run at any time to relabel when adding support for - new policy, or just check whether the file contexts are all -@@ -41,29 +41,29 @@ option. You can use the \-R flag to use rpmpackages as an alternative. - The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories - excluded from relabeling. - .P --.B fixfiles onboot -+.B fixfiles onboot - will setup the machine to relabel on the next reboot. - - .SH "OPTIONS" --.TP -+.TP - .B \-B - If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today. - .TP - .B \-F - Force reset of context to match file_context for customizable files - --.TP -+.TP - .B \-f - Clear /tmp directory with out prompt for removal. - --.TP -+.TP - .B \-R rpmpackagename[,rpmpackagename...] - Use the rpm database to discover all files within the specified packages and restore the file contexts. - .TP - .B \-C PREVIOUS_FILECONTEXT - Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files. - --.TP -+.TP - .B \-N time - Only act on files created after the specified date. Date must be specified in - "YYYY\-MM\-DD HH:MM" format. Date field will be passed to find \-\-newermt command. -@@ -83,19 +83,28 @@ Use parallel relabeling, see - - .SH "ARGUMENTS" - One of: --.TP -+.TP - .B check | verify - print any incorrect file context labels, showing old and new context, but do not change them. --.TP -+.TP - .B restore - change any incorrect file context labels. --.TP -+.TP - .B relabel - Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file. --.TP --.B [[dir/file] ... ] -+.TP -+.B [[dir/file] ... ] - List of files or directories trees that you wish to check file context on. - -+.SH EXAMPLE -+.nf -+Relabel the whole filesystem, except paths listed in /etc/selinux/fixfiles_exclude_dirs -+# fixfiles relabel -+Schedule the machine to relabel on the next boot and force relabeling of customizable types -+# fixfiles -F onboot -+Check labeling of all files from the samba package (while not changing any labels) -+# fixfiles -R samba check -+ - .SH "AUTHOR" - This man page was written by Richard Hally . - The script was written by Dan Walsh -@@ -103,4 +112,3 @@ The script was written by Dan Walsh - .SH "SEE ALSO" - .BR setfiles (8), - .BR restorecon (8) -- -diff --git a/policycoreutils/secon/secon.1 b/policycoreutils/secon/secon.1 -index 501b5cb8..c0e8b05a 100644 ---- a/policycoreutils/secon/secon.1 -+++ b/policycoreutils/secon/secon.1 -@@ -107,16 +107,24 @@ then the context will be read from stdin. - .br - If there is no argument, - .B secon --will try reading a context from stdin, if that is not a tty, otherwise -+will try reading a context from stdin, if that is not a tty, otherwise - .B secon - will act as though \fB\-\-self\fR had been passed. - .PP - If none of \fB\-\-user\fR, \fB\-\-role\fR, \fB\-\-type\fR, \fB\-\-level\fR or - \fB\-\-mls\-range\fR is passed. - Then all of them will be output. -+ -+.SH EXAMPLE -+.nf -+Show SElinux context of the init process -+# secon --pid 1 -+Parse the type portion of given security context -+# secon -t system_u:object_r:httpd_sys_rw_content_t:s0 -+ - .PP - .SH SEE ALSO - .BR chcon (1) - .SH AUTHORS - .nf --James Antill (james.antill@redhat.com) -+James Antill (james.antill@redhat.com) -diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8 -index c56e580f..01757b00 100644 ---- a/policycoreutils/semodule/semodule.8 -+++ b/policycoreutils/semodule/semodule.8 -@@ -1,5 +1,5 @@ - .TH SEMODULE "8" "Nov 2005" "Security Enhanced Linux" NSA --.SH NAME -+.SH NAME - semodule \- Manage SELinux policy modules. - - .SH SYNOPSIS -@@ -8,7 +8,7 @@ semodule \- Manage SELinux policy modules. - .SH DESCRIPTION - .PP - semodule is the tool used to manage SELinux policy modules, --including installing, upgrading, listing and removing modules. -+including installing, upgrading, listing and removing modules. - semodule may also be used to force a rebuild of policy from the - module store and/or to force a reload of policy without performing - any other transaction. semodule acts on module packages created -@@ -39,7 +39,7 @@ install/replace a module package - .B \-u,\-\-upgrade=MODULE_PKG - deprecated, alias for --install - .TP --.B \-b,\-\-base=MODULE_PKG -+.B \-b,\-\-base=MODULE_PKG - deprecated, alias for --install - .TP - .B \-r,\-\-remove=MODULE_NAME -@@ -77,7 +77,7 @@ name of the store to operate on - .B \-n,\-\-noreload,\-N - do not reload policy after commit - .TP --.B \-h,\-\-help -+.B \-h,\-\-help - prints help message and quit - .TP - .B \-P,\-\-preserve_tunables -@@ -92,7 +92,7 @@ Use an alternate path for the policy root - .B \-S,\-\-store-path - Use an alternate path for the policy store root - .TP --.B \-v,\-\-verbose -+.B \-v,\-\-verbose - be verbose - .TP - .B \-c,\-\-cil -@@ -131,8 +131,6 @@ $ semodule \-B - $ semodule \-d alsa - # Install a module at a specific priority. - $ semodule \-X 100 \-i alsa.pp --# List all modules. --$ semodule \-\-list=full - # Set an alternate path for the policy root - $ semodule \-B \-p "/tmp" - # Set an alternate path for the policy store root -@@ -143,6 +141,8 @@ $ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark - # Check whether a module in "localmodule.pp" file is same as installed module "localmodule" - $ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum - $ semodule -l -m | grep localmodule -+# Translate binary module file into CIL (useful for debugging installation errors) -+$ /usr/libexec/selinux/hll/pp alsa.pp > alsa.cil - .fi - - .SH SEE ALSO -diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index dbd55ce7..6160aced 100644 ---- a/policycoreutils/setfiles/restorecon.8 -+++ b/policycoreutils/setfiles/restorecon.8 -@@ -224,6 +224,15 @@ and provided the - option is NOT set and recursive mode is set, files will be relabeled as - required with the digests then being updated provided there are no errors. - -+.SH EXAMPLE -+.nf -+Fix labeling of /var/www/ including all sub-directories and list all context changes -+# restorecon -rv /var/www/ -+List mislabeled files in user home directory and what the correct label should be -+# restorecon -nvr ~ -+Fix labeling of files listed in file_list file, ignoring any that do not exist -+# restorecon -vif file_list -+ - .SH "AUTHOR" - This man page was written by Dan Walsh . - Some of the content of this man page was taken from the setfiles -diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8 -index 4b1ce304..09bfd8c4 100644 ---- a/policycoreutils/setfiles/restorecon_xattr.8 -+++ b/policycoreutils/setfiles/restorecon_xattr.8 -@@ -112,6 +112,13 @@ If the option is not specified, then the default file_contexts will be used. - .br - the pathname of the directory tree to be searched. - -+.SH EXAMPLE -+.nf -+List all paths that where assigned a checksum by "restorecon/setfiles -D" -+# restorecon_xattr -r / -+Remove all non-matching checksums -+# restorecon_xattr -rd / -+ - .SH "SEE ALSO" - .BR restorecon (8), - .BR setfiles (8) -diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 36fe6b36..6071d9ba 100644 ---- a/policycoreutils/setfiles/setfiles.8 -+++ b/policycoreutils/setfiles/setfiles.8 -@@ -289,6 +289,15 @@ and provided the - option is NOT set, files will be relabeled as required with the digests then - being updated provided there are no errors. - -+.SH EXAMPLE -+.nf -+Fix labeling of /var/www/ including all sub-directories, using targeted policy file context definitions and list all context changes -+# setfiles -v /etc/selinux/targeted/contexts/files/file_contexts /var/www/ -+List mislabeled files in user home directory and what the label should be based on targeted policy file context definitions -+# setfiles -nv /etc/selinux/targeted/contexts/files/file_contexts ~ -+Fix labeling of files listed in file_list file, ignoring any that do not exist -+# setfiles -vif file_list /etc/selinux/targeted/contexts/files/file_contexts -+ - .SH "AUTHOR" - This man page was written by Russell Coker . - The program was written by Stephen Smalley -diff --git a/policycoreutils/setsebool/setsebool.8 b/policycoreutils/setsebool/setsebool.8 -index 52936f5a..f54664fb 100644 ---- a/policycoreutils/setsebool/setsebool.8 -+++ b/policycoreutils/setsebool/setsebool.8 -@@ -7,13 +7,13 @@ setsebool \- set SELinux boolean value - .I "[ \-PNV ] boolean value | bool1=val1 bool2=val2 ..." - - .SH "DESCRIPTION" --.B setsebool --sets the current state of a particular SELinux boolean or a list of booleans --to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it. -+.B setsebool -+sets the current state of a particular SELinux boolean or a list of booleans -+to a given value. The value may be 1 or true or on to enable the boolean, or 0 or false or off to disable it. - - Without the \-P option, only the current boolean value is --affected; the boot-time default settings --are not changed. -+affected; the boot-time default settings -+are not changed. - - If the \-P option is given, all pending values are written to - the policy file on disk. So they will be persistent across reboots. -@@ -22,6 +22,12 @@ If the \-N option is given, the policy on disk is not reloaded into the kernel. - - If the \-V option is given, verbose error messages will be printed from semanage libraries. - -+.SH EXAMPLE -+.nf -+Enable container_use_devices boolean (will return to persistent value after reboot) -+# setsebool container_use_devices 1 -+Persistently enable samba_create_home_dirs and samba_enable_home_dirs booleans -+# setsebool -P samba_create_home_dirs=on samba_enable_home_dirs=on - - .SH AUTHOR - This manual page was written by Dan Walsh . --- -2.40.0 - diff --git a/0011-python-sepolicy-Improve-man-pages.patch b/0011-python-sepolicy-Improve-man-pages.patch deleted file mode 100644 index 4620b3e..0000000 --- a/0011-python-sepolicy-Improve-man-pages.patch +++ /dev/null @@ -1,390 +0,0 @@ -From 835b208cad02557cf99c3ab7289ca511b8bfa91e Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 1 Jun 2023 16:39:12 +0200 -Subject: [PATCH] python/sepolicy: Improve man pages - -- Add missing options -- Add examples -- Emphasize keywords -- Remove trailing whitespaces - -Signed-off-by: Vit Mojzis -Acked-by: Petr Lautrbach ---- - python/sepolicy/sepolicy-booleans.8 | 15 +++++++++--- - python/sepolicy/sepolicy-communicate.8 | 14 ++++++++--- - python/sepolicy/sepolicy-generate.8 | 34 ++++++++++++-------------- - python/sepolicy/sepolicy-gui.8 | 4 +-- - python/sepolicy/sepolicy-interface.8 | 18 +++++++++++--- - python/sepolicy/sepolicy-manpage.8 | 25 ++++++++++++++----- - python/sepolicy/sepolicy-network.8 | 17 ++++++------- - python/sepolicy/sepolicy-transition.8 | 19 +++++++++----- - 8 files changed, 96 insertions(+), 50 deletions(-) - -diff --git a/python/sepolicy/sepolicy-booleans.8 b/python/sepolicy/sepolicy-booleans.8 -index f8d8b56d..7f4b18e7 100644 ---- a/python/sepolicy/sepolicy-booleans.8 -+++ b/python/sepolicy/sepolicy-booleans.8 -@@ -8,12 +8,16 @@ sepolicy-booleans \- Query SELinux Policy to see description of booleans - .B sepolicy booleans [\-h] [ \-a | \-b booleanname ... ] - - .SH "DESCRIPTION" --sepolicy booleans will show all booleans and their descriptions, or you can --choose individual booleans to display -+.B sepolicy booleans -+will show all booleans and their descriptions, or you can -+choose individual booleans to display. -+Please make sure that selinux-policy-devel is present in your system since it contains boolean descriptions extracted from the policy source code. Otherwise -+.B sepolicy booleans -+will only show descriptions generated based on boolean names. - - .SH "OPTIONS" - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP - .I \-a, \-\-all -@@ -22,6 +26,11 @@ Display all boolean descriptions - .I \-b, \-\-boolean - boolean to get description - -+.SH EXAMPLE -+.nf -+List descriptions of samba_create_home_dirs and samba_enable_home_dirs booleans -+# sepolicy booleans -b samba_create_home_dirs samba_enable_home_dirs -+ - .SH "AUTHOR" - This man page was written by Daniel Walsh - -diff --git a/python/sepolicy/sepolicy-communicate.8 b/python/sepolicy/sepolicy-communicate.8 -index 050aa475..5ecf6eff 100644 ---- a/python/sepolicy/sepolicy-communicate.8 -+++ b/python/sepolicy/sepolicy-communicate.8 -@@ -8,7 +8,9 @@ sepolicy-communicate \- Generate a report showing if two SELinux Policy Domains - .B sepolicy communicate [\-h] \-s SOURCE \-t TARGET [\-c TCLASS] [\-S SOURCEACCESS] [\-T TARGETACCESS] - - .SH "DESCRIPTION" --Use sepolicy communicate to examine SELinux Policy to if a source SELinux Domain can communicate with a target SELinux Domain. -+Use -+.B sepolicy communicate -+to examine SELinux Policy and determine if a source SELinux Domain can communicate with a target SELinux Domain. - The default command looks to see if there are any file types that the source domain can write, which the target domain can read. - - .SH "OPTIONS" -@@ -16,7 +18,7 @@ The default command looks to see if there are any file types that the source dom - .I \-c, \-\-class - Specify the SELinux class which the source domain will attempt to communicate with the target domain. (Default file) - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP - .I \-s, \-\-source -@@ -31,9 +33,15 @@ Specify the target SELinux domain type. - .I \-T, \-\-targetaccess - Specify the list of accesses used by the target SELinux domain type to receive communications from the source domain. Default Open, Read. - -+.SH EXAMPLE -+.nf -+List types that can be used to communicate between samba daemon and apache server -+# sepolicy communicate -s httpd_t -t smbd_t -+Consider a type to be accessible by the source domain when it can be opened and appended to (as opposed to opened and written to) -+# sepolicy communicate -s httpd_t -t smbd_t -S open,append -+ - .SH "AUTHOR" - This man page was written by Daniel Walsh - - .SH "SEE ALSO" - sepolicy(8), selinux(8) -- -diff --git a/python/sepolicy/sepolicy-generate.8 b/python/sepolicy/sepolicy-generate.8 -index 0c5f998f..72d0e8e4 100644 ---- a/python/sepolicy/sepolicy-generate.8 -+++ b/python/sepolicy/sepolicy-generate.8 -@@ -57,32 +57,29 @@ path. \fBsepolicy generate\fP will use the rpm payload of the - application along with \fBnm \-D APPLICATION\fP to help it generate - types and policy rules for your policy files. - --.B Type Enforcing File NAME.te -+.B NAME.te - .br --This file can be used to define all the types rules for a particular domain. -+This file can be used to define all the types enforcement rules for a particular domain. - - .I Note: --Policy generated by \fBsepolicy generate\fP will automatically add a permissive DOMAIN to your te file. When you are satisfied that your policy works, you need to remove the permissive line from the te file to run your domain in enforcing mode. -+Policy generated by \fBsepolicy generate\fP will automatically add a \fIpermissive DOMAIN\fP to your \fB.te\fP file. When you are satisfied that your policy works, you need to remove the permissive line from the \fB.te\fP file to run your domain in enforcing mode. - --.B Interface File NAME.if -+.B NAME.if - .br --This file defines the interfaces for the types generated in the te file, which can be used by other policy domains. -+This file defines the interfaces for the types generated in the \fB.te\fP file, which can be used by other policy domains. - --.B File Context NAME.fc -+.B NAME.fc - .br --This file defines the default file context for the system, it takes the file types created in the te file and associates -+This file defines the default file context for the system, it takes the file types created in the \fB.te\fP file and associates - file paths to the types. Tools like restorecon and RPM will use these paths to put down labels. - --.B RPM Spec File NAME_selinux.spec -+.B NAME_selinux.spec - .br --This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page. -+This file is an RPM SPEC file that can be used to install the SELinux policy on to machines and setup the labeling. The spec file also installs the interface file and a man page describing the policy. You can use \fBsepolicy manpage \-d NAME\fP to generate the man page. - --.B Shell File NAME.sh -+.B NAME.sh - .br --This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and --compile and build an RPM suitable to be installed on other machines -- --If a generate is possible, this tool will print out all generate paths from the source domain to the target domain -+This is a helper shell script to compile, install and fix the labeling on your test system. It will also generate a man page based on the installed policy, and compile and build an RPM suitable to be installed on other machines. - - .SH "OPTIONS" - .TP -@@ -97,10 +94,11 @@ Specify alternate name of policy. The policy will default to the executable or n - .TP - .I \-p, \-\-path - Specify the directory to store the created policy files. (Default to current working directory ) -+.TP - optional arguments: - .TP - .I \-r, \-\-role --Enter role(s) to which this admin user will transition. -+Enter role(s) to which this admin user will transition - .TP - .I \-t, \-\-type - Enter type(s) for which you will generate new definition and rule(s) -@@ -109,12 +107,12 @@ Enter type(s) for which you will generate new definition and rule(s) - SELinux user(s) which will transition to this domain - .TP - .I \-w, \-\-writepath --Path(s) which the confined processes need to write -+Path(s) which the confined processes need to write to - .TP - .I \-a, \-\-admin - Domain(s) which the confined admin will administrate - .TP --.I \-\-admin_user -+.I \-\-admin_user - Generate Policy for Administrator Login User Role - .TP - .I \-\-application -@@ -142,7 +140,7 @@ Generate Policy for Internet Services Daemon - Generate Policy for Standard Init Daemon (Default) - .TP - .I \-\-newtype --Generate new policy for new types to add to an existing policy. -+Generate new policy for new types to add to an existing policy - .TP - .I \-\-sandbox - Generate Policy for Sandbox -diff --git a/python/sepolicy/sepolicy-gui.8 b/python/sepolicy/sepolicy-gui.8 -index ed744cdb..65b69fab 100644 ---- a/python/sepolicy/sepolicy-gui.8 -+++ b/python/sepolicy/sepolicy-gui.8 -@@ -11,7 +11,7 @@ Common options - .br - - .SH "DESCRIPTION" --Use \fBsepolicy gui\fP to run a the graphical user interface, which -+Use \fBsepolicy gui\fP to run the graphical user interface, which - allows you to explore how SELinux confines different process domains. - - .SH "OPTIONS" -@@ -20,7 +20,7 @@ allows you to explore how SELinux confines different process domains. - Display help message - .TP - .I \-d, \-\-domain --Initialize gui to the selected domain. -+Initialize gui to the selected domain - - .SH "AUTHOR" - This man page was written by Daniel Walsh -diff --git a/python/sepolicy/sepolicy-interface.8 b/python/sepolicy/sepolicy-interface.8 -index 3e74ea62..a70a9306 100644 ---- a/python/sepolicy/sepolicy-interface.8 -+++ b/python/sepolicy/sepolicy-interface.8 -@@ -5,10 +5,10 @@ sepolicy-interface \- Print interface information based on the installed SELinux - .SH "SYNOPSIS" - - .br --.B sepolicy interface [\-h] [\-c] [\-v] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]] -+.B sepolicy interface [\-h] [\-c] [\-v] [\-f FILE] [\-a | \-u | \-l | \-i INTERFACE [INTERFACE ... ]] - - .SH "DESCRIPTION" --Use sepolicy interface to print interfaces information based on SELinux Policy. -+Use \fBsepolicy interface\fP to print interface information based on SELinux Policy. - - .SH "OPTIONS" - .TP -@@ -18,7 +18,7 @@ List all domains with admin interface - .I \-c, \-\-compile - Test compile of interfaces - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP - .I \-i, \-\-interface -@@ -32,6 +32,18 @@ List all domains with SELinux user role interface - .TP - .I \-v, \-\-verbose - Display extended information about the interface including parameters and description if available. -+.TP -+.I \-f, \-\-file -+Interface file to be explored -+ -+.SH EXAMPLE -+.nf -+Show description of given interface -+# sepolicy interface -vi samba_rw_config -+List interfaces in given interface file and show their description -+# sepolicy interface -f my_policy.if -lv -+Run compile test for all interfaces in given file -+# sepolicy interface -f my_policy.if -lc - - .SH "AUTHOR" - This man page was written by Daniel Walsh -diff --git a/python/sepolicy/sepolicy-manpage.8 b/python/sepolicy/sepolicy-manpage.8 -index c05c9430..4991f645 100644 ---- a/python/sepolicy/sepolicy-manpage.8 -+++ b/python/sepolicy/sepolicy-manpage.8 -@@ -8,27 +8,40 @@ sepolicy-manpage \- Generate a man page based on the installed SELinux Policy - .B sepolicy manpage [\-w] [\-h] [\-p PATH ] [\-r ROOTDIR ] [\-a | \-d ] - - .SH "DESCRIPTION" --Use sepolicy manpage to generate manpages based on SELinux Policy. -+Use \fBsepolicy manpage\fP to generate manpages based on SELinux Policy. - - .SH "OPTIONS" - .TP --.I \-a, \-\-all -+.I \-a, \-\-all - Generate Man Pages for All Domains - .TP --.I \-d, \-\-domain -+.I \-d, \-\-domain - Generate a Man Page for the specified domain. (Supports multiple commands) - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP -+.I \-o, \-\-os -+Specify the name of the OS to be used in the man page (only affects HTML man pages) -+.TP - .I \-p, \-\-path - Specify the directory to store the created man pages. (Default to /tmp) - .TP - .I \-r, \-\-root --Specify alternate root directory to generate man pages from. (Default to /) -+Specify alternative root directory to generate man pages from. (Default to /) -+.TP -+.I \-\-source_files -+Use file_contexts and policy.xml files from the specified root directory (the alternative root needs to include both files) - .TP - .I \-w, \-\-web --Generate an additional HTML man pages for the specified domain(s). -+Generate an additional HTML man pages for the specified domain(s) -+ -+.SH EXAMPLE -+.nf -+Generate man pages for all available domains -+# sepolicy manpage -a -+Generate an HTML man page for domain alsa_t, setting the OS name to "My_distro" -+# sepolicy manpage -o My_distro -d alsa_t -w - - .SH "AUTHOR" - This man page was written by Daniel Walsh -diff --git a/python/sepolicy/sepolicy-network.8 b/python/sepolicy/sepolicy-network.8 -index dcddec75..6faf60ab 100644 ---- a/python/sepolicy/sepolicy-network.8 -+++ b/python/sepolicy/sepolicy-network.8 -@@ -8,27 +8,27 @@ sepolicy-network \- Examine the SELinux Policy and generate a network report - .B sepolicy network [\-h] (\-l | \-a application [application ...] | \-p PORT [PORT ...] | \-t TYPE [TYPE ...] | \-d DOMAIN [DOMAIN ...]) - - .SH "DESCRIPTION" --Use sepolicy network to examine SELinux Policy and generate network reports. -+Use \fBsepolicy network\fP to examine SELinux Policy and generate network reports. - - .SH "OPTIONS" - .TP - .I \-a, \-\-application --Generate a report listing the ports to which the specified init application is allowed to connect and or bind. -+Generate a report listing the ports to which the specified init application is allowed to connect and or bind - .TP --.I \-d, \-\-domain --Generate a report listing the ports to which the specified domain is allowed to connect and or bind. -+.I \-d, \-\-domain -+Generate a report listing the ports to which the specified domain is allowed to connect and or bind - .TP --.I \-l, \-\-list -+.I \-l, \-\-list - List all Network Port Types defined in SELinux Policy - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP - .I \-t, \-\-type --Generate a report listing the port numbers associate with the specified SELinux port type. -+Generate a report listing the port numbers associate with the specified SELinux port type - .TP - .I \-p, \-\-port --Generate a report listing the SELinux port types associate with the specified port number. -+Generate a report listing the SELinux port types associate with the specified port number - - .SH "EXAMPLES" - -@@ -88,4 +88,3 @@ This man page was written by Daniel Walsh - - .SH "SEE ALSO" - sepolicy(8), selinux(8), semanage(8) -- -diff --git a/python/sepolicy/sepolicy-transition.8 b/python/sepolicy/sepolicy-transition.8 -index 897f0c4c..9f9ff5a5 100644 ---- a/python/sepolicy/sepolicy-transition.8 -+++ b/python/sepolicy/sepolicy-transition.8 -@@ -11,21 +11,28 @@ sepolicy-transition \- Examine the SELinux Policy and generate a process transit - .B sepolicy transition [\-h] \-s SOURCE \-t TARGET - - .SH "DESCRIPTION" --sepolicy transition will show all domains that a give SELinux source domain can transition to, including the entrypoint. -+\fBsepolicy transition\fP will show all domains that a given SELinux source domain can transition to, including the entrypoint. - --If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the --paths. If a transition is possible, this tool will print out all transition paths from the source domain to the target domain -+If a target domain is given, sepolicy transition will examine policy for all transition paths from the source domain to the target domain, and will list the -+paths. - - .SH "OPTIONS" - .TP --.I \-h, \-\-help -+.I \-h, \-\-help - Display help message - .TP - .I \-s, \-\-source --Specify the source SELinux domain type. -+Specify the source SELinux domain type - .TP - .I \-t, \-\-target --Specify the target SELinux domain type. -+Specify the target SELinux domain type -+ -+.SH EXAMPLE -+.nf -+List all domain transition paths from init_t to httpd_t -+# sepolicy transition -s init_t -t httpd_t -+List all transitions available from samba domain, including entry points and booleans controlling each transition -+# sepolicy transition -s smbd_t - - .SH "AUTHOR" - This man page was written by Daniel Walsh --- -2.40.0 - diff --git a/0012-sandbox-Add-examples-to-man-pages.patch b/0012-sandbox-Add-examples-to-man-pages.patch deleted file mode 100644 index 28c0e64..0000000 --- a/0012-sandbox-Add-examples-to-man-pages.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 0beb84506b86844374d43db32180a4ea17aeb825 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 1 Jun 2023 16:39:13 +0200 -Subject: [PATCH] sandbox: Add examples to man pages - -While at it, remove trailing whitespaces. - -Signed-off-by: Vit Mojzis -Acked-by: Petr Lautrbach ---- - sandbox/sandbox.8 | 28 ++++++++++++++++++---------- - sandbox/seunshare.8 | 21 ++++++++++++++------- - 2 files changed, 32 insertions(+), 17 deletions(-) - -diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8 -index 775e4b23..1c187019 100644 ---- a/sandbox/sandbox.8 -+++ b/sandbox/sandbox.8 -@@ -11,12 +11,12 @@ sandbox \- Run cmd under an SELinux sandbox - .br - .SH DESCRIPTION - .PP --Run the --.I cmd -+Run the -+.I cmd - application within a tightly confined SELinux domain. The default sandbox domain only allows applications the ability to read and write stdin, stdout and any other file descriptors handed to it. It is not allowed to open any other files. The \-M option will mount an alternate homedir and tmpdir to be used by the sandbox. - --If you have the --.I policycoreutils-sandbox -+If you have the -+.I policycoreutils-sandbox - package installed, you can use the \-X option and the \-M option. - .B sandbox \-X - allows you to run X applications within a sandbox. These applications will start up their own X Server and create a temporary home directory and /tmp. The default SELinux policy does not allow any capabilities or network access. It also prevents all access to the users other processes and files. Files specified on the command that are in the home directory or /tmp will be copied into the sandbox directories. -@@ -78,27 +78,35 @@ Run a full desktop session, Requires level, and home and tmpdir. - Specifies the windowsize when creating an X based Sandbox. The default windowsize is 1000x700. - .TP - \fB\-W\fR \fB\-\-windowmanager\fR --Select alternative window manager to run within -+Select alternative window manager to run within - .B sandbox \-X. - Default to /usr/bin/matchbox-window-manager. - .TP --\fB\-X\fR -+\fB\-X\fR - Create an X based Sandbox for gui apps, temporary files for - $HOME and /tmp, secondary Xserver, defaults to sandbox_x_t - .TP - \fB\-d\fR \fB\-\-dpi\fR - Set the DPI value for the sandbox X Server. Defaults to the current X Sever DPI. - .TP --\fB\-C\fR \fB\-\-capabilities\fR Use capabilities within the --sandbox. By default applications executed within the sandbox will not --be allowed to use capabilities (setuid apps), with the \-C flag, you --can use programs requiring capabilities. -+\fB\-C\fR \fB\-\-capabilities\fR -+Use capabilities within the sandbox. By default applications executed within the sandbox will not be allowed to use capabilities (setuid apps), with the \-C flag, you can use programs requiring capabilities. - .PP - .SH "SEE ALSO" - .TP - runcon(1), seunshare(8), selinux(8) - .PP - -+.SH EXAMPLE -+.nf -+Run a graphical application inside the sandbox -+# sandbox -X evince -+Run a graphical application that requires the use of network -+# sandbox ‑X ‑t sandbox_web_t firefox -+Preserve data from one session to the next -+# mkdir -p ~/sandbox/home ~/sandbox/tmp -+# sandbox -H ~/sandbox/home -T ~/sandbox/tmp -X libreoffice --writer -+ - .SH AUTHOR - This manual page was written by - .I Dan Walsh -diff --git a/sandbox/seunshare.8 b/sandbox/seunshare.8 -index 09cf7fea..5339a3b1 100644 ---- a/sandbox/seunshare.8 -+++ b/sandbox/seunshare.8 -@@ -9,29 +9,36 @@ seunshare \- Run cmd with alternate homedir, tmpdir and/or SELinux context - .PP - Run the - .I executable --within the specified context, using the alternate home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context. -+within the specified context, using custom home directory and /tmp directory. The seunshare command unshares from the default namespace, then mounts the specified homedir and tmpdir over the default homedir and /tmp. Finally it tells the kernel to execute the application under the specified SELinux context. - - .TP - \fB\-h homedir\fR --Alternate homedir to be used by the application. Homedir must be owned by the user. -+Alternate homedir to be used by the application. Homedir must be owned by the user - .TP - \fB\-t\ tmpdir --Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user. -+Use alternate temporary directory to mount on /tmp. tmpdir must be owned by the user - .TP - \fB\-r\ runuserdir --Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user. -+Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID). runuserdir must be owned by the user - .TP - \fB\-C --capabilities\fR --Allow apps executed within the namespace to use capabilities. Default is no capabilities. -+Allow apps executed within the namespace to use capabilities. Default is no capabilities - .TP - \fB\-k --kill\fR --Kill all processes with matching MCS level. -+Kill all processes with matching MCS level - .TP - \fB\-Z\ context --Use alternate SELinux context while running the executable. -+Use alternate SELinux context while running the executable - .TP - \fB\-v\fR - Verbose output -+ -+.SH EXAMPLE -+.nf -+Run bash with temporary /home and /tmp directory -+# USERHOMEDIR=`mktemp -d /tmp/home.XXXXXX`; USERTEMPDIR=`mktemp -d /tmp/temp.XXXXXX` -+# seunshare -v -h ${USERHOMEDIR} -t ${USERTEMPDIR} -- /bin/bash -+ - .SH "SEE ALSO" - .TP - runcon(1), sandbox(8), selinux(8) --- -2.40.0 - diff --git a/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch b/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch deleted file mode 100644 index b2271a2..0000000 --- a/0013-python-sepolicy-Fix-template-for-confined-user-polic.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 73fd4231024f6241af6263ba74b70459bf9611f1 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 1 Jun 2023 18:34:30 +0200 -Subject: [PATCH] python/sepolicy: Fix template for confined user policy - modules - -The following commit -https://github.com/SELinuxProject/refpolicy/commit/330b0fc3331d3b836691464734c96f3da3044490 -changed the userdom_base_user_template, which now requires a role -corresponding to the user being created to be defined outside of the -template. -Similar change was also done to fedora-selinux/selinux-policy -https://github.com/fedora-selinux/selinux-policy/commit/e1e216b25df1bdb4eb7dbb8f73f32927ad6f3d1f - -Although I believe the template should define the role (just as it -defines the new user), that will require extensive changes to refpolicy. -In the meantime the role needs to be defined separately. - -Fixes: - # sepolicy generate --term_user -n newuser - Created the following files: - /root/a/test/newuser.te # Type Enforcement file - /root/a/test/newuser.if # Interface file - /root/a/test/newuser.fc # File Contexts file - /root/a/test/newuser_selinux.spec # Spec file - /root/a/test/newuser.sh # Setup Script - - # ./newuser.sh - Building and Loading Policy - + make -f /usr/share/selinux/devel/Makefile newuser.pp - Compiling targeted newuser module - Creating targeted newuser.pp policy package - rm tmp/newuser.mod tmp/newuser.mod.fc - + /usr/sbin/semodule -i newuser.pp - Failed to resolve roleattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/newuser/cil:8 - Failed to resolve AST - /usr/sbin/semodule: Failed! - -Signed-off-by: Vit Mojzis -Acked-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/templates/user.py | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/python/sepolicy/sepolicy/templates/user.py b/python/sepolicy/sepolicy/templates/user.py -index 1ff9d2ce..7081fbae 100644 ---- a/python/sepolicy/sepolicy/templates/user.py -+++ b/python/sepolicy/sepolicy/templates/user.py -@@ -28,6 +28,8 @@ policy_module(TEMPLATETYPE, 1.0.0) - # - # Declarations - # -+role TEMPLATETYPE_r; -+ - userdom_unpriv_user_template(TEMPLATETYPE) - """ - -@@ -38,6 +40,8 @@ policy_module(TEMPLATETYPE, 1.0.0) - # - # Declarations - # -+role TEMPLATETYPE_r; -+ - userdom_admin_user_template(TEMPLATETYPE) - """ - -@@ -48,6 +52,7 @@ policy_module(TEMPLATETYPE, 1.0.0) - # - # Declarations - # -+role TEMPLATETYPE_r; - - userdom_restricted_user_template(TEMPLATETYPE) - """ -@@ -59,6 +64,7 @@ policy_module(TEMPLATETYPE, 1.0.0) - # - # Declarations - # -+role TEMPLATETYPE_r; - - userdom_restricted_xwindows_user_template(TEMPLATETYPE) - """ -@@ -89,6 +95,7 @@ gen_tunable(TEMPLATETYPE_manage_user_files, false) - # - # Declarations - # -+role TEMPLATETYPE_r; - - userdom_base_user_template(TEMPLATETYPE) - """ --- -2.40.0 - diff --git a/0015-python-improve-format-strings-for-proper-localizatio.patch b/0015-python-improve-format-strings-for-proper-localizatio.patch deleted file mode 100644 index 79f1193..0000000 --- a/0015-python-improve-format-strings-for-proper-localizatio.patch +++ /dev/null @@ -1,455 +0,0 @@ -From d55f376b3cdff4e4159db32039175f9a5ea105db Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 16 May 2023 15:45:05 +0200 -Subject: [PATCH] python: improve format strings for proper localization -Content-type: text/plain - -If a string contains more than one unnamed argument it's hard for -translators to proper localize as they don't know which value is -represented by a unnamed argument. It also blocks them to use a -different order of arguments which would make better sense in other -languages. - -Fixes: - - $ xgettext --default-domain=python -L Python --keyword=_ --keyword=N_ ../audit2allow/audit2allow ../chcat/chcat ../semanage/semanage ../semanage/seobject.py ../sepolgen/src/sepolgen/interfaces.py ../sepolicy/sepolicy/generate.py ../sepolicy/sepolicy/gui.py ../sepolicy/sepolicy/__init__.py ../sepolicy/sepolicy/interface.py ../sepolicy/sepolicy.py - ../chcat/chcat:220: warning: 'msgid' format string with unnamed arguments cannot be properly localized: - The translator cannot reorder the arguments. - Please consider using a format string with named arguments, - and a mapping instead of a tuple for the arguments. - ../semanage/seobject.py:1178: warning: 'msgid' format string with unnamed arguments cannot be properly localized: - The translator cannot reorder the arguments. - Please consider using a format string with named arguments, - and a mapping instead of a tuple for the arguments. - ... - -Signed-off-by: Petr Lautrbach ---- - python/chcat/chcat | 6 +- - python/semanage/seobject.py | 130 ++++++++++++++++++------------------ - 2 files changed, 68 insertions(+), 68 deletions(-) - -diff --git a/python/chcat/chcat b/python/chcat/chcat -index 68718ec5f102..c4f592291821 100755 ---- a/python/chcat/chcat -+++ b/python/chcat/chcat -@@ -125,7 +125,7 @@ def chcat_add(orig, newcat, objects, login_ind): - - if len(clist) > 1: - if cat in clist[1:]: -- print(_("%s is already in %s") % (f, orig)) -+ print(_("{target} is already in {category}").format(target=f, category=orig)) - continue - clist.append(cat) - cats = clist[1:] -@@ -207,7 +207,7 @@ def chcat_remove(orig, newcat, objects, login_ind): - - if len(clist) > 1: - if cat not in clist[1:]: -- print(_("%s is not in %s") % (f, orig)) -+ print(_("{target} is not in {category}").format(target=f, category=orig)) - continue - clist.remove(cat) - if len(clist) > 1: -@@ -217,7 +217,7 @@ def chcat_remove(orig, newcat, objects, login_ind): - else: - cat = "" - else: -- print(_("%s is not in %s") % (f, orig)) -+ print(_("{target} is not in {category}").format(target=f, category=orig)) - continue - - if len(cat) == 0: -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index d82da4942987..2b1eb44ce8a3 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -843,7 +843,7 @@ class seluserRecords(semanageRecords): - for r in roles: - rc = semanage_user_add_role(self.sh, u, r) - if rc < 0: -- raise ValueError(_("Could not add role %s for %s") % (r, name)) -+ raise ValueError(_("Could not add role {role} for {name}").format(role=r, name=name)) - - if is_mls_enabled == 1: - rc = semanage_user_set_mlsrange(self.sh, u, serange) -@@ -855,7 +855,7 @@ class seluserRecords(semanageRecords): - raise ValueError(_("Could not set MLS level for %s") % name) - rc = semanage_user_set_prefix(self.sh, u, prefix) - if rc < 0: -- raise ValueError(_("Could not add prefix %s for %s") % (r, prefix)) -+ raise ValueError(_("Could not add prefix {prefix} for {role}").format(role=r, prefix=prefix)) - (rc, key) = semanage_user_key_extract(self.sh, u) - if rc < 0: - raise ValueError(_("Could not extract key for %s") % name) -@@ -1088,7 +1088,7 @@ class portRecords(semanageRecords): - - (rc, k) = semanage_port_key_create(self.sh, low, high, proto_d) - if rc < 0: -- raise ValueError(_("Could not create a key for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not create a key for {proto}/{port}").format(proto=proto, port=port)) - return (k, proto_d, low, high) - - def __add(self, port, proto, serange, type): -@@ -1110,44 +1110,44 @@ class portRecords(semanageRecords): - - (rc, exists) = semanage_port_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) -+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) - if exists: -- raise ValueError(_("Port %s/%s already defined") % (proto, port)) -+ raise ValueError(_("Port {proto}/{port} already defined").format(proto=proto, port=port)) - - (rc, p) = semanage_port_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create port for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not create port for {proto}/{port}").format(proto=proto, port=port)) - - semanage_port_set_proto(p, proto_d) - semanage_port_set_range(p, low, high) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not create context for {proto}/{port}").format(proto=proto, port=port)) - - rc = semanage_context_set_user(self.sh, con, "system_u") - if rc < 0: -- raise ValueError(_("Could not set user in port context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not set user in port context for {proto}/{port}").format(proto=proto, port=port)) - - rc = semanage_context_set_role(self.sh, con, "object_r") - if rc < 0: -- raise ValueError(_("Could not set role in port context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not set role in port context for {proto}/{port}").format(proto=proto, port=port)) - - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: -- raise ValueError(_("Could not set type in port context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not set type in port context for {proto}/{port}").format(proto=proto, port=port)) - - if (is_mls_enabled == 1) and (serange != ""): - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: -- raise ValueError(_("Could not set mls fields in port context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not set mls fields in port context for {proto}/{port}").format(proto=proto, port=port)) - - rc = semanage_port_set_con(self.sh, p, con) - if rc < 0: -- raise ValueError(_("Could not set port context for %s/%s") % (proto, port)) -+ raise ValueError(_("Could not set port context for {proto}/{port}").format(proto=proto, port=port)) - - rc = semanage_port_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not add port %s/%s") % (proto, port)) -+ raise ValueError(_("Could not add port {proto}/{port}").format(proto=proto, port=port)) - - semanage_context_free(con) - semanage_port_key_free(k) -@@ -1175,13 +1175,13 @@ class portRecords(semanageRecords): - - (rc, exists) = semanage_port_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) -+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) - if not exists: -- raise ValueError(_("Port %s/%s is not defined") % (proto, port)) -+ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port)) - - (rc, p) = semanage_port_query(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not query port %s/%s") % (proto, port)) -+ raise ValueError(_("Could not query port {proto}/{port}").format(proto=proto, port=port)) - - con = semanage_port_get_con(p) - -@@ -1195,7 +1195,7 @@ class portRecords(semanageRecords): - - rc = semanage_port_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not modify port %s/%s") % (proto, port)) -+ raise ValueError(_("Could not modify port {proto}/{port}").format(proto=proto, port=port)) - - semanage_port_key_free(k) - semanage_port_free(p) -@@ -1241,19 +1241,19 @@ class portRecords(semanageRecords): - (k, proto_d, low, high) = self.__genkey(port, proto) - (rc, exists) = semanage_port_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) -+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) - if not exists: -- raise ValueError(_("Port %s/%s is not defined") % (proto, port)) -+ raise ValueError(_("Port {proto}/{port} is not defined").format(proto=proto, port=port)) - - (rc, exists) = semanage_port_exists_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port)) -+ raise ValueError(_("Could not check if port {proto}/{port} is defined").format(proto=proto, port=port)) - if not exists: -- raise ValueError(_("Port %s/%s is defined in policy, cannot be deleted") % (proto, port)) -+ raise ValueError(_("Port {proto}/{port} is defined in policy, cannot be deleted").format(proto=proto, port=port)) - - rc = semanage_port_del_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not delete port %s/%s") % (proto, port)) -+ raise ValueError(_("Could not delete port {proto}/{port}").format(proto=proto, port=port)) - - semanage_port_key_free(k) - -@@ -1362,7 +1362,7 @@ class ibpkeyRecords(semanageRecords): - - (rc, k) = semanage_ibpkey_key_create(self.sh, subnet_prefix, low, high) - if rc < 0: -- raise ValueError(_("Could not create a key for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not create a key for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - return (k, subnet_prefix, low, high) - - def __add(self, pkey, subnet_prefix, serange, type): -@@ -1384,44 +1384,44 @@ class ibpkeyRecords(semanageRecords): - - (rc, exists) = semanage_ibpkey_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").formnat(subnet_prefix=subnet_prefix, pkey=pkey)) - if exists: -- raise ValueError(_("ibpkey %s/%s already defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} already defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - (rc, p) = semanage_ibpkey_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create ibpkey for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not create ibpkey for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - semanage_ibpkey_set_subnet_prefix(self.sh, p, subnet_prefix) - semanage_ibpkey_set_range(p, low, high) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not create context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_context_set_user(self.sh, con, "system_u") - if rc < 0: -- raise ValueError(_("Could not set user in ibpkey context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not set user in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_context_set_role(self.sh, con, "object_r") - if rc < 0: -- raise ValueError(_("Could not set role in ibpkey context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not set role in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: -- raise ValueError(_("Could not set type in ibpkey context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not set type in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - if (is_mls_enabled == 1) and (serange != ""): - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: -- raise ValueError(_("Could not set mls fields in ibpkey context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not set mls fields in ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_ibpkey_set_con(self.sh, p, con) - if rc < 0: -- raise ValueError(_("Could not set ibpkey context for %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not set ibpkey context for {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_ibpkey_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not add ibpkey %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not add ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - semanage_context_free(con) - semanage_ibpkey_key_free(k) -@@ -1448,13 +1448,13 @@ class ibpkeyRecords(semanageRecords): - - (rc, exists) = semanage_ibpkey_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - if not exists: -- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - (rc, p) = semanage_ibpkey_query(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not query ibpkey %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not query ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - con = semanage_ibpkey_get_con(p) - -@@ -1465,7 +1465,7 @@ class ibpkeyRecords(semanageRecords): - - rc = semanage_ibpkey_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not modify ibpkey %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not modify ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - semanage_ibpkey_key_free(k) - semanage_ibpkey_free(p) -@@ -1502,19 +1502,19 @@ class ibpkeyRecords(semanageRecords): - (k, subnet_prefix, low, high) = self.__genkey(pkey, subnet_prefix) - (rc, exists) = semanage_ibpkey_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - if not exists: -- raise ValueError(_("ibpkey %s/%s is not defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is not defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - (rc, exists) = semanage_ibpkey_exists_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibpkey %s/%s is defined") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not check if ibpkey {subnet_prefix}/{pkey} is defined").format(subnet_prefix=subnet_prefix, pkey=pkey)) - if not exists: -- raise ValueError(_("ibpkey %s/%s is defined in policy, cannot be deleted") % (subnet_prefix, pkey)) -+ raise ValueError(_("ibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deleted").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - rc = semanage_ibpkey_del_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not delete ibpkey %s/%s") % (subnet_prefix, pkey)) -+ raise ValueError(_("Could not delete ibpkey {subnet_prefix}/{pkey}").format(subnet_prefix=subnet_prefix, pkey=pkey)) - - semanage_ibpkey_key_free(k) - -@@ -1617,7 +1617,7 @@ class ibendportRecords(semanageRecords): - - (rc, k) = semanage_ibendport_key_create(self.sh, ibdev_name, port) - if rc < 0: -- raise ValueError(_("Could not create a key for ibendport %s/%s") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not create a key for ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) - return (k, ibdev_name, port) - - def __add(self, ibendport, ibdev_name, serange, type): -@@ -1638,44 +1638,44 @@ class ibendportRecords(semanageRecords): - - (rc, exists) = semanage_ibendport_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, port)) -+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{port} is defined").format(ibdev_name=ibdev_name, port=port)) - if exists: -- raise ValueError(_("ibendport %s/%s already defined") % (ibdev_name, port)) -+ raise ValueError(_("ibendport {ibdev_name}/{port} already defined").format(ibdev_name=ibdev_name, port=port)) - - (rc, p) = semanage_ibendport_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create ibendport for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not create ibendport for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - semanage_ibendport_set_ibdev_name(self.sh, p, ibdev_name) - semanage_ibendport_set_port(p, port) - (rc, con) = semanage_context_create(self.sh) - if rc < 0: -- raise ValueError(_("Could not create context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not create context for {ibendport}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_context_set_user(self.sh, con, "system_u") - if rc < 0: -- raise ValueError(_("Could not set user in ibendport context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not set user in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_context_set_role(self.sh, con, "object_r") - if rc < 0: -- raise ValueError(_("Could not set role in ibendport context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not set role in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_context_set_type(self.sh, con, type) - if rc < 0: -- raise ValueError(_("Could not set type in ibendport context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not set type in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - if (is_mls_enabled == 1) and (serange != ""): - rc = semanage_context_set_mls(self.sh, con, serange) - if rc < 0: -- raise ValueError(_("Could not set mls fields in ibendport context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not set mls fields in ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_ibendport_set_con(self.sh, p, con) - if rc < 0: -- raise ValueError(_("Could not set ibendport context for %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not set ibendport context for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_ibendport_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not add ibendport %s/%s") % (ibdev_name, port)) -+ raise ValueError(_("Could not add ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - semanage_context_free(con) - semanage_ibendport_key_free(k) -@@ -1702,13 +1702,13 @@ class ibendportRecords(semanageRecords): - - (rc, exists) = semanage_ibendport_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) - if not exists: -- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport)) -+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - (rc, p) = semanage_ibendport_query(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not query ibendport %s/%s") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not query ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - con = semanage_ibendport_get_con(p) - -@@ -1719,7 +1719,7 @@ class ibendportRecords(semanageRecords): - - rc = semanage_ibendport_modify_local(self.sh, k, p) - if rc < 0: -- raise ValueError(_("Could not modify ibendport %s/%s") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not modify ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - semanage_ibendport_key_free(k) - semanage_ibendport_free(p) -@@ -1741,11 +1741,11 @@ class ibendportRecords(semanageRecords): - port = semanage_ibendport_get_port(ibendport) - (k, ibdev_name, port) = self.__genkey(str(port), ibdev_name) - if rc < 0: -- raise ValueError(_("Could not create a key for %s/%d") % (ibdevname, port)) -+ raise ValueError(_("Could not create a key for {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - - rc = semanage_ibendport_del_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not delete the ibendport %s/%d") % (ibdev_name, port)) -+ raise ValueError(_("Could not delete the ibendport {ibdev_name}/{port}").format(ibdev_name=ibdev_name, port=port)) - semanage_ibendport_key_free(k) - - self.commit() -@@ -1754,19 +1754,19 @@ class ibendportRecords(semanageRecords): - (k, ibdev_name, port) = self.__genkey(ibendport, ibdev_name) - (rc, exists) = semanage_ibendport_exists(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) - if not exists: -- raise ValueError(_("ibendport %s/%s is not defined") % (ibdev_name, ibendport)) -+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is not defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - (rc, exists) = semanage_ibendport_exists_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not check if ibendport %s/%s is defined") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not check if ibendport {ibdev_name}/{ibendport} is defined").format(ibdev_name=ibdev_name, ibendport=ibendport)) - if not exists: -- raise ValueError(_("ibendport %s/%s is defined in policy, cannot be deleted") % (ibdev_name, ibendport)) -+ raise ValueError(_("ibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deleted").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - rc = semanage_ibendport_del_local(self.sh, k) - if rc < 0: -- raise ValueError(_("Could not delete ibendport %s/%s") % (ibdev_name, ibendport)) -+ raise ValueError(_("Could not delete ibendport {ibdev_name}/{ibendport}").format(ibdev_name=ibdev_name, ibendport=ibendport)) - - semanage_ibendport_key_free(k) - -@@ -2765,7 +2765,7 @@ class booleanRecords(semanageRecords): - try: - boolname, val = b.split("=") - except ValueError: -- raise ValueError(_("Bad format %s: Record %s" % (name, b))) -+ raise ValueError(_("Bad format {filename}: Record {record}").format(filename=name, record=b)) - self.__mod(boolname.strip(), val.strip()) - fd.close() - else: --- -2.41.0 - diff --git a/0016-python-Drop-hard-formating-from-localized-strings.patch b/0016-python-Drop-hard-formating-from-localized-strings.patch deleted file mode 100644 index 612a03b..0000000 --- a/0016-python-Drop-hard-formating-from-localized-strings.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 9de7df951d5c54de2a58e728a2089a0837f0c72e Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 17 May 2023 12:18:54 +0200 -Subject: [PATCH] python: Drop hard formating from localized strings -Content-type: text/plain - -It confuses translators and new lines are dropped by parser module anyway. - -Signed-off-by: Petr Lautrbach ---- - python/audit2allow/audit2allow | 14 ++++++-- - python/semanage/semanage | 60 +++++++++++++--------------------- - 2 files changed, 34 insertions(+), 40 deletions(-) - -diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow -index 5587a2dbb006..35b0b151ac86 100644 ---- a/python/audit2allow/audit2allow -+++ b/python/audit2allow/audit2allow -@@ -234,9 +234,17 @@ class AuditToPolicy: - print(e) - sys.exit(1) - -- sys.stdout.write(_("******************** IMPORTANT ***********************\n")) -- sys.stdout.write((_("To make this policy package active, execute:" + -- "\n\nsemodule -i %s\n\n") % packagename)) -+ sys.stdout.write( -+"""******************** {important} *********************** -+{text} -+ -+semodule -i {packagename} -+ -+""".format( -+ important=_("IMPORTANT"), -+ text=_("To make this policy package active, execute:"), -+ packagename=packagename -+)) - - def __output_audit2why(self): - import selinux -diff --git a/python/semanage/semanage b/python/semanage/semanage -index e0bd98a95c77..4fdb490f7df4 100644 ---- a/python/semanage/semanage -+++ b/python/semanage/semanage -@@ -238,30 +238,22 @@ def parser_add_level(parser, name): - - - def parser_add_range(parser, name): -- parser.add_argument('-r', '--range', default='', -- help=_(''' --MLS/MCS Security Range (MLS/MCS Systems only) --SELinux Range for SELinux login mapping --defaults to the SELinux user record range. --SELinux Range for SELinux user defaults to s0. --''')) -+ parser.add_argument('-r', '--range', default='', help=_( -+ "MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux login mapping defaults to the SELinux user record range. \ -+SELinux Range for SELinux user defaults to s0." -+ )) - - - def parser_add_proto(parser, name): -- parser.add_argument('-p', '--proto', help=_(''' -- Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol -- version for the specified node (ipv4|ipv6). --''')) -+ parser.add_argument('-p', '--proto', help=_( -+ "Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol version for the specified node (ipv4|ipv6)." -+ )) - - def parser_add_subnet_prefix(parser, name): -- parser.add_argument('-x', '--subnet_prefix', help=_(''' -- Subnet prefix for the specified infiniband ibpkey. --''')) -+ parser.add_argument('-x', '--subnet_prefix', help=_('Subnet prefix for the specified infiniband ibpkey.')) - - def parser_add_ibdev_name(parser, name): -- parser.add_argument('-z', '--ibdev_name', help=_(''' -- Name for the specified infiniband end port. --''')) -+ parser.add_argument('-z', '--ibdev_name', help=_("Name for the specified infiniband end port.")) - - def parser_add_modify(parser, name): - parser.add_argument('-m', '--modify', dest='action', action='store_const', const='modify', help=_("Modify a record of the %s object type") % name) -@@ -348,15 +340,6 @@ def handleFcontext(args): - - - def setupFcontextParser(subparsers): -- ftype_help = ''' --File Type. This is used with fcontext. Requires a file type --as shown in the mode field by ls, e.g. use d to match only --directories or f to match only regular files. The following --file type options can be passed: --f (regular file),d (directory),c (character device), --b (block device),s (socket),l (symbolic link),p (named pipe) --If you do not specify a file type, the file type will default to "all files". --''' - generate_usage = generate_custom_usage(usage_fcontext, usage_fcontext_dict) - fcontextParser = subparsers.add_parser('fcontext', usage=generate_usage, help=_("Manage file context mapping definitions")) - parser_add_locallist(fcontextParser, "fcontext") -@@ -372,11 +355,16 @@ If you do not specify a file type, the file type will default to "all files". - parser_add_extract(fcontext_action, "fcontext") - parser_add_deleteall(fcontext_action, "fcontext") - -- fcontextParser.add_argument('-e', '--equal', help=_('''Substitute target path with sourcepath when generating default -- label. This is used with fcontext. Requires source and target -- path arguments. The context labeling for the target subtree is -- made equivalent to that defined for the source.''')) -- fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_(ftype_help)) -+ fcontextParser.add_argument('-e', '--equal', help=_( -+ 'Substitute target path with sourcepath when generating default label. This is used with fcontext. Requires source and target \ -+path arguments. The context labeling for the target subtree is made equivalent to that defined for the source.' -+ )) -+ fcontextParser.add_argument('-f', '--ftype', default="", choices=["a", "f", "d", "c", "b", "s", "l", "p"], help=_( -+ 'File Type. This is used with fcontext. Requires a file type as shown in the mode field by ls, e.g. use d to match only \ -+directories or f to match only regular files. The following file type options can be passed: f (regular file), d (directory), \ -+c (character device), b (block device), s (socket), l (symbolic link), p (named pipe). \ -+If you do not specify a file type, the file type will default to "all files".' -+ )) - parser_add_seuser(fcontextParser, "fcontext") - parser_add_type(fcontextParser, "fcontext") - parser_add_range(fcontextParser, "fcontext") -@@ -426,9 +414,7 @@ def setupUserParser(subparsers): - parser_add_range(userParser, "user") - userParser.add_argument('-R', '--roles', default=[], - action=CheckRole, -- help=_(''' --SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times. --''')) -+ help=_("SELinux Roles. You must enclose multiple roles within quotes, separate by spaces. Or specify -R multiple times.")) - userParser.add_argument('-P', '--prefix', default="user", help=argparse.SUPPRESS) - userParser.add_argument('selinux_name', nargs='?', default=None, help=_('selinux_name')) - userParser.set_defaults(func=handleUser) -@@ -901,9 +887,9 @@ def setupImportParser(subparsers): - def createCommandParser(): - commandParser = seParser(prog='semanage', - formatter_class=argparse.ArgumentDefaultsHelpFormatter, -- description='''semanage is used to configure certain elements -- of SELinux policy with-out requiring modification -- to or recompilation from policy source.''') -+ description=_( -+ "semanage is used to configure certain elements of SELinux policy with-out requiring modification or recompilation from policy source." -+ )) - - #To add a new subcommand define the parser for it in a function above and call it here. - subparsers = commandParser.add_subparsers(dest='subcommand') --- -2.41.0 - diff --git a/0017-semanage-Drop-unnecessary-import-from-seobject.patch b/0017-semanage-Drop-unnecessary-import-from-seobject.patch deleted file mode 100644 index 03fb543..0000000 --- a/0017-semanage-Drop-unnecessary-import-from-seobject.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 74b849c9405f1b751e696c7fb2e419fcbd491fab Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 17 May 2023 13:09:58 +0200 -Subject: [PATCH] semanage: Drop unnecessary import from seobject -Content-type: text/plain - -sepolgen.module is not used for permissive domains - -Signed-off-by: Petr Lautrbach ---- - python/semanage/seobject.py | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index 2b1eb44ce8a3..361205d11c10 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -504,11 +504,6 @@ class permissiveRecords(semanageRecords): - print(t) - - def add(self, type): -- try: -- import sepolgen.module as module -- except ImportError: -- raise ValueError(_("The sepolgen python module is required to setup permissive domains.\nIn some distributions it is included in the policycoreutils-devel package.\n# yum install policycoreutils-devel\nOr similar for your distro.")) -- - name = "permissive_%s" % type - modtxt = "(typepermissive %s)" % type - --- -2.41.0 - diff --git a/0018-python-update-python.pot.patch b/0018-python-update-python.pot.patch deleted file mode 100644 index e928a89..0000000 --- a/0018-python-update-python.pot.patch +++ /dev/null @@ -1,2009 +0,0 @@ -From 7f00d6b53f73ee501fa4c6e48f85e641841efcc1 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 17 May 2023 13:52:22 +0200 -Subject: [PATCH] python: update python.pot -Content-type: text/plain - -Signed-off-by: Petr Lautrbach ---- - python/po/python.pot | 963 ++++++++++++++++++++++--------------------- - 1 file changed, 487 insertions(+), 476 deletions(-) - -diff --git a/python/po/python.pot b/python/po/python.pot -index 16d04eb0f18e..435a1b764e34 100644 ---- a/python/po/python.pot -+++ b/python/po/python.pot -@@ -8,7 +8,7 @@ msgid "" - msgstr "" - "Project-Id-Version: PACKAGE VERSION\n" - "Report-Msgid-Bugs-To: \n" --"POT-Creation-Date: 2023-01-18 11:57+0100\n" -+"POT-Creation-Date: 2023-06-12 18:13+0200\n" - "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" - "Last-Translator: FULL NAME \n" - "Language-Team: LANGUAGE \n" -@@ -17,17 +17,12 @@ msgstr "" - "Content-Type: text/plain; charset=UTF-8\n" - "Content-Transfer-Encoding: 8bit\n" - --#: ../audit2allow/audit2allow:239 --msgid "******************** IMPORTANT ***********************\n" -+#: ../audit2allow/audit2allow:244 -+msgid "IMPORTANT" - msgstr "" - --#: ../audit2allow/audit2allow:240 --#, python-format --msgid "" --"To make this policy package active, execute:\n" --"\n" --"semodule -i %s\n" --"\n" -+#: ../audit2allow/audit2allow:245 -+msgid "To make this policy package active, execute:" - msgstr "" - - #: ../chcat/chcat:111 ../chcat/chcat:191 -@@ -40,13 +35,13 @@ msgid "Can not modify sensitivity levels using '+' on %s" - msgstr "" - - #: ../chcat/chcat:128 --#, python-format --msgid "%s is already in %s" -+#, python-brace-format -+msgid "{target} is already in {category}" - msgstr "" - - #: ../chcat/chcat:210 ../chcat/chcat:220 --#, python-format --msgid "%s is not in %s" -+#, python-brace-format -+msgid "{target} is not in {category}" - msgstr "" - - #: ../chcat/chcat:291 ../chcat/chcat:296 -@@ -152,218 +147,222 @@ msgstr "" - - #: ../semanage/semanage:242 - msgid "" --"\n" --"MLS/MCS Security Range (MLS/MCS Systems only)\n" --"SELinux Range for SELinux login mapping\n" --"defaults to the SELinux user record range.\n" --"SELinux Range for SELinux user defaults to s0.\n" -+"MLS/MCS Security Range (MLS/MCS Systems only) SELinux Range for SELinux " -+"login mapping defaults to the SELinux user record range. SELinux Range for " -+"SELinux user defaults to s0." - msgstr "" - --#: ../semanage/semanage:251 -+#: ../semanage/semanage:249 - msgid "" --"\n" --" Protocol for the specified port (tcp|udp|dccp|sctp) or internet " --"protocol\n" --" version for the specified node (ipv4|ipv6).\n" -+"Protocol for the specified port (tcp|udp|dccp|sctp) or internet protocol " -+"version for the specified node (ipv4|ipv6)." - msgstr "" - --#: ../semanage/semanage:257 --msgid "" --"\n" --" Subnet prefix for the specified infiniband ibpkey.\n" -+#: ../semanage/semanage:253 -+msgid "Subnet prefix for the specified infiniband ibpkey." - msgstr "" - --#: ../semanage/semanage:262 --msgid "" --"\n" --" Name for the specified infiniband end port.\n" -+#: ../semanage/semanage:256 -+msgid "Name for the specified infiniband end port." - msgstr "" - --#: ../semanage/semanage:267 -+#: ../semanage/semanage:259 - #, python-format - msgid "Modify a record of the %s object type" - msgstr "" - --#: ../semanage/semanage:271 -+#: ../semanage/semanage:263 - #, python-format - msgid "List records of the %s object type" - msgstr "" - --#: ../semanage/semanage:275 -+#: ../semanage/semanage:267 - #, python-format - msgid "Delete a record of the %s object type" - msgstr "" - --#: ../semanage/semanage:279 -+#: ../semanage/semanage:271 - msgid "Extract customizable commands, for use within a transaction" - msgstr "" - --#: ../semanage/semanage:283 -+#: ../semanage/semanage:275 - #, python-format - msgid "Remove all %s objects local customizations" - msgstr "" - --#: ../semanage/semanage:287 -+#: ../semanage/semanage:279 - msgid "SELinux user name" - msgstr "" - --#: ../semanage/semanage:292 -+#: ../semanage/semanage:284 - msgid "Manage login mappings between linux users and SELinux confined users" - msgstr "" - --#: ../semanage/semanage:309 -+#: ../semanage/semanage:301 - #, python-format - msgid "login_name | %%groupname" - msgstr "" - --#: ../semanage/semanage:361 -+#: ../semanage/semanage:344 - msgid "Manage file context mapping definitions" - msgstr "" - --#: ../semanage/semanage:375 -+#: ../semanage/semanage:359 -+msgid "" -+"Substitute target path with sourcepath when generating default label. This " -+"is used with fcontext. Requires source and target path arguments. The " -+"context labeling for the target subtree is made equivalent to that defined " -+"for the source." -+msgstr "" -+ -+#: ../semanage/semanage:363 - msgid "" --"Substitute target path with sourcepath when generating default\n" --" label. " --"This is used with fcontext. Requires source and target\n" --" path " --"arguments. The context labeling for the target subtree is\n" --" made " --"equivalent to that defined for the source." -+"File Type. This is used with fcontext. Requires a file type as shown in the " -+"mode field by ls, e.g. use d to match only directories or f to match only " -+"regular files. The following file type options can be passed: f (regular " -+"file), d (directory), c (character device), b (block device), s (socket), l " -+"(symbolic link), p (named pipe). If you do not specify a file type, the file " -+"type will default to \"all files\"." - msgstr "" - --#: ../semanage/semanage:383 -+#: ../semanage/semanage:371 - msgid "" - "Path to be labeled (may be in the form of a Perl compatible regular " - "expression)" - msgstr "" - --#: ../semanage/semanage:411 -+#: ../semanage/semanage:399 - msgid "Manage SELinux confined users (Roles and levels for an SELinux user)" - msgstr "" - --#: ../semanage/semanage:429 -+#: ../semanage/semanage:417 - msgid "" --"\n" --"SELinux Roles. You must enclose multiple roles within quotes, separate by " --"spaces. Or specify -R multiple times.\n" -+"SELinux Roles. You must enclose multiple roles within quotes, separate by " -+"spaces. Or specify -R multiple times." - msgstr "" - --#: ../semanage/semanage:433 -+#: ../semanage/semanage:419 - msgid "selinux_name" - msgstr "" - --#: ../semanage/semanage:461 -+#: ../semanage/semanage:447 - msgid "Manage network port type definitions" - msgstr "" - --#: ../semanage/semanage:477 -+#: ../semanage/semanage:463 - msgid "port | port_range" - msgstr "" - --#: ../semanage/semanage:506 -+#: ../semanage/semanage:492 - msgid "Manage infiniband ibpkey type definitions" - msgstr "" - --#: ../semanage/semanage:522 -+#: ../semanage/semanage:508 - msgid "pkey | pkey_range" - msgstr "" - --#: ../semanage/semanage:549 -+#: ../semanage/semanage:535 - msgid "Manage infiniband end port type definitions" - msgstr "" - --#: ../semanage/semanage:565 -+#: ../semanage/semanage:551 - msgid "ibendport" - msgstr "" - --#: ../semanage/semanage:592 -+#: ../semanage/semanage:578 - msgid "Manage network interface type definitions" - msgstr "" - --#: ../semanage/semanage:607 -+#: ../semanage/semanage:593 - msgid "interface_spec" - msgstr "" - --#: ../semanage/semanage:631 -+#: ../semanage/semanage:617 - msgid "Manage SELinux policy modules" - msgstr "" - --#: ../semanage/semanage:642 -+#: ../semanage/semanage:628 - msgid "Add a module" - msgstr "" - --#: ../semanage/semanage:643 -+#: ../semanage/semanage:629 - msgid "Remove a module" - msgstr "" - --#: ../semanage/semanage:644 -+#: ../semanage/semanage:630 - msgid "Disable a module" - msgstr "" - --#: ../semanage/semanage:645 -+#: ../semanage/semanage:631 - msgid "Enable a module" - msgstr "" - --#: ../semanage/semanage:672 -+#: ../semanage/semanage:658 - msgid "Manage network node type definitions" - msgstr "" - --#: ../semanage/semanage:686 -+#: ../semanage/semanage:672 - msgid "Network Mask" - msgstr "" - --#: ../semanage/semanage:690 -+#: ../semanage/semanage:676 - msgid "node" - msgstr "" - --#: ../semanage/semanage:715 -+#: ../semanage/semanage:701 - msgid "Manage booleans to selectively enable functionality" - msgstr "" - --#: ../semanage/semanage:720 -+#: ../semanage/semanage:706 - msgid "boolean" - msgstr "" - --#: ../semanage/semanage:730 -+#: ../semanage/semanage:716 - msgid "Enable the boolean" - msgstr "" - --#: ../semanage/semanage:731 -+#: ../semanage/semanage:717 - msgid "Disable the boolean" - msgstr "" - --#: ../semanage/semanage:752 -+#: ../semanage/semanage:738 - msgid "semanage permissive: error: the following argument is required: type\n" - msgstr "" - --#: ../semanage/semanage:756 -+#: ../semanage/semanage:742 - msgid "Manage process type enforcement mode" - msgstr "" - --#: ../semanage/semanage:768 ../semanage/seobject.py:2677 -+#: ../semanage/semanage:754 ../semanage/seobject.py:2672 - msgid "type" - msgstr "" - --#: ../semanage/semanage:779 -+#: ../semanage/semanage:765 - msgid "Disable/Enable dontaudit rules in policy" - msgstr "" - --#: ../semanage/semanage:799 -+#: ../semanage/semanage:785 - msgid "Output local customizations" - msgstr "" - --#: ../semanage/semanage:801 -+#: ../semanage/semanage:787 - msgid "Output file" - msgstr "" - --#: ../semanage/semanage:894 -+#: ../semanage/semanage:880 - msgid "Import local customizations" - msgstr "" - --#: ../semanage/semanage:897 -+#: ../semanage/semanage:883 - msgid "Input file" - msgstr "" - -+#: ../semanage/semanage:891 -+msgid "" -+"semanage is used to configure certain elements of SELinux policy with-out " -+"requiring modification or recompilation from policy source." -+msgstr "" -+ - #: ../semanage/seobject.py:279 - msgid "Could not create semanage handle" - msgstr "" -@@ -485,123 +484,115 @@ msgstr "" - msgid "Customized Permissive Types" - msgstr "" - --#: ../semanage/seobject.py:510 --msgid "" --"The sepolgen python module is required to setup permissive domains.\n" --"In some distributions it is included in the policycoreutils-devel package.\n" --"# yum install policycoreutils-devel\n" --"Or similar for your distro." --msgstr "" -- --#: ../semanage/seobject.py:520 -+#: ../semanage/seobject.py:515 - #, python-format - msgid "Could not set permissive domain %s (module installation failed)" - msgstr "" - --#: ../semanage/seobject.py:526 -+#: ../semanage/seobject.py:521 - #, python-format - msgid "Could not remove permissive domain %s (remove failed)" - msgstr "" - --#: ../semanage/seobject.py:563 ../semanage/seobject.py:633 --#: ../semanage/seobject.py:678 ../semanage/seobject.py:797 --#: ../semanage/seobject.py:827 ../semanage/seobject.py:892 --#: ../semanage/seobject.py:948 ../semanage/seobject.py:1226 --#: ../semanage/seobject.py:1492 ../semanage/seobject.py:2502 --#: ../semanage/seobject.py:2575 ../semanage/seobject.py:2599 --#: ../semanage/seobject.py:2730 ../semanage/seobject.py:2781 -+#: ../semanage/seobject.py:558 ../semanage/seobject.py:628 -+#: ../semanage/seobject.py:673 ../semanage/seobject.py:792 -+#: ../semanage/seobject.py:822 ../semanage/seobject.py:887 -+#: ../semanage/seobject.py:943 ../semanage/seobject.py:1221 -+#: ../semanage/seobject.py:1487 ../semanage/seobject.py:2497 -+#: ../semanage/seobject.py:2570 ../semanage/seobject.py:2594 -+#: ../semanage/seobject.py:2725 ../semanage/seobject.py:2776 - #, python-format - msgid "Could not create a key for %s" - msgstr "" - --#: ../semanage/seobject.py:567 ../semanage/seobject.py:637 --#: ../semanage/seobject.py:682 ../semanage/seobject.py:688 -+#: ../semanage/seobject.py:562 ../semanage/seobject.py:632 -+#: ../semanage/seobject.py:677 ../semanage/seobject.py:683 - #, python-format - msgid "Could not check if login mapping for %s is defined" - msgstr "" - --#: ../semanage/seobject.py:569 -+#: ../semanage/seobject.py:564 - #, python-format - msgid "Login mapping for %s is already defined" - msgstr "" - --#: ../semanage/seobject.py:574 -+#: ../semanage/seobject.py:569 - #, python-format - msgid "Linux Group %s does not exist" - msgstr "" - --#: ../semanage/seobject.py:579 -+#: ../semanage/seobject.py:574 - #, python-format - msgid "Linux User %s does not exist" - msgstr "" - --#: ../semanage/seobject.py:583 -+#: ../semanage/seobject.py:578 - #, python-format - msgid "Could not create login mapping for %s" - msgstr "" - --#: ../semanage/seobject.py:587 ../semanage/seobject.py:841 -+#: ../semanage/seobject.py:582 ../semanage/seobject.py:836 - #, python-format - msgid "Could not set name for %s" - msgstr "" - --#: ../semanage/seobject.py:592 ../semanage/seobject.py:851 -+#: ../semanage/seobject.py:587 ../semanage/seobject.py:846 - #, python-format - msgid "Could not set MLS range for %s" - msgstr "" - --#: ../semanage/seobject.py:596 -+#: ../semanage/seobject.py:591 - #, python-format - msgid "Could not set SELinux user for %s" - msgstr "" - --#: ../semanage/seobject.py:600 -+#: ../semanage/seobject.py:595 - #, python-format - msgid "Could not add login mapping for %s" - msgstr "" - --#: ../semanage/seobject.py:616 -+#: ../semanage/seobject.py:611 - msgid "Requires seuser or serange" - msgstr "" - --#: ../semanage/seobject.py:639 ../semanage/seobject.py:684 -+#: ../semanage/seobject.py:634 ../semanage/seobject.py:679 - #, python-format - msgid "Login mapping for %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:643 -+#: ../semanage/seobject.py:638 - #, python-format - msgid "Could not query seuser for %s" - msgstr "" - --#: ../semanage/seobject.py:658 -+#: ../semanage/seobject.py:653 - #, python-format - msgid "Could not modify login mapping for %s" - msgstr "" - --#: ../semanage/seobject.py:690 -+#: ../semanage/seobject.py:685 - #, python-format - msgid "Login mapping for %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:694 -+#: ../semanage/seobject.py:689 - #, python-format - msgid "Could not delete login mapping for %s" - msgstr "" - --#: ../semanage/seobject.py:713 ../semanage/seobject.py:745 --#: ../semanage/seobject.py:991 -+#: ../semanage/seobject.py:708 ../semanage/seobject.py:740 -+#: ../semanage/seobject.py:986 - msgid "Could not list login mappings" - msgstr "" - --#: ../semanage/seobject.py:772 ../semanage/seobject.py:784 -+#: ../semanage/seobject.py:767 ../semanage/seobject.py:779 - #: ../sepolicy/sepolicy/sepolicy.glade:1156 - #: ../sepolicy/sepolicy/sepolicy.glade:3138 - msgid "Login Name" - msgstr "" - --#: ../semanage/seobject.py:772 ../semanage/seobject.py:784 --#: ../semanage/seobject.py:1041 ../semanage/seobject.py:1046 -+#: ../semanage/seobject.py:767 ../semanage/seobject.py:779 -+#: ../semanage/seobject.py:1036 ../semanage/seobject.py:1041 - #: ../sepolicy/sepolicy/sepolicy.glade:1182 - #: ../sepolicy/sepolicy/sepolicy.glade:3156 - #: ../sepolicy/sepolicy/sepolicy.glade:3242 -@@ -609,938 +600,958 @@ msgstr "" - msgid "SELinux User" - msgstr "" - --#: ../semanage/seobject.py:772 -+#: ../semanage/seobject.py:767 - msgid "MLS/MCS Range" - msgstr "" - --#: ../semanage/seobject.py:772 -+#: ../semanage/seobject.py:767 - msgid "Service" - msgstr "" - --#: ../semanage/seobject.py:800 ../semanage/seobject.py:831 --#: ../semanage/seobject.py:896 ../semanage/seobject.py:952 --#: ../semanage/seobject.py:958 -+#: ../semanage/seobject.py:795 ../semanage/seobject.py:826 -+#: ../semanage/seobject.py:891 ../semanage/seobject.py:947 -+#: ../semanage/seobject.py:953 - #, python-format - msgid "Could not check if SELinux user %s is defined" - msgstr "" - --#: ../semanage/seobject.py:803 ../semanage/seobject.py:902 --#: ../semanage/seobject.py:964 -+#: ../semanage/seobject.py:798 ../semanage/seobject.py:897 -+#: ../semanage/seobject.py:959 - #, python-format - msgid "Could not query user for %s" - msgstr "" - --#: ../semanage/seobject.py:823 -+#: ../semanage/seobject.py:818 - #, python-format - msgid "You must add at least one role for %s" - msgstr "" - --#: ../semanage/seobject.py:833 -+#: ../semanage/seobject.py:828 - #, python-format - msgid "SELinux user %s is already defined" - msgstr "" - --#: ../semanage/seobject.py:837 -+#: ../semanage/seobject.py:832 - #, python-format - msgid "Could not create SELinux user for %s" - msgstr "" - --#: ../semanage/seobject.py:846 --#, python-format --msgid "Could not add role %s for %s" -+#: ../semanage/seobject.py:841 -+#, python-brace-format -+msgid "Could not add role {role} for {name}" - msgstr "" - --#: ../semanage/seobject.py:855 -+#: ../semanage/seobject.py:850 - #, python-format - msgid "Could not set MLS level for %s" - msgstr "" - --#: ../semanage/seobject.py:858 --#, python-format --msgid "Could not add prefix %s for %s" -+#: ../semanage/seobject.py:853 -+#, python-brace-format -+msgid "Could not add prefix {prefix} for {role}" - msgstr "" - --#: ../semanage/seobject.py:861 -+#: ../semanage/seobject.py:856 - #, python-format - msgid "Could not extract key for %s" - msgstr "" - --#: ../semanage/seobject.py:865 -+#: ../semanage/seobject.py:860 - #, python-format - msgid "Could not add SELinux user %s" - msgstr "" - --#: ../semanage/seobject.py:886 -+#: ../semanage/seobject.py:881 - msgid "Requires prefix, roles, level or range" - msgstr "" - --#: ../semanage/seobject.py:888 -+#: ../semanage/seobject.py:883 - msgid "Requires prefix or roles" - msgstr "" - --#: ../semanage/seobject.py:898 ../semanage/seobject.py:954 -+#: ../semanage/seobject.py:893 ../semanage/seobject.py:949 - #, python-format - msgid "SELinux user %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:927 -+#: ../semanage/seobject.py:922 - #, python-format - msgid "Could not modify SELinux user %s" - msgstr "" - --#: ../semanage/seobject.py:960 -+#: ../semanage/seobject.py:955 - #, python-format - msgid "SELinux user %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:971 -+#: ../semanage/seobject.py:966 - #, python-format - msgid "Could not delete SELinux user %s" - msgstr "" - --#: ../semanage/seobject.py:1009 -+#: ../semanage/seobject.py:1004 - msgid "Could not list SELinux users" - msgstr "" - --#: ../semanage/seobject.py:1015 -+#: ../semanage/seobject.py:1010 - #, python-format - msgid "Could not list roles for user %s" - msgstr "" - --#: ../semanage/seobject.py:1040 -+#: ../semanage/seobject.py:1035 - msgid "Labeling" - msgstr "" - --#: ../semanage/seobject.py:1040 -+#: ../semanage/seobject.py:1035 - msgid "MLS/" - msgstr "" - --#: ../semanage/seobject.py:1041 -+#: ../semanage/seobject.py:1036 - msgid "Prefix" - msgstr "" - --#: ../semanage/seobject.py:1041 -+#: ../semanage/seobject.py:1036 - msgid "MCS Level" - msgstr "" - --#: ../semanage/seobject.py:1041 -+#: ../semanage/seobject.py:1036 - msgid "MCS Range" - msgstr "" - --#: ../semanage/seobject.py:1041 ../semanage/seobject.py:1046 -+#: ../semanage/seobject.py:1036 ../semanage/seobject.py:1041 - #: ../sepolicy/sepolicy/sepolicy.glade:3262 - #: ../sepolicy/sepolicy/sepolicy.glade:5233 - #: ../sepolicy/sepolicy/sepolicy.glade:5382 - msgid "SELinux Roles" - msgstr "" - --#: ../semanage/seobject.py:1071 -+#: ../semanage/seobject.py:1066 - msgid "Protocol has to be one of udp, tcp, dccp or sctp" - msgstr "" - --#: ../semanage/seobject.py:1073 -+#: ../semanage/seobject.py:1068 - msgid "Port is required" - msgstr "" - --#: ../semanage/seobject.py:1087 -+#: ../semanage/seobject.py:1082 - msgid "Invalid Port" - msgstr "" - --#: ../semanage/seobject.py:1091 ../semanage/seobject.py:1365 --#, python-format --msgid "Could not create a key for %s/%s" -+#: ../semanage/seobject.py:1086 -+#, python-brace-format -+msgid "Could not create a key for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1102 ../semanage/seobject.py:1376 --#: ../semanage/seobject.py:1631 -+#: ../semanage/seobject.py:1097 ../semanage/seobject.py:1371 -+#: ../semanage/seobject.py:1626 - msgid "Type is required" - msgstr "" - --#: ../semanage/seobject.py:1107 ../semanage/seobject.py:1172 -+#: ../semanage/seobject.py:1102 ../semanage/seobject.py:1167 - #, python-format - msgid "Type %s is invalid, must be a port type" - msgstr "" - --#: ../semanage/seobject.py:1113 ../semanage/seobject.py:1178 --#: ../semanage/seobject.py:1244 ../semanage/seobject.py:1250 --#, python-format --msgid "Could not check if port %s/%s is defined" -+#: ../semanage/seobject.py:1108 ../semanage/seobject.py:1173 -+#: ../semanage/seobject.py:1239 ../semanage/seobject.py:1245 -+#, python-brace-format -+msgid "Could not check if port {proto}/{port} is defined" - msgstr "" - --#: ../semanage/seobject.py:1115 --#, python-format --msgid "Port %s/%s already defined" -+#: ../semanage/seobject.py:1110 -+#, python-brace-format -+msgid "Port {proto}/{port} already defined" - msgstr "" - --#: ../semanage/seobject.py:1119 --#, python-format --msgid "Could not create port for %s/%s" -+#: ../semanage/seobject.py:1114 -+#, python-brace-format -+msgid "Could not create port for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1125 ../semanage/seobject.py:1399 --#: ../semanage/seobject.py:1653 --#, python-format --msgid "Could not create context for %s/%s" -+#: ../semanage/seobject.py:1120 -+#, python-brace-format -+msgid "Could not create context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1129 --#, python-format --msgid "Could not set user in port context for %s/%s" -+#: ../semanage/seobject.py:1124 -+#, python-brace-format -+msgid "Could not set user in port context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1133 --#, python-format --msgid "Could not set role in port context for %s/%s" -+#: ../semanage/seobject.py:1128 -+#, python-brace-format -+msgid "Could not set role in port context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1137 --#, python-format --msgid "Could not set type in port context for %s/%s" -+#: ../semanage/seobject.py:1132 -+#, python-brace-format -+msgid "Could not set type in port context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1142 --#, python-format --msgid "Could not set mls fields in port context for %s/%s" -+#: ../semanage/seobject.py:1137 -+#, python-brace-format -+msgid "Could not set mls fields in port context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1146 --#, python-format --msgid "Could not set port context for %s/%s" -+#: ../semanage/seobject.py:1141 -+#, python-brace-format -+msgid "Could not set port context for {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1150 --#, python-format --msgid "Could not add port %s/%s" -+#: ../semanage/seobject.py:1145 -+#, python-brace-format -+msgid "Could not add port {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1166 ../semanage/seobject.py:1438 --#: ../semanage/seobject.py:1692 ../semanage/seobject.py:1970 --#: ../semanage/seobject.py:2176 -+#: ../semanage/seobject.py:1161 ../semanage/seobject.py:1433 -+#: ../semanage/seobject.py:1687 ../semanage/seobject.py:1965 -+#: ../semanage/seobject.py:2171 - msgid "Requires setype or serange" - msgstr "" - --#: ../semanage/seobject.py:1168 ../semanage/seobject.py:1440 --#: ../semanage/seobject.py:1694 -+#: ../semanage/seobject.py:1163 ../semanage/seobject.py:1435 -+#: ../semanage/seobject.py:1689 - msgid "Requires setype" - msgstr "" - --#: ../semanage/seobject.py:1180 ../semanage/seobject.py:1246 --#, python-format --msgid "Port %s/%s is not defined" -+#: ../semanage/seobject.py:1175 ../semanage/seobject.py:1241 -+#, python-brace-format -+msgid "Port {proto}/{port} is not defined" - msgstr "" - --#: ../semanage/seobject.py:1184 --#, python-format --msgid "Could not query port %s/%s" -+#: ../semanage/seobject.py:1179 -+#, python-brace-format -+msgid "Could not query port {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1198 --#, python-format --msgid "Could not modify port %s/%s" -+#: ../semanage/seobject.py:1193 -+#, python-brace-format -+msgid "Could not modify port {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1213 -+#: ../semanage/seobject.py:1208 - msgid "Could not list the ports" - msgstr "" - --#: ../semanage/seobject.py:1230 -+#: ../semanage/seobject.py:1225 - #, python-format - msgid "Could not delete the port %s" - msgstr "" - --#: ../semanage/seobject.py:1252 --#, python-format --msgid "Port %s/%s is defined in policy, cannot be deleted" -+#: ../semanage/seobject.py:1247 -+#, python-brace-format -+msgid "Port {proto}/{port} is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:1256 --#, python-format --msgid "Could not delete port %s/%s" -+#: ../semanage/seobject.py:1251 -+#, python-brace-format -+msgid "Could not delete port {proto}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1274 ../semanage/seobject.py:1294 -+#: ../semanage/seobject.py:1269 ../semanage/seobject.py:1289 - msgid "Could not list ports" - msgstr "" - --#: ../semanage/seobject.py:1329 ../sepolicy/sepolicy/sepolicy.glade:2668 -+#: ../semanage/seobject.py:1324 ../sepolicy/sepolicy/sepolicy.glade:2668 - #: ../sepolicy/sepolicy/sepolicy.glade:2766 - #: ../sepolicy/sepolicy/sepolicy.glade:4630 - msgid "SELinux Port Type" - msgstr "" - --#: ../semanage/seobject.py:1329 -+#: ../semanage/seobject.py:1324 - msgid "Proto" - msgstr "" - --#: ../semanage/seobject.py:1329 ../semanage/seobject.py:1835 -+#: ../semanage/seobject.py:1324 ../semanage/seobject.py:1830 - #: ../sepolicy/sepolicy/sepolicy.glade:1407 - msgid "Port Number" - msgstr "" - --#: ../semanage/seobject.py:1351 -+#: ../semanage/seobject.py:1346 - msgid "Subnet Prefix is required" - msgstr "" - --#: ../semanage/seobject.py:1361 -+#: ../semanage/seobject.py:1356 - msgid "Invalid Pkey" - msgstr "" - --#: ../semanage/seobject.py:1381 ../semanage/seobject.py:1445 -+#: ../semanage/seobject.py:1360 -+#, python-brace-format -+msgid "Could not create a key for {subnet_prefix}/{pkey}" -+msgstr "" -+ -+#: ../semanage/seobject.py:1376 ../semanage/seobject.py:1440 - #, python-format - msgid "Type %s is invalid, must be a ibpkey type" - msgstr "" - --#: ../semanage/seobject.py:1387 ../semanage/seobject.py:1451 --#: ../semanage/seobject.py:1505 ../semanage/seobject.py:1511 --#, python-format --msgid "Could not check if ibpkey %s/%s is defined" -+#: ../semanage/seobject.py:1382 ../semanage/seobject.py:1446 -+#: ../semanage/seobject.py:1500 ../semanage/seobject.py:1506 -+#, python-brace-format -+msgid "Could not check if ibpkey {subnet_prefix}/{pkey} is defined" - msgstr "" - --#: ../semanage/seobject.py:1389 --#, python-format --msgid "ibpkey %s/%s already defined" -+#: ../semanage/seobject.py:1384 -+#, python-brace-format -+msgid "ibpkey {subnet_prefix}/{pkey} already defined" - msgstr "" - --#: ../semanage/seobject.py:1393 --#, python-format --msgid "Could not create ibpkey for %s/%s" -+#: ../semanage/seobject.py:1388 -+#, python-brace-format -+msgid "Could not create ibpkey for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1403 --#, python-format --msgid "Could not set user in ibpkey context for %s/%s" -+#: ../semanage/seobject.py:1394 -+#, python-brace-format -+msgid "Could not create context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1407 --#, python-format --msgid "Could not set role in ibpkey context for %s/%s" -+#: ../semanage/seobject.py:1398 -+#, python-brace-format -+msgid "Could not set user in ibpkey context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1411 --#, python-format --msgid "Could not set type in ibpkey context for %s/%s" -+#: ../semanage/seobject.py:1402 -+#, python-brace-format -+msgid "Could not set role in ibpkey context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1416 --#, python-format --msgid "Could not set mls fields in ibpkey context for %s/%s" -+#: ../semanage/seobject.py:1406 -+#, python-brace-format -+msgid "Could not set type in ibpkey context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1420 --#, python-format --msgid "Could not set ibpkey context for %s/%s" -+#: ../semanage/seobject.py:1411 -+#, python-brace-format -+msgid "Could not set mls fields in ibpkey context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1424 --#, python-format --msgid "Could not add ibpkey %s/%s" -+#: ../semanage/seobject.py:1415 -+#, python-brace-format -+msgid "Could not set ibpkey context for {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1453 ../semanage/seobject.py:1507 --#, python-format --msgid "ibpkey %s/%s is not defined" -+#: ../semanage/seobject.py:1419 -+#, python-brace-format -+msgid "Could not add ibpkey {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1457 --#, python-format --msgid "Could not query ibpkey %s/%s" -+#: ../semanage/seobject.py:1448 ../semanage/seobject.py:1502 -+#, python-brace-format -+msgid "ibpkey {subnet_prefix}/{pkey} is not defined" - msgstr "" - --#: ../semanage/seobject.py:1468 --#, python-format --msgid "Could not modify ibpkey %s/%s" -+#: ../semanage/seobject.py:1452 -+#, python-brace-format -+msgid "Could not query ibpkey {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1481 -+#: ../semanage/seobject.py:1463 -+#, python-brace-format -+msgid "Could not modify ibpkey {subnet_prefix}/{pkey}" -+msgstr "" -+ -+#: ../semanage/seobject.py:1476 - msgid "Could not list the ibpkeys" - msgstr "" - --#: ../semanage/seobject.py:1496 -+#: ../semanage/seobject.py:1491 - #, python-format - msgid "Could not delete the ibpkey %s" - msgstr "" - --#: ../semanage/seobject.py:1513 --#, python-format --msgid "ibpkey %s/%s is defined in policy, cannot be deleted" -+#: ../semanage/seobject.py:1508 -+#, python-brace-format -+msgid "ibpkey {subnet_prefix}/{pkey} is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:1517 --#, python-format --msgid "Could not delete ibpkey %s/%s" -+#: ../semanage/seobject.py:1512 -+#, python-brace-format -+msgid "Could not delete ibpkey {subnet_prefix}/{pkey}" - msgstr "" - --#: ../semanage/seobject.py:1533 ../semanage/seobject.py:1554 -+#: ../semanage/seobject.py:1528 ../semanage/seobject.py:1549 - msgid "Could not list ibpkeys" - msgstr "" - --#: ../semanage/seobject.py:1589 -+#: ../semanage/seobject.py:1584 - msgid "SELinux IB Pkey Type" - msgstr "" - --#: ../semanage/seobject.py:1589 -+#: ../semanage/seobject.py:1584 - msgid "Subnet_Prefix" - msgstr "" - --#: ../semanage/seobject.py:1589 -+#: ../semanage/seobject.py:1584 - msgid "Pkey Number" - msgstr "" - --#: ../semanage/seobject.py:1611 -+#: ../semanage/seobject.py:1606 - msgid "IB device name is required" - msgstr "" - --#: ../semanage/seobject.py:1616 -+#: ../semanage/seobject.py:1611 - msgid "Invalid Port Number" - msgstr "" - --#: ../semanage/seobject.py:1620 --#, python-format --msgid "Could not create a key for ibendport %s/%s" -+#: ../semanage/seobject.py:1615 -+#, python-brace-format -+msgid "Could not create a key for ibendport {ibdev_name}/{ibendport}" - msgstr "" - --#: ../semanage/seobject.py:1636 ../semanage/seobject.py:1699 -+#: ../semanage/seobject.py:1631 ../semanage/seobject.py:1694 - #, python-format - msgid "Type %s is invalid, must be an ibendport type" - msgstr "" - --#: ../semanage/seobject.py:1641 ../semanage/seobject.py:1705 --#: ../semanage/seobject.py:1757 ../semanage/seobject.py:1763 --#, python-format --msgid "Could not check if ibendport %s/%s is defined" -+#: ../semanage/seobject.py:1636 -+#, python-brace-format -+msgid "Could not check if ibendport {ibdev_name}/{port} is defined" - msgstr "" - --#: ../semanage/seobject.py:1643 --#, python-format --msgid "ibendport %s/%s already defined" -+#: ../semanage/seobject.py:1638 -+#, python-brace-format -+msgid "ibendport {ibdev_name}/{port} already defined" - msgstr "" - --#: ../semanage/seobject.py:1647 --#, python-format --msgid "Could not create ibendport for %s/%s" -+#: ../semanage/seobject.py:1642 -+#, python-brace-format -+msgid "Could not create ibendport for {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1657 --#, python-format --msgid "Could not set user in ibendport context for %s/%s" -+#: ../semanage/seobject.py:1648 -+#, python-brace-format -+msgid "Could not create context for {ibendport}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1661 --#, python-format --msgid "Could not set role in ibendport context for %s/%s" -+#: ../semanage/seobject.py:1652 -+#, python-brace-format -+msgid "Could not set user in ibendport context for {ibdev_name}/{port}" -+msgstr "" -+ -+#: ../semanage/seobject.py:1656 -+#, python-brace-format -+msgid "Could not set role in ibendport context for {ibdev_name}/{port}" -+msgstr "" -+ -+#: ../semanage/seobject.py:1660 -+#, python-brace-format -+msgid "Could not set type in ibendport context for {ibdev_name}/{port}" - msgstr "" - - #: ../semanage/seobject.py:1665 --#, python-format --msgid "Could not set type in ibendport context for %s/%s" -+#, python-brace-format -+msgid "Could not set mls fields in ibendport context for {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1670 --#, python-format --msgid "Could not set mls fields in ibendport context for %s/%s" -+#: ../semanage/seobject.py:1669 -+#, python-brace-format -+msgid "Could not set ibendport context for {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1674 --#, python-format --msgid "Could not set ibendport context for %s/%s" -+#: ../semanage/seobject.py:1673 -+#, python-brace-format -+msgid "Could not add ibendport {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1678 --#, python-format --msgid "Could not add ibendport %s/%s" -+#: ../semanage/seobject.py:1700 ../semanage/seobject.py:1752 -+#: ../semanage/seobject.py:1758 -+#, python-brace-format -+msgid "Could not check if ibendport {ibdev_name}/{ibendport} is defined" - msgstr "" - --#: ../semanage/seobject.py:1707 ../semanage/seobject.py:1759 --#, python-format --msgid "ibendport %s/%s is not defined" -+#: ../semanage/seobject.py:1702 ../semanage/seobject.py:1754 -+#, python-brace-format -+msgid "ibendport {ibdev_name}/{ibendport} is not defined" - msgstr "" - --#: ../semanage/seobject.py:1711 --#, python-format --msgid "Could not query ibendport %s/%s" -+#: ../semanage/seobject.py:1706 -+#, python-brace-format -+msgid "Could not query ibendport {ibdev_name}/{ibendport}" - msgstr "" - --#: ../semanage/seobject.py:1722 --#, python-format --msgid "Could not modify ibendport %s/%s" -+#: ../semanage/seobject.py:1717 -+#, python-brace-format -+msgid "Could not modify ibendport {ibdev_name}/{ibendport}" - msgstr "" - --#: ../semanage/seobject.py:1735 -+#: ../semanage/seobject.py:1730 - msgid "Could not list the ibendports" - msgstr "" - --#: ../semanage/seobject.py:1744 --#, python-format --msgid "Could not create a key for %s/%d" -+#: ../semanage/seobject.py:1739 -+#, python-brace-format -+msgid "Could not create a key for {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1748 --#, python-format --msgid "Could not delete the ibendport %s/%d" -+#: ../semanage/seobject.py:1743 -+#, python-brace-format -+msgid "Could not delete the ibendport {ibdev_name}/{port}" - msgstr "" - --#: ../semanage/seobject.py:1765 --#, python-format --msgid "ibendport %s/%s is defined in policy, cannot be deleted" -+#: ../semanage/seobject.py:1760 -+#, python-brace-format -+msgid "" -+"ibendport {ibdev_name}/{ibendport} is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:1769 --#, python-format --msgid "Could not delete ibendport %s/%s" -+#: ../semanage/seobject.py:1764 -+#, python-brace-format -+msgid "Could not delete ibendport {ibdev_name}/{ibendport}" - msgstr "" - --#: ../semanage/seobject.py:1785 ../semanage/seobject.py:1805 -+#: ../semanage/seobject.py:1780 ../semanage/seobject.py:1800 - msgid "Could not list ibendports" - msgstr "" - --#: ../semanage/seobject.py:1835 -+#: ../semanage/seobject.py:1830 - msgid "SELinux IB End Port Type" - msgstr "" - --#: ../semanage/seobject.py:1835 -+#: ../semanage/seobject.py:1830 - msgid "IB Device Name" - msgstr "" - --#: ../semanage/seobject.py:1861 -+#: ../semanage/seobject.py:1856 - msgid "Node Address is required" - msgstr "" - --#: ../semanage/seobject.py:1873 ../semanage/seobject.py:1885 -+#: ../semanage/seobject.py:1868 ../semanage/seobject.py:1880 - msgid "Unknown or missing protocol" - msgstr "" - --#: ../semanage/seobject.py:1899 -+#: ../semanage/seobject.py:1894 - msgid "SELinux node type is required" - msgstr "" - --#: ../semanage/seobject.py:1904 ../semanage/seobject.py:1975 -+#: ../semanage/seobject.py:1899 ../semanage/seobject.py:1970 - #, python-format - msgid "Type %s is invalid, must be a node type" - msgstr "" - --#: ../semanage/seobject.py:1908 ../semanage/seobject.py:1979 --#: ../semanage/seobject.py:2016 ../semanage/seobject.py:2117 --#: ../semanage/seobject.py:2180 ../semanage/seobject.py:2216 --#: ../semanage/seobject.py:2435 -+#: ../semanage/seobject.py:1903 ../semanage/seobject.py:1974 -+#: ../semanage/seobject.py:2011 ../semanage/seobject.py:2112 -+#: ../semanage/seobject.py:2175 ../semanage/seobject.py:2211 -+#: ../semanage/seobject.py:2430 - #, python-format - msgid "Could not create key for %s" - msgstr "" - --#: ../semanage/seobject.py:1912 ../semanage/seobject.py:1983 --#: ../semanage/seobject.py:2020 ../semanage/seobject.py:2026 -+#: ../semanage/seobject.py:1907 ../semanage/seobject.py:1978 -+#: ../semanage/seobject.py:2015 ../semanage/seobject.py:2021 - #, python-format - msgid "Could not check if addr %s is defined" - msgstr "" - --#: ../semanage/seobject.py:1914 -+#: ../semanage/seobject.py:1909 - #, python-format - msgid "Addr %s already defined" - msgstr "" - --#: ../semanage/seobject.py:1918 -+#: ../semanage/seobject.py:1913 - #, python-format - msgid "Could not create addr for %s" - msgstr "" - --#: ../semanage/seobject.py:1924 ../semanage/seobject.py:2132 --#: ../semanage/seobject.py:2389 -+#: ../semanage/seobject.py:1919 ../semanage/seobject.py:2127 -+#: ../semanage/seobject.py:2384 - #, python-format - msgid "Could not create context for %s" - msgstr "" - --#: ../semanage/seobject.py:1928 -+#: ../semanage/seobject.py:1923 - #, python-format - msgid "Could not set mask for %s" - msgstr "" - --#: ../semanage/seobject.py:1932 -+#: ../semanage/seobject.py:1927 - #, python-format - msgid "Could not set user in addr context for %s" - msgstr "" - --#: ../semanage/seobject.py:1936 -+#: ../semanage/seobject.py:1931 - #, python-format - msgid "Could not set role in addr context for %s" - msgstr "" - --#: ../semanage/seobject.py:1940 -+#: ../semanage/seobject.py:1935 - #, python-format - msgid "Could not set type in addr context for %s" - msgstr "" - --#: ../semanage/seobject.py:1945 -+#: ../semanage/seobject.py:1940 - #, python-format - msgid "Could not set mls fields in addr context for %s" - msgstr "" - --#: ../semanage/seobject.py:1949 -+#: ../semanage/seobject.py:1944 - #, python-format - msgid "Could not set addr context for %s" - msgstr "" - --#: ../semanage/seobject.py:1953 -+#: ../semanage/seobject.py:1948 - #, python-format - msgid "Could not add addr %s" - msgstr "" - --#: ../semanage/seobject.py:1985 ../semanage/seobject.py:2022 -+#: ../semanage/seobject.py:1980 ../semanage/seobject.py:2017 - #, python-format - msgid "Addr %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:1989 -+#: ../semanage/seobject.py:1984 - #, python-format - msgid "Could not query addr %s" - msgstr "" - --#: ../semanage/seobject.py:1999 -+#: ../semanage/seobject.py:1994 - #, python-format - msgid "Could not modify addr %s" - msgstr "" - --#: ../semanage/seobject.py:2028 -+#: ../semanage/seobject.py:2023 - #, python-format - msgid "Addr %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:2032 -+#: ../semanage/seobject.py:2027 - #, python-format - msgid "Could not delete addr %s" - msgstr "" - --#: ../semanage/seobject.py:2046 -+#: ../semanage/seobject.py:2041 - msgid "Could not deleteall node mappings" - msgstr "" - --#: ../semanage/seobject.py:2060 -+#: ../semanage/seobject.py:2055 - msgid "Could not list addrs" - msgstr "" - --#: ../semanage/seobject.py:2113 ../semanage/seobject.py:2426 -+#: ../semanage/seobject.py:2108 ../semanage/seobject.py:2421 - msgid "SELinux Type is required" - msgstr "" - --#: ../semanage/seobject.py:2121 ../semanage/seobject.py:2184 --#: ../semanage/seobject.py:2220 ../semanage/seobject.py:2226 -+#: ../semanage/seobject.py:2116 ../semanage/seobject.py:2179 -+#: ../semanage/seobject.py:2215 ../semanage/seobject.py:2221 - #, python-format - msgid "Could not check if interface %s is defined" - msgstr "" - --#: ../semanage/seobject.py:2123 -+#: ../semanage/seobject.py:2118 - #, python-format - msgid "Interface %s already defined" - msgstr "" - --#: ../semanage/seobject.py:2127 -+#: ../semanage/seobject.py:2122 - #, python-format - msgid "Could not create interface for %s" - msgstr "" - --#: ../semanage/seobject.py:2136 -+#: ../semanage/seobject.py:2131 - #, python-format - msgid "Could not set user in interface context for %s" - msgstr "" - --#: ../semanage/seobject.py:2140 -+#: ../semanage/seobject.py:2135 - #, python-format - msgid "Could not set role in interface context for %s" - msgstr "" - --#: ../semanage/seobject.py:2144 -+#: ../semanage/seobject.py:2139 - #, python-format - msgid "Could not set type in interface context for %s" - msgstr "" - --#: ../semanage/seobject.py:2149 -+#: ../semanage/seobject.py:2144 - #, python-format - msgid "Could not set mls fields in interface context for %s" - msgstr "" - --#: ../semanage/seobject.py:2153 -+#: ../semanage/seobject.py:2148 - #, python-format - msgid "Could not set interface context for %s" - msgstr "" - --#: ../semanage/seobject.py:2157 -+#: ../semanage/seobject.py:2152 - #, python-format - msgid "Could not set message context for %s" - msgstr "" - --#: ../semanage/seobject.py:2161 -+#: ../semanage/seobject.py:2156 - #, python-format - msgid "Could not add interface %s" - msgstr "" - --#: ../semanage/seobject.py:2186 ../semanage/seobject.py:2222 -+#: ../semanage/seobject.py:2181 ../semanage/seobject.py:2217 - #, python-format - msgid "Interface %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:2190 -+#: ../semanage/seobject.py:2185 - #, python-format - msgid "Could not query interface %s" - msgstr "" - --#: ../semanage/seobject.py:2201 -+#: ../semanage/seobject.py:2196 - #, python-format - msgid "Could not modify interface %s" - msgstr "" - --#: ../semanage/seobject.py:2228 -+#: ../semanage/seobject.py:2223 - #, python-format - msgid "Interface %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:2232 -+#: ../semanage/seobject.py:2227 - #, python-format - msgid "Could not delete interface %s" - msgstr "" - --#: ../semanage/seobject.py:2246 -+#: ../semanage/seobject.py:2241 - msgid "Could not delete all interface mappings" - msgstr "" - --#: ../semanage/seobject.py:2260 -+#: ../semanage/seobject.py:2255 - msgid "Could not list interfaces" - msgstr "" - --#: ../semanage/seobject.py:2285 -+#: ../semanage/seobject.py:2280 - msgid "SELinux Interface" - msgstr "" - --#: ../semanage/seobject.py:2285 ../semanage/seobject.py:2677 -+#: ../semanage/seobject.py:2280 ../semanage/seobject.py:2672 - msgid "Context" - msgstr "" - --#: ../semanage/seobject.py:2355 -+#: ../semanage/seobject.py:2350 - #, python-format - msgid "Target %s is not valid. Target is not allowed to end with '/'" - msgstr "" - --#: ../semanage/seobject.py:2358 -+#: ../semanage/seobject.py:2353 - #, python-format - msgid "Substitute %s is not valid. Substitute is not allowed to end with '/'" - msgstr "" - --#: ../semanage/seobject.py:2361 -+#: ../semanage/seobject.py:2356 - #, python-format - msgid "Equivalence class for %s already exists" - msgstr "" - --#: ../semanage/seobject.py:2367 -+#: ../semanage/seobject.py:2362 - #, python-format - msgid "File spec %s conflicts with equivalency rule '%s %s'" - msgstr "" - --#: ../semanage/seobject.py:2378 -+#: ../semanage/seobject.py:2373 - #, python-format - msgid "Equivalence class for %s does not exist" - msgstr "" - --#: ../semanage/seobject.py:2395 -+#: ../semanage/seobject.py:2390 - #, python-format - msgid "Could not set user in file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2399 -+#: ../semanage/seobject.py:2394 - #, python-format - msgid "Could not set role in file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2404 ../semanage/seobject.py:2464 -+#: ../semanage/seobject.py:2399 ../semanage/seobject.py:2459 - #, python-format - msgid "Could not set mls fields in file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2410 -+#: ../semanage/seobject.py:2405 - msgid "Invalid file specification" - msgstr "" - --#: ../semanage/seobject.py:2412 -+#: ../semanage/seobject.py:2407 - msgid "File specification can not include spaces" - msgstr "" - --#: ../semanage/seobject.py:2417 -+#: ../semanage/seobject.py:2412 - #, python-format - msgid "" - "File spec %s conflicts with equivalency rule '%s %s'; Try adding '%s' instead" - msgstr "" - --#: ../semanage/seobject.py:2431 ../semanage/seobject.py:2496 -+#: ../semanage/seobject.py:2426 ../semanage/seobject.py:2491 - #, python-format - msgid "Type %s is invalid, must be a file or device type" - msgstr "" - --#: ../semanage/seobject.py:2439 ../semanage/seobject.py:2444 --#: ../semanage/seobject.py:2506 ../semanage/seobject.py:2515 --#: ../semanage/seobject.py:2603 ../semanage/seobject.py:2607 -+#: ../semanage/seobject.py:2434 ../semanage/seobject.py:2439 -+#: ../semanage/seobject.py:2501 ../semanage/seobject.py:2510 -+#: ../semanage/seobject.py:2598 ../semanage/seobject.py:2602 - #, python-format - msgid "Could not check if file context for %s is defined" - msgstr "" - --#: ../semanage/seobject.py:2447 -+#: ../semanage/seobject.py:2442 - #, python-format - msgid "File context for %s already defined" - msgstr "" - --#: ../semanage/seobject.py:2451 -+#: ../semanage/seobject.py:2446 - #, python-format - msgid "Could not create file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2459 -+#: ../semanage/seobject.py:2454 - #, python-format - msgid "Could not set type in file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2467 ../semanage/seobject.py:2539 --#: ../semanage/seobject.py:2543 -+#: ../semanage/seobject.py:2462 ../semanage/seobject.py:2534 -+#: ../semanage/seobject.py:2538 - #, python-format - msgid "Could not set file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2473 -+#: ../semanage/seobject.py:2468 - #, python-format - msgid "Could not add file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2492 -+#: ../semanage/seobject.py:2487 - msgid "Requires setype, serange or seuser" - msgstr "" - --#: ../semanage/seobject.py:2511 ../semanage/seobject.py:2521 -+#: ../semanage/seobject.py:2506 ../semanage/seobject.py:2516 - #, python-format - msgid "Could not query file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2517 ../semanage/seobject.py:2611 -+#: ../semanage/seobject.py:2512 ../semanage/seobject.py:2606 - #, python-format - msgid "File context for %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:2547 -+#: ../semanage/seobject.py:2542 - #, python-format - msgid "Could not modify file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2565 -+#: ../semanage/seobject.py:2560 - msgid "Could not list the file contexts" - msgstr "" - --#: ../semanage/seobject.py:2579 -+#: ../semanage/seobject.py:2574 - #, python-format - msgid "Could not delete the file context %s" - msgstr "" - --#: ../semanage/seobject.py:2609 -+#: ../semanage/seobject.py:2604 - #, python-format - msgid "File context for %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:2615 -+#: ../semanage/seobject.py:2610 - #, python-format - msgid "Could not delete file context for %s" - msgstr "" - --#: ../semanage/seobject.py:2632 -+#: ../semanage/seobject.py:2627 - msgid "Could not list file contexts" - msgstr "" - --#: ../semanage/seobject.py:2636 -+#: ../semanage/seobject.py:2631 - msgid "Could not list file contexts for home directories" - msgstr "" - --#: ../semanage/seobject.py:2640 -+#: ../semanage/seobject.py:2635 - msgid "Could not list local file contexts" - msgstr "" - --#: ../semanage/seobject.py:2677 -+#: ../semanage/seobject.py:2672 - msgid "SELinux fcontext" - msgstr "" - --#: ../semanage/seobject.py:2690 -+#: ../semanage/seobject.py:2685 - msgid "" - "\n" - "SELinux Distribution fcontext Equivalence \n" - msgstr "" - --#: ../semanage/seobject.py:2695 -+#: ../semanage/seobject.py:2690 - msgid "" - "\n" - "SELinux Local fcontext Equivalence \n" - msgstr "" - --#: ../semanage/seobject.py:2733 ../semanage/seobject.py:2784 --#: ../semanage/seobject.py:2790 -+#: ../semanage/seobject.py:2728 ../semanage/seobject.py:2779 -+#: ../semanage/seobject.py:2785 - #, python-format - msgid "Could not check if boolean %s is defined" - msgstr "" - --#: ../semanage/seobject.py:2735 ../semanage/seobject.py:2786 -+#: ../semanage/seobject.py:2730 ../semanage/seobject.py:2781 - #, python-format - msgid "Boolean %s is not defined" - msgstr "" - --#: ../semanage/seobject.py:2739 -+#: ../semanage/seobject.py:2734 - #, python-format - msgid "Could not query file context %s" - msgstr "" - --#: ../semanage/seobject.py:2744 -+#: ../semanage/seobject.py:2739 - #, python-format - msgid "You must specify one of the following values: %s" - msgstr "" - --#: ../semanage/seobject.py:2749 -+#: ../semanage/seobject.py:2744 - #, python-format - msgid "Could not set active value of boolean %s" - msgstr "" - --#: ../semanage/seobject.py:2752 -+#: ../semanage/seobject.py:2747 - #, python-format - msgid "Could not modify boolean %s" - msgstr "" - --#: ../semanage/seobject.py:2768 --#, python-format --msgid "Bad format %s: Record %s" -+#: ../semanage/seobject.py:2763 -+#, python-brace-format -+msgid "Bad format {filename}: Record {record}" - msgstr "" - --#: ../semanage/seobject.py:2792 -+#: ../semanage/seobject.py:2787 - #, python-format - msgid "Boolean %s is defined in policy, cannot be deleted" - msgstr "" - --#: ../semanage/seobject.py:2796 -+#: ../semanage/seobject.py:2791 - #, python-format - msgid "Could not delete boolean %s" - msgstr "" - --#: ../semanage/seobject.py:2808 ../semanage/seobject.py:2825 -+#: ../semanage/seobject.py:2803 ../semanage/seobject.py:2820 - msgid "Could not list booleans" - msgstr "" - --#: ../semanage/seobject.py:2858 -+#: ../semanage/seobject.py:2853 - msgid "off" - msgstr "" - --#: ../semanage/seobject.py:2858 -+#: ../semanage/seobject.py:2853 - msgid "on" - msgstr "" - --#: ../semanage/seobject.py:2870 -+#: ../semanage/seobject.py:2865 - msgid "SELinux boolean" - msgstr "" - --#: ../semanage/seobject.py:2870 -+#: ../semanage/seobject.py:2865 - msgid "State" - msgstr "" - --#: ../semanage/seobject.py:2870 -+#: ../semanage/seobject.py:2865 - msgid "Default" - msgstr "" - --#: ../semanage/seobject.py:2870 ../sepolicy/sepolicy/sepolicy.glade:2140 -+#: ../semanage/seobject.py:2865 ../sepolicy/sepolicy/sepolicy.glade:2140 - #: ../sepolicy/sepolicy/sepolicy.glade:2510 - #: ../sepolicy/sepolicy/sepolicy.glade:5099 - msgid "Description" -@@ -1555,151 +1566,151 @@ msgstr "" - msgid "Missing interface definition for %s" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:140 -+#: ../sepolicy/sepolicy/generate.py:138 - msgid "Standard Init Daemon" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:141 -+#: ../sepolicy/sepolicy/generate.py:139 - msgid "DBUS System Daemon" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:142 -+#: ../sepolicy/sepolicy/generate.py:140 - msgid "Internet Services Daemon" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:143 -+#: ../sepolicy/sepolicy/generate.py:141 - msgid "Web Application/Script (CGI)" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:144 -+#: ../sepolicy/sepolicy/generate.py:142 - msgid "Sandbox" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:145 -+#: ../sepolicy/sepolicy/generate.py:143 - msgid "User Application" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:146 -+#: ../sepolicy/sepolicy/generate.py:144 - msgid "Existing Domain Type" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:147 -+#: ../sepolicy/sepolicy/generate.py:145 - msgid "Minimal Terminal Login User Role" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:148 -+#: ../sepolicy/sepolicy/generate.py:146 - msgid "Minimal X Windows Login User Role" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:149 -+#: ../sepolicy/sepolicy/generate.py:147 - msgid "Desktop Login User Role" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:150 -+#: ../sepolicy/sepolicy/generate.py:148 - msgid "Administrator Login User Role" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:151 -+#: ../sepolicy/sepolicy/generate.py:149 - msgid "Confined Root Administrator Role" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:152 -+#: ../sepolicy/sepolicy/generate.py:150 - msgid "Module information for a new type" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:158 -+#: ../sepolicy/sepolicy/generate.py:156 - msgid "Valid Types:\n" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:193 -+#: ../sepolicy/sepolicy/generate.py:191 - #, python-format - msgid "Ports must be numbers or ranges of numbers from 1 to %d " - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:205 -+#: ../sepolicy/sepolicy/generate.py:203 - msgid "You must enter a valid policy type" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:208 -+#: ../sepolicy/sepolicy/generate.py:206 - #, python-format - msgid "You must enter a name for your policy module for your '%s'." - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:346 -+#: ../sepolicy/sepolicy/generate.py:344 - msgid "" - "Name must be alphanumeric with no spaces. Consider using option \"-n " - "MODULENAME\"" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:438 -+#: ../sepolicy/sepolicy/generate.py:436 - msgid "User Role types can not be assigned executables." - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:444 -+#: ../sepolicy/sepolicy/generate.py:442 - msgid "Only Daemon apps can use an init script." - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:462 -+#: ../sepolicy/sepolicy/generate.py:460 - msgid "use_resolve must be a boolean value " - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:468 -+#: ../sepolicy/sepolicy/generate.py:466 - msgid "use_syslog must be a boolean value " - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:474 -+#: ../sepolicy/sepolicy/generate.py:472 - msgid "use_kerberos must be a boolean value " - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:480 -+#: ../sepolicy/sepolicy/generate.py:478 - msgid "manage_krb5_rcache must be a boolean value " - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:510 -+#: ../sepolicy/sepolicy/generate.py:508 - msgid "USER Types automatically get a tmp type" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:847 -+#: ../sepolicy/sepolicy/generate.py:845 - #, python-format - msgid "'%s' policy modules require existing domains" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:872 -+#: ../sepolicy/sepolicy/generate.py:870 - msgid "Type field required" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:885 -+#: ../sepolicy/sepolicy/generate.py:883 - #, python-format - msgid "" - "You need to define a new type which ends with: \n" - " %s" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1113 -+#: ../sepolicy/sepolicy/generate.py:1111 - msgid "You must enter the executable path for your confined process" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1378 -+#: ../sepolicy/sepolicy/generate.py:1376 - msgid "Created the following files:\n" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1379 -+#: ../sepolicy/sepolicy/generate.py:1377 - msgid "Type Enforcement file" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1380 -+#: ../sepolicy/sepolicy/generate.py:1378 - msgid "Interface file" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1381 -+#: ../sepolicy/sepolicy/generate.py:1379 - msgid "File Contexts file" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1383 -+#: ../sepolicy/sepolicy/generate.py:1381 - msgid "Spec file" - msgstr "" - --#: ../sepolicy/sepolicy/generate.py:1384 -+#: ../sepolicy/sepolicy/generate.py:1382 - msgid "Setup Script" - msgstr "" - -@@ -2367,29 +2378,29 @@ msgstr "" - msgid "named pipe" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:148 -+#: ../sepolicy/sepolicy/__init__.py:149 - msgid "No SELinux Policy installed" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:184 -+#: ../sepolicy/sepolicy/__init__.py:185 - #, python-format - msgid "Failed to read %s policy file" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:470 -+#: ../sepolicy/sepolicy/__init__.py:471 - #, python-format - msgid "-- Allowed %s [ %s ]" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:896 -+#: ../sepolicy/sepolicy/__init__.py:897 - msgid "You must regenerate interface info by running /usr/bin/sepolgen-ifgen" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:1221 -+#: ../sepolicy/sepolicy/__init__.py:1230 - msgid "unknown" - msgstr "" - --#: ../sepolicy/sepolicy/__init__.py:1230 -+#: ../sepolicy/sepolicy/__init__.py:1239 - #, python-brace-format - msgid "Allow {subject} to {rest}" - msgstr "" --- -2.41.0 - diff --git a/policycoreutils.spec b/policycoreutils.spec index e6eb739..4d576c2 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.5-1 -%global libsemanagever 3.5-1 -%global libselinuxver 3.5-1 +%global libsepolver 3.6-0 +%global libsemanagever 3.6-0 +%global libselinuxver 3.6-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,11 +10,11 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.5 -Release: 8%{?dist} +Version: 3.6 +Release: 0.rc1.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.5/selinux-3.5.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6-rc1/selinux-3.6-rc1.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -33,7 +33,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.5 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.6-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -41,20 +41,8 @@ Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch -Patch0006: 0006-python-chcat-Improve-man-pages.patch -Patch0007: 0007-python-audit2allow-Add-missing-options-to-man-page.patch -Patch0008: 0008-python-semanage-Improve-man-pages.patch -Patch0009: 0009-python-audit2allow-Remove-unused-debug-option.patch -Patch0010: 0010-policycoreutils-Add-examples-to-man-pages.patch -Patch0011: 0011-python-sepolicy-Improve-man-pages.patch -Patch0012: 0012-sandbox-Add-examples-to-man-pages.patch -Patch0013: 0013-python-sepolicy-Fix-template-for-confined-user-polic.patch -Patch0014: 0014-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0015: 0015-python-improve-format-strings-for-proper-localizatio.patch -Patch0016: 0016-python-Drop-hard-formating-from-localized-strings.patch -Patch0017: 0017-semanage-Drop-unnecessary-import-from-seobject.patch -Patch0018: 0018-python-update-python.pot.patch -Patch0019: 0019-sepolicy-port-to-dnf4-python-API.patch +Patch0006: 0006-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0007: 0007-sepolicy-port-to-dnf4-python-API.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -90,7 +78,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version} +%autosetup -p 1 -n selinux-%{version}-rc1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -100,18 +88,14 @@ tar -xvf %{SOURCE14} -C python/sepolicy/ # For more information see README.translations # First remove old translation files # rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po -# tar -x -f %{SOURCE20} -C policycoreutils -z -# tar -x -f %{SOURCE21} -C python -z -# tar -x -f %{SOURCE22} -C gui -z -# tar -x -f %{SOURCE23} -C sandbox -z -unzip %{SOURCE20} -cp -r selinux/policycoreutils/po policycoreutils -unzip %{SOURCE21} -cp -r selinux/python/po python -unzip %{SOURCE22} -cp -r selinux/gui/po gui -unzip %{SOURCE23} -cp -r selinux/sandbox/po sandbox +# unzip %{SOURCE20} +# cp -r selinux/policycoreutils/po policycoreutils +# unzip %{SOURCE21} +# cp -r selinux/python/po python +# unzip %{SOURCE22} +# cp -r selinux/gui/po gui +# unzip %{SOURCE23} +# cp -r selinux/sandbox/po sandbox %build %set_build_flags @@ -153,13 +137,9 @@ chmod 0755 %{buildroot}%{_bindir}/newrole # Systemd rm -rf %{buildroot}/%{_sysconfdir}/rc.d/init.d/restorecond -rm -f %{buildroot}/usr/share/man/ru/man8/genhomedircon.8.gz -rm -f %{buildroot}/usr/share/man/ru/man8/open_init_pty.8* -rm -f %{buildroot}/usr/share/man/ru/man8/semodule_deps.8.gz rm -f %{buildroot}/usr/share/man/man8/open_init_pty.8 rm -f %{buildroot}/usr/sbin/open_init_pty rm -f %{buildroot}/usr/sbin/run_init -rm -f %{buildroot}/usr/share/man/ru/man8/run_init.8* rm -f %{buildroot}/usr/share/man/man8/run_init.8* rm -f %{buildroot}/etc/pam.d/run_init* @@ -195,14 +175,10 @@ an SELinux environment. %{_bindir}/audit2allow %{_bindir}/audit2why %{_mandir}/man1/audit2allow.1* -%{_mandir}/ru/man1/audit2allow.1* %{_mandir}/man1/audit2why.1* -%{_mandir}/ru/man1/audit2why.1* %{_sysconfdir}/dbus-1/system.d/org.selinux.conf %{_mandir}/man8/chcat.8* -%{_mandir}/ru/man8/chcat.8* %{_mandir}/man8/semanage*.8* -%{_mandir}/ru/man8/semanage*.8* %{_datadir}/bash-completion/completions/semanage %package dbus @@ -282,7 +258,6 @@ The policycoreutils-devel package contains the management tools use to develop p /var/lib/sepolgen/perm_map %{_bindir}/sepolicy %{_mandir}/man8/sepolgen.8* -%{_mandir}/ru/man8/sepolgen.8* %{_mandir}/man8/sepolicy-booleans.8* %{_mandir}/man8/sepolicy-generate.8* %{_mandir}/man8/sepolicy-interface.8* @@ -291,7 +266,6 @@ The policycoreutils-devel package contains the management tools use to develop p %{_mandir}/man8/sepolicy-communicate.8* %{_mandir}/man8/sepolicy-manpage.8* %{_mandir}/man8/sepolicy-transition.8* -%{_mandir}/ru/man8/sepolicy*.8* %{_usr}/share/bash-completion/completions/sepolicy @@ -312,12 +286,9 @@ sandboxes %{_datadir}/sandbox/start %caps(cap_setpcap,cap_setuid,cap_fowner,cap_dac_override,cap_sys_admin,cap_sys_nice=pe) %{_sbindir}/seunshare %{_mandir}/man8/seunshare.8* -%{_mandir}/ru/man8/seunshare.8* %{_bindir}/sandbox %{_mandir}/man5/sandbox.5* -%{_mandir}/ru/man5/sandbox.5* %{_mandir}/man8/sandbox.8* -%{_mandir}/ru/man8/sandbox.8* %package newrole Summary: The newrole application for RBAC/MLS @@ -330,7 +301,6 @@ or level of a logged in user. %files newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole %{_mandir}/man1/newrole.1.gz -%{_mandir}/ru/man1/newrole.1.gz %config(noreplace) %{_sysconfdir}/pam.d/newrole %package gui @@ -365,11 +335,8 @@ system-config-selinux is a utility for managing the SELinux environment %{_datadir}/icons/hicolor/*/apps/sepolicy.png %{_datadir}/pixmaps/sepolicy.png %{_mandir}/man8/system-config-selinux.8* -%{_mandir}/ru/man8/system-config-selinux.8* %{_mandir}/man8/selinux-polgengui.8* -%{_mandir}/ru/man8/selinux-polgengui.8* %{_mandir}/man8/sepolicy-gui.8* -%{_mandir}/ru/man8/sepolicy-gui.8* %files -f %{name}.lang %{_sbindir}/restorecon @@ -396,37 +363,21 @@ system-config-selinux is a utility for managing the SELinux environment %{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf %{_mandir}/man5/selinux_config.5.gz -%{_mandir}/ru/man5/selinux_config.5.gz %{_mandir}/man5/sestatus.conf.5.gz -%{_mandir}/ru/man5/sestatus.conf.5.gz %{_mandir}/man8/fixfiles.8* -%{_mandir}/ru/man8/fixfiles.8* %{_mandir}/man8/load_policy.8* -%{_mandir}/ru/man8/load_policy.8* %{_mandir}/man8/restorecon.8* -%{_mandir}/ru/man8/restorecon.8* %{_mandir}/man8/restorecon_xattr.8* -%{_mandir}/ru/man8/restorecon_xattr.8* %{_mandir}/man8/semodule.8* -%{_mandir}/ru/man8/semodule.8* %{_mandir}/man8/sestatus.8* -%{_mandir}/ru/man8/sestatus.8* %{_mandir}/man8/setfiles.8* -%{_mandir}/ru/man8/setfiles.8* %{_mandir}/man8/setsebool.8* -%{_mandir}/ru/man8/setsebool.8* %{_mandir}/man1/secon.1* -%{_mandir}/ru/man1/secon.1* %{_mandir}/man8/genhomedircon.8* -%{_mandir}/ru/man8/genhomedircon.8* %{_mandir}/man8/semodule_expand.8* -%{_mandir}/ru/man8/semodule_expand.8* %{_mandir}/man8/semodule_link.8* -%{_mandir}/ru/man8/semodule_link.8* %{_mandir}/man8/semodule_unpackage.8* -%{_mandir}/ru/man8/semodule_unpackage.8* %{_mandir}/man8/semodule_package.8* -%{_mandir}/ru/man8/semodule_package.8* %dir %{_datadir}/bash-completion %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} @@ -449,7 +400,6 @@ The policycoreutils-restorecond package contains the restorecond service. %{_sysconfdir}/xdg/autostart/restorecond.desktop %{_datadir}/dbus-1/services/org.selinux.Restorecond.service %{_mandir}/man8/restorecond.8* -%{_mandir}/ru/man8/restorecond.8* %{!?_licensedir:%global license %%doc} %license policycoreutils/LICENSE @@ -470,6 +420,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue Nov 14 2023 Petr Lautrbach - 3.6-0.rc1.1 +- SELinux userspace 3.6-rc1 release + * Mon Oct 30 2023 Petr Lautrbach - 3.5-8 - Update translations https://translate.fedoraproject.org/projects/selinux/ diff --git a/sources b/sources index c428c60..92605d3 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (selinux-3.5.tar.gz) = a91b978d7a5f8adc6c4a4fb47ac92e49e73528905b8fe061ecff77d6ad6b316c4f8391e85dfcc7b422ed83076b9b84f592f567e76d862c569ab3a1079100a1fc +SHA512 (selinux-3.6-rc1.tar.gz) = b447b4f51055861730868dbe357cc740cef7ee97e10c59c1bc5840d3ea2141af0331d226d8fa9a4e06aea510a1854cfb5bc49a517b4ecd83ca527c1ab9bd1c6b SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 From e8ba46eae6a3bcdccb734fca7c2ab23549af3054 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Nov 2023 17:45:19 +0100 Subject: [PATCH 39/79] SELinux userspace 3.6-rc2 release --- .gitignore | 1 + policycoreutils.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index f4b9319..244b3fa 100644 --- a/.gitignore +++ b/.gitignore @@ -353,3 +353,4 @@ policycoreutils-2.0.83.tgz /selinux-sandbox.zip /selinux-gui.zip /selinux-3.6-rc1.tar.gz +/selinux-3.6-rc2.tar.gz diff --git a/policycoreutils.spec b/policycoreutils.spec index 4d576c2..49da384 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.6-0 -%global libsemanagever 3.6-0 -%global libselinuxver 3.6-0 +%global libsepolver 3.6-0.rc2 +%global libsemanagever 3.6-0.rc2 +%global libselinuxver 3.6-0.rc2 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 0.rc1.1%{?dist} +Release: 0.rc2.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6-rc1/selinux-3.6-rc1.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6-rc2/selinux-3.6-rc2.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -33,7 +33,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.6-rc1 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.6-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -78,7 +78,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version}-rc1 +%autosetup -p 1 -n selinux-%{version}-rc2 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -420,6 +420,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Nov 23 2023 Petr Lautrbach - 3.6-0.rc2.1 +- SELinux userspace 3.6-rc2 release + * Tue Nov 14 2023 Petr Lautrbach - 3.6-0.rc1.1 - SELinux userspace 3.6-rc1 release diff --git a/sources b/sources index 92605d3..c85d2c4 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (selinux-3.6-rc1.tar.gz) = b447b4f51055861730868dbe357cc740cef7ee97e10c59c1bc5840d3ea2141af0331d226d8fa9a4e06aea510a1854cfb5bc49a517b4ecd83ca527c1ab9bd1c6b +SHA512 (selinux-3.6-rc2.tar.gz) = b42d07af30a49e2d3e3f99c6400a57e4f830100870dc992f6a3f4b3ab16d3cd8a7f2c08f818045a2b8f358548551d31c75b14247a540e67da62bedaaee979ee0 SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 From 99b3f5a5d345a0e4ca977e2136bfdbcf809a7103 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 14 Dec 2023 17:52:44 +0100 Subject: [PATCH 40/79] SELinux userspace 3.6 release --- .gitignore | 1 + 0007-sepolicy-port-to-dnf4-python-API.patch | 84 --------------------- policycoreutils.spec | 18 +++-- sources | 2 +- 4 files changed, 12 insertions(+), 93 deletions(-) delete mode 100644 0007-sepolicy-port-to-dnf4-python-API.patch diff --git a/.gitignore b/.gitignore index 244b3fa..f168b35 100644 --- a/.gitignore +++ b/.gitignore @@ -354,3 +354,4 @@ policycoreutils-2.0.83.tgz /selinux-gui.zip /selinux-3.6-rc1.tar.gz /selinux-3.6-rc2.tar.gz +/selinux-3.6.tar.gz diff --git a/0007-sepolicy-port-to-dnf4-python-API.patch b/0007-sepolicy-port-to-dnf4-python-API.patch deleted file mode 100644 index 7410ccd..0000000 --- a/0007-sepolicy-port-to-dnf4-python-API.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 4417766f66fb5a1d41503c2d1f0008823ae11269 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Sat, 29 Jul 2023 20:33:06 +0200 -Subject: [PATCH] sepolicy: port to dnf4 python API -Content-type: text/plain - -yum module is not available since RHEL 7. - -Drop -systemd related code as it's obsoleted these days - only 2 -packages ship their .service in -systemd subpackage - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/generate.py | 38 ++++++++++++---------------- - 1 file changed, 16 insertions(+), 22 deletions(-) - -diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index 36a3ea1196b1..48602a736953 100644 ---- a/python/sepolicy/sepolicy/generate.py -+++ b/python/sepolicy/sepolicy/generate.py -@@ -1264,13 +1264,20 @@ allow %s_t %s_t:%s_socket name_%s; - return fcfile - - def __extract_rpms(self): -- import yum -- yb = yum.YumBase() -- yb.setCacheDir() -+ import dnf - -- for pkg in yb.rpmdb.searchProvides(self.program): -+ base = dnf.Base() -+ base.read_all_repos() -+ base.fill_sack(load_system_repo=True) -+ -+ query = base.sack.query() -+ -+ pq = query.available() -+ pq = pq.filter(file=self.program) -+ -+ for pkg in pq: - self.rpms.append(pkg.name) -- for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist: -+ for fname in pkg.files: - for b in self.DEFAULT_DIRS: - if b == "/etc": - continue -@@ -1279,9 +1286,10 @@ allow %s_t %s_t:%s_socket name_%s; - self.add_file(fname) - else: - self.add_dir(fname) -- -- for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]): -- for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist: -+ sq = query.available() -+ sq = sq.filter(provides=pkg.source_name) -+ for bpkg in sq: -+ for fname in bpkg.files: - for b in self.DEFAULT_DIRS: - if b == "/etc": - continue -@@ -1291,20 +1299,6 @@ allow %s_t %s_t:%s_socket name_%s; - else: - self.add_dir(fname) - -- # some packages have own systemd subpackage -- # tor-systemd for example -- binary_name = self.program.split("/")[-1] -- for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]): -- for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist: -- for b in self.DEFAULT_DIRS: -- if b == "/etc": -- continue -- if fname.startswith(b): -- if os.path.isfile(fname): -- self.add_file(fname) -- else: -- self.add_dir(fname) -- - def gen_writeable(self): - try: - self.__extract_rpms() --- -2.41.0 - diff --git a/policycoreutils.spec b/policycoreutils.spec index 49da384..d6c2e45 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.6-0.rc2 -%global libsemanagever 3.6-0.rc2 -%global libselinuxver 3.6-0.rc2 +%global libsepolver 3.6-1 +%global libsemanagever 3.6-1 +%global libselinuxver 3.6-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,10 +11,10 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 0.rc2.1%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6-rc2/selinux-3.6-rc2.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -33,7 +33,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.6-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.6 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch @@ -42,7 +42,6 @@ Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch Patch0006: 0006-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0007: 0007-sepolicy-port-to-dnf4-python-API.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -78,7 +77,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash -%autosetup -p 1 -n selinux-%{version}-rc2 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -420,6 +419,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Dec 14 2023 Petr Lautrbach - 3.6-1 +- SELinux userspace 3.6 release + * Thu Nov 23 2023 Petr Lautrbach - 3.6-0.rc2.1 - SELinux userspace 3.6-rc2 release diff --git a/sources b/sources index c85d2c4..9d03d1f 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (selinux-3.6-rc2.tar.gz) = b42d07af30a49e2d3e3f99c6400a57e4f830100870dc992f6a3f4b3ab16d3cd8a7f2c08f818045a2b8f358548551d31c75b14247a540e67da62bedaaee979ee0 +SHA512 (selinux-3.6.tar.gz) = 15ba9c5901ec4dc1e9e24374ffe61216301335fb07c0d653692251a59f210628775852f22d7c5eb784a43b65c133fad983ba1e6159d72fd3fd16e87f9a335fb6 SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 From 0b9f7c1112240e25643dd133de9504334bce40b9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 14 Dec 2023 18:08:50 +0100 Subject: [PATCH 41/79] sandbox to require xorg only in Fedora and RHEL <= 9 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index d6c2e45..0e6dbc5 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -271,7 +271,10 @@ The policycoreutils-devel package contains the management tools use to develop p %package sandbox Summary: SELinux sandbox utilities Requires: python3-policycoreutils = %{version}-%{release} -Requires: xorg-x11-server-Xephyr >= 1.14.1-2 /usr/bin/rsync /usr/bin/xmodmap +%if 0%{?fedora} || 0%{?rhel} <= 9 +Requires: xorg-x11-server-Xephyr >= 1.14.1-2 +%endif +Requires: /usr/bin/rsync /usr/bin/xmodmap Requires: matchbox-window-manager BuildRequires: libcap-ng-devel From 8afcf5f0685326ac0af149778e793d3f1e11b863 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 22:06:51 +0000 Subject: [PATCH 42/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 0e6dbc5..fc7d3aa 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz @@ -422,6 +422,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Dec 14 2023 Petr Lautrbach - 3.6-1 - SELinux userspace 3.6 release From bc27ad616af70962f498544334a9d4107717fe92 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 23:53:50 +0000 Subject: [PATCH 43/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index fc7d3aa..7f32993 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz @@ -422,6 +422,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 3.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 3.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 7ebfa734bdd71546dd24e7e9e5d84c32039e631c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 8 Apr 2024 14:42:28 +0200 Subject: [PATCH 44/79] Prepare for bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin - do not hardcode "/usr/sbin" in most places, use the macro instead. - fix build when %_sbindir==%_bindir. - add compat Provides for Requires in other packages. Rely on filesystem creating symlinks for us. This commit makes things compatible with the state before and after the merge. --- policycoreutils.spec | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 7f32993..cdd1edd 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -51,6 +51,17 @@ Conflicts: initscripts < 9.66 Provides: /sbin/fixfiles Provides: /sbin/restorecon +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/restorecon +Provides: /usr/sbin/fixfiles +Provides: /usr/sbin/setfiles +Provides: /usr/sbin/setsebool +Provides: /usr/sbin/semodule +%endif + BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel glib2-devel @@ -137,8 +148,8 @@ chmod 0755 %{buildroot}%{_bindir}/newrole rm -rf %{buildroot}/%{_sysconfdir}/rc.d/init.d/restorecond rm -f %{buildroot}/usr/share/man/man8/open_init_pty.8 -rm -f %{buildroot}/usr/sbin/open_init_pty -rm -f %{buildroot}/usr/sbin/run_init +rm -f %{buildroot}%{_sbindir}/open_init_pty +rm -f %{buildroot}%{_sbindir}/run_init rm -f %{buildroot}/usr/share/man/man8/run_init.8* rm -f %{buildroot}/etc/pam.d/run_init* @@ -164,6 +175,13 @@ Requires: python3-policycoreutils = %{version}-%{release} Obsoletes: policycoreutils-python <= 2.4-4 BuildArch: noarch +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/semanage +%endif + %description python-utils The policycoreutils-python-utils package contains the management tools use to manage an SELinux environment. @@ -349,8 +367,10 @@ system-config-selinux is a utility for managing the SELinux environment %{_sbindir}/genhomedircon %{_sbindir}/setsebool %{_sbindir}/semodule +%if "%{_sbindir}" != "%{_bindir}" # symlink to %%{_bindir}/sestatus %{_sbindir}/sestatus +%endif %{_bindir}/secon %{_bindir}/semodule_expand %{_bindir}/semodule_link From 2b61e9ad2cb3c81af079f6f68b2d8af8aa432cf1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 9 May 2024 15:56:29 +0200 Subject: [PATCH 45/79] Limit sandbox dependencies RHEL > 9 --- policycoreutils.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index cdd1edd..c33f6fe 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -291,9 +291,10 @@ Summary: SELinux sandbox utilities Requires: python3-policycoreutils = %{version}-%{release} %if 0%{?fedora} || 0%{?rhel} <= 9 Requires: xorg-x11-server-Xephyr >= 1.14.1-2 -%endif -Requires: /usr/bin/rsync /usr/bin/xmodmap +Requires: xmodmap Requires: matchbox-window-manager +%endif +Requires: rsync BuildRequires: libcap-ng-devel %description sandbox From 8cc9f3dabde908b03232a1d2fa49d76f882b319b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 9 May 2024 15:56:29 +0200 Subject: [PATCH 46/79] Limit sandbox dependencies RHEL > 9 --- ...-sandbox-do-not-fail-without-xmodmap.patch | 30 ++++++++++++++++ ...un-window-manager-if-it-s-not-a-sess.patch | 35 +++++++++++++++++++ policycoreutils.spec | 2 ++ 3 files changed, 67 insertions(+) create mode 100644 0007-sandbox-do-not-fail-without-xmodmap.patch create mode 100644 0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch diff --git a/0007-sandbox-do-not-fail-without-xmodmap.patch b/0007-sandbox-do-not-fail-without-xmodmap.patch new file mode 100644 index 0000000..30af299 --- /dev/null +++ b/0007-sandbox-do-not-fail-without-xmodmap.patch @@ -0,0 +1,30 @@ +From daedef300edce80cf8ee20825292504104dc0221 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 9 May 2024 16:17:05 +0200 +Subject: [PATCH] sandbox: do not fail without xmodmap +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +--- + sandbox/sandbox | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sandbox/sandbox b/sandbox/sandbox +index 0dc25584dd98..be8722e3b8d3 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -479,7 +479,10 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + + xmodmapfile = self.__homedir + "/.xmodmap" + xd = open(xmodmapfile, "w") +- subprocess.Popen(["/usr/bin/xmodmap", "-pke"], stdout=xd).wait() ++ try: ++ subprocess.Popen(["/usr/bin/xmodmap", "-pke"], stdout=xd).wait() ++ except: ++ pass + xd.close() + + self.__setup_sandboxrc(self.__options.wm) +-- +2.44.0 + diff --git a/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch b/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch new file mode 100644 index 0000000..a033946 --- /dev/null +++ b/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch @@ -0,0 +1,35 @@ +From d6e533bde4a25e5cdbb9445dfef6080dcaa6f43e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 20 Feb 2024 11:14:52 +0100 +Subject: [PATCH] sandbox: do not run window manager if it's not a session +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +--- + sandbox/sandbox | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/sandbox/sandbox b/sandbox/sandbox +index be8722e3b8d3..7ab98076fd2b 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -285,15 +285,12 @@ class Sandbox: + fd.write("""#! /bin/sh + #TITLE: %s + # /usr/bin/test -r ~/.xmodmap && /usr/bin/xmodmap ~/.xmodmap +-%s & +-WM_PID=$! + if which dbus-run-session >/dev/null 2>&1; then + dbus-run-session -- %s + else + dbus-launch --exit-with-session %s + fi +-kill -TERM $WM_PID 2> /dev/null +-""" % (command, wm, command, command)) ++""" % (command, command, command)) + fd.close() + os.chmod(execfile, 0o700) + +-- +2.44.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index c33f6fe..18e347a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -42,6 +42,8 @@ Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch Patch0006: 0006-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0007: 0007-sandbox-do-not-fail-without-xmodmap.patch +Patch0008: 0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 75a6e9fab4e79c5cbcee65bffd76234fc52fb439 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 9 May 2024 16:33:50 +0200 Subject: [PATCH 47/79] sandbox: Add support for Wayland - use XWayland for X application if it's run in Wayland session - run Wayland apps directly if it's run in Wayland session - add sandbox -Y option to run run Wayland application --- ...pipewiresocket-W-waylandsocket-optio.patch | 232 ++++++++++++++++++ 0010-sandbox-Add-support-for-Wayland.patch | 133 ++++++++++ policycoreutils.spec | 2 + 3 files changed, 367 insertions(+) create mode 100644 0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch create mode 100644 0010-sandbox-Add-support-for-Wayland.patch diff --git a/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch b/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch new file mode 100644 index 0000000..11ffed4 --- /dev/null +++ b/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch @@ -0,0 +1,232 @@ +From dde02ec582db3daa50ef09fdcfde025750f0575e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 20 Feb 2024 11:11:56 +0100 +Subject: [PATCH] seunshare: Add [ -P pipewiresocket ] [ -W waylandsocket ] + options +Content-type: text/plain + +Mount /run/user/UID/ or /run/user/UID/ +inside unshared /run/user/UID directory + +Signed-off-by: Petr Lautrbach +--- + sandbox/seunshare.c | 120 +++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 113 insertions(+), 7 deletions(-) + +diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c +index 1d38ea92b9ae..106f625fcba5 100644 +--- a/sandbox/seunshare.c ++++ b/sandbox/seunshare.c +@@ -52,7 +52,8 @@ + + #define BUF_SIZE 1024 + #define DEFAULT_PATH "/usr/bin:/bin" +-#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -r runuserdir ] [ -Z CONTEXT ] -- executable [args] ") ++#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] \ ++[ -r runuserdir ] [ -P pipewiresocket ] [ -W waylandsocket ] [ -Z CONTEXT ] -- executable [args] ") + + static int verbose = 0; + static int child = 0; +@@ -265,6 +266,10 @@ static int seunshare_mount(const char *src, const char *dst, struct stat *src_st + is_tmp = 1; + } + ++ if (strncmp("/run/user", dst, 9) == 0) { ++ flags = flags | MS_REC; ++ } ++ + /* mount directory */ + if (mount(src, dst, NULL, MS_BIND | flags, NULL) < 0) { + fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno)); +@@ -289,6 +294,31 @@ static int seunshare_mount(const char *src, const char *dst, struct stat *src_st + + } + ++/** ++ * Mount directory and check that we mounted the right directory. ++ */ ++static int seunshare_mount_file(const char *src, const char *dst) ++{ ++ int flags = 0; ++ ++ if (verbose) ++ printf(_("Mounting %s on %s\n"), src, dst); ++ ++ if (access(dst, F_OK) == -1) { ++ FILE *fptr; ++ fptr = fopen(dst, "w"); ++ fclose(fptr); ++ } ++ /* mount file */ ++ if (mount(src, dst, NULL, MS_BIND | flags, NULL) < 0) { ++ fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno)); ++ return -1; ++ } ++ ++ return 0; ++ ++} ++ + /* + If path is empty or ends with "/." or "/.. return -1 else return 0; + */ +@@ -616,6 +646,8 @@ killall (const char *execcon) + int main(int argc, char **argv) { + int status = -1; + const char *execcon = NULL; ++ const char *pipewire_socket = NULL; ++ const char *wayland_display = NULL; + + int clflag; /* holds codes for command line flags */ + int kill_all = 0; +@@ -641,6 +673,8 @@ int main(int argc, char **argv) { + {"verbose", 1, 0, 'v'}, + {"context", 1, 0, 'Z'}, + {"capabilities", 1, 0, 'C'}, ++ {"wayland", 1, 0, 'W'}, ++ {"pipewire", 1, 0, 'P'}, + {NULL, 0, 0, 0} + }; + +@@ -670,7 +704,7 @@ int main(int argc, char **argv) { + } + + while (1) { +- clflag = getopt_long(argc, argv, "Ccvh:r:t:Z:", long_options, NULL); ++ clflag = getopt_long(argc, argv, "Ccvh:r:t:W:Z:", long_options, NULL); + if (clflag == -1) + break; + +@@ -693,6 +727,12 @@ int main(int argc, char **argv) { + case 'C': + cap_set = CAPNG_SELECT_CAPS; + break; ++ case 'P': ++ pipewire_socket = optarg; ++ break; ++ case 'W': ++ wayland_display = optarg; ++ break; + case 'Z': + execcon = optarg; + break; +@@ -767,8 +807,14 @@ int main(int argc, char **argv) { + char *display = NULL; + char *LANG = NULL; + char *RUNTIME_DIR = NULL; ++ char *XDG_SESSION_TYPE = NULL; + int rc = -1; + char *resolved_path = NULL; ++ char *wayland_path_s = NULL; /* /tmp/.../wayland-0 */ ++ char *wayland_path = NULL; /* /run/user/UID/wayland-0 */ ++ char *pipewire_path_s = NULL; /* /tmp/.../pipewire-0 */ ++ char *pipewire_path = NULL; /* /run/user/UID/pipewire-0 */ ++ + + if (unshare(CLONE_NEWNS) < 0) { + perror(_("Failed to unshare")); +@@ -805,6 +851,42 @@ int main(int argc, char **argv) { + } + } + ++ if ((XDG_SESSION_TYPE = getenv("XDG_SESSION_TYPE")) != NULL) { ++ if ((XDG_SESSION_TYPE = strdup(XDG_SESSION_TYPE)) == NULL) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ } ++ ++ if (runuserdir_s && (wayland_display || pipewire_socket)) { ++ if (wayland_display) { ++ if (asprintf(&wayland_path_s, "%s/%s", runuserdir_s, wayland_display) == -1) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ ++ if (asprintf(&wayland_path, "%s/%s", RUNTIME_DIR, wayland_display) == -1) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ ++ if (seunshare_mount_file(wayland_path, wayland_path_s) == -1) ++ goto childerr; ++ } ++ ++ if (pipewire_socket) { ++ if (asprintf(&pipewire_path_s, "%s/%s", runuserdir_s, pipewire_socket) == -1) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ if (asprintf(&pipewire_path, "%s/pipewire-0", RUNTIME_DIR) == -1) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ seunshare_mount_file(pipewire_path, pipewire_path_s); ++ } ++ } ++ + /* mount homedir, runuserdir and tmpdir, in this order */ + if (runuserdir_s && seunshare_mount(runuserdir_s, RUNTIME_DIR, + &st_runuserdir_s) != 0) goto childerr; +@@ -816,10 +898,21 @@ int main(int argc, char **argv) { + if (drop_privs(uid) != 0) goto childerr; + + /* construct a new environment */ +- if ((display = getenv("DISPLAY")) != NULL) { +- if ((display = strdup(display)) == NULL) { +- perror(_("Out of memory")); +- goto childerr; ++ ++ if (XDG_SESSION_TYPE && strcmp(XDG_SESSION_TYPE, "wayland") == 0) { ++ if (wayland_display == NULL && (wayland_display = getenv("WAYLAND_DISPLAY")) != NULL) { ++ if ((wayland_display = strdup(wayland_display)) == NULL) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } ++ } ++ } ++ else { ++ if ((display = getenv("DISPLAY")) != NULL) { ++ if ((display = strdup(display)) == NULL) { ++ perror(_("Out of memory")); ++ goto childerr; ++ } + } + } + +@@ -835,8 +928,16 @@ int main(int argc, char **argv) { + perror(_("Failed to clear environment")); + goto childerr; + } +- if (display) ++ if (display) { + rc |= setenv("DISPLAY", display, 1); ++ } ++ if (wayland_display) { ++ rc |= setenv("WAYLAND_DISPLAY", wayland_display, 1); ++ } ++ ++ if (XDG_SESSION_TYPE) ++ rc |= setenv("XDG_SESSION_TYPE", XDG_SESSION_TYPE, 1); ++ + if (LANG) + rc |= setenv("LANG", LANG, 1); + if (RUNTIME_DIR) +@@ -874,9 +975,14 @@ int main(int argc, char **argv) { + fprintf(stderr, _("Failed to execute command %s: %s\n"), argv[optind], strerror(errno)); + childerr: + free(resolved_path); ++ free(wayland_path); ++ free(wayland_path_s); ++ free(pipewire_path); ++ free(pipewire_path_s); + free(display); + free(LANG); + free(RUNTIME_DIR); ++ free(XDG_SESSION_TYPE); + exit(-1); + } + +-- +2.44.0 + diff --git a/0010-sandbox-Add-support-for-Wayland.patch b/0010-sandbox-Add-support-for-Wayland.patch new file mode 100644 index 0000000..203c35f --- /dev/null +++ b/0010-sandbox-Add-support-for-Wayland.patch @@ -0,0 +1,133 @@ +From 5d1224b87ea10f3026ecf53c4c448ac4655add04 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 20 Feb 2024 11:17:20 +0100 +Subject: [PATCH] sandbox: Add support for Wayland +Content-type: text/plain + +- use XWayland for X application if it's run in Wayland session +- run Wayland apps directly if it's run in Wayland session +- add sandbox -Y option to run run Wayland application + +Signed-off-by: Petr Lautrbach +--- + sandbox/sandbox | 26 ++++++++++++++++++++++++-- + sandbox/sandboxX.sh | 36 ++++++++++++++++++++++++------------ + 2 files changed, 48 insertions(+), 14 deletions(-) + +diff --git a/sandbox/sandbox b/sandbox/sandbox +index 7ab98076fd2b..009b5f4df8f2 100644 +--- a/sandbox/sandbox ++++ b/sandbox/sandbox +@@ -344,6 +344,10 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + action="callback", callback=self.__x_callback, + default=False, help=_("run X application within a sandbox")) + ++ parser.add_option("-Y", dest="Y_ind", ++ action="callback", callback=self.__x_callback, ++ default=False, help=_("run Wayland application within a sandbox")) ++ + parser.add_option("-H", "--homedir", + action="callback", callback=self.__validdir, + type="string", +@@ -457,6 +461,16 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + selinux.chcon(self.__runuserdir, self.__filecon, recursive=True) + selinux.setfscreatecon(None) + ++ def __is_wayland_app(self): ++ binary = shutil.which(self.__paths[0]) ++ if binary is None: ++ return True ++ output = subprocess.run(['ldd', binary], capture_output=True) ++ for line in str(output.stdout, "utf-8").split('\n'): ++ if line.find("libwayland") != -1: ++ return "yes" ++ return False ++ + def __execute(self): + try: + cmds = [SEUNSHARE, "-Z", self.__execcon] +@@ -465,7 +479,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + if self.__mount: + cmds += ["-t", self.__tmpdir, "-h", self.__homedir, "-r", self.__runuserdir] + +- if self.__options.X_ind: ++ if self.__options.X_ind or self.__options.Y_ind: + if self.__options.dpi: + dpi = self.__options.dpi + else: +@@ -474,6 +488,9 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + from gi.repository import Gtk + dpi = str(Gtk.Settings.get_default().props.gtk_xft_dpi / 1024) + ++ if os.environ.get('WAYLAND_DISPLAY') is not None: ++ cmds += ["-W", os.environ["WAYLAND_DISPLAY"]] ++ + xmodmapfile = self.__homedir + "/.xmodmap" + xd = open(xmodmapfile, "w") + try: +@@ -484,7 +501,12 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- + + self.__setup_sandboxrc(self.__options.wm) + +- cmds += ["--", SANDBOXSH, self.__options.windowsize, dpi] ++ if self.__options.Y_ind or self.__is_wayland_app(): ++ WN = "yes" ++ else: ++ WN = "no" ++ ++ cmds += ["--", SANDBOXSH, WN, self.__options.windowsize, dpi] + else: + cmds += ["--"] + self.__paths + return subprocess.Popen(cmds).wait() +diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh +index c211ebc14549..e2a7ad9b2ac7 100644 +--- a/sandbox/sandboxX.sh ++++ b/sandbox/sandboxX.sh +@@ -2,20 +2,32 @@ + trap "" TERM + context=`id -Z | secon -t -l -P` + export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8-80`" +-[ -z $1 ] && export SCREENSIZE="1000x700" || export SCREENSIZE="$1" +-[ -z $2 ] && export DPI="96" || export DPI="$2" ++[ -z $1 ] && export WAYLAND_NATIVE="no" || export WAYLAND_NATIVE="$1" ++[ -z $2 ] && export SCREENSIZE="1000x700" || export SCREENSIZE="$2" ++[ -z $3 ] && export DPI="96" || export DPI="$3" + trap "exit 0" HUP + +-(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do +- export DISPLAY=:$D +- cat > ~/seremote << __EOF +-#!/bin/sh +-DISPLAY=$DISPLAY "\$@" ++if [ "$WAYLAND_NATIVE" == "no" ]; then ++ if [ -z "$WAYLAND_DISPLAY" ]; then ++ DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' ++ else ++ DISPLAY_COMMAND='/usr/bin/Xwayland -terminate -dpi $DPI -retro -geometry $SCREENSIZE -decorate -displayfd 5 5>&1 2>/dev/null' ++ fi ++ eval $DISPLAY_COMMAND | while read D; do ++ export DISPLAY=:$D ++ cat > ~/seremote << __EOF ++#!/bin/bash -x ++export DISPLAY=$DISPLAY ++export WAYLAND_DISPLAY=$WAYLAND_DISPLAY ++"\$@" + __EOF +- chmod +x ~/seremote ++ chmod +x ~/seremote ++ /usr/share/sandbox/start $HOME/.sandboxrc ++ export EXITCODE=$? ++ kill -TERM 0 ++ break ++ done ++else + /usr/share/sandbox/start $HOME/.sandboxrc +- export EXITCODE=$? +- kill -TERM 0 +- break +-done ++fi + exit 0 +-- +2.44.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 18e347a..ba326d9 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -44,6 +44,8 @@ Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch Patch0006: 0006-python-sepolicy-Fix-spec-file-dependencies.patch Patch0007: 0007-sandbox-do-not-fail-without-xmodmap.patch Patch0008: 0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch +Patch0009: 0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch +Patch0010: 0010-sandbox-Add-support-for-Wayland.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 303ec7f9f84840104411a11d975641089c125750 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 9 May 2024 16:40:45 +0200 Subject: [PATCH 48/79] policycoreutils-3.6-4 - Add Wayland support --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ba326d9..8b46a40 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz @@ -447,6 +447,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu May 09 2024 Petr Lautrbach - 3.6-4 +- Add Wayland support + * Thu Jan 25 2024 Fedora Release Engineering - 3.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 6b350d55f4c91dbf2ca3aa613663d77619a96a95 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 08:34:19 +0200 Subject: [PATCH 49/79] Rebuilt for Python 3.13 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 8b46a40..c036711 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz @@ -447,6 +447,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jun 07 2024 Python Maint - 3.6-5 +- Rebuilt for Python 3.13 + * Thu May 09 2024 Petr Lautrbach - 3.6-4 - Add Wayland support From 4c447e2cc8fbdddfb1a8bc0f3637f594cb13d52f Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 27 Jun 2024 17:47:47 +0200 Subject: [PATCH 50/79] SELinux userspace 3.7 release --- .gitignore | 1 + ...t-be-verbose-if-you-are-not-on-a-tty.patch | 6 +- ...t-to-Xephyr-as-it-works-better-with-.patch | 27 -- ...rate-Handle-more-reserved-port-types.patch | 6 +- ...hbox-window-manager-instead-of-openb.patch | 20 +- ...h => 0004-Use-SHA-2-instead-of-SHA-1.patch | 4 +- ...-sepolicy-Fix-spec-file-dependencies.patch | 4 +- ...-sandbox-do-not-fail-without-xmodmap.patch | 30 --- ...un-window-manager-if-it-s-not-a-sess.patch | 35 --- ...pipewiresocket-W-waylandsocket-optio.patch | 232 ------------------ 0010-sandbox-Add-support-for-Wayland.patch | 133 ---------- policycoreutils.spec | 32 ++- sources | 2 +- 13 files changed, 37 insertions(+), 495 deletions(-) rename 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch => 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch (83%) delete mode 100644 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch rename 0003-sepolicy-generate-Handle-more-reserved-port-types.patch => 0002-sepolicy-generate-Handle-more-reserved-port-types.patch (96%) rename 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch => 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch (79%) rename 0005-Use-SHA-2-instead-of-SHA-1.patch => 0004-Use-SHA-2-instead-of-SHA-1.patch (98%) rename 0006-python-sepolicy-Fix-spec-file-dependencies.patch => 0005-python-sepolicy-Fix-spec-file-dependencies.patch (95%) delete mode 100644 0007-sandbox-do-not-fail-without-xmodmap.patch delete mode 100644 0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch delete mode 100644 0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch delete mode 100644 0010-sandbox-Add-support-for-Wayland.patch diff --git a/.gitignore b/.gitignore index f168b35..dc44242 100644 --- a/.gitignore +++ b/.gitignore @@ -355,3 +355,4 @@ policycoreutils-2.0.83.tgz /selinux-3.6-rc1.tar.gz /selinux-3.6-rc2.tar.gz /selinux-3.6.tar.gz +/selinux-3.7.tar.gz diff --git a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch similarity index 83% rename from 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch rename to 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index 87f5561..aaea883 100644 --- a/0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 5dd7c8460230bd27170725bbb27014855652f356 Mon Sep 17 00:00:00 2001 +From 7030465cd94d22aef6824e46df69f82b256195c8 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 166af6f360a2..ebe64563c7d7 100755 +index cb50fef3ca65..13ac07414c14 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { @@ -21,5 +21,5 @@ index 166af6f360a2..ebe64563c7d7 100755 THREADS="" RPMFILES="" -- -2.41.0 +2.44.0 diff --git a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch b/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch deleted file mode 100644 index ed3f2a4..0000000 --- a/0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 10542b4fde99a089950126b008105c14b9452da1 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 20 Aug 2015 12:58:41 +0200 -Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in - recent Fedoras -Content-type: text/plain - ---- - sandbox/sandboxX.sh | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh -index eaa500d08143..4774528027ef 100644 ---- a/sandbox/sandboxX.sh -+++ b/sandbox/sandboxX.sh -@@ -20,7 +20,7 @@ cat > ~/.config/openbox/rc.xml << EOF - - EOF - --(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do -+(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do - export DISPLAY=:$D - cat > ~/seremote << __EOF - #!/bin/sh --- -2.41.0 - diff --git a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch similarity index 96% rename from 0003-sepolicy-generate-Handle-more-reserved-port-types.patch rename to 0002-sepolicy-generate-Handle-more-reserved-port-types.patch index 20134a1..1ff3536 100644 --- a/0003-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From 6213773ec3a6364cac48eb39d8ecfb11b5addc12 Mon Sep 17 00:00:00 2001 +From 856ac05345d8557a38e82d012a4d13b4d34efd6f Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -53,7 +53,7 @@ https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redha 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index b6df3e91160b..36a3ea1196b1 100644 +index adf65f27a822..f726ad51b775 100644 --- a/python/sepolicy/sepolicy/generate.py +++ b/python/sepolicy/sepolicy/generate.py @@ -100,7 +100,9 @@ def get_all_ports(): @@ -68,5 +68,5 @@ index b6df3e91160b..36a3ea1196b1 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.41.0 +2.44.0 diff --git a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch similarity index 79% rename from 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch rename to 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index a920866..91b36be 100644 --- a/0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 7bf4ac2438df52b259b9d3d539b9a9e889cc7424 Mon Sep 17 00:00:00 2001 +From 8f7a90cb77a79aaef2ceca75bc25679a7b17ff98 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -11,7 +11,7 @@ Content-type: text/plain 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/sandbox/sandbox b/sandbox/sandbox -index a2762a7d215a..a32a33ea3cf6 100644 +index e3fd6119ed4d..e01425f0c637 100644 --- a/sandbox/sandbox +++ b/sandbox/sandbox @@ -270,7 +270,7 @@ class Sandbox: @@ -23,7 +23,7 @@ index a2762a7d215a..a32a33ea3cf6 100644 execfile = self.__homedir + "/.sandboxrc" fd = open(execfile, "w+") if self.__options.session: -@@ -369,7 +369,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- +@@ -370,7 +370,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- parser.add_option("-W", "--windowmanager", dest="wm", type="string", @@ -46,11 +46,11 @@ index 095b9e27042d..1c1870190e51 100644 \fB\-X\fR Create an X based Sandbox for gui apps, temporary files for diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh -index 4774528027ef..c211ebc14549 100644 +index 28169182ce42..e2a7ad9b2ac7 100644 --- a/sandbox/sandboxX.sh +++ b/sandbox/sandboxX.sh -@@ -6,20 +6,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8 - [ -z $2 ] && export DPI="96" || export DPI="$2" +@@ -7,20 +7,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8 + [ -z $3 ] && export DPI="96" || export DPI="$3" trap "exit 0" HUP -mkdir -p ~/.config/openbox @@ -67,9 +67,9 @@ index 4774528027ef..c211ebc14549 100644 - -EOF - - (/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do - export DISPLAY=:$D - cat > ~/seremote << __EOF + if [ "$WAYLAND_NATIVE" == "no" ]; then + if [ -z "$WAYLAND_DISPLAY" ]; then + DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -- -2.41.0 +2.44.0 diff --git a/0005-Use-SHA-2-instead-of-SHA-1.patch b/0004-Use-SHA-2-instead-of-SHA-1.patch similarity index 98% rename from 0005-Use-SHA-2-instead-of-SHA-1.patch rename to 0004-Use-SHA-2-instead-of-SHA-1.patch index 7025395..96f6d1d 100644 --- a/0005-Use-SHA-2-instead-of-SHA-1.patch +++ b/0004-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 94859162dbf9d2ccd4ffb923720c654a4cb9150a Mon Sep 17 00:00:00 2001 +From 4884c917237e53e34d3fc75dcf4f07217cfd7584 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644 and provided the .B \-n -- -2.41.0 +2.44.0 diff --git a/0006-python-sepolicy-Fix-spec-file-dependencies.patch b/0005-python-sepolicy-Fix-spec-file-dependencies.patch similarity index 95% rename from 0006-python-sepolicy-Fix-spec-file-dependencies.patch rename to 0005-python-sepolicy-Fix-spec-file-dependencies.patch index 817224b..ff76509 100644 --- a/0006-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0005-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,4 +1,4 @@ -From f364324e66cb2bf014362c5c1d1b6a2bcf98d6ff Mon Sep 17 00:00:00 2001 +From cb1b3bdca016edaa90e92b49d51544f8a38cba19 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies @@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644 mid_section="""\ -- -2.41.0 +2.44.0 diff --git a/0007-sandbox-do-not-fail-without-xmodmap.patch b/0007-sandbox-do-not-fail-without-xmodmap.patch deleted file mode 100644 index 30af299..0000000 --- a/0007-sandbox-do-not-fail-without-xmodmap.patch +++ /dev/null @@ -1,30 +0,0 @@ -From daedef300edce80cf8ee20825292504104dc0221 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 9 May 2024 16:17:05 +0200 -Subject: [PATCH] sandbox: do not fail without xmodmap -Content-type: text/plain - -Signed-off-by: Petr Lautrbach ---- - sandbox/sandbox | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/sandbox/sandbox b/sandbox/sandbox -index 0dc25584dd98..be8722e3b8d3 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -479,7 +479,10 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - - xmodmapfile = self.__homedir + "/.xmodmap" - xd = open(xmodmapfile, "w") -- subprocess.Popen(["/usr/bin/xmodmap", "-pke"], stdout=xd).wait() -+ try: -+ subprocess.Popen(["/usr/bin/xmodmap", "-pke"], stdout=xd).wait() -+ except: -+ pass - xd.close() - - self.__setup_sandboxrc(self.__options.wm) --- -2.44.0 - diff --git a/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch b/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch deleted file mode 100644 index a033946..0000000 --- a/0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch +++ /dev/null @@ -1,35 +0,0 @@ -From d6e533bde4a25e5cdbb9445dfef6080dcaa6f43e Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 20 Feb 2024 11:14:52 +0100 -Subject: [PATCH] sandbox: do not run window manager if it's not a session -Content-type: text/plain - -Signed-off-by: Petr Lautrbach ---- - sandbox/sandbox | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/sandbox/sandbox b/sandbox/sandbox -index be8722e3b8d3..7ab98076fd2b 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -285,15 +285,12 @@ class Sandbox: - fd.write("""#! /bin/sh - #TITLE: %s - # /usr/bin/test -r ~/.xmodmap && /usr/bin/xmodmap ~/.xmodmap --%s & --WM_PID=$! - if which dbus-run-session >/dev/null 2>&1; then - dbus-run-session -- %s - else - dbus-launch --exit-with-session %s - fi --kill -TERM $WM_PID 2> /dev/null --""" % (command, wm, command, command)) -+""" % (command, command, command)) - fd.close() - os.chmod(execfile, 0o700) - --- -2.44.0 - diff --git a/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch b/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch deleted file mode 100644 index 11ffed4..0000000 --- a/0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch +++ /dev/null @@ -1,232 +0,0 @@ -From dde02ec582db3daa50ef09fdcfde025750f0575e Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 20 Feb 2024 11:11:56 +0100 -Subject: [PATCH] seunshare: Add [ -P pipewiresocket ] [ -W waylandsocket ] - options -Content-type: text/plain - -Mount /run/user/UID/ or /run/user/UID/ -inside unshared /run/user/UID directory - -Signed-off-by: Petr Lautrbach ---- - sandbox/seunshare.c | 120 +++++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 113 insertions(+), 7 deletions(-) - -diff --git a/sandbox/seunshare.c b/sandbox/seunshare.c -index 1d38ea92b9ae..106f625fcba5 100644 ---- a/sandbox/seunshare.c -+++ b/sandbox/seunshare.c -@@ -52,7 +52,8 @@ - - #define BUF_SIZE 1024 - #define DEFAULT_PATH "/usr/bin:/bin" --#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -r runuserdir ] [ -Z CONTEXT ] -- executable [args] ") -+#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -k ] [ -t tmpdir ] [ -h homedir ] \ -+[ -r runuserdir ] [ -P pipewiresocket ] [ -W waylandsocket ] [ -Z CONTEXT ] -- executable [args] ") - - static int verbose = 0; - static int child = 0; -@@ -265,6 +266,10 @@ static int seunshare_mount(const char *src, const char *dst, struct stat *src_st - is_tmp = 1; - } - -+ if (strncmp("/run/user", dst, 9) == 0) { -+ flags = flags | MS_REC; -+ } -+ - /* mount directory */ - if (mount(src, dst, NULL, MS_BIND | flags, NULL) < 0) { - fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno)); -@@ -289,6 +294,31 @@ static int seunshare_mount(const char *src, const char *dst, struct stat *src_st - - } - -+/** -+ * Mount directory and check that we mounted the right directory. -+ */ -+static int seunshare_mount_file(const char *src, const char *dst) -+{ -+ int flags = 0; -+ -+ if (verbose) -+ printf(_("Mounting %s on %s\n"), src, dst); -+ -+ if (access(dst, F_OK) == -1) { -+ FILE *fptr; -+ fptr = fopen(dst, "w"); -+ fclose(fptr); -+ } -+ /* mount file */ -+ if (mount(src, dst, NULL, MS_BIND | flags, NULL) < 0) { -+ fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno)); -+ return -1; -+ } -+ -+ return 0; -+ -+} -+ - /* - If path is empty or ends with "/." or "/.. return -1 else return 0; - */ -@@ -616,6 +646,8 @@ killall (const char *execcon) - int main(int argc, char **argv) { - int status = -1; - const char *execcon = NULL; -+ const char *pipewire_socket = NULL; -+ const char *wayland_display = NULL; - - int clflag; /* holds codes for command line flags */ - int kill_all = 0; -@@ -641,6 +673,8 @@ int main(int argc, char **argv) { - {"verbose", 1, 0, 'v'}, - {"context", 1, 0, 'Z'}, - {"capabilities", 1, 0, 'C'}, -+ {"wayland", 1, 0, 'W'}, -+ {"pipewire", 1, 0, 'P'}, - {NULL, 0, 0, 0} - }; - -@@ -670,7 +704,7 @@ int main(int argc, char **argv) { - } - - while (1) { -- clflag = getopt_long(argc, argv, "Ccvh:r:t:Z:", long_options, NULL); -+ clflag = getopt_long(argc, argv, "Ccvh:r:t:W:Z:", long_options, NULL); - if (clflag == -1) - break; - -@@ -693,6 +727,12 @@ int main(int argc, char **argv) { - case 'C': - cap_set = CAPNG_SELECT_CAPS; - break; -+ case 'P': -+ pipewire_socket = optarg; -+ break; -+ case 'W': -+ wayland_display = optarg; -+ break; - case 'Z': - execcon = optarg; - break; -@@ -767,8 +807,14 @@ int main(int argc, char **argv) { - char *display = NULL; - char *LANG = NULL; - char *RUNTIME_DIR = NULL; -+ char *XDG_SESSION_TYPE = NULL; - int rc = -1; - char *resolved_path = NULL; -+ char *wayland_path_s = NULL; /* /tmp/.../wayland-0 */ -+ char *wayland_path = NULL; /* /run/user/UID/wayland-0 */ -+ char *pipewire_path_s = NULL; /* /tmp/.../pipewire-0 */ -+ char *pipewire_path = NULL; /* /run/user/UID/pipewire-0 */ -+ - - if (unshare(CLONE_NEWNS) < 0) { - perror(_("Failed to unshare")); -@@ -805,6 +851,42 @@ int main(int argc, char **argv) { - } - } - -+ if ((XDG_SESSION_TYPE = getenv("XDG_SESSION_TYPE")) != NULL) { -+ if ((XDG_SESSION_TYPE = strdup(XDG_SESSION_TYPE)) == NULL) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ } -+ -+ if (runuserdir_s && (wayland_display || pipewire_socket)) { -+ if (wayland_display) { -+ if (asprintf(&wayland_path_s, "%s/%s", runuserdir_s, wayland_display) == -1) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ -+ if (asprintf(&wayland_path, "%s/%s", RUNTIME_DIR, wayland_display) == -1) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ -+ if (seunshare_mount_file(wayland_path, wayland_path_s) == -1) -+ goto childerr; -+ } -+ -+ if (pipewire_socket) { -+ if (asprintf(&pipewire_path_s, "%s/%s", runuserdir_s, pipewire_socket) == -1) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ if (asprintf(&pipewire_path, "%s/pipewire-0", RUNTIME_DIR) == -1) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ seunshare_mount_file(pipewire_path, pipewire_path_s); -+ } -+ } -+ - /* mount homedir, runuserdir and tmpdir, in this order */ - if (runuserdir_s && seunshare_mount(runuserdir_s, RUNTIME_DIR, - &st_runuserdir_s) != 0) goto childerr; -@@ -816,10 +898,21 @@ int main(int argc, char **argv) { - if (drop_privs(uid) != 0) goto childerr; - - /* construct a new environment */ -- if ((display = getenv("DISPLAY")) != NULL) { -- if ((display = strdup(display)) == NULL) { -- perror(_("Out of memory")); -- goto childerr; -+ -+ if (XDG_SESSION_TYPE && strcmp(XDG_SESSION_TYPE, "wayland") == 0) { -+ if (wayland_display == NULL && (wayland_display = getenv("WAYLAND_DISPLAY")) != NULL) { -+ if ((wayland_display = strdup(wayland_display)) == NULL) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } -+ } -+ } -+ else { -+ if ((display = getenv("DISPLAY")) != NULL) { -+ if ((display = strdup(display)) == NULL) { -+ perror(_("Out of memory")); -+ goto childerr; -+ } - } - } - -@@ -835,8 +928,16 @@ int main(int argc, char **argv) { - perror(_("Failed to clear environment")); - goto childerr; - } -- if (display) -+ if (display) { - rc |= setenv("DISPLAY", display, 1); -+ } -+ if (wayland_display) { -+ rc |= setenv("WAYLAND_DISPLAY", wayland_display, 1); -+ } -+ -+ if (XDG_SESSION_TYPE) -+ rc |= setenv("XDG_SESSION_TYPE", XDG_SESSION_TYPE, 1); -+ - if (LANG) - rc |= setenv("LANG", LANG, 1); - if (RUNTIME_DIR) -@@ -874,9 +975,14 @@ int main(int argc, char **argv) { - fprintf(stderr, _("Failed to execute command %s: %s\n"), argv[optind], strerror(errno)); - childerr: - free(resolved_path); -+ free(wayland_path); -+ free(wayland_path_s); -+ free(pipewire_path); -+ free(pipewire_path_s); - free(display); - free(LANG); - free(RUNTIME_DIR); -+ free(XDG_SESSION_TYPE); - exit(-1); - } - --- -2.44.0 - diff --git a/0010-sandbox-Add-support-for-Wayland.patch b/0010-sandbox-Add-support-for-Wayland.patch deleted file mode 100644 index 203c35f..0000000 --- a/0010-sandbox-Add-support-for-Wayland.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 5d1224b87ea10f3026ecf53c4c448ac4655add04 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 20 Feb 2024 11:17:20 +0100 -Subject: [PATCH] sandbox: Add support for Wayland -Content-type: text/plain - -- use XWayland for X application if it's run in Wayland session -- run Wayland apps directly if it's run in Wayland session -- add sandbox -Y option to run run Wayland application - -Signed-off-by: Petr Lautrbach ---- - sandbox/sandbox | 26 ++++++++++++++++++++++++-- - sandbox/sandboxX.sh | 36 ++++++++++++++++++++++++------------ - 2 files changed, 48 insertions(+), 14 deletions(-) - -diff --git a/sandbox/sandbox b/sandbox/sandbox -index 7ab98076fd2b..009b5f4df8f2 100644 ---- a/sandbox/sandbox -+++ b/sandbox/sandbox -@@ -344,6 +344,10 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - action="callback", callback=self.__x_callback, - default=False, help=_("run X application within a sandbox")) - -+ parser.add_option("-Y", dest="Y_ind", -+ action="callback", callback=self.__x_callback, -+ default=False, help=_("run Wayland application within a sandbox")) -+ - parser.add_option("-H", "--homedir", - action="callback", callback=self.__validdir, - type="string", -@@ -457,6 +461,16 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - selinux.chcon(self.__runuserdir, self.__filecon, recursive=True) - selinux.setfscreatecon(None) - -+ def __is_wayland_app(self): -+ binary = shutil.which(self.__paths[0]) -+ if binary is None: -+ return True -+ output = subprocess.run(['ldd', binary], capture_output=True) -+ for line in str(output.stdout, "utf-8").split('\n'): -+ if line.find("libwayland") != -1: -+ return "yes" -+ return False -+ - def __execute(self): - try: - cmds = [SEUNSHARE, "-Z", self.__execcon] -@@ -465,7 +479,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - if self.__mount: - cmds += ["-t", self.__tmpdir, "-h", self.__homedir, "-r", self.__runuserdir] - -- if self.__options.X_ind: -+ if self.__options.X_ind or self.__options.Y_ind: - if self.__options.dpi: - dpi = self.__options.dpi - else: -@@ -474,6 +488,9 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - from gi.repository import Gtk - dpi = str(Gtk.Settings.get_default().props.gtk_xft_dpi / 1024) - -+ if os.environ.get('WAYLAND_DISPLAY') is not None: -+ cmds += ["-W", os.environ["WAYLAND_DISPLAY"]] -+ - xmodmapfile = self.__homedir + "/.xmodmap" - xd = open(xmodmapfile, "w") - try: -@@ -484,7 +501,12 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [- - - self.__setup_sandboxrc(self.__options.wm) - -- cmds += ["--", SANDBOXSH, self.__options.windowsize, dpi] -+ if self.__options.Y_ind or self.__is_wayland_app(): -+ WN = "yes" -+ else: -+ WN = "no" -+ -+ cmds += ["--", SANDBOXSH, WN, self.__options.windowsize, dpi] - else: - cmds += ["--"] + self.__paths - return subprocess.Popen(cmds).wait() -diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh -index c211ebc14549..e2a7ad9b2ac7 100644 ---- a/sandbox/sandboxX.sh -+++ b/sandbox/sandboxX.sh -@@ -2,20 +2,32 @@ - trap "" TERM - context=`id -Z | secon -t -l -P` - export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8-80`" --[ -z $1 ] && export SCREENSIZE="1000x700" || export SCREENSIZE="$1" --[ -z $2 ] && export DPI="96" || export DPI="$2" -+[ -z $1 ] && export WAYLAND_NATIVE="no" || export WAYLAND_NATIVE="$1" -+[ -z $2 ] && export SCREENSIZE="1000x700" || export SCREENSIZE="$2" -+[ -z $3 ] && export DPI="96" || export DPI="$3" - trap "exit 0" HUP - --(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do -- export DISPLAY=:$D -- cat > ~/seremote << __EOF --#!/bin/sh --DISPLAY=$DISPLAY "\$@" -+if [ "$WAYLAND_NATIVE" == "no" ]; then -+ if [ -z "$WAYLAND_DISPLAY" ]; then -+ DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -+ else -+ DISPLAY_COMMAND='/usr/bin/Xwayland -terminate -dpi $DPI -retro -geometry $SCREENSIZE -decorate -displayfd 5 5>&1 2>/dev/null' -+ fi -+ eval $DISPLAY_COMMAND | while read D; do -+ export DISPLAY=:$D -+ cat > ~/seremote << __EOF -+#!/bin/bash -x -+export DISPLAY=$DISPLAY -+export WAYLAND_DISPLAY=$WAYLAND_DISPLAY -+"\$@" - __EOF -- chmod +x ~/seremote -+ chmod +x ~/seremote -+ /usr/share/sandbox/start $HOME/.sandboxrc -+ export EXITCODE=$? -+ kill -TERM 0 -+ break -+ done -+else - /usr/share/sandbox/start $HOME/.sandboxrc -- export EXITCODE=$? -- kill -TERM 0 -- break --done -+fi - exit 0 --- -2.44.0 - diff --git a/policycoreutils.spec b/policycoreutils.spec index c036711..7560357 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.6-1 -%global libsemanagever 3.6-1 -%global libselinuxver 3.6-1 +%global libsepolver 3.7-1 +%global libsemanagever 3.7-1 +%global libselinuxver 3.7-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,11 +10,11 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.6 -Release: 5%{?dist} +Version: 3.7 +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz +Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -33,19 +33,14 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.6 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.7 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch -Patch0002: 0002-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0003: 0003-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0004: 0004-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0005: 0005-Use-SHA-2-instead-of-SHA-1.patch -Patch0006: 0006-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0007: 0007-sandbox-do-not-fail-without-xmodmap.patch -Patch0008: 0008-sandbox-do-not-run-window-manager-if-it-s-not-a-sess.patch -Patch0009: 0009-seunshare-Add-P-pipewiresocket-W-waylandsocket-optio.patch -Patch0010: 0010-sandbox-Add-support-for-Wayland.patch +Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch +Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -447,6 +442,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Thu Jun 27 2024 Petr Lautrbach - 3.7-1 +- SELinux userspace 3.7 release + * Fri Jun 07 2024 Python Maint - 3.6-5 - Rebuilt for Python 3.13 diff --git a/sources b/sources index 9d03d1f..322ed2e 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (selinux-3.6.tar.gz) = 15ba9c5901ec4dc1e9e24374ffe61216301335fb07c0d653692251a59f210628775852f22d7c5eb784a43b65c133fad983ba1e6159d72fd3fd16e87f9a335fb6 SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 +SHA512 (selinux-3.7.tar.gz) = f16c3731e27a09306147ffd5b929f55357642da663326edf5837885b36e8fe763ba6a1d18e8ae4001f6091545d06bb11f2d9ed78d69711c0211fbb406bc52345 From 0af2af4e053a9584208aa202f76d092ea1159994 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 27 Jun 2024 17:54:30 +0200 Subject: [PATCH 51/79] Verify upstream tarball signature https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification --- .gitignore | 1 + bachradsusi.gpg | 321 +++++++++++++++++++++++++++++++++++++++++++ policycoreutils.spec | 4 + sources | 1 + 4 files changed, 327 insertions(+) create mode 100644 bachradsusi.gpg diff --git a/.gitignore b/.gitignore index dc44242..1b551bf 100644 --- a/.gitignore +++ b/.gitignore @@ -356,3 +356,4 @@ policycoreutils-2.0.83.tgz /selinux-3.6-rc2.tar.gz /selinux-3.6.tar.gz /selinux-3.7.tar.gz +/selinux-3.7.tar.gz.asc diff --git a/bachradsusi.gpg b/bachradsusi.gpg new file mode 100644 index 0000000..ff4e382 --- /dev/null +++ b/bachradsusi.gpg @@ -0,0 +1,321 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBE97JQcBEAC/aeBxbuToAJokMiVxtMVFoUMgCbcVQDB21YhMq4i5a/HDzFno +qVPhQjGViGTKXQYR7SnT8CCfC3ggG7hqU0oaWKN3D003V6e/ivTJwMKrQRFqf5/A +vN7ELulXFxEt/ZjYmvTukpW5Li2AU7JBD0aO243Ld9jYdZOZn2zdfA8IpnE9Bmm3 +K/LO1Xb2F9ujF9faI5/IlJvdUFk3uiCKTSvM8kGwOmAwBI921Z5x/CYvy5kKEazU +lUxMqECl+Tu2YS6NDhWYNkifAIZ7lsUvGjW3/wfh7AvmAQyt/CxOXu9LL2nGzFhw +CIS4jVIxy5bDswNfHcaMX7B5WEyqTPtjzPAEMiLL4yHJZrHDPd26QHSaqtilVA4K +AeTYbME8iZIdacquFEq02PO9qAM21O48OknCTSolF7z6nBkk6l26W3EL+Gz5I2Et +3S9pab3FMjiiKVavM6UA5D0DQkNxxDn9blDXZyhX4HFrk+NnoETcGYFymPbbijgi +kFC4339/Z1aK31aJLkxiana5mqLthD4jCeg3B8Cp5IurqPr8QEh3FH8ZZhtdx2fX +TXHTmGQF/lXG4tg1eH5cb6wWGU93wD+5mf6czJlUZTY+kdevKtZCQnA0/2ENCOFW +Jdm/oMTUw6ozPd474ctzWKeO78e8yMvZst/Zp3Gq6SD9kcoPgiuMQ+BOkwARAQAB +tCRQZXRyIExhdXRyYmFjaCA8cGxhdXRyYmFAcmVkaGF0LmNvbT6JAjgEEwECACIF +Ak97JQcCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGOorUuYLENzy1MP +/2c4fH8eXWbqoot/vLE+hJ14k0leYOQhVSo4lNlxRlbKNd5MQSX/QjkQgJNECbB3 +LM0KxE/zwVOZ+umvmxLxNskOxjubE6NzoF7Sm9ydoqjwzenIpR9BVtg71mfjBOoL +PNrst7tHRE5btSnnnOS9ddt/y9JOIvQpkjtBTI2TfVcp2b4Domg7i4qU/hJ7hu45 +5oAi6rPPkr0pcGiDKTqi46l7+9orsj9Mxs1XTmrTMMB/eV6PCU7Fo4WJNXS8SXd3 +sEVxXvpyYjUTTnDuewjT1q8NL7anrsckS16WYSVGKzRhqtP1Vudt1F/D5cWKVqQp +vQl/XW/uQS2IsgEWsbRmIAEZIUOy4TnuF494C/A+1BbJBdUr4Nl9zPH2bjrJeqYk +TsvGQr1icgO4pUg5oC456htkqCxCuPRqqrGDAZBx54TldgPwvCo31+aPQJlOlWvI +uWD/depp0De3oTK9FDnHh3swE0vyn4Ht96+vM+KNnDYgJ1FEaw1efYePFACobvEB +o2ZpLbnDyqAT4MzfHpHSbwzUOk52ZOnkl/KrUIOxhXtf4dxRS6J70Rzb+HWS3rY/ +LgaMO5Q0BJfbvknguKmE8dO8jx0pTlVER9ujqp+bVPXmFMha1j8vyGhJ3eLJZaRL +k3jgfRjiUUb4lNp+hXpvBwIYeFWl5kFVKg2aPywgnnFWiEYEExECAAYFAlBq4WgA +CgkQ4J/vJdlkhKxmjQCfevlawFaGTx58nDFN+4j/2U6uaGcAn2g1sZcTUrEEYHdL +byAyw1GNLksOiF4EEBEIAAYFAk99mCMACgkQ/2iSBAM3HxDivAD+Lu8U54iGgL5+ +h9KpeV+ZlHgIpj4cD+BVL85L6AQ3GP0A/1TwZ1tS6Ag3ut2G6AL2wewR3v9Mgu68 +E0M5esz5of4oiQEcBBMBAgAGBQJPh9ZuAAoJEBliWhMliBCHMSUH/30V/E930OTT +oWeq+QKkTJuMF0lrA5NaAy+xWtrynMKoiAuM0KFNGPfrPehkoxR4D+MKXH+xh0j2 +bHl6fXOHJCKZLhCtsC/o8j7kkjIJjixBlwYMul21rxecke7Zt4XpxHARJx4208Lk +ztpzOd7ZnDP6KYav3itpxK8Eyj4g8N2omoTQ2Dcd+sCa0jgRkyskpPxdt0fK0D04 +XW7b1LZkxwzwrAGSpjAZVzpKBXANcSmUQDAaIhGvYSKoiwVe2eaE5lUmvAaJQaTr +Ud/LCIwFofTLSaBRX8fEOe+UwvW36VtynPyETyROeTMp//Cm5e2CQVPoDv79soyi +E/oUW9DFDhCJARwEEwECAAYFAk+Oe6EACgkQlGXZM5TcxIlIRwf/VjfbN3eVf648 +vXvDctsXfucl37i6Yue2COJiGYuZOrN7wYxVvH2to8P3V53YV9OqDpJl2NXUro1V +iUjFHuIKp23VbtyBAYsrLeTMmHLjnXlaUPSr6JUDHUQhCF34BTk17e9y7tXlEshF +YVyPlGum7JhyarHB2rRdjQk8kyTqmQ4yHjw/nP/HlvVxdgb+mTmudTPVBafOT1R9 +MJ/SN2x4bclT4cQ0hjNEy/TsFzVduQj8yNOMFG9r6p1Vb+u1wn3BTANIh55R9aDh +3JFFIV/jBTkxukxR5iyGQiR53nl0e0qnQFxpfhFGclh0RktjrHZ3DBAzcuYXp540 +Vu9aq9QuPIkCHAQQAQIABgUCT4bdRgAKCRDCPZG7HYJE34FtEACfqPwWSItk1lNX +E0HOM1YuHXFfMGURF1AotskJatwtjGy9oDUQkjfsPROnWjgH9s0xD2UmlTrjJfWi +BdH0kTLiExVUOmvnM9VFMRhYxQZMwiHecm4FZ5IWUz4e05oGCkHFbMswXEoEG+qq +btOfLNpX67yy/JM6We+8PiXV/c2vaErpH5S8YChb5wD9lEWNM2aPBOUmbzONM1/f +EFd8AF6fUVYN7htuyG1n5zTv+oowmO2c0terJRGmMgVuLugIEnKKhaQ+H1K6bdZJ +7mX4xxx5izEyYeYhi9DhBHSwCLhWR+Yilqkc5U0nrF+3Z+Cb9THHppi071OIQ7pX +rGsQSpDzGRXCw0nKEBm0Li13re8cOoHMlPD0RHWZEIRZGSYX1YKBtVuv4kpSq8GN +85lZSDKGRNtbJBS7Qj4vyOlOrBO1eyyd4lepQCe2Ri3gU97rek52tOM+fAIibz7V +b4a0qbbphrz6PVMbDGiBxM92+YpdDyZGyL7wJ4g6DhRRcEUQahlZ1n7y+YQ60ETs +zt7+kD08Zi2BoJpiMHsFfoas2pot7VePFxGutwvq0p+OHSVlwkLgOaORPHumLA8u +J3BGlJTHsErUB2EEgdc/Tv1vsZzEI3Zi+hqw1gcbke21Ii8aDfshbeKW9hYJAhnW +m8VdF3n80UX5Eg56iybrLCjEyiAEYYkCHAQQAQIABgUCT7yYRAAKCRBOBfZjp6Qb +nnyTD/4gVbq8H5ka7fVdSAnX65/kFn5xkqGzbpCkjcqe/5uI2CvdYtjeQ4K6sm7I +5RLoyu/EE/JPbCRHiucsEak42WAZSRte/Wn2yTQpIb0mQ0wXJvuM+Hx7DSx2R12P +9rIZ4mGo/rEtdG7Y9Vog9M/XGx7w5IqSw2DF2yiYQJXsOzHjphfYB8JfoqjW/73k +n4E2IRJtCuWhfiJZJ+GEGceSBIredH3o01ThtbAeh/gzPRF3FU1361zyA1sXtmGe +qwnhNL1spHRlpub3cvAXQ8RSYrNdiFZB5zohNt+iL+qzVWaUJo+vYZal1Co5/roI +HN5nJef8kp1ngaYKvf1hIVvsdQsilVQIXKFWMd47aU6W8gPr1W2+U4yw+q+OXari +eo7gpH7/OvMSe/3wOhGVD8KJrMwAVnr3M4wo2CM6zlwxPGdltQI+IxDD8NTGTmNT +rRARYRQaFQyqd1SrVt4sSkeoegrpOG4oWXya/v4SeXHD4vt8vvvX3A4szB73a355 +IfbyRXDER3EfFfW5c+BnR3bxhfATTE6T0AKz1Gq30Xm2ycTGYCAZ2yBKewaegTpx +3O/E6APTXUnVWTIPQay8T4iVUiLFs7W1UFMY/RvmIvKKFIQWcm5O0L+27PJK+YSx +Uoo1Ivt1pclTuetbRbN8VnR3K9Pp5uZ4KLz6ZkffmJg2sOSu74kCHAQSAQgABgUC +WWMlagAKCRAyfirUINN1OOtFD/4jW0ZMGigpruCnvY0nr47rA12X6dJ6+KIBE+XB +QxuaQRjM5u44geksDwrqZ0nXrNvsa4SVwAhKVOrgMJVdzvUa1m2yeNCFHOTjln6Q +GjZ5f3a6aj6n/X5tlPptdklUr9ucEwXVd5fFMpWAiwaqZt38I2u0Pi+/qHDt0kLy +RSukmRPzRuS/kO1ugGO4aoO+sanVDl2Pq6LIwubL1Unk2HUerg8VCAyQrxYtZtHc +coyhmBTlAb+EmZnUVbQZ3Uy3eA89OuNTBhJWCk8vqROFm257MiH6gvG/V8CTrJfz +lpE+s9E6kxXhXpQWZUwtwWObq7vrJVkJhRwBsO9N2erxe+biBauFErYQPw3bg6xL +1BJLxDWnKUlMWs5o+h7lyjp+1B/gbnnlrUIlpW8IKVZRHwRUPGRN07SbbEO1lDk5 +uJDMk+r2KrOUNVYCEp794P014xodkLvB8X7ml6tcABE4V9d4uVDX3SsktOLMvtWg +nL6xWMoBYiVOXi3Rsm8vESBOb8JFQL/ItciUyAioM4Zjq5eqotVq90HMBO9kqcjC +YsYEs6RACRmyE+TNmzGoucIPTwPEi5Ib4gj+LG6iPOBprk5DSjD7F0/wnQPoq8PY +HIufb4+PgOXKf/ROQXDRLeD6eZBtPcDUJOgW19m7QcXZ8fvo6B91COe9jTF/H/i3 +A7NjR4kCHAQTAQgABgUCUQZ8hwAKCRDZsFd72T6Y/MoUD/9xxmXbPL2Zto6qECXs +Q1GFuydiYlURxDsVUiuc1tSgEoDb8XcXl37l/IKX1QmcpvHMPzeT0g8sNwIXSnL6 +BNCnFcfrd0tEz8uBPxVnzMiGwaHP1kB6Vs6sNV31+CJcTz8BHHbOdXZnhHqXSb02 +SonqAYeWVSlE08Ejvq0HIWRn6NIGdGqv6icBExryJjS3ZChRFpvgAJwsVO5f6BKH +oZnEn79uQR4XPHwuxRbm4hf6iYEbOhE7Hod6kTzS9vYIhyuTFTz5Kz/YxlMoZX/j +TIYsX0nZ3r+Tshur8iUXJhKvvXVlGyrGO2HXfEuIpJqEx4/qM9jUNP0EE7aPzZ6f +BP7Xq49Dx9lnZuSQ1jeXxEEpO+AND2xmnjCHr3EfgYZrrhCSxMQhvJh7wypkzu30 +D41BHPOPSotmM7WLceHWmYui0Wuq9X2hom5jq11XwACEtmNiP/odXjF0ovfK0d8l +j/kivgrXAZdN/ONJapVSLkRMS71S6eln+urR9HfswEfM7IPt0cRwN1oNIhXmK14+ +XBWvvwvalfuxG2UfxD8K0JXMwARlpGlV8lXpuzDV8EcrvLipKpqiQWaJer64kaQb +8qHEtT6+JNoGkymohrfeVagxKmPzDWR4v1a9lgZwY1FTRHNVPM0P8LWlN9q0CrYc +poBwkhTMV1YJ1OBSrkM9IM2vsokCMwQTAQgAHRYhBGMZHOlBgwmGicq4237xN+yT +Ww6vBQJjLRkzAAoJEH7xN+yTWw6vZSYP/36Bt4QhRtIh6HPWbHraFSl4omnuISu6 +lTHsqhik81nbIUiLZ5e/KN6ONSgD2jfMVQOLiPTQFOoxVZvOjaHmHvMuF7BCbr90 +Afh1qXW9txuPbVkhtC6hqIMn87b8UHEnt1l5MiafQnPHhoociqaqwfls/iu0nJGu +Jf5eVMXpdeWRk+ckGkqP+tXp/0G933jibSdYqwG1Tsw9D98xnGV3a/+zIqRtJflp +HPEjHPT6rVKAZxk7gkYSSsv6ONBwZHqwe9W1I+U4t6OPkGo5kNbMPBORB6/7B2Qo +LHx3+KYZs1j6glI+F/8IX2+JSFs07saMnsDhE7w5FzmwWV2JcUt42RSf8DVub438 +jgA/Ht5yPROEJ87de78aD/t/gPq/Gm3bnUz1BW0jxBidjqg1qPOMYjC7n4dH8X0N +cRfX6tWOdSXmDBbPg/vQi6CEIhsGVisKlnrgYi1wDZExU6UVMnBNvllUu9PXye+7 +51cIbrb+fwAWiwmu+AsL0qsjxZYo+9ozOLh9wLUhxOY5MZM82alN/mlUGzEiXN3R +i7D3rDrNFHdI4LGGLbO2hjPYrG4hdNHS+6WbU6qYcpBEhrqBtnUjoVqIKP2boBLR +ara7hHqVO120s8kgGtf/AoYpggD0H4qqUy4EFNjVdcL5T08w6ldQIYo7CEa1iHFt +ML4bsPcJh8lciQIzBBIBCAAdFiEEcQCq365ubpQNLgrWVeRaWujKfIoFAmMsvIwA +CgkQVeRaWujKfIqNXA//fjCpyIPPd6RnJhagWH8XCp5NB4cCT+LqAIR5yZfz1QE8 +Qbzpoobz9ysgXZ5XjLp/lbVffGyg986j0wUtSW1+g3kJcYXBUKjSWoBwwmZgyZky +95U+uklY8CdPjSeuzr2I5X/LogHNH1378d9aEmQXBfX1uW5g4Aqgnl0OOgkCVzgs +FFOO2o1j6svrrDVG52/mwXhNRm0yYK/hFB8T3PO2IvMQGDGJLHl6N5Kl7P2jtkyF +Isi4AEzJeop/2GJYXQ+VkUTSNRKQj8oOS5qe9/0RkF9uqeamoc81n2But8MZN2fv +R7ug2EuG2LHp9/pwu5ekohXmY8EtMbVbU7TYKgduK0FMBaK36jXN4Bapakfxr1z5 +pwdDjN4QiqUefBQlG1CJ6fGrqbdAupzRRDqN974rs5HafnbxioYRYjoo4H0zC8XN +UwgmA2wrwIIY/cyNCSnUuT8yVAnroPiFgmMoL8RM7C5pHQYh0u3fXPfvNBswjXmR +pJ6mhTqG6SS4qIaPhqoZqA1iyA6+Ua3YLBDT5wqvuqNMnfLtLUvMuridmlj97cRc +srQIr022NdpafDQVAiVhZO0CRyFd/++XT35iiDoiv20+LewC0VVza466AE1fkAme +rKlurlET8U/+U0JB6IP77ErjMgCzotV8e1DJkp/M37nMeNzazAb//ovsdkNM6P6J +AjMEEwEIAB0WIQRFaBEoRJtl+IDGF5c6hKlGtLpirgUCYy3RvAAKCRA6hKlGtLpi +rvhHD/99Lvgf+CjbhwC87CoKX84MyAyBlYACCSuySQBnEsVigz8sCVyTYDx52h1h +/SEj7XfTylAfIl1CjUedH4w3hk+7IN4scmhf5eeEMvQd8q+Q/hWQcXIUpwgKOcVD +NbUgYcbakJAPtilK1CeQvDdBD+aYoMsJTsII/f7FJzwjPM1XGf5EoODUC8BtQf/W +KAVoESwwAUwN6Y5XeYSwMqu1s7IHs3yNYLV8C6A7EQPVaVVlORqI+33rKyqAhK5X +ErNvAREQPYJMfRnQlIW7alSORwdG0JBgVLgV+jvoFo4a1AQImHDDtKxs2X5BCVG1 +I687uYDBy5Assl/VxRMIUpx5+zWvXyDZX/6nlL7AMokTlyosgP4iiifBS+5KMhan +phMgnDXYIJE10V46Bdw2tjd7wMKey6BcKgfbZSvU5z+SuVnQXCyl3/blRML54I5o +EomXPg6lgVxSb6BBnaJXzx4JKgLer5uom1OGsLgPMqEHRoO3bucr2xFdtq1Zegw4 +9S3qDhQ3bn8pg9JlYwmAAhBd3Xy5cPv01mV6ompOQ38SlMCJzcAGASdMw5scaxUl +7MloV2Nl32HIzPjK47bF7aVOFX7Tz+rEFLmJCchqmUSdxi42rJyHKVRqiAlNfZ9S +9FeaEfU+vBxOHsLNqVO7ErvrTafT5fjphZqvUTqZGCUiJUjPnYkCMwQTAQgAHRYh +BOJeJUyO5NMDVUv1r+xwGh2klMXrBQJjL1NOAAoJEOxwGh2klMXrYaIP/ifHM9eU +UT6JD0m6Oa3P3T161NhOvNqr71LDSztClsWo3XX0+ZK3wpjoC6vKqgx0Cc8OL1S2 +GqwCaxb5JqWpsoqR3NW6bTqTTUGREj/e0JHDeBzv57OEUTe4ea7qzqjhCX6iyzHa +qDP9fiAogMQ7uT2oCghDV5yo4JUrG5brw8GkMLEvRSs2BEv7xFAySRaGwNj+oziZ +VzL7sBzp1bCr5cwNZVYxoo3VAv6FUcExp1TydxzPVB8/VvxOa4zrht+hFTn6mjUi +NHBc7DYECgh4jlDR6TnAdvpg0FsujTXiN6A0obOUl9jGz2uFmdY+2ojlVtzqKXoP ++PDz8o2zMrRoQYkni9VyIc536E4OFIhfO6CrThMjJjPNn22Tq+fzRYkWTrlJom9b +nOldQ1BdUXQt2QNigdzqjhZTIgF5OEOTERh80dvwIbZ+7vN00BOsuncR5GUBQerU +F6+SksVRAaOg2lyoDdxUQ+Z28RU8R/n7VjMV8ctFkQvHHLBqKkpET8LRh0C/jSNh +gB8zLPc3Oa4wTf2xZWO58S18esbYMr74vRYrsACbmwxH5Tz+L6Br70Fmcz608+IQ +ESKW3657gemZgFud3AGokzKG5AuWykSinydiZbK8MRGLsdfPUojaVIgXFqnWKtkH +At9gkD8YbqGYzuVwBnljBNRdTUMk0ClgV6pjuQINBFom2R0BEAC9k1Ky6AIe9sPP +xrgsrXRe0dyYcoHufzeU3jFssl3+S4cRuvYCzdZfRfdjfHa4n+CxTaOd7xkefwJg +GpaR9KJbu8dqHm61GIiS5ZbMCRU8FAW6ohVeDqEwFrPAzZjtO41OTpeXCrPu5H5A +Tg/kDnabzlD2H8JWAqr0DYRRhFtJUihXUey9zK03wSjUi5E1+YHUC/fOpbS+msNN +945CeQNBN4Ljap9Q183Fkh0Wm4Q8C0OS1WN8a0XtqSALRCGAZ+EV6UrmQVP9PCC4 +/J0hoKQPv2bfpBAsrUGAO3Fnsw7804i2TY7O3JA8gGDYX6fwOVJMUXdD7FX7LM2P +pESqAdPrjqmPqHT8cPfq27GYgqHv3N4hP9Rjt9wxmHYFbJT0YCHw2ZMiAO/VcvvN +miGr590ZFiQEb1MJN1r+h5UDE1CtF6nTieirSXi9oMilHlo2NY5nAItv/T9PKk4X ++kaH3UoicMxrkT34tACGwxi4VIRYWL+ZquxE+bwXqAvbGJ0p3XbyREURCaO96J/2 +w951EvZErpFRQu4zzClmoMiNbwkQ8QdesSaqjMirlHyFI8T9BZrXbPazdVNUwfyR +LFil1q/kgXjXeJDoje73UiyGhqhlVOlEbunGzCwEBzrtQdPTDeFQr476/4pe0v4u +gdNYkL/gY8Izodn47d1XH68AuRSrzwARAQABiQI2BBgBCgAgFiEE6FPBhIsBhc9C +hk3zY6itS5gsQ3MFAlom2R0CGyAACgkQY6itS5gsQ3PQSA/8CZGTxQDbD2oLkGb6 +tyECIs5A1RsfwJ9aj0R/HuEO39ki8yM88fwi8F5AfzNcmYwp0rxyYDDYM0itObSv +A9WBB8YFZ2PKT1YHrwTzWbne+spmQYDRdFt+0Kx0JLvgv7SYvQ1jNdCazixH1SAM +9O+Tn5oFybVHjRavWsQYHp1CvXY5kOHOEDHhz37pGwFvyVyFdSYS5PWT0+0XU/g6 +Uq2HeFCurhUGuDXJ6WA6Ipvmu0vbi8GpyeiWCRoG76sqbBfQ7dd0oDMUHitewWGq +LP1Kioke9hu5p9CbkjYwGZjJWZEV6WHxOmICfFcBRPeIJyO8Kfa/vVBfQZj9fhqs +3sHSfAGIdKIB3tX0qKhMRdu/QoM14YQ1yK80JTUUOcrKLDt6QJinF1UQ/OcYQqGB +CXaRk1OKGFuuij16QudnX56+aYbNPltf7cLs1O7aodQcRxmMSgxSE/2ckthPYBsX +PWuDMYZCb3e6JMWsdnCI7iPpoPFAJmId7SWJebXZxntoX6YwZ7Tx58/QMLEqxMfE +ExQTAFg8/owvxCG12KaharLr4GpLx0aU39QEJenG1LqGLwiQh9Vxsejw+MkebZJE +6zhs7XBpenrd5c9OFOtb/Goxwal/6UXz7a62jZ7wDNpJw9xOfC3/eX/56+6dLVef +RFj/LOIu9reM4boTiY2dmGj1QC25Ag0EWibSSgEQAMhQB2Q329FSozPk7V6dYBO+ +jDBMr1jHWvNMCR/2DkwXfDAKK3haSWSqr51/wua9skFRezQvc9PhgvOIJi1jsxRf +xNoM82a2OpYJdj16FG5RVQ/ApojiywNvp1YPJbmq4DfXSuUA6q+OephsFLrx2cPY +nyDQaI6mrqTBecET4cdQTZK0nKKUPj3U2bI96zTBIYK8Kr7GMKXm8R1eV8bktwHT +HyDjI7hN5EjZViYqZYDQ3jt2vC1Aj6XpFw5K7Sv6f0l91zyjfcu6Llsfo8xtRhAl +lub8EBuO6ljJ5uWqDgjqTOkDXcIAUkhUCg8ztweR15zgJQQ/On0XDcHLtyi7zuQd +xNaKYKkD3oROTqce+YbNN3qnP4bV0qa0JLlTOrE/0/zmif7Q1zYOidcmMgGeF6Gp +pGQkkxY4gSKet8kD8h4AZXGlpFu4e9sue1ENDRmgWaqSzIWudMRZ3z0/s9EGNNiW +60nwJ1NBoySeQEmnwMzAHXneRM9pRGQ1S3/CKttq/0eWEH3Y/Td9xi4DNvTXcvgJ +uUUwoclWP2PCPg3zE+EQ1q/Kt2oYrT8NcemM9EO8btNzJ/Y1wSDLFAFNikHwYjTM +86jWoeGhSM3fD9HJjfqoB41gDKvNIVlhQavhe6df4+AoCo/mGosLYAPFaHHdkmqn +eT0Y0BnTRIS9yLcO8CBVABEBAAGJBGwEGAEIACAWIQToU8GEiwGFz0KGTfNjqK1L +mCxDcwUCWibSSgIbAgJACRBjqK1LmCxDc8F0IAQZAQgAHRYhBNalthyaVTQWgpLb +Z74iCR4+9iJ1BQJaJtJKAAoJEL4iCR4+9iJ1D2AP/1VMC8KOmzPYyiFY+1xHu2rv +siB0f80GH1jXwDSM/IKvsH1axCD0hMV5sSi52epCov37czSlR3MpQjo0xK32wJB9 +26AgbzJYZO48qulDUXUhPWJ9bxiyIcxI/3KEspY1RMoWv8AfYA/qSma1cSdT4IMo +SGJzPh3RyrUpeFP5QT02oGa5TuSQPiJwy/b9u+RVOi1SSqzHMJdKzZehGays65Pd +jC8Xtf4ipdYRBr6mIyUISOB+FBkY2MttFzNDUBdDrOepyjStQLZ1vUXnYKIiSRHX +o3XTW/W8fh72o26zeDbQcALywQMZqnwtrZluzKHZxF07whKmXvw9pUHXX6hbJDvm +GVMxnB/F6grPNi/V+Bv75sKOdImgnJBUp1Jz7288SPbNQwrqFKV2ZD3f0PFmolFj +Cz/Oc+UUk+swfnsT3pV6LClTThsOH8WlKJYxZLneX75HuVx4CmT+qv6GlFQuixjc +H0LtsbbSjAx7J2LRNVtfI+2DfMcIi8KJxe69MAKGqqxDyDPSWeFrs0MHmyD6/6m+ +GTovgUT5jOZbR6GVKelW054bmby0zQevWnRieANVeFoFsnwclJnqKIRzQiGod1p1 +b8HhSCw4nOeOQSifaOf3zcnFhYyByDMOtl3/AqGoLp/61u3Bk9h+BP4VPR3RUWzc +ggjmxJM0MrLzjaSXSedjzuQQAIq9g35FGpnaB8d/EjufED1TVSOkvNK/qJ+dD4Xz +f5RvnbprofMnzfEyy8jJ1Vqc3QZQU3IDQt/Un2ZywX0OboKGAIn/gyfwdkpnxJ0j +JoxRBuMplNpfNBw+oe0nFuozO9idFozKM+SWoE051/jvGHp1FqEPLnAAGeSbWB0L +RlAsnMjc5u6+SKHeFGRKYg7U0sO7ZKbVIT4ZmRnsQLDakHwbAgfcIakh9Whj0Ou5 +r78Cs+DcM3XAdtZ04d81jV5TsveR8/Cn473c6dvPIfnA2P4uClTCaCDv+jXG2f9a +FIuJhYCO+TdYs7qjAsXWngJUebRFiHbfSuYDw92/eqLdKD1Hoff4MnW5YOtDpp6E +sdCDuINeRtUtnidw2vIPezX+xdmycXIq9Fb+GvKrIDsKu0VO8HObVviLa/RE11ds +EHYlrarj4mqzS2MhvmU79Bazg9rDDB4WVs502n3uJaf6Sod/+ke1c3ff7AUPox2n +pjH/bVmkZJsOq5EqcvlH3m2FZUHSFWS/yTR1rPuJoHBMHVc4OPlTuSqT3qmKL2vb +vD1l3D4zHZs1paRLddYXiaex4qPU/0YpP61XU070MmFGYE8Z43TbMPHu/6LYBpw9 +p5Vj3VZwn2edNl4LGx+05hIABzM23I7JoQ44uPoTbohmYXF/DUGJ6h2LYdp81AVC +lSFWuQINBE97JQcBEACpbBqvDl8J65jEhPjOWczcDVB+WfG7GBHB7T6RxSNFIahy +mDqzx73zZD6n4NnZogPDPopYdRJ56u5AfF0bDZlgebl8+VEgPHGoay74Gf6k0B+c +pEkp5PaWQHHEqXINotVg29hTsf1u0sb+yjgcc+9WHw3MtpChsgk8Rc5N8Xvr1FJc +L+xynSvUCcLIwfgvLHYPPBYGIRpvz4ek/zgHvaGftDfnyMwrMbgi8kadrSb7PQgc +eWeTL7CQN1B88TPJFqKt/QxMdXaPy+Cr3P4XVy5V3/QEVFUizrtCCqJgxHMAeCP5 +QxwYEWmA2zxUzGA/t/QUDFbccKt2BdpdKBFtHLliE+yn9FHw98JayjhAJxxeCkrp +MED9N2aGHI1q44sbmeLKQ8EuIbCamfq7fqLXgkEy8jgivv2J9YfXejjjEobGLkss +Jlxaq9JeQgFEVl6f0jJ0PgkYPd11RxTcVLy4RB417cxc9LHcoKdAtcgBTcZXPPYO +L+eM9S7rTvFTna9IdF4bbnJFNjHDMhb/9XomxxBsekpTUXEm2DGoTpO2W/jwWcZY +LVrdhikkkF8b88EdWk94fUTcFA90I+Ch0YbS8XGM/WIklrMGa0JpA4OQW5oMhKDn +gqAcV7gxRYt6ylBPVh94/AIMz++wmfqBxETFP8HMgTVEApLBLjwru9B/4lRStwAR +AQABiQIfBBgBAgAJBQJPeyUHAhsMAAoJEGOorUuYLENzegsQAL6NuhGuzQf2GELc +O5J8/BW2yF9sxHWDLrw0Pntq8D35kgGfZLB52tN3DI4NwL0vE931bXC7ovi4kHPS +sazv+WPUckYfJ7qskWVD1yDtHsADduwudJpAflfZ4VIvMJqJ7FUw5Fy9ennw/Idp +H7LC+ubn6XT6Kh9oKvVmp+BQEOsdisjVw848Thik+gS08WvAjK9m+g7++FFwKy08 +5iXuuqZpvi94eU1QPvzxzzRZz6M4gQaz+pCq/5yf6I+Hu8G+5nq2foFN+G7FRkx7 +KJmJ3SAEsG3M23V9MKWON49ZbhTe5xW+1at/TKKoNGzNIYs07jApR2/E4J57yMWj +zsAqg77hTDRiV0jhHl0DJw3RHFi3z+SrK+6ie6mrq8WEPj62q9qdM8dFs+y5X3UT +x0nxly7GjOxxhi+Nt83PAG2wVFpqmhVLuyPnruvxzyrVFc8Dvx46DiKCzt4PPK/Y ++jnVIQ7Jr2Jm2ZCpzZZT5QNJuDp46mKHlNBkvSy3q3+pM6cM8vKSuCFd9+dw3dX/ +GptLebMrPOvLVDl4Bm9hSmG7rLpJy8U8Ns8pYSS1zaxHM8KqMaPuS/Zlx1SRIj/E +afefnHd5fIlmsH9C2O5fb18SFjmD14FCLcVTG7bwh3ZfbGo9sOJSShPxppPW2OoT +jwfANmj1cSg/VFr1d4HAEc83jFgumQINBGNZjyYBEACk7biPgvCVldNWq1CwVoJa +/Fvc4T49tqxcc/sY4uVlGo6oSi4fQcXE9XKPPBuRLmvpmMWvODQLzPxJMWUfJq6L +yYFmX2U9VRTcyITdmJs8itkEaDwq8BtXkeQfUDAVSFy6V6/uvVmNWD7pGXqJE1Gx +uV44Ihlh6v2YyqSzDG/rZur771hke8VZmlKMVMs1RSeOBA3nUmvZQ58+uqkhJNYq +OeQhxGIxDOHo7QhzTG+SlX+uQq6mzACKygVJJl33toaUwVAX5R02a0u67A5wC0wh +AoLSHInc3P7ayivWV/iESAz+gMIkuvJWns/Ak14J7MTGgjD6rle7PNMsPDCCwQSc +qA8F0x4OChCixbZGZn6Mr0u8+01VCEe2IjJwVUfFI/G4n1FZ1RAdqjkHfZJeD20L +GHSbjJLcnqLLFx3LDpI5dAxo5K2kFvz0VowrB58aHoofW8/g8yZygGQ4Zpw4JnpU +maPnMTiD5yvnFzEihM5L9DuaWqSK3sb9qzoaXABYRYI7OmX4B5nmMzFteHHq0tMt +aKWf0HkAsCP0BLJcS9Oc1/0I0+gC4oKLRD8a4+kaEpNr6BXvWnj7Y1h0Zr/CZS6+ +gi34CxWMl2Q34OSqtS37mzzBu+UZxffPR0aV2RXcEpc0c5HW550Thq1NF9EmFOoy +eG4J2ox9JRANZXLh/i7mNwARAQABtCVQZXRyIExhdXRyYmFjaCA8bGF1dHJiYWNo +QHJlZGhhdC5jb20+iQJXBBMBCABBFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmNZ +jyYCGwMFCQPCZwAFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQvDkF8jUX +nPGeAA//ScQ3kJMqI6FRULXo0aF7CpafPXVWdvj+mfQMlZzuGwXXTmM42T0DXnXR +BSjstWkmOXP/UqkN7bNeXH/S3D3GCJ2l0qx8Qp6fP0FloJIbemyxNtzl7yvAE7kW +vuBuLvUdm23cntv49gAzj+ElDqCxtT6A6qaqM6r7DLUvw+G+r6gkeu1hNQbtRpEK +9Dt8tHriQyI410qFRMbi3QxU+iTJ79HXwrXiYpX7V7T+ugiU9lgIiC/hWJCo6SY4 +knt9E6zhegUWN6zErl2HY8FBM2P9eHOTqToEOAhKeM1fXZvxe3m49fGq/spmRM1R +UUl1V9WFEaMiLg/Z2rmbD8LX9YtfYlQCbEwyX2nkIP1QIcr/DEfcmCA2MXCQCgsq +I/2XS3BTLPyjuqAYnXxrk+T/Cydcg4W3ZBYI/wT56GH02TQzB/wJsn0cW6EMG46V +SDY/mZ2/gwi54G/Pqb2R3ZC9I7wQ6/FFxuu8myI/QVmEiTlvTxBoyOdNlliBQxCk +Dczs1rxd/o8Wfjo1vwRHW84jZrCP3xr7xPJWuzsrmPU8kFHTgepGoY+4b/h3jGwl +V103RpRUK4JidwHsmYDVk6pgeUH69hf0iVcbFfKiViFTR+DwjbAOxTdsFgsYYn+7 +hBj2l+pV/uzeA0akL2dkgfJc9pAf6ItRUnGC+RlntZ0Pf2NbwIS5Ag0EY1mPJgEQ +AMRQDbNHBQ376nDF8miBZOAV1txpmbHc5D/X63PNapP0P1/I7SfcJU9D3wX8c4vm +xkjEYtH23s4lmT1VLsU7PisS3MacRemm9pL2bD53hs9XQEuU9OtJsZn1ZJ+Ynh6i +5sfW1bG3OiV/TWgYXW66GwE1hn9PuP8arodUmhEft+64G2u8Xtxr5yqlQJEUThV6 +280OJrxVbduaMi5C6UNeeGE5wuhfrQ0TNYZiwQ4KYbU3QhlWhHVjJlJ5hCLiktwF +DyR24P+wlTIziWA407mo2enQT+mz3bO7Paf4mBionGsJMoADqBThf4B69BxjJ7Yg +7oQVIZ7560YIRRmNo4tk5Mhep11OtQgZjZJR6MhWDaUO17w1qScrOPRj6G1IXP1R +5NarydJpLyAVb/5WFZ5jxUGMGtq3mYn4nKbbHUg2WzvCJvPctDE6EV2vaiRy5N1f +QjsHgSa29F2feh14p4ngFCmHjpdbcdjfv6rWL8tgkSpQlDdeHRRd1q03TKAg/byP +auAHKzvV+iWlmw1f6KBWjeTn0fofmk9eeQ+P1j0a3/XTxMOjB34SzqPRWzmLPLF6 +YmujBK2gymM+JLirJFFzao1i4lgmxqkDhQoNYHXmVYEd7w+/qUYbfKwO9eJOWzuU +WajxvJ1Vgv6z4CPy9if0gwfhrx0OOcIpBE/xZU+SwQQpABEBAAGJAjwEGAEIACYW +IQS4aChHdk32DfUtmSy8OQXyNRec8QUCY1mPJgIbDAUJA8JnAAAKCRC8OQXyNRec +8a+qD/4whGQ9J+td1iLFMpNRAqvuGtTnM6shZJNnC5CB56Cu7ElIpr74sk0R98Ia +1pJlBcLALbYSrqwluZaLiRVDPdub6tGSRVssqQdZcKThz33waTru9IfLhCrRSNd0 +ZMHJaOG1ErU0noWw2d4ifVJK+vvuvMeEyNm4H5pZOYzYeikqVUYzS143cSzMEwtv +PSdP5JkTQi4WNF09khH1D+QpJoXEgVEQla7Sr955Zdt3q5OlpYxxw+X62vslZ2OM +iKZ14kWVSRbVQ+WdnjtRYS4vivB6ko9QL770jZ131hKhC/BcWpEYSjfPpVua2oKb +ccKHXheIFEJ06kGkMeeoQPxmzPRBYIw/E+d5sZp7YXDyBGOAxBeiOaOnZ8vLBzy7 +2HFng3oB3hkVGTTHq+PsHdSSaRME3QrNpDsaGeSjw62FG3I4zK985GtrXAHEzN/F +fd17srl4mcRQ+8QM/a+XbF/8ugjE/RHhhFf8sWVAPutYzVE8lF+uqcduPuq/rTcU +BuzSVjnSRfXWqCokjh+ypUpHNUO8fZDzkTLuE5rwMG1xpPueDBTzvoGDQRqc2eoX +pJnDBmdlz83zHsoR2gIHcdqyc/hCV+fTvR8E0v9ZG3Jr6RFgWdD008PsGxUevIDg +MAYFwasZSTofEnzg49/WeIFU1rGB5HZVlmOJKZnKRuBiTakEP7kCDQRjWY9xARAA +rEkjlUH4hoSQAkVJCWWk+nF+daAP5IszrGEQH7TyOVwXbRZndSPFSUqKU2kEgHbM +m+wFYoZe95h9tjDh2sLCs338pVu5Chhz3dNseTF7/rbckw2rCU+JbalEiwck7tKL +qobvbh77jnrbQnkrZNc+nMeHHLrYyc5gHW6cSn4UlU42MKmTlSeOG4Ly9wXhgaKC +heIXNX3U/D682Tffl7Gopcm7pPZF92dwY4nIpCxU2ATimkSyulbhzk2CjZ1JYUJ1 +LHctMHm9F0LEGtc1GxDShzVZP8dOWpDs9BBwZDLXxCzC4rvZ+z5BJCDFbuNTKZQ5 +JEoW2sM8yP1LLZGXz44hsab1aPrvB3vcdS5ETP6bqT5267ZiotdhUifU/pTV5ze4 +7wNuaZenQtGd9olyh2dAqOk2DQrcBQFA0gRp55b4U62hLTYXxT+7jEbSVAxeXDPR +qPvqh/4kVn86llYjV6dAoASN1wWz423QH3u4ZK+S6g8HZ0HrY2+NBYgqthb6H/X6 +FiF5VcHWstkk967g4Xt0PgN/rlCtpXh4WK9sScX/CFdOURsHlb78ZN2LexaYaVBq +QuqvfHaAPJaIElXqMheZ8aYrO6Df4yzJ+6eTs3s4PqM6EMir5waFonx5Gh50X4xL +9p7IVqgNPhQsU8Z5U5hGYbmUH766GtENv4CI1upFA1cAEQEAAYkCPAQYAQgAJhYh +BLhoKEd2TfYN9S2ZLLw5BfI1F5zxBQJjWY9xAhsgBQkDwmcAAAoJELw5BfI1F5zx +4cMP+wbjKu2xCr63oyn+lo7NqMDLBYl4zHunYTZhG/egDakVWp5Ikj5/k3i+hVSY +fUyUhqQ/b/H096ropB7GA6EzS44GS+hLMdQOJOmEbjvAP/9dJDX2FQnYZzaA2f/e +Ikgaw283oOLnmYz0x7YAW/oxlnPn+7Sg7DGGqqn3nKofDUUrowfX0tQGwkGmJJqQ +gOH/ZfU4t51UCKzF6hWRbberBI8ezp24vYngA2kGef1fCUC+EIFhoYcdHHCtC1Ti +KmOUaeB9ZMiVXkP60fmCLKObwcKTyYpAFPqM05xgsMPFaXN+fQ7YVAGpCdthk53N +5Go+QqehwLoJk77CHZxIWJIf43p3UiuH1FsuXF7OdExzIhUSiUum6MoCI8BpVwn9 +uSKfXKLOdGDR6IJI8jqdC9LYoXqxZtDhpcqD70hFWJwJzZg+U2SvxZyhOqwtKXtD +TDtee3yGzPacSAJD7mFURc/DRi62UBMiFcqO1YW/5LgC4yjtzo7MTQPkaGbQLduH +IlCKa8pHWPqaLFdMawwqNrTNHWXCD4XxijJYwdAue3NUG/utekNm82mqnbbWw/AX +URIzefQsbyqiNYMztudJ9hAS8yCdkfb9SKVIvWYPQ77tHltOZF7K/NzOGeJaJr8l +vqZCfXpWmOduTpWaD2kIvU2Kx7gB4jXdMa2ai9N+/Hdr3lLouQINBGNZj8YBEADg +Y6HOawiThxQVI+0uvAAU9yisew1SSVO6mAsQtZM7s7BpLA3RGPj3UGojZIeejA+k +fq7A+PVLBhz/kSBTtw9/s3o4rlqNzz7SLaix6XKWCpHOBs84n3/LF6u9KMMVk9vT +sjKz8iDF9mBR2bmCfLvEk0HDiMyApv5SbOsZMB8k5PWyK8HYPyMI5umEaOsaC3tA +eihO3nzAxEf3oZl53J1pIw+ecdrQLbWbH0aqKngfCddD8Q0oMr/Iwly3W49+5eqJ +oelR9/dut/dg0a3Nn1wIGYRzC62CCsF5IZwKdyPh7nilEUFpA5Vlz+HfIFch2LfR +F3Q/GZD8fKzKxhjDIdgyaWSTsMbityKxX2G/pcjshyMsZT7I3Hx7SwQfFro58s2D +FsFLEZgBhJv+nW/HckeedaveXmXdHKjtsa8+rvGADti4wohOl+N5tbpYW3/zR3AY +qlh47hG0ikUJ8Tusnu865j3Z5mE+KqS68ypRVBMRrdJl2lGPDCnXGhl2720VPNMC +/jB2Mgm/L1mvQM1jPfdC3KgokDAH5NMzKvav6A71aLSUJli3UdkGHkX5d5urs3k3 +WmCt7XeTb30MBvNzBcSYTbw2UGIRE8G0CFc3wtiWWiQKPeFXYhn0+COCoW/EXpIC +VaAuMPMgcsldM13bKGyGo3NngsNEdopNFfr0KKW5XwARAQABiQRyBBgBCAAmFiEE +uGgoR3ZN9g31LZksvDkF8jUXnPEFAmNZj8YCGwIFCQPCZwACQAkQvDkF8jUXnPHB +dCAEGQEIAB0WIQQb4sD/CJSWIxAv0lZGlYgcJUUI0QUCY1mPxgAKCRBGlYgcJUUI +0ZkHD/9TlRvAaZETf+pv4/IceeL3KHwj5lrC/gojXxN0AjhAXljLSRCu0EyICxZy +3158h4k0vwjdv8699yHEN97PdF84m81mqxOz+juKBRHFK/EwAAgOdSlzGnUYgNkm +mCROFWtjeneNWaFdEnq9MItx1OascPeyxnWMjq7LLYMSESP4tgUV5KdlaVAXR6q/ +833u27/NodkDcNH2UK+IyT+Kt/uCOoIIL4ttxo/PvZTphzV8n6s0sJJE3/BrRxgv +CTkVU6zosyJsyau8/vayQYGPuBuEQVs4Tr+vZ42izbkHgElcZv9oYjJsxaqZqqMz +fWPte7m6Pl/pvtmlhPmpZ+ej7y8SRysBV+3aHNXaE1J3sIOmYxighlgZapSjHl/A +9N/KXdoLAjIZtBAOQ2ZFyRz/c2+VUqJgwiwdxoaFaYn2eUM+HSTbZfdGXBS/yyZL +YsM+L4M2aizQvDIRXzy8vG0vpHQEvPlXL0Gg0gyk0fox0OsAP5CfXmHC/AvYOHM8 +y81X2QqDf33Au1RIgog4cLqq2wpXEARWbAj0BAMIeJoCDCu9Mz2juK1ui2wr8AZ0 +42PCUgZK6CdUI18AsvApUhPsNunF7ZOc5mFMuaEGjjWJvrTG3qyrCY73ySBiGXWo +92ZB7FXu2MzgujPBEigByqeF6IV2x0EBHw/VrcxXq6Slgmik6G0SD/48l5mGCxM0 +Wr91raB9zQlwDbtD3PCbjA6DtkMrRyAq+81g75N6uiztGPCVw9n1HoGOSjN1hAhe +SgQQlcXbDLpzfdPFowDEHclFFfUODCIOuF+FgmxlAz5Exr9JkJdozBFqRZ4iF/tf +E5sHB0rzeUcY3J6VjTsjULjE4GSg5trsOc8GHUnFn9wwwkf9nR/Mr1RYcX0GkTcy +iUskw+AoRz6svOfAWIDJY450wgD0MHZK08IfUUsYTGecoXcvWf/hITtv/Af5MpQA +wuGEDltVDeu9EAu65SZlMkkMuQD1h3KOQjUJ6nY4a4M2CQ51ggs/c+vsemxsuYlG +vSuhrfXt6HGD3dhsOEeyEvIcjjpP1Ku5mqrPhqXFli1swfohhYGGVO+fM7G3l7wF +kAIi0B1szn0K13qRqBIwjnWL+orP1KLzvczCH6yD0FZY90CDdMtM0VB6AqT4BFh6 +5+ygjA4YiA7fFYBm8510ybUcNfzU3gUIJ5pF8MdGizO54tCPSK6U+iVRY4qfCFdu +IiOZ7FUUn78VIxQUMYMrozy7kn/0PQZa7KKRbXJ8sg0sgrQapwpgUjdMwuYZPGGv +1Jw5/+WUGWMbGxmlpHcEOmsPZpITH557M/kHyk9Ud0iKwciBI2mGLxiafCuLrUY4 +TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfg== +=I8Dr +-----END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/policycoreutils.spec b/policycoreutils.spec index 7560357..4e62550 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -15,6 +15,8 @@ Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz.asc +Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -67,6 +69,7 @@ BuildRequires: desktop-file-utils dbus-devel glib2-devel BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip BuildRequires: systemd BuildRequires: git-core +BuildRequires: gnupg2 Requires: util-linux grep gawk diffutils rpm sed Requires: libsepol >= %{libsepolver} coreutils libselinux-utils >= %{libselinuxver} @@ -87,6 +90,7 @@ load_policy to load policies, setfiles to label filesystems, newrole to switch roles. %prep -p /usr/bin/bash +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ diff --git a/sources b/sources index 322ed2e..80536c5 100644 --- a/sources +++ b/sources @@ -3,3 +3,4 @@ SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2 SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 SHA512 (selinux-3.7.tar.gz) = f16c3731e27a09306147ffd5b929f55357642da663326edf5837885b36e8fe763ba6a1d18e8ae4001f6091545d06bb11f2d9ed78d69711c0211fbb406bc52345 +SHA512 (selinux-3.7.tar.gz.asc) = d433765388e40b80429eb74784bf107457ef0dd8bdbc2c35c2ad3e687da11d4526a513e344bc6404383cbc61d9ac8e6a8aa5ce8a535db06ce4e2f11aa5b38056 From 853954a187f8d6a4038c180b9bcd679cae8f9cd8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 27 Jun 2024 18:01:13 +0200 Subject: [PATCH 52/79] Move changelog to changelog and use %autochangelog https://docs.pagure.org/Fedora-Infra.rpmautospec/autochangelog.html `rpmautospec generate-changelog` can be used to preview how the generated changelog will look [skip changelog] --- changelog | 5178 +++++++++++++++++++++++++++++++++++++++++ policycoreutils.spec | 5179 +----------------------------------------- 2 files changed, 5179 insertions(+), 5178 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..16332d6 --- /dev/null +++ b/changelog @@ -0,0 +1,5178 @@ +* Thu Jun 27 2024 Petr Lautrbach - 3.7-1 +- SELinux userspace 3.7 release + +* Fri Jun 07 2024 Python Maint - 3.6-5 +- Rebuilt for Python 3.13 + +* Thu May 09 2024 Petr Lautrbach - 3.6-4 +- Add Wayland support + +* Thu Jan 25 2024 Fedora Release Engineering - 3.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Dec 14 2023 Petr Lautrbach - 3.6-1 +- SELinux userspace 3.6 release + +* Thu Nov 23 2023 Petr Lautrbach - 3.6-0.rc2.1 +- SELinux userspace 3.6-rc2 release + +* Tue Nov 14 2023 Petr Lautrbach - 3.6-0.rc1.1 +- SELinux userspace 3.6-rc1 release + +* Mon Oct 30 2023 Petr Lautrbach - 3.5-8 +- Update translations + https://translate.fedoraproject.org/projects/selinux/ + +* Tue Aug 1 2023 Petr Lautrbach - 3.5-7 +- python: improve format strings for proper localization +- python: Drop hard formating from localized strings +- sepolicy: port to dnf4 python API (rhbz#2209404) + +* Fri Jul 21 2023 Fedora Release Engineering - 3.5-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jun 21 2023 Vit Mojzis - 3.5-5 +- python/sepolicy: Fix spec file dependencies +- python/sepolicy: Fix template for confined user policy modules +- Improve man pages and add examples + +* Tue Jun 13 2023 Python Maint - 3.5-4 +- Rebuilt for Python 3.12 + +* Fri May 26 2023 Miro Hrončok - 3.5-3 +- Fix build with pip 23.1.2+ +- Fixes: rhbz#2209016 + +* Wed May 10 2023 Tomas Popela - 3.5-2 +- Drop unused BR on dbus-glib and explicitly BR glib2 + +* Fri Feb 24 2023 Petr Lautrbach - 3.5-1 +- SELinux userspace 3.5 release + +* Mon Feb 13 2023 Petr Lautrbach - 3.5-0.rc3.1 +- SELinux userspace 3.5-rc3 release + +* Wed Feb 8 2023 Petr Lautrbach - 3.5-0.rc2.3 +- Attach tty to selinux-autorelabel.service when AUTORELABEL=0 + +* Thu Jan 26 2023 Vit Mojzis - 3.5-0.rc2.2 +- python/sepolicy: Cache conditional rule queries + +* Fri Jan 20 2023 Fedora Release Engineering - 3.5-0.rc2.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Jan 16 2023 Petr Lautrbach - 3.5-0.rc2.1 +- SELinux userspace 3.5-rc2 release + +* Fri Dec 23 2022 Petr Lautrbach - 3.5-0.rc1.1 +- SELinux userspace 3.5-rc1 release + +* Mon Nov 21 2022 Petr Lautrbach - 3.4-7.1 +- Rebase on upstream f56a72ac9e86 +- sepolicy: fix sepolicy manpage -w +- sandbox: add -R option to alternate XDG_RUNTIME_DIR +- Remove dependency on the Python module distutils + +* Tue Aug 2 2022 Petr Lautrbach - 3.4-6 +- Run autorelabel in parallel by default + https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel + +* Mon Jul 25 2022 Petr Lautrbach - 3.4-5 +- gettext: handle unsupported languages properly (#2100378) +- semodule: rename --rebuild-if-modules-changed to --refresh +- python: Split "semanage import" into two transactions (#2063353) +- selinux-autorelabel: Do not force reboot (#2093133) + +* Fri Jul 22 2022 Fedora Release Engineering - 3.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 13 2022 Python Maint - 3.4-3 +- Rebuilt for Python 3.11 + +* Wed May 25 2022 Petr Lautrbach - 3.4-2 +- rebuilt + +* Thu May 19 2022 Petr Lautrbach - 3.4-1 +- SELinux userspace 3.4 release + +* Tue May 10 2022 Petr Lautrbach - 3.4-0.rc3.1 +- SELinux userspace 3.4-rc3 release + +* Thu Apr 21 2022 Petr Lautrbach - 3.4-0.rc.1 +- SELinux userspace 3.4-rc2 release + +* Wed Apr 13 2022 Petr Lautrbach - 3.4-0.rc.1 +- SELinux userspace 3.4-rc1 release + +* Tue Feb 22 2022 Petr Lautrbach - 3.3-5 +- Improve error message when selabel_open fails + +* Sat Feb 19 2022 Petr Lautrbach - 3.3-4 +- semodule: add command-line option to detect module changes +- fixfiles: Use parallel relabeling + +* Fri Jan 21 2022 Fedora Release Engineering - 3.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Mon Nov 29 2021 Petr Lautrbach - 3.3-2 +- setfiles/restorecon: support parallel relabeling with -T option +- semodule: add -m | --checksum option + +* Fri Oct 22 2021 Petr Lautrbach - 3.3-1 +- SELinux userspace 3.3 release + +* Mon Oct 11 2021 Petr Lautrbach - 3.3-0.rc3.1 +- SELinux userspace 3.3-rc3 release + +* Wed Sep 29 2021 Petr Lautrbach - 3.3-0.rc2.1 +- SELinux userspace 3.3-rc2 release + +* Tue Aug 3 2021 Petr Lautrbach - 3.2-6 +- Drop forgotten ru/ man pages from -restorecond + +* Wed Jul 28 2021 Petr Lautrbach - 3.2-5 +- Rebase on upstream commit 32611aea6543 + +* Fri Jul 23 2021 Fedora Release Engineering - 3.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Jun 03 2021 Python Maint - 3.2-3 +- Rebuilt for Python 3.10 + +* Mon May 10 2021 Petr Lautrbach - 3.2-2 +- Do not use Python slip +- fixfiles: do not exclude /dev and /run in -C mode +- dbus: use GLib.MainLoop + +* Mon Mar 8 2021 Petr Lautrbach - 3.2-1 +- SELinux userspace 3.2 release + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.2-0.rc2.1.1 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Fri Feb 5 2021 Petr Lautrbach - 3.2-0.rc2.1 +- SELinux userspace 3.2-rc2 release + +* Wed Jan 27 2021 Fedora Release Engineering - 3.2-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jan 20 2021 Petr Lautrbach - 3.2-0.rc1.1 +- SELinux userspace 3.2-rc1 release + +* Tue Nov 24 2020 Petr Lautrbach - 3.1-8 +- Fix BuildRequires to libsemanage-devel + +* Fri Nov 20 2020 Petr Lautrbach - 3.1-7 +- python/sepolicy: allow to override manpage date +- selinux_config(5): add a note that runtime disable is deprecated + +* Mon Nov 9 2020 Petr Lautrbach - 3.1-6 +- Require latest setools + +* Fri Oct 30 2020 Petr Lautrbach - 3.1-5 +- Build with libsepol.so.1 and libsemanage.so.2 +- Set X-GNOME-HiddenUnderSystemd=true in restorecond.desktop file +- fixfiles: correctly restore context of mountpoints +- sepolgen: print extended permissions in hexadecimal + +* Sat Aug 01 2020 Fedora Release Engineering - 3.1-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 14 2020 Tom Stellard - 3.1-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Fri Jul 10 2020 Petr Lautrbach - 3.1-1 +- SELinux userspace 3.1 release + +* Mon Jun 1 2020 Petr Lautrbach - 3.0-4 +- policycoreutils-dbus requires python3-gobject-base + +* Sat May 23 2020 Miro Hrončok - 3.0-3 +- Rebuilt for Python 3.9 + +* Thu Jan 30 2020 Fedora Release Engineering - 3.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Dec 6 2019 Petr Lautrbach - 3.0-1 +- SELinux userspace 3.0 release + +* Wed Sep 4 2019 Petr Lautrbach - 2.9-7 +- semanage: Do not use default s0 range in "semanage login -a" (#1312283) + +* Thu Aug 29 2019 Petr Lautrbach - 2.9-6 +- gui: Fix remove module in system-config-selinux (#1740936) + +* Fri Aug 23 2019 Petr Lautrbach - 2.9-5 +- fixfiles: Fix unbound variable problem + +* Fri Aug 16 2019 Miro Hrončok - 2.9-4 +- Rebuilt for Python 3.8 + +* Mon Aug 5 2019 Petr Lautrbach - 2.9-3 +- Drop python2-policycoreutils +- Update ru man page translations +- fixfiles: Fix [-B] [-F] onboot + +* Fri Jul 26 2019 Fedora Release Engineering - 2.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Mar 18 2019 Petr Lautrbach - 2.9-1 +- SELinux userspace 2.9 release + +* Mon Mar 11 2019 Petr Lautrbach - 2.9-0.rc2.1 +- SELinux userspace 2.9-rc2 release + +* Sat Feb 02 2019 Fedora Release Engineering - 2.9-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 25 2019 Petr Lautrbach - 2.9-0.rc1.1 +- SELinux userspace 2.9-rc1 release candidate + +* Fri Jan 25 2019 Petr Lautrbach - 2.8-17 +- python2-policycoreutils requires python2-ipaddress (#1669230) + +* Tue Jan 22 2019 Petr Lautrbach - 2.8-16 +- restorecond: Install DBUS service file with 644 permissions + +* Mon Jan 21 2019 Petr Lautrbach - 2.8-15 +- setsebool: support use of -P on SELinux-disabled hosts +- sepolicy: initialize mislabeled_files in __init__() +- audit2allow: use local sepolgen-ifgen-attr-helper for tests +- audit2allow: allow using audit2why as non-root user +- audit2allow/sepolgen-ifgen: show errors on stderr +- audit2allow/sepolgen-ifgen: add missing \n to error message +- sepolgen: close /etc/selinux/sepolgen.conf after parsing it +- sepolicy: Make policy files sorting more robust +- semanage: Load a store policy and set the store SELinux policy root + +* Thu Dec 20 2018 Petr Lautrbach - 2.8-14 +- chcat: fix removing categories on users with Fedora default setup +- semanage: Include MCS/MLS range when exporting local customizations +- semanage: Start exporting "ibendport" and "ibpkey" entries +- semanage: do not show "None" levels when using a non-MLS policy +- sepolicy: Add sepolicy.load_store_policy(store) +- semanage: import sepolicy only when it's needed +- semanage: move valid_types initialisations to class constructors + +* Mon Dec 10 2018 Petr Lautrbach - 2.8-13 +- chcat: use check_call instead of getstatusoutput +- Use matchbox-window-manager instead of openbox +- Use ipaddress python module instead of IPy +- semanage: Fix handling of -a/-e/-d/-r options +- semanage: Use standard argparse.error() method + +* Mon Nov 12 2018 Petr Lautrbach - 2.8-12 +- sepolicy,semanage: replace aliases with corresponding type names +- sepolicy-generate: Handle more reserved port types +- Fix RESOURCE_LEAK coverity scan defects + +* Tue Oct 16 2018 Petr Lautrbach - 2.8-11 +- sepolicy: Fix get_real_type_name to handle query failure properly +- sepolicy: search() for dontaudit rules as well + +* Tue Oct 2 2018 Petr Lautrbach - 2.8-10 +- semanage: "semanage user" does not use -s, fix documentation +- semanage: add a missing space in ibendport help +- sepolicy: Update to work with setools-4.2.0 + +* Fri Sep 14 2018 Petr Lautrbach - 2.8-9 +- semanage: Stop rejecting aliases in semanage commands +- sepolicy: Stop rejecting aliases in sepolicy commands +- sepolicy: Fix "info" to search aliases as well +- setfiles: Improve description of -d switch + +* Wed Sep 12 2018 Petr Lautrbach - 2.8-8 +- Update translations + +* Tue Sep 4 2018 Petr Lautrbach - 2.8-7 +- Fix typo in newrole.1 manpage +- sepolgen: print all AV rules correctly +- sepolgen: fix access vector initialization +- Add xperms support to audit2allow +- semanage: Stop logging loginRecords changes +- semanage: Fix logger class definition +- semanage: Replace bare except with specific one +- semanage: fix Python syntax of catching several exceptions +- sepolgen: return NotImplemented instead of raising it +- sepolgen: fix refpolicy parsing of "permissive" + +* Mon Aug 6 2018 Petr Lautrbach - 2.8-6 +- Use split translation files + https://github.com/fedora-selinux/selinux/issues/43 + +* Fri Jul 13 2018 Fedora Release Engineering - 2.8-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Mon Jul 02 2018 Miro Hrončok - 2.8-4 +- Rebuilt for Python 3.7 + +* Mon Jun 18 2018 Petr Lautrbach - 2.8-3 +- selinux-autorelabel: Use plymouth --quit rather then --hide-splash (#1592221) +- selinux-autorelabel: Increment boot_indeterminate grub environment variable (#1592221) + +* Fri Jun 15 2018 Miro Hrončok - 2.8-2 +- Rebuilt for Python 3.7 + +* Fri May 25 2018 Petr Lautrbach - 2.8-1 +- SELinux userspace 2.8 release + +* Tue May 22 2018 Petr Lautrbach - 2.8-0.rc3.2 +- selinux-autorelabel: set UEFI boot order (BootNext) same as BootCurrent +- selinux-autorelabel: synchronize cached writes before reboot (#1385272) + +* Tue May 15 2018 Petr Lautrbach - 2.8-0.rc3.1 +- SELinux userspace 2.8-rc2 release candidate + +* Fri May 4 2018 Petr Lautrbach - 2.8-0.rc2.1 +- SELinux userspace 2.8-rc2 release candidate + +* Mon Apr 23 2018 Petr Lautrbach - 2.8-0.rc1.1 +- SELinux userspace 2.8-rc1 release candidate + +* Thu Apr 19 2018 Petr Lautrbach - 2.7-20 +- Drop python2 sepolicy gui files from policycoreutils-gui (#1566618) + +* Wed Apr 18 2018 Iryna Shcherbina - 2.7-19 +- Update Python 2 dependency declarations to new packaging standards + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + +* Tue Apr 3 2018 Petr Lautrbach - 2.7-18 +- Move semodule_* utilities to policycoreutils package (#1562549) + +* Thu Mar 22 2018 Petr Lautrbach - 2.7-17 +- semanage/seobject.py: Fix undefined store check (#1559174) + +* Fri Mar 16 2018 Petr Lautrbach - 2.7-16 +- Build python only subpackages as noarch +- Move semodule_package to policycoreutils-devel + +* Tue Mar 13 2018 Petr Lautrbach - 2.7-15 +- sepolicy: Fix translated strings with parameters +- sepolicy: Support non-MLS policy +- sepolicy: Initialize policy.ports as a dict in generate.py +- gui/polgengui.py: Use stop_emission_by_name instead of emit_stop_by_name +- Minor update for bash completion +- semodule_package: fix semodule_unpackage man page +- gui/semanagePage: Close "edit" and "add" dialogues when successfull +- gui/fcontextPage: Set default object class in addDialog\ +- sepolgen: fix typo in PolicyGenerator +- build: follow standard semantics for DESTDIR and PREFIX + +* Mon Feb 26 2018 Petr Lautrbach - 2.7-14 +- Use Fedora RPM build flags (#1548740) + +* Tue Feb 20 2018 Petr Lautrbach - 2.7-13 +- Fix mangling of python shebangs + +* Mon Feb 19 2018 Miro Hrončok - 2.7-12 +- Rename the python3 subpackage to have prefix, not suffix +- Use python3 prefixes in requires where possible + +* Thu Feb 15 2018 Petr Lautrbach - 2.7-11 +- Rewrite selinux-polgengui to use Gtk3 +- Drop python2 and gnome-python2 from gui Requires + +* Fri Feb 09 2018 Fedora Release Engineering - 2.7-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Wed Jan 31 2018 Petr Lautrbach - 2.7-9 +- Require audit-libs-python2 + +* Thu Jan 18 2018 Igor Gnatenko - 2.7-8 +- Remove obsolete scriptlets + +* Wed Dec 20 2017 Petr Lautrbach - 2.7-7 +- semanage: bring semanageRecords.set_reload back to seobject.py (#1527745) + +* Wed Dec 13 2017 Petr Lautrbach - 2.7-6 +- semanage: make seobject.py backward compatible +- Own %%{pythonX_sitelib}/site-packages/sepolicy directories (#1522942) + +* Wed Nov 22 2017 Petr Lautrbach - 2.7-5 +- sepolicy: Fix sepolicy manpage +- semanage: Update Infiniband code to work on python3 +- semanage: Fix export of ibendport entries +- semanage: Enforce noreload only if it's requested by -N option + +* Fri Oct 20 2017 Petr Lautrbach - 2.7-4 +- restorecond: check write() and daemon() results +- sepolicy: do not fail when file_contexts.local or .subs do not exist +- sepolicy: remove stray space in section "SEE ALSO" +- sepolicy: fix misspelling of _ra_content_t suffix +- gui: port to Python 3 by migrating to PyGI +- gui: remove the status bar +- gui: fix parsing of "semodule -lfull" in tab Modules +- gui: delete overridden definition of usersPage.delete() +- Enable listing file_contexts.homedirs (#1409813) +- remove semodule_deps + +* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 2.7-3 +- Also add Provides for the old name without %%_isa + +* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 2.7-2 +- Python 2 binary package renamed to python2-policycoreutils + See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 + +* Mon Aug 07 2017 Petr Lautrbach - 2.7-1 +- Update to upstream release 2017-08-04 +- Move DBUS API from -gui to -dbus package + +* Thu Aug 03 2017 Fedora Release Engineering - 2.6-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Sun Jul 30 2017 Florian Weimer - 2.6-8 +- Rebuild with binutils fix for ppc64le (#1475636) + +* Fri Jul 28 2017 Petr Lautrbach - 2.6-7 +- Make 'sepolicy manpage' and 'sepolicy transition' faster +- open_init_pty: restore stdin/stdout to blocking upon exit +- fixfiles: do not dereference link files in tmp +- fixfiles: use a consistent order for options to restorecon +- fixfiles: don't ignore `-F` when run in `-C` mode +- fixfiles: remove bad modes of "relabel" command +- fixfiles: refactor into the `set -u` dialect +- fixfiles: if restorecon aborts, we should too +- fixfiles: usage errors are fatal +- fixfiles: syntax error +- fixfiles: remove two unused variables +- fixfiles: tidy up usage(), manpage synopsis +- fixfiles: deprecate -l option +- fixfiles: move logit call outside of redirected function +- fixfiles: fix logging about R/O filesystems +- fixfiles: clarify exclude_dirs() +- fixfiles: remove (broken) redundant code + + +* Thu Jul 27 2017 Fedora Release Engineering - 2.6-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Thu Apr 06 2017 Petr Lautrbach - 2.6-5 +- semanage: Unify argument handling (#1398987) +- setfiles: set up a logging callback for libselinux +- setfiles: Fix setfiles progress indicator +- setfiles: stdout messages don't need program prefix +- setfiles: don't scramble stdout and stderr together (#1435894) +- restorecond: Decrease loglevel of termination message (#1264505) +- fixfiles should handle path arguments more robustly +- fixfiles: handle unexpected spaces in command +- fixfiles: remove useless use of cat (#1435894) +- semanage: Add checks if a module name is passed in (#1420707) +- semanage: fix export of fcontext socket entries (#1435127) +- selinux-autorelabel: remove incorrect redirection to /dev/null (#1415674) + +* Fri Mar 17 2017 Petr Lautrbach - 2.6-4 +- Fix selinux-polgengui (#1432337) +- sepolicy - fix obtaining domain name in HTMLManPages + +* Tue Feb 28 2017 Petr Lautrbach - 2.6-3 +- Fix several issues in gui and 'sepolicy manpage' (#1416372) + +* Thu Feb 23 2017 Petr Lautrbach - 2.6-2 +- Use %%{__python3} instead of python3 + +* Mon Feb 20 2017 Petr Lautrbach - 2.6-1.1 +- Fix pp crash when processing base module (#1417200) +- Update to upstream release 2016-10-14 + +* Wed Feb 15 2017 Igor Gnatenko - 2.5-22 +- Rebuild for brp-python-bytecompile + +* Sat Feb 11 2017 Fedora Release Engineering - 2.5-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Dec 21 2016 Kevin Fenzi - 2.5-20 +- Rebuild for python 3.6 + +* Thu Dec 01 2016 Petr Lautrbach - 2.5-19 +- seobject: Handle python error returns correctly +- policycoreutils/sepolicy/gui: fix current selinux state radiobutton +- policycoreutils: semodule_package: do not fail with an empty fc file + +* Tue Nov 22 2016 Petr Lautrbach - 2.5-18 +- Update translations +- Fix fcontextPage editing features (#1344842) + +* Mon Oct 03 2016 Petr Lautrbach 2.5-17 +- sandbox: Use dbus-run-session instead of dbus-launch when available +- hll/pp: Change warning for module name not matching filename to match new behavior +- Remove LDFLAGS from CFLAGS +- sandbox: create a new session for sandboxed processes +- sandbox: do not try to setup directories without -X or -M +- sandbox: do not run xmodmap in a new X session +- sandbox: Use GObject introspection binding instead of pygtk2 +- sandbox: fix file labels on copied files +- sandbox: tests - close stdout of p +- sandbox: tests - use sandbox from cwd +- audit2allow: tests should use local copy not system +- audit2allow: fix audit2why import from seobject +- audit2allow: remove audit2why so that it gets symlinked +- semanage: fix man page and help message for import option +- semanage: fix error message for fcontext -m +- semanage: Fix semanage fcontext -D +- semanage: Correct fcontext auditing +- semanage: Default serange to "s0" for port modify +- semanage: Use socket.getprotobyname for protocol +- semanage: fix modify action in node and interface +- fixfiles: Pass -n to restorecon for fixfiles check +- sepolicy: Check get_rpm_nvr_list() return value +- Don't use subprocess.getstatusoutput() in Python 2 code +- semanage: Add auditing of changes in records +- Remove unused 'q' from semodule getopt string + +* Mon Aug 01 2016 Petr Lautrbach 2.5-16 +- Remove unused autoconf files from po/ +- Remove duplicate, empty translation files +- Rebuilt with libsepol-2.5-9, libselinux-2.5-11, libsemanage-2.5-7 + +* Thu Jul 21 2016 Petr Lautrbach 2.5-15 +- Fix sandbox -X issue related to python3 (#1358138) + +* Wed Jul 20 2016 Richard W.M. Jones - 2.5-14 +- Use generator approach to fix autorelabel + +* Tue Jul 19 2016 Fedora Release Engineering - 2.5-13 +- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages + +* Thu Jul 14 2016 Petr Lautrbach - 2.5-12 +- open_init_pty: Do not error on EINTR +- Fix [-s STORE] typos in semanage +- Update sandbox types in sandbox manual +- Update translations + +* Mon Jun 27 2016 Petr Lautrbach - 2.5-11 +- Convert sandbox to gtk-3 using pygi-convert.sh (#1343166) + +* Thu Jun 23 2016 Petr Lautrbach - 2.5-10 +- Fix typos in semanage manpages +- Fix the documentation of -l,--list for semodule +- Minor fix in a French translation +- Fix the extract example in semodule.8 +- Update sandbox.8 man page +- Remove typos from chcat --help +- sepolgen: Remove additional files when cleaning + +* Wed May 11 2016 Petr Lautrbach - 2.5-9 +- Fix multiple spelling errors +- Rebuild with libsepol-2.5-6 + +* Mon May 02 2016 Petr Lautrbach - 2.5-8 +- Rebuilt with libsepol-2.5-5 + +* Fri Apr 29 2016 Petr Lautrbach - 2.5-7 +- hll/pp: Warn if module name different than output filename + +* Mon Apr 25 2016 Petr Lautrbach - 2.5-6 +- Ship selinux-autorelabel utility and systemd unit files (#1328825) + +* Fri Apr 08 2016 Petr Lautrbach - 2.5-5 +- sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy files (#1319338) + +* Fri Mar 18 2016 Petr Lautrbach - 2.5-4 +- Add documentation for MCS separated domains +- Move svirt man page out of libvirt into its own + +* Thu Mar 17 2016 Petr Lautrbach - 2.5-3 +- policycoreutils: use python3 in chcat(#1318408) + +* Sat Mar 05 2016 Petr Lautrbach 2.5-2 +- policycoreutils/sepolicy: selinux_server.py to use GLib instead of gobject +- policycoreutils-gui requires python-slip-dbus (#1314685) + +* Tue Feb 23 2016 Petr Lautrbach 2.5-1 +- Update to upstream release 2016-02-23 + +* Thu Feb 04 2016 Fedora Release Engineering - 2.4-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Mon Dec 14 2015 Petr Lautrbach - 2.4-20 +- Fix 'semanage permissive -l' subcommand (#1286325) +- Several 'sepolicy gui' fixes (#1281309,#1281309,#1282382) + +* Tue Nov 17 2015 Petr Lautrbach 2.4-19 +- Require at least one argument for 'semanage permissive -d' (#1255676) + +* Mon Nov 16 2015 Petr Lautrbach 2.4-18 +- Improve sepolicy command line interface +- Fix sandbox to propagate specified MCS/MLS Security Level. (#1279006) +- Fix 'audit2allow -R' (#1280418) + +* Thu Nov 12 2015 Fedora Release Engineering - 2.4-17 +- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 + +* Mon Nov 09 2015 Petr Lautrbach 2.4-16 +- policycoreutils-gui needs policycoreutils-python (#1279046) + +* Wed Nov 04 2015 Robert Kuska - 2.4-15 +- Rebuilt for Python3.5 rebuild + +* Thu Oct 08 2015 Petr Lautrbach 2.4-14 +- Revert the attempt to port -gui to GTK 3 (#1269328, #1266059) + +* Fri Oct 02 2015 Petr Lautrbach 2.4-13 +- newrole: Set keepcaps around setresuid calls +- newrole: Open stdin as read/write + +* Fri Sep 04 2015 Petr Lautrbach 2.4-12 +- Fix several semanage issue (#1247714) +- Decode output from subprocess, if error occurred (#1247039) + +* Wed Sep 02 2015 Petr Lautrbach 2.4-11 +- audit2allow, audit2why - ignore setlocale errors (#1208529) + +* Fri Aug 21 2015 Petr Lautrbach 2.4-10 +- Port sandbox to GTK 3 and fix issue with Xephyr + +* Thu Aug 13 2015 Petr Lautrbach 2.4-9 +- Fix another python3 issues mainly in sepolicy (#1247039,#1247575,#1251713) + +* Thu Aug 06 2015 Petr Lautrbach 2.4-8 +- Fix multiple python3 issues in sepolgen (#1249388,#1247575,#1247564) + +* Mon Jul 27 2015 Petr Lautrbach 2.4-7 +- policycoreutils-python3 depends on python-IPy-python3 + +* Mon Jul 27 2015 Petr Lautrbach 2.4-6 +- policycoreutils-devel depends on policycoreutils-python-utils (#1246818) + +* Fri Jul 24 2015 Petr Lautrbach 2.4-5 +- Move python utilities from -python to -python-utilities +- All scripts originally from policycoreutils-python use python 3 now + +* Fri Jul 24 2015 Petr Lautrbach 2.4-4 +- policycoreutils: semanage: fix moduleRecords deleteall method + +* Thu Jul 23 2015 Petr Lautrbach 2.4-3 +- Improve compatibility with python 3 +- Add sepolgen module to python3 package + +* Tue Jul 21 2015 Petr Lautrbach 2.4-2 +- Add Python3 support for sepolgen module (#1125208,#1125209) + +* Tue Jul 21 2015 Petr Lautrbach 2.4-1.1 +- Update to 2.4 release + +* Wed Jul 15 2015 Petr Lautrbach 2.4-0.7 +- Fix typo in semanage args for minimum policy store + +* Fri Jul 03 2015 Petr Lautrbach 2.4-0.6 +- policycoreutils: semanage: update to new source policy infrastructure +- semanage: move permissive module creation to /tmp + +* Thu Jun 18 2015 Fedora Release Engineering - 2.3-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Wed May 06 2015 Petr Lautrbach 2.3-17 +- setfiles/restorecon: fix -r/-R option (#1211721) + +* Mon Apr 13 2015 Petr Lautrbach 2.4-0.4 +- Update to upstream 2.4 + +* Tue Feb 24 2015 Petr Lautrbach 2.3-16 +- Temporary removed Requires:audit-libs-python from policycoreutils-python3 subpackage (#1195139) +- Simplication of sepolicy-manpage web functionality (#1193552) + +* Mon Feb 02 2015 Petr Lautrbach 2.3-15 +- We need to cover file_context.XXX.homedir to have fixfiles with exclude_dirs working correctly +- Use dnf instead of yum (#1156547) + +* Tue Nov 18 2014 Dan Walsh - 2.3-14 +- Audit2allow will check for mislabeled files, and tells user to fix the label. +- Also checks for basefiles and suggests creating a different label. +- Patch from Ryan Hallisey + +* Wed Nov 5 2014 Miroslav Grepl - 2.3-13 +- Switch back to yum. Need additional fixes to make it working correctly. + +* Wed Nov 5 2014 Miroslav Grepl - 2.3-12 +- Switch over to dnf from yum + +* Tue Sep 23 2014 Miroslav Grepl - 2.3-11 +- Improvements to audit2allow from rhallise@redhat.com + * Check for mislabeled files. + * Check for base file use and + * Suggest writable files as alternatives + +* Sun Aug 17 2014 Fedora Release Engineering - 2.3-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Mon Aug 4 2014 Dan Walsh - 2.3-9 +- Remove build requires for openbox, not needed + +* Thu Jul 31 2014 Tom Callaway - 2.3-8 +- fix license handling + +* Wed Jul 23 2014 Miroslav Grepl - 2.3-7 +- Examples are no longer in the main semanage man page (#1084390) +- Add support for Fedora22 man pages. We need to fix it to not using hardcoding. +- Print usage for all mutually exclusive options. +- Fix selinux man page to refer seinfo and sesearch tools. + +* Sat Jun 07 2014 Fedora Release Engineering - 2.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Wed May 28 2014 Kalev Lember - 2.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4 + +* Tue May 20 2014 Miroslav Grepl - 2.3-4 +- Fix setfiles to work correctly if -r option is defined + +* Fri May 16 2014 Dan Walsh - 2.3-3 +- Update Miroslav Grepl Patches + * If there is no executable we don't want to print a part of STANDARD FILE CON + * Add-manpages-for-typealiased-types + * Make fixfiles_exclude_dirs working if there is a substituion for the given d + +* Mon May 12 2014 Miroslav Grepl - 2.3-2 +- If there is no executable we don't want to print a part of STANDARD FILE CONTEXT + +* Tue May 6 2014 Dan Walsh - 2.3-1 +- Update to upstream + * Add -P semodule option to man page from Dan Walsh. + * selinux_current_policy_path will return none on a disabled SELinux system from Dan Walsh. + * Add new icons for sepolicy gui from Dan Walsh. + * Only return writeable files that are enabled from Dan Walsh. + * Add domain to short list of domains, when -t and -d from Dan Walsh. + * Fix up desktop files to match current standards from Dan Walsh. + * Add support to return sensitivities and categories for python from Dan Walsh. + * Cleanup whitespace from Dan Walsh. + * Add message to tell user to install sandbox policy from Dan Walsh. + * Add systemd unit file for mcstrans from Laurent Bigonville. + * Improve restorecond systemd unit file from Laurent Bigonville. + * Minor man pages improvements from Laurent Bigonville. + +* Tue May 6 2014 Miroslav Grepl - 2.2.5-15 +- Apply patch to use setcon in seunshare from luto@mit.edu + +* Wed Apr 30 2014 Dan Walsh - 2.2.5-14 +- Remove requirement for systemd-units + +* Fri Apr 25 2014 Miroslav Grepl - 2.2.5-13 +- Fix previous Fix-STANDARD_FILE_CONTEXT patch to exclude if non_exec does not exist + +* Thu Apr 24 2014 Miroslav Grepl - 2.2.5-12 +- Add policycoreutils-rhat-revert.patch to revert the last two commits to make build working +- Add 0001-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages patch + +* Tue Apr 1 2014 Dan Walsh - 2.2.5-11 +- Update Translations + +* Thu Mar 27 2014 Miroslav Grepl - 2.2.5-10 +- Add support for Fedora21 html manpage structure +- Fix broken dependencies to require only usermode-gtk + +* Wed Mar 26 2014 Dan Walsh - 2.2.5-9 +- mgrepl [PATCH] Deleteall user customization fails if there is a user used +- for the default login. We do not want to fail on it and continue to delete +- customizations for users which are not used for default login. + +* Mon Mar 24 2014 Dan Walsh - 2.2.5-8 +- Update Translations +- Make selinux-policy build working also on another architectures related to s +- Miroslav grepl patch to fix the creation of man pages on different architectures. +- Add ability to list the actual active modules +- Fix spelling mistake on sesearch in generate man pages. + +* Fri Feb 14 2014 Dan Walsh - 2.2.5-7 +- Allow manpages to be built on aarch64 + +* Fri Feb 14 2014 Dan Walsh - 2.2.5-6 +- Don't be verbose in fixfiles if there is not tty + +* Thu Feb 13 2014 Dan Walsh - 2.2.5-5 +- Yum should only be required for policycoreutils-devel + +* Tue Jan 21 2014 Dan Walsh - 2.2.5-4 +- Update translations + +* Thu Jan 16 2014 Dan Walsh - 2.2.5-3 +- Add Miroslav patch to +- Fix previously_modified_initialize() to show modified changes properly for all selections + +* Wed Jan 8 2014 Dan Walsh - 2.2.5-2 +- Do not require /usr/share/selinux/devel/Makefile to build permissive domains + +* Mon Jan 6 2014 Dan Walsh - 2.2.5-1 +- Update to upstream + * Ignore selevel/serange if MLS is disabled from Sven Vermeulen. + +* Fri Jan 3 2014 Dan Walsh - 2.2.4-8 +- Update Tranlations +- Patch from Yuri Chornoivan to fix typos + +* Fri Jan 3 2014 Dan Walsh - 2.2.4-7 +- Fixes Customized booleans causing a crash of the sepolicy gui + +* Fri Dec 20 2013 Dan Walsh - 2.2.4-6 +- Fix sepolicy gui selection for advanced screen +- Update Translations +- Move requires checkpolicy requirement into policycoreutils-python + +* Mon Dec 16 2013 Dan Walsh - 2.2.4-5 +- Fix semanage man page description of import command +- Fix policy kit file to allow changing to permissive mode + +* Mon Dec 16 2013 Dan Walsh - 2.2.4-4 +- Fix broken dependencies. + +* Fri Dec 13 2013 Dan Walsh - 2.2.4-3 +- Break out python3 code into separate package + +* Fri Dec 6 2013 Dan Walsh - 2.2.4-2 +- Add mgrepl patch +- ptrace should be a part of deny_ptrace boolean in TEMPLATETYPE_admin + +* Tue Dec 3 2013 Dan Walsh - 2.2.4-1 +- Update to upstream + * Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems. +- Add patches for sepolicy gui from mgrepl to + Fix advanced_item_button_push() to allow to select an application in advanced search menu + Fix previously_modified_initialize() to show modified changes properly for all selections + + +* Fri Nov 22 2013 Dan Walsh - 2.2.3-1 +- Update to upstream + * Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh. + * Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh. +- Apply Miroslav Grepl patch to fix TEMPLATETYPE_domtrans description in sepolicy generate + +* Wed Nov 20 2013 Dan Walsh - 2.2.2-2 +- Fix selinux-polgengui, get_all_modules call + +* Fri Nov 15 2013 Dan Walsh - 2.2.2-1 +- Speed up startup time of sepolicy gui +- Clean up ports screen to only show enabled ports. +- Update to upstream + * Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh. + * Make yum/extract_rpms optional for sepolicy generate from Dan Walsh. + * Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh. + +* Thu Oct 31 2013 Dan Walsh - 2.2-2 +- Shift around some of the files to more appropriate packages. + * semodule_* packages are required for devel. +* Thu Oct 31 2013 Dan Walsh - 2.2-1 +- Update to upstream + * Properly build the swig exception file from Laurent Bigonville. + * Fix man pages from Laurent Bigonville. + * Support overriding PATH and INITDIR in Makefile from Laurent Bigonville. + * Fix LDFLAGS usage from Laurent Bigonville. + * Fix init_policy warning from Laurent Bigonville. + * Fix semanage logging from Laurent Bigonville. + * Open newrole stdin as read/write from Sven Vermeulen. + * Fix sepolicy transition from Sven Vermeulen. + * Support overriding CFLAGS from Simon Ruderich. + * Create correct man directory for run_init from Russell Coker. + * restorecon GLOB_BRACE change from Michal Trunecka. + * Extend audit2why to report additional constraint information. + * Catch IOError errors within audit2allow from Dan Walsh. + * semanage export/import fixes from Dan Walsh. + * Improve setfiles progress reporting from Dan Walsh. + * Document setfiles -o option in usage from Dan Walsh. + * Change setfiles to always return -1 on failure from Dan Walsh. + * Improve setsebool error r eporting from Dan Walsh. + * Major overhaul of gui from Dan Walsh. + * Fix sepolicy handling of non-MLS policy from Dan Walsh. + * Support returning type aliases from Dan Walsh. + * Add sepolicy tests from Dan Walsh. + * Add org.selinux.config.policy from Dan Walsh. + * Improve range and user input checking by semanage from Dan Walsh. + * Prevent source or target arguments that end with / for substitutions from Dan Walsh. + * Allow use of <> for semanage fcontext from Dan Walsh. + * Report customized user levels from Dan Walsh. + * Support deleteall for restoring disabled modules from Dan Walsh. + * Improve semanage error reporting from Dan Walsh. + * Only list disabled modules for module locallist from Dan Walsh. + * Fix logging from Dan Walsh. + * Define new constants for file type character codes from Dan Walsh. + * Improve bash completions from Dan Walsh. + * Convert semanage to argparse from Dan Walsh (originally by Dave Quigley). + * Add semanage tests from Dan Walsh. + * Split semanage man pages from Dan Walsh. + * Move bash completion scripts from Dan Walsh. + * Replace genhomedircon script with a link to semodule from Dan Walsh. + * Fix fixfiles from Dan Walsh. + * Add support for systemd service for restorecon from Dan Walsh. + * Spelling corrections from Dan Walsh. + * Improve sandbox support for home dir symlinks and file caps from Dan Walsh. + * Switch sandbox to openbox window manager from Dan Walsh. + * Coalesce audit2why and audit2allow from Dan Walsh. + * Change audit2allow to append to output file from Dan Walsh. + * Update translations from Dan Walsh. + * Change audit2why to use selinux_current_policy_path from Dan Walsh. + +* Fri Oct 25 2013 Dan Walsh - 2.1.14-89 +- Fix handling of man pages. + +* Wed Oct 16 2013 Dan Walsh - 2.1.14-88 +- Cleanup errors found by pychecker +- Apply patch from Michal Trunecka to allow restorecon to handle {} in globs + +* Fri Oct 11 2013 Dan Walsh - 2.1.14-87 +- sepolicy gui + - mgrepl fixes for users and login +- Update Translations. + +* Fri Oct 11 2013 Dan Walsh - 2.1.14-86 +- sepolicy gui + - mgrepl added delete screens for users and login + - Fix lots of bugs. +- Update Translations. + + +* Fri Oct 4 2013 Dan Walsh - 2.1.14-85 +- Fixes for fixfiles + * exclude_from_dirs should apply to all types of restorecon calls + * fixfiles check now works + * exit with the correct status + +- semanage no longer import selinux + +* Wed Oct 2 2013 Dan Walsh - 2.1.14-84 +- Fixes for sepolicy gui +- Fix setsebool to return 0 on success +- Update Po + +* Mon Sep 30 2013 Dan Walsh - 2.1.14-83 +- Fix sizes of help screens in sepolicy gui + +* Sat Sep 28 2013 Dan Walsh - 2.1.14-82 +- Improvements to sepolicy gui + - Add more help information + - Cleanup code + - Add deny_ptrace on lockdown screen + - Make unconfined/permissivedomains lockdown work + - Add more support for file equivalency + +* Wed Sep 18 2013 Dan Walsh - 2.1.14-81 +- Add back in the help png files +- Begin Adding support for file equivalency. + +* Wed Sep 4 2013 Dan Walsh - 2.1.14-80 +- Random fixes for sepolicy gui + * Do not prompt for password until you make a change + * Add user mappings and selinux users page + * lots of code cleanup + +- Verify homedir is owned by user before mounting over it with seunshare +- Fix fixfiles to handle Relabel properly +- Fix semanage fcontext -e / command to allow "/" + +* Wed Sep 4 2013 Dan Walsh - 2.1.14-79 +- Add Miroslav Grepl setsebool patch to give better error message on bad boolean names +- Additional help screens for sepolicy gui + +* Tue Sep 3 2013 Dan Walsh - 2.1.14-78 +- Random fixes for sepolicy gui +- Update Translations + +* Fri Aug 30 2013 Dan Walsh - 2.1.14-77 +- Add help screens for each page +- Fixes for system page + +* Mon Aug 26 2013 Dan Walsh - 2.1.14-76 +- Add Miroslav Grepl Patch to handle semanage -i and semanage -o better +- Update Translations + +* Thu Aug 15 2013 Dan Walsh - 2.1.14-75 +- Update sepolicy gui code, cleanups and add file transition tab +- Fix semanage fcontext -a --ftype code to work. + +* Wed Aug 7 2013 Dan Walsh - 2.1.14-74 +- If policy is not installed get_bools should not crash + +* Wed Aug 7 2013 Dan Walsh - 2.1.14-73 +- Fix doc versioning + +* Tue Aug 6 2013 Dan Walsh - 2.1.14-72 +- Update sepolicy gui code, cleanups and add file transition tab +- Fix semanage argparse problems + +* Fri Aug 2 2013 Dan Walsh - 2.1.14-71 +- Update sepolicy gui code, adding dbus calls +- Update Translations + +* Fri Jul 26 2013 Dan Walsh - 2.1.14-70 +- Fix semanage argparse bugs +- Update Translations +- Add test suite for semanage command lines + +* Wed Jul 24 2013 Dan Walsh - 2.1.14-69 +- Fix semanage argparse bugs + +* Tue Jul 23 2013 Dan Walsh - 2.1.14-68 +- Fix bugs introduced by previous patch. semanage port +- Update Translations +- Add test suite for sepolicy command lines + +* Fri Jul 19 2013 Dan Walsh - 2.1.14-67 +- Fix bugs introduced by previous patch. semanage port +- Update Translations + +* Wed Jul 17 2013 Dan Walsh - 2.1.14-66 +- Rewrite argparse code in semanage and fix reload problem. + +* Tue Jul 16 2013 Dan Walsh - 2.1.14-65 +- Do not generate shell script or spec file for sepolicy generate --newtype +- Update translations +- Fix sepolicy generate --admin_user man page again +- Fix setsebool to print less verbose error messages by default, add -V for ve + +* Mon Jul 15 2013 Dan Walsh - 2.1.14-64 +- Move audit2allow and audit2why back into -python package + +* Wed Jul 10 2013 Dan Walsh - 2.1.14-63 +- Update sepolicy gui. +- Error out of you call sepolicy gui without policycoreutils-gui package installed +- Fix semanage login -d command +- Update Translations + +* Wed Jul 10 2013 Dan Walsh - 2.1.14-62 +- Update sepolicy gui. + +* Fri Jul 5 2013 Dan Walsh - 2.1.14-61 +- Add Ryan Hallisey sepolicy gui. +- Update Translations + +* Mon Jun 24 2013 Dan Walsh - 2.1.14-60 +- Fix semanage module error handling + +* Sun Jun 23 2013 Dan Walsh - 2.1.14-59 +- Add back default exception handling for errors, which argparse rewrite removed. + +* Fri Jun 21 2013 Dan Walsh - 2.1.14-58 +- Fix generation of booleans in man pages + +* Fri Jun 21 2013 Dan Walsh - 2.1.14-57 +- Remove requires for systemd-sysv +- Move systemd-units require to restorecond section +- Update Tranlasions +- More sepolicy interfaces for gui +- Cleanup man pages for sepolicy generate + +* Wed Jun 19 2013 Dan Walsh - 2.1.14-56 +- Fix semanage export/import commands +- Fix semange module command +- Remove --version option from sandbox + +* Tue Jun 18 2013 Dan Walsh - 2.1.14-55 +- Add man page doc for --role and bash complestion support for sepolicy --role + +* Tue Jun 18 2013 Dan Walsh - 2.1.14-54 +- Make fcdict return a dictionary of dictionaries +- Fix for sepolicy manpage + +* Mon Jun 17 2013 Dan Walsh - 2.1.14-53 +- Add new man pages for each semanage subsection + +* Mon Jun 17 2013 Dan Walsh - 2.1.14-52 +- Fix handling of sepolicy network sorting. +- Additional interfaces needed for sepolicy gui + +* Thu Jun 6 2013 Dan Walsh - 2.1.14-51 +- Fix handling of semanage args + +* Thu Jun 6 2013 Dan Walsh - 2.1.14-50 +- Fix sepolicy generate --confined_admin to generate tunables +- Add new interface to generate entrypoints for use with new gui + +* Wed Jun 5 2013 Dan Walsh - 2.1.14-49 +- Fix handing of semanage with no args + +* Tue Jun 4 2013 Dan Walsh - 2.1.14-48 +- Fix audit2allow -o to open file for append +- Fix the name of the spec file generated in the build script + +* Fri May 31 2013 Dan Walsh - 2.1.14-47 +- Fix mgrepl patch to support all semanage command parsing + +* Sun May 26 2013 Dan Walsh - 2.1.14-46 +- Fix the name of the spec file generated in the build script +- Add mgrepl patch to support argparse for semanage command parsing + +* Tue May 21 2013 Dan Walsh - 2.1.14-45 +- Fix sandbox to always use sandbox_file_t, so generated policy will work. +- Update Translations + +* Thu May 16 2013 Dan Walsh - 2.1.14-44 +- Fix sepolicy-generate man page to clear up options/policy type +- Add Miroslav Grepl to not generate man page when doing + sepolicy generate --customize +- Add support for executing semanage user within spec file +- Fix generation of confined admin domains, to handle booleans properly. + +* Tue May 14 2013 Dan Walsh - 2.1.14-43 +- Need to handle gziped policy.xml as well as not compressed. + +* Tue May 14 2013 Dan Walsh - 2.1.14-42 +- Add support for Xephyr -resizable, so sandbox can now resize window +- Add support for compressed policy.xml +- Miroslav Grepl patch to allow sepolicy interface on individual interface fil +- Also add capability to test interfaces for correctness. + +* Mon May 13 2013 Dan Walsh - 2.1.14-41 +- Apply patches from Sven Vermeulen for sepolgen to fix typos. + +* Mon May 13 2013 Dan Walsh - 2.1.14-40 +- Only require selinux-policy-devel for policycoreutils-devel, this will shrink the size of the livecd. + +* Sun May 12 2013 Dan Walsh - 2.1.14-39 +- Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed, first time +- Add Sven Vermeulen patches to cleanup man pages + +* Fri May 10 2013 Dan Walsh - 2.1.14-38 +- No longer run sepolgen-ifgen at install time. +- Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed. +- Update Translations + +* Mon Apr 22 2013 Dan Walsh - 2.1.14-37 +- Fix exceptionion hanling in audit2allow -o +- Generate Man pages for everydomain, not just ones with exec_t entrypoints +- sepolicy comunicate should return ValueError not TypeError +- Trim header line in sepolicy manpage to use less space +- Add missing options to restorecon man page + +* Thu Apr 11 2013 Dan Walsh - 2.1.14-36 +- Raise proper Exception on sepolicy communicate with invalid value + +* Wed Apr 10 2013 Dan Walsh - 2.1.14-35 +- Update translations +- Add patch by Miroslav Grepl to add compile test for sepolicy interface command. + +* Tue Apr 9 2013 Dan Walsh - 2.1.14-34 +- Update translations +- Add patch inspired by Miroslav Grepl to add extended information for sepolicy interface command. + +* Mon Apr 8 2013 Dan Walsh - 2.1.14-33 +- Update translations +- Add missing man pages and fixup existing man pages + +* Wed Apr 3 2013 Dan Walsh - 2.1.14-32 +- Move sepolicy to policycoreutils-devel pacage, since most of it is used for devel +- Apply Miroslav Grepl Patches for sepolicy +-- Fix generate mutually groups option handling +-- EUSER is used for existing policy +-- customize options can be used together with admin_domain option +-- Fix manpage.py to generate correct man pages for SELinux users +-- Fix policy *.te file generated by customize+writepaths options +-- Fix install script for confined_admin option + +* Mon Apr 1 2013 Dan Walsh - 2.1.14-31 +- Add post install scripts for gui to make sure Icon Cache is refreshed. +- Fix grammar issue in secon man page +- Update Translations + +* Thu Mar 28 2013 Dan Walsh - 2.1.14-30 +- Add buildrequires for OpenBox to prevent me from accidently building into RHEL7 +- Add support for returning alias data to sepolicy.info python bindings + +* Wed Mar 27 2013 Dan Walsh - 2.1.14-28 +- Fix audit2allow output to better align analysys with the allow rules +- Apply Miroslav Grepl patch to clean up sepolicy generate usage +- Apply Miroslav Grepl patch to fixupt handing of admin_user generation +- Update Tranlslations + +* Wed Mar 27 2013 Dan Walsh - 2.1.14-27 +- Allow semanage fcontext -a -t "<>" ... to work + +* Mon Mar 25 2013 Dan Walsh - 2.1.14-26 +- Can not unshare IPC in sandbox, since it blows up Xephyr +- Remove bogus error message sandbox about reseting setfsuid + +* Thu Mar 21 2013 Dan Walsh - 2.1.14-25 +- Fix sepolicy generate --customize to generate policy with -w commands + +* Thu Mar 21 2013 Dan Walsh - 2.1.14-24 +- sepolgen-ifgen needs to handle filename transition rules containing ":" + +* Tue Mar 19 2013 Dan Walsh - 2.1.14-23 +- sepolicy manpage: +- use nroff instead of man2html +- Remove checking for name of person who created the man page +- audit2allow +- Fix output to show the level that is different. + +* Thu Mar 14 2013 Dan Walsh - 2.1.14-22 +- Fix newrole to not drop capabilities from the bounding set. +- Stop dropping capabilities from its children. +- Add better error messages. +- Change location of bash_completion files to /usr/share/bash-completion/compl + +* Mon Mar 11 2013 Dan Walsh - 2.1.14-21 +- sepolicy generate should look for booleans that effect equivalence names, and add them to the man page + +* Thu Mar 7 2013 Dan Walsh - 2.1.14-20 +- Mention creation of permissive domains in sepolicy generate man page +- Change sepolicy manpage to use shortname with an "_" to stop accidently grabbing unrelated types for a domain. +- Fix audit2allow to show better information on constraint violations. + +* Wed Mar 6 2013 Dan Walsh - 2.1.14-19 +- Have restorecon exit -1 on errors for consistancy. + +* Tue Mar 5 2013 Dan Walsh - 2.1.14-18 +- Need to provide a value to semanage boolean -m + +* Mon Mar 4 2013 Dan Walsh - 2.1.14-17 +- Fix cut and paste errors for sepolicy network command + +* Fri Mar 1 2013 Dan Walsh - 2.1.14-16 +- Fix sepoicy interface to work properly + +* Thu Feb 28 2013 Dan Walsh - 2.1.14-15 +- Fix fixfiles to use exclude_dirs on fixfiles restore + +* Thu Feb 28 2013 Dan Walsh - 2.1.14-14 +- Allow users with symlinked homedirs to work. call realpath on homedir +- Fix sepolicy reorganization of helper functions. + +* Sun Feb 24 2013 Dan Walsh - 2.1.14-13 +- Update trans +- Fix sepolicy reorganization of helper functions. + +* Sun Feb 24 2013 Rahul Sundaram - 2.1.14-13 +- remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247 +- clean up spec to follow current guidelines + +* Fri Feb 22 2013 Dan Walsh - 2.1.14-12 +- Do not load interface file by default when sepolicy is called, mov get_all_methods to the sepolicy package + +* Fri Feb 22 2013 Dan Walsh - 2.1.14-11 +- sepolgen-ifgen should use the current policy path if selinux is enabled + +* Fri Feb 22 2013 Dan Walsh - 2.1.14-10 +- Fix sepolicy to be able to work on an SELinux disabled system. +- Needed to be able to build man pages in selinux-policy package + +* Thu Feb 21 2013 Dan Walsh - 2.1.14-9 +- Add yum to requires of policycoreutils-python since sepolicy requires it. + +* Thu Feb 21 2013 Dan Walsh - 2.1.14-8 +- Sepolixy should not throw an exception on an SELinux disabled machine +- Switch from using console app to using pkexec, so we will work better +with policykit. +- Add missing import to fix system-config-selinux startup +- Add comment to pamd files about pam_rootok.so +- Fix sepolicy generate to not comment out the first line + +* Wed Feb 20 2013 Dan Walsh - 2.1.14-7 +- Add --root/-r flag to sepolicy manpage, +- This allows us to generate man pages on the fly in the selinux-policy build + +* Mon Feb 18 2013 Dan Walsh - 2.1.14-6 +- Fix newrole to retain cap_audit_write when compiled with namespace, also +do not drop capabilities when run as root. + +* Thu Feb 14 2013 Dan Walsh - 2.1.14-5 +- Fix man page generation and public_content description + +* Thu Feb 14 2013 Dan Walsh - 2.1.14-4 +- Revert some changes which are causing the wrong policy version file to be created +- Switch sandbox to start using openbox rather then matchbox +- Make sepolgen a symlink to sepolicy +- update translations + +* Wed Feb 13 2013 Dan Walsh - 2.1.14-3 +- Fix empty system-config-selinux.png, again + +* Tue Feb 12 2013 Dan Walsh - 2.1.14-2 +- Fix empty system-config-selinux.png + +* Thu Feb 7 2013 Dan Walsh - 2.1.14-1 +- Update to upstream + * setfiles: estimate percent progress + * load_policy: make link at the destination directory + * Rebuild polgen.glade with glade-3 + * sepolicy: new command to unite small utilities + * sepolicy: Update Makefiles and po files + * sandbox: use sepolicy to look for sandbox_t + * gui: switch to use sepolicy + * gui: sepolgen: use sepolicy to generate + * semanage: use sepolicy for boolean dictionary + * add po file configuration information + * po: stop running update-po on all + * semanage: seobject verify policy types before allowing you to assign them. + * gui: Start using Popen, instead of os.spawnl + * sandbox: Copy /var/tmp to /tmp as they are the same inside + * qualifier to shred content + * semanage: Fix handling of boolean_sub names when using the -F flag + * semanage: man: roles instead of role + * gui: system-config-selinux: Catch no DISPLAY= error + * setfiles: print error if no default label found + * semanage: list logins file entries in semanage login -l + * semanage: good error message is sepolgen python module missing + * gui: system-config-selinux: do not use lokkit + * secon: add support for setrans color information in prompt output + * restorecond: remove /etc/mtab from default list + * gui: If you are not able to read enforcemode set it to False + * genhomedircon: regenerate genhomedircon more often + * restorecond: Add /etc/udpatedb.conf to restorecond.conf + * genhomedircon generation to allow spec file to pass in SEMODULE_PATH + * fixfiles: relabel only after specific date + * po: update translations + * sandbox: seunshare: do not reassign realloc value + * seunshare: do checking on setfsuid + * sestatus: rewrite to shut up coverity + +* Thu Jan 31 2013 Dan Walsh - 2.1.12-58 +- Reorginize sepolicy so all get_all functions are in main module +- Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot. + +* Fri Jan 25 2013 Dan Walsh - 2.1.12-57 +- Update to latest patches from eparis/Upstream +- fixfiles onboot will write any flags handed to it to /.autorelabel. +- * Patch sent to initscripts to have fedora-autorelabel pass flags back to fixfiles restore +- * This should allow fixfiles -F onboot, to force a hard relabel. +- Add -p to show progress on full relabel. + +* Tue Jan 15 2013 Dan Walsh - 2.1.12-56 +- Additional changes for bash completsion and generate man page to match the w +- Add newtype as a new qualifier to sepolicy generate. This new mechanism wil +- a policy write to generate types after the initial policy has been written a +- will autogenerate all of the interfaces. +- I also added a -w options to allow policy writers from the command line to s +- the writable directories of files. +- +- Modify network.py to include interface definitions for newly created port type +- Standardize of te_types just like all of the other templates. + +- Change permissive domains creation to raise exception if sepolgen is not ins +- get_te_results no longer needs or uses the opts parameter. +- The compliler was complaining so I just removed the option. +- Start returning analysis data for audit2allow + +* Tue Jan 15 2013 Dan Walsh - 2.1.12-55 +- Update Translations +- Fix handling of semanage generate --cgi -n MODULE PATHTO/CGI +- This fixes the spec file and script file getting wrong names for modules and types. + +* Wed Jan 9 2013 Dan Walsh - 2.1.12-54 +- Additional patch from Miroslav to handle role attributes + +* Wed Jan 9 2013 Dan Walsh - 2.1.12-53 +- Update with Miroslav patch to handle role attributes +- Update Translations +- import sepolicy will only throw exception on missing policy iff selinux is enabled + +* Sat Jan 5 2013 Dan Walsh - 2.1.12-52 +- Update to latest patches from eparis/Upstream +- secon: add support for setrans color information in prompt output +- Update translations + +* Fri Jan 4 2013 Dan Walsh - 2.1.12-51 +- Update translations +- Fix sepolicy booleans to handle autogenerated booleans descriptions +- Cleanups of sepolicy manpage +- Fix crash on git_shell man page generation + +* Thu Jan 3 2013 Dan Walsh - 2.1.12-50 +- Update translations +- update sepolicy manpage to generate fcontext equivalence data and to list +default file context paths. +- Add ability to generate policy for confined admins and domains like puppet. + +* Thu Dec 20 2012 Dan Walsh - 2.1.12-49 +- Fix semanage permissive , this time with the patch. +- Update translations + +* Wed Dec 19 2012 Dan Walsh - 2.1.12-48 +- Fix semanage permissive +- Change to use correct gtk forward button +- Update po + +* Mon Dec 17 2012 Dan Walsh - 2.1.12-47 +- Move audit2why to -devel package + +* Mon Dec 17 2012 Dan Walsh - 2.1.12-46 +- sepolicy transition was blowing up. Also cleanup output when only source is specified. +- sepolicy generate should allow policy modules names that include - or _ + +* Mon Dec 10 2012 Dan Walsh - 2.1.12-45 +- Apply patch from Miroslav to display proper range description in man pages g +- Should print warning on missing default label when run in recusive mode iff +- Remove extra -R description, and fix recursive description + +* Thu Dec 6 2012 Dan Walsh - 2.1.12-44 +- Additional fixes for disabled SELinux Box +- system-config-selinux no longer relies on lokkit for /etc/selinux/config + +* Thu Dec 6 2012 Dan Walsh - 2.1.12-43 +- sepolicy should failover to installed policy file on a disabled SELinux box, if it exists. + +* Wed Dec 5 2012 Dan Walsh - 2.1.12-42 +- Update Translations +- sepolicy network -d needs to accept multiple domains + +* Fri Nov 30 2012 Dan Walsh - 2.1.12-41 +- Add --path as a parameter to sepolicy generate +- Print warning message if program does not exists when generating policy, and do not attempt to run nm command +- Fix sepolicy generate -T to not take an argument, and supress the help message +- Since this is really just a testing tool + +* Fri Nov 30 2012 Dan Walsh - 2.1.12-40 +- Fix sepolicy communicate to handle invalid input + +* Thu Nov 29 2012 Dan Walsh - 2.1.12-39 +- Fix sepolicy network -p to handle high ports + +* Thu Nov 29 2012 Dan Walsh - 2.1.12-38 +- Fix handling of manpages without entrypoints, nsswitch domains +- Update Translations + +* Wed Nov 28 2012 Dan Walsh - 2.1.12-37 +- Move sepogen python bindings back into policycoreutils-python out of -devel, since sepolicy is using the + +* Tue Nov 27 2012 Dan Walsh - 2.1.12-36 +- Fix sepolicy/__init__.py to handle _() + +* Wed Nov 21 2012 Dan Walsh - 2.1.12-35 +- Add Miroslav Grepl patch to create etc_rw_t sock files policy + +* Fri Nov 16 2012 Dan Walsh - 2.1.12-34 +- Fix semanage to work without policycoreutils-devel installed +- Update translations + +* Tue Nov 13 2012 Dan Walsh - 2.1.12-33 +- Fix semanage login -l to list contents of /etc/selinux/POLICY/logins directory + +* Tue Nov 13 2012 Dan Walsh - 2.1.12-32 +- Fix booleansPage not showing booleans +- Fix audit2allow -b + +* Tue Nov 13 2012 Dan Walsh - 2.1.12-31 +- Fix sepolicy booleans again +- Fix man page + +* Mon Nov 12 2012 Dan Walsh - 2.1.12-30 +- Move policy generation tools into policycoreutils-devel + +* Mon Nov 12 2012 Dan Walsh - 2.1.12-29 +- Document and fix sepolicy booleans +- Update Translations +- Fix several spelling mistakes + +* Wed Nov 7 2012 Dan Walsh - 2.1.12-27 +- Only report restorecon warning for missing default label, if not running +recusively +- Update translations + +* Mon Nov 5 2012 Dan Walsh - 2.1.12-26 +- Fix semanage booleans -l, move more boolean_dict handling into sepolicy +- Update translations +- Fixup sepolicy generate to discover /var/log, /var/run and /var/lib directories if they match the name +- Fix kill function call should indicate signal_perms not kill capability +- Error out cleanly in system-config-selinux, if it can not contact XServer + +* Mon Nov 5 2012 Dan Walsh - 2.1.12-25 +- Remove run_init, no longer needed with systemd. +- Fix sepolicy generate to not include subdirs in generated fcontext file. (mgrepl patch) + +* Sat Nov 3 2012 Dan Walsh - 2.1.12-24 +- Fix manpage to generate proper man pages for alternate policy, +basically allow me to build RHEL6 man pages on a Fedora 18 box, as long as +I pull the policy, policy.xml and file_contexts and file_contexts.homedir + +* Thu Nov 1 2012 Dan Walsh - 2.1.12-23 +- Fix some build problems in sepolicy manpage and sepolicy transition + +* Tue Oct 30 2012 Dan Walsh - 2.1.12-22 +- Add alias man pages to sepolicy manpage + +* Mon Oct 29 2012 Dan Walsh - 2.1.12-21 +- Redesign sepolicy to only read the policy file once, not for every call + +* Mon Oct 29 2012 Dan Walsh - 2.1.12-20 +- Fixes to sepolicy transition, allow it to list all transitions from a domain + +* Sat Oct 27 2012 Dan Walsh - 2.1.12-19 +- Change sepolicy python bindings to have python pick policy file, fixes weird memory problems in sepolicy network + +* Fri Oct 26 2012 Dan Walsh - 2.1.12-18 +- Allow sepolicy to specify the policy to generate content from + +* Thu Oct 25 2012 Dan Walsh - 2.1.12-17 +- Fix semanage boolean -F to handle boolean subs + +* Thu Oct 25 2012 Dan Walsh - 2.1.12-16 +- Add Miroslav Grepl patch to generate html man pages +- Update Translations +- Add option to sandbox to shred files before deleting + +* Mon Oct 22 2012 Dan Walsh - 2.1.12-15 +- Add Requires(post) PKGNAME to sepolicy generate /usr/bin/pkg + +* Fri Oct 19 2012 Dan Walsh - 2.1.12-14 +- Add role_allow to sepolicy.search python bindings, this allows us to remove last requirement for setools-cmdline in gui tools. +- Fix man page generator. + +* Wed Oct 17 2012 Dan Walsh - 2.1.12-13 +- Remove dwalsh@redhat.com from man pages +- Fix spec file for sepolicy generate + +* Wed Oct 17 2012 Dan Walsh - 2.1.12-12 +- Add missing spec.py from templates directory needed for sepolicy generate +- Add /var/tmp as collection point for sandbox apps. + +* Tue Oct 16 2012 Dan Walsh - 2.1.12-11 +- Handle audit2allow -b in foreign locales + +* Tue Oct 16 2012 Dan Walsh - 2.1.12-10 +- Update sepolicy generate with patch to create spec file and man page. +- Patch initiated by Miroslav Grepl + +* Wed Oct 10 2012 Dan Walsh - 2.1.12-9 +- Fix semanage to verify that types are appropriate for commands. + * Patch initiated by mgrepl + * Fixes problem of specifying non file_types for fcontext, or not port_types for semanage port + +* Tue Oct 9 2012 Dan Walsh - 2.1.12-8 +- Fix typo in preunstall line for restorecond +- Add mgrepl patch to consolidate file context generated by sepolicy generate + +* Mon Oct 8 2012 Dan Walsh - 2.1.12-7 +- Fix manpage generation, missing import +- Add equiv_dict to get samba booleans into smbd_selinux +- Add proper translations for booleans and remove selinux.tbl + +* Sat Oct 6 2012 Dan Walsh - 2.1.12-6 +- Fix system-config-selinux to use sepolicy.generate instead of sepolgen + +* Thu Oct 4 2012 Dan Walsh - 2.1.12-5 +- Add sepolicy commands, and change tools to use them. + +* Tue Sep 25 2012 Dan Walsh - 2.1.12-4 +- Rebuild without bogus prebuild 64 bit seunshare app + +* Sun Sep 16 2012 Dan Walsh - 2.1.12-3 +- Allow fixfiles to specify -v, so they can get verbosity rather then progress. +- Fix load_file Makefile to use SBINDIR rather then real OS. +- Fix man pages in setfiles and restorecon to reflect what happens when you relabel the entire OS. + +* Sun Sep 16 2012 Dan Walsh - 2.1.12-2 +- Use systemd post install scriptlets + +* Thu Sep 13 2012 Dan Walsh - 2.1.12-1 +- Update to upstream + * genhomedircon: manual page improvements + * setfiles/restorecon minor improvements + * run_init: If open_init_pty is not available then just use exec + * newrole: do not drop capabilities when newrole is run as + * restorecon: only update type by default + * scripts: Don't syslog setfiles changes on a fixfiles restore + * setfiles: do not syslog if no changes + * Disable user restorecond by default + * Make restorecon return 0 when a file has changed context + * setfiles: Fix process_glob error handling + * semanage: allow enable/disable under -m + * add .tx to gitignore + * translations: commit translations from Fedora community + * po: silence build process + * gui: Checking in policy to support polgengui and sepolgen. + * gui: polgen: search for systemd subpackage when generating policy + * gui: for exploring booleans + * gui: system-config-selinux gui + * Add Makefiles to support new gui code + * gui: remove lockdown wizard + * return equivalency records in fcontext customized + * semanage: option to not load new policy into kernel after + * sandbox: manpage update to describe standard types + * setsebool: -N should not reload policy on changes + * semodule: Add -N qualifier to no reload kernel policy + * gui: polgen: sort selinux types of user controls + * gui: polgen: follow symlinks and get the real path to + * gui: Fix missing error function + * setfiles: return errors when bad paths are given + * fixfiles: tell restorecon to ignore missing paths + * setsebool: error when setting multiple options + * semanage: use boolean subs. + * sandbox: Make sure Xephyr never listens on tcp ports + * sepolgen: return and output constraint violation information + * semanage: skip comments while reading external configuration files + * restorecond: relabel all mount runtime files in the restorecond example + * genhomedircon: dynamically create genhomedircon + * Allow returning of bastard matches + * sepolgen: return and output constraint violation information + * audit2allow: one role/type pair per line + +* Wed Aug 8 2012 Dan Walsh - 2.1.11-6 +- Change polgen to generate dbus apps as optional so they can compile on minimal policy system, patch from Miroslav Grepl + +* Fri Jul 27 2012 Dan Walsh - 2.1.11-5 +- Fix sepolgen/audit2allow to handle multiple role/types in avc messages properly + +* Thu Jul 19 2012 Dan Walsh - 2.1.11-4 +- Fix restorecon to generate a better percentage of completion on restorecon -R /. +- Have audit2allow look at the constaint violation and tell the user whether it +- is because of user,role or level + + +* Wed Jul 11 2012 Dan Walsh - 2.1.11-3 +- userapps is generating sandbox code in polgengui + +* Thu Jul 5 2012 Dan Walsh - 2.1.11-2 +- Remove load_policy symbolic link on usrmove systems this breaks the system + +* Wed Jul 4 2012 Dan Walsh - 2.1.11-1 +- Update to upstream + - policycoreutils + * restorecond: wrong options should exit with non-zero error code + * restorecond: Add -h option to get usage command + * resorecond: user: fix fd leak + * mcstrans: add -f to run in foreground + * semanage: fix man page range and level defaults + * semanage: bash completion for modules should include -a,-m, -d + * semanage: manpage update for -e + * semanage: dontaudit off should work + * semanage: locallist option does not take an argument + * sepolgen: Make use of setools optional within sepolgen + - sepolgen + * Make use of setools optional within sepolgen + * We need to support files that have a + in them + +* Thu May 24 2012 Dan Walsh - 2.1.11-18 +- Make restorecon exit with an error on a bad path + +* Thu May 24 2012 Dan Walsh - 2.1.11-17 +- Fix setsebool command, handling of = broken. +- Add missing error option in booleansPage + +* Sun May 20 2012 Dan Walsh - 2.1.11-16 +- Fix sepolgen to use realpath on executables handed to it. - Brian Bickford + +* Fri May 18 2012 Dan Walsh - 2.1.11-15 +- Allow stream sock_files to be stored in /tmp and etc_rw_t directories by sepolgen +- Trigger on selinux-policy needs to change to selinux-policy-devel +- Update translations +- Fix semanage dontaudit off/on exception + +* Tue May 8 2012 Dan Walsh - 2.1.11-12 +- Add -N qualifier to semanage, setsebool and semodule to allow you to update +- policy without reloading it into the kernel. + +* Thu May 3 2012 Dan Walsh - 2.1.11-11 +- add some definition to the standard types available for sandboxes + +* Tue May 1 2012 Dan Walsh - 2.1.11-10 +- Remove lockdown wizard + +* Mon Apr 30 2012 Dan Walsh - 2.1.11-9 +- Fix semanage fcontext -E to extract the equivalance customizations. + +* Thu Apr 26 2012 Dan Walsh - 2.1.11-8 +- Add mgrepl patch to have sepolgen search for -systemd rpm packages + +* Tue Apr 24 2012 Dan Walsh - 2.1.11-7 +- Apply Stef Walter patch for semanage man page + +* Mon Apr 23 2012 Dan Walsh - 2.1.11-6 +- Rebuild to get latest libsepol which fixes the file_name transition problems +- Update translations +- Fix calls to close fd for restorecond + +* Fri Apr 13 2012 Dan Walsh - 2.1.11-5 +- Update translations +- Fix sepolgen to discover unit files in /lib/systemd/ + +* Tue Apr 3 2012 Dan Walsh - 2.1.11-4 +- Update translations +- Fix segfault on restorecon + +* Tue Apr 3 2012 Dan Walsh - 2.1.11-3 +- Allow filename transitions to use + in a file name + +* Fri Mar 30 2012 Dan Walsh - 2.1.11-2 +- Change policycoreutils-python to require selinux-policy-devel package + +* Thu Mar 29 2012 Dan Walsh - 2.1.11-1 +- Update to upstream + - policycoreutils + * sandbox: do not propogate inside mounts outside + * sandbox: Removing sandbox init script, should no longer be necessary + * restorecond: Stop using deprecated interfaces for g_io + * semanage: proper auditting of user changes for LSPP + * semanage: audit message to show what record(s) and item(s) have chaged + * scripts: Update Makefiles to handle /usrmove + * mcstrans: Version should have been bumped on last check in + * seunshare: Only drop caps not the Bounding Set from seunshare + * Add bash-completion scripts for setsebool and semanage + * newrole: Use correct capng calls in newrole + * Fix infinite loop with inotify on 2.6.31 kernels + * fix ftbfs with hardening flags + * Only run setfiles if we found read-write filesystems to run it on + * update .po files + * remove empty po files + * do not fail to install if unable to make load_policy lnk file + + - sepolgen + * Fix dead links to www.nsa.gov/selinux + * audit.py Dont crash if empty data is passed to sepolgen + * do not use md5 when calculating hash signatures + * fix detection of policy loads + +* Wed Mar 28 2012 Dan Walsh - 2.1.10-30 +- Have sepolgen script specify the pp file with the make command. From mgrepl. + +* Wed Mar 21 2012 Dan Walsh - 2.1.10-29 +- Fix sepolgen handling of unit files. + +* Thu Mar 8 2012 Dan Walsh - 2.1.10-28 +- Require selinux-policy-doc + +* Thu Mar 8 2012 Dan Walsh - 2.1.10-27 +- Fix unit file handling in sepolgen + +* Wed Feb 29 2012 Dan Walsh - 2.1.10-26 +- Add bash_command completion for setsebool/getsebool + +* Mon Feb 27 2012 Dan Walsh - 2.1.10-25 +- Disable restorecond on desktop by default +- Change seunshare to not modify the bounding set + +* Mon Feb 20 2012 Dan Walsh - 2.1.10-24 +- Stop using sandbox init in post install since it no longer exists. + +* Thu Feb 16 2012 Dan Walsh - 2.1.10-23 +- Change to use new selinux_current_policy_path() + +* Wed Feb 15 2012 Dan Walsh - 2.1.10-22 +- Change to use new selinux_binary_policy_path() +- Add systemd_passwd_agent_exec($1), and systemd_read_fifo_file_passwd_run($1) to templates for _admin interface + +* Fri Feb 3 2012 Dan Walsh - 2.1.10-21 +- On full relabels we will now show a estimated percent complete rather then +just *s. + +* Wed Feb 1 2012 Dan Walsh - 2.1.10-20 +- Add unit_file.py for sepolgen + +* Tue Jan 31 2012 Dan Walsh - 2.1.10-19 +- Change sepolgen to use sha256 instead of md5 + +* Mon Jan 30 2012 Dan Walsh - 2.1.10-18 +- Stop syslogging on full restore +- Stop syslogging when restorecon is not changing values + +* Fri Jan 27 2012 Dan Walsh - 2.1.10-17 +- Change semanage to produce proper audit records for Common Criteria +- Cleanup packaging for usrmove + +* Thu Jan 26 2012 Harald Hoyer 2.1.10-16 +- fixed load_policy location + +* Thu Jan 26 2012 Harald Hoyer 2.1.10-15 +- fixed load_policy location + +* Thu Jan 26 2012 Harald Hoyer 2.1.10-14 +- fixed load_policy location + +* Wed Jan 25 2012 Harald Hoyer 2.1.10-13 +- add filesystem guard + +* Wed Jan 25 2012 Harald Hoyer 2.1.10-12 +- install everything in /usr + https://fedoraproject.org/wiki/Features/UsrMove + +* Tue Jan 24 2012 Dan Walsh - 2.1.10-11 +- restorecond fixes: + Stop using depracated g_io interfaces + Exit with non zero exit code if wrong options given + Add -h option + +* Thu Jan 19 2012 Dan Walsh - 2.1.10-10 +- Eliminate not needed Requires + +* Wed Jan 18 2012 Dan Walsh - 2.1.10-9 +- fix sepolgen to not crash on echo "" | audit2allow + +* Mon Jan 16 2012 Dan Walsh - 2.1.10-8 +- Remove sandbox init script, should no longer be necessary + +* Sun Jan 15 2012 Dan Walsh - 2.1.10-7 +- Add unit file support to sepolgen, and cleanup some of the output. + +* Mon Jan 9 2012 Dan Walsh - 2.1.10-5 +- Fix English in templates for sepolgen + +* Fri Dec 23 2011 Dan Walsh - 2.1.10-4 +- Fix the handling of namespaces in seunshare/sandbox. +- Currently mounting of directories within sandbox is propogating to the +- parent namesspace. + +* Thu Dec 22 2011 Dan Walsh - 2.1.10-3 +- Add umount code to seunshare to cleanup left over mounts of /var/tmp + +* Wed Dec 21 2011 Dan Walsh - 2.1.10-2 +- Remove open_init_pty + +* Wed Dec 21 2011 Dan Walsh - 2.1.10-1 +-Update to upstream +- sepolgen + * better analysis of why things broke +- policycoreutils + * Remove excess whitespace + * sandbox: Add back in . functions to sandbox.init script + * Fix Makefile to match other policycoreutils Makefiles + * semanage: drop unused translation getopt + +* Thu Dec 15 2011 Dan Walsh - 2.1.9-3 +- Bump libsepol version requires rebuild + +* Wed Dec 7 2011 Dan Walsh - 2.1.9-2 +- Add back accidently dropped patches for semanage + +* Tue Dec 6 2011 Dan Walsh - 2.1.9-1 +- Upgrade to upstream + * sandbox: move sandbox.conf.5 to just sandbox.5 + * po: Makefile use -p to preserve times to allow multilib simultatious installs + * of po files + * sandbox: Allow user to specify the DPI value for X in a sandbox + * sandbox: make sure the domain launching sandbox has at least 100 categories + * sandbox: do not try forever to find available category set + * sandbox: only complain if sandbox unable to launch + * sandbox: init script run twice is still successful + * semanage: print local and dristo equiv rules + * semanage: check file equivalence rules for conflict + * semanage: Make sure semanage fcontext -l -C prints even if local keys + * are not defined + * semanage: change src,dst to target,substitute for equivalency + * sestatus: Updated sestatus and man pages. + * Added SELinux config file man page. + * add clean target to man Makefile + +* Wed Nov 30 2011 Dan Walsh - 2.1.8-8 +- Fix semange fcontext -a to check for more conflicts on equivalency + +* Tue Nov 29 2011 Dan Walsh - 2.1.8-7 +- Fix dpi handling in sandbox +- Make sure semanage fcontext -l -C prints if only local equiv have changed + +* Wed Nov 16 2011 Dan Walsh - 2.1.8-6 +- Add listing of distribution equivalence class from semanage fcontext -l +- Add checking to semanage fcontext -a to guarantee a file specification will not be masked by an equivalence + +* Wed Nov 16 2011 Dan Walsh - 2.1.8-5 +- Allow ~ as a valid part of a filename in sepolgen + +* Fri Nov 11 2011 Dan Walsh - 2.1.8-4 +- sandbox init script should always return 0 +- sandbox command needs to check range of categories and report error if not big enough + +* Mon Nov 7 2011 Dan Walsh - 2.1.8-3 +- Allow user to specify DPI when running sandbox + +* Mon Nov 7 2011 Dan Walsh - 2.1.8-2 +- Add Miroslav patch to return all attributes + +* Fri Nov 4 2011 Dan Walsh - 2.1.8-1 +- Upgrade to policycoreutils upstream + * sandbox: Maintain the LANG environment into the sandbox + * audit2allow: use audit2why internally + * fixfiles: label /root but not /var/lib/BackupPC + * semanage: update local boolean settings is dealing with localstore + * semanage: missing modify=True + * semanage: set modified correctly + * restorecond: make restorecond dbuss-able + * restorecon: Always check return code on asprintf + * restorecond: make restorecond -u exit when terminal closes + * sandbox: introduce package name and language stuff + * semodule_package: remove semodule_unpackage on clean + * fix sandbox Makefile to support DESTDIR + * semanage: Add -o description to the semanage man page + * make use of the new realpath_not_final function + * setfiles: close /proc/mounts file when finished + * semodule: Document semodule -p in man page + * setfiles: fix use before initialized + * restorecond: Add .local/share as a directory to watch +- Upgrade to sepolgen upstream + * Ignore permissive qualifier if found in an interface + * Return name field in avc data + +* Mon Oct 31 2011 Dan Walsh - 2.1.7-6 +- Rebuild versus newer libsepol + +* Fri Oct 28 2011 Dan Walsh - 2.1.7-5 +- A couple of minor coverity fixes for a potential leaked file descriptor +- An an unchecked return code. +- Add ~/.local/share/* to restorecond_user watches + +* Thu Oct 13 2011 Dan Walsh - 2.1.7-4 +- Have sepolgen return name field in AVC + +* Thu Oct 6 2011 Dan Walsh - 2.1.7-3 +- restorecond -u needs to watch terminal for exit if run outside of dbus. + +* Tue Oct 4 2011 Dan Walsh - 2.1.7-2 +- Do not drop capabilities if running newrole as root + +* Fri Sep 30 2011 Dan Walsh - 2.1.7-1 +-Update to upstream + * semanage: fix indentation error in seobject + +* Thu Sep 29 2011 Dan Walsh - 2.1.6-3 +- Ignore permissive commands in interfaces + +* Thu Sep 29 2011 Dan Walsh - 2.1.6-2 +- Remove gnome requirement from polgengui + +* Mon Sep 19 2011 Dan Walsh - 2.1.6-1 +-Update to upstream + policycoreutils-2.1.6 + * sepolgen-ifgen: new attr-helper does something + * audit2allow: use alternate policy file + * audit2allow: sepolgen-ifgen use the attr helper + * setfiles: switch from stat to stat64 + * setfiles: Fix potential crash using dereferenced ftsent + * setfiles: do not wrap * output at 80 characters + * sandbox: add -Wall and -Werror to makefile + * sandbox: add sandbox cgroup support + * sandbox: rewrite /tmp handling + * sandbox: do not bind mount so much + * sandbox: add level based kill option + * sandbox: cntrl-c should kill entire process control group + * Create a new preserve_tunables flag in sepol_handle_t. + * semanage: show running and disk setting for booleans + * semanage: Dont print heading if no items selected + * sepolgen: audit2allow is mistakakenly not allowing valid module names + * semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled + * More files to ignore + * tree: default make target to all not install + * sandbox: do not load unused generic init functions + sepolgen-1.1.2 + * src: sepolgen: add attribute storing infrastructure + * Change perm-map and add open to try to get better results on + * look for booleans that might solve problems + * sepolgen: audit2allow is mistakakenly not allowing valid module names + * tree: default make target to all not install + +* Wed Sep 14 2011 Dan Walsh - 2.1.5-6 +- Change separator on -L from ; to : + +* Thu Sep 8 2011 Dan Walsh - 2.1.5-5 +- Add back lockdown wizard for booleans using pywebkitgtk + +* Wed Sep 7 2011 Dan Walsh - 2.1.5-4 +- Maintain the LANG environment Variable into the sandbox +- Change restorecon/setfiles to only change type part of the context unless + -f qualifier is given + +* Tue Sep 6 2011 Dan Walsh - 2.1.5-3 +- Remove lockdown wizard, since gtkhtml2 is no longer supported. + +* Fri Sep 2 2011 Dan Walsh - 2.1.5-2 +- Allow setfiles and restorecon to use labeledprefix to speed up processing +and limit memory. + +* Tue Aug 30 2011 Dan Walsh - 2.1.5-1 +-Update to upstream + * policycoreutils + * setfiles: Fix process_glob to handle error situations + * sandbox: Allow seunshare to run as root + * sandbox: trap sigterm to make sure sandbox + * sandbox: pass DPI from the desktop + * sandbox: seunshare: introduce helper spawn_command + * sandbox: seunshare: introduce new filesystem helpers + * sandbox: add -C option to not drop + * sandbox: split seunshare caps dropping + * sandbox: use dbus-launch + * sandbox: numerous simple updates to sandbox + * sandbox: do not require selinux context + * sandbox: Makefile: new man pages + * sandbox: rename dir to srcdir + * sandbox: allow users specify sandbox window size + * sandbox: check for paths up front + * sandbox: use defined values for paths rather + * sandbox: move seunshare globals to the top + * sandbox: whitespace fix + * semodule_package: Add semodule_unpackage executable + * setfiles: get rid of some stupid globals + * setfiles: move exclude_non_seclabel_mounts to a generic location + * sepolgen + * refparser: include open among valid permissions + * refparser: add support for filename_trans rules + +* Thu Aug 18 2011 Dan Walsh - 2.1.4-2 +- Fix bug in glob handling for restorecon + +* Thu Aug 18 2011 Dan Walsh - 2.1.4-1 +-Update to upstream +2.1.4 2011-08-17 + * run_init: clarification of the usage in the + * semanage: fix usage header around booleans + * semanage: remove useless empty lines + * semanage: update man page with new examples + * semanage: update usage text + * semanage: introduce file context equivalencies + * semanage: enable and disable modules + * semanage: output all local modifications + * semanage: introduce extraction of local configuration + * semanage: cleanup error on invalid operation + * semanage: handle being called with no arguments + * semanage: return sooner to save CPU time + * semanage: surround getopt with try/except + * semanage: use define/raise instead of lots of + * semanage: some options are only valid for + * semanage: introduce better deleteall support + * semanage: do not allow spaces in file + * semanage: distinguish between builtin and local permissive + * semanage: centralized ip node handling + * setfiles: make the restore function exclude() non-static + * setfiles: use glob to handle ~ and + * fixfiles: do not hard code types + * fixfiles: stop trying to be smart about + * fixfiles: use new kernel seclabel option + * fixfiles: pipe everything to cat before sending + * fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs + * semodule: support for alternative root paths + +2.1.3 2011-08-03 + * semanage: fix indention + * semodule_package: fix man page typo + * semodule_expand: update man page with -a + * semanage: handle os errors + * semanage: fix traceback with bad options + * semanage: show usage on -h or --help + * semanage: introduce more deleteall options + * semanage: verify ports < 65536 + * transaction into semanageRecords + * make get_handle a method of semanageRecords + * remove a needless blank line + * make process_one error if not initialized correctly + * fixfiles: correct usage for r_opts.rootpath + * put -p in help for restorecon and + * fixfiles: do not try to only label + * fixfiles clean up /var/run and /var/lib/debug + * fixfiles delete tmp sockets and pipes rather + * fixfile use find -delete instead of pipe + * chcat man page typo + * add man page for genhomedircon + * setfiles fix typo + * setsebool should inform users they need to + * setsebool typos + * open_init_tty man page typos + * Don't add user site directory to sys.path + * newrole retain CAP_SETPCAP + +2.1.2 2011-08-02 + * seunshare: define _GNU_SOURCE earlier + * make ignore_enoent do something + * restorecond: first user logged in is not noticed + * Repo: update .gitignore + +2.1.1 2011-08-01 + * Man page updates + * restorecon fix for bad inotify assumptions + +2.1.0 2011-07-27 + * Release, minor version bump + +* Tue Jul 26 2011 Dan Walsh 2.0.86-20 +- Fix sepolgen usage statement +- Stop using -k insandbox +- Fix seunshare usage statement + +* Thu Jul 7 2011 Dan Walsh 2.0.86-18 +- Change seunshare to send kill signals to the childs session. +- Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown. + +* Wed Jul 6 2011 Dan Walsh 2.0.86-17 +- Add -k qualifier to seunshare to have it attempt to kill all processes with +the matching MCS label. + +* Tue Jul 5 2011 Dan Walsh 2.0.86-16 +- Add -C option to sandbox and seunshare to maintain capabilities, otherwise +the bounding set will be dropped. +- Change --cgroups short name -c rather then -C for consistancy +- Fix memory and fd leaks in seunshare + +* Wed Jun 29 2011 Jóhann B. Guðmundsson - 2.0.86-15 +- Introduce systemd unit file for restorecond drop SysV support + +* Mon Jun 13 2011 Dan Walsh 2.0.86-14 +- Do not drop capability bounding set in seunshare, this allows sandbox to +- run setuid apps. + +* Fri Jun 10 2011 Dan Walsh 2.0.86-13 +- Add semanage-bash-completion.sh script + +* Tue Jun 7 2011 Dan Walsh 2.0.86-12 +- Remove mount -o bind calls from sandbox init script +- pam_namespace now has this built in. + +* Tue Jun 7 2011 Dan Walsh 2.0.86-11 +- Pass desktop dpi to sandbox Xephyr window + +* Mon Jun 6 2011 Dan Walsh 2.0.86-10 +- Allow semodule to pick alternate root for selinux files +- Add ~/.config/* to restorcond_user.conf, so restorecond will watch for mislabeled files in this directory. + +* Wed May 25 2011 Dan Walsh 2.0.86-9 +- Fix var_spool template read_spool_files +- Fix sepolgen to handle filename transitions + +* Mon May 23 2011 Dan Walsh 2.0.86-8 +- Templates cleanedup by Dominic Grift + +* Fri Apr 29 2011 Dan Walsh 2.0.86-7 +- Clean up some of the templates for sepolgen + +* Fri Apr 22 2011 Dan Walsh 2.0.86-6 +- Apply patches from Christoph A. + * fix sandbox title + * stop xephyr from li +- Also ignore errors on sandbox include of directory missing files + +* Thu Apr 21 2011 Dan Walsh 2.0.86-5 +- rebuild versus latest libsepol + +* Mon Apr 18 2011 Dan Walsh 2.0.86-4 +- Change fixfiles restore to delete unlabeled sockets in /tmp + +* Mon Apr 18 2011 Dan Walsh 2.0.86-2 +- rebuild versus latest libsepol + +* Tue Apr 12 2011 Dan Walsh 2.0.86-1 +- Update to upstream + * Use correct color range in mcstrand by Richard Haines. + +* Mon Apr 11 2011 Dan Walsh 2.0.85-30 +- Add Elia Pinto patches to allow user to specify directories to ignore + +* Tue Apr 5 2011 Dan Walsh 2.0.85-29 +- Fix policycoreutils-sandbox description + +* Tue Mar 29 2011 Dan Walsh 2.0.85-28 +- rsynccmd should run outside of execcon + +* Thu Mar 24 2011 Dan Walsh 2.0.85-27 +- Fix semange node handling of ipv6 addresses + +* Wed Mar 23 2011 Dan Walsh 2.0.85-26 +- Fix sepolgen-ifgen call, add -p option + +* Wed Mar 23 2011 Dan Walsh 2.0.85-25 +- Fix sepolgen-ifgen call + +* Fri Mar 18 2011 Dan Walsh 2.0.85-24 +- Fix rsync command to work if the directory is old. +- Fix all tests + +* Wed Mar 16 2011 Dan Walsh 2.0.85-23 +- Fix sepolgen to generate network polcy using generic_if and genric_node versus all_if and all_node + +* Wed Mar 16 2011 Dan Walsh 2.0.85-22 +- Return to original seunshare man page + +* Fri Mar 11 2011 Dan Walsh 2.0.85-21 +- change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_* +- This will allow default sandboxes to work on NFS homedirs without allowing + access to homedir data + +* Fri Mar 11 2011 Dan Walsh 2.0.85-20 +- Change sepolgen-ifgen to search all available policy files +- Exit in restorecond if it can not find a UID in the passwd database + +* Wed Mar 9 2011 Dan Walsh 2.0.85-19 +- Fix portspage in system-config-selinux to not crash +- More fixes for seunshare from Tomas Hoger + +* Tue Mar 8 2011 Dan Walsh 2.0.85-18 +- put back in old handling of -T in sandbox command +- Put back setsid in seunshare +- Fix rsync to maintain times + +* Tue Mar 8 2011 Dan Walsh 2.0.85-17 +- Use rewritten seunshare from thoger + +* Mon Mar 7 2011 Dan Walsh 2.0.85-16 +- Require python-IPy for policycoreutils-python package +- Fixes for sepologen + - Usage statement needs -n name + - Names with _ are being prevented + - dbus apps should get _chat interface + +* Thu Mar 3 2011 Dan Walsh 2.0.85-15 +- Fix error message in seunshare, check for tmpdir existance before unlink. + +* Fri Feb 25 2011 Dan Walsh 2.0.85-13 +- Rewrite seunshare to make sure /tmp is mounted stickybit owned by root +- Only allow names in polgengui that contain letters and numbers +- Fix up node handling in semanage command +- Update translations + +* Wed Feb 09 2011 Fedora Release Engineering - 2.0.85-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Thu Feb 3 2011 Dan Walsh 2.0.85-11 +- Fix sandbox policy creation with udp connect ports + +* Thu Feb 3 2011 Dan Walsh 2.0.85-10 +- Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name +- Cleanup chcat man page + +* Wed Feb 2 2011 Dan Walsh 2.0.85-9 +- Report full errors on OSError on Sandbox + +* Fri Jan 21 2011 Dan Walsh 2.0.85-8 +- Fix newrole hanlding of pcap + +* Wed Jan 19 2011 Dan Walsh 2.0.85-7 +- Have restorecond watch more directories in homedir + +* Fri Jan 14 2011 Dan Walsh 2.0.85-6 +- Add sandbox to sepolgen + +* Thu Jan 6 2011 Dan Walsh 2.0.85-4 +- Fix proper handling of getopt errors +- Do not allow modules names to contain spaces + +* Wed Jan 5 2011 Dan Walsh 2.0.85-3 +- Polgengui raises the wrong type of exception. #471078 +- Change semanage to not allow it to semanage module -D +- Change setsebool to suggest run as root on failure + +* Wed Dec 22 2010 Dan Walsh 2.0.85-2 +- Fix restorecond watching utmp file for people logging in our out + +* Tue Dec 21 2010 Dan Walsh 2.0.85-1 +- Update to upstream + +* Thu Dec 16 2010 Dan Walsh 2.0.84-5 +- Change to allow sandbox to run on nfs homedirs, add start python script + +* Wed Dec 15 2010 Dan Walsh 2.0.84-4 +- Move seunshare to sandbox package + +* Mon Nov 29 2010 Dan Walsh 2.0.84-3 +- Fix sandbox to show correct types in usage statement + +* Mon Nov 29 2010 Dan Walsh 2.0.84-2 +- Stop fixfiles from complaining about missing dirs + +* Mon Nov 22 2010 Dan Walsh 2.0.84-1 +- Update to upstream +- List types available for sandbox in usage statement + +* Mon Nov 22 2010 Dan Walsh 2.0.83-37 +- Don't report error on load_policy when system is disabled. + +* Mon Nov 8 2010 Dan Walsh 2.0.83-36 +- Fix up problems pointed out by solar designer on dropping capabilities + +* Mon Nov 1 2010 Dan Walsh 2.0.83-35 +- Check if you have full privs and reset otherwise dont drop caps + +* Mon Nov 1 2010 Dan Walsh 2.0.83-34 +- Fix setools require line + +* Fri Oct 29 2010 Dan Walsh 2.0.83-33 +- Move /etc/pam.d/newrole in to polcicycoreutils-newrole +- Additional capability checking in sepolgen + +* Mon Oct 25 2010 Dan Walsh 2.0.83-32 +- Remove setuid flag and replace with file capabilities +- Fix sandbox handling of files with spaces in them + +* Wed Sep 29 2010 jkeating - 2.0.83-31 +- Rebuilt for gcc bug 634757 + +* Thu Sep 23 2010 Dan Walsh 2.0.83-30 +- Move restorecond into its own subpackage + +* Thu Sep 23 2010 Dan Walsh 2.0.83-29 +- Fix semanage man page + +* Mon Sep 13 2010 Dan Walsh 2.0.83-28 +- Add seremote, to allow the execution of command inside the sandbox from outside the sandbox. + +* Mon Sep 13 2010 Dan Walsh 2.0.83-27 +- Fix sandbox copyfile when copying a dir with a socket, print error + +* Fri Sep 10 2010 Dan Walsh 2.0.83-26 +- Stop polgengui from crashing if selinux policy is not installed + +* Thu Sep 9 2010 Dan Walsh 2.0.83-25 +- Fix bug preventing sandbox from using -l + +* Tue Sep 7 2010 Dan Walsh 2.0.83-24 +- Eliminate quotes fro desktop files + +* Mon Aug 30 2010 Dan Walsh 2.0.83-23 +- Add -w windowsize patch from Christoph A. + +* Mon Aug 30 2010 Dan Walsh 2.0.83-22 +- Update po + +* Wed Aug 25 2010 Dan Walsh 2.0.83-21 +- Update po + +* Tue Aug 24 2010 Dan Walsh 2.0.83-20 +- Tighten down seunshare to create /tmp dir with sticky bit and MS_NODEV | MS_NOSUID | MS_NOEXEC; +- Remove setsid on seunshare so ^c on sandbox will cause apps to exit +- Add dbus-launch --exit-with-session so all processes launched within the sandbox exit with the sandbox +- Clean up error handling so error will get sent back to sandbox tool + +* Mon Aug 23 2010 Dan Walsh 2.0.83-19 +- Fix translation handling in file context page of system-config-selinux + +* Fri Aug 13 2010 Dan Walsh 2.0.83-18 +- Fix sandbox error handling + +* Fri Aug 13 2010 Dan Walsh 2.0.83-17 +- Apply patch to restorecond from Chris Adams, which will cause restorecond +- to watch first user that logs in. + +* Thu Aug 12 2010 Dan Walsh 2.0.83-16 +- Add COPYING file to doc dir + +* Thu Aug 5 2010 Dan Walsh 2.0.83-15 +- Update po and translations +Resolves: #610473 + +* Thu Aug 5 2010 Dan Walsh 2.0.83-14 +- More fixes for polgen tools + +* Thu Aug 5 2010 Dan Walsh 2.0.83-13 +- Remove requirement to run selinux-polgen as root + +* Thu Aug 5 2010 Dan Walsh 2.0.83-12 +- Update po and translations +- Fix gui policy generation tools + +* Wed Aug 4 2010 Dan Walsh 2.0.83-11 +- Update po and translations + +* Sat Jul 31 2010 David Malcolm - 2.0.83-10 +- rebuild against python 2.7 + +* Wed Jul 28 2010 Dan Walsh 2.0.83-9 +- Update selinux-polgengui to sepolgen policy generation + +* Wed Jul 28 2010 Dan Walsh 2.0.83-8 +- Fix invalid free in seunshare and fix man page + +* Tue Jul 27 2010 Dan Walsh 2.0.83-7 +- Update translations + +* Mon Jul 26 2010 Dan Walsh 2.0.83-6 +- Fix sandbox man page + +* Wed Jul 21 2010 David Malcolm - 2.0.83-5 +- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild + +* Tue Jul 20 2010 Dan Walsh 2.0.83-4 +- Add translations for menus +- Fixup man page from Russell Coker + +* Tue Jun 15 2010 Dan Walsh 2.0.83-3 +- Change python scripts to use -s flag +- Update po + +* Tue Jun 15 2010 Dan Walsh 2.0.83-1 +- Update to upstream + * Add sandbox support from Dan Walsh with modifications from Steve Lawrence. + +* Tue Jun 15 2010 Dan Walsh 2.0.82-31 +- Fix sepolgen code generation +Resolve: #603001 + +* Tue Jun 8 2010 Dan Walsh 2.0.82-30 +- Add cgroup support for sandbox + +* Mon Jun 7 2010 Dan Walsh 2.0.82-29 +- Allow creation of /var/cache/DOMAIN from sepolgen + +* Thu Jun 3 2010 Dan Walsh 2.0.82-28 +- Fix sandbox init script +- Add dbus-launch to sandbox -X +Resolve: #599599 + +* Thu Jun 3 2010 Dan Walsh 2.0.82-27 +- Move genhomedircon.8 to same package as genhomedircon +- Fix sandbox to pass unit test +Resolves: #595796 + +* Wed Jun 2 2010 Dan Walsh 2.0.82-26 +- Fix listing of booleans from audit2allow + +* Wed Jun 2 2010 Dan Walsh 2.0.82-25 +- Fix audit2allow to output if the current policy has avc +- Update translations +- Fix icon + +* Thu May 27 2010 Dan Walsh 2.0.82-24 +- Man page fixes +- sandbox fixes +- Move seunshare to base package + +* Fri May 21 2010 Dan Walsh 2.0.82-23 +- Fix seunshare translations +- Fix seunshare to work on all arches +- Fix icon for system-config-selinux +Resolves: #595276 + +* Fri May 21 2010 Dan Walsh 2.0.82-22 +- Fix can_exec definition in sepolgen + +* Fri May 21 2010 Dan Walsh 2.0.82-21 +- Add man page for seunshare and genhomedircon +Resolves: #594303 +- Fix node management via semanage + +* Wed May 19 2010 Dan Walsh 2.0.82-20 +- Fixes from upstream for sandbox command +Resolves: #580938 + +* Thu May 13 2010 Dan Walsh 2.0.82-18 +- Fix sandbox error handling on copyfile +- Fix desktop files + +* Tue May 11 2010 Dan Walsh 2.0.82-17 +- Fix policy tool to have correct name in menus +- Fix seunshare to handle /tmp being in ~/home +- Fix saving of altered files +- Update translations + +* Tue May 4 2010 Dan Walsh 2.0.82-15 +- Allow audit2allow to specify alternative policy file for analysis + +* Mon May 3 2010 Dan Walsh 2.0.82-14 +- Update po +- Fix sepolgen --no_attrs +Resolves: #588280 + +* Thu Apr 29 2010 Dan Walsh 2.0.82-13 +- Make semanage boolean work on disabled machines and during livecd xguest +- Fix homedir and tmpdir handling in sandbox +Resolves: #587263 + +* Wed Apr 28 2010 Dan Walsh 2.0.82-11 +- Make semanage boolean work on disabled machines + +* Tue Apr 27 2010 Dan Walsh 2.0.82-10 +- Make sepolgen-ifgen be quiet + +* Wed Apr 21 2010 Dan Walsh 2.0.82-8 +- Make sepolgen report on more interfaces +- Fix system-config-selinux display of modules + +* Thu Apr 15 2010 Dan Walsh 2.0.82-7 +- Fix crash when args are empty +Resolves: #582542 +- Fix semange to exit on bad options +- Fix semanage dontaudit man page section +Resolves: #582533 + +* Wed Apr 14 2010 Dan Walsh 2.0.82-6 +- Remove debug line from semanage +- Update po + +* Tue Apr 13 2010 Dan Walsh 2.0.82-5 +- Fix sandbox comment on HOMEDIRS +- Fix sandbox to throw error on bad executable + +* Tue Apr 6 2010 Dan Walsh 2.0.82-4 +- Fix spacing in templates + +* Wed Mar 31 2010 Dan Walsh 2.0.82-3 +- Fix semanage return codes + +* Tue Mar 30 2010 Dan Walsh 2.0.82-2 +- Fix sepolgen to confirm to the "Reference Policy Style Guide" + +* Tue Mar 23 2010 Dan Walsh 2.0.82-1 +- Update to upstream + * Add avc's since boot from Dan Walsh. + * Fix unit tests from Dan Walsh. + +* Tue Mar 23 2010 Dan Walsh 2.0.81-4 +- Update to upstream - sepolgen + * Add since-last-boot option to audit2allow from Dan Walsh. + * Fix sepolgen output to match what Chris expects for upstream + refpolicy from Dan Walsh. + +* Mon Mar 22 2010 Dan Walsh 2.0.81-3 +- Allow restorecon on > 2 Gig files + +* Tue Mar 16 2010 Dan Walsh 2.0.81-2 +- Fix semanage handling of boolean options +- Update translations + +* Fri Mar 12 2010 Dan Walsh 2.0.81-1 +- Update to upstream + * Add dontaudit flag to audit2allow from Dan Walsh. + +* Thu Mar 11 2010 Dan Walsh 2.0.80-2 +- Use --rbind in sandbox init scripts + +* Mon Mar 8 2010 Dan Walsh 2.0.80-1 +- Update to upstream + * Module enable/disable support from Dan Walsh. + +* Mon Mar 1 2010 Dan Walsh 2.0.79-5 +- Rewrite of sandbox script, add unit test for sandbox +- Update translations + +* Mon Mar 1 2010 Dan Walsh 2.0.79-4 +- Fix patch for dontaudit rules from audit2allow for upstream acceptance + +* Fri Feb 26 2010 Dan Walsh 2.0.79-3 +- Fixes for fixfiles + +* Wed Feb 17 2010 Dan Walsh 2.0.79-2 +- Fix sandbox to complain if mount-shared has not been run +- Fix to use /etc/sysconfig/sandbox + +* Tue Feb 16 2010 Dan Walsh 2.0.79-1 +- Update to upstream + * Fix double-free in newrole +- Fix python language handling + +* Thu Feb 11 2010 Dan Walsh 2.0.78-21 +- Fix display of command in sandbox + +* Fri Feb 5 2010 Dan Walsh 2.0.78-20 +- Catch OSError in semanage + +* Wed Feb 3 2010 Dan Walsh 2.0.78-19 +- Fix seobject and fixfiles + +* Fri Jan 29 2010 Dan Walsh 2.0.78-17 +- Change seobject to use translations properly + +* Thu Jan 28 2010 Dan Walsh 2.0.78-16 +- Cleanup spec file +Resolves: 555835 + +* Thu Jan 28 2010 Dan Walsh 2.0.78-15 +- Add use_resolve to sepolgen + +* Wed Jan 27 2010 Dan Walsh 2.0.78-14 +- Add session capability to sandbox +- sandbox -SX -H ~/.homedir -t unconfined_t -l s0:c15 /etc/gdm/Xsession + +* Thu Jan 21 2010 Dan Walsh 2.0.78-13 +- Fix executable template for fifo files + +* Tue Jan 19 2010 Dan Walsh 2.0.78-12 +- Fix patch xod xmodmap +- Exit 0 from script + +* Thu Jan 14 2010 Dan Walsh 2.0.78-11 +- Run with the same xdmodmap in sandbox as outside +- Patch from Josh Cogliati + +* Fri Jan 8 2010 Dan Walsh 2.0.78-10 +- Fix sepolgen to not generate user sh section on non user policy + +* Fri Jan 8 2010 Dan Walsh 2.0.78-9 +- Add -e to semanage man page +- Add -D qualifier to audit2allow to generate dontaudit rules + +* Wed Jan 6 2010 Dan Walsh 2.0.78-8 +- Speed up audit2allow processing of audit2why comments + +* Fri Dec 18 2009 Dan Walsh 2.0.78-7 +- Fixes to sandbox man page + +* Thu Dec 17 2009 Dan Walsh 2.0.78-6 +- Add setools-libs-python to requires for gui + +* Wed Dec 16 2009 Dan Walsh 2.0.78-5 +- If restorecond running as a user has no files to watch then it should exit. (NFS Homedirs) + +* Thu Dec 10 2009 Dan Walsh 2.0.78-4 +- Move sandbox man page to base package + +* Tue Dec 8 2009 Dan Walsh 2.0.78-3 +- Fix audit2allow to report constraints, dontaudits, types, booleans + +* Fri Dec 4 2009 Dan Walsh 2.0.78-2 +- Fix restorecon -i to ignore enoent + +* Tue Dec 1 2009 Dan Walsh 2.0.78-1 +- Update to upstream + * Remove non-working OUTFILE from fixfiles from Dan Walsh. + * Additional exception handling in chcat from Dan Walsh. + + * fix sepolgen to read a "type 1403" msg as a policy load by Stephen + Smalley + * Add support for Xen ocontexts from Paul Nuzzi. + +* Tue Nov 24 2009 Dan Walsh 2.0.77-1 +- Update to upstream + * Fixed bug preventing semanage node -a from working + from Chad Sellers + * Fixed bug preventing semanage fcontext -l from working + from Chad Sellers +- Change semanage to use unicode + +* Wed Nov 18 2009 Dan Walsh 2.0.76-1 +- Update to upstream + * Remove setrans management from semanage, as it does not work + from Dan Walsh. + * Move load_policy from /usr/sbin to /sbin from Dan Walsh. + +* Mon Nov 16 2009 Dan Walsh 2.0.75-3 +- Raise exception if user tries to add file context with an embedded space + +* Wed Nov 11 2009 Dan Walsh 2.0.75-2 +- Fix sandbox to setsid so it can run under mozilla without crashing the session + +* Mon Nov 2 2009 Dan Walsh 2.0.75-1 +- Update to upstream + * Factor out restoring logic from setfiles.c into restore.c + +* Fri Oct 30 2009 Dan Walsh 2.0.74-15 +- Fix typo in seobject.py + +* Fri Oct 30 2009 Dan Walsh 2.0.74-14 +- Allow semanage -i and semanage -o to generate customization files. +- semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration + +* Tue Oct 20 2009 Dan Walsh 2.0.74-13 +- Fix restorecond man page + +* Mon Oct 19 2009 Dan Walsh 2.0.74-12 +- Add generation of the users context file to polgengui + +* Fri Oct 16 2009 Dan Walsh 2.0.74-11 +- Remove tabs from system-config-selinux glade file + +* Thu Oct 15 2009 Dan Walsh 2.0.74-10 +- Remove translations screen from system-config-selinux + +* Wed Oct 14 2009 Dan Walsh 2.0.74-9 +- Move fixfiles man pages into the correct package +- Add genhomedircon to fixfiles restore + +* Tue Oct 6 2009 Dan Walsh 2.0.74-8 +- Add check to sandbox to verify save changes - Chris Pardy +- Fix memory leak in restorecond - Steve Grubb + +* Thu Oct 1 2009 Dan Walsh 2.0.74-7 +- Fixes Templates + +* Thu Oct 1 2009 Dan Walsh 2.0.74-6 +- Fixes for polgengui to handle tcp ports correctly +- Fix semanage node -a + +* Wed Sep 30 2009 Dan Walsh 2.0.74-5 +- Fixes for semanage -equiv, readded modules, --enable, --disable + +* Sun Sep 20 2009 Dan Walsh 2.0.74-4 +- Close sandbox when eclipse exits + +* Fri Sep 18 2009 Dan Walsh 2.0.74-3 +- Security fixes for seunshare +- Fix Sandbox to handle non file input to command. + +* Thu Sep 17 2009 Dan Walsh 2.0.74-2 +- Security fixes for seunshare + +* Thu Sep 17 2009 Dan Walsh 2.0.74-1 +- Update to upstream + * Change semodule upgrade behavior to install even if the module + is not present from Dan Walsh. + * Make setfiles label if selinux is disabled and a seclabel aware + kernel is running from Caleb Case. + * Clarify forkpty() error message in run_init from Manoj Srivastava. + +* Mon Sep 14 2009 Dan Walsh 2.0.73-5 +- Fix sandbox to handle relative paths + +* Mon Sep 14 2009 Dan Walsh 2.0.73-4 +- Add symbolic link to load_policy + +* Mon Sep 14 2009 Dan Walsh 2.0.73-3 +- Fix restorecond script to use force-reload + +* Tue Sep 8 2009 Dan Walsh 2.0.73-2 +- Fix init script to show status in usage message + +* Tue Sep 8 2009 Dan Walsh 2.0.73-1 +- Update to upstream + * Add semanage dontaudit to turn off dontaudits from Dan Walsh. + * Fix semanage to set correct mode for setrans file from Dan Walsh. + * Fix malformed dictionary in portRecord from Dan Walsh. + * Restore symlink handling support to restorecon based on a patch by + Martin Orr. This fixes the restorecon /dev/stdin performed by Debian + udev scripts that was broken by policycoreutils 2.0.70. + +* Thu Sep 3 2009 Dan Walsh 2.0.71-15 +- Add DAC_OVERRIED to seunshare + +* Wed Sep 2 2009 Bill Nottingham 2.0.71-15 +- Fix typo + +* Fri Aug 28 2009 Dan Walsh 2.0.71-14 +- Add enable/disable patch + +* Thu Aug 27 2009 Tomas Mraz - 2.0.71-13 +- rebuilt with new audit + +* Wed Aug 26 2009 Dan Walsh 2.0.71-12 +- Tighten up controls on seunshare.c + +* Wed Aug 26 2009 Dan Walsh 2.0.71-11 +- Add sandboxX + +* Sat Aug 22 2009 Dan Walsh 2.0.71-10 +- Fix realpath usage to only happen on argv input from user + +* Fri Aug 21 2009 Ville Skyttä - 2.0.71-9 +- Don't try to remove restorecond after last erase (done already in %%preun). +- Ensure scriptlets exit with status 0. +- Fix %%post and %%pr + +* Thu Aug 20 2009 Dan Walsh 2.0.71-7 +- Fix glob handling of /.. + +* Wed Aug 19 2009 Dan Walsh 2.0.71-6 +- Redesign restorecond to use setfiles/restore functionality + +* Wed Aug 19 2009 Dan Walsh 2.0.71-5 +- Fix sepolgen again + +* Tue Aug 18 2009 Dan Walsh 2.0.71-4 +- Add --boot flag to audit2allow to get all AVC messages since last boot + +* Tue Aug 18 2009 Dan Walsh 2.0.71-3 +- Fix semanage command + +* Thu Aug 13 2009 Dan Walsh 2.0.71-2 +- exclude unconfined.if from sepolgen + +* Thu Aug 13 2009 Dan Walsh 2.0.71-1 +- Fix chcat to report error on non existing file +- Update to upstream + * Modify setfiles/restorecon checking of exclude paths. Only check + user-supplied exclude paths (not automatically generated ones based on + lack of seclabel support), don't require them to be directories, and + ignore permission denied errors on them (it is ok to exclude a path to + which the caller lacks permission). + +* Mon Aug 10 2009 Dan Walsh 2.0.70-2 +- Don't warn if the user did not specify the exclude if root can not stat file system + +* Wed Aug 5 2009 Dan Walsh 2.0.70-1 +- Update to upstream + * Modify restorecon to only call realpath() on user-supplied pathnames + from Stephen Smalley. + * Fix typo in fixfiles that prevented it from relabeling btrfs + filesystems from Dan Walsh. + +* Wed Jul 29 2009 Dan Walsh 2.0.68-1 +- Fix location of man pages +- Update to upstream + * Modify setfiles to exclude mounts without seclabel option in + /proc/mounts on kernels >= 2.6.30 from Thomas Liu. + * Re-enable disable_dontaudit rules upon semodule -B from Christopher + Pardy and Dan Walsh. + * setfiles converted to fts from Thomas Liu. + +* Sun Jul 26 2009 Fedora Release Engineering - 2.0.64-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Tue Jul 7 2009 Tom "spot" Callaway 2.0.64-2 +- fix multiple directory ownership of mandirs + +* Fri Jun 26 2009 Dan Walsh 2.0.64-1 +- Update to upstream + * Keep setfiles from spamming console from Dan Walsh. + * Fix chcat's category expansion for users from Dan Walsh. +- Update po files +- Fix sepolgen + +* Thu Jun 4 2009 Dan Walsh 2.0.63-5 +- Add sepolgen executable + +* Mon Jun 1 2009 Dan Walsh 2.0.63-4 +- Fix Sandbox option handling +- Fix fixfiles handling of btrfs + +* Tue May 26 2009 Dan Walsh 2.0.63-3 +- Fix sandbox to be able to execute files in homedir + +* Fri May 22 2009 Dan Walsh 2.0.63-2 +- Change polgen.py to be able to generate policy + +* Wed May 20 2009 Dan Walsh 2.0.63-1 +- Update to upstream + * Fix transaction checking from Dan Walsh. + * Make fixfiles -R (for rpm) recursive. + * Make semanage permissive clean up after itself from Dan Walsh. + * add /root/.ssh/* to restorecond.conf + +* Wed Apr 22 2009 Dan Walsh 2.0.62-14 +- Fix audit2allow -a to retun /var/log/messages + +* Wed Apr 22 2009 Dan Walsh 2.0.62-13 +- Run restorecond as a user service + +* Thu Apr 16 2009 Dan Walsh 2.0.62-12 +- Add semanage module support + +* Tue Apr 14 2009 Dan Walsh 2.0.62-10 +- Do not print \n, if count < 1000; + +* Sat Apr 11 2009 Dan Walsh 2.0.62-9 +- Handle case where subs file does not exist + +* Wed Apr 8 2009 Dan Walsh 2.0.62-8 +- Update po files +- Add --equiv command for semanage + +* Tue Mar 31 2009 Dan Walsh 2.0.62-7 +- Cleanup creation of permissive domains +- Update po files + +* Mon Mar 23 2009 Dan Walsh 2.0.62-6 +- Update po files + +* Thu Mar 12 2009 Dan Walsh 2.0.62-5 +- Fix semanage transations + +* Sat Mar 7 2009 Dan Walsh 2.0.62-4 +- Update polgengui templates to match current upstream policy + +* Thu Feb 26 2009 Fedora Release Engineering - 2.0.62-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Mon Feb 23 2009 Dan Walsh 2.0.62-2 +- Add /root/.ssh to restorecond.conf +- fixfiles -R package should recursively fix files + +* Wed Feb 18 2009 Dan Walsh 2.0.62-1 +- Update to upstream + * Add btrfs to fixfiles from Dan Walsh. + * Remove restorecond error for matching globs with multiple hard links + and fix some error messages from Dan Walsh. + * Make removing a non-existant module a warning rather than an error + from Dan Walsh. + * Man page fixes from Dan Walsh. + +* Mon Feb 16 2009 Dan Walsh 2.0.61-10 +- Fix script created by polgengui to not refer to selinux-policy-devel + +* Mon Feb 9 2009 Dan Walsh 2.0.61-9 +- Change initc scripts to use proper labeling on gui + +* Mon Feb 9 2009 Dan Walsh 2.0.61-8 +- Add obsoletes to cause policycoreuils to update both python and non python version + +* Fri Jan 30 2009 Dan Walsh 2.0.61-7 +- Dont report errors on glob match and multiple links + +* Thu Jan 22 2009 Dan Walsh 2.0.61-6 +- Move sepolgen-ifgen to post python + +* Wed Jan 21 2009 Dan Walsh 2.0.61-4 +- Fix Translations + +* Tue Jan 20 2009 Dan Walsh 2.0.61-3 +- Add Domains Page to system-config-selinux +- Add ability to create dbus confined applications to polgen + +* Wed Jan 14 2009 Dan Walsh 2.0.61-2 +- Split python into a separate package + +* Tue Jan 13 2009 Dan Walsh 2.0.61-1 +- Update to upstream + * chcat: cut categories at arbitrary point (25) from Dan Walsh + * semodule: use new interfaces in libsemanage for compressed files + from Dan Walsh + * audit2allow: string changes for usage + +* Tue Jan 6 2009 Dan Walsh 2.0.60-7 +- Don't error out when removing a non existing module + +* Mon Dec 15 2008 Dan Walsh 2.0.60-6 +- fix audit2allow man page + +* Wed Dec 10 2008 Dan Walsh 2.0.60-5 +- Fix Japanese translations + +* Sat Dec 6 2008 Dan Walsh 2.0.60-4 +- Change md5 to hashlib.md5 in sepolgen + +* Thu Dec 04 2008 Ignacio Vazquez-Abrams - 2.0.60-3 +- Rebuild for Python 2.6 + +* Tue Dec 2 2008 Dan Walsh 2.0.60-2 +- Fix error checking in restorecond, for inotify_add_watch + +* Mon Dec 1 2008 Dan Walsh 2.0.60-1 +- Update to upstream + * semanage: use semanage_mls_enabled() from Stephen Smalley. + +* Sat Nov 29 2008 Ignacio Vazquez-Abrams - 2.0.59-2 +- Rebuild for Python 2.6 + +* Tue Nov 11 2008 Dan Walsh 2.0.59-1 +- Update to upstream + * fcontext add checked local records twice, fix from Dan Walsh. + +* Mon Nov 10 2008 Dan Walsh 2.0.58-1 +- Update to upstream + * Allow local file context entries to override policy entries in + semanage from Dan Walsh. + * Newrole error message corrections from Dan Walsh. + * Add exception to audit2why call in audit2allow from Dan Walsh. + +* Fri Nov 7 2008 Dan Walsh 2.0.57-12 +- add compression + +* Tue Nov 04 2008 Jesse Keating - 2.0.57-11 +- Move the usermode-gtk requires to the -gui subpackage. + +* Thu Oct 30 2008 Dan Walsh 2.0.57-10 +- Fix traceback in audit2why + +* Wed Oct 29 2008 Dan Walsh 2.0.57-9 +- Make GUI use translations + +* Wed Oct 29 2008 Dan Walsh 2.0.57-8 +- Fix typo in man page + +* Tue Oct 28 2008 Dan Walsh 2.0.57-7 +- Handle selinux disabled correctly +- Handle manipulation of fcontext file correctly + +* Mon Oct 27 2008 Dan Walsh 2.0.57-6 +- Add usermode-gtk requires + +* Thu Oct 23 2008 Dan Walsh 2.0.57-5 +- Allow addition of local modifications of fcontext policy. + +* Mon Oct 20 2008 Dan Walsh 2.0.57-4 +- Fix system-config-selinux booleanspage throwing and exception +- Update po files + +* Fri Oct 17 2008 Dan Walsh 2.0.57-3 +- Fix text in newrole +- Fix revertbutton on booleans page in system-config-selinux + +* Wed Oct 1 2008 Dan Walsh 2.0.57-2 +- Change semodule calls for libsemanage + +* Wed Oct 1 2008 Dan Walsh 2.0.57-1 +- Update to upstream + * Update po files from Dan Walsh. + +* Fri Sep 12 2008 Dan Walsh 2.0.56-1 +- Fix semanage help display +- Update to upstream + * fixfiles will now remove all files in /tmp and will check for + unlabeled_t in /tmp and /var/tmp from Dan Walsh. + * add glob support to restorecond from Dan Walsh. + * allow semanage to handle multi-line commands in a single transaction + from Dan Walsh. + +* Thu Sep 11 2008 Dan Walsh 2.0.55-8 +- Only call gen_requires once in sepolgen + +* Tue Sep 9 2008 Dan Walsh 2.0.55-7 +- Change Requires line to gnome-python2-gnome +- Fix spelling mistakes +- Require libselinux-utils + +* Mon Sep 8 2008 Dan Walsh 2.0.55-5 +- Add node support to semanage + +* Mon Sep 8 2008 Dan Walsh 2.0.55-4 +- Fix fixfiles to correct unlabeled_t files and remove .? files + +* Wed Sep 3 2008 Dan Walsh 2.0.55-2 +- Add glob support to restorecond so it can check every file in the homedir + +* Thu Aug 28 2008 Dan Walsh 2.0.55-1 +- Update to upstream + * Merged semanage node support from Christian Kuester. + +* Fri Aug 15 2008 Dan Walsh 2.0.54-7 +- Add require libsemanage-python + +* Mon Aug 11 2008 Dan Walsh 2.0.54-6 +- Add missing html_util.py file + +* Thu Aug 7 2008 Dan Walsh 2.0.54-5 +- Fixes for multiple transactions + +* Wed Aug 6 2008 Dan Walsh 2.0.54-2 +- Allow multiple transactions in one semanage command + +* Tue Aug 5 2008 Dan Walsh 2.0.54-1 +- Update to upstream + * Add support for boolean files and group support for seusers from Dan Walsh. + * Ensure that setfiles -p output is newline terminated from Russell Coker. + +* Fri Aug 1 2008 Dan Walsh 2.0.53-3 +- Allow semanage user to add group lists % groupname + +* Tue Jul 29 2008 Dan Walsh 2.0.53-2 +- Fix help + +* Tue Jul 29 2008 Dan Walsh 2.0.53-1 +- Update to upstream + * Change setfiles to validate all file_contexts files when using -c from Stephen Smalley. + +* Tue Jul 29 2008 Dan Walsh 2.0.52-6 +- Fix boolean handling +- Upgrade to latest sepolgen +- Update po patch + +* Wed Jul 9 2008 Dan Walsh 2.0.52-5 +- Additial cleanup of boolean handling for semanage + +* Tue Jul 8 2008 Dan Walsh 2.0.52-4 +- Handle ranges of ports in gui + +* Tue Jul 8 2008 Dan Walsh 2.0.52-3 +- Fix indent problems in seobject + +* Wed Jul 2 2008 Dan Walsh 2.0.52-2 +- Add lockdown wizard +- Allow semanage booleans to take an input file an process lots of booleans at once. + +* Wed Jul 2 2008 Dan Walsh 2.0.52-1 +- Default prefix to "user" + +* Tue Jul 1 2008 Dan Walsh 2.0.50-2 +- Remove semodule use within semanage +- Fix launching of polgengui from toolbar + +* Mon Jun 30 2008 Dan Walsh 2.0.50-1 +- Update to upstream + * Fix audit2allow generation of role-type rules from Karl MacMillan. + +* Tue Jun 24 2008 Dan Walsh 2.0.49-10 +- Fix spelling of enforcement + +* Mon Jun 23 2008 Dan Walsh 2.0.49-8 +- Fix sepolgen/audit2allow handling of roles + +* Mon Jun 16 2008 Dan Walsh 2.0.49-7 +- Fix sepolgen-ifgen processing + +* Thu Jun 12 2008 Dan Walsh 2.0.49-6 +- Add deleteall to semanage permissive, cleanup error handling + +* Thu Jun 12 2008 Dan Walsh 2.0.49-5 +- Complete removal of rhpl requirement + +* Wed Jun 11 2008 Dan Walsh 2.0.49-4 +- Add semanage permissive * + +* Fri May 16 2008 Dan Walsh 2.0.49-3 +- Fix fixfiles to cleanup /tmp and /var/tmp + +* Fri May 16 2008 Dan Walsh 2.0.49-2 +- Fix listing of types in gui + +* Mon May 12 2008 Dan Walsh 2.0.49-1 +- Update to upstream + * Remove security_check_context calls for prefix validation from semanage. + * Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified. + +* Mon May 12 2008 Dan Walsh 2.0.47-3 +- Remove /usr/share/locale/sr@Latn/LC_MESSAGES/policycoreutils.mo + +* Wed May 7 2008 Dan Walsh 2.0.47-2 +- Add rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* to fixfiles restore +- So that mislabeled files will get removed on full relabel + +* Wed May 7 2008 Dan Walsh 2.0.47-1 +- Make restorecond not start by default +- Fix polgengui to allow defining of confined roles. +- Add patches from Lubomir Rintel + * Add necessary runtime dependencies on setools-console for -gui + * separate stderr when run seinfo commands +- Update to upstream + * Update semanage man page for booleans from Dan Walsh. + * Add further error checking to seobject.py for setting booleans. + +* Fri Apr 18 2008 Matthias Clasen - 2.0.46-5 +- Uninvasive (ie no string or widget changes) HIG approximations + in selinux-polgenui + +* Fri Apr 18 2008 Matthias Clasen - 2.0.46-4 +- Move s-c-selinux to the right menu + +* Sun Apr 6 2008 Dan Walsh 2.0.46-3 +- Fix boolean descriptions +- Fix semanage man page + +* Wed Mar 19 2008 Dan Walsh 2.0.46-2 +- Don't use prefix in gui + +* Tue Mar 18 2008 Dan Walsh 2.0.46-1 +- Update to upstream + * Update audit2allow to report dontaudit cases from Dan Walsh. + * Fix semanage port to use --proto from Caleb Case. + +* Fri Feb 22 2008 Dan Walsh 2.0.44-1 +- Update to upstream + * Fix for segfault when conf file parse error occurs. + +* Wed Feb 13 2008 Dan Walsh 2.0.43-2 +- Don't show tabs on polgengui + +* Wed Feb 13 2008 Dan Walsh 2.0.43-1 +- Update to upstream + * Merged fix fixfiles option processing from Vaclav Ovsik. +- Added existing users, staff and user_t users to polgengui + +* Fri Feb 8 2008 Dan Walsh 2.0.42-3 +- Add messages for audit2allow DONTAUDIT + +* Tue Feb 5 2008 Dan Walsh 2.0.42-2 +- Add ability to transition to roles via polgengui + +* Sat Feb 2 2008 Dan Walsh 2.0.42-1 +- Update to upstream + * Make semodule_expand use sepol_set_expand_consume_base to reduce + peak memory usage. + +* Tue Jan 29 2008 Dan Walsh 2.0.41-1 +- Update to upstream + * Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh. + * Merged a second fixfiles -C fix from Marshall Miller. + + +* Thu Jan 24 2008 Dan Walsh 2.0.39-1 +- Don't initialize audit2allow for audit2why call. Use default +- Update to upstream + * Merged fixfiles -C fix from Marshall Miller. + +* Thu Jan 24 2008 Dan Walsh 2.0.38-1 +- Update to upstream + * Merged audit2allow cleanups and boolean descriptions from Dan Walsh. + * Merged setfiles -0 support by Benny Amorsen via Dan Walsh. + * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh. + +* Wed Jan 23 2008 Dan Walsh 2.0.37-1 +- Update to upstream + * Merged replacement for audit2why from Dan Walsh. + +* Wed Jan 23 2008 Dan Walsh 2.0.36-2 +- Cleanup fixfiles -f message in man page + +* Wed Jan 23 2008 Dan Walsh 2.0.36-1 +- Update to upstream + * Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh. + * Merged sepolgen fixes from Dan Walsh. + +* Tue Jan 22 2008 Dan Walsh 2.0.35-5 +- handle files with spaces on upgrades + +* Tue Jan 22 2008 Dan Walsh 2.0.35-4 +- Add support in fixfiles for ext4 ext4dev and gfs2 + +* Mon Jan 21 2008 Dan Walsh 2.0.35-3 +- Allow files with spaces to be used by setfiles + +* Tue Jan 15 2008 Dan Walsh 2.0.35-2 +- Add descriptions of booleans to audit2allow + +* Fri Jan 11 2008 Dan Walsh 2.0.35-1 +- Update to upstream + * Merged support for non-interactive newrole command invocation from Tim Reed. + +* Thu Jan 10 2008 Dan Walsh 2.0.34-8 +- Change to use selinux bindings to audit2why + +* Tue Jan 8 2008 Dan Walsh 2.0.34-7 +- Fix fixfiles to handle no args + +* Mon Dec 31 2007 Dan Walsh 2.0.34-5 +- Fix roles output when creating a module + +* Mon Dec 31 2007 Dan Walsh 2.0.34-4 +- Handle files with spaces in fixfiles + +* Fri Dec 21 2007 Dan Walsh 2.0.34-3 +- Catch SELINUX_ERR with audit2allow and generate policy + +* Thu Dec 20 2007 Dan Walsh 2.0.34-2 +- Make sepolgen set error exit code when partial failure +- audit2why now checks booleans for avc diagnosis + +* Wed Dec 19 2007 Dan Walsh 2.0.34-1 +- Update to upstream + * Update Makefile to not build restorecond if + /usr/include/sys/inotify.h is not present + +* Wed Dec 19 2007 Dan Walsh 2.0.33-4 +- Fix sepolgen to be able to parse Fedora 9 policy + Handle ifelse statements + Handle refpolicywarn inside of define + Add init.if and inetd.if into parse + Add parse_file to syntax error message + +* Fri Dec 14 2007 Dan Walsh 2.0.33-3 +- Add scroll bar to fcontext gui page + +* Tue Dec 11 2007 Dan Walsh 2.0.33-2 +- Add Russion Man pages + +* Mon Dec 10 2007 Dan Walsh 2.0.33-1 +- Upgrade from NSA + * Drop verbose output on fixfiles -C from Dan Walsh. + * Fix argument handling in fixfiles from Dan Walsh. + * Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh. +- Fix handling of final screen in polgengui + +* Sun Dec 2 2007 Dan Walsh 2.0.32-2 +- Fix handling of disable selinux button in gui + +* Mon Nov 19 2007 Dan Walsh 2.0.32-1 +- Upgrade from NSA + * load_policy initial load option from Chad Sellers. + +* Mon Nov 19 2007 Dan Walsh 2.0.31-20 +- Don't show error on missing policy.xml + +* Mon Nov 19 2007 Dan Walsh 2.0.31-19 +- GUI Enhancements + - Fix cgi generation + - Use more patterns + +* Mon Nov 19 2007 Dan Walsh 2.0.31-18 +- Remove codec hacking, which seems to be fixed in python + +* Fri Nov 16 2007 Dan Walsh 2.0.31-17 +- Fix typo +- Change to upstream minimal privledge interfaces + +* Fri Nov 16 2007 Dan Walsh 2.0.31-16 +- Fix fixfiles argument parsing + +* Thu Nov 15 2007 Dan Walsh 2.0.31-15 +- Fix File Labeling add + +* Thu Nov 8 2007 Dan Walsh 2.0.31-14 +- Fix semanage to handle state where policy.xml is not installed + +* Mon Nov 5 2007 Dan Walsh 2.0.31-13 +- Remove -v from restorecon in fixfiles + +* Mon Nov 5 2007 Dan Walsh 2.0.31-12 +- Fix filter and search capabilities, add wait cursor + +* Fri Nov 2 2007 Dan Walsh 2.0.31-11 +- Translate booleans via policy.xml +- Allow booleans to be set via semanage + +* Thu Nov 1 2007 Dan Walsh 2.0.31-10 +- Require use of selinux-policy-devel + +* Wed Oct 31 2007 Dan Walsh 2.0.31-9 +- Validate semanage fcontext input +- Fix template names for log files in gui + +* Fri Oct 19 2007 Dan Walsh 2.0.31-8 +- Fix template to generate correct content + +* Fri Oct 19 2007 Dan Walsh 2.0.31-7 +- Fix consolekit link to selinux-polgengui + +* Thu Oct 18 2007 Dan Walsh 2.0.31-6 +- Fix the generation templates + +* Tue Oct 16 2007 Dan Walsh 2.0.31-5 +- Fix enable/disable audit messages + +* Mon Oct 15 2007 Dan Walsh 2.0.31-4 +- Add booleans page + +* Mon Oct 15 2007 Dan Walsh 2.0.31-3 +- Lots of updates to gui + +* Mon Oct 15 2007 Dan Walsh 2.0.31-1 +- Remove no.po +- Update to upstream + * Fix semodule option handling from Dan Walsh. + * Add deleteall support for ports and fcontexts in semanage from Dan Walsh. + +* Thu Oct 11 2007 Dan Walsh 2.0.29-2 +- Fix semodule parameter checking + +* Sun Oct 7 2007 Dan Walsh 2.0.29-1 +- Update to upstream + * Add genhomedircon script to invoke semodule -Bn from Dan Walsh. +- Add deleteall for ports and fcontext + +* Fri Oct 5 2007 Dan Walsh 2.0.28-1 +- Update to upstream + * Update semodule man page for -D from Dan Walsh. + * Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh. + +* Tue Oct 2 2007 Dan Walsh 2.0.27-7 +- Add genhomedircon script to rebuild file_context for shadow-utils + +* Tue Oct 2 2007 Dan Walsh 2.0.27-6 +- Update translations + +* Tue Oct 2 2007 Dan Walsh 2.0.27-5 +- Additional checkboxes for application policy + +* Fri Sep 28 2007 Dan Walsh 2.0.27-4 +- Allow policy writer to select user types to transition to there users + +* Thu Sep 27 2007 Dan Walsh 2.0.27-3 +- Fix bug in building policy with polgengui +- Creating ports correctly + +* Wed Sep 26 2007 Dan Walsh 2.0.27-1 +- Update to upstream + * Improve semodule reporting of system errors from Stephen Smalley. + +* Mon Sep 24 2007 Dan Walsh 2.0.26-3 +- Show local changes with semanage + +* Mon Sep 24 2007 Dan Walsh 2.0.26-2 +- Fixed spelling mistakes in booleans defs +- Update po + +* Tue Sep 18 2007 Dan Walsh 2.0.26-1 +- Update to upstream + * Fix setfiles selabel option flag setting for 64-bit from Stephen Smalley. + +* Tue Sep 18 2007 Dan Walsh 2.0.25-15 +- Fix wording in policy generation tool + +* Fri Sep 14 2007 Dan Walsh 2.0.25-14 +- Fix calls to _admin interfaces + +* Thu Sep 13 2007 Dan Walsh 2.0.25-13 +- Upgrade version of sepolgen from NSA + * Expand the sepolgen parser to parse all current refpolicy modules from Karl MacMillan. + * Suppress generation of rules for non-denials from Karl MacMillan (take 3). + +* Tue Sep 11 2007 Dan Walsh 2.0.25-12 +- Remove bogus import libxml2 + +* Mon Sep 10 2007 Dan Walsh 2.0.25-11 +- Lots of fixes for polgengui + +* Thu Sep 6 2007 Dan Walsh 2.0.25-10 +- Change Requires /bin/rpm to rpm + +* Wed Sep 5 2007 Dan Walsh 2.0.25-9 +- Bump libsemanage version for disable dontaudit +- New gui features for creating admin users + +* Fri Aug 31 2007 Dan Walsh 2.0.25-8 +- Fix generated code for admin policy + +* Fri Aug 31 2007 Dan Walsh 2.0.25-7 +- Lots of fixes for role templates + +* Tue Aug 28 2007 Dan Walsh 2.0.25-6 +- Add more role_templates + +* Tue Aug 28 2007 Dan Walsh 2.0.25-5 +- Update genpolgui to add creation of user domains + +* Mon Aug 27 2007 Dan Walsh 2.0.25-4 +- Fix location of sepolgen-ifgen + +* Sat Aug 25 2007 Dan Walsh 2.0.25-3 +- Add selinux-polgengui to desktop + +* Fri Aug 24 2007 Dan Walsh 2.0.25-2 +- Cleanup spec + +* Thu Aug 23 2007 Dan Walsh 2.0.25-1 +- Update semodule man page + * Fix genhomedircon searching for USER from Todd Miller + * Install run_init with mode 0755 from Dan Walsh. + * Fix chcat from Dan Walsh. + * Fix fixfiles pattern expansion and error reporting from Dan Walsh. + * Optimize genhomedircon to compile regexes once from Dan Walsh. + * Fix semanage gettext call from Dan Walsh. + +* Thu Aug 23 2007 Dan Walsh 2.0.23-2 +- Update semodule man page + +* Mon Aug 20 2007 Dan Walsh 2.0.23-1 +- Update to match NSA + * Disable dontaudits via semodule -D + +* Wed Aug 1 2007 Dan Walsh 2.0.22-13 +- Speed up genhomedircon by an order of magnitude by compiling regex +- Allow semanage fcontext -a -t <> /path to work + +* Fri Jul 27 2007 Dan Walsh 2.0.22-11 +- Fixfiles update required to match new regex + +* Fri Jul 27 2007 Dan Walsh 2.0.22-10 +- Update booleans translations + +* Wed Jul 25 2007 Jeremy Katz - 2.0.22-9 +- rebuild for toolchain bug + +* Tue Jul 24 2007 Dan Walsh 2.0.22-8 +- Add requires libselinux-python + +* Mon Jul 23 2007 Dan Walsh 2.0.22-7 +- Fix fixfiles to report incorrect rpm +- Patch provided by Tony Nelson + +* Fri Jul 20 2007 Dan Walsh 2.0.22-6 +- Clean up spec file + +* Fri Jul 13 2007 Dan Walsh 2.0.22-5 +- Require newer libselinux version + +* Sat Jul 7 2007 Dan Walsh 2.0.22-4 +- Fix checking for conflicting directory specification in genhomedircon + +* Mon Jun 25 2007 Dan Walsh 2.0.22-3 +- Fix spelling mistakes in GUI + +* Fri Jun 22 2007 Dan Walsh 2.0.22-2 +- Fix else path in chcat + +* Thu Jun 21 2007 Dan Walsh 2.0.22-1 +- Update to match NSA + * Rebase setfiles to use new labeling interface. + +* Wed Jun 13 2007 Dan Walsh 2.0.21-2 +- Add filter to all system-config-selinux lists + +* Wed Jun 13 2007 Dan Walsh 2.0.21-1 +- Update to match NSA + * Fixed setsebool (falling through to error path on success). + +* Mon Jun 11 2007 Dan Walsh 2.0.20-1 +- Update to match NSA + * Merged genhomedircon fixes from Dan Walsh. + * Merged setfiles -c usage fix from Dan Walsh. + * Merged restorecon fix from Yuichi Nakamura. + * Dropped -lsepol where no longer needed. + +* Mon Jun 11 2007 Dan Walsh 2.0.19-5 +- Fix translations code, Add more filters to gui + +* Mon Jun 4 2007 Dan Walsh 2.0.19-4 +- Fix setfiles -c to make it work + +* Mon Jun 4 2007 Dan Walsh 2.0.19-3 +- Fix french translation to not crash system-config-selinux + +* Fri Jun 1 2007 Dan Walsh 2.0.19-2 +- Fix genhomedircon to work in stage2 builds of anaconda + +* Sat May 19 2007 Dan Walsh 2.0.19-1 +- Update to match NSA + +* Thu May 17 2007 Dan Walsh 2.0.16-2 +- Fixes for polgentool templates file + +* Fri May 4 2007 Dan Walsh 2.0.16-1 +- Updated version of policycoreutils + * Merged support for modifying the prefix via semanage from Dan Walsh. +- Fixed genhomedircon to find homedirs correctly. + +* Tue May 1 2007 Dan Walsh 2.0.15-1 +- Updated version of policycoreutils + * Merged po file updates from Dan Walsh. +- Fix semanage to be able to modify prefix in user record + +* Mon Apr 30 2007 Dan Walsh 2.0.14-2 +- Fix title on system-config-selinux + +* Wed Apr 25 2007 Dan Walsh 2.0.14-1 +- Updated version of policycoreutils + * Build fix for setsebool. + +* Wed Apr 25 2007 Dan Walsh 2.0.13-1 +- Updated version of policycoreutils + * Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley. + * Merged genhomedircon patch to use the __default__ setting from Dan Walsh. + * Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel. + +* Tue Apr 24 2007 Dan Walsh 2.0.10-2 +- Fixes for polgengui + +* Tue Apr 24 2007 Dan Walsh 2.0.10-1 +- Updated version of policycoreutils + * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh. + +* Fri Apr 20 2007 Dan Walsh 2.0.9-10 +- Fix genhomedircon to handle non user_u for the default user + +* Wed Apr 18 2007 Dan Walsh 2.0.9-9 +- More cleanups for gui + +* Wed Apr 18 2007 Dan Walsh 2.0.9-8 +- Fix size and use_tmp problem on gui + +* Wed Apr 18 2007 Dan Walsh 2.0.9-7 +- Fix restorecon crash + +* Wed Apr 18 2007 Dan Walsh 2.0.9-6 +- Change polgengui to a druid + +* Tue Apr 17 2007 Dan Walsh 2.0.9-5 +- Fully path script.py + +* Mon Apr 16 2007 Dan Walsh 2.0.9-4 +- Add -l flag to restorecon to not traverse file systems + +* Sat Apr 14 2007 Dan Walsh 2.0.9-3 +- Fixes for policygengui + +* Fri Apr 13 2007 Dan Walsh 2.0.9-2 +- Add polgengui + +* Thu Apr 12 2007 Dan Walsh 2.0.9-1 +- Updated version of sepolgen + * Merged seobject setransRecords patch to return the first alias from Xavier Toth. + +* Wed Apr 11 2007 Dan Walsh 2.0.8-1 +- Updated version of sepolgen + * Merged updates to sepolgen-ifgen from Karl MacMillan. + * Merged updates to sepolgen parser and tools from Karl MacMillan. + This includes improved debugging support, handling of interface + calls with list parameters, support for role transition rules, + updated range transition rule support, and looser matching. + +* Mon Apr 9 2007 Dan Walsh 2.0.7-11 +- Don't generate invalid context with genhomedircon + +* Mon Apr 9 2007 Dan Walsh 2.0.7-10 +- Add filter to booleans page + +* Tue Apr 3 2007 Dan Walsh 2.0.7-9 +- Fix polgen.py to not generate udp rules on tcp input + +* Fri Mar 30 2007 Dan Walsh 2.0.7-8 +- system-config-selinux should be able to run on a disabled system, +- at least enough to get it enabled. + +* Thu Mar 29 2007 Dan Walsh 2.0.7-7 +- Many fixes to polgengui + +* Fri Mar 23 2007 Dan Walsh 2.0.7-6 +- Updated version of sepolgen + * Merged patch to discard self from types when generating requires from Karl MacMillan. + +* Fri Mar 23 2007 Dan Walsh 2.0.7-5 +- Change location of audit2allow and sepol-ifgen to sbin +- Updated version of sepolgen + * Merged patch to move the sepolgen runtime data from /usr/share to /var/lib to facilitate a read-only /usr from Karl MacMillan. + +* Mon Mar 19 2007 Dan Walsh 2.0.7-4 +- Add polgen gui +- Many fixes to system-config-selinux + +* Mon Mar 12 2007 Dan Walsh 2.0.7-3 +- service restorecond status needs to set exit value correctly + +* Mon Mar 12 2007 Dan Walsh 2.0.7-2 +- Fix gui + +* Thu Mar 1 2007 Dan Walsh 2.0.7-1 +- Update to upstream + * Merged restorecond init script LSB compliance patch from Steve Grubb. + -sepolgen + * Merged better matching for refpolicy style from Karl MacMillan + * Merged support for extracting interface paramaters from interface calls from Karl MacMillan + * Merged support for parsing USER_AVC audit messages from Karl MacMillan. + +* Tue Feb 27 2007 Dan Walsh 2.0.6-3 +- Update to upstream + -sepolgen + * Merged support for enabling parser debugging from Karl MacMillan. +- Add sgrupp cleanup of restorcon init script + +* Mon Feb 26 2007 Dan Walsh 2.0.6-2 +- Add Bill Nottinham patch to run restorcond condrestart in postun + +* Fri Feb 23 2007 Dan Walsh 2.0.6-1 +- Update to upstream + - policycoreutils + * Merged newrole O_NONBLOCK fix from Linda Knippers. + * Merged sepolgen and audit2allow patches to leave generated files + in the current directory from Karl MacMillan. + * Merged restorecond memory leak fix from Steve Grubb. + -sepolgen + * Merged patch to leave generated files (e.g. local.te) in current directory from Karl MacMillan. + * Merged patch to make run-tests.py use unittest.main from Karl MacMillan. + * Merged patch to update PLY from Karl MacMillan. + * Merged patch to update the sepolgen parser to handle the latest reference policy from Karl MacMillan. + +* Thu Feb 22 2007 Dan Walsh 2.0.3-2 +- Do not fail on sepolgen-ifgen + +* Thu Feb 22 2007 Dan Walsh 2.0.3-1 +- Update to upstream + * Merged translations update from Dan Walsh. + * Merged chcat fixes from Dan Walsh. + * Merged man page fixes from Dan Walsh. + * Merged seobject prefix validity checking from Dan Walsh. + * Merged Makefile and refparser.py patch from Dan Walsh. + Fixes PYTHONLIBDIR definition and error handling on interface files. + +* Tue Feb 20 2007 Dan Walsh 2.0.2-3 +- Updated newrole NONBlOCK patch + +* Tue Feb 20 2007 Dan Walsh 2.0.2-2 +- Remove Requires: %%{name}-plugins + +* Tue Feb 20 2007 Dan Walsh 2.0.2-1 +- Update to upstream + * Merged seobject exception handler fix from Caleb Case. + * Merged setfiles memory leak patch from Todd Miller. + +* Thu Feb 15 2007 Dan Walsh 2.0.1-2 +- Cleanup man pages syntax +- Add sepolgen + +* Mon Feb 12 2007 Dan Walsh 2.0.1-1 +- Update to upstream + * Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh. + +* Wed Feb 7 2007 Dan Walsh 2.0.0-1 +- Update to upstream + * Merged new audit2allow from Karl MacMillan. + This audit2allow depends on the new sepolgen python module. + Note that you must run the sepolgen-ifgen tool to generate + the data needed by audit2allow to generate refpolicy. + * Fixed newrole non-pam build. +- Fix Changelog and spelling error in man page + +* Thu Feb 1 2007 Dan Walsh 1.34.1-4 +- Fix audit2allow on missing translations + +* Wed Jan 24 2007 Dan Walsh 1.34.1-3 +- More chcat fixes + +* Wed Jan 24 2007 Dan Walsh 1.34.1-2 +- Change chcat to exec semodule so file context is maintained + +* Wed Jan 24 2007 Dan Walsh 1.34.1-1 +- Fix system-config-selinux ports view +- Update to upstream + * Fixed newrole non-pam build. + * Updated version for stable branch. + +* Wed Jan 17 2007 Dan Walsh 1.33.15-1 +- Update to upstream + * Merged unicode-to-string fix for seobject audit from Dan Walsh. + * Merged man page updates to make "apropos selinux" work from Dan Walsh. +* Tue Jan 16 2007 Dan Walsh 1.33.14-1 + * Merged newrole man page patch from Michael Thompson. + * Merged patch to fix python unicode problem from Dan Walsh. + +* Tue Jan 16 2007 Dan Walsh 1.33.12-3 +- Fix handling of audit messages for useradd change +Resolves: #222159 + +* Fri Jan 12 2007 Dan Walsh 1.33.12-2 +- Update man pages by adding SELinux to header to fix apropos database +Resolves: #217881 + +* Tue Jan 9 2007 Dan Walsh 1.33.12-1 +- Want to update to match api +- Update to upstream + * Merged newrole securetty check from Dan Walsh. + * Merged semodule patch to generalize list support from Karl MacMillan. +Resolves: #200110 + +* Tue Jan 9 2007 Dan Walsh 1.33.11-1 +- Update to upstream + * Merged fixfiles and seobject fixes from Dan Walsh. + * Merged semodule support for list of modules after -i from Karl MacMillan. + +* Tue Jan 9 2007 Dan Walsh 1.33.10-1 +- Update to upstream + * Merged patch to correctly handle a failure during semanage handle + creation from Karl MacMillan. + * Merged patch to fix seobject role modification from Dan Walsh. + +* Fri Jan 5 2007 Dan Walsh 1.33.8-2 +- Stop newrole -l from working on non secure ttys +Resolves: #200110 + +* Thu Jan 4 2007 Dan Walsh 1.33.8-1 +- Update to upstream + * Merged patches from Dan Walsh to: + - omit the optional name from audit2allow + - use the installed python version in the Makefiles + - re-open the tty with O_RDWR in newrole + +* Wed Jan 3 2007 Dan Walsh 1.33.7-1 +- Update to upstream + * Patch from Dan Walsh to correctly suppress warnings in load_policy. + +* Tue Jan 2 2007 Dan Walsh 1.33.6-9 +- Fix fixfiles script to use tty command correctly. If this command fails, it +should set the LOGFILE to /dev/null +Resolves: #220879 + +* Wed Dec 20 2006 Dan Walsh 1.33.6-8 +- Remove hard coding of python2.4 from Makefiles + +* Tue Dec 19 2006 Dan Walsh 1.33.6-7 +- add exists switch to semanage to tell it not to check for existance of Linux user +Resolves: #219421 + +* Mon Dec 18 2006 Dan Walsh 1.33.6-6 +- Fix audit2allow generating reference policy +- Fix semanage to manage user roles properly +Resolves: #220071 + +* Fri Dec 8 2006 Dan Walsh 1.33.6-5 +- Update po files +- Fix newrole to open stdout and stderr rdrw so more will work on MLS machines +Resolves: #216920 + +* Thu Dec 7 2006 Jeremy Katz - 1.33.6-4 +- rebuild for python 2.5 + +* Wed Dec 6 2006 Dan Walsh 1.33.6-3 +- Update po files +Resolves: #216920 + +* Fri Dec 1 2006 Dan Walsh 1.33.6-2 +- Update po files +Resolves: #216920 + +* Wed Nov 29 2006 Dan Walsh 1.33.6-1 +- Update to upstream + * Patch from Dan Walsh to add an pam_acct_msg call to run_init + * Patch from Dan Walsh to fix error code returns in newrole + * Patch from Dan Walsh to remove verbose flag from semanage man page + * Patch from Dan Walsh to make audit2allow use refpolicy Makefile + in /usr/share/selinux/ + +* Wed Nov 29 2006 Dan Walsh 1.33.5-4 +- Fixing the Makefile line again to build with LSPP support +Resolves: #208838 + +* Wed Nov 29 2006 Dan Walsh 1.33.5-3 +- Don't report errors on restorecond when file system does not support XATTRS +Resolves: #217694 + +* Tue Nov 28 2006 Dan Walsh 1.33.5-2 +- Fix -q qualifier on load_policy +Resolves: #214827 + +* Tue Nov 28 2006 Dan Walsh 1.33.5-1 +- Merge to upstream +- Fix makefile line +Resolves: #208838 + +* Fri Nov 24 2006 Dan Walsh 1.33.4-2 +- Additional po changes +- Added all booleans definitions + +* Wed Nov 22 2006 Dan Walsh 1.33.4-1 +- Upstream accepted my patches + * Merged setsebool patch from Karl MacMillan. + This fixes a bug reported by Yuichi Nakamura with + always setting booleans persistently on an unmanaged system. + +* Mon Nov 20 2006 Dan Walsh 1.33.2-2 +- Fixes for the gui + +* Mon Nov 20 2006 Dan Walsh 1.33.2-1 +- Upstream accepted my patches + +* Fri Nov 17 2006 Dan Walsh 1.33.1-9 +- Add Amy Grifis Patch to preserve newrole exit status + +* Thu Nov 16 2006 Dan Walsh 1.33.1-8 +- Fix display of gui + +* Thu Nov 16 2006 Dan Walsh 1.33.1-7 +- Add patch by Jose Plans to make run_init use pam_acct_mgmt + +* Wed Nov 15 2006 Dan Walsh 1.33.1-6 +- More fixes to gui + +* Wed Nov 15 2006 Dan Walsh 1.33.1-5 +- Fix audit2allow to generate referene policy + +* Wed Nov 15 2006 Dan Walsh 1.33.1-4 +- Add group sort for portsPage.py +- Add enable/disableaudit to modules page + +* Wed Nov 15 2006 Dan Walsh 1.33.1-3 +- Add glade file + +* Tue Nov 14 2006 Dan Walsh 1.33.1-2 +- Fix Module handling in system-config-selinux + +* Tue Nov 14 2006 Dan Walsh 1.33.1-1 +- Update to upstream + * Merged newrole patch set from Michael Thompson. +- Add policycoreutils-gui + +* Thu Nov 9 2006 Dan Walsh 1.32-3 +- No longer requires rhpl + +* Mon Nov 6 2006 Dan Walsh 1.32-2 +- Fix genhomedircon man page + +* Mon Oct 9 2006 Dan Walsh 1.32-1 +- Add newrole audit patch from sgrubb +- Update to upstream + * Merged audit2allow -l fix from Yuichi Nakamura. + * Merged restorecon -i and -o - support from Karl MacMillan. + * Merged semanage/seobject fix from Dan Walsh. + * Merged fixfiles -R and verify changes from Dan Walsh. + +* Fri Oct 6 2006 Dan Walsh 1.30.30-2 +- Separate out newrole into its own package + +* Fri Sep 29 2006 Dan Walsh 1.30.30-1 +- Update to upstream + * Merged newrole auditing of failures due to user actions from + Michael Thompson. + +* Thu Sep 21 2006 Dan Walsh 1.30.29-6 +- Pass -i qualifier to restorecon for fixfiles -R +- Update translations + +* Thu Sep 21 2006 Dan Walsh 1.30.29-5 +- Remove recursion from fixfiles -R calls +- Fix semanage to verify prefix + +* Thu Sep 21 2006 Dan Walsh 1.30.29-4 +- More translations +- Compile with -pie + +* Mon Sep 18 2006 Dan Walsh 1.30.29-3 +- Add translations +- Fix audit2allow -l + +* Thu Sep 14 2006 Dan Walsh 1.30.29-2 +- Rebuild + +* Thu Sep 14 2006 Dan Walsh 1.30.29-1 +- Update to upstream +- Change -o to take "-" for stdout + +* Wed Sep 13 2006 Dan Walsh 1.30.28-9 +- Add -h support for genhomedircon + +* Wed Sep 13 2006 Dan Walsh 1.30.28-8 +- Fix fixfiles handling of -o + +* Mon Sep 11 2006 Dan Walsh 1.30.28-7 +- Make restorecon return the number of changes files if you use the -n flag + +* Fri Sep 8 2006 Dan Walsh 1.30.28-6 +- Change setfiles and restorecon to use stderr except for -o flag +- Also -o flag will now output files + +* Thu Sep 7 2006 Dan Walsh 1.30.28-5 +- Put back Erich's change + +* Wed Sep 6 2006 Dan Walsh 1.30.28-4 +- Remove recursive switch when using rpm + +* Wed Sep 6 2006 Dan Walsh 1.30.28-3 +- Fix fixfiles to handle multiple rpm and make -o work + +* Fri Sep 1 2006 Dan Walsh 1.30.28-2 +- Apply patch + +* Fri Sep 1 2006 Dan Walsh 1.30.28-1 +- Security fixes to run python in a more locked down manner +- More Translations +- Update to upstream + * Merged fix for restorecon // handling from Erich Schubert. + * Merged translations update and fixfiles fix from Dan Walsh. + +* Thu Aug 31 2006 Dan Walsh 1.30.27-5 +- Change scripts to use /usr/sbin/python + +* Thu Aug 31 2006 Dan Walsh 1.30.27-4 +- Add -i qualified to restorecon to tell it to ignore files that do not exist +- Fixfiles also modified for this change + +* Thu Aug 31 2006 Dan Walsh 1.30.27-3 +- Ignore sigpipe + +* Thu Aug 31 2006 Dan Walsh 1.30.27-2 +- Fix init script and add translations + +* Thu Aug 24 2006 Dan Walsh 1.30.27-1 +- Update to upstream + * Merged fix for restorecon symlink handling from Erich Schubert. + +* Sat Aug 12 2006 Dan Walsh 1.30.26-1 +- Update to upstream + * Merged semanage local file contexts patch from Chris PeBenito. +- Fix fixfiles log creation +- More translations + +* Thu Aug 3 2006 Dan Walsh 1.30.25-1 +- Update to upstream + * Merged patch from Dan Walsh with: + * audit2allow: process MAC_POLICY_LOAD events + * newrole: run shell with - prefix to start a login shell + * po: po file updates + * restorecond: bail if SELinux not enabled + * fixfiles: omit -q + * genhomedircon: fix exit code if non-root + * semodule_deps: install man page + * Merged secon Makefile fix from Joshua Brindle. + * Merged netfilter contexts support patch from Chris PeBenito. + +* Wed Aug 2 2006 Dan Walsh 1.30.22-3 +- Fix audit2allow to handle reload of policy + +* Wed Aug 2 2006 Dan Walsh 1.30.22-2 +- Stop restorecond init script when selinux is not enabled + +* Tue Aug 1 2006 Dan Walsh 1.30.22-1 +- Update to upstream + * Merged restorecond size_t fix from Joshua Brindle. + * Merged secon keycreate patch from Michael LeMay. + * Merged restorecond fixes from Dan Walsh. + Merged updated po files from Dan Walsh. + * Merged python gettext patch from Stephen Bennett. + * Merged semodule_deps from Karl MacMillan. + +* Thu Jul 27 2006 Dan Walsh 1.30.17-7 +- Change newrole to exec a login shell to prevent suspend. + +* Fri Jul 21 2006 Dan Walsh 1.30.17-6 +- Report error when selinux not enabled in restorecond + +* Tue Jul 18 2006 Dan Walsh 1.30.17-5 +- Fix handling of restorecond + +* Mon Jul 17 2006 Dan Walsh 1.30.17-4 +- Fix creation of restorecond pidfile + +* Mon Jul 17 2006 Dan Walsh 1.30.17-3 +- Update translations +- Update to new GCC + +* Mon Jul 10 2006 Dan Walsh 1.30.17-2 +- Add verbose flag to restorecond and update translations + +* Tue Jul 4 2006 Dan Walsh 1.30.17-1 +- Update to upstream + * Lindent. + * Merged patch from Dan Walsh with: + * -p option (progress) for setfiles and restorecon. + * disable context translation for setfiles and restorecon. + * on/off values for setsebool. + * Merged setfiles and semodule_link fixes from Joshua Brindle. + +* Thu Jun 22 2006 Dan Walsh 1.30.14-5 +- Add progress indicator on fixfiles/setfiles/restorecon + +* Wed Jun 21 2006 Dan Walsh 1.30.14-4 +- Don't use translations with matchpathcon + +* Tue Jun 20 2006 Dan Walsh 1.30.14-3 +- Prompt for selinux-policy-devel package in audit2allow + +* Mon Jun 19 2006 Dan Walsh 1.30.14-2 +- Allow setsebool to use on/off +- Update translations + +* Fri Jun 16 2006 Dan Walsh 1.30.14-1 +- Update to upstream + * Merged fix for setsebool error path from Serge Hallyn. + * Merged patch from Dan Walsh with: + * Updated po files. + * Fixes for genhomedircon and seobject. + * Audit message for mass relabel by setfiles. + +* Tue Jun 13 2006 James Antill 1.30.12-5 +- Update audit mass relabel to only compile in when audit is installed. + +* Mon Jun 12 2006 Dan Walsh 1.30.12-4 +- Update to required versions +- Update translation + +* Wed Jun 7 2006 Dan Walsh 1.30.12-3 +- Fix shell selection + +* Mon Jun 5 2006 Dan Walsh 1.30.12-2 +- Add BuildRequires for gettext + +* Mon Jun 5 2006 Dan Walsh 1.30.12-1 + * Updated fixfiles script for new setfiles location in /sbin. + +* Tue May 30 2006 Dan Walsh 1.30.11-1 +- Update to upstream + * Merged more translations from Dan Walsh. + * Merged patch to relocate setfiles to /sbin for early relabel + when /usr might not be mounted from Dan Walsh. + * Merged semanage/seobject patch to preserve fcontext ordering in list. + * Merged secon patch from James Antill. + +* Fri May 26 2006 Dan Walsh 1.30.10-4 +- Fix seobject.py to not sort the file_context file. +- move setfiles to /sbin + +* Wed May 24 2006 James Antill 1.30.10-3 +- secon man page and getopt fixes. +- Enable mass relabel audit, even though it doesn't work. + +* Wed May 24 2006 James Antill 1.30.10-2 +- secon fixes for --self-exec etc. +- secon change from level => sensitivity, add clearance. +- Add mass relabel AUDIT patch, but disable it until kernel problem solved. + +* Tue May 23 2006 Dan Walsh 1.30.10-1 +- Update to upstream + * Merged patch with updates to audit2allow, secon, genhomedircon, + and semanage from Dan Walsh. + +* Sat May 20 2006 Dan Walsh 1.30.9-4 +- Fix exception in genhomedircon + +* Mon May 15 2006 James Antill 1.30.9-3 +- Add rhpl dependancy + +* Mon May 15 2006 James Antill 1.30.9-2 +- Add secon man page and prompt options. + +* Mon May 15 2006 Dan Walsh 1.30.9-1 +- Update to upstream + * Fixed audit2allow and po Makefiles for DESTDIR= builds. + * Merged .po file patch from Dan Walsh. + * Merged bug fix for genhomedircon. + +* Wed May 10 2006 Dan Walsh 1.30.8-2 +- Fix exception on bad file_context + +* Mon May 8 2006 Dan Walsh 1.30.8-1 +- Update to upstream + * Merged fix warnings patch from Karl MacMillan. + * Merged patch from Dan Walsh. + This includes audit2allow changes for analysis plugins, + internationalization support for several additional programs + and added po files, some fixes for semanage, and several cleanups. + It also adds a new secon utility. + +* Sun May 7 2006 Dan Walsh 1.30.6-5 +- Fix genhomedircon to catch duplicate homedir problem + +* Thu May 4 2006 Dan Walsh 1.30.6-4 +- Add secon program +- Add translations + +* Thu Apr 20 2006 Dan Walsh 1.30.6-3 +- Fix check for "msg" + +* Mon Apr 17 2006 Dan Walsh 1.30.6-2 +- Ship avc.py + +* Fri Apr 14 2006 Dan Walsh 1.30.6-1 +- Add /etc/samba/secrets.tdb to restorecond.conf +- Update from upstream + * Merged semanage prefix support from Russell Coker. + * Added a test to setfiles to check that the spec file is + a regular file. + +* Thu Apr 06 2006 Karsten Hopp 1.30.4-4 +- added some missing buildrequires +- added Requires: initscripts for /sbin/service + +* Thu Apr 06 2006 Karsten Hopp 1.30.4-3 +- use absolute path /sbin/service + +* Wed Apr 5 2006 Dan Walsh 1.30.4-2 +- Fix audit2allow to not require ausearch. +- Fix man page +- Add libflashplayer to restorecond.conf + +* Wed Mar 29 2006 Dan Walsh 1.30.4-1 +- Update from upstream + * Merged audit2allow fixes for refpolicy from Dan Walsh. + * Merged fixfiles patch from Dan Walsh. + * Merged restorecond daemon from Dan Walsh. + * Merged semanage non-MLS fixes from Chris PeBenito. + * Merged semanage and semodule man page examples from Thomas Bleher. + +* Tue Mar 28 2006 Dan Walsh 1.30.1-4 +- Clean up reference policy generation in audit2allow + +* Tue Mar 21 2006 Dan Walsh 1.30.1-3 +- Add IN_MOVED_TO to catch renames + +* Tue Mar 21 2006 Dan Walsh 1.30.1-2 +- make restorecond only ignore non directories with lnk > 1 + +* Tue Mar 21 2006 Dan Walsh 1.30.1-1 +- Make audit2allow translate dontaudit as well as allow rules +- Update from upstream + * Merged semanage labeling prefix patch from Ivan Gyurdiev. + +* Tue Mar 21 2006 Dan Walsh 1.30-5 +- Fix audit2allow to retrieve dontaudit rules + +* Mon Mar 20 2006 Dan Walsh 1.30-4 +- Open file descriptor to make sure file does not change from underneath. + +* Fri Mar 17 2006 Dan Walsh 1.30-3 +- Fixes for restorecond attack via symlinks +- Fixes for fixfiles + +* Fri Mar 17 2006 Dan Walsh 1.30-2 +- Restorecon has to handle suspend/resume + +* Fri Mar 17 2006 Dan Walsh 1.30-1 +- Update to upstream + +* Fri Mar 10 2006 Dan Walsh 1.29.27-1 +- Add restorecond + +* Fri Mar 10 2006 Dan Walsh 1.29.26-6 +- Remove prereq + +* Mon Mar 6 2006 Dan Walsh 1.29.26-5 +- Fix audit2allow to generate all rules + +* Fri Mar 3 2006 Dan Walsh 1.29.26-4 +- Minor fixes to chcat and semanage + +* Fri Feb 24 2006 Dan Walsh 1.29.26-3 +- Add missing setsebool man page + +* Thu Feb 23 2006 Dan Walsh 1.29.26-2 +- Change audit2allow to use devel instead of refpolicy + +* Mon Feb 20 2006 Dan Walsh 1.29.26-1 +- Update from upstream + * Merged semanage bug fix patch from Ivan Gyurdiev. + * Merged improve bindings patch from Ivan Gyurdiev. + * Merged semanage usage patch from Ivan Gyurdiev. + * Merged use PyList patch from Ivan Gyurdiev. + +* Mon Feb 13 2006 Dan Walsh 1.29.23-1 +- Update from upstream + * Merged newrole -V/--version support from Glauber de Oliveira Costa. + * Merged genhomedircon prefix patch from Dan Walsh. + * Merged optionals in base patch from Joshua Brindle. + +* Fri Feb 10 2006 Jesse Keating - 1.29.20-2.1 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Dan Walsh 1.29.20-2 +- Fix auditing to semanage +- Change genhomedircon to use new prefix interface in libselinux + +* Tue Feb 07 2006 Dan Walsh 1.29.20-1 +- Update from upstream + * Merged seuser/user_extra support patch to semodule_package + from Joshua Brindle. + * Merged getopt type fix for semodule_link/expand and sestatus + from Chris PeBenito. +- Fix genhomedircon output + +* Tue Feb 07 2006 Jesse Keating - 1.29.18-2.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Fri Feb 3 2006 Dan Walsh 1.29.18-2 +- Add auditing to semanage + +* Thu Feb 2 2006 Dan Walsh 1.29.18-1 +- Update from upstream + * Merged clone record on set_con patch from Ivan Gyurdiev. + +* Mon Jan 30 2006 Dan Walsh 1.29.17-1 +- Update from upstream + * Merged genhomedircon fix from Dan Walsh. + * Merged seusers.system patch from Ivan Gyurdiev. + * Merged improve port/fcontext API patch from Ivan Gyurdiev. + * Merged genhomedircon patch from Dan Walsh. + +* Fri Jan 27 2006 Dan Walsh 1.29.15-1 +- Update from upstream + * Merged newrole audit patch from Steve Grubb. + * Merged seuser -> seuser local rename patch from Ivan Gyurdiev. + * Merged semanage and semodule access check patches from Joshua Brindle. +* Wed Jan 25 2006 Dan Walsh 1.29.12-1 +- Add a default of /export/home + +* Wed Jan 25 2006 Dan Walsh 1.29.11-3 +- Cleanup of the patch + +* Wed Jan 25 2006 Dan Walsh 1.29.11-2 +- Correct handling of symbolic links in restorecon + +* Wed Jan 25 2006 Dan Walsh 1.29.11-1 +- Added translation support to semanage +- Update from upstream + * Modified newrole and run_init to use the loginuid when + supported to obtain the Linux user identity to re-authenticate, + and to fall back to real uid. Dropped the use of the SELinux + user identity, as Linux users are now mapped to SELinux users + via seusers and the SELinux user identity space is separate. + * Merged semanage bug fixes from Ivan Gyurdiev. + * Merged semanage fixes from Russell Coker. + * Merged chcat.8 and genhomedircon patches from Dan Walsh. + +* Thu Jan 19 2006 Dan Walsh 1.29.9-2 +- Fix genhomedircon to work on MLS policy + +* Thu Jan 19 2006 Dan Walsh 1.29.9-1 +- Update to match NSA + * Merged chcat, semanage, and setsebool patches from Dan Walsh. + +* Thu Jan 19 2006 Dan Walsh 1.29.8-4 +- Fixes for "add"-"modify" error messages +- Fixes for chcat + +* Wed Jan 18 2006 Dan Walsh 1.29.8-3 +- Add management of translation file to semaange and seobject + +* Wed Jan 18 2006 Dan Walsh 1.29.8-2 +- Fix chcat -l -L to work while not root + +* Wed Jan 18 2006 Dan Walsh 1.29.8-1 +- Update to match NSA + * Merged semanage fixes from Ivan Gyurdiev. + * Merged semanage fixes from Russell Coker. + * Merged chcat, genhomedircon, and semanage diffs from Dan Walsh. + +* Tue Jan 17 2006 Dan Walsh 1.29.7-4 +- Update chcat to manage user categories also + +* Sat Jan 14 2006 Dan Walsh 1.29.7-3 +- Add check for root for semanage, genhomedircon + +* Sat Jan 14 2006 Dan Walsh 1.29.7-2 +- Add ivans patch + +* Fri Jan 13 2006 Dan Walsh 1.29.7-1 +- Update to match NSA + * Merged newrole cleanup patch from Steve Grubb. + * Merged setfiles/restorecon performance patch from Russell Coker. + * Merged genhomedircon and semanage patches from Dan Walsh. + * Merged remove add_local/set_local patch from Ivan Gyurdiev. + +* Tue Jan 10 2006 Dan Walsh 1.29.5-3 +- Fixes for mls policy + +* Tue Jan 10 2006 Dan Walsh 1.29.5-2 +- Update semanage and split out seobject +- Fix labeleing of home_root + +* Thu Jan 5 2006 Dan Walsh 1.29.5-1 +- Update to match NSA + * Added filename to semodule error reporting. + +* Thu Jan 5 2006 Dan Walsh 1.29.4-1 +- Update to match NSA + * Merged genhomedircon and semanage patch from Dan Walsh. + * Changed semodule error reporting to include argv[0]. + +* Wed Jan 4 2006 Dan Walsh 1.29.3-1 +- Update to match NSA + * Merged semanage getpwnam bug fix from Serge Hallyn (IBM). + * Merged patch series from Ivan Gyurdiev. + This includes patches to: + - cleanup setsebool + - update setsebool to apply active booleans through libsemanage + - update semodule to use the new semanage_set_rebuild() interface + - fix various bugs in semanage + * Merged patch from Dan Walsh (Red Hat). + This includes fixes for restorecon, chcat, fixfiles, genhomedircon, + and semanage. + +* Mon Jan 2 2006 Dan Walsh 1.29.2-10 +- Fix restorecon to not say it is changing user section when -vv is specified + +* Tue Dec 27 2005 Dan Walsh 1.29.2-9 +- Fixes for semanage, patch from Ivan and added a test script + +* Sat Dec 24 2005 Dan Walsh 1.29.2-8 +- Fix getpwnam call + +* Fri Dec 23 2005 Dan Walsh 1.29.2-7 +- Anaconda fixes + +* Thu Dec 22 2005 Dan Walsh 1.29.2-6 +- Turn off try catch block to debug anaconda failure + +* Tue Dec 20 2005 Dan Walsh 1.29.2-5 +- More fixes for chcat + +* Tue Dec 20 2005 Dan Walsh 1.29.2-4 +- Add try catch for files that may not exists + +* Mon Dec 19 2005 Dan Walsh 1.29.2-3 +- Remove commands from genhomedircon for installer + +* Wed Dec 14 2005 Dan Walsh 1.29.2-1 +- Fix genhomedircon to work in installer +- Update to match NSA + * Merged patch for chcat script from Dan Walsh. + +* Fri Dec 9 2005 Dan Walsh 1.29.1-2 +- More fixes to chcat + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Thu Dec 8 2005 Dan Walsh 1.29.1-1 +- Update to match NSA + * Merged fix for audit2allow long option list from Dan Walsh. + * Merged -r option for restorecon (alias for -R) from Dan Walsh. + * Merged chcat script and man page from Dan Walsh. + +* Wed Dec 7 2005 Dan Walsh 1.28-1 +- Update to match NSA +- Add gfs support + +* Wed Dec 7 2005 Dan Walsh 1.27.37-1 +- Update to match NSA +- Add chcat to policycoreutils, adding +/- syntax +` +* Tue Dec 6 2005 Dan Walsh 1.27.36-2 +- Require new version of libsemanage + +* Mon Dec 5 2005 Dan Walsh 1.27.36-1 +- Update to match NSA + * Changed genhomedircon to warn on use of ROLE in homedir_template + if using managed policy, as libsemanage does not yet support it. + +* Sun Dec 4 2005 Dan Walsh 1.27.35-1 +- Update to match NSA + * Merged genhomedircon bug fix from Dan Walsh. + * Revised semodule* man pages to refer to checkmodule and + to include example sections. + +* Thu Dec 1 2005 Dan Walsh 1.27.33-1 +- Update to match NSA + * Merged audit2allow --tefile and --fcfile support from Dan Walsh. + * Merged genhomedircon fix from Dan Walsh. + * Merged semodule* man pages from Dan Walsh, and edited them. + * Changed setfiles to set the MATCHPATHCON_VALIDATE flag to + retain validation/canonicalization of contexts during init. + +* Wed Nov 30 2005 Dan Walsh 1.27.31-1 +- Update to match NSA + * Changed genhomedircon to always use user_r for the role in the + managed case since user_get_defrole is broken. +- Add te file capabilities to audit2allow +- Add man pages for semodule + +* Tue Nov 29 2005 Dan Walsh 1.27.30-1 +- Update to match NSA + * Merged sestatus, audit2allow, and semanage patch from Dan Walsh. + * Fixed semodule -v option. + +* Mon Nov 28 2005 Dan Walsh 1.27.29-1 +- Update to match NSA + * Merged audit2allow python script from Dan Walsh. + (old script moved to audit2allow.perl, will be removed later). + * Merged genhomedircon fixes from Dan Walsh. + * Merged semodule quieting patch from Dan Walsh + (inverts default, use -v to restore original behavior). + +* Thu Nov 17 2005 Dan Walsh 1.27.28-3 +- Audit2allow + * Add more error checking + * Add gen policy package + * Add gen requires + +* Wed Nov 16 2005 Dan Walsh 1.27.28-2 +- Update to match NSA + * Merged genhomedircon rewrite from Dan Walsh. +- Rewrite audit2allow to python + +* Mon Nov 14 2005 Dan Walsh 1.27.27-5 +- Fix genhomedircon to work with non libsemanage systems + +* Fri Nov 11 2005 Dan Walsh 1.27.27-3 +- Patch genhomedircon to use libsemanage.py stuff + +* Wed Nov 9 2005 Dan Walsh 1.27.27-1 +- Update to match NSA + * Merged setsebool cleanup patch from Ivan Gyurdiev. + +* Wed Nov 9 2005 Dan Walsh 1.27.26-4 +- Fix genhomedircon to use seusers file, temporary fix until swigified semanage + +* Tue Nov 8 2005 Dan Walsh 1.27.26-1 + * Added -B (--build) option to semodule to force a rebuild. + * Reverted setsebool patch to call semanage_set_reload_bools(). + * Changed setsebool to disable policy reload and to call + security_set_boolean_list to update the runtime booleans. + * Changed setfiles -c to use new flag to set_matchpathcon_flags() + to disable context translation by matchpathcon_init(). + +* Tue Nov 8 2005 Dan Walsh 1.27.23-1 +- Update to match NSA + * Changed setfiles for the context canonicalization support. + * Changed setsebool to call semanage_is_managed() interface + and fall back to security_set_boolean_list() if policy is + not managed. + * Merged setsebool memory leak fix from Ivan Gyurdiev. + * Merged setsebool patch to call semanage_set_reload_bools() + interface from Ivan Gyurdiev. + +* Mon Nov 7 2005 Dan Walsh 1.27.20-1 +- Update to match NSA + * Merged setsebool patch from Ivan Gyurdiev. + This moves setsebool from libselinux/utils to policycoreutils, + and rewrites it to use libsemanage for permanent boolean changes. + +* Tue Oct 25 2005 Dan Walsh 1.27.19-2 +- Rebuild to use latest libselinux, libsemanage, and libsepol + +* Tue Oct 25 2005 Dan Walsh 1.27.19-1 +- Update to match NSA + * Merged semodule support for reload, noreload, and store options + from Joshua Brindle. + * Merged semodule_package rewrite from Joshua Brindle. + +* Thu Oct 20 2005 Dan Walsh 1.27.18-1 +- Update to match NSA + * Cleaned up usage and error messages and releasing of memory by + semodule utilities. + * Corrected error reporting by semodule. + * Updated semodule_expand for change to sepol interface. + * Merged fixes for make DESTDIR= builds from Joshua Brindle. + +* Tue Oct 18 2005 Dan Walsh 1.27.14-1 +- Update to match NSA + * Updated semodule_package for sepol interface changes. + +* Tue Oct 18 2005 Dan Walsh 1.27.13-1 +- Update to match NSA + * Updated semodule_expand/link for sepol interface changes. + +* Sat Oct 15 2005 Dan Walsh 1.27.12-1 +- Update to match NSA + * Merged non-PAM Makefile support for newrole and run_init from Timothy Wood. + +* Fri Oct 14 2005 Dan Walsh 1.27.11-1 +- Update to match NSA + * Updated semodule_expand to use get interfaces for hidden sepol_module_package type. + * Merged newrole and run_init pam config patches from Dan Walsh (Red Hat). + * Merged fixfiles patch from Dan Walsh (Red Hat). + * Updated semodule for removal of semanage_strerror. + + +* Thu Oct 13 2005 Dan Walsh 1.27.7-2 +- Fix run_init.pamd and spec file + +* Wed Oct 12 2005 Dan Walsh 1.27.7-1 +- Update to match NSA + * Updated semodule_link and semodule_expand to use shared libsepol. + Fixed audit2why to call policydb_init prior to policydb_read (still + uses the static libsepol). + +* Mon Oct 10 2005 Dan Walsh 1.27.6-1 +- Update to match NSA + * Updated for changes to libsepol. + Changed semodule and semodule_package to use the shared libsepol. + Disabled build of semodule_link and semodule_expand for now. + Updated audit2why for relocated policydb internal headers, + still needs to be converted to a shared lib interface. + +* Fri Oct 7 2005 Dan Walsh 1.27.5-3 +- Update newrole pam file to remove pam-stack +- Update run_init pam file to remove pam-stack + +* Thu Oct 6 2005 Dan Walsh 1.27.5-1 +- Update to match NSA + * Fixed warnings in load_policy. + * Rewrote load_policy to use the new selinux_mkload_policy() + interface provided by libselinux. + +* Wed Oct 5 2005 Dan Walsh 1.27.3-2 +- Rebuild with newer libararies + +* Wed Sep 28 2005 Dan Walsh 1.27.3-1 +- Update to match NSA + * Merged patch to update semodule to the new libsemanage API + and improve the user interface from Karl MacMillan (Tresys). + * Modified semodule for the create/connect API split. + +* Wed Sep 28 2005 Dan Walsh 1.27.2-2 +- More fixes to stop find from following nfs paths + +* Wed Sep 21 2005 Dan Walsh 1.27.2-1 +- Update to match NSA + * Merged run_init open_init_pty bug fix from Manoj Srivastava + (unblock SIGCHLD). Bug reported by Erich Schubert. + +* Tue Sep 20 2005 Dan Walsh 1.27.1-1 +- Update to match NSA + * Merged error shadowing bug fix for restorecon from Dan Walsh. + * Merged setfiles usage/man page update for -r option from Dan Walsh. + * Merged fixfiles -C patch to ignore :s0 addition on update + to a MCS/MLS policy from Dan Walsh. + +* Thu Sep 15 2005 Dan Walsh 1.26-3 +- Add chcat script for use with chcon. + +* Tue Sep 13 2005 Dan Walsh 1.26-2 +- Fix restorecon to exit with error code + +* Mon Sep 12 2005 Dan Walsh 1.26-1 + * Updated version for release. + +* Tue Sep 6 2005 Dan Walsh 1.25.9-2 +- Add prereq for mount command + +* Thu Sep 1 2005 Dan Walsh 1.25.9-1 +- Update to match NSA + * Changed setfiles -c to translate the context to raw format + prior to calling libsepol. + +* Fri Aug 26 2005 Dan Walsh 1.25.7-3 +- Use new version of libsemange and require it for install + +* Fri Aug 26 2005 Dan Walsh 1.25.7-2 +- Ignore s0 in file context + +* Thu Aug 25 2005 Dan Walsh 1.25.7-1 +- Update to match NSA + * Merged patch for fixfiles -C from Dan Walsh. + +* Tue Aug 23 2005 Dan Walsh 1.25.6-1 +- Update to match NSA + * Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM). + Bugs found by Coverity. + +* Mon Aug 22 2005 Dan Walsh 1.25.5-3 +- Fix fixfiles to call sort -u followed by sort -d. + +* Wed Aug 17 2005 Dan Walsh 1.25.5-2 +- Change fixfiles to ignore /home directory on updates + +* Fri Aug 5 2005 Dan Walsh 1.25.5-1 +- Update to match NSA + * Merged patch to move module read/write code from libsemanage + to libsepol from Jason Tang (Tresys). + +* Thu Jul 28 2005 Dan Walsh 1.25.4-1 +- Update to match NSA + * Changed semodule* to link with libsemanage. + +* Wed Jul 27 2005 Dan Walsh 1.25.3-1 +- Update to match NSA + * Merged restorecon patch from Ivan Gyurdiev. + +* Mon Jul 18 2005 Dan Walsh 1.25.2-1 +- Update to match NSA + * Merged load_policy, newrole, and genhomedircon patches from Red Hat. + +* Thu Jul 7 2005 Dan Walsh 1.25.1-1 +- Update to match NSA + * Merged loadable module support from Tresys Technology. + +* Wed Jun 29 2005 Dan Walsh 1.24-1 +- Update to match NSA + * Updated version for release. + +* Tue Jun 14 2005 Dan Walsh 1.23.11-4 +- Fix Ivan's patch for user role changes + +* Sat May 28 2005 Dan Walsh 1.23.11-3 +- Add Ivan's patch for user role changes in genhomedircon + +* Thu May 26 2005 Dan Walsh 1.23.11-2 +- Fix warning message on reload of booleans + + +* Fri May 20 2005 Dan Walsh 1.23.11-1 +- Update to match NSA + * Merged fixfiles and newrole patch from Dan Walsh. + * Merged audit2why man page from Dan Walsh. + +* Thu May 19 2005 Dan Walsh 1.23.10-2 +- Add call to pam_acct_mgmt in newrole. + +* Tue May 17 2005 Dan Walsh 1.23.10-1 +- Update to match NSA + * Extended audit2why to incorporate booleans and local user + settings when analyzing audit messages. + +* Mon May 16 2005 Dan Walsh 1.23.9-1 +- Update to match NSA + * Updated audit2why for sepol_ prefixes on Flask types to + avoid namespace collision with libselinux, and to + include now. + +* Fri May 13 2005 Dan Walsh 1.23.8-1 +- Fix fixfiles to accept -f +- Update to match NSA + * Added audit2why utility. + +* Fri Apr 29 2005 Dan Walsh 1.23.7-1 +- Change -f flag in fixfiles to remove stuff from /tmp +- Change -F flag to pass -F flag to restorecon/fixfiles. (IE Force relabel). + +* Thu Apr 14 2005 Dan Walsh 1.23.6-1 +- Update to match NSA + * Fixed signed/unsigned pointer bug in load_policy. + * Reverted context validation patch for genhomedircon. + +* Wed Apr 13 2005 Dan Walsh 1.23.5-1 +- Update to match NSA + * Reverted load_policy is_selinux_enabled patch from Dan Walsh. + Otherwise, an initial policy load cannot be performed using + load_policy, e.g. for anaconda. + + +* Mon Apr 11 2005 Dan Walsh 1.23.4-3 +- remove is_selinux_enabled check from load_policy (Bad idea) + +* Mon Apr 11 2005 Dan Walsh 1.23.4-1 +- Update to version from NSA + * Merged load_policy is_selinux_enabled patch from Dan Walsh. + * Merged restorecon verbose output patch from Dan Walsh. + * Merged setfiles altroot patch from Chris PeBenito. + +* Thu Apr 7 2005 Dan Walsh 1.23.3-2 +- Don't run load_policy on a non SELinux kernel. + +* Wed Apr 6 2005 Dan Walsh 1.23.3-1 +- Update to version from NSA + * Merged context validation patch for genhomedircon from Eric Paris. +- Fix verbose output of restorecon + +* Thu Mar 17 2005 Dan Walsh 1.23.2-1 +- Update to version from NSA + * Changed setfiles -c to call set_matchpathcon_flags(3) to + turn off processing of .homedirs and .local. + +* Tue Mar 15 2005 Dan Walsh 1.23.1-1 +- Update to released version from NSA + * Merged rewrite of genhomedircon by Eric Paris. + * Changed fixfiles to relabel jfs since it now supports security xattrs + (as of 2.6.11). Removed reiserfs until 2.6.12 is released with + fixed support for reiserfs and selinux. + +* Thu Mar 10 2005 Dan Walsh 1.22-2 +- Update to released version from NSA +- Patch genhomedircon to handle passwd in different places. + +* Wed Mar 9 2005 Dan Walsh 1.21.22-2 +- Fix genhomedircon to not put bad userad error in file_contexts.homedir + +* Tue Mar 8 2005 Dan Walsh 1.21.22-1 +- Cleanup error reporting + +* Tue Mar 1 2005 Dan Walsh 1.21.21-1 + * Merged load_policy and genhomedircon patch from Dan Walsh. + +* Mon Feb 28 2005 Dan Walsh 1.21.20-3 +- Fix genhomedircon to add extr "\n" + +* Fri Feb 25 2005 Dan Walsh 1.21.20-2 +- Fix genhomedircon to handle blank users + +* Fri Feb 25 2005 Dan Walsh 1.21.20-1 +- Update to latest from NSA +- Add call to libsepol + +* Thu Feb 24 2005 Dan Walsh 1.21.19-4 +- Fix genhomedircon to handle root +- Fix fixfiles to better handle file system types + +* Wed Feb 23 2005 Dan Walsh 1.21.19-2 +- Fix genhomedircon to handle spaces in SELINUXPOLICYTYPE + +* Tue Feb 22 2005 Dan Walsh 1.21.19-1 +- Update to latest from NSA + * Merged several fixes from Ulrich Drepper. + +* Mon Feb 21 2005 Dan Walsh 1.21.18-2 +- Apply Uli patch + * The Makefiles should use the -Wall option even if compiled in beehive + * Add -W, too + * use -Werror when used outside of beehive. This could also be used unconditionally + * setfiles/setfiles.c: fix resulting warning + * restorecon/restorecon.c: Likewise + * run_init/open_init_pty.c: argc hasn't been checked, the program would crash if +called without parameters. ignore the return value of nice properly. + * run_init: don't link with -ldl lutil + * load_policy: that's the bad bug. pointer to unsigned int is passed, size_t is +written to. fails on 64-bit archs + * sestatus: signed vs unsigned problem + * newrole: don't link with -ldl + +* Sat Feb 19 2005 Dan Walsh 1.21.18-1 +- Update to latest from NSA + * Changed load_policy to fall back to the original policy upon + an error from sepol_genusers(). + +* Thu Feb 17 2005 Dan Walsh 1.21.17-2 +- Only restorecon on ext[23], reiser and xfs + +* Thu Feb 17 2005 Dan Walsh 1.21.17-1 +- Update to latest from NSA + * Merged new genhomedircon script from Dan Walsh. + * Changed load_policy to call sepol_genusers(). + +* Thu Feb 17 2005 Dan Walsh 1.21.15-9 +- Remove Red Hat rhpl usage +- Add back in original syntax +- Update man page to match new syntax + +* Fri Feb 11 2005 Dan Walsh 1.21.15-8 +- Fix genhomedircon regular expression +- Fix exclude in restorecon + +* Thu Feb 10 2005 Dan Walsh 1.21.15-5 +- Trap failure on write +- Rewrite genhomedircon to generate file_context.homedirs +- several passes + +* Thu Feb 10 2005 Dan Walsh 1.21.15-1 +- Update from NSA + * Changed relabel Makefile target to use restorecon. + +* Wed Feb 9 2005 Dan Walsh 1.21.14-1 +- Update from NSA + * Merged restorecon patch from Dan Walsh. + +* Tue Feb 8 2005 Dan Walsh 1.21.13-1 +- Update from NSA + * Merged further change to fixfiles -C from Dan Walsh. + * Merged updated fixfiles script from Dan Walsh. +- Fix error handling of restorecon + + +* Mon Feb 7 2005 Dan Walsh 1.21.12-2 +- Fix sestatus for longer booleans + +* Wed Feb 2 2005 Dan Walsh 1.21.12-1 +- More cleanup of fixfiles sed patch + * Merged further patches for restorecon/setfiles -e and fixfiles -C. + +* Wed Feb 2 2005 Dan Walsh 1.21.10-2 +- More cleanup of fixfiles sed patch + +* Mon Jan 31 2005 Dan Walsh 1.21.10-1 +- More cleanup of fixfiles sed patch +- Upgrade to latest from NSA + * Merged patch for open_init_pty from Manoj Srivastava. + +* Fri Jan 28 2005 Dan Walsh 1.21.9-1 +- More cleanup of sed patch +- Upgrade to latest from NSA + * Merged updated fixfiles script from Dan Walsh. + * Merged updated man page for fixfiles from Dan Walsh and re-added unzipped. + * Reverted fixfiles patch for file_contexts.local; + obsoleted by setfiles rewrite. + * Merged error handling patch for restorecon from Dan Walsh. + * Merged semi raw mode for open_init_pty helper from Manoj Srivastava. + * Rewrote setfiles to use matchpathcon and the new interfaces + exported by libselinux (>= 1.21.5). + + +* Fri Jan 28 2005 Dan Walsh 1.21.7-3 +- Fix fixfiles patch +- Upgrade to latest from NSA + * Prevent overflow of spec array in setfiles. +- Add diff comparason between file_contexts to fixfiles +- Allow restorecon to give an warning on file not found instead of exiting + +* Thu Jan 27 2005 Dan Walsh 1.21.5-1 +- Upgrade to latest from NSA + * Merged newrole -l support from Darrel Goeddel (TCS). +- Fix genhomedircon STARTING_UID + +* Wed Jan 26 2005 Dan Walsh 1.21.4-1 +- Upgrade to latest from NSA + * Merged fixfiles patch for file_contexts.local from Dan Walsh. + +* Fri Jan 21 2005 Dan Walsh 1.21.3-2 +- Temp file needs to be created in /etc/selinux/POLICYTYPE/contexts/files/ directory. + +* Fri Jan 21 2005 Dan Walsh 1.21.3-1 +- Upgrade to latest from NSA + * Fixed restorecon to not treat errors from is_context_customizable() + as a customizable context. + * Merged setfiles/restorecon patch to not reset user field unless + -F option is specified from Dan Walsh. + * Merged open_init_pty helper for run_init from Manoj Srivastava. + * Merged audit2allow and genhomedircon man pages from Manoj Srivastava. + +* Fri Jan 21 2005 Dan Walsh 1.21.1-3 +- Don't change user componant if it is all that changed unless forced. +- Change fixfiles to concatinate file_context.local for setfiles + +* Thu Jan 20 2005 Dan Walsh 1.21.1-1 +- Update to latest from NSA + +* Mon Jan 10 2005 Dan Walsh 1.20.1-2 +- Fix restorecon segfault + +* Mon Jan 3 2005 Dan Walsh 1.20.1-1 +- Update to latest from NSA + * Merged fixfiles rewrite from Dan Walsh. + * Merged restorecon patch from Dan Walsh. + +* Mon Jan 3 2005 Dan Walsh 1.19.3-1 +- Update to latest from NSA + * Merged fixfiles and restorecon patches from Dan Walsh. + * Don't display change if only user part changed. + +* Mon Jan 3 2005 Dan Walsh 1.19.2-4 +- Fix fixfiles handling of rpm +- Fix restorecon to not warn on symlinks unless -v -v +- Fix output of verbose to show old context as well as new context + +* Wed Dec 29 2004 Dan Walsh 1.19.2-1 +- Update to latest from NSA + * Changed restorecon to ignore ENOENT errors from matchpathcon. + * Merged nonls patch from Chris PeBenito. + +* Mon Dec 20 2004 Dan Walsh 1.19.1-1 +- Update to latest from NSA + * Removed fixfiles.cron. + * Merged run_init.8 patch from Dan Walsh. + +* Thu Nov 18 2004 Dan Walsh 1.18.1-3 +- Fix run_init.8 to refer to correct location of initrc_context + +* Wed Nov 3 2004 Dan Walsh 1.18.1-1 +- Upgrade to latest from NSA + +* Wed Oct 27 2004 Steve Grubb 1.17.7-3 +- Add code to sestatus to output the current policy from config file + +* Fri Oct 22 2004 Dan Walsh 1.17.7-2 +- Patch audit2allow to return self and no brackets if only one rule + +* Fri Oct 22 2004 Dan Walsh 1.17.7-1 +- Update to latest from NSA +- Eliminate fixfiles.cron + +* Tue Oct 12 2004 Dan Walsh 1.17.6-2 +- Only run fixfiles.cron once a week, and eliminate null message + +* Fri Oct 1 2004 Dan Walsh 1.17.6-1 +- Update with NSA + * Added -l option to setfiles to log changes via syslog. + * Merged -e option to setfiles to exclude directories. + * Merged -R option to restorecon for recursive descent. +* Fri Oct 1 2004 Dan Walsh 1.17.5-6 +- Add -e (exclude directory) switch to setfiles +- Add syslog to setfiles + +* Fri Sep 24 2004 Dan Walsh 1.17.5-5 +- Add -R (recursive) switch to restorecon. + +* Thu Sep 23 2004 Dan Walsh 1.17.5-4 +- Change to only display to terminal if tty is specified + +* Tue Sep 21 2004 Dan Walsh 1.17.5-3 +- Only display to stdout if logfile not specified + +* Thu Sep 9 2004 Dan Walsh 1.17.5-2 +- Add Steve Grubb patch to cleanup log files. + +* Mon Aug 30 2004 Dan Walsh 1.17.5-1 +- Add optargs +- Update to match NSA + +* Wed Aug 25 2004 Dan Walsh 1.17.4-1 +- Add fix to get cdrom info from /proc/media in fixfiles. + +* Wed Aug 25 2004 Dan Walsh 1.17.3-4 +- Add Steve Grub patches for + * Fix fixfiles.cron MAILTO + * Several problems in sestatus + +* Wed Aug 25 2004 Dan Walsh 1.17.3-3 +- Add -q (quiet) qualifier to load_policy to not report warnings + +* Tue Aug 24 2004 Dan Walsh 1.17.3-2 +- Add requires for libsepol >= 1.1.1 + +* Tue Aug 24 2004 Dan Walsh 1.17.3-1 +- Update to latest from upstream + +* Mon Aug 23 2004 Dan Walsh 1.17.2-1 +- Update to latest from upstream +- Includes Colin patch for verifying file_contexts + +* Sun Aug 22 2004 Dan Walsh 1.17.1-1 +- Update to latest from upstream + +* Mon Aug 16 2004 Dan Walsh 1.15.7-1 +- Update to latest from upstream + +* Thu Aug 12 2004 Dan Walsh 1.15.6-1 +- Add Man page for load_policy + +* Tue Aug 10 2004 Dan Walsh 1.15.5-1 +- new version from NSA uses libsepol + +* Mon Aug 2 2004 Dan Walsh 1.15.3-2 +- Fix genhomedircon join command + +* Thu Jul 29 2004 Dan Walsh 1.15.3-1 +- Latest from NSA + +* Mon Jul 26 2004 Dan Walsh 1.15.2-4 +- Change fixfiles to not change when running a check + +* Tue Jul 20 2004 Dan Walsh 1.15.2-3 +- Fix restorecon getopt call to stop hang on IBM Arches + +* Mon Jul 19 2004 Dan Walsh 1.15.2-2 +- Only mail files less than 100 lines from fixfiles.cron +- Add Russell's fix for genhomedircon + +* Fri Jul 16 2004 Dan Walsh 1.15.2-1 +- Latest from NSA + +* Thu Jul 8 2004 Dan Walsh 1.15.1-2 +- Add ro warnings + +* Thu Jul 8 2004 Dan Walsh 1.15.1-1 +- Latest from NSA +- Fix fixfiles.cron to delete outfile + +* Tue Jul 6 2004 Dan Walsh 1.14.1-2 +- Fix fixfiles.cron to not run on non SELinux boxes +- Fix several problems in fixfiles and fixfiles.cron + +* Wed Jun 30 2004 Dan Walsh 1.14.1-1 +- Update from NSA +- Add cron capability to fixfiles + +* Fri Jun 25 2004 Dan Walsh 1.13.4-1 +- Update from NSA + +* Thu Jun 24 2004 Dan Walsh 1.13.3-2 +- Fix fixfiles to handle no rpm file on relabel + +* Wed Jun 23 2004 Dan Walsh 1.13.3-1 +- Update latest from NSA +- Add -o option to setfiles to save output of any files with incorrect context. + +* Tue Jun 22 2004 Dan Walsh 1.13.2-2 +- Add rpm support to fixfiles +- Update restorecon to add file input support + +* Fri Jun 18 2004 Dan Walsh 1.13.2-1 +- Update with NSA Latest + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Sat Jun 12 2004 Dan Walsh 1.13.1-2 +- Fix run_init to use policy formats + +* Wed Jun 2 2004 Dan Walsh 1.13.1-1 +- Update from NSA + +* Tue May 25 2004 Dan Walsh 1.13-3 +- Change location of file_context file + +* Tue May 25 2004 Dan Walsh 1.13-2 +- Change to use /etc/sysconfig/selinux to determine location of policy files + +* Fri May 21 2004 Dan Walsh 1.13-1 +- Update to latest from NSA +- Change fixfiles to prompt before deleteing /tmp files + +* Tue May 18 2004 Dan Walsh 1.12-2 +- have restorecon ingnore <> +- Hand matchpathcon the file status + +* Thu May 13 2004 Dan Walsh 1.12-1 +- Update to match NSA + +* Mon May 10 2004 Dan Walsh 1.11-4 +- Move location of log file to /var/tmp + +* Mon May 10 2004 Dan Walsh 1.11-3 +- Better grep command for bind + +* Fri May 7 2004 Dan Walsh 1.11-2 +- Eliminate bind and context mounts + +* Wed May 5 2004 Dan Walsh 1.11-1 +- update to match NSA + +* Wed Apr 28 2004 Dan Walsh 1.10-4 +- Log fixfiles to the /tmp directory + +* Wed Apr 21 2004 Colin Walters 1.10-3 +- Add patch to fall back to authenticating via uid if + the current user's SELinux user identity is the default + identity +- Add BuildRequires pam-devel + +* Mon Apr 12 2004 Dan Walsh 1.10-2 +- Add man page, thanks to Richard Halley + +* Thu Apr 8 2004 Dan Walsh 1.10-1 +- Upgrade to latest from NSA + +* Fri Apr 2 2004 Dan Walsh 1.9.2-1 +- Update with latest from gentoo and NSA + +* Thu Apr 1 2004 Dan Walsh 1.9.1-1 +- Check return codes in sestatus.c + +* Mon Mar 29 2004 Dan Walsh 1.9-19 +- Fix sestatus to not double free +- Fix sestatus.conf to be unix format + +* Mon Mar 29 2004 Dan Walsh 1.9-18 +- Warn on setfiles failure to relabel. + +* Mon Mar 29 2004 Dan Walsh 1.9-17 +- Updated version of sestatus + +* Mon Mar 29 2004 Dan Walsh 1.9-16 +- Fix fixfiles to checklabel properly + +* Fri Mar 26 2004 Dan Walsh 1.9-15 +- add sestatus + +* Thu Mar 25 2004 Dan Walsh 1.9-14 +- Change free call to freecon +- Cleanup + +* Tue Mar 23 2004 Dan Walsh 1.9-12 +- Remove setfiles-assoc patch +- Fix restorecon to not crash on missing dir + +* Thu Mar 18 2004 Dan Walsh 1.9-11 +- Eliminate trailing / in restorecon + +* Thu Mar 18 2004 Dan Walsh 1.9-10 +- Add Verbosity check + +* Thu Mar 18 2004 Dan Walsh 1.9-9 +- Change restorecon to not follow symlinks. It is too difficult and confusing +- to figure out the file context for the file pointed to by a symlink. + +* Wed Mar 17 2004 Dan Walsh 1.9-8 +- Fix restorecon +* Wed Mar 17 2004 Dan Walsh 1.9-7 +- Read restorecon patch + +* Wed Mar 17 2004 Dan Walsh 1.9-6 +- Change genhomedircon to take POLICYSOURCEDIR from command line + +* Wed Mar 17 2004 Dan Walsh 1.9-5 +- Add checkselinux +- move fixfiles and restorecon to /sbin + +* Wed Mar 17 2004 Dan Walsh 1.9-4 +- Restore patch of genhomedircon + +* Mon Mar 15 2004 Dan Walsh 1.9-3 +- Add setfiles-assoc patch to try to freeup memory use + +* Mon Mar 15 2004 Dan Walsh 1.9-2 +- Add fixlabels + +* Mon Mar 15 2004 Dan Walsh 1.9-1 +- Update to latest from NSA + +* Wed Mar 10 2004 Dan Walsh 1.6-8 +- Increase the size of buffer accepted by setfiles to BUFSIZ. + +* Tue Mar 9 2004 Dan Walsh 1.6-7 +- genhomedircon should complete even if it can't read /etc/default/useradd + +* Tue Mar 9 2004 Dan Walsh 1.6-6 +- fix restorecon to relabel unlabled files. + +* Fri Mar 5 2004 Dan Walsh 1.6-5 +- Add genhomedircon from tresys +- Fixed patch for restorecon + +* Thu Feb 26 2004 Dan Walsh 1.6-4 +- exit out when selinux is not enabled + +* Thu Feb 26 2004 Dan Walsh 1.6-3 +- Fix minor bugs in restorecon + +* Thu Feb 26 2004 Dan Walsh 1.6-2 +- Add restorecon c program + +* Tue Feb 24 2004 Dan Walsh 1.6-1 +- Update to latest tarball from NSA + +* Thu Feb 19 2004 Dan Walsh 1.4-9 +- Add sort patch + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Thu Jan 29 2004 Dan Walsh 1.4-7 +- remove mods to run_init since init scripts don't require it anymore + +* Wed Jan 28 2004 Dan Walsh 1.4-6 +- fix genhomedircon not to return and error + +* Wed Jan 28 2004 Dan Walsh 1.4-5 +- add setfiles quiet patch + +* Tue Jan 27 2004 Dan Walsh 1.4-4 +- add checkcon to verify context match file_context + +* Wed Jan 7 2004 Dan Walsh 1.4-3 +- fix command parsing restorecon + +* Tue Jan 6 2004 Dan Walsh 1.4-2 +- Add restorecon + +* Sat Dec 6 2003 Dan Walsh 1.4-1 +- Update to latest NSA 1.4 + +* Tue Nov 25 2003 Dan Walsh 1.2-9 +- Change run_init.console to run as run_init_t + +* Tue Oct 14 2003 Dan Walsh 1.2-8 +- Remove dietcc since load_policy is not in mkinitrd +- Change to use CONSOLEHELPER flag + +* Tue Oct 14 2003 Dan Walsh 1.2-7 +- Don't authenticate run_init when used with consolehelper + +* Wed Oct 01 2003 Dan Walsh 1.2-6 +- Add run_init consolehelper link + +* Wed Sep 24 2003 Dan Walsh 1.2-5 +- Add russell spead up patch to deal with file path stems + +* Fri Sep 12 2003 Dan Walsh 1.2-4 +- Build load_policy with diet gcc in order to save space on initrd + +* Fri Sep 12 2003 Dan Walsh 1.2-3 +- Update with NSA latest + +* Thu Aug 7 2003 Dan Walsh 1.2-1 +- remove i18n +- Temp remove gtk support + +* Thu Aug 7 2003 Dan Walsh 1.1-4 +- Remove wnck requirement + +* Thu Aug 7 2003 Dan Walsh 1.1-3 +- Add gtk support to run_init + +* Tue Aug 5 2003 Dan Walsh 1.1-2 +- Add internationalization + +* Mon Jun 2 2003 Dan Walsh 1.0-1 +- Initial version diff --git a/policycoreutils.spec b/policycoreutils.spec index 4e62550..b05ec3e 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -446,5181 +446,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Thu Jun 27 2024 Petr Lautrbach - 3.7-1 -- SELinux userspace 3.7 release - -* Fri Jun 07 2024 Python Maint - 3.6-5 -- Rebuilt for Python 3.13 - -* Thu May 09 2024 Petr Lautrbach - 3.6-4 -- Add Wayland support - -* Thu Jan 25 2024 Fedora Release Engineering - 3.6-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 3.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Dec 14 2023 Petr Lautrbach - 3.6-1 -- SELinux userspace 3.6 release - -* Thu Nov 23 2023 Petr Lautrbach - 3.6-0.rc2.1 -- SELinux userspace 3.6-rc2 release - -* Tue Nov 14 2023 Petr Lautrbach - 3.6-0.rc1.1 -- SELinux userspace 3.6-rc1 release - -* Mon Oct 30 2023 Petr Lautrbach - 3.5-8 -- Update translations - https://translate.fedoraproject.org/projects/selinux/ - -* Tue Aug 1 2023 Petr Lautrbach - 3.5-7 -- python: improve format strings for proper localization -- python: Drop hard formating from localized strings -- sepolicy: port to dnf4 python API (rhbz#2209404) - -* Fri Jul 21 2023 Fedora Release Engineering - 3.5-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jun 21 2023 Vit Mojzis - 3.5-5 -- python/sepolicy: Fix spec file dependencies -- python/sepolicy: Fix template for confined user policy modules -- Improve man pages and add examples - -* Tue Jun 13 2023 Python Maint - 3.5-4 -- Rebuilt for Python 3.12 - -* Fri May 26 2023 Miro Hrončok - 3.5-3 -- Fix build with pip 23.1.2+ -- Fixes: rhbz#2209016 - -* Wed May 10 2023 Tomas Popela - 3.5-2 -- Drop unused BR on dbus-glib and explicitly BR glib2 - -* Fri Feb 24 2023 Petr Lautrbach - 3.5-1 -- SELinux userspace 3.5 release - -* Mon Feb 13 2023 Petr Lautrbach - 3.5-0.rc3.1 -- SELinux userspace 3.5-rc3 release - -* Wed Feb 8 2023 Petr Lautrbach - 3.5-0.rc2.3 -- Attach tty to selinux-autorelabel.service when AUTORELABEL=0 - -* Thu Jan 26 2023 Vit Mojzis - 3.5-0.rc2.2 -- python/sepolicy: Cache conditional rule queries - -* Fri Jan 20 2023 Fedora Release Engineering - 3.5-0.rc2.1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Mon Jan 16 2023 Petr Lautrbach - 3.5-0.rc2.1 -- SELinux userspace 3.5-rc2 release - -* Fri Dec 23 2022 Petr Lautrbach - 3.5-0.rc1.1 -- SELinux userspace 3.5-rc1 release - -* Mon Nov 21 2022 Petr Lautrbach - 3.4-7.1 -- Rebase on upstream f56a72ac9e86 -- sepolicy: fix sepolicy manpage -w -- sandbox: add -R option to alternate XDG_RUNTIME_DIR -- Remove dependency on the Python module distutils - -* Tue Aug 2 2022 Petr Lautrbach - 3.4-6 -- Run autorelabel in parallel by default - https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel - -* Mon Jul 25 2022 Petr Lautrbach - 3.4-5 -- gettext: handle unsupported languages properly (#2100378) -- semodule: rename --rebuild-if-modules-changed to --refresh -- python: Split "semanage import" into two transactions (#2063353) -- selinux-autorelabel: Do not force reboot (#2093133) - -* Fri Jul 22 2022 Fedora Release Engineering - 3.4-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jun 13 2022 Python Maint - 3.4-3 -- Rebuilt for Python 3.11 - -* Wed May 25 2022 Petr Lautrbach - 3.4-2 -- rebuilt - -* Thu May 19 2022 Petr Lautrbach - 3.4-1 -- SELinux userspace 3.4 release - -* Tue May 10 2022 Petr Lautrbach - 3.4-0.rc3.1 -- SELinux userspace 3.4-rc3 release - -* Thu Apr 21 2022 Petr Lautrbach - 3.4-0.rc.1 -- SELinux userspace 3.4-rc2 release - -* Wed Apr 13 2022 Petr Lautrbach - 3.4-0.rc.1 -- SELinux userspace 3.4-rc1 release - -* Tue Feb 22 2022 Petr Lautrbach - 3.3-5 -- Improve error message when selabel_open fails - -* Sat Feb 19 2022 Petr Lautrbach - 3.3-4 -- semodule: add command-line option to detect module changes -- fixfiles: Use parallel relabeling - -* Fri Jan 21 2022 Fedora Release Engineering - 3.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Mon Nov 29 2021 Petr Lautrbach - 3.3-2 -- setfiles/restorecon: support parallel relabeling with -T option -- semodule: add -m | --checksum option - -* Fri Oct 22 2021 Petr Lautrbach - 3.3-1 -- SELinux userspace 3.3 release - -* Mon Oct 11 2021 Petr Lautrbach - 3.3-0.rc3.1 -- SELinux userspace 3.3-rc3 release - -* Wed Sep 29 2021 Petr Lautrbach - 3.3-0.rc2.1 -- SELinux userspace 3.3-rc2 release - -* Tue Aug 3 2021 Petr Lautrbach - 3.2-6 -- Drop forgotten ru/ man pages from -restorecond - -* Wed Jul 28 2021 Petr Lautrbach - 3.2-5 -- Rebase on upstream commit 32611aea6543 - -* Fri Jul 23 2021 Fedora Release Engineering - 3.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Thu Jun 03 2021 Python Maint - 3.2-3 -- Rebuilt for Python 3.10 - -* Mon May 10 2021 Petr Lautrbach - 3.2-2 -- Do not use Python slip -- fixfiles: do not exclude /dev and /run in -C mode -- dbus: use GLib.MainLoop - -* Mon Mar 8 2021 Petr Lautrbach - 3.2-1 -- SELinux userspace 3.2 release - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.2-0.rc2.1.1 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Fri Feb 5 2021 Petr Lautrbach - 3.2-0.rc2.1 -- SELinux userspace 3.2-rc2 release - -* Wed Jan 27 2021 Fedora Release Engineering - 3.2-0.rc1.1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jan 20 2021 Petr Lautrbach - 3.2-0.rc1.1 -- SELinux userspace 3.2-rc1 release - -* Tue Nov 24 2020 Petr Lautrbach - 3.1-8 -- Fix BuildRequires to libsemanage-devel - -* Fri Nov 20 2020 Petr Lautrbach - 3.1-7 -- python/sepolicy: allow to override manpage date -- selinux_config(5): add a note that runtime disable is deprecated - -* Mon Nov 9 2020 Petr Lautrbach - 3.1-6 -- Require latest setools - -* Fri Oct 30 2020 Petr Lautrbach - 3.1-5 -- Build with libsepol.so.1 and libsemanage.so.2 -- Set X-GNOME-HiddenUnderSystemd=true in restorecond.desktop file -- fixfiles: correctly restore context of mountpoints -- sepolgen: print extended permissions in hexadecimal - -* Sat Aug 01 2020 Fedora Release Engineering - 3.1-4 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 28 2020 Fedora Release Engineering - 3.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 14 2020 Tom Stellard - 3.1-2 -- Use make macros -- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Fri Jul 10 2020 Petr Lautrbach - 3.1-1 -- SELinux userspace 3.1 release - -* Mon Jun 1 2020 Petr Lautrbach - 3.0-4 -- policycoreutils-dbus requires python3-gobject-base - -* Sat May 23 2020 Miro Hrončok - 3.0-3 -- Rebuilt for Python 3.9 - -* Thu Jan 30 2020 Fedora Release Engineering - 3.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Dec 6 2019 Petr Lautrbach - 3.0-1 -- SELinux userspace 3.0 release - -* Wed Sep 4 2019 Petr Lautrbach - 2.9-7 -- semanage: Do not use default s0 range in "semanage login -a" (#1312283) - -* Thu Aug 29 2019 Petr Lautrbach - 2.9-6 -- gui: Fix remove module in system-config-selinux (#1740936) - -* Fri Aug 23 2019 Petr Lautrbach - 2.9-5 -- fixfiles: Fix unbound variable problem - -* Fri Aug 16 2019 Miro Hrončok - 2.9-4 -- Rebuilt for Python 3.8 - -* Mon Aug 5 2019 Petr Lautrbach - 2.9-3 -- Drop python2-policycoreutils -- Update ru man page translations -- fixfiles: Fix [-B] [-F] onboot - -* Fri Jul 26 2019 Fedora Release Engineering - 2.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Mar 18 2019 Petr Lautrbach - 2.9-1 -- SELinux userspace 2.9 release - -* Mon Mar 11 2019 Petr Lautrbach - 2.9-0.rc2.1 -- SELinux userspace 2.9-rc2 release - -* Sat Feb 02 2019 Fedora Release Engineering - 2.9-0.rc1.1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Fri Jan 25 2019 Petr Lautrbach - 2.9-0.rc1.1 -- SELinux userspace 2.9-rc1 release candidate - -* Fri Jan 25 2019 Petr Lautrbach - 2.8-17 -- python2-policycoreutils requires python2-ipaddress (#1669230) - -* Tue Jan 22 2019 Petr Lautrbach - 2.8-16 -- restorecond: Install DBUS service file with 644 permissions - -* Mon Jan 21 2019 Petr Lautrbach - 2.8-15 -- setsebool: support use of -P on SELinux-disabled hosts -- sepolicy: initialize mislabeled_files in __init__() -- audit2allow: use local sepolgen-ifgen-attr-helper for tests -- audit2allow: allow using audit2why as non-root user -- audit2allow/sepolgen-ifgen: show errors on stderr -- audit2allow/sepolgen-ifgen: add missing \n to error message -- sepolgen: close /etc/selinux/sepolgen.conf after parsing it -- sepolicy: Make policy files sorting more robust -- semanage: Load a store policy and set the store SELinux policy root - -* Thu Dec 20 2018 Petr Lautrbach - 2.8-14 -- chcat: fix removing categories on users with Fedora default setup -- semanage: Include MCS/MLS range when exporting local customizations -- semanage: Start exporting "ibendport" and "ibpkey" entries -- semanage: do not show "None" levels when using a non-MLS policy -- sepolicy: Add sepolicy.load_store_policy(store) -- semanage: import sepolicy only when it's needed -- semanage: move valid_types initialisations to class constructors - -* Mon Dec 10 2018 Petr Lautrbach - 2.8-13 -- chcat: use check_call instead of getstatusoutput -- Use matchbox-window-manager instead of openbox -- Use ipaddress python module instead of IPy -- semanage: Fix handling of -a/-e/-d/-r options -- semanage: Use standard argparse.error() method - -* Mon Nov 12 2018 Petr Lautrbach - 2.8-12 -- sepolicy,semanage: replace aliases with corresponding type names -- sepolicy-generate: Handle more reserved port types -- Fix RESOURCE_LEAK coverity scan defects - -* Tue Oct 16 2018 Petr Lautrbach - 2.8-11 -- sepolicy: Fix get_real_type_name to handle query failure properly -- sepolicy: search() for dontaudit rules as well - -* Tue Oct 2 2018 Petr Lautrbach - 2.8-10 -- semanage: "semanage user" does not use -s, fix documentation -- semanage: add a missing space in ibendport help -- sepolicy: Update to work with setools-4.2.0 - -* Fri Sep 14 2018 Petr Lautrbach - 2.8-9 -- semanage: Stop rejecting aliases in semanage commands -- sepolicy: Stop rejecting aliases in sepolicy commands -- sepolicy: Fix "info" to search aliases as well -- setfiles: Improve description of -d switch - -* Wed Sep 12 2018 Petr Lautrbach - 2.8-8 -- Update translations - -* Tue Sep 4 2018 Petr Lautrbach - 2.8-7 -- Fix typo in newrole.1 manpage -- sepolgen: print all AV rules correctly -- sepolgen: fix access vector initialization -- Add xperms support to audit2allow -- semanage: Stop logging loginRecords changes -- semanage: Fix logger class definition -- semanage: Replace bare except with specific one -- semanage: fix Python syntax of catching several exceptions -- sepolgen: return NotImplemented instead of raising it -- sepolgen: fix refpolicy parsing of "permissive" - -* Mon Aug 6 2018 Petr Lautrbach - 2.8-6 -- Use split translation files - https://github.com/fedora-selinux/selinux/issues/43 - -* Fri Jul 13 2018 Fedora Release Engineering - 2.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Mon Jul 02 2018 Miro Hrončok - 2.8-4 -- Rebuilt for Python 3.7 - -* Mon Jun 18 2018 Petr Lautrbach - 2.8-3 -- selinux-autorelabel: Use plymouth --quit rather then --hide-splash (#1592221) -- selinux-autorelabel: Increment boot_indeterminate grub environment variable (#1592221) - -* Fri Jun 15 2018 Miro Hrončok - 2.8-2 -- Rebuilt for Python 3.7 - -* Fri May 25 2018 Petr Lautrbach - 2.8-1 -- SELinux userspace 2.8 release - -* Tue May 22 2018 Petr Lautrbach - 2.8-0.rc3.2 -- selinux-autorelabel: set UEFI boot order (BootNext) same as BootCurrent -- selinux-autorelabel: synchronize cached writes before reboot (#1385272) - -* Tue May 15 2018 Petr Lautrbach - 2.8-0.rc3.1 -- SELinux userspace 2.8-rc2 release candidate - -* Fri May 4 2018 Petr Lautrbach - 2.8-0.rc2.1 -- SELinux userspace 2.8-rc2 release candidate - -* Mon Apr 23 2018 Petr Lautrbach - 2.8-0.rc1.1 -- SELinux userspace 2.8-rc1 release candidate - -* Thu Apr 19 2018 Petr Lautrbach - 2.7-20 -- Drop python2 sepolicy gui files from policycoreutils-gui (#1566618) - -* Wed Apr 18 2018 Iryna Shcherbina - 2.7-19 -- Update Python 2 dependency declarations to new packaging standards - (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) - -* Tue Apr 3 2018 Petr Lautrbach - 2.7-18 -- Move semodule_* utilities to policycoreutils package (#1562549) - -* Thu Mar 22 2018 Petr Lautrbach - 2.7-17 -- semanage/seobject.py: Fix undefined store check (#1559174) - -* Fri Mar 16 2018 Petr Lautrbach - 2.7-16 -- Build python only subpackages as noarch -- Move semodule_package to policycoreutils-devel - -* Tue Mar 13 2018 Petr Lautrbach - 2.7-15 -- sepolicy: Fix translated strings with parameters -- sepolicy: Support non-MLS policy -- sepolicy: Initialize policy.ports as a dict in generate.py -- gui/polgengui.py: Use stop_emission_by_name instead of emit_stop_by_name -- Minor update for bash completion -- semodule_package: fix semodule_unpackage man page -- gui/semanagePage: Close "edit" and "add" dialogues when successfull -- gui/fcontextPage: Set default object class in addDialog\ -- sepolgen: fix typo in PolicyGenerator -- build: follow standard semantics for DESTDIR and PREFIX - -* Mon Feb 26 2018 Petr Lautrbach - 2.7-14 -- Use Fedora RPM build flags (#1548740) - -* Tue Feb 20 2018 Petr Lautrbach - 2.7-13 -- Fix mangling of python shebangs - -* Mon Feb 19 2018 Miro Hrončok - 2.7-12 -- Rename the python3 subpackage to have prefix, not suffix -- Use python3 prefixes in requires where possible - -* Thu Feb 15 2018 Petr Lautrbach - 2.7-11 -- Rewrite selinux-polgengui to use Gtk3 -- Drop python2 and gnome-python2 from gui Requires - -* Fri Feb 09 2018 Fedora Release Engineering - 2.7-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Wed Jan 31 2018 Petr Lautrbach - 2.7-9 -- Require audit-libs-python2 - -* Thu Jan 18 2018 Igor Gnatenko - 2.7-8 -- Remove obsolete scriptlets - -* Wed Dec 20 2017 Petr Lautrbach - 2.7-7 -- semanage: bring semanageRecords.set_reload back to seobject.py (#1527745) - -* Wed Dec 13 2017 Petr Lautrbach - 2.7-6 -- semanage: make seobject.py backward compatible -- Own %%{pythonX_sitelib}/site-packages/sepolicy directories (#1522942) - -* Wed Nov 22 2017 Petr Lautrbach - 2.7-5 -- sepolicy: Fix sepolicy manpage -- semanage: Update Infiniband code to work on python3 -- semanage: Fix export of ibendport entries -- semanage: Enforce noreload only if it's requested by -N option - -* Fri Oct 20 2017 Petr Lautrbach - 2.7-4 -- restorecond: check write() and daemon() results -- sepolicy: do not fail when file_contexts.local or .subs do not exist -- sepolicy: remove stray space in section "SEE ALSO" -- sepolicy: fix misspelling of _ra_content_t suffix -- gui: port to Python 3 by migrating to PyGI -- gui: remove the status bar -- gui: fix parsing of "semodule -lfull" in tab Modules -- gui: delete overridden definition of usersPage.delete() -- Enable listing file_contexts.homedirs (#1409813) -- remove semodule_deps - -* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 2.7-3 -- Also add Provides for the old name without %%_isa - -* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 2.7-2 -- Python 2 binary package renamed to python2-policycoreutils - See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 - -* Mon Aug 07 2017 Petr Lautrbach - 2.7-1 -- Update to upstream release 2017-08-04 -- Move DBUS API from -gui to -dbus package - -* Thu Aug 03 2017 Fedora Release Engineering - 2.6-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Sun Jul 30 2017 Florian Weimer - 2.6-8 -- Rebuild with binutils fix for ppc64le (#1475636) - -* Fri Jul 28 2017 Petr Lautrbach - 2.6-7 -- Make 'sepolicy manpage' and 'sepolicy transition' faster -- open_init_pty: restore stdin/stdout to blocking upon exit -- fixfiles: do not dereference link files in tmp -- fixfiles: use a consistent order for options to restorecon -- fixfiles: don't ignore `-F` when run in `-C` mode -- fixfiles: remove bad modes of "relabel" command -- fixfiles: refactor into the `set -u` dialect -- fixfiles: if restorecon aborts, we should too -- fixfiles: usage errors are fatal -- fixfiles: syntax error -- fixfiles: remove two unused variables -- fixfiles: tidy up usage(), manpage synopsis -- fixfiles: deprecate -l option -- fixfiles: move logit call outside of redirected function -- fixfiles: fix logging about R/O filesystems -- fixfiles: clarify exclude_dirs() -- fixfiles: remove (broken) redundant code - - -* Thu Jul 27 2017 Fedora Release Engineering - 2.6-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Thu Apr 06 2017 Petr Lautrbach - 2.6-5 -- semanage: Unify argument handling (#1398987) -- setfiles: set up a logging callback for libselinux -- setfiles: Fix setfiles progress indicator -- setfiles: stdout messages don't need program prefix -- setfiles: don't scramble stdout and stderr together (#1435894) -- restorecond: Decrease loglevel of termination message (#1264505) -- fixfiles should handle path arguments more robustly -- fixfiles: handle unexpected spaces in command -- fixfiles: remove useless use of cat (#1435894) -- semanage: Add checks if a module name is passed in (#1420707) -- semanage: fix export of fcontext socket entries (#1435127) -- selinux-autorelabel: remove incorrect redirection to /dev/null (#1415674) - -* Fri Mar 17 2017 Petr Lautrbach - 2.6-4 -- Fix selinux-polgengui (#1432337) -- sepolicy - fix obtaining domain name in HTMLManPages - -* Tue Feb 28 2017 Petr Lautrbach - 2.6-3 -- Fix several issues in gui and 'sepolicy manpage' (#1416372) - -* Thu Feb 23 2017 Petr Lautrbach - 2.6-2 -- Use %%{__python3} instead of python3 - -* Mon Feb 20 2017 Petr Lautrbach - 2.6-1.1 -- Fix pp crash when processing base module (#1417200) -- Update to upstream release 2016-10-14 - -* Wed Feb 15 2017 Igor Gnatenko - 2.5-22 -- Rebuild for brp-python-bytecompile - -* Sat Feb 11 2017 Fedora Release Engineering - 2.5-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Wed Dec 21 2016 Kevin Fenzi - 2.5-20 -- Rebuild for python 3.6 - -* Thu Dec 01 2016 Petr Lautrbach - 2.5-19 -- seobject: Handle python error returns correctly -- policycoreutils/sepolicy/gui: fix current selinux state radiobutton -- policycoreutils: semodule_package: do not fail with an empty fc file - -* Tue Nov 22 2016 Petr Lautrbach - 2.5-18 -- Update translations -- Fix fcontextPage editing features (#1344842) - -* Mon Oct 03 2016 Petr Lautrbach 2.5-17 -- sandbox: Use dbus-run-session instead of dbus-launch when available -- hll/pp: Change warning for module name not matching filename to match new behavior -- Remove LDFLAGS from CFLAGS -- sandbox: create a new session for sandboxed processes -- sandbox: do not try to setup directories without -X or -M -- sandbox: do not run xmodmap in a new X session -- sandbox: Use GObject introspection binding instead of pygtk2 -- sandbox: fix file labels on copied files -- sandbox: tests - close stdout of p -- sandbox: tests - use sandbox from cwd -- audit2allow: tests should use local copy not system -- audit2allow: fix audit2why import from seobject -- audit2allow: remove audit2why so that it gets symlinked -- semanage: fix man page and help message for import option -- semanage: fix error message for fcontext -m -- semanage: Fix semanage fcontext -D -- semanage: Correct fcontext auditing -- semanage: Default serange to "s0" for port modify -- semanage: Use socket.getprotobyname for protocol -- semanage: fix modify action in node and interface -- fixfiles: Pass -n to restorecon for fixfiles check -- sepolicy: Check get_rpm_nvr_list() return value -- Don't use subprocess.getstatusoutput() in Python 2 code -- semanage: Add auditing of changes in records -- Remove unused 'q' from semodule getopt string - -* Mon Aug 01 2016 Petr Lautrbach 2.5-16 -- Remove unused autoconf files from po/ -- Remove duplicate, empty translation files -- Rebuilt with libsepol-2.5-9, libselinux-2.5-11, libsemanage-2.5-7 - -* Thu Jul 21 2016 Petr Lautrbach 2.5-15 -- Fix sandbox -X issue related to python3 (#1358138) - -* Wed Jul 20 2016 Richard W.M. Jones - 2.5-14 -- Use generator approach to fix autorelabel - -* Tue Jul 19 2016 Fedora Release Engineering - 2.5-13 -- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages - -* Thu Jul 14 2016 Petr Lautrbach - 2.5-12 -- open_init_pty: Do not error on EINTR -- Fix [-s STORE] typos in semanage -- Update sandbox types in sandbox manual -- Update translations - -* Mon Jun 27 2016 Petr Lautrbach - 2.5-11 -- Convert sandbox to gtk-3 using pygi-convert.sh (#1343166) - -* Thu Jun 23 2016 Petr Lautrbach - 2.5-10 -- Fix typos in semanage manpages -- Fix the documentation of -l,--list for semodule -- Minor fix in a French translation -- Fix the extract example in semodule.8 -- Update sandbox.8 man page -- Remove typos from chcat --help -- sepolgen: Remove additional files when cleaning - -* Wed May 11 2016 Petr Lautrbach - 2.5-9 -- Fix multiple spelling errors -- Rebuild with libsepol-2.5-6 - -* Mon May 02 2016 Petr Lautrbach - 2.5-8 -- Rebuilt with libsepol-2.5-5 - -* Fri Apr 29 2016 Petr Lautrbach - 2.5-7 -- hll/pp: Warn if module name different than output filename - -* Mon Apr 25 2016 Petr Lautrbach - 2.5-6 -- Ship selinux-autorelabel utility and systemd unit files (#1328825) - -* Fri Apr 08 2016 Petr Lautrbach - 2.5-5 -- sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy files (#1319338) - -* Fri Mar 18 2016 Petr Lautrbach - 2.5-4 -- Add documentation for MCS separated domains -- Move svirt man page out of libvirt into its own - -* Thu Mar 17 2016 Petr Lautrbach - 2.5-3 -- policycoreutils: use python3 in chcat(#1318408) - -* Sat Mar 05 2016 Petr Lautrbach 2.5-2 -- policycoreutils/sepolicy: selinux_server.py to use GLib instead of gobject -- policycoreutils-gui requires python-slip-dbus (#1314685) - -* Tue Feb 23 2016 Petr Lautrbach 2.5-1 -- Update to upstream release 2016-02-23 - -* Thu Feb 04 2016 Fedora Release Engineering - 2.4-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Mon Dec 14 2015 Petr Lautrbach - 2.4-20 -- Fix 'semanage permissive -l' subcommand (#1286325) -- Several 'sepolicy gui' fixes (#1281309,#1281309,#1282382) - -* Tue Nov 17 2015 Petr Lautrbach 2.4-19 -- Require at least one argument for 'semanage permissive -d' (#1255676) - -* Mon Nov 16 2015 Petr Lautrbach 2.4-18 -- Improve sepolicy command line interface -- Fix sandbox to propagate specified MCS/MLS Security Level. (#1279006) -- Fix 'audit2allow -R' (#1280418) - -* Thu Nov 12 2015 Fedora Release Engineering - 2.4-17 -- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 - -* Mon Nov 09 2015 Petr Lautrbach 2.4-16 -- policycoreutils-gui needs policycoreutils-python (#1279046) - -* Wed Nov 04 2015 Robert Kuska - 2.4-15 -- Rebuilt for Python3.5 rebuild - -* Thu Oct 08 2015 Petr Lautrbach 2.4-14 -- Revert the attempt to port -gui to GTK 3 (#1269328, #1266059) - -* Fri Oct 02 2015 Petr Lautrbach 2.4-13 -- newrole: Set keepcaps around setresuid calls -- newrole: Open stdin as read/write - -* Fri Sep 04 2015 Petr Lautrbach 2.4-12 -- Fix several semanage issue (#1247714) -- Decode output from subprocess, if error occurred (#1247039) - -* Wed Sep 02 2015 Petr Lautrbach 2.4-11 -- audit2allow, audit2why - ignore setlocale errors (#1208529) - -* Fri Aug 21 2015 Petr Lautrbach 2.4-10 -- Port sandbox to GTK 3 and fix issue with Xephyr - -* Thu Aug 13 2015 Petr Lautrbach 2.4-9 -- Fix another python3 issues mainly in sepolicy (#1247039,#1247575,#1251713) - -* Thu Aug 06 2015 Petr Lautrbach 2.4-8 -- Fix multiple python3 issues in sepolgen (#1249388,#1247575,#1247564) - -* Mon Jul 27 2015 Petr Lautrbach 2.4-7 -- policycoreutils-python3 depends on python-IPy-python3 - -* Mon Jul 27 2015 Petr Lautrbach 2.4-6 -- policycoreutils-devel depends on policycoreutils-python-utils (#1246818) - -* Fri Jul 24 2015 Petr Lautrbach 2.4-5 -- Move python utilities from -python to -python-utilities -- All scripts originally from policycoreutils-python use python 3 now - -* Fri Jul 24 2015 Petr Lautrbach 2.4-4 -- policycoreutils: semanage: fix moduleRecords deleteall method - -* Thu Jul 23 2015 Petr Lautrbach 2.4-3 -- Improve compatibility with python 3 -- Add sepolgen module to python3 package - -* Tue Jul 21 2015 Petr Lautrbach 2.4-2 -- Add Python3 support for sepolgen module (#1125208,#1125209) - -* Tue Jul 21 2015 Petr Lautrbach 2.4-1.1 -- Update to 2.4 release - -* Wed Jul 15 2015 Petr Lautrbach 2.4-0.7 -- Fix typo in semanage args for minimum policy store - -* Fri Jul 03 2015 Petr Lautrbach 2.4-0.6 -- policycoreutils: semanage: update to new source policy infrastructure -- semanage: move permissive module creation to /tmp - -* Thu Jun 18 2015 Fedora Release Engineering - 2.3-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Wed May 06 2015 Petr Lautrbach 2.3-17 -- setfiles/restorecon: fix -r/-R option (#1211721) - -* Mon Apr 13 2015 Petr Lautrbach 2.4-0.4 -- Update to upstream 2.4 - -* Tue Feb 24 2015 Petr Lautrbach 2.3-16 -- Temporary removed Requires:audit-libs-python from policycoreutils-python3 subpackage (#1195139) -- Simplication of sepolicy-manpage web functionality (#1193552) - -* Mon Feb 02 2015 Petr Lautrbach 2.3-15 -- We need to cover file_context.XXX.homedir to have fixfiles with exclude_dirs working correctly -- Use dnf instead of yum (#1156547) - -* Tue Nov 18 2014 Dan Walsh - 2.3-14 -- Audit2allow will check for mislabeled files, and tells user to fix the label. -- Also checks for basefiles and suggests creating a different label. -- Patch from Ryan Hallisey - -* Wed Nov 5 2014 Miroslav Grepl - 2.3-13 -- Switch back to yum. Need additional fixes to make it working correctly. - -* Wed Nov 5 2014 Miroslav Grepl - 2.3-12 -- Switch over to dnf from yum - -* Tue Sep 23 2014 Miroslav Grepl - 2.3-11 -- Improvements to audit2allow from rhallise@redhat.com - * Check for mislabeled files. - * Check for base file use and - * Suggest writable files as alternatives - -* Sun Aug 17 2014 Fedora Release Engineering - 2.3-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Mon Aug 4 2014 Dan Walsh - 2.3-9 -- Remove build requires for openbox, not needed - -* Thu Jul 31 2014 Tom Callaway - 2.3-8 -- fix license handling - -* Wed Jul 23 2014 Miroslav Grepl - 2.3-7 -- Examples are no longer in the main semanage man page (#1084390) -- Add support for Fedora22 man pages. We need to fix it to not using hardcoding. -- Print usage for all mutually exclusive options. -- Fix selinux man page to refer seinfo and sesearch tools. - -* Sat Jun 07 2014 Fedora Release Engineering - 2.3-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Wed May 28 2014 Kalev Lember - 2.3-5 -- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4 - -* Tue May 20 2014 Miroslav Grepl - 2.3-4 -- Fix setfiles to work correctly if -r option is defined - -* Fri May 16 2014 Dan Walsh - 2.3-3 -- Update Miroslav Grepl Patches - * If there is no executable we don't want to print a part of STANDARD FILE CON - * Add-manpages-for-typealiased-types - * Make fixfiles_exclude_dirs working if there is a substituion for the given d - -* Mon May 12 2014 Miroslav Grepl - 2.3-2 -- If there is no executable we don't want to print a part of STANDARD FILE CONTEXT - -* Tue May 6 2014 Dan Walsh - 2.3-1 -- Update to upstream - * Add -P semodule option to man page from Dan Walsh. - * selinux_current_policy_path will return none on a disabled SELinux system from Dan Walsh. - * Add new icons for sepolicy gui from Dan Walsh. - * Only return writeable files that are enabled from Dan Walsh. - * Add domain to short list of domains, when -t and -d from Dan Walsh. - * Fix up desktop files to match current standards from Dan Walsh. - * Add support to return sensitivities and categories for python from Dan Walsh. - * Cleanup whitespace from Dan Walsh. - * Add message to tell user to install sandbox policy from Dan Walsh. - * Add systemd unit file for mcstrans from Laurent Bigonville. - * Improve restorecond systemd unit file from Laurent Bigonville. - * Minor man pages improvements from Laurent Bigonville. - -* Tue May 6 2014 Miroslav Grepl - 2.2.5-15 -- Apply patch to use setcon in seunshare from luto@mit.edu - -* Wed Apr 30 2014 Dan Walsh - 2.2.5-14 -- Remove requirement for systemd-units - -* Fri Apr 25 2014 Miroslav Grepl - 2.2.5-13 -- Fix previous Fix-STANDARD_FILE_CONTEXT patch to exclude if non_exec does not exist - -* Thu Apr 24 2014 Miroslav Grepl - 2.2.5-12 -- Add policycoreutils-rhat-revert.patch to revert the last two commits to make build working -- Add 0001-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages patch - -* Tue Apr 1 2014 Dan Walsh - 2.2.5-11 -- Update Translations - -* Thu Mar 27 2014 Miroslav Grepl - 2.2.5-10 -- Add support for Fedora21 html manpage structure -- Fix broken dependencies to require only usermode-gtk - -* Wed Mar 26 2014 Dan Walsh - 2.2.5-9 -- mgrepl [PATCH] Deleteall user customization fails if there is a user used -- for the default login. We do not want to fail on it and continue to delete -- customizations for users which are not used for default login. - -* Mon Mar 24 2014 Dan Walsh - 2.2.5-8 -- Update Translations -- Make selinux-policy build working also on another architectures related to s -- Miroslav grepl patch to fix the creation of man pages on different architectures. -- Add ability to list the actual active modules -- Fix spelling mistake on sesearch in generate man pages. - -* Fri Feb 14 2014 Dan Walsh - 2.2.5-7 -- Allow manpages to be built on aarch64 - -* Fri Feb 14 2014 Dan Walsh - 2.2.5-6 -- Don't be verbose in fixfiles if there is not tty - -* Thu Feb 13 2014 Dan Walsh - 2.2.5-5 -- Yum should only be required for policycoreutils-devel - -* Tue Jan 21 2014 Dan Walsh - 2.2.5-4 -- Update translations - -* Thu Jan 16 2014 Dan Walsh - 2.2.5-3 -- Add Miroslav patch to -- Fix previously_modified_initialize() to show modified changes properly for all selections - -* Wed Jan 8 2014 Dan Walsh - 2.2.5-2 -- Do not require /usr/share/selinux/devel/Makefile to build permissive domains - -* Mon Jan 6 2014 Dan Walsh - 2.2.5-1 -- Update to upstream - * Ignore selevel/serange if MLS is disabled from Sven Vermeulen. - -* Fri Jan 3 2014 Dan Walsh - 2.2.4-8 -- Update Tranlations -- Patch from Yuri Chornoivan to fix typos - -* Fri Jan 3 2014 Dan Walsh - 2.2.4-7 -- Fixes Customized booleans causing a crash of the sepolicy gui - -* Fri Dec 20 2013 Dan Walsh - 2.2.4-6 -- Fix sepolicy gui selection for advanced screen -- Update Translations -- Move requires checkpolicy requirement into policycoreutils-python - -* Mon Dec 16 2013 Dan Walsh - 2.2.4-5 -- Fix semanage man page description of import command -- Fix policy kit file to allow changing to permissive mode - -* Mon Dec 16 2013 Dan Walsh - 2.2.4-4 -- Fix broken dependencies. - -* Fri Dec 13 2013 Dan Walsh - 2.2.4-3 -- Break out python3 code into separate package - -* Fri Dec 6 2013 Dan Walsh - 2.2.4-2 -- Add mgrepl patch -- ptrace should be a part of deny_ptrace boolean in TEMPLATETYPE_admin - -* Tue Dec 3 2013 Dan Walsh - 2.2.4-1 -- Update to upstream - * Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems. -- Add patches for sepolicy gui from mgrepl to - Fix advanced_item_button_push() to allow to select an application in advanced search menu - Fix previously_modified_initialize() to show modified changes properly for all selections - - -* Fri Nov 22 2013 Dan Walsh - 2.2.3-1 -- Update to upstream - * Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh. - * Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh. -- Apply Miroslav Grepl patch to fix TEMPLATETYPE_domtrans description in sepolicy generate - -* Wed Nov 20 2013 Dan Walsh - 2.2.2-2 -- Fix selinux-polgengui, get_all_modules call - -* Fri Nov 15 2013 Dan Walsh - 2.2.2-1 -- Speed up startup time of sepolicy gui -- Clean up ports screen to only show enabled ports. -- Update to upstream - * Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh. - * Make yum/extract_rpms optional for sepolicy generate from Dan Walsh. - * Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh. - -* Thu Oct 31 2013 Dan Walsh - 2.2-2 -- Shift around some of the files to more appropriate packages. - * semodule_* packages are required for devel. -* Thu Oct 31 2013 Dan Walsh - 2.2-1 -- Update to upstream - * Properly build the swig exception file from Laurent Bigonville. - * Fix man pages from Laurent Bigonville. - * Support overriding PATH and INITDIR in Makefile from Laurent Bigonville. - * Fix LDFLAGS usage from Laurent Bigonville. - * Fix init_policy warning from Laurent Bigonville. - * Fix semanage logging from Laurent Bigonville. - * Open newrole stdin as read/write from Sven Vermeulen. - * Fix sepolicy transition from Sven Vermeulen. - * Support overriding CFLAGS from Simon Ruderich. - * Create correct man directory for run_init from Russell Coker. - * restorecon GLOB_BRACE change from Michal Trunecka. - * Extend audit2why to report additional constraint information. - * Catch IOError errors within audit2allow from Dan Walsh. - * semanage export/import fixes from Dan Walsh. - * Improve setfiles progress reporting from Dan Walsh. - * Document setfiles -o option in usage from Dan Walsh. - * Change setfiles to always return -1 on failure from Dan Walsh. - * Improve setsebool error r eporting from Dan Walsh. - * Major overhaul of gui from Dan Walsh. - * Fix sepolicy handling of non-MLS policy from Dan Walsh. - * Support returning type aliases from Dan Walsh. - * Add sepolicy tests from Dan Walsh. - * Add org.selinux.config.policy from Dan Walsh. - * Improve range and user input checking by semanage from Dan Walsh. - * Prevent source or target arguments that end with / for substitutions from Dan Walsh. - * Allow use of <> for semanage fcontext from Dan Walsh. - * Report customized user levels from Dan Walsh. - * Support deleteall for restoring disabled modules from Dan Walsh. - * Improve semanage error reporting from Dan Walsh. - * Only list disabled modules for module locallist from Dan Walsh. - * Fix logging from Dan Walsh. - * Define new constants for file type character codes from Dan Walsh. - * Improve bash completions from Dan Walsh. - * Convert semanage to argparse from Dan Walsh (originally by Dave Quigley). - * Add semanage tests from Dan Walsh. - * Split semanage man pages from Dan Walsh. - * Move bash completion scripts from Dan Walsh. - * Replace genhomedircon script with a link to semodule from Dan Walsh. - * Fix fixfiles from Dan Walsh. - * Add support for systemd service for restorecon from Dan Walsh. - * Spelling corrections from Dan Walsh. - * Improve sandbox support for home dir symlinks and file caps from Dan Walsh. - * Switch sandbox to openbox window manager from Dan Walsh. - * Coalesce audit2why and audit2allow from Dan Walsh. - * Change audit2allow to append to output file from Dan Walsh. - * Update translations from Dan Walsh. - * Change audit2why to use selinux_current_policy_path from Dan Walsh. - -* Fri Oct 25 2013 Dan Walsh - 2.1.14-89 -- Fix handling of man pages. - -* Wed Oct 16 2013 Dan Walsh - 2.1.14-88 -- Cleanup errors found by pychecker -- Apply patch from Michal Trunecka to allow restorecon to handle {} in globs - -* Fri Oct 11 2013 Dan Walsh - 2.1.14-87 -- sepolicy gui - - mgrepl fixes for users and login -- Update Translations. - -* Fri Oct 11 2013 Dan Walsh - 2.1.14-86 -- sepolicy gui - - mgrepl added delete screens for users and login - - Fix lots of bugs. -- Update Translations. - - -* Fri Oct 4 2013 Dan Walsh - 2.1.14-85 -- Fixes for fixfiles - * exclude_from_dirs should apply to all types of restorecon calls - * fixfiles check now works - * exit with the correct status - -- semanage no longer import selinux - -* Wed Oct 2 2013 Dan Walsh - 2.1.14-84 -- Fixes for sepolicy gui -- Fix setsebool to return 0 on success -- Update Po - -* Mon Sep 30 2013 Dan Walsh - 2.1.14-83 -- Fix sizes of help screens in sepolicy gui - -* Sat Sep 28 2013 Dan Walsh - 2.1.14-82 -- Improvements to sepolicy gui - - Add more help information - - Cleanup code - - Add deny_ptrace on lockdown screen - - Make unconfined/permissivedomains lockdown work - - Add more support for file equivalency - -* Wed Sep 18 2013 Dan Walsh - 2.1.14-81 -- Add back in the help png files -- Begin Adding support for file equivalency. - -* Wed Sep 4 2013 Dan Walsh - 2.1.14-80 -- Random fixes for sepolicy gui - * Do not prompt for password until you make a change - * Add user mappings and selinux users page - * lots of code cleanup - -- Verify homedir is owned by user before mounting over it with seunshare -- Fix fixfiles to handle Relabel properly -- Fix semanage fcontext -e / command to allow "/" - -* Wed Sep 4 2013 Dan Walsh - 2.1.14-79 -- Add Miroslav Grepl setsebool patch to give better error message on bad boolean names -- Additional help screens for sepolicy gui - -* Tue Sep 3 2013 Dan Walsh - 2.1.14-78 -- Random fixes for sepolicy gui -- Update Translations - -* Fri Aug 30 2013 Dan Walsh - 2.1.14-77 -- Add help screens for each page -- Fixes for system page - -* Mon Aug 26 2013 Dan Walsh - 2.1.14-76 -- Add Miroslav Grepl Patch to handle semanage -i and semanage -o better -- Update Translations - -* Thu Aug 15 2013 Dan Walsh - 2.1.14-75 -- Update sepolicy gui code, cleanups and add file transition tab -- Fix semanage fcontext -a --ftype code to work. - -* Wed Aug 7 2013 Dan Walsh - 2.1.14-74 -- If policy is not installed get_bools should not crash - -* Wed Aug 7 2013 Dan Walsh - 2.1.14-73 -- Fix doc versioning - -* Tue Aug 6 2013 Dan Walsh - 2.1.14-72 -- Update sepolicy gui code, cleanups and add file transition tab -- Fix semanage argparse problems - -* Fri Aug 2 2013 Dan Walsh - 2.1.14-71 -- Update sepolicy gui code, adding dbus calls -- Update Translations - -* Fri Jul 26 2013 Dan Walsh - 2.1.14-70 -- Fix semanage argparse bugs -- Update Translations -- Add test suite for semanage command lines - -* Wed Jul 24 2013 Dan Walsh - 2.1.14-69 -- Fix semanage argparse bugs - -* Tue Jul 23 2013 Dan Walsh - 2.1.14-68 -- Fix bugs introduced by previous patch. semanage port -- Update Translations -- Add test suite for sepolicy command lines - -* Fri Jul 19 2013 Dan Walsh - 2.1.14-67 -- Fix bugs introduced by previous patch. semanage port -- Update Translations - -* Wed Jul 17 2013 Dan Walsh - 2.1.14-66 -- Rewrite argparse code in semanage and fix reload problem. - -* Tue Jul 16 2013 Dan Walsh - 2.1.14-65 -- Do not generate shell script or spec file for sepolicy generate --newtype -- Update translations -- Fix sepolicy generate --admin_user man page again -- Fix setsebool to print less verbose error messages by default, add -V for ve - -* Mon Jul 15 2013 Dan Walsh - 2.1.14-64 -- Move audit2allow and audit2why back into -python package - -* Wed Jul 10 2013 Dan Walsh - 2.1.14-63 -- Update sepolicy gui. -- Error out of you call sepolicy gui without policycoreutils-gui package installed -- Fix semanage login -d command -- Update Translations - -* Wed Jul 10 2013 Dan Walsh - 2.1.14-62 -- Update sepolicy gui. - -* Fri Jul 5 2013 Dan Walsh - 2.1.14-61 -- Add Ryan Hallisey sepolicy gui. -- Update Translations - -* Mon Jun 24 2013 Dan Walsh - 2.1.14-60 -- Fix semanage module error handling - -* Sun Jun 23 2013 Dan Walsh - 2.1.14-59 -- Add back default exception handling for errors, which argparse rewrite removed. - -* Fri Jun 21 2013 Dan Walsh - 2.1.14-58 -- Fix generation of booleans in man pages - -* Fri Jun 21 2013 Dan Walsh - 2.1.14-57 -- Remove requires for systemd-sysv -- Move systemd-units require to restorecond section -- Update Tranlasions -- More sepolicy interfaces for gui -- Cleanup man pages for sepolicy generate - -* Wed Jun 19 2013 Dan Walsh - 2.1.14-56 -- Fix semanage export/import commands -- Fix semange module command -- Remove --version option from sandbox - -* Tue Jun 18 2013 Dan Walsh - 2.1.14-55 -- Add man page doc for --role and bash complestion support for sepolicy --role - -* Tue Jun 18 2013 Dan Walsh - 2.1.14-54 -- Make fcdict return a dictionary of dictionaries -- Fix for sepolicy manpage - -* Mon Jun 17 2013 Dan Walsh - 2.1.14-53 -- Add new man pages for each semanage subsection - -* Mon Jun 17 2013 Dan Walsh - 2.1.14-52 -- Fix handling of sepolicy network sorting. -- Additional interfaces needed for sepolicy gui - -* Thu Jun 6 2013 Dan Walsh - 2.1.14-51 -- Fix handling of semanage args - -* Thu Jun 6 2013 Dan Walsh - 2.1.14-50 -- Fix sepolicy generate --confined_admin to generate tunables -- Add new interface to generate entrypoints for use with new gui - -* Wed Jun 5 2013 Dan Walsh - 2.1.14-49 -- Fix handing of semanage with no args - -* Tue Jun 4 2013 Dan Walsh - 2.1.14-48 -- Fix audit2allow -o to open file for append -- Fix the name of the spec file generated in the build script - -* Fri May 31 2013 Dan Walsh - 2.1.14-47 -- Fix mgrepl patch to support all semanage command parsing - -* Sun May 26 2013 Dan Walsh - 2.1.14-46 -- Fix the name of the spec file generated in the build script -- Add mgrepl patch to support argparse for semanage command parsing - -* Tue May 21 2013 Dan Walsh - 2.1.14-45 -- Fix sandbox to always use sandbox_file_t, so generated policy will work. -- Update Translations - -* Thu May 16 2013 Dan Walsh - 2.1.14-44 -- Fix sepolicy-generate man page to clear up options/policy type -- Add Miroslav Grepl to not generate man page when doing - sepolicy generate --customize -- Add support for executing semanage user within spec file -- Fix generation of confined admin domains, to handle booleans properly. - -* Tue May 14 2013 Dan Walsh - 2.1.14-43 -- Need to handle gziped policy.xml as well as not compressed. - -* Tue May 14 2013 Dan Walsh - 2.1.14-42 -- Add support for Xephyr -resizable, so sandbox can now resize window -- Add support for compressed policy.xml -- Miroslav Grepl patch to allow sepolicy interface on individual interface fil -- Also add capability to test interfaces for correctness. - -* Mon May 13 2013 Dan Walsh - 2.1.14-41 -- Apply patches from Sven Vermeulen for sepolgen to fix typos. - -* Mon May 13 2013 Dan Walsh - 2.1.14-40 -- Only require selinux-policy-devel for policycoreutils-devel, this will shrink the size of the livecd. - -* Sun May 12 2013 Dan Walsh - 2.1.14-39 -- Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed, first time -- Add Sven Vermeulen patches to cleanup man pages - -* Fri May 10 2013 Dan Walsh - 2.1.14-38 -- No longer run sepolgen-ifgen at install time. -- Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed. -- Update Translations - -* Mon Apr 22 2013 Dan Walsh - 2.1.14-37 -- Fix exceptionion hanling in audit2allow -o -- Generate Man pages for everydomain, not just ones with exec_t entrypoints -- sepolicy comunicate should return ValueError not TypeError -- Trim header line in sepolicy manpage to use less space -- Add missing options to restorecon man page - -* Thu Apr 11 2013 Dan Walsh - 2.1.14-36 -- Raise proper Exception on sepolicy communicate with invalid value - -* Wed Apr 10 2013 Dan Walsh - 2.1.14-35 -- Update translations -- Add patch by Miroslav Grepl to add compile test for sepolicy interface command. - -* Tue Apr 9 2013 Dan Walsh - 2.1.14-34 -- Update translations -- Add patch inspired by Miroslav Grepl to add extended information for sepolicy interface command. - -* Mon Apr 8 2013 Dan Walsh - 2.1.14-33 -- Update translations -- Add missing man pages and fixup existing man pages - -* Wed Apr 3 2013 Dan Walsh - 2.1.14-32 -- Move sepolicy to policycoreutils-devel pacage, since most of it is used for devel -- Apply Miroslav Grepl Patches for sepolicy --- Fix generate mutually groups option handling --- EUSER is used for existing policy --- customize options can be used together with admin_domain option --- Fix manpage.py to generate correct man pages for SELinux users --- Fix policy *.te file generated by customize+writepaths options --- Fix install script for confined_admin option - -* Mon Apr 1 2013 Dan Walsh - 2.1.14-31 -- Add post install scripts for gui to make sure Icon Cache is refreshed. -- Fix grammar issue in secon man page -- Update Translations - -* Thu Mar 28 2013 Dan Walsh - 2.1.14-30 -- Add buildrequires for OpenBox to prevent me from accidently building into RHEL7 -- Add support for returning alias data to sepolicy.info python bindings - -* Wed Mar 27 2013 Dan Walsh - 2.1.14-28 -- Fix audit2allow output to better align analysys with the allow rules -- Apply Miroslav Grepl patch to clean up sepolicy generate usage -- Apply Miroslav Grepl patch to fixupt handing of admin_user generation -- Update Tranlslations - -* Wed Mar 27 2013 Dan Walsh - 2.1.14-27 -- Allow semanage fcontext -a -t "<>" ... to work - -* Mon Mar 25 2013 Dan Walsh - 2.1.14-26 -- Can not unshare IPC in sandbox, since it blows up Xephyr -- Remove bogus error message sandbox about reseting setfsuid - -* Thu Mar 21 2013 Dan Walsh - 2.1.14-25 -- Fix sepolicy generate --customize to generate policy with -w commands - -* Thu Mar 21 2013 Dan Walsh - 2.1.14-24 -- sepolgen-ifgen needs to handle filename transition rules containing ":" - -* Tue Mar 19 2013 Dan Walsh - 2.1.14-23 -- sepolicy manpage: -- use nroff instead of man2html -- Remove checking for name of person who created the man page -- audit2allow -- Fix output to show the level that is different. - -* Thu Mar 14 2013 Dan Walsh - 2.1.14-22 -- Fix newrole to not drop capabilities from the bounding set. -- Stop dropping capabilities from its children. -- Add better error messages. -- Change location of bash_completion files to /usr/share/bash-completion/compl - -* Mon Mar 11 2013 Dan Walsh - 2.1.14-21 -- sepolicy generate should look for booleans that effect equivalence names, and add them to the man page - -* Thu Mar 7 2013 Dan Walsh - 2.1.14-20 -- Mention creation of permissive domains in sepolicy generate man page -- Change sepolicy manpage to use shortname with an "_" to stop accidently grabbing unrelated types for a domain. -- Fix audit2allow to show better information on constraint violations. - -* Wed Mar 6 2013 Dan Walsh - 2.1.14-19 -- Have restorecon exit -1 on errors for consistancy. - -* Tue Mar 5 2013 Dan Walsh - 2.1.14-18 -- Need to provide a value to semanage boolean -m - -* Mon Mar 4 2013 Dan Walsh - 2.1.14-17 -- Fix cut and paste errors for sepolicy network command - -* Fri Mar 1 2013 Dan Walsh - 2.1.14-16 -- Fix sepoicy interface to work properly - -* Thu Feb 28 2013 Dan Walsh - 2.1.14-15 -- Fix fixfiles to use exclude_dirs on fixfiles restore - -* Thu Feb 28 2013 Dan Walsh - 2.1.14-14 -- Allow users with symlinked homedirs to work. call realpath on homedir -- Fix sepolicy reorganization of helper functions. - -* Sun Feb 24 2013 Dan Walsh - 2.1.14-13 -- Update trans -- Fix sepolicy reorganization of helper functions. - -* Sun Feb 24 2013 Rahul Sundaram - 2.1.14-13 -- remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247 -- clean up spec to follow current guidelines - -* Fri Feb 22 2013 Dan Walsh - 2.1.14-12 -- Do not load interface file by default when sepolicy is called, mov get_all_methods to the sepolicy package - -* Fri Feb 22 2013 Dan Walsh - 2.1.14-11 -- sepolgen-ifgen should use the current policy path if selinux is enabled - -* Fri Feb 22 2013 Dan Walsh - 2.1.14-10 -- Fix sepolicy to be able to work on an SELinux disabled system. -- Needed to be able to build man pages in selinux-policy package - -* Thu Feb 21 2013 Dan Walsh - 2.1.14-9 -- Add yum to requires of policycoreutils-python since sepolicy requires it. - -* Thu Feb 21 2013 Dan Walsh - 2.1.14-8 -- Sepolixy should not throw an exception on an SELinux disabled machine -- Switch from using console app to using pkexec, so we will work better -with policykit. -- Add missing import to fix system-config-selinux startup -- Add comment to pamd files about pam_rootok.so -- Fix sepolicy generate to not comment out the first line - -* Wed Feb 20 2013 Dan Walsh - 2.1.14-7 -- Add --root/-r flag to sepolicy manpage, -- This allows us to generate man pages on the fly in the selinux-policy build - -* Mon Feb 18 2013 Dan Walsh - 2.1.14-6 -- Fix newrole to retain cap_audit_write when compiled with namespace, also -do not drop capabilities when run as root. - -* Thu Feb 14 2013 Dan Walsh - 2.1.14-5 -- Fix man page generation and public_content description - -* Thu Feb 14 2013 Dan Walsh - 2.1.14-4 -- Revert some changes which are causing the wrong policy version file to be created -- Switch sandbox to start using openbox rather then matchbox -- Make sepolgen a symlink to sepolicy -- update translations - -* Wed Feb 13 2013 Dan Walsh - 2.1.14-3 -- Fix empty system-config-selinux.png, again - -* Tue Feb 12 2013 Dan Walsh - 2.1.14-2 -- Fix empty system-config-selinux.png - -* Thu Feb 7 2013 Dan Walsh - 2.1.14-1 -- Update to upstream - * setfiles: estimate percent progress - * load_policy: make link at the destination directory - * Rebuild polgen.glade with glade-3 - * sepolicy: new command to unite small utilities - * sepolicy: Update Makefiles and po files - * sandbox: use sepolicy to look for sandbox_t - * gui: switch to use sepolicy - * gui: sepolgen: use sepolicy to generate - * semanage: use sepolicy for boolean dictionary - * add po file configuration information - * po: stop running update-po on all - * semanage: seobject verify policy types before allowing you to assign them. - * gui: Start using Popen, instead of os.spawnl - * sandbox: Copy /var/tmp to /tmp as they are the same inside - * qualifier to shred content - * semanage: Fix handling of boolean_sub names when using the -F flag - * semanage: man: roles instead of role - * gui: system-config-selinux: Catch no DISPLAY= error - * setfiles: print error if no default label found - * semanage: list logins file entries in semanage login -l - * semanage: good error message is sepolgen python module missing - * gui: system-config-selinux: do not use lokkit - * secon: add support for setrans color information in prompt output - * restorecond: remove /etc/mtab from default list - * gui: If you are not able to read enforcemode set it to False - * genhomedircon: regenerate genhomedircon more often - * restorecond: Add /etc/udpatedb.conf to restorecond.conf - * genhomedircon generation to allow spec file to pass in SEMODULE_PATH - * fixfiles: relabel only after specific date - * po: update translations - * sandbox: seunshare: do not reassign realloc value - * seunshare: do checking on setfsuid - * sestatus: rewrite to shut up coverity - -* Thu Jan 31 2013 Dan Walsh - 2.1.12-58 -- Reorginize sepolicy so all get_all functions are in main module -- Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot. - -* Fri Jan 25 2013 Dan Walsh - 2.1.12-57 -- Update to latest patches from eparis/Upstream -- fixfiles onboot will write any flags handed to it to /.autorelabel. -- * Patch sent to initscripts to have fedora-autorelabel pass flags back to fixfiles restore -- * This should allow fixfiles -F onboot, to force a hard relabel. -- Add -p to show progress on full relabel. - -* Tue Jan 15 2013 Dan Walsh - 2.1.12-56 -- Additional changes for bash completsion and generate man page to match the w -- Add newtype as a new qualifier to sepolicy generate. This new mechanism wil -- a policy write to generate types after the initial policy has been written a -- will autogenerate all of the interfaces. -- I also added a -w options to allow policy writers from the command line to s -- the writable directories of files. -- -- Modify network.py to include interface definitions for newly created port type -- Standardize of te_types just like all of the other templates. - -- Change permissive domains creation to raise exception if sepolgen is not ins -- get_te_results no longer needs or uses the opts parameter. -- The compliler was complaining so I just removed the option. -- Start returning analysis data for audit2allow - -* Tue Jan 15 2013 Dan Walsh - 2.1.12-55 -- Update Translations -- Fix handling of semanage generate --cgi -n MODULE PATHTO/CGI -- This fixes the spec file and script file getting wrong names for modules and types. - -* Wed Jan 9 2013 Dan Walsh - 2.1.12-54 -- Additional patch from Miroslav to handle role attributes - -* Wed Jan 9 2013 Dan Walsh - 2.1.12-53 -- Update with Miroslav patch to handle role attributes -- Update Translations -- import sepolicy will only throw exception on missing policy iff selinux is enabled - -* Sat Jan 5 2013 Dan Walsh - 2.1.12-52 -- Update to latest patches from eparis/Upstream -- secon: add support for setrans color information in prompt output -- Update translations - -* Fri Jan 4 2013 Dan Walsh - 2.1.12-51 -- Update translations -- Fix sepolicy booleans to handle autogenerated booleans descriptions -- Cleanups of sepolicy manpage -- Fix crash on git_shell man page generation - -* Thu Jan 3 2013 Dan Walsh - 2.1.12-50 -- Update translations -- update sepolicy manpage to generate fcontext equivalence data and to list -default file context paths. -- Add ability to generate policy for confined admins and domains like puppet. - -* Thu Dec 20 2012 Dan Walsh - 2.1.12-49 -- Fix semanage permissive , this time with the patch. -- Update translations - -* Wed Dec 19 2012 Dan Walsh - 2.1.12-48 -- Fix semanage permissive -- Change to use correct gtk forward button -- Update po - -* Mon Dec 17 2012 Dan Walsh - 2.1.12-47 -- Move audit2why to -devel package - -* Mon Dec 17 2012 Dan Walsh - 2.1.12-46 -- sepolicy transition was blowing up. Also cleanup output when only source is specified. -- sepolicy generate should allow policy modules names that include - or _ - -* Mon Dec 10 2012 Dan Walsh - 2.1.12-45 -- Apply patch from Miroslav to display proper range description in man pages g -- Should print warning on missing default label when run in recusive mode iff -- Remove extra -R description, and fix recursive description - -* Thu Dec 6 2012 Dan Walsh - 2.1.12-44 -- Additional fixes for disabled SELinux Box -- system-config-selinux no longer relies on lokkit for /etc/selinux/config - -* Thu Dec 6 2012 Dan Walsh - 2.1.12-43 -- sepolicy should failover to installed policy file on a disabled SELinux box, if it exists. - -* Wed Dec 5 2012 Dan Walsh - 2.1.12-42 -- Update Translations -- sepolicy network -d needs to accept multiple domains - -* Fri Nov 30 2012 Dan Walsh - 2.1.12-41 -- Add --path as a parameter to sepolicy generate -- Print warning message if program does not exists when generating policy, and do not attempt to run nm command -- Fix sepolicy generate -T to not take an argument, and supress the help message -- Since this is really just a testing tool - -* Fri Nov 30 2012 Dan Walsh - 2.1.12-40 -- Fix sepolicy communicate to handle invalid input - -* Thu Nov 29 2012 Dan Walsh - 2.1.12-39 -- Fix sepolicy network -p to handle high ports - -* Thu Nov 29 2012 Dan Walsh - 2.1.12-38 -- Fix handling of manpages without entrypoints, nsswitch domains -- Update Translations - -* Wed Nov 28 2012 Dan Walsh - 2.1.12-37 -- Move sepogen python bindings back into policycoreutils-python out of -devel, since sepolicy is using the - -* Tue Nov 27 2012 Dan Walsh - 2.1.12-36 -- Fix sepolicy/__init__.py to handle _() - -* Wed Nov 21 2012 Dan Walsh - 2.1.12-35 -- Add Miroslav Grepl patch to create etc_rw_t sock files policy - -* Fri Nov 16 2012 Dan Walsh - 2.1.12-34 -- Fix semanage to work without policycoreutils-devel installed -- Update translations - -* Tue Nov 13 2012 Dan Walsh - 2.1.12-33 -- Fix semanage login -l to list contents of /etc/selinux/POLICY/logins directory - -* Tue Nov 13 2012 Dan Walsh - 2.1.12-32 -- Fix booleansPage not showing booleans -- Fix audit2allow -b - -* Tue Nov 13 2012 Dan Walsh - 2.1.12-31 -- Fix sepolicy booleans again -- Fix man page - -* Mon Nov 12 2012 Dan Walsh - 2.1.12-30 -- Move policy generation tools into policycoreutils-devel - -* Mon Nov 12 2012 Dan Walsh - 2.1.12-29 -- Document and fix sepolicy booleans -- Update Translations -- Fix several spelling mistakes - -* Wed Nov 7 2012 Dan Walsh - 2.1.12-27 -- Only report restorecon warning for missing default label, if not running -recusively -- Update translations - -* Mon Nov 5 2012 Dan Walsh - 2.1.12-26 -- Fix semanage booleans -l, move more boolean_dict handling into sepolicy -- Update translations -- Fixup sepolicy generate to discover /var/log, /var/run and /var/lib directories if they match the name -- Fix kill function call should indicate signal_perms not kill capability -- Error out cleanly in system-config-selinux, if it can not contact XServer - -* Mon Nov 5 2012 Dan Walsh - 2.1.12-25 -- Remove run_init, no longer needed with systemd. -- Fix sepolicy generate to not include subdirs in generated fcontext file. (mgrepl patch) - -* Sat Nov 3 2012 Dan Walsh - 2.1.12-24 -- Fix manpage to generate proper man pages for alternate policy, -basically allow me to build RHEL6 man pages on a Fedora 18 box, as long as -I pull the policy, policy.xml and file_contexts and file_contexts.homedir - -* Thu Nov 1 2012 Dan Walsh - 2.1.12-23 -- Fix some build problems in sepolicy manpage and sepolicy transition - -* Tue Oct 30 2012 Dan Walsh - 2.1.12-22 -- Add alias man pages to sepolicy manpage - -* Mon Oct 29 2012 Dan Walsh - 2.1.12-21 -- Redesign sepolicy to only read the policy file once, not for every call - -* Mon Oct 29 2012 Dan Walsh - 2.1.12-20 -- Fixes to sepolicy transition, allow it to list all transitions from a domain - -* Sat Oct 27 2012 Dan Walsh - 2.1.12-19 -- Change sepolicy python bindings to have python pick policy file, fixes weird memory problems in sepolicy network - -* Fri Oct 26 2012 Dan Walsh - 2.1.12-18 -- Allow sepolicy to specify the policy to generate content from - -* Thu Oct 25 2012 Dan Walsh - 2.1.12-17 -- Fix semanage boolean -F to handle boolean subs - -* Thu Oct 25 2012 Dan Walsh - 2.1.12-16 -- Add Miroslav Grepl patch to generate html man pages -- Update Translations -- Add option to sandbox to shred files before deleting - -* Mon Oct 22 2012 Dan Walsh - 2.1.12-15 -- Add Requires(post) PKGNAME to sepolicy generate /usr/bin/pkg - -* Fri Oct 19 2012 Dan Walsh - 2.1.12-14 -- Add role_allow to sepolicy.search python bindings, this allows us to remove last requirement for setools-cmdline in gui tools. -- Fix man page generator. - -* Wed Oct 17 2012 Dan Walsh - 2.1.12-13 -- Remove dwalsh@redhat.com from man pages -- Fix spec file for sepolicy generate - -* Wed Oct 17 2012 Dan Walsh - 2.1.12-12 -- Add missing spec.py from templates directory needed for sepolicy generate -- Add /var/tmp as collection point for sandbox apps. - -* Tue Oct 16 2012 Dan Walsh - 2.1.12-11 -- Handle audit2allow -b in foreign locales - -* Tue Oct 16 2012 Dan Walsh - 2.1.12-10 -- Update sepolicy generate with patch to create spec file and man page. -- Patch initiated by Miroslav Grepl - -* Wed Oct 10 2012 Dan Walsh - 2.1.12-9 -- Fix semanage to verify that types are appropriate for commands. - * Patch initiated by mgrepl - * Fixes problem of specifying non file_types for fcontext, or not port_types for semanage port - -* Tue Oct 9 2012 Dan Walsh - 2.1.12-8 -- Fix typo in preunstall line for restorecond -- Add mgrepl patch to consolidate file context generated by sepolicy generate - -* Mon Oct 8 2012 Dan Walsh - 2.1.12-7 -- Fix manpage generation, missing import -- Add equiv_dict to get samba booleans into smbd_selinux -- Add proper translations for booleans and remove selinux.tbl - -* Sat Oct 6 2012 Dan Walsh - 2.1.12-6 -- Fix system-config-selinux to use sepolicy.generate instead of sepolgen - -* Thu Oct 4 2012 Dan Walsh - 2.1.12-5 -- Add sepolicy commands, and change tools to use them. - -* Tue Sep 25 2012 Dan Walsh - 2.1.12-4 -- Rebuild without bogus prebuild 64 bit seunshare app - -* Sun Sep 16 2012 Dan Walsh - 2.1.12-3 -- Allow fixfiles to specify -v, so they can get verbosity rather then progress. -- Fix load_file Makefile to use SBINDIR rather then real OS. -- Fix man pages in setfiles and restorecon to reflect what happens when you relabel the entire OS. - -* Sun Sep 16 2012 Dan Walsh - 2.1.12-2 -- Use systemd post install scriptlets - -* Thu Sep 13 2012 Dan Walsh - 2.1.12-1 -- Update to upstream - * genhomedircon: manual page improvements - * setfiles/restorecon minor improvements - * run_init: If open_init_pty is not available then just use exec - * newrole: do not drop capabilities when newrole is run as - * restorecon: only update type by default - * scripts: Don't syslog setfiles changes on a fixfiles restore - * setfiles: do not syslog if no changes - * Disable user restorecond by default - * Make restorecon return 0 when a file has changed context - * setfiles: Fix process_glob error handling - * semanage: allow enable/disable under -m - * add .tx to gitignore - * translations: commit translations from Fedora community - * po: silence build process - * gui: Checking in policy to support polgengui and sepolgen. - * gui: polgen: search for systemd subpackage when generating policy - * gui: for exploring booleans - * gui: system-config-selinux gui - * Add Makefiles to support new gui code - * gui: remove lockdown wizard - * return equivalency records in fcontext customized - * semanage: option to not load new policy into kernel after - * sandbox: manpage update to describe standard types - * setsebool: -N should not reload policy on changes - * semodule: Add -N qualifier to no reload kernel policy - * gui: polgen: sort selinux types of user controls - * gui: polgen: follow symlinks and get the real path to - * gui: Fix missing error function - * setfiles: return errors when bad paths are given - * fixfiles: tell restorecon to ignore missing paths - * setsebool: error when setting multiple options - * semanage: use boolean subs. - * sandbox: Make sure Xephyr never listens on tcp ports - * sepolgen: return and output constraint violation information - * semanage: skip comments while reading external configuration files - * restorecond: relabel all mount runtime files in the restorecond example - * genhomedircon: dynamically create genhomedircon - * Allow returning of bastard matches - * sepolgen: return and output constraint violation information - * audit2allow: one role/type pair per line - -* Wed Aug 8 2012 Dan Walsh - 2.1.11-6 -- Change polgen to generate dbus apps as optional so they can compile on minimal policy system, patch from Miroslav Grepl - -* Fri Jul 27 2012 Dan Walsh - 2.1.11-5 -- Fix sepolgen/audit2allow to handle multiple role/types in avc messages properly - -* Thu Jul 19 2012 Dan Walsh - 2.1.11-4 -- Fix restorecon to generate a better percentage of completion on restorecon -R /. -- Have audit2allow look at the constaint violation and tell the user whether it -- is because of user,role or level - - -* Wed Jul 11 2012 Dan Walsh - 2.1.11-3 -- userapps is generating sandbox code in polgengui - -* Thu Jul 5 2012 Dan Walsh - 2.1.11-2 -- Remove load_policy symbolic link on usrmove systems this breaks the system - -* Wed Jul 4 2012 Dan Walsh - 2.1.11-1 -- Update to upstream - - policycoreutils - * restorecond: wrong options should exit with non-zero error code - * restorecond: Add -h option to get usage command - * resorecond: user: fix fd leak - * mcstrans: add -f to run in foreground - * semanage: fix man page range and level defaults - * semanage: bash completion for modules should include -a,-m, -d - * semanage: manpage update for -e - * semanage: dontaudit off should work - * semanage: locallist option does not take an argument - * sepolgen: Make use of setools optional within sepolgen - - sepolgen - * Make use of setools optional within sepolgen - * We need to support files that have a + in them - -* Thu May 24 2012 Dan Walsh - 2.1.11-18 -- Make restorecon exit with an error on a bad path - -* Thu May 24 2012 Dan Walsh - 2.1.11-17 -- Fix setsebool command, handling of = broken. -- Add missing error option in booleansPage - -* Sun May 20 2012 Dan Walsh - 2.1.11-16 -- Fix sepolgen to use realpath on executables handed to it. - Brian Bickford - -* Fri May 18 2012 Dan Walsh - 2.1.11-15 -- Allow stream sock_files to be stored in /tmp and etc_rw_t directories by sepolgen -- Trigger on selinux-policy needs to change to selinux-policy-devel -- Update translations -- Fix semanage dontaudit off/on exception - -* Tue May 8 2012 Dan Walsh - 2.1.11-12 -- Add -N qualifier to semanage, setsebool and semodule to allow you to update -- policy without reloading it into the kernel. - -* Thu May 3 2012 Dan Walsh - 2.1.11-11 -- add some definition to the standard types available for sandboxes - -* Tue May 1 2012 Dan Walsh - 2.1.11-10 -- Remove lockdown wizard - -* Mon Apr 30 2012 Dan Walsh - 2.1.11-9 -- Fix semanage fcontext -E to extract the equivalance customizations. - -* Thu Apr 26 2012 Dan Walsh - 2.1.11-8 -- Add mgrepl patch to have sepolgen search for -systemd rpm packages - -* Tue Apr 24 2012 Dan Walsh - 2.1.11-7 -- Apply Stef Walter patch for semanage man page - -* Mon Apr 23 2012 Dan Walsh - 2.1.11-6 -- Rebuild to get latest libsepol which fixes the file_name transition problems -- Update translations -- Fix calls to close fd for restorecond - -* Fri Apr 13 2012 Dan Walsh - 2.1.11-5 -- Update translations -- Fix sepolgen to discover unit files in /lib/systemd/ - -* Tue Apr 3 2012 Dan Walsh - 2.1.11-4 -- Update translations -- Fix segfault on restorecon - -* Tue Apr 3 2012 Dan Walsh - 2.1.11-3 -- Allow filename transitions to use + in a file name - -* Fri Mar 30 2012 Dan Walsh - 2.1.11-2 -- Change policycoreutils-python to require selinux-policy-devel package - -* Thu Mar 29 2012 Dan Walsh - 2.1.11-1 -- Update to upstream - - policycoreutils - * sandbox: do not propogate inside mounts outside - * sandbox: Removing sandbox init script, should no longer be necessary - * restorecond: Stop using deprecated interfaces for g_io - * semanage: proper auditting of user changes for LSPP - * semanage: audit message to show what record(s) and item(s) have chaged - * scripts: Update Makefiles to handle /usrmove - * mcstrans: Version should have been bumped on last check in - * seunshare: Only drop caps not the Bounding Set from seunshare - * Add bash-completion scripts for setsebool and semanage - * newrole: Use correct capng calls in newrole - * Fix infinite loop with inotify on 2.6.31 kernels - * fix ftbfs with hardening flags - * Only run setfiles if we found read-write filesystems to run it on - * update .po files - * remove empty po files - * do not fail to install if unable to make load_policy lnk file - - - sepolgen - * Fix dead links to www.nsa.gov/selinux - * audit.py Dont crash if empty data is passed to sepolgen - * do not use md5 when calculating hash signatures - * fix detection of policy loads - -* Wed Mar 28 2012 Dan Walsh - 2.1.10-30 -- Have sepolgen script specify the pp file with the make command. From mgrepl. - -* Wed Mar 21 2012 Dan Walsh - 2.1.10-29 -- Fix sepolgen handling of unit files. - -* Thu Mar 8 2012 Dan Walsh - 2.1.10-28 -- Require selinux-policy-doc - -* Thu Mar 8 2012 Dan Walsh - 2.1.10-27 -- Fix unit file handling in sepolgen - -* Wed Feb 29 2012 Dan Walsh - 2.1.10-26 -- Add bash_command completion for setsebool/getsebool - -* Mon Feb 27 2012 Dan Walsh - 2.1.10-25 -- Disable restorecond on desktop by default -- Change seunshare to not modify the bounding set - -* Mon Feb 20 2012 Dan Walsh - 2.1.10-24 -- Stop using sandbox init in post install since it no longer exists. - -* Thu Feb 16 2012 Dan Walsh - 2.1.10-23 -- Change to use new selinux_current_policy_path() - -* Wed Feb 15 2012 Dan Walsh - 2.1.10-22 -- Change to use new selinux_binary_policy_path() -- Add systemd_passwd_agent_exec($1), and systemd_read_fifo_file_passwd_run($1) to templates for _admin interface - -* Fri Feb 3 2012 Dan Walsh - 2.1.10-21 -- On full relabels we will now show a estimated percent complete rather then -just *s. - -* Wed Feb 1 2012 Dan Walsh - 2.1.10-20 -- Add unit_file.py for sepolgen - -* Tue Jan 31 2012 Dan Walsh - 2.1.10-19 -- Change sepolgen to use sha256 instead of md5 - -* Mon Jan 30 2012 Dan Walsh - 2.1.10-18 -- Stop syslogging on full restore -- Stop syslogging when restorecon is not changing values - -* Fri Jan 27 2012 Dan Walsh - 2.1.10-17 -- Change semanage to produce proper audit records for Common Criteria -- Cleanup packaging for usrmove - -* Thu Jan 26 2012 Harald Hoyer 2.1.10-16 -- fixed load_policy location - -* Thu Jan 26 2012 Harald Hoyer 2.1.10-15 -- fixed load_policy location - -* Thu Jan 26 2012 Harald Hoyer 2.1.10-14 -- fixed load_policy location - -* Wed Jan 25 2012 Harald Hoyer 2.1.10-13 -- add filesystem guard - -* Wed Jan 25 2012 Harald Hoyer 2.1.10-12 -- install everything in /usr - https://fedoraproject.org/wiki/Features/UsrMove - -* Tue Jan 24 2012 Dan Walsh - 2.1.10-11 -- restorecond fixes: - Stop using depracated g_io interfaces - Exit with non zero exit code if wrong options given - Add -h option - -* Thu Jan 19 2012 Dan Walsh - 2.1.10-10 -- Eliminate not needed Requires - -* Wed Jan 18 2012 Dan Walsh - 2.1.10-9 -- fix sepolgen to not crash on echo "" | audit2allow - -* Mon Jan 16 2012 Dan Walsh - 2.1.10-8 -- Remove sandbox init script, should no longer be necessary - -* Sun Jan 15 2012 Dan Walsh - 2.1.10-7 -- Add unit file support to sepolgen, and cleanup some of the output. - -* Mon Jan 9 2012 Dan Walsh - 2.1.10-5 -- Fix English in templates for sepolgen - -* Fri Dec 23 2011 Dan Walsh - 2.1.10-4 -- Fix the handling of namespaces in seunshare/sandbox. -- Currently mounting of directories within sandbox is propogating to the -- parent namesspace. - -* Thu Dec 22 2011 Dan Walsh - 2.1.10-3 -- Add umount code to seunshare to cleanup left over mounts of /var/tmp - -* Wed Dec 21 2011 Dan Walsh - 2.1.10-2 -- Remove open_init_pty - -* Wed Dec 21 2011 Dan Walsh - 2.1.10-1 --Update to upstream -- sepolgen - * better analysis of why things broke -- policycoreutils - * Remove excess whitespace - * sandbox: Add back in . functions to sandbox.init script - * Fix Makefile to match other policycoreutils Makefiles - * semanage: drop unused translation getopt - -* Thu Dec 15 2011 Dan Walsh - 2.1.9-3 -- Bump libsepol version requires rebuild - -* Wed Dec 7 2011 Dan Walsh - 2.1.9-2 -- Add back accidently dropped patches for semanage - -* Tue Dec 6 2011 Dan Walsh - 2.1.9-1 -- Upgrade to upstream - * sandbox: move sandbox.conf.5 to just sandbox.5 - * po: Makefile use -p to preserve times to allow multilib simultatious installs - * of po files - * sandbox: Allow user to specify the DPI value for X in a sandbox - * sandbox: make sure the domain launching sandbox has at least 100 categories - * sandbox: do not try forever to find available category set - * sandbox: only complain if sandbox unable to launch - * sandbox: init script run twice is still successful - * semanage: print local and dristo equiv rules - * semanage: check file equivalence rules for conflict - * semanage: Make sure semanage fcontext -l -C prints even if local keys - * are not defined - * semanage: change src,dst to target,substitute for equivalency - * sestatus: Updated sestatus and man pages. - * Added SELinux config file man page. - * add clean target to man Makefile - -* Wed Nov 30 2011 Dan Walsh - 2.1.8-8 -- Fix semange fcontext -a to check for more conflicts on equivalency - -* Tue Nov 29 2011 Dan Walsh - 2.1.8-7 -- Fix dpi handling in sandbox -- Make sure semanage fcontext -l -C prints if only local equiv have changed - -* Wed Nov 16 2011 Dan Walsh - 2.1.8-6 -- Add listing of distribution equivalence class from semanage fcontext -l -- Add checking to semanage fcontext -a to guarantee a file specification will not be masked by an equivalence - -* Wed Nov 16 2011 Dan Walsh - 2.1.8-5 -- Allow ~ as a valid part of a filename in sepolgen - -* Fri Nov 11 2011 Dan Walsh - 2.1.8-4 -- sandbox init script should always return 0 -- sandbox command needs to check range of categories and report error if not big enough - -* Mon Nov 7 2011 Dan Walsh - 2.1.8-3 -- Allow user to specify DPI when running sandbox - -* Mon Nov 7 2011 Dan Walsh - 2.1.8-2 -- Add Miroslav patch to return all attributes - -* Fri Nov 4 2011 Dan Walsh - 2.1.8-1 -- Upgrade to policycoreutils upstream - * sandbox: Maintain the LANG environment into the sandbox - * audit2allow: use audit2why internally - * fixfiles: label /root but not /var/lib/BackupPC - * semanage: update local boolean settings is dealing with localstore - * semanage: missing modify=True - * semanage: set modified correctly - * restorecond: make restorecond dbuss-able - * restorecon: Always check return code on asprintf - * restorecond: make restorecond -u exit when terminal closes - * sandbox: introduce package name and language stuff - * semodule_package: remove semodule_unpackage on clean - * fix sandbox Makefile to support DESTDIR - * semanage: Add -o description to the semanage man page - * make use of the new realpath_not_final function - * setfiles: close /proc/mounts file when finished - * semodule: Document semodule -p in man page - * setfiles: fix use before initialized - * restorecond: Add .local/share as a directory to watch -- Upgrade to sepolgen upstream - * Ignore permissive qualifier if found in an interface - * Return name field in avc data - -* Mon Oct 31 2011 Dan Walsh - 2.1.7-6 -- Rebuild versus newer libsepol - -* Fri Oct 28 2011 Dan Walsh - 2.1.7-5 -- A couple of minor coverity fixes for a potential leaked file descriptor -- An an unchecked return code. -- Add ~/.local/share/* to restorecond_user watches - -* Thu Oct 13 2011 Dan Walsh - 2.1.7-4 -- Have sepolgen return name field in AVC - -* Thu Oct 6 2011 Dan Walsh - 2.1.7-3 -- restorecond -u needs to watch terminal for exit if run outside of dbus. - -* Tue Oct 4 2011 Dan Walsh - 2.1.7-2 -- Do not drop capabilities if running newrole as root - -* Fri Sep 30 2011 Dan Walsh - 2.1.7-1 --Update to upstream - * semanage: fix indentation error in seobject - -* Thu Sep 29 2011 Dan Walsh - 2.1.6-3 -- Ignore permissive commands in interfaces - -* Thu Sep 29 2011 Dan Walsh - 2.1.6-2 -- Remove gnome requirement from polgengui - -* Mon Sep 19 2011 Dan Walsh - 2.1.6-1 --Update to upstream - policycoreutils-2.1.6 - * sepolgen-ifgen: new attr-helper does something - * audit2allow: use alternate policy file - * audit2allow: sepolgen-ifgen use the attr helper - * setfiles: switch from stat to stat64 - * setfiles: Fix potential crash using dereferenced ftsent - * setfiles: do not wrap * output at 80 characters - * sandbox: add -Wall and -Werror to makefile - * sandbox: add sandbox cgroup support - * sandbox: rewrite /tmp handling - * sandbox: do not bind mount so much - * sandbox: add level based kill option - * sandbox: cntrl-c should kill entire process control group - * Create a new preserve_tunables flag in sepol_handle_t. - * semanage: show running and disk setting for booleans - * semanage: Dont print heading if no items selected - * sepolgen: audit2allow is mistakakenly not allowing valid module names - * semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled - * More files to ignore - * tree: default make target to all not install - * sandbox: do not load unused generic init functions - sepolgen-1.1.2 - * src: sepolgen: add attribute storing infrastructure - * Change perm-map and add open to try to get better results on - * look for booleans that might solve problems - * sepolgen: audit2allow is mistakakenly not allowing valid module names - * tree: default make target to all not install - -* Wed Sep 14 2011 Dan Walsh - 2.1.5-6 -- Change separator on -L from ; to : - -* Thu Sep 8 2011 Dan Walsh - 2.1.5-5 -- Add back lockdown wizard for booleans using pywebkitgtk - -* Wed Sep 7 2011 Dan Walsh - 2.1.5-4 -- Maintain the LANG environment Variable into the sandbox -- Change restorecon/setfiles to only change type part of the context unless - -f qualifier is given - -* Tue Sep 6 2011 Dan Walsh - 2.1.5-3 -- Remove lockdown wizard, since gtkhtml2 is no longer supported. - -* Fri Sep 2 2011 Dan Walsh - 2.1.5-2 -- Allow setfiles and restorecon to use labeledprefix to speed up processing -and limit memory. - -* Tue Aug 30 2011 Dan Walsh - 2.1.5-1 --Update to upstream - * policycoreutils - * setfiles: Fix process_glob to handle error situations - * sandbox: Allow seunshare to run as root - * sandbox: trap sigterm to make sure sandbox - * sandbox: pass DPI from the desktop - * sandbox: seunshare: introduce helper spawn_command - * sandbox: seunshare: introduce new filesystem helpers - * sandbox: add -C option to not drop - * sandbox: split seunshare caps dropping - * sandbox: use dbus-launch - * sandbox: numerous simple updates to sandbox - * sandbox: do not require selinux context - * sandbox: Makefile: new man pages - * sandbox: rename dir to srcdir - * sandbox: allow users specify sandbox window size - * sandbox: check for paths up front - * sandbox: use defined values for paths rather - * sandbox: move seunshare globals to the top - * sandbox: whitespace fix - * semodule_package: Add semodule_unpackage executable - * setfiles: get rid of some stupid globals - * setfiles: move exclude_non_seclabel_mounts to a generic location - * sepolgen - * refparser: include open among valid permissions - * refparser: add support for filename_trans rules - -* Thu Aug 18 2011 Dan Walsh - 2.1.4-2 -- Fix bug in glob handling for restorecon - -* Thu Aug 18 2011 Dan Walsh - 2.1.4-1 --Update to upstream -2.1.4 2011-08-17 - * run_init: clarification of the usage in the - * semanage: fix usage header around booleans - * semanage: remove useless empty lines - * semanage: update man page with new examples - * semanage: update usage text - * semanage: introduce file context equivalencies - * semanage: enable and disable modules - * semanage: output all local modifications - * semanage: introduce extraction of local configuration - * semanage: cleanup error on invalid operation - * semanage: handle being called with no arguments - * semanage: return sooner to save CPU time - * semanage: surround getopt with try/except - * semanage: use define/raise instead of lots of - * semanage: some options are only valid for - * semanage: introduce better deleteall support - * semanage: do not allow spaces in file - * semanage: distinguish between builtin and local permissive - * semanage: centralized ip node handling - * setfiles: make the restore function exclude() non-static - * setfiles: use glob to handle ~ and - * fixfiles: do not hard code types - * fixfiles: stop trying to be smart about - * fixfiles: use new kernel seclabel option - * fixfiles: pipe everything to cat before sending - * fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs - * semodule: support for alternative root paths - -2.1.3 2011-08-03 - * semanage: fix indention - * semodule_package: fix man page typo - * semodule_expand: update man page with -a - * semanage: handle os errors - * semanage: fix traceback with bad options - * semanage: show usage on -h or --help - * semanage: introduce more deleteall options - * semanage: verify ports < 65536 - * transaction into semanageRecords - * make get_handle a method of semanageRecords - * remove a needless blank line - * make process_one error if not initialized correctly - * fixfiles: correct usage for r_opts.rootpath - * put -p in help for restorecon and - * fixfiles: do not try to only label - * fixfiles clean up /var/run and /var/lib/debug - * fixfiles delete tmp sockets and pipes rather - * fixfile use find -delete instead of pipe - * chcat man page typo - * add man page for genhomedircon - * setfiles fix typo - * setsebool should inform users they need to - * setsebool typos - * open_init_tty man page typos - * Don't add user site directory to sys.path - * newrole retain CAP_SETPCAP - -2.1.2 2011-08-02 - * seunshare: define _GNU_SOURCE earlier - * make ignore_enoent do something - * restorecond: first user logged in is not noticed - * Repo: update .gitignore - -2.1.1 2011-08-01 - * Man page updates - * restorecon fix for bad inotify assumptions - -2.1.0 2011-07-27 - * Release, minor version bump - -* Tue Jul 26 2011 Dan Walsh 2.0.86-20 -- Fix sepolgen usage statement -- Stop using -k insandbox -- Fix seunshare usage statement - -* Thu Jul 7 2011 Dan Walsh 2.0.86-18 -- Change seunshare to send kill signals to the childs session. -- Also add signal handler to catch sigint, so if user enters ctrl-C sandbox will shutdown. - -* Wed Jul 6 2011 Dan Walsh 2.0.86-17 -- Add -k qualifier to seunshare to have it attempt to kill all processes with -the matching MCS label. - -* Tue Jul 5 2011 Dan Walsh 2.0.86-16 -- Add -C option to sandbox and seunshare to maintain capabilities, otherwise -the bounding set will be dropped. -- Change --cgroups short name -c rather then -C for consistancy -- Fix memory and fd leaks in seunshare - -* Wed Jun 29 2011 Jóhann B. Guðmundsson - 2.0.86-15 -- Introduce systemd unit file for restorecond drop SysV support - -* Mon Jun 13 2011 Dan Walsh 2.0.86-14 -- Do not drop capability bounding set in seunshare, this allows sandbox to -- run setuid apps. - -* Fri Jun 10 2011 Dan Walsh 2.0.86-13 -- Add semanage-bash-completion.sh script - -* Tue Jun 7 2011 Dan Walsh 2.0.86-12 -- Remove mount -o bind calls from sandbox init script -- pam_namespace now has this built in. - -* Tue Jun 7 2011 Dan Walsh 2.0.86-11 -- Pass desktop dpi to sandbox Xephyr window - -* Mon Jun 6 2011 Dan Walsh 2.0.86-10 -- Allow semodule to pick alternate root for selinux files -- Add ~/.config/* to restorcond_user.conf, so restorecond will watch for mislabeled files in this directory. - -* Wed May 25 2011 Dan Walsh 2.0.86-9 -- Fix var_spool template read_spool_files -- Fix sepolgen to handle filename transitions - -* Mon May 23 2011 Dan Walsh 2.0.86-8 -- Templates cleanedup by Dominic Grift - -* Fri Apr 29 2011 Dan Walsh 2.0.86-7 -- Clean up some of the templates for sepolgen - -* Fri Apr 22 2011 Dan Walsh 2.0.86-6 -- Apply patches from Christoph A. - * fix sandbox title - * stop xephyr from li -- Also ignore errors on sandbox include of directory missing files - -* Thu Apr 21 2011 Dan Walsh 2.0.86-5 -- rebuild versus latest libsepol - -* Mon Apr 18 2011 Dan Walsh 2.0.86-4 -- Change fixfiles restore to delete unlabeled sockets in /tmp - -* Mon Apr 18 2011 Dan Walsh 2.0.86-2 -- rebuild versus latest libsepol - -* Tue Apr 12 2011 Dan Walsh 2.0.86-1 -- Update to upstream - * Use correct color range in mcstrand by Richard Haines. - -* Mon Apr 11 2011 Dan Walsh 2.0.85-30 -- Add Elia Pinto patches to allow user to specify directories to ignore - -* Tue Apr 5 2011 Dan Walsh 2.0.85-29 -- Fix policycoreutils-sandbox description - -* Tue Mar 29 2011 Dan Walsh 2.0.85-28 -- rsynccmd should run outside of execcon - -* Thu Mar 24 2011 Dan Walsh 2.0.85-27 -- Fix semange node handling of ipv6 addresses - -* Wed Mar 23 2011 Dan Walsh 2.0.85-26 -- Fix sepolgen-ifgen call, add -p option - -* Wed Mar 23 2011 Dan Walsh 2.0.85-25 -- Fix sepolgen-ifgen call - -* Fri Mar 18 2011 Dan Walsh 2.0.85-24 -- Fix rsync command to work if the directory is old. -- Fix all tests - -* Wed Mar 16 2011 Dan Walsh 2.0.85-23 -- Fix sepolgen to generate network polcy using generic_if and genric_node versus all_if and all_node - -* Wed Mar 16 2011 Dan Walsh 2.0.85-22 -- Return to original seunshare man page - -* Fri Mar 11 2011 Dan Walsh 2.0.85-21 -- change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_* -- This will allow default sandboxes to work on NFS homedirs without allowing - access to homedir data - -* Fri Mar 11 2011 Dan Walsh 2.0.85-20 -- Change sepolgen-ifgen to search all available policy files -- Exit in restorecond if it can not find a UID in the passwd database - -* Wed Mar 9 2011 Dan Walsh 2.0.85-19 -- Fix portspage in system-config-selinux to not crash -- More fixes for seunshare from Tomas Hoger - -* Tue Mar 8 2011 Dan Walsh 2.0.85-18 -- put back in old handling of -T in sandbox command -- Put back setsid in seunshare -- Fix rsync to maintain times - -* Tue Mar 8 2011 Dan Walsh 2.0.85-17 -- Use rewritten seunshare from thoger - -* Mon Mar 7 2011 Dan Walsh 2.0.85-16 -- Require python-IPy for policycoreutils-python package -- Fixes for sepologen - - Usage statement needs -n name - - Names with _ are being prevented - - dbus apps should get _chat interface - -* Thu Mar 3 2011 Dan Walsh 2.0.85-15 -- Fix error message in seunshare, check for tmpdir existance before unlink. - -* Fri Feb 25 2011 Dan Walsh 2.0.85-13 -- Rewrite seunshare to make sure /tmp is mounted stickybit owned by root -- Only allow names in polgengui that contain letters and numbers -- Fix up node handling in semanage command -- Update translations - -* Wed Feb 09 2011 Fedora Release Engineering - 2.0.85-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Thu Feb 3 2011 Dan Walsh 2.0.85-11 -- Fix sandbox policy creation with udp connect ports - -* Thu Feb 3 2011 Dan Walsh 2.0.85-10 -- Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name -- Cleanup chcat man page - -* Wed Feb 2 2011 Dan Walsh 2.0.85-9 -- Report full errors on OSError on Sandbox - -* Fri Jan 21 2011 Dan Walsh 2.0.85-8 -- Fix newrole hanlding of pcap - -* Wed Jan 19 2011 Dan Walsh 2.0.85-7 -- Have restorecond watch more directories in homedir - -* Fri Jan 14 2011 Dan Walsh 2.0.85-6 -- Add sandbox to sepolgen - -* Thu Jan 6 2011 Dan Walsh 2.0.85-4 -- Fix proper handling of getopt errors -- Do not allow modules names to contain spaces - -* Wed Jan 5 2011 Dan Walsh 2.0.85-3 -- Polgengui raises the wrong type of exception. #471078 -- Change semanage to not allow it to semanage module -D -- Change setsebool to suggest run as root on failure - -* Wed Dec 22 2010 Dan Walsh 2.0.85-2 -- Fix restorecond watching utmp file for people logging in our out - -* Tue Dec 21 2010 Dan Walsh 2.0.85-1 -- Update to upstream - -* Thu Dec 16 2010 Dan Walsh 2.0.84-5 -- Change to allow sandbox to run on nfs homedirs, add start python script - -* Wed Dec 15 2010 Dan Walsh 2.0.84-4 -- Move seunshare to sandbox package - -* Mon Nov 29 2010 Dan Walsh 2.0.84-3 -- Fix sandbox to show correct types in usage statement - -* Mon Nov 29 2010 Dan Walsh 2.0.84-2 -- Stop fixfiles from complaining about missing dirs - -* Mon Nov 22 2010 Dan Walsh 2.0.84-1 -- Update to upstream -- List types available for sandbox in usage statement - -* Mon Nov 22 2010 Dan Walsh 2.0.83-37 -- Don't report error on load_policy when system is disabled. - -* Mon Nov 8 2010 Dan Walsh 2.0.83-36 -- Fix up problems pointed out by solar designer on dropping capabilities - -* Mon Nov 1 2010 Dan Walsh 2.0.83-35 -- Check if you have full privs and reset otherwise dont drop caps - -* Mon Nov 1 2010 Dan Walsh 2.0.83-34 -- Fix setools require line - -* Fri Oct 29 2010 Dan Walsh 2.0.83-33 -- Move /etc/pam.d/newrole in to polcicycoreutils-newrole -- Additional capability checking in sepolgen - -* Mon Oct 25 2010 Dan Walsh 2.0.83-32 -- Remove setuid flag and replace with file capabilities -- Fix sandbox handling of files with spaces in them - -* Wed Sep 29 2010 jkeating - 2.0.83-31 -- Rebuilt for gcc bug 634757 - -* Thu Sep 23 2010 Dan Walsh 2.0.83-30 -- Move restorecond into its own subpackage - -* Thu Sep 23 2010 Dan Walsh 2.0.83-29 -- Fix semanage man page - -* Mon Sep 13 2010 Dan Walsh 2.0.83-28 -- Add seremote, to allow the execution of command inside the sandbox from outside the sandbox. - -* Mon Sep 13 2010 Dan Walsh 2.0.83-27 -- Fix sandbox copyfile when copying a dir with a socket, print error - -* Fri Sep 10 2010 Dan Walsh 2.0.83-26 -- Stop polgengui from crashing if selinux policy is not installed - -* Thu Sep 9 2010 Dan Walsh 2.0.83-25 -- Fix bug preventing sandbox from using -l - -* Tue Sep 7 2010 Dan Walsh 2.0.83-24 -- Eliminate quotes fro desktop files - -* Mon Aug 30 2010 Dan Walsh 2.0.83-23 -- Add -w windowsize patch from Christoph A. - -* Mon Aug 30 2010 Dan Walsh 2.0.83-22 -- Update po - -* Wed Aug 25 2010 Dan Walsh 2.0.83-21 -- Update po - -* Tue Aug 24 2010 Dan Walsh 2.0.83-20 -- Tighten down seunshare to create /tmp dir with sticky bit and MS_NODEV | MS_NOSUID | MS_NOEXEC; -- Remove setsid on seunshare so ^c on sandbox will cause apps to exit -- Add dbus-launch --exit-with-session so all processes launched within the sandbox exit with the sandbox -- Clean up error handling so error will get sent back to sandbox tool - -* Mon Aug 23 2010 Dan Walsh 2.0.83-19 -- Fix translation handling in file context page of system-config-selinux - -* Fri Aug 13 2010 Dan Walsh 2.0.83-18 -- Fix sandbox error handling - -* Fri Aug 13 2010 Dan Walsh 2.0.83-17 -- Apply patch to restorecond from Chris Adams, which will cause restorecond -- to watch first user that logs in. - -* Thu Aug 12 2010 Dan Walsh 2.0.83-16 -- Add COPYING file to doc dir - -* Thu Aug 5 2010 Dan Walsh 2.0.83-15 -- Update po and translations -Resolves: #610473 - -* Thu Aug 5 2010 Dan Walsh 2.0.83-14 -- More fixes for polgen tools - -* Thu Aug 5 2010 Dan Walsh 2.0.83-13 -- Remove requirement to run selinux-polgen as root - -* Thu Aug 5 2010 Dan Walsh 2.0.83-12 -- Update po and translations -- Fix gui policy generation tools - -* Wed Aug 4 2010 Dan Walsh 2.0.83-11 -- Update po and translations - -* Sat Jul 31 2010 David Malcolm - 2.0.83-10 -- rebuild against python 2.7 - -* Wed Jul 28 2010 Dan Walsh 2.0.83-9 -- Update selinux-polgengui to sepolgen policy generation - -* Wed Jul 28 2010 Dan Walsh 2.0.83-8 -- Fix invalid free in seunshare and fix man page - -* Tue Jul 27 2010 Dan Walsh 2.0.83-7 -- Update translations - -* Mon Jul 26 2010 Dan Walsh 2.0.83-6 -- Fix sandbox man page - -* Wed Jul 21 2010 David Malcolm - 2.0.83-5 -- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild - -* Tue Jul 20 2010 Dan Walsh 2.0.83-4 -- Add translations for menus -- Fixup man page from Russell Coker - -* Tue Jun 15 2010 Dan Walsh 2.0.83-3 -- Change python scripts to use -s flag -- Update po - -* Tue Jun 15 2010 Dan Walsh 2.0.83-1 -- Update to upstream - * Add sandbox support from Dan Walsh with modifications from Steve Lawrence. - -* Tue Jun 15 2010 Dan Walsh 2.0.82-31 -- Fix sepolgen code generation -Resolve: #603001 - -* Tue Jun 8 2010 Dan Walsh 2.0.82-30 -- Add cgroup support for sandbox - -* Mon Jun 7 2010 Dan Walsh 2.0.82-29 -- Allow creation of /var/cache/DOMAIN from sepolgen - -* Thu Jun 3 2010 Dan Walsh 2.0.82-28 -- Fix sandbox init script -- Add dbus-launch to sandbox -X -Resolve: #599599 - -* Thu Jun 3 2010 Dan Walsh 2.0.82-27 -- Move genhomedircon.8 to same package as genhomedircon -- Fix sandbox to pass unit test -Resolves: #595796 - -* Wed Jun 2 2010 Dan Walsh 2.0.82-26 -- Fix listing of booleans from audit2allow - -* Wed Jun 2 2010 Dan Walsh 2.0.82-25 -- Fix audit2allow to output if the current policy has avc -- Update translations -- Fix icon - -* Thu May 27 2010 Dan Walsh 2.0.82-24 -- Man page fixes -- sandbox fixes -- Move seunshare to base package - -* Fri May 21 2010 Dan Walsh 2.0.82-23 -- Fix seunshare translations -- Fix seunshare to work on all arches -- Fix icon for system-config-selinux -Resolves: #595276 - -* Fri May 21 2010 Dan Walsh 2.0.82-22 -- Fix can_exec definition in sepolgen - -* Fri May 21 2010 Dan Walsh 2.0.82-21 -- Add man page for seunshare and genhomedircon -Resolves: #594303 -- Fix node management via semanage - -* Wed May 19 2010 Dan Walsh 2.0.82-20 -- Fixes from upstream for sandbox command -Resolves: #580938 - -* Thu May 13 2010 Dan Walsh 2.0.82-18 -- Fix sandbox error handling on copyfile -- Fix desktop files - -* Tue May 11 2010 Dan Walsh 2.0.82-17 -- Fix policy tool to have correct name in menus -- Fix seunshare to handle /tmp being in ~/home -- Fix saving of altered files -- Update translations - -* Tue May 4 2010 Dan Walsh 2.0.82-15 -- Allow audit2allow to specify alternative policy file for analysis - -* Mon May 3 2010 Dan Walsh 2.0.82-14 -- Update po -- Fix sepolgen --no_attrs -Resolves: #588280 - -* Thu Apr 29 2010 Dan Walsh 2.0.82-13 -- Make semanage boolean work on disabled machines and during livecd xguest -- Fix homedir and tmpdir handling in sandbox -Resolves: #587263 - -* Wed Apr 28 2010 Dan Walsh 2.0.82-11 -- Make semanage boolean work on disabled machines - -* Tue Apr 27 2010 Dan Walsh 2.0.82-10 -- Make sepolgen-ifgen be quiet - -* Wed Apr 21 2010 Dan Walsh 2.0.82-8 -- Make sepolgen report on more interfaces -- Fix system-config-selinux display of modules - -* Thu Apr 15 2010 Dan Walsh 2.0.82-7 -- Fix crash when args are empty -Resolves: #582542 -- Fix semange to exit on bad options -- Fix semanage dontaudit man page section -Resolves: #582533 - -* Wed Apr 14 2010 Dan Walsh 2.0.82-6 -- Remove debug line from semanage -- Update po - -* Tue Apr 13 2010 Dan Walsh 2.0.82-5 -- Fix sandbox comment on HOMEDIRS -- Fix sandbox to throw error on bad executable - -* Tue Apr 6 2010 Dan Walsh 2.0.82-4 -- Fix spacing in templates - -* Wed Mar 31 2010 Dan Walsh 2.0.82-3 -- Fix semanage return codes - -* Tue Mar 30 2010 Dan Walsh 2.0.82-2 -- Fix sepolgen to confirm to the "Reference Policy Style Guide" - -* Tue Mar 23 2010 Dan Walsh 2.0.82-1 -- Update to upstream - * Add avc's since boot from Dan Walsh. - * Fix unit tests from Dan Walsh. - -* Tue Mar 23 2010 Dan Walsh 2.0.81-4 -- Update to upstream - sepolgen - * Add since-last-boot option to audit2allow from Dan Walsh. - * Fix sepolgen output to match what Chris expects for upstream - refpolicy from Dan Walsh. - -* Mon Mar 22 2010 Dan Walsh 2.0.81-3 -- Allow restorecon on > 2 Gig files - -* Tue Mar 16 2010 Dan Walsh 2.0.81-2 -- Fix semanage handling of boolean options -- Update translations - -* Fri Mar 12 2010 Dan Walsh 2.0.81-1 -- Update to upstream - * Add dontaudit flag to audit2allow from Dan Walsh. - -* Thu Mar 11 2010 Dan Walsh 2.0.80-2 -- Use --rbind in sandbox init scripts - -* Mon Mar 8 2010 Dan Walsh 2.0.80-1 -- Update to upstream - * Module enable/disable support from Dan Walsh. - -* Mon Mar 1 2010 Dan Walsh 2.0.79-5 -- Rewrite of sandbox script, add unit test for sandbox -- Update translations - -* Mon Mar 1 2010 Dan Walsh 2.0.79-4 -- Fix patch for dontaudit rules from audit2allow for upstream acceptance - -* Fri Feb 26 2010 Dan Walsh 2.0.79-3 -- Fixes for fixfiles - -* Wed Feb 17 2010 Dan Walsh 2.0.79-2 -- Fix sandbox to complain if mount-shared has not been run -- Fix to use /etc/sysconfig/sandbox - -* Tue Feb 16 2010 Dan Walsh 2.0.79-1 -- Update to upstream - * Fix double-free in newrole -- Fix python language handling - -* Thu Feb 11 2010 Dan Walsh 2.0.78-21 -- Fix display of command in sandbox - -* Fri Feb 5 2010 Dan Walsh 2.0.78-20 -- Catch OSError in semanage - -* Wed Feb 3 2010 Dan Walsh 2.0.78-19 -- Fix seobject and fixfiles - -* Fri Jan 29 2010 Dan Walsh 2.0.78-17 -- Change seobject to use translations properly - -* Thu Jan 28 2010 Dan Walsh 2.0.78-16 -- Cleanup spec file -Resolves: 555835 - -* Thu Jan 28 2010 Dan Walsh 2.0.78-15 -- Add use_resolve to sepolgen - -* Wed Jan 27 2010 Dan Walsh 2.0.78-14 -- Add session capability to sandbox -- sandbox -SX -H ~/.homedir -t unconfined_t -l s0:c15 /etc/gdm/Xsession - -* Thu Jan 21 2010 Dan Walsh 2.0.78-13 -- Fix executable template for fifo files - -* Tue Jan 19 2010 Dan Walsh 2.0.78-12 -- Fix patch xod xmodmap -- Exit 0 from script - -* Thu Jan 14 2010 Dan Walsh 2.0.78-11 -- Run with the same xdmodmap in sandbox as outside -- Patch from Josh Cogliati - -* Fri Jan 8 2010 Dan Walsh 2.0.78-10 -- Fix sepolgen to not generate user sh section on non user policy - -* Fri Jan 8 2010 Dan Walsh 2.0.78-9 -- Add -e to semanage man page -- Add -D qualifier to audit2allow to generate dontaudit rules - -* Wed Jan 6 2010 Dan Walsh 2.0.78-8 -- Speed up audit2allow processing of audit2why comments - -* Fri Dec 18 2009 Dan Walsh 2.0.78-7 -- Fixes to sandbox man page - -* Thu Dec 17 2009 Dan Walsh 2.0.78-6 -- Add setools-libs-python to requires for gui - -* Wed Dec 16 2009 Dan Walsh 2.0.78-5 -- If restorecond running as a user has no files to watch then it should exit. (NFS Homedirs) - -* Thu Dec 10 2009 Dan Walsh 2.0.78-4 -- Move sandbox man page to base package - -* Tue Dec 8 2009 Dan Walsh 2.0.78-3 -- Fix audit2allow to report constraints, dontaudits, types, booleans - -* Fri Dec 4 2009 Dan Walsh 2.0.78-2 -- Fix restorecon -i to ignore enoent - -* Tue Dec 1 2009 Dan Walsh 2.0.78-1 -- Update to upstream - * Remove non-working OUTFILE from fixfiles from Dan Walsh. - * Additional exception handling in chcat from Dan Walsh. - - * fix sepolgen to read a "type 1403" msg as a policy load by Stephen - Smalley - * Add support for Xen ocontexts from Paul Nuzzi. - -* Tue Nov 24 2009 Dan Walsh 2.0.77-1 -- Update to upstream - * Fixed bug preventing semanage node -a from working - from Chad Sellers - * Fixed bug preventing semanage fcontext -l from working - from Chad Sellers -- Change semanage to use unicode - -* Wed Nov 18 2009 Dan Walsh 2.0.76-1 -- Update to upstream - * Remove setrans management from semanage, as it does not work - from Dan Walsh. - * Move load_policy from /usr/sbin to /sbin from Dan Walsh. - -* Mon Nov 16 2009 Dan Walsh 2.0.75-3 -- Raise exception if user tries to add file context with an embedded space - -* Wed Nov 11 2009 Dan Walsh 2.0.75-2 -- Fix sandbox to setsid so it can run under mozilla without crashing the session - -* Mon Nov 2 2009 Dan Walsh 2.0.75-1 -- Update to upstream - * Factor out restoring logic from setfiles.c into restore.c - -* Fri Oct 30 2009 Dan Walsh 2.0.74-15 -- Fix typo in seobject.py - -* Fri Oct 30 2009 Dan Walsh 2.0.74-14 -- Allow semanage -i and semanage -o to generate customization files. -- semanage -o will generate a customization file that semanage -i can read and set a machines to the same selinux configuration - -* Tue Oct 20 2009 Dan Walsh 2.0.74-13 -- Fix restorecond man page - -* Mon Oct 19 2009 Dan Walsh 2.0.74-12 -- Add generation of the users context file to polgengui - -* Fri Oct 16 2009 Dan Walsh 2.0.74-11 -- Remove tabs from system-config-selinux glade file - -* Thu Oct 15 2009 Dan Walsh 2.0.74-10 -- Remove translations screen from system-config-selinux - -* Wed Oct 14 2009 Dan Walsh 2.0.74-9 -- Move fixfiles man pages into the correct package -- Add genhomedircon to fixfiles restore - -* Tue Oct 6 2009 Dan Walsh 2.0.74-8 -- Add check to sandbox to verify save changes - Chris Pardy -- Fix memory leak in restorecond - Steve Grubb - -* Thu Oct 1 2009 Dan Walsh 2.0.74-7 -- Fixes Templates - -* Thu Oct 1 2009 Dan Walsh 2.0.74-6 -- Fixes for polgengui to handle tcp ports correctly -- Fix semanage node -a - -* Wed Sep 30 2009 Dan Walsh 2.0.74-5 -- Fixes for semanage -equiv, readded modules, --enable, --disable - -* Sun Sep 20 2009 Dan Walsh 2.0.74-4 -- Close sandbox when eclipse exits - -* Fri Sep 18 2009 Dan Walsh 2.0.74-3 -- Security fixes for seunshare -- Fix Sandbox to handle non file input to command. - -* Thu Sep 17 2009 Dan Walsh 2.0.74-2 -- Security fixes for seunshare - -* Thu Sep 17 2009 Dan Walsh 2.0.74-1 -- Update to upstream - * Change semodule upgrade behavior to install even if the module - is not present from Dan Walsh. - * Make setfiles label if selinux is disabled and a seclabel aware - kernel is running from Caleb Case. - * Clarify forkpty() error message in run_init from Manoj Srivastava. - -* Mon Sep 14 2009 Dan Walsh 2.0.73-5 -- Fix sandbox to handle relative paths - -* Mon Sep 14 2009 Dan Walsh 2.0.73-4 -- Add symbolic link to load_policy - -* Mon Sep 14 2009 Dan Walsh 2.0.73-3 -- Fix restorecond script to use force-reload - -* Tue Sep 8 2009 Dan Walsh 2.0.73-2 -- Fix init script to show status in usage message - -* Tue Sep 8 2009 Dan Walsh 2.0.73-1 -- Update to upstream - * Add semanage dontaudit to turn off dontaudits from Dan Walsh. - * Fix semanage to set correct mode for setrans file from Dan Walsh. - * Fix malformed dictionary in portRecord from Dan Walsh. - * Restore symlink handling support to restorecon based on a patch by - Martin Orr. This fixes the restorecon /dev/stdin performed by Debian - udev scripts that was broken by policycoreutils 2.0.70. - -* Thu Sep 3 2009 Dan Walsh 2.0.71-15 -- Add DAC_OVERRIED to seunshare - -* Wed Sep 2 2009 Bill Nottingham 2.0.71-15 -- Fix typo - -* Fri Aug 28 2009 Dan Walsh 2.0.71-14 -- Add enable/disable patch - -* Thu Aug 27 2009 Tomas Mraz - 2.0.71-13 -- rebuilt with new audit - -* Wed Aug 26 2009 Dan Walsh 2.0.71-12 -- Tighten up controls on seunshare.c - -* Wed Aug 26 2009 Dan Walsh 2.0.71-11 -- Add sandboxX - -* Sat Aug 22 2009 Dan Walsh 2.0.71-10 -- Fix realpath usage to only happen on argv input from user - -* Fri Aug 21 2009 Ville Skyttä - 2.0.71-9 -- Don't try to remove restorecond after last erase (done already in %%preun). -- Ensure scriptlets exit with status 0. -- Fix %%post and %%pr - -* Thu Aug 20 2009 Dan Walsh 2.0.71-7 -- Fix glob handling of /.. - -* Wed Aug 19 2009 Dan Walsh 2.0.71-6 -- Redesign restorecond to use setfiles/restore functionality - -* Wed Aug 19 2009 Dan Walsh 2.0.71-5 -- Fix sepolgen again - -* Tue Aug 18 2009 Dan Walsh 2.0.71-4 -- Add --boot flag to audit2allow to get all AVC messages since last boot - -* Tue Aug 18 2009 Dan Walsh 2.0.71-3 -- Fix semanage command - -* Thu Aug 13 2009 Dan Walsh 2.0.71-2 -- exclude unconfined.if from sepolgen - -* Thu Aug 13 2009 Dan Walsh 2.0.71-1 -- Fix chcat to report error on non existing file -- Update to upstream - * Modify setfiles/restorecon checking of exclude paths. Only check - user-supplied exclude paths (not automatically generated ones based on - lack of seclabel support), don't require them to be directories, and - ignore permission denied errors on them (it is ok to exclude a path to - which the caller lacks permission). - -* Mon Aug 10 2009 Dan Walsh 2.0.70-2 -- Don't warn if the user did not specify the exclude if root can not stat file system - -* Wed Aug 5 2009 Dan Walsh 2.0.70-1 -- Update to upstream - * Modify restorecon to only call realpath() on user-supplied pathnames - from Stephen Smalley. - * Fix typo in fixfiles that prevented it from relabeling btrfs - filesystems from Dan Walsh. - -* Wed Jul 29 2009 Dan Walsh 2.0.68-1 -- Fix location of man pages -- Update to upstream - * Modify setfiles to exclude mounts without seclabel option in - /proc/mounts on kernels >= 2.6.30 from Thomas Liu. - * Re-enable disable_dontaudit rules upon semodule -B from Christopher - Pardy and Dan Walsh. - * setfiles converted to fts from Thomas Liu. - -* Sun Jul 26 2009 Fedora Release Engineering - 2.0.64-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Tue Jul 7 2009 Tom "spot" Callaway 2.0.64-2 -- fix multiple directory ownership of mandirs - -* Fri Jun 26 2009 Dan Walsh 2.0.64-1 -- Update to upstream - * Keep setfiles from spamming console from Dan Walsh. - * Fix chcat's category expansion for users from Dan Walsh. -- Update po files -- Fix sepolgen - -* Thu Jun 4 2009 Dan Walsh 2.0.63-5 -- Add sepolgen executable - -* Mon Jun 1 2009 Dan Walsh 2.0.63-4 -- Fix Sandbox option handling -- Fix fixfiles handling of btrfs - -* Tue May 26 2009 Dan Walsh 2.0.63-3 -- Fix sandbox to be able to execute files in homedir - -* Fri May 22 2009 Dan Walsh 2.0.63-2 -- Change polgen.py to be able to generate policy - -* Wed May 20 2009 Dan Walsh 2.0.63-1 -- Update to upstream - * Fix transaction checking from Dan Walsh. - * Make fixfiles -R (for rpm) recursive. - * Make semanage permissive clean up after itself from Dan Walsh. - * add /root/.ssh/* to restorecond.conf - -* Wed Apr 22 2009 Dan Walsh 2.0.62-14 -- Fix audit2allow -a to retun /var/log/messages - -* Wed Apr 22 2009 Dan Walsh 2.0.62-13 -- Run restorecond as a user service - -* Thu Apr 16 2009 Dan Walsh 2.0.62-12 -- Add semanage module support - -* Tue Apr 14 2009 Dan Walsh 2.0.62-10 -- Do not print \n, if count < 1000; - -* Sat Apr 11 2009 Dan Walsh 2.0.62-9 -- Handle case where subs file does not exist - -* Wed Apr 8 2009 Dan Walsh 2.0.62-8 -- Update po files -- Add --equiv command for semanage - -* Tue Mar 31 2009 Dan Walsh 2.0.62-7 -- Cleanup creation of permissive domains -- Update po files - -* Mon Mar 23 2009 Dan Walsh 2.0.62-6 -- Update po files - -* Thu Mar 12 2009 Dan Walsh 2.0.62-5 -- Fix semanage transations - -* Sat Mar 7 2009 Dan Walsh 2.0.62-4 -- Update polgengui templates to match current upstream policy - -* Thu Feb 26 2009 Fedora Release Engineering - 2.0.62-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Mon Feb 23 2009 Dan Walsh 2.0.62-2 -- Add /root/.ssh to restorecond.conf -- fixfiles -R package should recursively fix files - -* Wed Feb 18 2009 Dan Walsh 2.0.62-1 -- Update to upstream - * Add btrfs to fixfiles from Dan Walsh. - * Remove restorecond error for matching globs with multiple hard links - and fix some error messages from Dan Walsh. - * Make removing a non-existant module a warning rather than an error - from Dan Walsh. - * Man page fixes from Dan Walsh. - -* Mon Feb 16 2009 Dan Walsh 2.0.61-10 -- Fix script created by polgengui to not refer to selinux-policy-devel - -* Mon Feb 9 2009 Dan Walsh 2.0.61-9 -- Change initc scripts to use proper labeling on gui - -* Mon Feb 9 2009 Dan Walsh 2.0.61-8 -- Add obsoletes to cause policycoreuils to update both python and non python version - -* Fri Jan 30 2009 Dan Walsh 2.0.61-7 -- Dont report errors on glob match and multiple links - -* Thu Jan 22 2009 Dan Walsh 2.0.61-6 -- Move sepolgen-ifgen to post python - -* Wed Jan 21 2009 Dan Walsh 2.0.61-4 -- Fix Translations - -* Tue Jan 20 2009 Dan Walsh 2.0.61-3 -- Add Domains Page to system-config-selinux -- Add ability to create dbus confined applications to polgen - -* Wed Jan 14 2009 Dan Walsh 2.0.61-2 -- Split python into a separate package - -* Tue Jan 13 2009 Dan Walsh 2.0.61-1 -- Update to upstream - * chcat: cut categories at arbitrary point (25) from Dan Walsh - * semodule: use new interfaces in libsemanage for compressed files - from Dan Walsh - * audit2allow: string changes for usage - -* Tue Jan 6 2009 Dan Walsh 2.0.60-7 -- Don't error out when removing a non existing module - -* Mon Dec 15 2008 Dan Walsh 2.0.60-6 -- fix audit2allow man page - -* Wed Dec 10 2008 Dan Walsh 2.0.60-5 -- Fix Japanese translations - -* Sat Dec 6 2008 Dan Walsh 2.0.60-4 -- Change md5 to hashlib.md5 in sepolgen - -* Thu Dec 04 2008 Ignacio Vazquez-Abrams - 2.0.60-3 -- Rebuild for Python 2.6 - -* Tue Dec 2 2008 Dan Walsh 2.0.60-2 -- Fix error checking in restorecond, for inotify_add_watch - -* Mon Dec 1 2008 Dan Walsh 2.0.60-1 -- Update to upstream - * semanage: use semanage_mls_enabled() from Stephen Smalley. - -* Sat Nov 29 2008 Ignacio Vazquez-Abrams - 2.0.59-2 -- Rebuild for Python 2.6 - -* Tue Nov 11 2008 Dan Walsh 2.0.59-1 -- Update to upstream - * fcontext add checked local records twice, fix from Dan Walsh. - -* Mon Nov 10 2008 Dan Walsh 2.0.58-1 -- Update to upstream - * Allow local file context entries to override policy entries in - semanage from Dan Walsh. - * Newrole error message corrections from Dan Walsh. - * Add exception to audit2why call in audit2allow from Dan Walsh. - -* Fri Nov 7 2008 Dan Walsh 2.0.57-12 -- add compression - -* Tue Nov 04 2008 Jesse Keating - 2.0.57-11 -- Move the usermode-gtk requires to the -gui subpackage. - -* Thu Oct 30 2008 Dan Walsh 2.0.57-10 -- Fix traceback in audit2why - -* Wed Oct 29 2008 Dan Walsh 2.0.57-9 -- Make GUI use translations - -* Wed Oct 29 2008 Dan Walsh 2.0.57-8 -- Fix typo in man page - -* Tue Oct 28 2008 Dan Walsh 2.0.57-7 -- Handle selinux disabled correctly -- Handle manipulation of fcontext file correctly - -* Mon Oct 27 2008 Dan Walsh 2.0.57-6 -- Add usermode-gtk requires - -* Thu Oct 23 2008 Dan Walsh 2.0.57-5 -- Allow addition of local modifications of fcontext policy. - -* Mon Oct 20 2008 Dan Walsh 2.0.57-4 -- Fix system-config-selinux booleanspage throwing and exception -- Update po files - -* Fri Oct 17 2008 Dan Walsh 2.0.57-3 -- Fix text in newrole -- Fix revertbutton on booleans page in system-config-selinux - -* Wed Oct 1 2008 Dan Walsh 2.0.57-2 -- Change semodule calls for libsemanage - -* Wed Oct 1 2008 Dan Walsh 2.0.57-1 -- Update to upstream - * Update po files from Dan Walsh. - -* Fri Sep 12 2008 Dan Walsh 2.0.56-1 -- Fix semanage help display -- Update to upstream - * fixfiles will now remove all files in /tmp and will check for - unlabeled_t in /tmp and /var/tmp from Dan Walsh. - * add glob support to restorecond from Dan Walsh. - * allow semanage to handle multi-line commands in a single transaction - from Dan Walsh. - -* Thu Sep 11 2008 Dan Walsh 2.0.55-8 -- Only call gen_requires once in sepolgen - -* Tue Sep 9 2008 Dan Walsh 2.0.55-7 -- Change Requires line to gnome-python2-gnome -- Fix spelling mistakes -- Require libselinux-utils - -* Mon Sep 8 2008 Dan Walsh 2.0.55-5 -- Add node support to semanage - -* Mon Sep 8 2008 Dan Walsh 2.0.55-4 -- Fix fixfiles to correct unlabeled_t files and remove .? files - -* Wed Sep 3 2008 Dan Walsh 2.0.55-2 -- Add glob support to restorecond so it can check every file in the homedir - -* Thu Aug 28 2008 Dan Walsh 2.0.55-1 -- Update to upstream - * Merged semanage node support from Christian Kuester. - -* Fri Aug 15 2008 Dan Walsh 2.0.54-7 -- Add require libsemanage-python - -* Mon Aug 11 2008 Dan Walsh 2.0.54-6 -- Add missing html_util.py file - -* Thu Aug 7 2008 Dan Walsh 2.0.54-5 -- Fixes for multiple transactions - -* Wed Aug 6 2008 Dan Walsh 2.0.54-2 -- Allow multiple transactions in one semanage command - -* Tue Aug 5 2008 Dan Walsh 2.0.54-1 -- Update to upstream - * Add support for boolean files and group support for seusers from Dan Walsh. - * Ensure that setfiles -p output is newline terminated from Russell Coker. - -* Fri Aug 1 2008 Dan Walsh 2.0.53-3 -- Allow semanage user to add group lists % groupname - -* Tue Jul 29 2008 Dan Walsh 2.0.53-2 -- Fix help - -* Tue Jul 29 2008 Dan Walsh 2.0.53-1 -- Update to upstream - * Change setfiles to validate all file_contexts files when using -c from Stephen Smalley. - -* Tue Jul 29 2008 Dan Walsh 2.0.52-6 -- Fix boolean handling -- Upgrade to latest sepolgen -- Update po patch - -* Wed Jul 9 2008 Dan Walsh 2.0.52-5 -- Additial cleanup of boolean handling for semanage - -* Tue Jul 8 2008 Dan Walsh 2.0.52-4 -- Handle ranges of ports in gui - -* Tue Jul 8 2008 Dan Walsh 2.0.52-3 -- Fix indent problems in seobject - -* Wed Jul 2 2008 Dan Walsh 2.0.52-2 -- Add lockdown wizard -- Allow semanage booleans to take an input file an process lots of booleans at once. - -* Wed Jul 2 2008 Dan Walsh 2.0.52-1 -- Default prefix to "user" - -* Tue Jul 1 2008 Dan Walsh 2.0.50-2 -- Remove semodule use within semanage -- Fix launching of polgengui from toolbar - -* Mon Jun 30 2008 Dan Walsh 2.0.50-1 -- Update to upstream - * Fix audit2allow generation of role-type rules from Karl MacMillan. - -* Tue Jun 24 2008 Dan Walsh 2.0.49-10 -- Fix spelling of enforcement - -* Mon Jun 23 2008 Dan Walsh 2.0.49-8 -- Fix sepolgen/audit2allow handling of roles - -* Mon Jun 16 2008 Dan Walsh 2.0.49-7 -- Fix sepolgen-ifgen processing - -* Thu Jun 12 2008 Dan Walsh 2.0.49-6 -- Add deleteall to semanage permissive, cleanup error handling - -* Thu Jun 12 2008 Dan Walsh 2.0.49-5 -- Complete removal of rhpl requirement - -* Wed Jun 11 2008 Dan Walsh 2.0.49-4 -- Add semanage permissive * - -* Fri May 16 2008 Dan Walsh 2.0.49-3 -- Fix fixfiles to cleanup /tmp and /var/tmp - -* Fri May 16 2008 Dan Walsh 2.0.49-2 -- Fix listing of types in gui - -* Mon May 12 2008 Dan Walsh 2.0.49-1 -- Update to upstream - * Remove security_check_context calls for prefix validation from semanage. - * Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified. - -* Mon May 12 2008 Dan Walsh 2.0.47-3 -- Remove /usr/share/locale/sr@Latn/LC_MESSAGES/policycoreutils.mo - -* Wed May 7 2008 Dan Walsh 2.0.47-2 -- Add rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* to fixfiles restore -- So that mislabeled files will get removed on full relabel - -* Wed May 7 2008 Dan Walsh 2.0.47-1 -- Make restorecond not start by default -- Fix polgengui to allow defining of confined roles. -- Add patches from Lubomir Rintel - * Add necessary runtime dependencies on setools-console for -gui - * separate stderr when run seinfo commands -- Update to upstream - * Update semanage man page for booleans from Dan Walsh. - * Add further error checking to seobject.py for setting booleans. - -* Fri Apr 18 2008 Matthias Clasen - 2.0.46-5 -- Uninvasive (ie no string or widget changes) HIG approximations - in selinux-polgenui - -* Fri Apr 18 2008 Matthias Clasen - 2.0.46-4 -- Move s-c-selinux to the right menu - -* Sun Apr 6 2008 Dan Walsh 2.0.46-3 -- Fix boolean descriptions -- Fix semanage man page - -* Wed Mar 19 2008 Dan Walsh 2.0.46-2 -- Don't use prefix in gui - -* Tue Mar 18 2008 Dan Walsh 2.0.46-1 -- Update to upstream - * Update audit2allow to report dontaudit cases from Dan Walsh. - * Fix semanage port to use --proto from Caleb Case. - -* Fri Feb 22 2008 Dan Walsh 2.0.44-1 -- Update to upstream - * Fix for segfault when conf file parse error occurs. - -* Wed Feb 13 2008 Dan Walsh 2.0.43-2 -- Don't show tabs on polgengui - -* Wed Feb 13 2008 Dan Walsh 2.0.43-1 -- Update to upstream - * Merged fix fixfiles option processing from Vaclav Ovsik. -- Added existing users, staff and user_t users to polgengui - -* Fri Feb 8 2008 Dan Walsh 2.0.42-3 -- Add messages for audit2allow DONTAUDIT - -* Tue Feb 5 2008 Dan Walsh 2.0.42-2 -- Add ability to transition to roles via polgengui - -* Sat Feb 2 2008 Dan Walsh 2.0.42-1 -- Update to upstream - * Make semodule_expand use sepol_set_expand_consume_base to reduce - peak memory usage. - -* Tue Jan 29 2008 Dan Walsh 2.0.41-1 -- Update to upstream - * Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh. - * Merged a second fixfiles -C fix from Marshall Miller. - - -* Thu Jan 24 2008 Dan Walsh 2.0.39-1 -- Don't initialize audit2allow for audit2why call. Use default -- Update to upstream - * Merged fixfiles -C fix from Marshall Miller. - -* Thu Jan 24 2008 Dan Walsh 2.0.38-1 -- Update to upstream - * Merged audit2allow cleanups and boolean descriptions from Dan Walsh. - * Merged setfiles -0 support by Benny Amorsen via Dan Walsh. - * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh. - -* Wed Jan 23 2008 Dan Walsh 2.0.37-1 -- Update to upstream - * Merged replacement for audit2why from Dan Walsh. - -* Wed Jan 23 2008 Dan Walsh 2.0.36-2 -- Cleanup fixfiles -f message in man page - -* Wed Jan 23 2008 Dan Walsh 2.0.36-1 -- Update to upstream - * Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh. - * Merged sepolgen fixes from Dan Walsh. - -* Tue Jan 22 2008 Dan Walsh 2.0.35-5 -- handle files with spaces on upgrades - -* Tue Jan 22 2008 Dan Walsh 2.0.35-4 -- Add support in fixfiles for ext4 ext4dev and gfs2 - -* Mon Jan 21 2008 Dan Walsh 2.0.35-3 -- Allow files with spaces to be used by setfiles - -* Tue Jan 15 2008 Dan Walsh 2.0.35-2 -- Add descriptions of booleans to audit2allow - -* Fri Jan 11 2008 Dan Walsh 2.0.35-1 -- Update to upstream - * Merged support for non-interactive newrole command invocation from Tim Reed. - -* Thu Jan 10 2008 Dan Walsh 2.0.34-8 -- Change to use selinux bindings to audit2why - -* Tue Jan 8 2008 Dan Walsh 2.0.34-7 -- Fix fixfiles to handle no args - -* Mon Dec 31 2007 Dan Walsh 2.0.34-5 -- Fix roles output when creating a module - -* Mon Dec 31 2007 Dan Walsh 2.0.34-4 -- Handle files with spaces in fixfiles - -* Fri Dec 21 2007 Dan Walsh 2.0.34-3 -- Catch SELINUX_ERR with audit2allow and generate policy - -* Thu Dec 20 2007 Dan Walsh 2.0.34-2 -- Make sepolgen set error exit code when partial failure -- audit2why now checks booleans for avc diagnosis - -* Wed Dec 19 2007 Dan Walsh 2.0.34-1 -- Update to upstream - * Update Makefile to not build restorecond if - /usr/include/sys/inotify.h is not present - -* Wed Dec 19 2007 Dan Walsh 2.0.33-4 -- Fix sepolgen to be able to parse Fedora 9 policy - Handle ifelse statements - Handle refpolicywarn inside of define - Add init.if and inetd.if into parse - Add parse_file to syntax error message - -* Fri Dec 14 2007 Dan Walsh 2.0.33-3 -- Add scroll bar to fcontext gui page - -* Tue Dec 11 2007 Dan Walsh 2.0.33-2 -- Add Russion Man pages - -* Mon Dec 10 2007 Dan Walsh 2.0.33-1 -- Upgrade from NSA - * Drop verbose output on fixfiles -C from Dan Walsh. - * Fix argument handling in fixfiles from Dan Walsh. - * Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh. -- Fix handling of final screen in polgengui - -* Sun Dec 2 2007 Dan Walsh 2.0.32-2 -- Fix handling of disable selinux button in gui - -* Mon Nov 19 2007 Dan Walsh 2.0.32-1 -- Upgrade from NSA - * load_policy initial load option from Chad Sellers. - -* Mon Nov 19 2007 Dan Walsh 2.0.31-20 -- Don't show error on missing policy.xml - -* Mon Nov 19 2007 Dan Walsh 2.0.31-19 -- GUI Enhancements - - Fix cgi generation - - Use more patterns - -* Mon Nov 19 2007 Dan Walsh 2.0.31-18 -- Remove codec hacking, which seems to be fixed in python - -* Fri Nov 16 2007 Dan Walsh 2.0.31-17 -- Fix typo -- Change to upstream minimal privledge interfaces - -* Fri Nov 16 2007 Dan Walsh 2.0.31-16 -- Fix fixfiles argument parsing - -* Thu Nov 15 2007 Dan Walsh 2.0.31-15 -- Fix File Labeling add - -* Thu Nov 8 2007 Dan Walsh 2.0.31-14 -- Fix semanage to handle state where policy.xml is not installed - -* Mon Nov 5 2007 Dan Walsh 2.0.31-13 -- Remove -v from restorecon in fixfiles - -* Mon Nov 5 2007 Dan Walsh 2.0.31-12 -- Fix filter and search capabilities, add wait cursor - -* Fri Nov 2 2007 Dan Walsh 2.0.31-11 -- Translate booleans via policy.xml -- Allow booleans to be set via semanage - -* Thu Nov 1 2007 Dan Walsh 2.0.31-10 -- Require use of selinux-policy-devel - -* Wed Oct 31 2007 Dan Walsh 2.0.31-9 -- Validate semanage fcontext input -- Fix template names for log files in gui - -* Fri Oct 19 2007 Dan Walsh 2.0.31-8 -- Fix template to generate correct content - -* Fri Oct 19 2007 Dan Walsh 2.0.31-7 -- Fix consolekit link to selinux-polgengui - -* Thu Oct 18 2007 Dan Walsh 2.0.31-6 -- Fix the generation templates - -* Tue Oct 16 2007 Dan Walsh 2.0.31-5 -- Fix enable/disable audit messages - -* Mon Oct 15 2007 Dan Walsh 2.0.31-4 -- Add booleans page - -* Mon Oct 15 2007 Dan Walsh 2.0.31-3 -- Lots of updates to gui - -* Mon Oct 15 2007 Dan Walsh 2.0.31-1 -- Remove no.po -- Update to upstream - * Fix semodule option handling from Dan Walsh. - * Add deleteall support for ports and fcontexts in semanage from Dan Walsh. - -* Thu Oct 11 2007 Dan Walsh 2.0.29-2 -- Fix semodule parameter checking - -* Sun Oct 7 2007 Dan Walsh 2.0.29-1 -- Update to upstream - * Add genhomedircon script to invoke semodule -Bn from Dan Walsh. -- Add deleteall for ports and fcontext - -* Fri Oct 5 2007 Dan Walsh 2.0.28-1 -- Update to upstream - * Update semodule man page for -D from Dan Walsh. - * Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh. - -* Tue Oct 2 2007 Dan Walsh 2.0.27-7 -- Add genhomedircon script to rebuild file_context for shadow-utils - -* Tue Oct 2 2007 Dan Walsh 2.0.27-6 -- Update translations - -* Tue Oct 2 2007 Dan Walsh 2.0.27-5 -- Additional checkboxes for application policy - -* Fri Sep 28 2007 Dan Walsh 2.0.27-4 -- Allow policy writer to select user types to transition to there users - -* Thu Sep 27 2007 Dan Walsh 2.0.27-3 -- Fix bug in building policy with polgengui -- Creating ports correctly - -* Wed Sep 26 2007 Dan Walsh 2.0.27-1 -- Update to upstream - * Improve semodule reporting of system errors from Stephen Smalley. - -* Mon Sep 24 2007 Dan Walsh 2.0.26-3 -- Show local changes with semanage - -* Mon Sep 24 2007 Dan Walsh 2.0.26-2 -- Fixed spelling mistakes in booleans defs -- Update po - -* Tue Sep 18 2007 Dan Walsh 2.0.26-1 -- Update to upstream - * Fix setfiles selabel option flag setting for 64-bit from Stephen Smalley. - -* Tue Sep 18 2007 Dan Walsh 2.0.25-15 -- Fix wording in policy generation tool - -* Fri Sep 14 2007 Dan Walsh 2.0.25-14 -- Fix calls to _admin interfaces - -* Thu Sep 13 2007 Dan Walsh 2.0.25-13 -- Upgrade version of sepolgen from NSA - * Expand the sepolgen parser to parse all current refpolicy modules from Karl MacMillan. - * Suppress generation of rules for non-denials from Karl MacMillan (take 3). - -* Tue Sep 11 2007 Dan Walsh 2.0.25-12 -- Remove bogus import libxml2 - -* Mon Sep 10 2007 Dan Walsh 2.0.25-11 -- Lots of fixes for polgengui - -* Thu Sep 6 2007 Dan Walsh 2.0.25-10 -- Change Requires /bin/rpm to rpm - -* Wed Sep 5 2007 Dan Walsh 2.0.25-9 -- Bump libsemanage version for disable dontaudit -- New gui features for creating admin users - -* Fri Aug 31 2007 Dan Walsh 2.0.25-8 -- Fix generated code for admin policy - -* Fri Aug 31 2007 Dan Walsh 2.0.25-7 -- Lots of fixes for role templates - -* Tue Aug 28 2007 Dan Walsh 2.0.25-6 -- Add more role_templates - -* Tue Aug 28 2007 Dan Walsh 2.0.25-5 -- Update genpolgui to add creation of user domains - -* Mon Aug 27 2007 Dan Walsh 2.0.25-4 -- Fix location of sepolgen-ifgen - -* Sat Aug 25 2007 Dan Walsh 2.0.25-3 -- Add selinux-polgengui to desktop - -* Fri Aug 24 2007 Dan Walsh 2.0.25-2 -- Cleanup spec - -* Thu Aug 23 2007 Dan Walsh 2.0.25-1 -- Update semodule man page - * Fix genhomedircon searching for USER from Todd Miller - * Install run_init with mode 0755 from Dan Walsh. - * Fix chcat from Dan Walsh. - * Fix fixfiles pattern expansion and error reporting from Dan Walsh. - * Optimize genhomedircon to compile regexes once from Dan Walsh. - * Fix semanage gettext call from Dan Walsh. - -* Thu Aug 23 2007 Dan Walsh 2.0.23-2 -- Update semodule man page - -* Mon Aug 20 2007 Dan Walsh 2.0.23-1 -- Update to match NSA - * Disable dontaudits via semodule -D - -* Wed Aug 1 2007 Dan Walsh 2.0.22-13 -- Speed up genhomedircon by an order of magnitude by compiling regex -- Allow semanage fcontext -a -t <> /path to work - -* Fri Jul 27 2007 Dan Walsh 2.0.22-11 -- Fixfiles update required to match new regex - -* Fri Jul 27 2007 Dan Walsh 2.0.22-10 -- Update booleans translations - -* Wed Jul 25 2007 Jeremy Katz - 2.0.22-9 -- rebuild for toolchain bug - -* Tue Jul 24 2007 Dan Walsh 2.0.22-8 -- Add requires libselinux-python - -* Mon Jul 23 2007 Dan Walsh 2.0.22-7 -- Fix fixfiles to report incorrect rpm -- Patch provided by Tony Nelson - -* Fri Jul 20 2007 Dan Walsh 2.0.22-6 -- Clean up spec file - -* Fri Jul 13 2007 Dan Walsh 2.0.22-5 -- Require newer libselinux version - -* Sat Jul 7 2007 Dan Walsh 2.0.22-4 -- Fix checking for conflicting directory specification in genhomedircon - -* Mon Jun 25 2007 Dan Walsh 2.0.22-3 -- Fix spelling mistakes in GUI - -* Fri Jun 22 2007 Dan Walsh 2.0.22-2 -- Fix else path in chcat - -* Thu Jun 21 2007 Dan Walsh 2.0.22-1 -- Update to match NSA - * Rebase setfiles to use new labeling interface. - -* Wed Jun 13 2007 Dan Walsh 2.0.21-2 -- Add filter to all system-config-selinux lists - -* Wed Jun 13 2007 Dan Walsh 2.0.21-1 -- Update to match NSA - * Fixed setsebool (falling through to error path on success). - -* Mon Jun 11 2007 Dan Walsh 2.0.20-1 -- Update to match NSA - * Merged genhomedircon fixes from Dan Walsh. - * Merged setfiles -c usage fix from Dan Walsh. - * Merged restorecon fix from Yuichi Nakamura. - * Dropped -lsepol where no longer needed. - -* Mon Jun 11 2007 Dan Walsh 2.0.19-5 -- Fix translations code, Add more filters to gui - -* Mon Jun 4 2007 Dan Walsh 2.0.19-4 -- Fix setfiles -c to make it work - -* Mon Jun 4 2007 Dan Walsh 2.0.19-3 -- Fix french translation to not crash system-config-selinux - -* Fri Jun 1 2007 Dan Walsh 2.0.19-2 -- Fix genhomedircon to work in stage2 builds of anaconda - -* Sat May 19 2007 Dan Walsh 2.0.19-1 -- Update to match NSA - -* Thu May 17 2007 Dan Walsh 2.0.16-2 -- Fixes for polgentool templates file - -* Fri May 4 2007 Dan Walsh 2.0.16-1 -- Updated version of policycoreutils - * Merged support for modifying the prefix via semanage from Dan Walsh. -- Fixed genhomedircon to find homedirs correctly. - -* Tue May 1 2007 Dan Walsh 2.0.15-1 -- Updated version of policycoreutils - * Merged po file updates from Dan Walsh. -- Fix semanage to be able to modify prefix in user record - -* Mon Apr 30 2007 Dan Walsh 2.0.14-2 -- Fix title on system-config-selinux - -* Wed Apr 25 2007 Dan Walsh 2.0.14-1 -- Updated version of policycoreutils - * Build fix for setsebool. - -* Wed Apr 25 2007 Dan Walsh 2.0.13-1 -- Updated version of policycoreutils - * Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley. - * Merged genhomedircon patch to use the __default__ setting from Dan Walsh. - * Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel. - -* Tue Apr 24 2007 Dan Walsh 2.0.10-2 -- Fixes for polgengui - -* Tue Apr 24 2007 Dan Walsh 2.0.10-1 -- Updated version of policycoreutils - * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh. - -* Fri Apr 20 2007 Dan Walsh 2.0.9-10 -- Fix genhomedircon to handle non user_u for the default user - -* Wed Apr 18 2007 Dan Walsh 2.0.9-9 -- More cleanups for gui - -* Wed Apr 18 2007 Dan Walsh 2.0.9-8 -- Fix size and use_tmp problem on gui - -* Wed Apr 18 2007 Dan Walsh 2.0.9-7 -- Fix restorecon crash - -* Wed Apr 18 2007 Dan Walsh 2.0.9-6 -- Change polgengui to a druid - -* Tue Apr 17 2007 Dan Walsh 2.0.9-5 -- Fully path script.py - -* Mon Apr 16 2007 Dan Walsh 2.0.9-4 -- Add -l flag to restorecon to not traverse file systems - -* Sat Apr 14 2007 Dan Walsh 2.0.9-3 -- Fixes for policygengui - -* Fri Apr 13 2007 Dan Walsh 2.0.9-2 -- Add polgengui - -* Thu Apr 12 2007 Dan Walsh 2.0.9-1 -- Updated version of sepolgen - * Merged seobject setransRecords patch to return the first alias from Xavier Toth. - -* Wed Apr 11 2007 Dan Walsh 2.0.8-1 -- Updated version of sepolgen - * Merged updates to sepolgen-ifgen from Karl MacMillan. - * Merged updates to sepolgen parser and tools from Karl MacMillan. - This includes improved debugging support, handling of interface - calls with list parameters, support for role transition rules, - updated range transition rule support, and looser matching. - -* Mon Apr 9 2007 Dan Walsh 2.0.7-11 -- Don't generate invalid context with genhomedircon - -* Mon Apr 9 2007 Dan Walsh 2.0.7-10 -- Add filter to booleans page - -* Tue Apr 3 2007 Dan Walsh 2.0.7-9 -- Fix polgen.py to not generate udp rules on tcp input - -* Fri Mar 30 2007 Dan Walsh 2.0.7-8 -- system-config-selinux should be able to run on a disabled system, -- at least enough to get it enabled. - -* Thu Mar 29 2007 Dan Walsh 2.0.7-7 -- Many fixes to polgengui - -* Fri Mar 23 2007 Dan Walsh 2.0.7-6 -- Updated version of sepolgen - * Merged patch to discard self from types when generating requires from Karl MacMillan. - -* Fri Mar 23 2007 Dan Walsh 2.0.7-5 -- Change location of audit2allow and sepol-ifgen to sbin -- Updated version of sepolgen - * Merged patch to move the sepolgen runtime data from /usr/share to /var/lib to facilitate a read-only /usr from Karl MacMillan. - -* Mon Mar 19 2007 Dan Walsh 2.0.7-4 -- Add polgen gui -- Many fixes to system-config-selinux - -* Mon Mar 12 2007 Dan Walsh 2.0.7-3 -- service restorecond status needs to set exit value correctly - -* Mon Mar 12 2007 Dan Walsh 2.0.7-2 -- Fix gui - -* Thu Mar 1 2007 Dan Walsh 2.0.7-1 -- Update to upstream - * Merged restorecond init script LSB compliance patch from Steve Grubb. - -sepolgen - * Merged better matching for refpolicy style from Karl MacMillan - * Merged support for extracting interface paramaters from interface calls from Karl MacMillan - * Merged support for parsing USER_AVC audit messages from Karl MacMillan. - -* Tue Feb 27 2007 Dan Walsh 2.0.6-3 -- Update to upstream - -sepolgen - * Merged support for enabling parser debugging from Karl MacMillan. -- Add sgrupp cleanup of restorcon init script - -* Mon Feb 26 2007 Dan Walsh 2.0.6-2 -- Add Bill Nottinham patch to run restorcond condrestart in postun - -* Fri Feb 23 2007 Dan Walsh 2.0.6-1 -- Update to upstream - - policycoreutils - * Merged newrole O_NONBLOCK fix from Linda Knippers. - * Merged sepolgen and audit2allow patches to leave generated files - in the current directory from Karl MacMillan. - * Merged restorecond memory leak fix from Steve Grubb. - -sepolgen - * Merged patch to leave generated files (e.g. local.te) in current directory from Karl MacMillan. - * Merged patch to make run-tests.py use unittest.main from Karl MacMillan. - * Merged patch to update PLY from Karl MacMillan. - * Merged patch to update the sepolgen parser to handle the latest reference policy from Karl MacMillan. - -* Thu Feb 22 2007 Dan Walsh 2.0.3-2 -- Do not fail on sepolgen-ifgen - -* Thu Feb 22 2007 Dan Walsh 2.0.3-1 -- Update to upstream - * Merged translations update from Dan Walsh. - * Merged chcat fixes from Dan Walsh. - * Merged man page fixes from Dan Walsh. - * Merged seobject prefix validity checking from Dan Walsh. - * Merged Makefile and refparser.py patch from Dan Walsh. - Fixes PYTHONLIBDIR definition and error handling on interface files. - -* Tue Feb 20 2007 Dan Walsh 2.0.2-3 -- Updated newrole NONBlOCK patch - -* Tue Feb 20 2007 Dan Walsh 2.0.2-2 -- Remove Requires: %%{name}-plugins - -* Tue Feb 20 2007 Dan Walsh 2.0.2-1 -- Update to upstream - * Merged seobject exception handler fix from Caleb Case. - * Merged setfiles memory leak patch from Todd Miller. - -* Thu Feb 15 2007 Dan Walsh 2.0.1-2 -- Cleanup man pages syntax -- Add sepolgen - -* Mon Feb 12 2007 Dan Walsh 2.0.1-1 -- Update to upstream - * Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh. - -* Wed Feb 7 2007 Dan Walsh 2.0.0-1 -- Update to upstream - * Merged new audit2allow from Karl MacMillan. - This audit2allow depends on the new sepolgen python module. - Note that you must run the sepolgen-ifgen tool to generate - the data needed by audit2allow to generate refpolicy. - * Fixed newrole non-pam build. -- Fix Changelog and spelling error in man page - -* Thu Feb 1 2007 Dan Walsh 1.34.1-4 -- Fix audit2allow on missing translations - -* Wed Jan 24 2007 Dan Walsh 1.34.1-3 -- More chcat fixes - -* Wed Jan 24 2007 Dan Walsh 1.34.1-2 -- Change chcat to exec semodule so file context is maintained - -* Wed Jan 24 2007 Dan Walsh 1.34.1-1 -- Fix system-config-selinux ports view -- Update to upstream - * Fixed newrole non-pam build. - * Updated version for stable branch. - -* Wed Jan 17 2007 Dan Walsh 1.33.15-1 -- Update to upstream - * Merged unicode-to-string fix for seobject audit from Dan Walsh. - * Merged man page updates to make "apropos selinux" work from Dan Walsh. -* Tue Jan 16 2007 Dan Walsh 1.33.14-1 - * Merged newrole man page patch from Michael Thompson. - * Merged patch to fix python unicode problem from Dan Walsh. - -* Tue Jan 16 2007 Dan Walsh 1.33.12-3 -- Fix handling of audit messages for useradd change -Resolves: #222159 - -* Fri Jan 12 2007 Dan Walsh 1.33.12-2 -- Update man pages by adding SELinux to header to fix apropos database -Resolves: #217881 - -* Tue Jan 9 2007 Dan Walsh 1.33.12-1 -- Want to update to match api -- Update to upstream - * Merged newrole securetty check from Dan Walsh. - * Merged semodule patch to generalize list support from Karl MacMillan. -Resolves: #200110 - -* Tue Jan 9 2007 Dan Walsh 1.33.11-1 -- Update to upstream - * Merged fixfiles and seobject fixes from Dan Walsh. - * Merged semodule support for list of modules after -i from Karl MacMillan. - -* Tue Jan 9 2007 Dan Walsh 1.33.10-1 -- Update to upstream - * Merged patch to correctly handle a failure during semanage handle - creation from Karl MacMillan. - * Merged patch to fix seobject role modification from Dan Walsh. - -* Fri Jan 5 2007 Dan Walsh 1.33.8-2 -- Stop newrole -l from working on non secure ttys -Resolves: #200110 - -* Thu Jan 4 2007 Dan Walsh 1.33.8-1 -- Update to upstream - * Merged patches from Dan Walsh to: - - omit the optional name from audit2allow - - use the installed python version in the Makefiles - - re-open the tty with O_RDWR in newrole - -* Wed Jan 3 2007 Dan Walsh 1.33.7-1 -- Update to upstream - * Patch from Dan Walsh to correctly suppress warnings in load_policy. - -* Tue Jan 2 2007 Dan Walsh 1.33.6-9 -- Fix fixfiles script to use tty command correctly. If this command fails, it -should set the LOGFILE to /dev/null -Resolves: #220879 - -* Wed Dec 20 2006 Dan Walsh 1.33.6-8 -- Remove hard coding of python2.4 from Makefiles - -* Tue Dec 19 2006 Dan Walsh 1.33.6-7 -- add exists switch to semanage to tell it not to check for existance of Linux user -Resolves: #219421 - -* Mon Dec 18 2006 Dan Walsh 1.33.6-6 -- Fix audit2allow generating reference policy -- Fix semanage to manage user roles properly -Resolves: #220071 - -* Fri Dec 8 2006 Dan Walsh 1.33.6-5 -- Update po files -- Fix newrole to open stdout and stderr rdrw so more will work on MLS machines -Resolves: #216920 - -* Thu Dec 7 2006 Jeremy Katz - 1.33.6-4 -- rebuild for python 2.5 - -* Wed Dec 6 2006 Dan Walsh 1.33.6-3 -- Update po files -Resolves: #216920 - -* Fri Dec 1 2006 Dan Walsh 1.33.6-2 -- Update po files -Resolves: #216920 - -* Wed Nov 29 2006 Dan Walsh 1.33.6-1 -- Update to upstream - * Patch from Dan Walsh to add an pam_acct_msg call to run_init - * Patch from Dan Walsh to fix error code returns in newrole - * Patch from Dan Walsh to remove verbose flag from semanage man page - * Patch from Dan Walsh to make audit2allow use refpolicy Makefile - in /usr/share/selinux/ - -* Wed Nov 29 2006 Dan Walsh 1.33.5-4 -- Fixing the Makefile line again to build with LSPP support -Resolves: #208838 - -* Wed Nov 29 2006 Dan Walsh 1.33.5-3 -- Don't report errors on restorecond when file system does not support XATTRS -Resolves: #217694 - -* Tue Nov 28 2006 Dan Walsh 1.33.5-2 -- Fix -q qualifier on load_policy -Resolves: #214827 - -* Tue Nov 28 2006 Dan Walsh 1.33.5-1 -- Merge to upstream -- Fix makefile line -Resolves: #208838 - -* Fri Nov 24 2006 Dan Walsh 1.33.4-2 -- Additional po changes -- Added all booleans definitions - -* Wed Nov 22 2006 Dan Walsh 1.33.4-1 -- Upstream accepted my patches - * Merged setsebool patch from Karl MacMillan. - This fixes a bug reported by Yuichi Nakamura with - always setting booleans persistently on an unmanaged system. - -* Mon Nov 20 2006 Dan Walsh 1.33.2-2 -- Fixes for the gui - -* Mon Nov 20 2006 Dan Walsh 1.33.2-1 -- Upstream accepted my patches - -* Fri Nov 17 2006 Dan Walsh 1.33.1-9 -- Add Amy Grifis Patch to preserve newrole exit status - -* Thu Nov 16 2006 Dan Walsh 1.33.1-8 -- Fix display of gui - -* Thu Nov 16 2006 Dan Walsh 1.33.1-7 -- Add patch by Jose Plans to make run_init use pam_acct_mgmt - -* Wed Nov 15 2006 Dan Walsh 1.33.1-6 -- More fixes to gui - -* Wed Nov 15 2006 Dan Walsh 1.33.1-5 -- Fix audit2allow to generate referene policy - -* Wed Nov 15 2006 Dan Walsh 1.33.1-4 -- Add group sort for portsPage.py -- Add enable/disableaudit to modules page - -* Wed Nov 15 2006 Dan Walsh 1.33.1-3 -- Add glade file - -* Tue Nov 14 2006 Dan Walsh 1.33.1-2 -- Fix Module handling in system-config-selinux - -* Tue Nov 14 2006 Dan Walsh 1.33.1-1 -- Update to upstream - * Merged newrole patch set from Michael Thompson. -- Add policycoreutils-gui - -* Thu Nov 9 2006 Dan Walsh 1.32-3 -- No longer requires rhpl - -* Mon Nov 6 2006 Dan Walsh 1.32-2 -- Fix genhomedircon man page - -* Mon Oct 9 2006 Dan Walsh 1.32-1 -- Add newrole audit patch from sgrubb -- Update to upstream - * Merged audit2allow -l fix from Yuichi Nakamura. - * Merged restorecon -i and -o - support from Karl MacMillan. - * Merged semanage/seobject fix from Dan Walsh. - * Merged fixfiles -R and verify changes from Dan Walsh. - -* Fri Oct 6 2006 Dan Walsh 1.30.30-2 -- Separate out newrole into its own package - -* Fri Sep 29 2006 Dan Walsh 1.30.30-1 -- Update to upstream - * Merged newrole auditing of failures due to user actions from - Michael Thompson. - -* Thu Sep 21 2006 Dan Walsh 1.30.29-6 -- Pass -i qualifier to restorecon for fixfiles -R -- Update translations - -* Thu Sep 21 2006 Dan Walsh 1.30.29-5 -- Remove recursion from fixfiles -R calls -- Fix semanage to verify prefix - -* Thu Sep 21 2006 Dan Walsh 1.30.29-4 -- More translations -- Compile with -pie - -* Mon Sep 18 2006 Dan Walsh 1.30.29-3 -- Add translations -- Fix audit2allow -l - -* Thu Sep 14 2006 Dan Walsh 1.30.29-2 -- Rebuild - -* Thu Sep 14 2006 Dan Walsh 1.30.29-1 -- Update to upstream -- Change -o to take "-" for stdout - -* Wed Sep 13 2006 Dan Walsh 1.30.28-9 -- Add -h support for genhomedircon - -* Wed Sep 13 2006 Dan Walsh 1.30.28-8 -- Fix fixfiles handling of -o - -* Mon Sep 11 2006 Dan Walsh 1.30.28-7 -- Make restorecon return the number of changes files if you use the -n flag - -* Fri Sep 8 2006 Dan Walsh 1.30.28-6 -- Change setfiles and restorecon to use stderr except for -o flag -- Also -o flag will now output files - -* Thu Sep 7 2006 Dan Walsh 1.30.28-5 -- Put back Erich's change - -* Wed Sep 6 2006 Dan Walsh 1.30.28-4 -- Remove recursive switch when using rpm - -* Wed Sep 6 2006 Dan Walsh 1.30.28-3 -- Fix fixfiles to handle multiple rpm and make -o work - -* Fri Sep 1 2006 Dan Walsh 1.30.28-2 -- Apply patch - -* Fri Sep 1 2006 Dan Walsh 1.30.28-1 -- Security fixes to run python in a more locked down manner -- More Translations -- Update to upstream - * Merged fix for restorecon // handling from Erich Schubert. - * Merged translations update and fixfiles fix from Dan Walsh. - -* Thu Aug 31 2006 Dan Walsh 1.30.27-5 -- Change scripts to use /usr/sbin/python - -* Thu Aug 31 2006 Dan Walsh 1.30.27-4 -- Add -i qualified to restorecon to tell it to ignore files that do not exist -- Fixfiles also modified for this change - -* Thu Aug 31 2006 Dan Walsh 1.30.27-3 -- Ignore sigpipe - -* Thu Aug 31 2006 Dan Walsh 1.30.27-2 -- Fix init script and add translations - -* Thu Aug 24 2006 Dan Walsh 1.30.27-1 -- Update to upstream - * Merged fix for restorecon symlink handling from Erich Schubert. - -* Sat Aug 12 2006 Dan Walsh 1.30.26-1 -- Update to upstream - * Merged semanage local file contexts patch from Chris PeBenito. -- Fix fixfiles log creation -- More translations - -* Thu Aug 3 2006 Dan Walsh 1.30.25-1 -- Update to upstream - * Merged patch from Dan Walsh with: - * audit2allow: process MAC_POLICY_LOAD events - * newrole: run shell with - prefix to start a login shell - * po: po file updates - * restorecond: bail if SELinux not enabled - * fixfiles: omit -q - * genhomedircon: fix exit code if non-root - * semodule_deps: install man page - * Merged secon Makefile fix from Joshua Brindle. - * Merged netfilter contexts support patch from Chris PeBenito. - -* Wed Aug 2 2006 Dan Walsh 1.30.22-3 -- Fix audit2allow to handle reload of policy - -* Wed Aug 2 2006 Dan Walsh 1.30.22-2 -- Stop restorecond init script when selinux is not enabled - -* Tue Aug 1 2006 Dan Walsh 1.30.22-1 -- Update to upstream - * Merged restorecond size_t fix from Joshua Brindle. - * Merged secon keycreate patch from Michael LeMay. - * Merged restorecond fixes from Dan Walsh. - Merged updated po files from Dan Walsh. - * Merged python gettext patch from Stephen Bennett. - * Merged semodule_deps from Karl MacMillan. - -* Thu Jul 27 2006 Dan Walsh 1.30.17-7 -- Change newrole to exec a login shell to prevent suspend. - -* Fri Jul 21 2006 Dan Walsh 1.30.17-6 -- Report error when selinux not enabled in restorecond - -* Tue Jul 18 2006 Dan Walsh 1.30.17-5 -- Fix handling of restorecond - -* Mon Jul 17 2006 Dan Walsh 1.30.17-4 -- Fix creation of restorecond pidfile - -* Mon Jul 17 2006 Dan Walsh 1.30.17-3 -- Update translations -- Update to new GCC - -* Mon Jul 10 2006 Dan Walsh 1.30.17-2 -- Add verbose flag to restorecond and update translations - -* Tue Jul 4 2006 Dan Walsh 1.30.17-1 -- Update to upstream - * Lindent. - * Merged patch from Dan Walsh with: - * -p option (progress) for setfiles and restorecon. - * disable context translation for setfiles and restorecon. - * on/off values for setsebool. - * Merged setfiles and semodule_link fixes from Joshua Brindle. - -* Thu Jun 22 2006 Dan Walsh 1.30.14-5 -- Add progress indicator on fixfiles/setfiles/restorecon - -* Wed Jun 21 2006 Dan Walsh 1.30.14-4 -- Don't use translations with matchpathcon - -* Tue Jun 20 2006 Dan Walsh 1.30.14-3 -- Prompt for selinux-policy-devel package in audit2allow - -* Mon Jun 19 2006 Dan Walsh 1.30.14-2 -- Allow setsebool to use on/off -- Update translations - -* Fri Jun 16 2006 Dan Walsh 1.30.14-1 -- Update to upstream - * Merged fix for setsebool error path from Serge Hallyn. - * Merged patch from Dan Walsh with: - * Updated po files. - * Fixes for genhomedircon and seobject. - * Audit message for mass relabel by setfiles. - -* Tue Jun 13 2006 James Antill 1.30.12-5 -- Update audit mass relabel to only compile in when audit is installed. - -* Mon Jun 12 2006 Dan Walsh 1.30.12-4 -- Update to required versions -- Update translation - -* Wed Jun 7 2006 Dan Walsh 1.30.12-3 -- Fix shell selection - -* Mon Jun 5 2006 Dan Walsh 1.30.12-2 -- Add BuildRequires for gettext - -* Mon Jun 5 2006 Dan Walsh 1.30.12-1 - * Updated fixfiles script for new setfiles location in /sbin. - -* Tue May 30 2006 Dan Walsh 1.30.11-1 -- Update to upstream - * Merged more translations from Dan Walsh. - * Merged patch to relocate setfiles to /sbin for early relabel - when /usr might not be mounted from Dan Walsh. - * Merged semanage/seobject patch to preserve fcontext ordering in list. - * Merged secon patch from James Antill. - -* Fri May 26 2006 Dan Walsh 1.30.10-4 -- Fix seobject.py to not sort the file_context file. -- move setfiles to /sbin - -* Wed May 24 2006 James Antill 1.30.10-3 -- secon man page and getopt fixes. -- Enable mass relabel audit, even though it doesn't work. - -* Wed May 24 2006 James Antill 1.30.10-2 -- secon fixes for --self-exec etc. -- secon change from level => sensitivity, add clearance. -- Add mass relabel AUDIT patch, but disable it until kernel problem solved. - -* Tue May 23 2006 Dan Walsh 1.30.10-1 -- Update to upstream - * Merged patch with updates to audit2allow, secon, genhomedircon, - and semanage from Dan Walsh. - -* Sat May 20 2006 Dan Walsh 1.30.9-4 -- Fix exception in genhomedircon - -* Mon May 15 2006 James Antill 1.30.9-3 -- Add rhpl dependancy - -* Mon May 15 2006 James Antill 1.30.9-2 -- Add secon man page and prompt options. - -* Mon May 15 2006 Dan Walsh 1.30.9-1 -- Update to upstream - * Fixed audit2allow and po Makefiles for DESTDIR= builds. - * Merged .po file patch from Dan Walsh. - * Merged bug fix for genhomedircon. - -* Wed May 10 2006 Dan Walsh 1.30.8-2 -- Fix exception on bad file_context - -* Mon May 8 2006 Dan Walsh 1.30.8-1 -- Update to upstream - * Merged fix warnings patch from Karl MacMillan. - * Merged patch from Dan Walsh. - This includes audit2allow changes for analysis plugins, - internationalization support for several additional programs - and added po files, some fixes for semanage, and several cleanups. - It also adds a new secon utility. - -* Sun May 7 2006 Dan Walsh 1.30.6-5 -- Fix genhomedircon to catch duplicate homedir problem - -* Thu May 4 2006 Dan Walsh 1.30.6-4 -- Add secon program -- Add translations - -* Thu Apr 20 2006 Dan Walsh 1.30.6-3 -- Fix check for "msg" - -* Mon Apr 17 2006 Dan Walsh 1.30.6-2 -- Ship avc.py - -* Fri Apr 14 2006 Dan Walsh 1.30.6-1 -- Add /etc/samba/secrets.tdb to restorecond.conf -- Update from upstream - * Merged semanage prefix support from Russell Coker. - * Added a test to setfiles to check that the spec file is - a regular file. - -* Thu Apr 06 2006 Karsten Hopp 1.30.4-4 -- added some missing buildrequires -- added Requires: initscripts for /sbin/service - -* Thu Apr 06 2006 Karsten Hopp 1.30.4-3 -- use absolute path /sbin/service - -* Wed Apr 5 2006 Dan Walsh 1.30.4-2 -- Fix audit2allow to not require ausearch. -- Fix man page -- Add libflashplayer to restorecond.conf - -* Wed Mar 29 2006 Dan Walsh 1.30.4-1 -- Update from upstream - * Merged audit2allow fixes for refpolicy from Dan Walsh. - * Merged fixfiles patch from Dan Walsh. - * Merged restorecond daemon from Dan Walsh. - * Merged semanage non-MLS fixes from Chris PeBenito. - * Merged semanage and semodule man page examples from Thomas Bleher. - -* Tue Mar 28 2006 Dan Walsh 1.30.1-4 -- Clean up reference policy generation in audit2allow - -* Tue Mar 21 2006 Dan Walsh 1.30.1-3 -- Add IN_MOVED_TO to catch renames - -* Tue Mar 21 2006 Dan Walsh 1.30.1-2 -- make restorecond only ignore non directories with lnk > 1 - -* Tue Mar 21 2006 Dan Walsh 1.30.1-1 -- Make audit2allow translate dontaudit as well as allow rules -- Update from upstream - * Merged semanage labeling prefix patch from Ivan Gyurdiev. - -* Tue Mar 21 2006 Dan Walsh 1.30-5 -- Fix audit2allow to retrieve dontaudit rules - -* Mon Mar 20 2006 Dan Walsh 1.30-4 -- Open file descriptor to make sure file does not change from underneath. - -* Fri Mar 17 2006 Dan Walsh 1.30-3 -- Fixes for restorecond attack via symlinks -- Fixes for fixfiles - -* Fri Mar 17 2006 Dan Walsh 1.30-2 -- Restorecon has to handle suspend/resume - -* Fri Mar 17 2006 Dan Walsh 1.30-1 -- Update to upstream - -* Fri Mar 10 2006 Dan Walsh 1.29.27-1 -- Add restorecond - -* Fri Mar 10 2006 Dan Walsh 1.29.26-6 -- Remove prereq - -* Mon Mar 6 2006 Dan Walsh 1.29.26-5 -- Fix audit2allow to generate all rules - -* Fri Mar 3 2006 Dan Walsh 1.29.26-4 -- Minor fixes to chcat and semanage - -* Fri Feb 24 2006 Dan Walsh 1.29.26-3 -- Add missing setsebool man page - -* Thu Feb 23 2006 Dan Walsh 1.29.26-2 -- Change audit2allow to use devel instead of refpolicy - -* Mon Feb 20 2006 Dan Walsh 1.29.26-1 -- Update from upstream - * Merged semanage bug fix patch from Ivan Gyurdiev. - * Merged improve bindings patch from Ivan Gyurdiev. - * Merged semanage usage patch from Ivan Gyurdiev. - * Merged use PyList patch from Ivan Gyurdiev. - -* Mon Feb 13 2006 Dan Walsh 1.29.23-1 -- Update from upstream - * Merged newrole -V/--version support from Glauber de Oliveira Costa. - * Merged genhomedircon prefix patch from Dan Walsh. - * Merged optionals in base patch from Joshua Brindle. - -* Fri Feb 10 2006 Jesse Keating - 1.29.20-2.1 -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Dan Walsh 1.29.20-2 -- Fix auditing to semanage -- Change genhomedircon to use new prefix interface in libselinux - -* Tue Feb 07 2006 Dan Walsh 1.29.20-1 -- Update from upstream - * Merged seuser/user_extra support patch to semodule_package - from Joshua Brindle. - * Merged getopt type fix for semodule_link/expand and sestatus - from Chris PeBenito. -- Fix genhomedircon output - -* Tue Feb 07 2006 Jesse Keating - 1.29.18-2.1 -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Fri Feb 3 2006 Dan Walsh 1.29.18-2 -- Add auditing to semanage - -* Thu Feb 2 2006 Dan Walsh 1.29.18-1 -- Update from upstream - * Merged clone record on set_con patch from Ivan Gyurdiev. - -* Mon Jan 30 2006 Dan Walsh 1.29.17-1 -- Update from upstream - * Merged genhomedircon fix from Dan Walsh. - * Merged seusers.system patch from Ivan Gyurdiev. - * Merged improve port/fcontext API patch from Ivan Gyurdiev. - * Merged genhomedircon patch from Dan Walsh. - -* Fri Jan 27 2006 Dan Walsh 1.29.15-1 -- Update from upstream - * Merged newrole audit patch from Steve Grubb. - * Merged seuser -> seuser local rename patch from Ivan Gyurdiev. - * Merged semanage and semodule access check patches from Joshua Brindle. -* Wed Jan 25 2006 Dan Walsh 1.29.12-1 -- Add a default of /export/home - -* Wed Jan 25 2006 Dan Walsh 1.29.11-3 -- Cleanup of the patch - -* Wed Jan 25 2006 Dan Walsh 1.29.11-2 -- Correct handling of symbolic links in restorecon - -* Wed Jan 25 2006 Dan Walsh 1.29.11-1 -- Added translation support to semanage -- Update from upstream - * Modified newrole and run_init to use the loginuid when - supported to obtain the Linux user identity to re-authenticate, - and to fall back to real uid. Dropped the use of the SELinux - user identity, as Linux users are now mapped to SELinux users - via seusers and the SELinux user identity space is separate. - * Merged semanage bug fixes from Ivan Gyurdiev. - * Merged semanage fixes from Russell Coker. - * Merged chcat.8 and genhomedircon patches from Dan Walsh. - -* Thu Jan 19 2006 Dan Walsh 1.29.9-2 -- Fix genhomedircon to work on MLS policy - -* Thu Jan 19 2006 Dan Walsh 1.29.9-1 -- Update to match NSA - * Merged chcat, semanage, and setsebool patches from Dan Walsh. - -* Thu Jan 19 2006 Dan Walsh 1.29.8-4 -- Fixes for "add"-"modify" error messages -- Fixes for chcat - -* Wed Jan 18 2006 Dan Walsh 1.29.8-3 -- Add management of translation file to semaange and seobject - -* Wed Jan 18 2006 Dan Walsh 1.29.8-2 -- Fix chcat -l -L to work while not root - -* Wed Jan 18 2006 Dan Walsh 1.29.8-1 -- Update to match NSA - * Merged semanage fixes from Ivan Gyurdiev. - * Merged semanage fixes from Russell Coker. - * Merged chcat, genhomedircon, and semanage diffs from Dan Walsh. - -* Tue Jan 17 2006 Dan Walsh 1.29.7-4 -- Update chcat to manage user categories also - -* Sat Jan 14 2006 Dan Walsh 1.29.7-3 -- Add check for root for semanage, genhomedircon - -* Sat Jan 14 2006 Dan Walsh 1.29.7-2 -- Add ivans patch - -* Fri Jan 13 2006 Dan Walsh 1.29.7-1 -- Update to match NSA - * Merged newrole cleanup patch from Steve Grubb. - * Merged setfiles/restorecon performance patch from Russell Coker. - * Merged genhomedircon and semanage patches from Dan Walsh. - * Merged remove add_local/set_local patch from Ivan Gyurdiev. - -* Tue Jan 10 2006 Dan Walsh 1.29.5-3 -- Fixes for mls policy - -* Tue Jan 10 2006 Dan Walsh 1.29.5-2 -- Update semanage and split out seobject -- Fix labeleing of home_root - -* Thu Jan 5 2006 Dan Walsh 1.29.5-1 -- Update to match NSA - * Added filename to semodule error reporting. - -* Thu Jan 5 2006 Dan Walsh 1.29.4-1 -- Update to match NSA - * Merged genhomedircon and semanage patch from Dan Walsh. - * Changed semodule error reporting to include argv[0]. - -* Wed Jan 4 2006 Dan Walsh 1.29.3-1 -- Update to match NSA - * Merged semanage getpwnam bug fix from Serge Hallyn (IBM). - * Merged patch series from Ivan Gyurdiev. - This includes patches to: - - cleanup setsebool - - update setsebool to apply active booleans through libsemanage - - update semodule to use the new semanage_set_rebuild() interface - - fix various bugs in semanage - * Merged patch from Dan Walsh (Red Hat). - This includes fixes for restorecon, chcat, fixfiles, genhomedircon, - and semanage. - -* Mon Jan 2 2006 Dan Walsh 1.29.2-10 -- Fix restorecon to not say it is changing user section when -vv is specified - -* Tue Dec 27 2005 Dan Walsh 1.29.2-9 -- Fixes for semanage, patch from Ivan and added a test script - -* Sat Dec 24 2005 Dan Walsh 1.29.2-8 -- Fix getpwnam call - -* Fri Dec 23 2005 Dan Walsh 1.29.2-7 -- Anaconda fixes - -* Thu Dec 22 2005 Dan Walsh 1.29.2-6 -- Turn off try catch block to debug anaconda failure - -* Tue Dec 20 2005 Dan Walsh 1.29.2-5 -- More fixes for chcat - -* Tue Dec 20 2005 Dan Walsh 1.29.2-4 -- Add try catch for files that may not exists - -* Mon Dec 19 2005 Dan Walsh 1.29.2-3 -- Remove commands from genhomedircon for installer - -* Wed Dec 14 2005 Dan Walsh 1.29.2-1 -- Fix genhomedircon to work in installer -- Update to match NSA - * Merged patch for chcat script from Dan Walsh. - -* Fri Dec 9 2005 Dan Walsh 1.29.1-2 -- More fixes to chcat - -* Fri Dec 09 2005 Jesse Keating -- rebuilt - -* Thu Dec 8 2005 Dan Walsh 1.29.1-1 -- Update to match NSA - * Merged fix for audit2allow long option list from Dan Walsh. - * Merged -r option for restorecon (alias for -R) from Dan Walsh. - * Merged chcat script and man page from Dan Walsh. - -* Wed Dec 7 2005 Dan Walsh 1.28-1 -- Update to match NSA -- Add gfs support - -* Wed Dec 7 2005 Dan Walsh 1.27.37-1 -- Update to match NSA -- Add chcat to policycoreutils, adding +/- syntax -` -* Tue Dec 6 2005 Dan Walsh 1.27.36-2 -- Require new version of libsemanage - -* Mon Dec 5 2005 Dan Walsh 1.27.36-1 -- Update to match NSA - * Changed genhomedircon to warn on use of ROLE in homedir_template - if using managed policy, as libsemanage does not yet support it. - -* Sun Dec 4 2005 Dan Walsh 1.27.35-1 -- Update to match NSA - * Merged genhomedircon bug fix from Dan Walsh. - * Revised semodule* man pages to refer to checkmodule and - to include example sections. - -* Thu Dec 1 2005 Dan Walsh 1.27.33-1 -- Update to match NSA - * Merged audit2allow --tefile and --fcfile support from Dan Walsh. - * Merged genhomedircon fix from Dan Walsh. - * Merged semodule* man pages from Dan Walsh, and edited them. - * Changed setfiles to set the MATCHPATHCON_VALIDATE flag to - retain validation/canonicalization of contexts during init. - -* Wed Nov 30 2005 Dan Walsh 1.27.31-1 -- Update to match NSA - * Changed genhomedircon to always use user_r for the role in the - managed case since user_get_defrole is broken. -- Add te file capabilities to audit2allow -- Add man pages for semodule - -* Tue Nov 29 2005 Dan Walsh 1.27.30-1 -- Update to match NSA - * Merged sestatus, audit2allow, and semanage patch from Dan Walsh. - * Fixed semodule -v option. - -* Mon Nov 28 2005 Dan Walsh 1.27.29-1 -- Update to match NSA - * Merged audit2allow python script from Dan Walsh. - (old script moved to audit2allow.perl, will be removed later). - * Merged genhomedircon fixes from Dan Walsh. - * Merged semodule quieting patch from Dan Walsh - (inverts default, use -v to restore original behavior). - -* Thu Nov 17 2005 Dan Walsh 1.27.28-3 -- Audit2allow - * Add more error checking - * Add gen policy package - * Add gen requires - -* Wed Nov 16 2005 Dan Walsh 1.27.28-2 -- Update to match NSA - * Merged genhomedircon rewrite from Dan Walsh. -- Rewrite audit2allow to python - -* Mon Nov 14 2005 Dan Walsh 1.27.27-5 -- Fix genhomedircon to work with non libsemanage systems - -* Fri Nov 11 2005 Dan Walsh 1.27.27-3 -- Patch genhomedircon to use libsemanage.py stuff - -* Wed Nov 9 2005 Dan Walsh 1.27.27-1 -- Update to match NSA - * Merged setsebool cleanup patch from Ivan Gyurdiev. - -* Wed Nov 9 2005 Dan Walsh 1.27.26-4 -- Fix genhomedircon to use seusers file, temporary fix until swigified semanage - -* Tue Nov 8 2005 Dan Walsh 1.27.26-1 - * Added -B (--build) option to semodule to force a rebuild. - * Reverted setsebool patch to call semanage_set_reload_bools(). - * Changed setsebool to disable policy reload and to call - security_set_boolean_list to update the runtime booleans. - * Changed setfiles -c to use new flag to set_matchpathcon_flags() - to disable context translation by matchpathcon_init(). - -* Tue Nov 8 2005 Dan Walsh 1.27.23-1 -- Update to match NSA - * Changed setfiles for the context canonicalization support. - * Changed setsebool to call semanage_is_managed() interface - and fall back to security_set_boolean_list() if policy is - not managed. - * Merged setsebool memory leak fix from Ivan Gyurdiev. - * Merged setsebool patch to call semanage_set_reload_bools() - interface from Ivan Gyurdiev. - -* Mon Nov 7 2005 Dan Walsh 1.27.20-1 -- Update to match NSA - * Merged setsebool patch from Ivan Gyurdiev. - This moves setsebool from libselinux/utils to policycoreutils, - and rewrites it to use libsemanage for permanent boolean changes. - -* Tue Oct 25 2005 Dan Walsh 1.27.19-2 -- Rebuild to use latest libselinux, libsemanage, and libsepol - -* Tue Oct 25 2005 Dan Walsh 1.27.19-1 -- Update to match NSA - * Merged semodule support for reload, noreload, and store options - from Joshua Brindle. - * Merged semodule_package rewrite from Joshua Brindle. - -* Thu Oct 20 2005 Dan Walsh 1.27.18-1 -- Update to match NSA - * Cleaned up usage and error messages and releasing of memory by - semodule utilities. - * Corrected error reporting by semodule. - * Updated semodule_expand for change to sepol interface. - * Merged fixes for make DESTDIR= builds from Joshua Brindle. - -* Tue Oct 18 2005 Dan Walsh 1.27.14-1 -- Update to match NSA - * Updated semodule_package for sepol interface changes. - -* Tue Oct 18 2005 Dan Walsh 1.27.13-1 -- Update to match NSA - * Updated semodule_expand/link for sepol interface changes. - -* Sat Oct 15 2005 Dan Walsh 1.27.12-1 -- Update to match NSA - * Merged non-PAM Makefile support for newrole and run_init from Timothy Wood. - -* Fri Oct 14 2005 Dan Walsh 1.27.11-1 -- Update to match NSA - * Updated semodule_expand to use get interfaces for hidden sepol_module_package type. - * Merged newrole and run_init pam config patches from Dan Walsh (Red Hat). - * Merged fixfiles patch from Dan Walsh (Red Hat). - * Updated semodule for removal of semanage_strerror. - - -* Thu Oct 13 2005 Dan Walsh 1.27.7-2 -- Fix run_init.pamd and spec file - -* Wed Oct 12 2005 Dan Walsh 1.27.7-1 -- Update to match NSA - * Updated semodule_link and semodule_expand to use shared libsepol. - Fixed audit2why to call policydb_init prior to policydb_read (still - uses the static libsepol). - -* Mon Oct 10 2005 Dan Walsh 1.27.6-1 -- Update to match NSA - * Updated for changes to libsepol. - Changed semodule and semodule_package to use the shared libsepol. - Disabled build of semodule_link and semodule_expand for now. - Updated audit2why for relocated policydb internal headers, - still needs to be converted to a shared lib interface. - -* Fri Oct 7 2005 Dan Walsh 1.27.5-3 -- Update newrole pam file to remove pam-stack -- Update run_init pam file to remove pam-stack - -* Thu Oct 6 2005 Dan Walsh 1.27.5-1 -- Update to match NSA - * Fixed warnings in load_policy. - * Rewrote load_policy to use the new selinux_mkload_policy() - interface provided by libselinux. - -* Wed Oct 5 2005 Dan Walsh 1.27.3-2 -- Rebuild with newer libararies - -* Wed Sep 28 2005 Dan Walsh 1.27.3-1 -- Update to match NSA - * Merged patch to update semodule to the new libsemanage API - and improve the user interface from Karl MacMillan (Tresys). - * Modified semodule for the create/connect API split. - -* Wed Sep 28 2005 Dan Walsh 1.27.2-2 -- More fixes to stop find from following nfs paths - -* Wed Sep 21 2005 Dan Walsh 1.27.2-1 -- Update to match NSA - * Merged run_init open_init_pty bug fix from Manoj Srivastava - (unblock SIGCHLD). Bug reported by Erich Schubert. - -* Tue Sep 20 2005 Dan Walsh 1.27.1-1 -- Update to match NSA - * Merged error shadowing bug fix for restorecon from Dan Walsh. - * Merged setfiles usage/man page update for -r option from Dan Walsh. - * Merged fixfiles -C patch to ignore :s0 addition on update - to a MCS/MLS policy from Dan Walsh. - -* Thu Sep 15 2005 Dan Walsh 1.26-3 -- Add chcat script for use with chcon. - -* Tue Sep 13 2005 Dan Walsh 1.26-2 -- Fix restorecon to exit with error code - -* Mon Sep 12 2005 Dan Walsh 1.26-1 - * Updated version for release. - -* Tue Sep 6 2005 Dan Walsh 1.25.9-2 -- Add prereq for mount command - -* Thu Sep 1 2005 Dan Walsh 1.25.9-1 -- Update to match NSA - * Changed setfiles -c to translate the context to raw format - prior to calling libsepol. - -* Fri Aug 26 2005 Dan Walsh 1.25.7-3 -- Use new version of libsemange and require it for install - -* Fri Aug 26 2005 Dan Walsh 1.25.7-2 -- Ignore s0 in file context - -* Thu Aug 25 2005 Dan Walsh 1.25.7-1 -- Update to match NSA - * Merged patch for fixfiles -C from Dan Walsh. - -* Tue Aug 23 2005 Dan Walsh 1.25.6-1 -- Update to match NSA - * Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM). - Bugs found by Coverity. - -* Mon Aug 22 2005 Dan Walsh 1.25.5-3 -- Fix fixfiles to call sort -u followed by sort -d. - -* Wed Aug 17 2005 Dan Walsh 1.25.5-2 -- Change fixfiles to ignore /home directory on updates - -* Fri Aug 5 2005 Dan Walsh 1.25.5-1 -- Update to match NSA - * Merged patch to move module read/write code from libsemanage - to libsepol from Jason Tang (Tresys). - -* Thu Jul 28 2005 Dan Walsh 1.25.4-1 -- Update to match NSA - * Changed semodule* to link with libsemanage. - -* Wed Jul 27 2005 Dan Walsh 1.25.3-1 -- Update to match NSA - * Merged restorecon patch from Ivan Gyurdiev. - -* Mon Jul 18 2005 Dan Walsh 1.25.2-1 -- Update to match NSA - * Merged load_policy, newrole, and genhomedircon patches from Red Hat. - -* Thu Jul 7 2005 Dan Walsh 1.25.1-1 -- Update to match NSA - * Merged loadable module support from Tresys Technology. - -* Wed Jun 29 2005 Dan Walsh 1.24-1 -- Update to match NSA - * Updated version for release. - -* Tue Jun 14 2005 Dan Walsh 1.23.11-4 -- Fix Ivan's patch for user role changes - -* Sat May 28 2005 Dan Walsh 1.23.11-3 -- Add Ivan's patch for user role changes in genhomedircon - -* Thu May 26 2005 Dan Walsh 1.23.11-2 -- Fix warning message on reload of booleans - - -* Fri May 20 2005 Dan Walsh 1.23.11-1 -- Update to match NSA - * Merged fixfiles and newrole patch from Dan Walsh. - * Merged audit2why man page from Dan Walsh. - -* Thu May 19 2005 Dan Walsh 1.23.10-2 -- Add call to pam_acct_mgmt in newrole. - -* Tue May 17 2005 Dan Walsh 1.23.10-1 -- Update to match NSA - * Extended audit2why to incorporate booleans and local user - settings when analyzing audit messages. - -* Mon May 16 2005 Dan Walsh 1.23.9-1 -- Update to match NSA - * Updated audit2why for sepol_ prefixes on Flask types to - avoid namespace collision with libselinux, and to - include now. - -* Fri May 13 2005 Dan Walsh 1.23.8-1 -- Fix fixfiles to accept -f -- Update to match NSA - * Added audit2why utility. - -* Fri Apr 29 2005 Dan Walsh 1.23.7-1 -- Change -f flag in fixfiles to remove stuff from /tmp -- Change -F flag to pass -F flag to restorecon/fixfiles. (IE Force relabel). - -* Thu Apr 14 2005 Dan Walsh 1.23.6-1 -- Update to match NSA - * Fixed signed/unsigned pointer bug in load_policy. - * Reverted context validation patch for genhomedircon. - -* Wed Apr 13 2005 Dan Walsh 1.23.5-1 -- Update to match NSA - * Reverted load_policy is_selinux_enabled patch from Dan Walsh. - Otherwise, an initial policy load cannot be performed using - load_policy, e.g. for anaconda. - - -* Mon Apr 11 2005 Dan Walsh 1.23.4-3 -- remove is_selinux_enabled check from load_policy (Bad idea) - -* Mon Apr 11 2005 Dan Walsh 1.23.4-1 -- Update to version from NSA - * Merged load_policy is_selinux_enabled patch from Dan Walsh. - * Merged restorecon verbose output patch from Dan Walsh. - * Merged setfiles altroot patch from Chris PeBenito. - -* Thu Apr 7 2005 Dan Walsh 1.23.3-2 -- Don't run load_policy on a non SELinux kernel. - -* Wed Apr 6 2005 Dan Walsh 1.23.3-1 -- Update to version from NSA - * Merged context validation patch for genhomedircon from Eric Paris. -- Fix verbose output of restorecon - -* Thu Mar 17 2005 Dan Walsh 1.23.2-1 -- Update to version from NSA - * Changed setfiles -c to call set_matchpathcon_flags(3) to - turn off processing of .homedirs and .local. - -* Tue Mar 15 2005 Dan Walsh 1.23.1-1 -- Update to released version from NSA - * Merged rewrite of genhomedircon by Eric Paris. - * Changed fixfiles to relabel jfs since it now supports security xattrs - (as of 2.6.11). Removed reiserfs until 2.6.12 is released with - fixed support for reiserfs and selinux. - -* Thu Mar 10 2005 Dan Walsh 1.22-2 -- Update to released version from NSA -- Patch genhomedircon to handle passwd in different places. - -* Wed Mar 9 2005 Dan Walsh 1.21.22-2 -- Fix genhomedircon to not put bad userad error in file_contexts.homedir - -* Tue Mar 8 2005 Dan Walsh 1.21.22-1 -- Cleanup error reporting - -* Tue Mar 1 2005 Dan Walsh 1.21.21-1 - * Merged load_policy and genhomedircon patch from Dan Walsh. - -* Mon Feb 28 2005 Dan Walsh 1.21.20-3 -- Fix genhomedircon to add extr "\n" - -* Fri Feb 25 2005 Dan Walsh 1.21.20-2 -- Fix genhomedircon to handle blank users - -* Fri Feb 25 2005 Dan Walsh 1.21.20-1 -- Update to latest from NSA -- Add call to libsepol - -* Thu Feb 24 2005 Dan Walsh 1.21.19-4 -- Fix genhomedircon to handle root -- Fix fixfiles to better handle file system types - -* Wed Feb 23 2005 Dan Walsh 1.21.19-2 -- Fix genhomedircon to handle spaces in SELINUXPOLICYTYPE - -* Tue Feb 22 2005 Dan Walsh 1.21.19-1 -- Update to latest from NSA - * Merged several fixes from Ulrich Drepper. - -* Mon Feb 21 2005 Dan Walsh 1.21.18-2 -- Apply Uli patch - * The Makefiles should use the -Wall option even if compiled in beehive - * Add -W, too - * use -Werror when used outside of beehive. This could also be used unconditionally - * setfiles/setfiles.c: fix resulting warning - * restorecon/restorecon.c: Likewise - * run_init/open_init_pty.c: argc hasn't been checked, the program would crash if -called without parameters. ignore the return value of nice properly. - * run_init: don't link with -ldl lutil - * load_policy: that's the bad bug. pointer to unsigned int is passed, size_t is -written to. fails on 64-bit archs - * sestatus: signed vs unsigned problem - * newrole: don't link with -ldl - -* Sat Feb 19 2005 Dan Walsh 1.21.18-1 -- Update to latest from NSA - * Changed load_policy to fall back to the original policy upon - an error from sepol_genusers(). - -* Thu Feb 17 2005 Dan Walsh 1.21.17-2 -- Only restorecon on ext[23], reiser and xfs - -* Thu Feb 17 2005 Dan Walsh 1.21.17-1 -- Update to latest from NSA - * Merged new genhomedircon script from Dan Walsh. - * Changed load_policy to call sepol_genusers(). - -* Thu Feb 17 2005 Dan Walsh 1.21.15-9 -- Remove Red Hat rhpl usage -- Add back in original syntax -- Update man page to match new syntax - -* Fri Feb 11 2005 Dan Walsh 1.21.15-8 -- Fix genhomedircon regular expression -- Fix exclude in restorecon - -* Thu Feb 10 2005 Dan Walsh 1.21.15-5 -- Trap failure on write -- Rewrite genhomedircon to generate file_context.homedirs -- several passes - -* Thu Feb 10 2005 Dan Walsh 1.21.15-1 -- Update from NSA - * Changed relabel Makefile target to use restorecon. - -* Wed Feb 9 2005 Dan Walsh 1.21.14-1 -- Update from NSA - * Merged restorecon patch from Dan Walsh. - -* Tue Feb 8 2005 Dan Walsh 1.21.13-1 -- Update from NSA - * Merged further change to fixfiles -C from Dan Walsh. - * Merged updated fixfiles script from Dan Walsh. -- Fix error handling of restorecon - - -* Mon Feb 7 2005 Dan Walsh 1.21.12-2 -- Fix sestatus for longer booleans - -* Wed Feb 2 2005 Dan Walsh 1.21.12-1 -- More cleanup of fixfiles sed patch - * Merged further patches for restorecon/setfiles -e and fixfiles -C. - -* Wed Feb 2 2005 Dan Walsh 1.21.10-2 -- More cleanup of fixfiles sed patch - -* Mon Jan 31 2005 Dan Walsh 1.21.10-1 -- More cleanup of fixfiles sed patch -- Upgrade to latest from NSA - * Merged patch for open_init_pty from Manoj Srivastava. - -* Fri Jan 28 2005 Dan Walsh 1.21.9-1 -- More cleanup of sed patch -- Upgrade to latest from NSA - * Merged updated fixfiles script from Dan Walsh. - * Merged updated man page for fixfiles from Dan Walsh and re-added unzipped. - * Reverted fixfiles patch for file_contexts.local; - obsoleted by setfiles rewrite. - * Merged error handling patch for restorecon from Dan Walsh. - * Merged semi raw mode for open_init_pty helper from Manoj Srivastava. - * Rewrote setfiles to use matchpathcon and the new interfaces - exported by libselinux (>= 1.21.5). - - -* Fri Jan 28 2005 Dan Walsh 1.21.7-3 -- Fix fixfiles patch -- Upgrade to latest from NSA - * Prevent overflow of spec array in setfiles. -- Add diff comparason between file_contexts to fixfiles -- Allow restorecon to give an warning on file not found instead of exiting - -* Thu Jan 27 2005 Dan Walsh 1.21.5-1 -- Upgrade to latest from NSA - * Merged newrole -l support from Darrel Goeddel (TCS). -- Fix genhomedircon STARTING_UID - -* Wed Jan 26 2005 Dan Walsh 1.21.4-1 -- Upgrade to latest from NSA - * Merged fixfiles patch for file_contexts.local from Dan Walsh. - -* Fri Jan 21 2005 Dan Walsh 1.21.3-2 -- Temp file needs to be created in /etc/selinux/POLICYTYPE/contexts/files/ directory. - -* Fri Jan 21 2005 Dan Walsh 1.21.3-1 -- Upgrade to latest from NSA - * Fixed restorecon to not treat errors from is_context_customizable() - as a customizable context. - * Merged setfiles/restorecon patch to not reset user field unless - -F option is specified from Dan Walsh. - * Merged open_init_pty helper for run_init from Manoj Srivastava. - * Merged audit2allow and genhomedircon man pages from Manoj Srivastava. - -* Fri Jan 21 2005 Dan Walsh 1.21.1-3 -- Don't change user componant if it is all that changed unless forced. -- Change fixfiles to concatinate file_context.local for setfiles - -* Thu Jan 20 2005 Dan Walsh 1.21.1-1 -- Update to latest from NSA - -* Mon Jan 10 2005 Dan Walsh 1.20.1-2 -- Fix restorecon segfault - -* Mon Jan 3 2005 Dan Walsh 1.20.1-1 -- Update to latest from NSA - * Merged fixfiles rewrite from Dan Walsh. - * Merged restorecon patch from Dan Walsh. - -* Mon Jan 3 2005 Dan Walsh 1.19.3-1 -- Update to latest from NSA - * Merged fixfiles and restorecon patches from Dan Walsh. - * Don't display change if only user part changed. - -* Mon Jan 3 2005 Dan Walsh 1.19.2-4 -- Fix fixfiles handling of rpm -- Fix restorecon to not warn on symlinks unless -v -v -- Fix output of verbose to show old context as well as new context - -* Wed Dec 29 2004 Dan Walsh 1.19.2-1 -- Update to latest from NSA - * Changed restorecon to ignore ENOENT errors from matchpathcon. - * Merged nonls patch from Chris PeBenito. - -* Mon Dec 20 2004 Dan Walsh 1.19.1-1 -- Update to latest from NSA - * Removed fixfiles.cron. - * Merged run_init.8 patch from Dan Walsh. - -* Thu Nov 18 2004 Dan Walsh 1.18.1-3 -- Fix run_init.8 to refer to correct location of initrc_context - -* Wed Nov 3 2004 Dan Walsh 1.18.1-1 -- Upgrade to latest from NSA - -* Wed Oct 27 2004 Steve Grubb 1.17.7-3 -- Add code to sestatus to output the current policy from config file - -* Fri Oct 22 2004 Dan Walsh 1.17.7-2 -- Patch audit2allow to return self and no brackets if only one rule - -* Fri Oct 22 2004 Dan Walsh 1.17.7-1 -- Update to latest from NSA -- Eliminate fixfiles.cron - -* Tue Oct 12 2004 Dan Walsh 1.17.6-2 -- Only run fixfiles.cron once a week, and eliminate null message - -* Fri Oct 1 2004 Dan Walsh 1.17.6-1 -- Update with NSA - * Added -l option to setfiles to log changes via syslog. - * Merged -e option to setfiles to exclude directories. - * Merged -R option to restorecon for recursive descent. -* Fri Oct 1 2004 Dan Walsh 1.17.5-6 -- Add -e (exclude directory) switch to setfiles -- Add syslog to setfiles - -* Fri Sep 24 2004 Dan Walsh 1.17.5-5 -- Add -R (recursive) switch to restorecon. - -* Thu Sep 23 2004 Dan Walsh 1.17.5-4 -- Change to only display to terminal if tty is specified - -* Tue Sep 21 2004 Dan Walsh 1.17.5-3 -- Only display to stdout if logfile not specified - -* Thu Sep 9 2004 Dan Walsh 1.17.5-2 -- Add Steve Grubb patch to cleanup log files. - -* Mon Aug 30 2004 Dan Walsh 1.17.5-1 -- Add optargs -- Update to match NSA - -* Wed Aug 25 2004 Dan Walsh 1.17.4-1 -- Add fix to get cdrom info from /proc/media in fixfiles. - -* Wed Aug 25 2004 Dan Walsh 1.17.3-4 -- Add Steve Grub patches for - * Fix fixfiles.cron MAILTO - * Several problems in sestatus - -* Wed Aug 25 2004 Dan Walsh 1.17.3-3 -- Add -q (quiet) qualifier to load_policy to not report warnings - -* Tue Aug 24 2004 Dan Walsh 1.17.3-2 -- Add requires for libsepol >= 1.1.1 - -* Tue Aug 24 2004 Dan Walsh 1.17.3-1 -- Update to latest from upstream - -* Mon Aug 23 2004 Dan Walsh 1.17.2-1 -- Update to latest from upstream -- Includes Colin patch for verifying file_contexts - -* Sun Aug 22 2004 Dan Walsh 1.17.1-1 -- Update to latest from upstream - -* Mon Aug 16 2004 Dan Walsh 1.15.7-1 -- Update to latest from upstream - -* Thu Aug 12 2004 Dan Walsh 1.15.6-1 -- Add Man page for load_policy - -* Tue Aug 10 2004 Dan Walsh 1.15.5-1 -- new version from NSA uses libsepol - -* Mon Aug 2 2004 Dan Walsh 1.15.3-2 -- Fix genhomedircon join command - -* Thu Jul 29 2004 Dan Walsh 1.15.3-1 -- Latest from NSA - -* Mon Jul 26 2004 Dan Walsh 1.15.2-4 -- Change fixfiles to not change when running a check - -* Tue Jul 20 2004 Dan Walsh 1.15.2-3 -- Fix restorecon getopt call to stop hang on IBM Arches - -* Mon Jul 19 2004 Dan Walsh 1.15.2-2 -- Only mail files less than 100 lines from fixfiles.cron -- Add Russell's fix for genhomedircon - -* Fri Jul 16 2004 Dan Walsh 1.15.2-1 -- Latest from NSA - -* Thu Jul 8 2004 Dan Walsh 1.15.1-2 -- Add ro warnings - -* Thu Jul 8 2004 Dan Walsh 1.15.1-1 -- Latest from NSA -- Fix fixfiles.cron to delete outfile - -* Tue Jul 6 2004 Dan Walsh 1.14.1-2 -- Fix fixfiles.cron to not run on non SELinux boxes -- Fix several problems in fixfiles and fixfiles.cron - -* Wed Jun 30 2004 Dan Walsh 1.14.1-1 -- Update from NSA -- Add cron capability to fixfiles - -* Fri Jun 25 2004 Dan Walsh 1.13.4-1 -- Update from NSA - -* Thu Jun 24 2004 Dan Walsh 1.13.3-2 -- Fix fixfiles to handle no rpm file on relabel - -* Wed Jun 23 2004 Dan Walsh 1.13.3-1 -- Update latest from NSA -- Add -o option to setfiles to save output of any files with incorrect context. - -* Tue Jun 22 2004 Dan Walsh 1.13.2-2 -- Add rpm support to fixfiles -- Update restorecon to add file input support - -* Fri Jun 18 2004 Dan Walsh 1.13.2-1 -- Update with NSA Latest - -* Tue Jun 15 2004 Elliot Lee -- rebuilt - -* Sat Jun 12 2004 Dan Walsh 1.13.1-2 -- Fix run_init to use policy formats - -* Wed Jun 2 2004 Dan Walsh 1.13.1-1 -- Update from NSA - -* Tue May 25 2004 Dan Walsh 1.13-3 -- Change location of file_context file - -* Tue May 25 2004 Dan Walsh 1.13-2 -- Change to use /etc/sysconfig/selinux to determine location of policy files - -* Fri May 21 2004 Dan Walsh 1.13-1 -- Update to latest from NSA -- Change fixfiles to prompt before deleteing /tmp files - -* Tue May 18 2004 Dan Walsh 1.12-2 -- have restorecon ingnore <> -- Hand matchpathcon the file status - -* Thu May 13 2004 Dan Walsh 1.12-1 -- Update to match NSA - -* Mon May 10 2004 Dan Walsh 1.11-4 -- Move location of log file to /var/tmp - -* Mon May 10 2004 Dan Walsh 1.11-3 -- Better grep command for bind - -* Fri May 7 2004 Dan Walsh 1.11-2 -- Eliminate bind and context mounts - -* Wed May 5 2004 Dan Walsh 1.11-1 -- update to match NSA - -* Wed Apr 28 2004 Dan Walsh 1.10-4 -- Log fixfiles to the /tmp directory - -* Wed Apr 21 2004 Colin Walters 1.10-3 -- Add patch to fall back to authenticating via uid if - the current user's SELinux user identity is the default - identity -- Add BuildRequires pam-devel - -* Mon Apr 12 2004 Dan Walsh 1.10-2 -- Add man page, thanks to Richard Halley - -* Thu Apr 8 2004 Dan Walsh 1.10-1 -- Upgrade to latest from NSA - -* Fri Apr 2 2004 Dan Walsh 1.9.2-1 -- Update with latest from gentoo and NSA - -* Thu Apr 1 2004 Dan Walsh 1.9.1-1 -- Check return codes in sestatus.c - -* Mon Mar 29 2004 Dan Walsh 1.9-19 -- Fix sestatus to not double free -- Fix sestatus.conf to be unix format - -* Mon Mar 29 2004 Dan Walsh 1.9-18 -- Warn on setfiles failure to relabel. - -* Mon Mar 29 2004 Dan Walsh 1.9-17 -- Updated version of sestatus - -* Mon Mar 29 2004 Dan Walsh 1.9-16 -- Fix fixfiles to checklabel properly - -* Fri Mar 26 2004 Dan Walsh 1.9-15 -- add sestatus - -* Thu Mar 25 2004 Dan Walsh 1.9-14 -- Change free call to freecon -- Cleanup - -* Tue Mar 23 2004 Dan Walsh 1.9-12 -- Remove setfiles-assoc patch -- Fix restorecon to not crash on missing dir - -* Thu Mar 18 2004 Dan Walsh 1.9-11 -- Eliminate trailing / in restorecon - -* Thu Mar 18 2004 Dan Walsh 1.9-10 -- Add Verbosity check - -* Thu Mar 18 2004 Dan Walsh 1.9-9 -- Change restorecon to not follow symlinks. It is too difficult and confusing -- to figure out the file context for the file pointed to by a symlink. - -* Wed Mar 17 2004 Dan Walsh 1.9-8 -- Fix restorecon -* Wed Mar 17 2004 Dan Walsh 1.9-7 -- Read restorecon patch - -* Wed Mar 17 2004 Dan Walsh 1.9-6 -- Change genhomedircon to take POLICYSOURCEDIR from command line - -* Wed Mar 17 2004 Dan Walsh 1.9-5 -- Add checkselinux -- move fixfiles and restorecon to /sbin - -* Wed Mar 17 2004 Dan Walsh 1.9-4 -- Restore patch of genhomedircon - -* Mon Mar 15 2004 Dan Walsh 1.9-3 -- Add setfiles-assoc patch to try to freeup memory use - -* Mon Mar 15 2004 Dan Walsh 1.9-2 -- Add fixlabels - -* Mon Mar 15 2004 Dan Walsh 1.9-1 -- Update to latest from NSA - -* Wed Mar 10 2004 Dan Walsh 1.6-8 -- Increase the size of buffer accepted by setfiles to BUFSIZ. - -* Tue Mar 9 2004 Dan Walsh 1.6-7 -- genhomedircon should complete even if it can't read /etc/default/useradd - -* Tue Mar 9 2004 Dan Walsh 1.6-6 -- fix restorecon to relabel unlabled files. - -* Fri Mar 5 2004 Dan Walsh 1.6-5 -- Add genhomedircon from tresys -- Fixed patch for restorecon - -* Thu Feb 26 2004 Dan Walsh 1.6-4 -- exit out when selinux is not enabled - -* Thu Feb 26 2004 Dan Walsh 1.6-3 -- Fix minor bugs in restorecon - -* Thu Feb 26 2004 Dan Walsh 1.6-2 -- Add restorecon c program - -* Tue Feb 24 2004 Dan Walsh 1.6-1 -- Update to latest tarball from NSA - -* Thu Feb 19 2004 Dan Walsh 1.4-9 -- Add sort patch - -* Fri Feb 13 2004 Elliot Lee -- rebuilt - -* Thu Jan 29 2004 Dan Walsh 1.4-7 -- remove mods to run_init since init scripts don't require it anymore - -* Wed Jan 28 2004 Dan Walsh 1.4-6 -- fix genhomedircon not to return and error - -* Wed Jan 28 2004 Dan Walsh 1.4-5 -- add setfiles quiet patch - -* Tue Jan 27 2004 Dan Walsh 1.4-4 -- add checkcon to verify context match file_context - -* Wed Jan 7 2004 Dan Walsh 1.4-3 -- fix command parsing restorecon - -* Tue Jan 6 2004 Dan Walsh 1.4-2 -- Add restorecon - -* Sat Dec 6 2003 Dan Walsh 1.4-1 -- Update to latest NSA 1.4 - -* Tue Nov 25 2003 Dan Walsh 1.2-9 -- Change run_init.console to run as run_init_t - -* Tue Oct 14 2003 Dan Walsh 1.2-8 -- Remove dietcc since load_policy is not in mkinitrd -- Change to use CONSOLEHELPER flag - -* Tue Oct 14 2003 Dan Walsh 1.2-7 -- Don't authenticate run_init when used with consolehelper - -* Wed Oct 01 2003 Dan Walsh 1.2-6 -- Add run_init consolehelper link - -* Wed Sep 24 2003 Dan Walsh 1.2-5 -- Add russell spead up patch to deal with file path stems - -* Fri Sep 12 2003 Dan Walsh 1.2-4 -- Build load_policy with diet gcc in order to save space on initrd - -* Fri Sep 12 2003 Dan Walsh 1.2-3 -- Update with NSA latest - -* Thu Aug 7 2003 Dan Walsh 1.2-1 -- remove i18n -- Temp remove gtk support - -* Thu Aug 7 2003 Dan Walsh 1.1-4 -- Remove wnck requirement - -* Thu Aug 7 2003 Dan Walsh 1.1-3 -- Add gtk support to run_init - -* Tue Aug 5 2003 Dan Walsh 1.1-2 -- Add internationalization - -* Mon Jun 2 2003 Dan Walsh 1.0-1 -- Initial version +%autochangelog From b91c86874b3ac5651b0519a87dbe44d0a51ebb1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 13:47:32 +0200 Subject: [PATCH 53/79] Rebuilt for the bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index b05ec3e..f159727 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.7 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz @@ -446,4 +446,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 3.7-2 +- Rebuilt for the bin-sbin merge + %autochangelog From 345af02a21b70c0609cc0051c6080421c87c01bf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 08:13:40 +0000 Subject: [PATCH 54/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index f159727..e38ebed 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.7 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz @@ -446,6 +446,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 3.7-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 3.7-2 - Rebuilt for the bin-sbin merge From 07240ecb026fe9603cc0eaa152d5340ada32e0bb Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 20 Aug 2024 11:02:43 +0200 Subject: [PATCH 55/79] sepolgen-ifgen: allow M4 escaped filenames When a file name in type transition rule used in an interface is same as a keyword, it needs to be M4 escaped so that the keyword is not expanded by M4, e.g. - filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface") + filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''") But sepolgen-ifgen could not parse such string: # sepolgen-ifgen Illegal character '`' This change allows M4 escaping inside quoted strings and fixed described problem. https://bugzilla.redhat.com/show_bug.cgi?id=2254206 --- ...gen-ifgen-allow-M4-escaped-filenames.patch | 44 +++++++++++++++++++ changelog | 9 ++++ policycoreutils.spec | 9 +--- 3 files changed, 55 insertions(+), 7 deletions(-) create mode 100644 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch new file mode 100644 index 0000000..7468c97 --- /dev/null +++ b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch @@ -0,0 +1,44 @@ +From dc3eca6bd964e545fda4a1e19d07c26a347c5d9a Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 19 Aug 2024 19:51:51 +0200 +Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames +Content-type: text/plain + +When a file name in type transition rule used in an interface is same as +a keyword, it needs to be M4 escaped so that the keyword is not expanded +by M4, e.g. + +- filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface") ++ filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''") + +But sepolgen-ifgen could not parse such string: + + # sepolgen-ifgen + Illegal character '`' + +This change allows M4 escaping inside quoted strings and fixed described +problem. + +https://bugzilla.redhat.com/show_bug.cgi?id=2254206 + +Signed-off-by: Petr Lautrbach +--- + python/sepolgen/src/sepolgen/refparser.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py +index e261d3f78f87..9622ee9a29ce 100644 +--- a/python/sepolgen/src/sepolgen/refparser.py ++++ b/python/sepolgen/src/sepolgen/refparser.py +@@ -261,7 +261,7 @@ def t_IDENTIFIER(t): + return t + + def t_FILENAME(t): +- r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"' ++ r'\"`*[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\'*\"' + # Handle any keywords + t.type = reserved.get(t.value,'FILENAME') + return t +-- +2.46.0 + diff --git a/changelog b/changelog index 16332d6..250c934 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,12 @@ +* Tue Aug 20 2024 Petr Lautrbach - 3.7-4 +- sepolgen-ifgen: allow M4 escaped filenames + +* Fri Jul 19 2024 Fedora Release Engineering - 3.7-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 3.7-2 +- Rebuilt for the bin-sbin merge + * Thu Jun 27 2024 Petr Lautrbach - 3.7-1 - SELinux userspace 3.7 release diff --git a/policycoreutils.spec b/policycoreutils.spec index e38ebed..8c3dfa7 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.7 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz @@ -43,6 +43,7 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -446,10 +447,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Jul 19 2024 Fedora Release Engineering - 3.7-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 3.7-2 -- Rebuilt for the bin-sbin merge - %autochangelog From f08722bf2a6f700455807cb40c93becc8d989adc Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 13 Nov 2024 18:17:15 +0100 Subject: [PATCH 56/79] fixfiles: use `grep -F` when search in mounts (bz#2323728) --- ...les-use-grep-F-when-search-in-mounts.patch | 59 +++++++++++++++++++ policycoreutils.spec | 1 + 2 files changed, 60 insertions(+) create mode 100644 0007-fixfiles-use-grep-F-when-search-in-mounts.patch diff --git a/0007-fixfiles-use-grep-F-when-search-in-mounts.patch b/0007-fixfiles-use-grep-F-when-search-in-mounts.patch new file mode 100644 index 0000000..b36d220 --- /dev/null +++ b/0007-fixfiles-use-grep-F-when-search-in-mounts.patch @@ -0,0 +1,59 @@ +From 23e9ed5aa00cab872ad18f492eab25af464885b4 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 13 Nov 2024 12:20:32 +0100 +Subject: [PATCH] fixfiles: use `grep -F` when search in mounts +Content-type: text/plain + +systemd escapes luks uid so that mount points contain '\' and grep +should not consider this as regexp +Fixes: + $ cat /proc/self/mounts | sort | uniq | awk '{print $2}' + /run/credentials/systemd-cryptsetup@luks\134x2d6d1f41e6\134x2d5538\134x2d41a0\134x2db383\134x2cd41c2ddcacaa.service + + $ sudo fixfiles -B onboot + grep: Invalid back reference + grep: Invalid back reference + System will relabel on next boot + +Suggested-by: Christopher Tubbs +Signed-off-by: Petr Lautrbach +--- + policycoreutils/scripts/fixfiles | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles +index 13ac07414c14..f2518e96e34c 100755 +--- a/policycoreutils/scripts/fixfiles ++++ b/policycoreutils/scripts/fixfiles +@@ -45,9 +45,9 @@ FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" + for i in $FS; do + if [ `useseclabel` -ge 0 ] + then +- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i ++ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i + else +- grep " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i ++ grep -F " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i + fi + done + } +@@ -55,14 +55,14 @@ done + get_rw_labeled_mounts() { + FS=`get_all_labeled_mounts | sort | uniq` + for i in $FS; do +- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i ++ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i + done + } + + get_ro_labeled_mounts() { + FS=`get_all_labeled_mounts | sort | uniq` + for i in $FS; do +- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i ++ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i + done + } + +-- +2.47.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 8c3dfa7..128aa2e 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -44,6 +44,7 @@ Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch +Patch0007: 0007-fixfiles-use-grep-F-when-search-in-mounts.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 2265bc4616a0cdd2ceb56fcdd618eee7befba428 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 13 Nov 2024 18:23:46 +0100 Subject: [PATCH 57/79] policycoreutils-3.7-5 - fixfiles: use `grep -F` when search in mounts (bz#2323728) [skip changelog] --- changelog | 3 +++ policycoreutils.spec | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/changelog b/changelog index 250c934..69ae898 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Nov 13 2024 Petr Lautrbach - 3.7-5 +- fixfiles: use `grep -F` when search in mounts (bz#2323728) + * Tue Aug 20 2024 Petr Lautrbach - 3.7-4 - sepolgen-ifgen: allow M4 escaped filenames diff --git a/policycoreutils.spec b/policycoreutils.spec index 128aa2e..bcded22 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.7 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz From 1959cc983fc2598d5032c85c70849ef5ef94842b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 28 Nov 2024 21:58:25 +0100 Subject: [PATCH 58/79] SELinux userspace 3.8-rc1 release --- .gitignore | 2 + ...t-be-verbose-if-you-are-not-on-a-tty.patch | 6 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 4 +- 0004-Use-SHA-2-instead-of-SHA-1.patch | 4 +- ...-sepolicy-Fix-spec-file-dependencies.patch | 4 +- ...gen-ifgen-allow-M4-escaped-filenames.patch | 4 +- ...les-use-grep-F-when-search-in-mounts.patch | 59 --------- bachradsusi.gpg | 121 +++++++++++++++++- policycoreutils.spec | 21 +-- sources | 4 +- 11 files changed, 147 insertions(+), 86 deletions(-) delete mode 100644 0007-fixfiles-use-grep-F-when-search-in-mounts.patch diff --git a/.gitignore b/.gitignore index 1b551bf..ddc70f1 100644 --- a/.gitignore +++ b/.gitignore @@ -357,3 +357,5 @@ policycoreutils-2.0.83.tgz /selinux-3.6.tar.gz /selinux-3.7.tar.gz /selinux-3.7.tar.gz.asc +/selinux-3.8-rc1.tar.gz +/selinux-3.8-rc1.tar.gz.asc diff --git a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index aaea883..e319d1d 100644 --- a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 7030465cd94d22aef6824e46df69f82b256195c8 Mon Sep 17 00:00:00 2001 +From 12f57453e8b53a8aab6d3581fd1a4c921fe36918 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index cb50fef3ca65..13ac07414c14 100755 +index b7cd765c15e4..f2518e96e34c 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { @@ -21,5 +21,5 @@ index cb50fef3ca65..13ac07414c14 100755 THREADS="" RPMFILES="" -- -2.44.0 +2.47.0 diff --git a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch index 1ff3536..996113f 100644 --- a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From 856ac05345d8557a38e82d012a4d13b4d34efd6f Mon Sep 17 00:00:00 2001 +From fb7357cd097801fcdfa21ed49a17a3875db05e42 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index adf65f27a822..f726ad51b775 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.44.0 +2.47.0 diff --git a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 91b36be..9c77d93 100644 --- a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 8f7a90cb77a79aaef2ceca75bc25679a7b17ff98 Mon Sep 17 00:00:00 2001 +From f2092a1b859a028f2c5c79b41c70b135ba3ad0fa Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -71,5 +71,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644 if [ -z "$WAYLAND_DISPLAY" ]; then DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -- -2.44.0 +2.47.0 diff --git a/0004-Use-SHA-2-instead-of-SHA-1.patch b/0004-Use-SHA-2-instead-of-SHA-1.patch index 96f6d1d..bcebe4f 100644 --- a/0004-Use-SHA-2-instead-of-SHA-1.patch +++ b/0004-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 4884c917237e53e34d3fc75dcf4f07217cfd7584 Mon Sep 17 00:00:00 2001 +From 4780b755bb1171f5aa4cd7545535839d451a2070 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644 and provided the .B \-n -- -2.44.0 +2.47.0 diff --git a/0005-python-sepolicy-Fix-spec-file-dependencies.patch b/0005-python-sepolicy-Fix-spec-file-dependencies.patch index ff76509..27f1ea1 100644 --- a/0005-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0005-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,4 +1,4 @@ -From cb1b3bdca016edaa90e92b49d51544f8a38cba19 Mon Sep 17 00:00:00 2001 +From 7e8d67e63daebd675284afaf98aa07530659272f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies @@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644 mid_section="""\ -- -2.44.0 +2.47.0 diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch index 7468c97..1149167 100644 --- a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch +++ b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch @@ -1,4 +1,4 @@ -From dc3eca6bd964e545fda4a1e19d07c26a347c5d9a Mon Sep 17 00:00:00 2001 +From d95931cc190b18e9c405e19dccfa6290269a84df Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 19 Aug 2024 19:51:51 +0200 Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames @@ -40,5 +40,5 @@ index e261d3f78f87..9622ee9a29ce 100644 t.type = reserved.get(t.value,'FILENAME') return t -- -2.46.0 +2.47.0 diff --git a/0007-fixfiles-use-grep-F-when-search-in-mounts.patch b/0007-fixfiles-use-grep-F-when-search-in-mounts.patch deleted file mode 100644 index b36d220..0000000 --- a/0007-fixfiles-use-grep-F-when-search-in-mounts.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 23e9ed5aa00cab872ad18f492eab25af464885b4 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 13 Nov 2024 12:20:32 +0100 -Subject: [PATCH] fixfiles: use `grep -F` when search in mounts -Content-type: text/plain - -systemd escapes luks uid so that mount points contain '\' and grep -should not consider this as regexp -Fixes: - $ cat /proc/self/mounts | sort | uniq | awk '{print $2}' - /run/credentials/systemd-cryptsetup@luks\134x2d6d1f41e6\134x2d5538\134x2d41a0\134x2db383\134x2cd41c2ddcacaa.service - - $ sudo fixfiles -B onboot - grep: Invalid back reference - grep: Invalid back reference - System will relabel on next boot - -Suggested-by: Christopher Tubbs -Signed-off-by: Petr Lautrbach ---- - policycoreutils/scripts/fixfiles | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 13ac07414c14..f2518e96e34c 100755 ---- a/policycoreutils/scripts/fixfiles -+++ b/policycoreutils/scripts/fixfiles -@@ -45,9 +45,9 @@ FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" - for i in $FS; do - if [ `useseclabel` -ge 0 ] - then -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i - else -- grep " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i -+ grep -F " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i - fi - done - } -@@ -55,14 +55,14 @@ done - get_rw_labeled_mounts() { - FS=`get_all_labeled_mounts | sort | uniq` - for i in $FS; do -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i - done - } - - get_ro_labeled_mounts() { - FS=`get_all_labeled_mounts | sort | uniq` - for i in $FS; do -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i - done - } - --- -2.47.0 - diff --git a/bachradsusi.gpg b/bachradsusi.gpg index ff4e382..aa060bb 100644 --- a/bachradsusi.gpg +++ b/bachradsusi.gpg @@ -316,6 +316,123 @@ kAIi0B1szn0K13qRqBIwjnWL+orP1KLzvczCH6yD0FZY90CDdMtM0VB6AqT4BFh6 5+ygjA4YiA7fFYBm8510ybUcNfzU3gUIJ5pF8MdGizO54tCPSK6U+iVRY4qfCFdu IiOZ7FUUn78VIxQUMYMrozy7kn/0PQZa7KKRbXJ8sg0sgrQapwpgUjdMwuYZPGGv 1Jw5/+WUGWMbGxmlpHcEOmsPZpITH557M/kHyk9Ud0iKwciBI2mGLxiafCuLrUY4 -TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfg== -=I8Dr +TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfpkCDQRnKRF7ARAAo5H9/6cStbyjWFeb +G6qDn6pT+4v1rlbRZo0rYwWkDmEAjOZMRC9SJipTCdQeNFlv6HEiiCvl3bmZIqrZ ++zvLI6U1+2dH7k06xNqIFLTV0zbr+tUkOwspg5nr59KsuNP01WBS0ELzunO/zHj+ +BOEdPg1KvB0IQFtqAwaAfuny67YvTr9O7Yz07ZCfTxPtHf6FJ80FPeRa0LoZYnW4 +UmSGtm1f59VD9+qe4yhRtNanamXUKjf8BTw0rQwjoJhVT5Mg0Z6hW6fhFrD57Lgd +8fBi5ZHHUlR4z1+nqGCUoHlHjc0JVyK8j8fofKafow/79ITaOqBzv+P3psY9ecBg +7wGaOHrqzRzRxAfKYRO2IaFHRGnsEE8FnwSEL00uPVxpiiTavrLJFEjku9GmP3OY +3rbwIPXbw1m9mZG1yAVbSEEf58WSWeoBp0O6qrwAdIbdgUX4BkQ8bX5MtUjXp5tm +0StmjQiZ7O91cg0VuWtrfj/I4E3xtloNzhtG2QLI4s7iAL1orhClxEuZRO9alUCS +cnRvhmw2Dh6sB6i56evcZdUFwxMXOByxfWr0fxX4QlR8jYqMPj7UMNj2PccTBOQX +umIW2cdGEeni9vrE9cLfZRSNCwPWAXWtr1zQW54Jx5DjCGHobQk53Z7kE+MZVAje +gOaT0u50cljBNfJootuln4+gbGMAEQEAAbQlUGV0ciBMYXV0cmJhY2ggPGxhdXRy +YmFjaEByZWRoYXQuY29tPokCVwQTAQgAQRYhBGjSGCM0KhNoOus+TvtMaFtdwcE+ +BQJnKRF7AhsDBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEPtM +aFtdwcE+doMQAI5mnNA8aH0dfeOZnz/NrMwY6H7jK/+lYatCx05e1TfK+zz9feRK +sxgP3Pjj0p9igo3jIdPcN5/YnlmVEeplDmSiKOOdendviy+sA8sukMo07Q+m1pYW +NzFtyiZd+c44mp9I1l7h6rktIY9XDedrlAkNog1VlUet9eNpmgXt2OmJNDmYftWc +KIpyw/ZLaubjRcAmxwsn7I6dWnT66Ffg9H8trcRlWipVWP8imO0EIpwC8RbhuNgk +xjt/cVf3CEpzokF4n0k3nqYmt90NNtGc0kG5QAlTvlUuHpNWzuzvdAPtMy3KEaXI +fu3IEZeIKCxSgWXTm7zRKUn0F6jKAsLXhK/WOA1Aa7NdAUwMxrEndfNoqBrusaLD +lpzWU7USv2YT+Pf3aQ7u1szg2J8V5eqRP+E8wwe54RNCgQrcDgUq5abyncsvull3 +GqJvzvZC7/Q3Th/g5Wc+dRaGBz0O9FBuRPQwjrnB932xW1fDf17cScpVKAvV/jwn +tpWXf7nSv2M0o9fihnTBl4d2c2EBKtTdp5W0IpeRl5uLad3AYoouP6RoZ+/Id/Zg +NeaQKH/ZlCxk5S9GLzYhm665ysOYRkh7NfoThRtvAqAeDcTKWGDG1nQok2KKOSyq +S81PT2AlMz7A26R0vsH/9lQ1uZFIhIGbxZXlGERZwXd1s+lgfWTbB5K+iQIzBBAB +CAAdFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmcpGAUACgkQvDkF8jUXnPFdGQ/+ +L7uA7EMB+Yh0urhZuOltZSNtge6b+UbLZTd8DRsf044e+Z0NJWdQ2saLBptGhIcn +as4Qd0gS+QkWB7lMrJ31uux15ZBjFsGtyqK+VoH8JIPvV8Mr5XojqA+UYUpXP6ns +ILrdkUvNzpeA51IxYuVMWcut8SUVYzjD11YG1P8LFzydsImaYe7se+RE85F3/2Po +kZNe0d0Gh36uyfJSND80XrrxLpROgabQgHNG0drL/DHjdoa3F0V5EUoG7NBwUrmB +RlWKYCLUFfW+8mQn6RVK8JIV9WaHrzi/KAZLonZb5dCjO0e+Ol16pyUofLA8SN7B +aqjens8ho297GtE3darkXmj5p3p4YPur/D+oZCNIH+BYMsht46VtE3v6V10P8KA2 +6MgNo5qME1Q0kC1DUYi68cPeDgrQBMWa+nF+m9i2aGeAyi3qDhZu03JLhOYAhv45 +OVRawm9vFqyKiBRANVogTRr+ch4zywaapwfVLQ+xiwVLqlT5n/iIzWCQ0hA15eKZ +gJV0kTXL4OWKBeJqSNnnLVm4AhZ2OpKHMsjE7BEopvCe9JZWFIrjtQ9TrriByOx0 +3anWkmm7b4lZ1HKDOI/Cxyz8BZvYizo7hSOdGjLrFBTD/Wk0swvpzB4NKh5I6N7k +gppXMTaWp36+KmQx66JzaZjepGl1VMNFdgiP6Sw6pO+5Ag0EZykRewEQAK4EY+06 +GeuX4wLlUqAMWCnbFELuhBZGWFLEIvP6WJS1WOvee45RVcpVfYMp3AqymiNRahAl +RMtSQ9YtXSdlBPkhtNcoV/hqjcNywMdbsy+Rs27pRk/DJVC0yVL4ABrSSlwhfNa4 +6X4ZvPr8GGDvjAUhK6NXQ7WrZJxYR9/U0nqRGtGuPBLhFey1H60n5axP8+2f9pFC +NbDJ13HbrhVju+RUeE8Gq5WJI5dea5SfYnXFERsT/zO+pw7ZaaSDmWKR1a88P6Bk +DD7e63ZIaAa849M/Dz+OgzNEgbyRjvgbO0OEIrS2x61lGoW7F9prEgzj97NIiBu6 +qpNCYJefkpfPENrk+wmOUthJfh6E7uphlliQams6dqXAc3Z+xBN9jFf74RpzVmIP +K/MFNr0EcUMFgURpBtaTrk4dGMh++v5i4qKxxwJHf4RsGCDsgH9ZZDemKz5q8uFN +TI1kbTnsKNt+d7L45U+3/mRm4l22g8eu+AvD6R4GfKjsyzEFCyGK7TmVYj0Y+EGR +9+YbRQ1GahXqtrR/aLC09LSyxQTqYfKU8KusnoceEbBOigEZUNPybpzibwHl1VEV +9crR5eT8MPHgs8xdpjQ7gRuPi12fvc83unpUsNIHSCxZqXoilGsz2+zpX2si3PxB +tK/tTo6ZFRLijhHs250Y1agp4MyXYq91A2VTABEBAAGJAjwEGAEIACYWIQRo0hgj +NCoTaDrrPk77TGhbXcHBPgUCZykRewIbDAUJA8JnAAAKCRD7TGhbXcHBPozGD/0Y +fkktGwGq2vPZUI/Fscv+VnEqVt94dBnS0/6GyYvhI7Tf81v+72URlQeX8TUQox9B +8d3Aru5b2+iSkPcvH70PbY8jt/yTwHtSlFzf6+YPIl+oyTz7DoiILSjrO51ntl8g +KmIb8Q9W74xV6VFIJ4m8rH04MKFpIlzUDq660JYQIGtOUFugSfg7aLVU/0j4WKKE +KfAfg93wYTKKd+JgRFy4FZPriem7HvlUSi2VKffdrrUF/PX35X74iKdPQoEADZi8 +KkMZULDtyQ6ZOu2hiDpArjo5hDadKM314Z65VnM11hjiEhmTF3IyGBllb0qBIk0L +nBVHuMYmiqBNJEbaqHLqIju8/RvFlYV+AMISeA7B68knbJcao13ogtDpuJ4hpgCj +j2B1n0NWMcju0gteu1sfsIaQbWHevH2vgl5LJDCNtUJN/NoWB2Uov27wEvsongwY +3du40TnM+5ejwf4r8D3wX+JpVCAhfr3Oc0knw14nRqFPAe1E7DNURJ8xfEV9iPRA +swo6qoh7IIxNETUG1rywRExNt6tHsojx0Wb0I0IB7CnWRK9F6oNRp0S4kVgp+Jeh +a9NGXFK2hn8qBD/rpUPsj/OdkiBN+C7Ai07rCNez+IKdnUfXkOJqLCOyeUwC9WPl +uFPB9RnnghYM4xhMWf8XvSLOOk/vgPxiqR5ANLObsbkCDQRnKRLhARAAuh+b2Oxj +9q+RRZ+pkDVf/M6P01yDmDhwtYHzi/LW8PFHC6iQlzMReyv1R5n3uCEpAZ++mdUe +Cgo2TmFnYdpmxEgdaMIW98uqe4fuHhoXU2Mh4eiN7jyJvXQCsijCDYzifoj03HY7 +nTVjw4+BSSu9kA3/vEqU9A5YjG01MmVSMaIaTrqZqsnypK6r2exJa7YVRYwRqpLY +C5ksikDVK9ftdfhjnsnYGS4pYyfMNSHY1KBMpHjT7wEkM+KZ2WRpjTZZ7nP9u4Lf +fJMKgcclRgf+13CeSaJfVIhjJlxGVLkloE8XJbOeh2vkK257e9BenEFgQnyLCpGJ +8YNsnsJVhxU1aA62dT7jmnOVMBhnGoNhMyzzfvUw0REz2VbpZBkiwZRfZ9MWUBsy +bneH8NwzZMQQLCc/yo/jnPrmDS+tgl4CXGzBtpxPUZSMuY4tHZZ2vBb0zcfhY7P1 +CrHuylXLFzkOO/XRP3w1F8I1UqJCjdTKjdjCDF/VWtedHee1iEsSHxPGH8fHp4Qp +rBDDwZ4NnfilYNHMDWm6U1bzhX2ynqcGArQSd1Ny/oL7JzE1qoH/nNrwVvOSSNWF +UTXFXeLy+SOXJdFJpGP+/wV+gYfyczoUP6vmCdK1Hs15WQvKzyP/nmLS5uLilfxV +KrxZDI6SNrS4f/XkHcGnYByFKUhq5gVN0ZcAEQEAAYkEcgQYAQgAJhYhBGjSGCM0 +KhNoOus+TvtMaFtdwcE+BQJnKRLhAhsCBQkDwmcAAkAJEPtMaFtdwcE+wXQgBBkB +CAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmcpEuEACgkQzcroySfGvjExiQ// +TKQ2Ci+sqNSVIcwg/k0Go1i4cA7lhKNdYRBCaIThB9jMqNg2zgPzgELBcaVJL8xw +0E2x2ZvBejM4X+eTrmkdufcxHR8B/zBF8oPlD2pgs/zZmZEO1gq4Cdab7yIoVNNr +foCZShxOCPR2wIixcYZtt5f7Z3zSXqkjIec6sTOedT75ZXrpQbvINeUkvOJfMCOi +ailauvDfv8k5iJUVbP+Dx1vOc88bvewVJcbLID4HIRr/PS+k1D10zGbnF71TnxGZ +r7anMZCSFCHJ5WV+BSwHHKtxRy+bJ1x9ML45Jcr1anTXeaHIeSKNzFBigJQSgHv0 +euegkD3Rmw+IcxNb4l536selaNR0UAwx1DC1qpjBtnE9/pXdTEsZQxq9kMrj0d+f +VKFjOKADVIpkx7o0dZ1jmbUmdjQVyGDgHE+Emgdd726/2ftWriW2uPeUC6YZiqbt +vBnCnwF+aV6P1nrE0BWJchLyBjDCe5Y2oXBAYF6xwpDPfMPr4oscqzPV4TWVULBi +brtRWgSxmvinIGFx9T9wQCVfX254dqBaAEhRMImoT/YP+6evRZKqQODRhI44OG7u +V71IVAJ8BHEBN8hxvQM3WPs1fhwMBFCyGfr/x/U4/c78R9JhxkU9VwmMbLGQP7VP +1QgfiHqZpHMk8ZUmQn6KLeurzWcnwPFkwgFPZED8OQOMXxAAio3DhWr5KDd3mICH +ALNY0A2ipb/JH6LSHxu0S3MLa/bF6PbqRY1+fKMT/cFVxln99rNUrX+hDRbc7qbh +KkxvGmcnXnkcTHah9bfUghEanlKkBr1g1ik3zgEnpO/x3+X39Ov+ge92MDawV0nq +k9R/9tS+ZD/ph72Q9kx3ZfVNSL0eWxjuwBzFW0Zwh5TAX4raSmyQCmAXi05O3YmN +iq4arSUg5oAOMRZ+d96DsrAS4Sdtlx6/CuKTBzEaGPQLQ9wJNB0Vmd/eQWTP99KY +cAdIwj5BJ5P0Z7+xhsVjQOntn4otnP6vN6RuDtYrS6M7TCN/ZeKCvN/G0nRac4D+ +IJX3CYYtYXgaoDuoetUWtc7O5PzHRETaBt/46ob2lzf6cT5QyVujTfz+i0rGEc63 +pvXK8mV+K7BFY/DHpdEhl1pDw2YYLbBmUthQWdsL6/TVvpMe/wZadvJ/by3AeRzQ +eusUucuSo9UNN7Yj8u3dRhxNgsSiU96A/SFlAoB5s3Onh5K4WEVCBu/INjdi+r2B +LJePSnA3I7VkRE9Haf1D28jtBzm3Xbft2rs3lO18FcCqw6kd7Ih3e0tZ8uUG9UDv +qTDHTUHLAWvwrq38gKKAu2RMaU06A5kR87RcQiizxOwBIwiHuUWMU4/Hyx6fXsOD +hEs0O6AFDarNDZGee2amKTAyZpG5Ag0EZykTxQEQAOwGV1boBD3vDLsoAT62nGxb +SqXiBsObxnpWbNifOzM9BUGPOIpHsSH32PZGG/+LNjNdECfyyP1RysH5OT7j92Q8 +vgRQoG3X985gbOjYyZc0xvAkTSvWxOiy5CuF3X8sJ3NSerQDXwjP9qVqLVj/3FB8 +nka1HFS7KzC3Zo/kzCoxeZ3/hV3PTWIjcoJvtBSCKPZyOJxnRqWfi5BNJo3S2SR1 +mxV967zawXiZ8MeeBl6rLhOfCBtz9g+bqrXZYoenuMn5Js2mcH0haYeMSV3UWIC4 +kinzr1EJxs+L1/hVCVBNiiDc6DXcFXoz9ZVc9kjpZTOMoZVDkRkyOeen+5Sya9wK +4teLmDLME4+pgeHCS/Wa4KrYyEWe7NpG1VTkSJnRS+fyYGTWtwEiuwT6J9U0t1d5 +hbxhM7YAhlnOEnNVmqa3Bq3yqJs9G/7gicZ7CIJ9JBHKTJzOnKfpGhxBSOgOoCOa +WW6uVCzDqfrYPmCUIKQmanB441xJFGuHVPMLBjVjswoMKGkK3gM6KMRCDYQ53u6s +FK+Jcl8HobBSezVIUKpKVX3IW9d506cE0FhSW/NvWJv0FIMVloyC2BpOjSWVgEwX +tk/m3SKPsgCAcCqzi7xlloR8+E9C2xci9cdGG5faghgSjaP6j0qDww/slRPQJc5A +DIeukkOYTCiSiDwQtblJABEBAAGJAjMEGAEIACcWIQRo0hgjNCoTaDrrPk77TGhb +XcHBPgUCZykTxQMbIAQFCQPCZwAAADcWD/4qJRLn7TcMtRMF43Yn+dX+O13YrxBC +T4n1QVmiPsGrUca4Vg1J+trV6IMsGrhktpiaV0qeL/km0h02m4gEDZKDyWWXdeWh +EXFaTVy9yCpSXUWJl5gSXTSwxrqBWyWLlLLk4UT9l9sk5mMdy0JA8unobV4M/eXQ +ggR11DL3ji7aO0hsqxyxXkJcawWjVGW5KL1EaoDKIJ/CwxOI5ipFueMIRQjQvw9A +o/w2fq11qVXY9zknk6pFkp/RDHLes+wVHDtebZfJ9xV7Mb1mf/k03dT56GaA/U3E +XvJ2FdgWR+zf+YMEa9MPDHYo2UNEvk9mOk247M8s+OeexdlkPgyKW5A8mtYuY/dR +j8W6C4pLcMWa+d/vIUpm5Guw0F5q0AWk9/FbBe9HLztEevvRnuHXmfTZeto/nCAi +Yg4pCj6p3JoN5CLebR8YtWm9AJBbX1kgVvqSU2VgwYIFsxBEz8Wu2h7z/eSCSeIg +ARFbTlJ6cBrRkXCVyhbv0LPWWUfAUqiEtdGxrA4Xx/jKrI02JjRdW/bZkXjSka8K ++cDlpcr9ixBWW5LkWsOdiL8jExfTGw25FA7Wd1HiHnBv36Mu/zb+0/I63d+fLq93 +e3lmmVx9qQF8p5Okf4ojY9YoIHVkLS7t9AgFjm/ucmpEGbXxyPk2Cr3l+b5R41x3 +dBW9kxiuWpZN3Q== +=iuRK -----END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/policycoreutils.spec b/policycoreutils.spec index bcded22..ee0dd61 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.7-1 -%global libsemanagever 3.7-1 -%global libselinuxver 3.7-1 +%global libsepolver 3.8-0 +%global libsemanagever 3.8-0 +%global libselinuxver 3.8-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,12 +10,12 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.7 -Release: 5%{?dist} +Version: 3.8 +Release: 0.rc1.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,7 +35,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.7 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.8 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -44,7 +44,6 @@ Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch -Patch0007: 0007-fixfiles-use-grep-F-when-search-in-mounts.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -93,7 +92,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version} +%autosetup -p 1 -n selinux-%{version}-rc1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -373,6 +372,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_sbindir}/genhomedircon %{_sbindir}/setsebool %{_sbindir}/semodule +%{_sbindir}/unsetfiles %if "%{_sbindir}" != "%{_bindir}" # symlink to %%{_bindir}/sestatus %{_sbindir}/sestatus @@ -401,6 +401,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_mandir}/man8/setfiles.8* %{_mandir}/man8/setsebool.8* %{_mandir}/man1/secon.1* +%{_mandir}/man1/unsetfiles.1* %{_mandir}/man8/genhomedircon.8* %{_mandir}/man8/semodule_expand.8* %{_mandir}/man8/semodule_link.8* diff --git a/sources b/sources index 80536c5..1fa9725 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.7.tar.gz) = f16c3731e27a09306147ffd5b929f55357642da663326edf5837885b36e8fe763ba6a1d18e8ae4001f6091545d06bb11f2d9ed78d69711c0211fbb406bc52345 -SHA512 (selinux-3.7.tar.gz.asc) = d433765388e40b80429eb74784bf107457ef0dd8bdbc2c35c2ad3e687da11d4526a513e344bc6404383cbc61d9ac8e6a8aa5ce8a535db06ce4e2f11aa5b38056 +SHA512 (selinux-3.8-rc1.tar.gz) = 64e4ca41d3558ef4f2af0b26ca1d55d3d2b9badb685dde7acda866fa5ebfb71d80e924a4e314ae1fe83be70a1250dbd1df1c78118cff2b845ccffaf3b4a5c55c +SHA512 (selinux-3.8-rc1.tar.gz.asc) = e974331b53df020367270885a1a54b458b4f8eea4429c5a8bd65770b8ea72ad2d4e46ca4349a730d7db40f5e0796be6fe846e888cb215c750649e98fd7cefc2c From a8be26778e3b6b66f65915aaef6ad5d2c9c7905d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Dec 2024 16:14:46 +0100 Subject: [PATCH 59/79] SELinux userspace 3.8-rc3 release --- .gitignore | 2 + ...gen-ifgen-allow-M4-escaped-filenames.patch | 44 ------------------- changelog | 6 +++ policycoreutils.spec | 15 +++---- sources | 4 +- 5 files changed, 17 insertions(+), 54 deletions(-) delete mode 100644 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch diff --git a/.gitignore b/.gitignore index ddc70f1..2ca0051 100644 --- a/.gitignore +++ b/.gitignore @@ -359,3 +359,5 @@ policycoreutils-2.0.83.tgz /selinux-3.7.tar.gz.asc /selinux-3.8-rc1.tar.gz /selinux-3.8-rc1.tar.gz.asc +/selinux-3.8-rc3.tar.gz +/selinux-3.8-rc3.tar.gz.asc diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch deleted file mode 100644 index 1149167..0000000 --- a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch +++ /dev/null @@ -1,44 +0,0 @@ -From d95931cc190b18e9c405e19dccfa6290269a84df Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 19 Aug 2024 19:51:51 +0200 -Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames -Content-type: text/plain - -When a file name in type transition rule used in an interface is same as -a keyword, it needs to be M4 escaped so that the keyword is not expanded -by M4, e.g. - -- filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface") -+ filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''") - -But sepolgen-ifgen could not parse such string: - - # sepolgen-ifgen - Illegal character '`' - -This change allows M4 escaping inside quoted strings and fixed described -problem. - -https://bugzilla.redhat.com/show_bug.cgi?id=2254206 - -Signed-off-by: Petr Lautrbach ---- - python/sepolgen/src/sepolgen/refparser.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py -index e261d3f78f87..9622ee9a29ce 100644 ---- a/python/sepolgen/src/sepolgen/refparser.py -+++ b/python/sepolgen/src/sepolgen/refparser.py -@@ -261,7 +261,7 @@ def t_IDENTIFIER(t): - return t - - def t_FILENAME(t): -- r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"' -+ r'\"`*[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\'*\"' - # Handle any keywords - t.type = reserved.get(t.value,'FILENAME') - return t --- -2.47.0 - diff --git a/changelog b/changelog index 69ae898..d16cc32 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Wed Dec 18 2024 Petr Lautrbach - 3.8-0.rc3.1 +- SELinux userspace 3.8-rc3 release + +* Thu Nov 28 2024 Petr Lautrbach - 3.8-0.rc1.1 +- SELinux userspace 3.8-rc1 release + * Wed Nov 13 2024 Petr Lautrbach - 3.7-5 - fixfiles: use `grep -F` when search in mounts (bz#2323728) diff --git a/policycoreutils.spec b/policycoreutils.spec index ee0dd61..8ba751a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-0 -%global libsemanagever 3.8-0 -%global libselinuxver 3.8-0 +%global libsepolver 3.8-0.rc3 +%global libsemanagever 3.8-0.rc3 +%global libselinuxver 3.8-0.rc3 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc1.1%{?dist} +Release: 0.rc3.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -43,7 +43,6 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -92,7 +91,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc1 +%autosetup -p 1 -n selinux-%{version}-rc3 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 1fa9725..aabc995 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8-rc1.tar.gz) = 64e4ca41d3558ef4f2af0b26ca1d55d3d2b9badb685dde7acda866fa5ebfb71d80e924a4e314ae1fe83be70a1250dbd1df1c78118cff2b845ccffaf3b4a5c55c -SHA512 (selinux-3.8-rc1.tar.gz.asc) = e974331b53df020367270885a1a54b458b4f8eea4429c5a8bd65770b8ea72ad2d4e46ca4349a730d7db40f5e0796be6fe846e888cb215c750649e98fd7cefc2c +SHA512 (selinux-3.8-rc3.tar.gz) = 952cf58fd236949df96580f1e98cdde9003c8e783663c8cff391a4b56d3399a71694c756d1ba3141a494386c9b053ad0ca3665ac7dcdd5c6c252be4df6539c31 +SHA512 (selinux-3.8-rc3.tar.gz.asc) = 5149d362dea727edf40d88fcb3ad277b0c510b9799fd2e5ab420e98cafd60b33c208563c3ba93a6949c4592946a6ab87b4477bc413702942691fa2c676f51dad From 4ede7dad3761a6f32b6cf2f99922596dd2dcabda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:39:08 +0100 Subject: [PATCH 60/79] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 8ba751a..f7e4d10 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist} +Release: 0.rc3.1%{?dist}.1 License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -448,4 +448,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 +- Rebuilt for the bin-sbin merge (2nd attempt) + %autochangelog From ff9ef4f536b5377067dca23ae7e907c69f108053 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 10:31:59 +0000 Subject: [PATCH 61/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index f7e4d10..3e490dd 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist}.1 +Release: 0.rc3.1%{?dist}.2 License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -448,6 +448,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 - Rebuilt for the bin-sbin merge (2nd attempt) From 5ab4154096343cc4163be84be571d1839ab87f74 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Jan 2025 08:45:34 +0100 Subject: [PATCH 62/79] Fix changelog --- changelog | 6 ++++++ policycoreutils.spec | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/changelog b/changelog index d16cc32..4a864cc 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Wed Dec 18 2024 Petr Lautrbach - 3.8-0.rc3.1 - SELinux userspace 3.8-rc3 release diff --git a/policycoreutils.spec b/policycoreutils.spec index 3e490dd..1effba0 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -448,10 +448,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 -- Rebuilt for the bin-sbin merge (2nd attempt) - %autochangelog From 0d18a959c76579106658d72d210d4356ccdf90b2 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Jan 2025 08:47:43 +0100 Subject: [PATCH 63/79] Make `rpm` a weak dependency The goal is to allow systems based on bootc without rpm installed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2338647 --- changelog | 3 +++ policycoreutils.spec | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changelog b/changelog index 4a864cc..668e444 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Jan 22 2025 Petr Lautrbach - 3.8-rc3.2 +- Make `rpm` a weak dependency (bz#2338647) + * Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/policycoreutils.spec b/policycoreutils.spec index 1effba0..85e98ba 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist}.2 +Release: 0.rc3.2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -70,8 +70,9 @@ BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip BuildRequires: systemd BuildRequires: git-core BuildRequires: gnupg2 -Requires: util-linux grep gawk diffutils rpm sed +Requires: util-linux grep gawk diffutils sed Requires: libsepol >= %{libsepolver} coreutils libselinux-utils >= %{libselinuxver} +Recommends: rpm %description Security-enhanced Linux is a feature of the Linux® kernel and a number From 5d6ff857413043a6150e55a7dc97af5f032db555 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 30 Jan 2025 15:51:05 +0100 Subject: [PATCH 64/79] SELinux userspace 3.8 release --- .gitignore | 2 ++ changelog | 3 +++ policycoreutils.spec | 14 +++++++------- sources | 4 ++-- 4 files changed, 14 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 2ca0051..b37fa8e 100644 --- a/.gitignore +++ b/.gitignore @@ -361,3 +361,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8-rc1.tar.gz.asc /selinux-3.8-rc3.tar.gz /selinux-3.8-rc3.tar.gz.asc +/selinux-3.8.tar.gz +/selinux-3.8.tar.gz.asc diff --git a/changelog b/changelog index 668e444..8b6cf27 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Thu Jan 30 2025 Petr Lautrbach - 3.8-1 +- SELinux userspace 3.8 release + * Wed Jan 22 2025 Petr Lautrbach - 3.8-rc3.2 - Make `rpm` a weak dependency (bz#2338647) diff --git a/policycoreutils.spec b/policycoreutils.spec index 85e98ba..41eb359 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-0.rc3 -%global libsemanagever 3.8-0.rc3 -%global libselinuxver 3.8-0.rc3 +%global libsepolver 3.8-1 +%global libsemanagever 3.8-1 +%global libselinuxver 3.8-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.2%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -92,7 +92,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc3 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index aabc995..347f300 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8-rc3.tar.gz) = 952cf58fd236949df96580f1e98cdde9003c8e783663c8cff391a4b56d3399a71694c756d1ba3141a494386c9b053ad0ca3665ac7dcdd5c6c252be4df6539c31 -SHA512 (selinux-3.8-rc3.tar.gz.asc) = 5149d362dea727edf40d88fcb3ad277b0c510b9799fd2e5ab420e98cafd60b33c208563c3ba93a6949c4592946a6ab87b4477bc413702942691fa2c676f51dad +SHA512 (selinux-3.8.tar.gz) = 58d05cd17ebcb4975e49573d2019304e6bbe0692f0ec230d79dfbcd144c2ff695c137b83318cc5e04c618031db7764e697162a3a8ff753ecfa314e552ccb8b81 +SHA512 (selinux-3.8.tar.gz.asc) = b4cd45bd66b7ae716123efde2ba0acddabc25cf3728e30ef101c7c001b6114c2b37fdc5e1cb09d75dc87f4d544da2f4a2e5803091334685c69c4c52e004e8434 From ba57ad88565a5fba5d891b6ed61fcca57d69dc41 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 21:22:44 +0200 Subject: [PATCH 65/79] Rebuilt for Python 3.14 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 41eb359..d1bee76 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -449,4 +449,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Jun 02 2025 Python Maint - 3.8-2 +- Rebuilt for Python 3.14 + %autochangelog From 6ebaf8c522fcbd3c3bf0fff832110db698d3d917 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 25 Jun 2025 16:58:23 +0200 Subject: [PATCH 66/79] policycoreutils-3.8-3 - Use multiprocessing 'fork' method (rhbz#2374569) --- ...licy-use-multiprocessing-fork-method.patch | 57 +++++++++++++++++++ changelog | 6 ++ policycoreutils.spec | 6 +- 3 files changed, 65 insertions(+), 4 deletions(-) create mode 100644 0006-sepolicy-use-multiprocessing-fork-method.patch diff --git a/0006-sepolicy-use-multiprocessing-fork-method.patch b/0006-sepolicy-use-multiprocessing-fork-method.patch new file mode 100644 index 0000000..51ba23f --- /dev/null +++ b/0006-sepolicy-use-multiprocessing-fork-method.patch @@ -0,0 +1,57 @@ +From 9e26190295f01d74f70eed7ea3a78c00e38eafbb Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 25 Jun 2025 16:45:43 +0200 +Subject: [PATCH] sepolicy: use multiprocessing 'fork' method +Content-type: text/plain + +'fork' was the default starting method in Python before 3.14. + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2374569 + + sh-5.2# sepolicy manpage -a -p /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT/usr/share/man/man8/ -w -r /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT + ValueError: No SELinux Policy installed + Exception ignored while calling deallocator : + Traceback (most recent call last): + File "/usr/lib64/python3.14/multiprocessing/pool.py", line 271, in __del__ + self._change_notifier.put(None) + File "/usr/lib64/python3.14/multiprocessing/queues.py", line 397, in put + self._writer.send_bytes(obj) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 206, in send_bytes + self._send_bytes(m[offset:offset + size]) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 444, in _send_bytes + self._send(header + buf) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 400, in _send + n = write(self._handle, buf) + BrokenPipeError: [Errno 32] Broken pipe + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy.py | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py +index 82ff6af2bc2d..febb2fc103ed 100755 +--- a/python/sepolicy/sepolicy.py ++++ b/python/sepolicy/sepolicy.py +@@ -25,7 +25,7 @@ import os + import sys + import selinux + import sepolicy +-from multiprocessing import Pool ++import multiprocessing + from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text + import argparse + PROGNAME = "selinux-python" +@@ -350,7 +350,8 @@ def manpage(args): + + manpage_domains = set() + manpage_roles = set() +- p = Pool() ++ multiprocessing.set_start_method('fork') ++ p = multiprocessing.Pool() + async_results = [] + for domain in test_domains: + async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) +-- +2.50.0 + diff --git a/changelog b/changelog index 8b6cf27..92a6186 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Wed Jun 25 2025 Petr Lautrbach - 3.8-3 +- Use multiprocessing 'fork' method (rhbz#2374569) + +* Mon Jun 02 2025 Python Maint - 3.8-2 +- Rebuilt for Python 3.14 + * Thu Jan 30 2025 Petr Lautrbach - 3.8-1 - SELinux userspace 3.8 release diff --git a/policycoreutils.spec b/policycoreutils.spec index d1bee76..96499e7 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -43,6 +43,7 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -449,7 +450,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Mon Jun 02 2025 Python Maint - 3.8-2 -- Rebuilt for Python 3.14 - %autochangelog From 552779a79e09a64f99bb1bae249ae8176b96e45b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 4 Jul 2025 13:39:25 +0200 Subject: [PATCH 67/79] SELinux userspace 3.9-rc2 release --- .gitignore | 2 + ...utils-use-pkg-config-for-libsemanage.patch | 77 +++++++++++++++++++ ...Make-pkg-config-work-for-more-types-.patch | 41 ++++++++++ changelog | 3 + policycoreutils.spec | 20 ++--- sources | 4 +- 6 files changed, 136 insertions(+), 11 deletions(-) create mode 100644 0007-policycoreutils-use-pkg-config-for-libsemanage.patch create mode 100644 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch diff --git a/.gitignore b/.gitignore index b37fa8e..2bcddbf 100644 --- a/.gitignore +++ b/.gitignore @@ -363,3 +363,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8-rc3.tar.gz.asc /selinux-3.8.tar.gz /selinux-3.8.tar.gz.asc +/selinux-3.9-rc2.tar.gz +/selinux-3.9-rc2.tar.gz.asc diff --git a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch new file mode 100644 index 0000000..ebcd5a3 --- /dev/null +++ b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch @@ -0,0 +1,77 @@ +From 6509a337599845279baa8070f5c2113b73805f74 Mon Sep 17 00:00:00 2001 +From: Alyssa Ross +Date: Wed, 25 Jun 2025 12:41:03 +0200 +Subject: [PATCH] policycoreutils: use pkg-config for libsemanage +Content-type: text/plain + +libaudit and libbz2 are only required to be in the linker path for +static builds. For dynamic builds, they'll be discovered through ELF +metadata. pkg-config knows how to do the right thing in both cases, +so just use it rather than listing libsemanage's dependencies +manually. + +Fixes: da6cd3d8 ("Support static-only builds") +Closes: https://lore.kernel.org/r/87bjqebpre.fsf@redhat.com +Signed-off-by: Alyssa Ross +Acked-by: James Carter +--- + policycoreutils/Makefile | 3 ++- + policycoreutils/semodule/Makefile | 3 +-- + policycoreutils/setsebool/Makefile | 3 +-- + 3 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile +index 7acd51ddd646..0f3d62f26830 100644 +--- a/policycoreutils/Makefile ++++ b/policycoreutils/Makefile +@@ -3,7 +3,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo + PKG_CONFIG ?= pkg-config + + LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) +-export LIBSELINUX_LDLIBS ++LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) ++export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS + + all install relabel clean indent: + @for subdir in $(SUBDIRS); do \ +diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile +index 7c45831fcd4e..018ee2ca7d39 100644 +--- a/policycoreutils/semodule/Makefile ++++ b/policycoreutils/semodule/Makefile +@@ -7,12 +7,11 @@ MANDIR = $(PREFIX)/share/man + CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I../../libselinux/include -I../../libsemanage/include + override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src +-override LDLIBS += -lsemanage -lsepol $(LIBSELINUX_LDLIBS) ++override LDLIBS += $(LIBSEMANAGE_LDLIBS) -lsepol $(LIBSELINUX_LDLIBS) + SEMODULE_OBJS = semodule.o + + all: semodule genhomedircon + +-semodule: LDLIBS += -laudit -lbz2 + semodule: $(SEMODULE_OBJS) + + genhomedircon: +diff --git a/policycoreutils/setsebool/Makefile b/policycoreutils/setsebool/Makefile +index 1d5148469f01..87494c559c17 100644 +--- a/policycoreutils/setsebool/Makefile ++++ b/policycoreutils/setsebool/Makefile +@@ -8,14 +8,13 @@ BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions + CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I../../libselinux/include -I../../libsemanage/include + override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src +-override LDLIBS += -lsemanage $(LIBSELINUX_LDLIBS) ++override LDLIBS += $(LIBSEMANAGE_LDLIBS) $(LIBSELINUX_LDLIBS) + SETSEBOOL_OBJS = setsebool.o + + BASHCOMPLETIONS=setsebool-bash-completion.sh + + all: setsebool + +-setsebool: LDLIBS += -laudit -lbz2 + setsebool: $(SETSEBOOL_OBJS) + + install: all +-- +2.50.0 + diff --git a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch new file mode 100644 index 0000000..eba501d --- /dev/null +++ b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch @@ -0,0 +1,41 @@ +From 13d2f412bd1d32b2e5948b70ecba25d05632fd41 Mon Sep 17 00:00:00 2001 +From: James Carter +Date: Tue, 1 Jul 2025 09:03:09 -0400 +Subject: [PATCH] Policycoreutils: Make pkg-config work for more types of + builds +Content-type: text/plain + +To support static builds, pkg-config is used to add the libraries +needed for libselinux and libsemanage during the build. Unforunately, +pkg-config will always use the installed pc files for libselinux and +libsemanage. + +Instead set PKG_CONFIG_PATH when invoking pkg-config so that +it searches in order: +1) The directory specified by PKG_CONFIG_PATH, if already set. +2) The local src directories of libselinux and libsemaange. +3) The default directories specified by the system. + +Signed-off-by: James Carter +--- + policycoreutils/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile +index 0f3d62f26830..7c9706e3fe72 100644 +--- a/policycoreutils/Makefile ++++ b/policycoreutils/Makefile +@@ -2,8 +2,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo + + PKG_CONFIG ?= pkg-config + +-LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) +-LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) ++LIBSELINUX_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libselinux/src" $(PKG_CONFIG) --libs libselinux) ++LIBSEMANAGE_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libsemanage/src" $(PKG_CONFIG) --libs libsemanage) + export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS + + all install relabel clean indent: +-- +2.50.0 + diff --git a/changelog b/changelog index 92a6186..f7bf768 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Fri Jul 04 2025 Petr Lautrbach - 3.9-0.rc2.1 +- SELinux userspace 3.9-rc2 release + * Wed Jun 25 2025 Petr Lautrbach - 3.8-3 - Use multiprocessing 'fork' method (rhbz#2374569) diff --git a/policycoreutils.spec b/policycoreutils.spec index 96499e7..62b2aa6 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-1 -%global libsemanagever 3.8-1 -%global libselinuxver 3.8-1 +%global libsepolver 3.9-0 +%global libsemanagever 3.9-0 +%global libselinuxver 3.9-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,12 +10,12 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.8 -Release: 3%{?dist} +Version: 3.9 +Release: 0.rc2.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,7 +35,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.8 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.9-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -44,6 +44,8 @@ Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch +Patch0007: 0007-policycoreutils-use-pkg-config-for-libsemanage.patch +Patch0008: 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -93,7 +95,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version} +%autosetup -p 1 -n selinux-%{version}-rc2 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 347f300..26bad72 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8.tar.gz) = 58d05cd17ebcb4975e49573d2019304e6bbe0692f0ec230d79dfbcd144c2ff695c137b83318cc5e04c618031db7764e697162a3a8ff753ecfa314e552ccb8b81 -SHA512 (selinux-3.8.tar.gz.asc) = b4cd45bd66b7ae716123efde2ba0acddabc25cf3728e30ef101c7c001b6114c2b37fdc5e1cb09d75dc87f4d544da2f4a2e5803091334685c69c4c52e004e8434 +SHA512 (selinux-3.9-rc2.tar.gz) = d05d7633826154007117fc17a22de5dfb5f929fa124123341e98039ecf68a133b9ca70c575ca5e4aaa390daa930ffb6dda43b016b9cfcda8d8a901fb5204ba89 +SHA512 (selinux-3.9-rc2.tar.gz.asc) = 0fec5c55f48978829bbb61ac9e3330fbd42be08ecc89b9abb318ccd86feda41f7a5dea58aef73979c471b95b539202336a7336feb8c9014e32c7d7684ed081f1 From dd082a7b126533e042476d35a93cbb19c4cf250c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 16 Jul 2025 16:24:54 +0200 Subject: [PATCH 68/79] SELinux userspace 3.9 release --- .gitignore | 2 + ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 4 +- 0004-Use-SHA-2-instead-of-SHA-1.patch | 20 ++--- ...-sepolicy-Fix-spec-file-dependencies.patch | 4 +- ...licy-use-multiprocessing-fork-method.patch | 57 -------------- ...utils-use-pkg-config-for-libsemanage.patch | 77 ------------------- ...Make-pkg-config-work-for-more-types-.patch | 41 ---------- changelog | 3 + policycoreutils.spec | 24 ++---- sources | 4 +- 12 files changed, 33 insertions(+), 211 deletions(-) delete mode 100644 0006-sepolicy-use-multiprocessing-fork-method.patch delete mode 100644 0007-policycoreutils-use-pkg-config-for-libsemanage.patch delete mode 100644 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch diff --git a/.gitignore b/.gitignore index 2bcddbf..5686001 100644 --- a/.gitignore +++ b/.gitignore @@ -365,3 +365,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8.tar.gz.asc /selinux-3.9-rc2.tar.gz /selinux-3.9-rc2.tar.gz.asc +/selinux-3.9.tar.gz +/selinux-3.9.tar.gz.asc diff --git a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index e319d1d..43396d2 100644 --- a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 12f57453e8b53a8aab6d3581fd1a4c921fe36918 Mon Sep 17 00:00:00 2001 +From ce28d432bef8d1a346054b56a989e58533fecfa7 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -21,5 +21,5 @@ index b7cd765c15e4..f2518e96e34c 100755 THREADS="" RPMFILES="" -- -2.47.0 +2.50.1 diff --git a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch index 996113f..f8433da 100644 --- a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From fb7357cd097801fcdfa21ed49a17a3875db05e42 Mon Sep 17 00:00:00 2001 +From 618ae48ebf1334f9380a9ae7460c553515f9c4ca Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index adf65f27a822..f726ad51b775 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.47.0 +2.50.1 diff --git a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 9c77d93..f876b7b 100644 --- a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From f2092a1b859a028f2c5c79b41c70b135ba3ad0fa Mon Sep 17 00:00:00 2001 +From 16fd581da479f80b8f8ff8ae8ff58a4f0a610d54 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -71,5 +71,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644 if [ -z "$WAYLAND_DISPLAY" ]; then DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -- -2.47.0 +2.50.1 diff --git a/0004-Use-SHA-2-instead-of-SHA-1.patch b/0004-Use-SHA-2-instead-of-SHA-1.patch index bcebe4f..d1847c1 100644 --- a/0004-Use-SHA-2-instead-of-SHA-1.patch +++ b/0004-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 4780b755bb1171f5aa4cd7545535839d451a2070 Mon Sep 17 00:00:00 2001 +From 1a3fc195c6dc7fe51ef76e4484910f7b41161ccc Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -13,10 +13,10 @@ The use of SHA-1 in RHEL9 is deprecated 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index c3cc5c9b0e52..6160aced5922 100644 +index 1134420e0e28..77dd05421d11 100644 --- a/policycoreutils/setfiles/restorecon.8 +++ b/policycoreutils/setfiles/restorecon.8 -@@ -95,14 +95,14 @@ display usage information and exit. +@@ -103,14 +103,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -34,7 +34,7 @@ index c3cc5c9b0e52..6160aced5922 100644 enable usage of the .IR security.sehash extended attribute. -@@ -200,7 +200,7 @@ the +@@ -208,7 +208,7 @@ the .B \-D option to .B restorecon @@ -43,7 +43,7 @@ index c3cc5c9b0e52..6160aced5922 100644 attribute named .IR security.sehash on each directory specified in -@@ -217,7 +217,7 @@ for further details. +@@ -225,7 +225,7 @@ for further details. .sp The .B \-I @@ -134,10 +134,10 @@ index 31fb82fd2099..bc22d3fd4560 100644 } diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index ee01725050bb..57c663a99d67 100644 +index eabf0a1cf755..187f45131a1f 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 -@@ -95,14 +95,14 @@ display usage information and exit. +@@ -104,14 +104,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -155,7 +155,7 @@ index ee01725050bb..57c663a99d67 100644 enable usage of the .IR security.sehash extended attribute. -@@ -261,7 +261,7 @@ the +@@ -270,7 +270,7 @@ the .B \-D option to .B setfiles @@ -164,7 +164,7 @@ index ee01725050bb..57c663a99d67 100644 .B spec_file set in an extended attribute named .IR security.sehash -@@ -282,7 +282,7 @@ for further details. +@@ -291,7 +291,7 @@ for further details. .sp The .B \-I @@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644 and provided the .B \-n -- -2.47.0 +2.50.1 diff --git a/0005-python-sepolicy-Fix-spec-file-dependencies.patch b/0005-python-sepolicy-Fix-spec-file-dependencies.patch index 27f1ea1..abecd7b 100644 --- a/0005-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0005-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,4 +1,4 @@ -From 7e8d67e63daebd675284afaf98aa07530659272f Mon Sep 17 00:00:00 2001 +From 84b051139ab536519cc8e9c333483475d830d40b Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies @@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644 mid_section="""\ -- -2.47.0 +2.50.1 diff --git a/0006-sepolicy-use-multiprocessing-fork-method.patch b/0006-sepolicy-use-multiprocessing-fork-method.patch deleted file mode 100644 index 51ba23f..0000000 --- a/0006-sepolicy-use-multiprocessing-fork-method.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 9e26190295f01d74f70eed7ea3a78c00e38eafbb Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 25 Jun 2025 16:45:43 +0200 -Subject: [PATCH] sepolicy: use multiprocessing 'fork' method -Content-type: text/plain - -'fork' was the default starting method in Python before 3.14. - -Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2374569 - - sh-5.2# sepolicy manpage -a -p /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT/usr/share/man/man8/ -w -r /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT - ValueError: No SELinux Policy installed - Exception ignored while calling deallocator : - Traceback (most recent call last): - File "/usr/lib64/python3.14/multiprocessing/pool.py", line 271, in __del__ - self._change_notifier.put(None) - File "/usr/lib64/python3.14/multiprocessing/queues.py", line 397, in put - self._writer.send_bytes(obj) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 206, in send_bytes - self._send_bytes(m[offset:offset + size]) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 444, in _send_bytes - self._send(header + buf) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 400, in _send - n = write(self._handle, buf) - BrokenPipeError: [Errno 32] Broken pipe - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy.py | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index 82ff6af2bc2d..febb2fc103ed 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -25,7 +25,7 @@ import os - import sys - import selinux - import sepolicy --from multiprocessing import Pool -+import multiprocessing - from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text - import argparse - PROGNAME = "selinux-python" -@@ -350,7 +350,8 @@ def manpage(args): - - manpage_domains = set() - manpage_roles = set() -- p = Pool() -+ multiprocessing.set_start_method('fork') -+ p = multiprocessing.Pool() - async_results = [] - for domain in test_domains: - async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) --- -2.50.0 - diff --git a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch deleted file mode 100644 index ebcd5a3..0000000 --- a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 6509a337599845279baa8070f5c2113b73805f74 Mon Sep 17 00:00:00 2001 -From: Alyssa Ross -Date: Wed, 25 Jun 2025 12:41:03 +0200 -Subject: [PATCH] policycoreutils: use pkg-config for libsemanage -Content-type: text/plain - -libaudit and libbz2 are only required to be in the linker path for -static builds. For dynamic builds, they'll be discovered through ELF -metadata. pkg-config knows how to do the right thing in both cases, -so just use it rather than listing libsemanage's dependencies -manually. - -Fixes: da6cd3d8 ("Support static-only builds") -Closes: https://lore.kernel.org/r/87bjqebpre.fsf@redhat.com -Signed-off-by: Alyssa Ross -Acked-by: James Carter ---- - policycoreutils/Makefile | 3 ++- - policycoreutils/semodule/Makefile | 3 +-- - policycoreutils/setsebool/Makefile | 3 +-- - 3 files changed, 4 insertions(+), 5 deletions(-) - -diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile -index 7acd51ddd646..0f3d62f26830 100644 ---- a/policycoreutils/Makefile -+++ b/policycoreutils/Makefile -@@ -3,7 +3,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo - PKG_CONFIG ?= pkg-config - - LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) --export LIBSELINUX_LDLIBS -+LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) -+export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS - - all install relabel clean indent: - @for subdir in $(SUBDIRS); do \ -diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile -index 7c45831fcd4e..018ee2ca7d39 100644 ---- a/policycoreutils/semodule/Makefile -+++ b/policycoreutils/semodule/Makefile -@@ -7,12 +7,11 @@ MANDIR = $(PREFIX)/share/man - CFLAGS ?= -Werror -Wall -W - override CFLAGS += -I../../libselinux/include -I../../libsemanage/include - override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src --override LDLIBS += -lsemanage -lsepol $(LIBSELINUX_LDLIBS) -+override LDLIBS += $(LIBSEMANAGE_LDLIBS) -lsepol $(LIBSELINUX_LDLIBS) - SEMODULE_OBJS = semodule.o - - all: semodule genhomedircon - --semodule: LDLIBS += -laudit -lbz2 - semodule: $(SEMODULE_OBJS) - - genhomedircon: -diff --git a/policycoreutils/setsebool/Makefile b/policycoreutils/setsebool/Makefile -index 1d5148469f01..87494c559c17 100644 ---- a/policycoreutils/setsebool/Makefile -+++ b/policycoreutils/setsebool/Makefile -@@ -8,14 +8,13 @@ BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions - CFLAGS ?= -Werror -Wall -W - override CFLAGS += -I../../libselinux/include -I../../libsemanage/include - override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src --override LDLIBS += -lsemanage $(LIBSELINUX_LDLIBS) -+override LDLIBS += $(LIBSEMANAGE_LDLIBS) $(LIBSELINUX_LDLIBS) - SETSEBOOL_OBJS = setsebool.o - - BASHCOMPLETIONS=setsebool-bash-completion.sh - - all: setsebool - --setsebool: LDLIBS += -laudit -lbz2 - setsebool: $(SETSEBOOL_OBJS) - - install: all --- -2.50.0 - diff --git a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch deleted file mode 100644 index eba501d..0000000 --- a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 13d2f412bd1d32b2e5948b70ecba25d05632fd41 Mon Sep 17 00:00:00 2001 -From: James Carter -Date: Tue, 1 Jul 2025 09:03:09 -0400 -Subject: [PATCH] Policycoreutils: Make pkg-config work for more types of - builds -Content-type: text/plain - -To support static builds, pkg-config is used to add the libraries -needed for libselinux and libsemanage during the build. Unforunately, -pkg-config will always use the installed pc files for libselinux and -libsemanage. - -Instead set PKG_CONFIG_PATH when invoking pkg-config so that -it searches in order: -1) The directory specified by PKG_CONFIG_PATH, if already set. -2) The local src directories of libselinux and libsemaange. -3) The default directories specified by the system. - -Signed-off-by: James Carter ---- - policycoreutils/Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile -index 0f3d62f26830..7c9706e3fe72 100644 ---- a/policycoreutils/Makefile -+++ b/policycoreutils/Makefile -@@ -2,8 +2,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo - - PKG_CONFIG ?= pkg-config - --LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) --LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) -+LIBSELINUX_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libselinux/src" $(PKG_CONFIG) --libs libselinux) -+LIBSEMANAGE_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libsemanage/src" $(PKG_CONFIG) --libs libsemanage) - export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS - - all install relabel clean indent: --- -2.50.0 - diff --git a/changelog b/changelog index f7bf768..8125bdb 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Jul 16 2025 Petr Lautrbach - 3.9-1 +- SELinux userspace 3.9 release + * Fri Jul 04 2025 Petr Lautrbach - 3.9-0.rc2.1 - SELinux userspace 3.9-rc2 release diff --git a/policycoreutils.spec b/policycoreutils.spec index 62b2aa6..a78333e 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.9-0 -%global libsemanagever 3.9-0 -%global libselinuxver 3.9-0 +%global libsepolver 3.9-1 +%global libsemanagever 3.9-1 +%global libselinuxver 3.9-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 0.rc2.1%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,17 +35,9 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.9-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch -Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch -Patch0007: 0007-policycoreutils-use-pkg-config-for-libsemanage.patch -Patch0008: 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -95,7 +87,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc2 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 26bad72..2f274a6 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.9-rc2.tar.gz) = d05d7633826154007117fc17a22de5dfb5f929fa124123341e98039ecf68a133b9ca70c575ca5e4aaa390daa930ffb6dda43b016b9cfcda8d8a901fb5204ba89 -SHA512 (selinux-3.9-rc2.tar.gz.asc) = 0fec5c55f48978829bbb61ac9e3330fbd42be08ecc89b9abb318ccd86feda41f7a5dea58aef73979c471b95b539202336a7336feb8c9014e32c7d7684ed081f1 +SHA512 (selinux-3.9.tar.gz) = ccfe9c8907ef50e35cda1e8282a4e02e8d2e1749dabde856343f236724214c89d0bcd4e799f383961b990c5fb9a6b0191880a478a8930af447951c8b36689720 +SHA512 (selinux-3.9.tar.gz.asc) = 598498e3919c72e1b7e6db85250ac7b1ff26e33598fb94c29ee74569dddee407fca73961d9fbb245ecf5ff5a7ee0eaa83031f79b7f0b2d89661119d45bbf5954 From 9613beb188c622f435426851633077d0a93713ea Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 06:00:45 +0000 Subject: [PATCH 69/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index a78333e..ed59a07 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -444,4 +444,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + %autochangelog From 13fd9c38cc8bf803d52d8dbb1084ff3c37e0b361 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 29 Jul 2025 14:07:06 +0200 Subject: [PATCH 70/79] Drop unused BuildRequires on python3-wheel See https://github.com/fedora-eln/eln/issues/284 When pip sees a setup.py file and it has setuptools and wheel installed it does not use build isolation (by default). When we remove wheel, the default changes, so we need to be explicit. Note that setting PIP_NO_BUILD_ISOLATION=0 disables build isolation, which is a tad confusing, see https://github.com/pypa/pip/issues/5735 --- policycoreutils.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ed59a07..c43ec0f 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -61,7 +61,8 @@ Provides: /usr/sbin/semodule BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel glib2-devel -BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip +BuildRequires: python3-devel python3-setuptools python3-pip +BuildRequires: (python3-wheel if python3-setuptools < 71) BuildRequires: systemd BuildRequires: git-core BuildRequires: gnupg2 @@ -128,7 +129,7 @@ mkdir -p %{buildroot}%{_mandir}/man8 %make_install -C policycoreutils LSPP_PRIV=y SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" SEMODULE_PATH="/usr/sbin" LIBSEPOLA="%{_libdir}/libsepol.a" -%make_install -C python PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" +%make_install -C python PYTHON=%{__python3} PIP_NO_BUILD_ISOLATION=0 SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" %make_install -C gui PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" From 6c0adeff6972263b4618fb750e51beddc82b7f39 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 11 Aug 2025 10:04:30 +0200 Subject: [PATCH 71/79] policycoreutils-3.9-3 - Drop unused BuildRequires on python3-wheel --- changelog | 6 ++++++ policycoreutils.spec | 5 +---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changelog b/changelog index 8125bdb..956ef08 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Tue Jul 29 2025 Miro Hrončok - 3.9-3 +- Drop unused BuildRequires on python3-wheel + +* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jul 16 2025 Petr Lautrbach - 3.9-1 - SELinux userspace 3.9 release diff --git a/policycoreutils.spec b/policycoreutils.spec index c43ec0f..c384a52 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,7 +445,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - %autochangelog From 1c3d6107fc572693a25dc1f177a3a7e2806f508e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 13:07:03 +0200 Subject: [PATCH 72/79] Rebuilt for Python 3.14.0rc2 bytecode --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index c384a52..4a34cfa 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,4 +445,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + %autochangelog From 7a130bd9c17ed9eb87a4f81aca8a3dac25882553 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 12:37:25 +0200 Subject: [PATCH 73/79] Rebuilt for Python 3.14.0rc3 bytecode --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 4a34cfa..ca70bcc 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,6 +445,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + * Fri Aug 15 2025 Python Maint - 3.9-4 - Rebuilt for Python 3.14.0rc2 bytecode From 2f22660c9f93c0371b729741bd20c7752847b52d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 07:33:59 +0100 Subject: [PATCH 74/79] Fix manpages pattern https://docs.fedoraproject.org/en-US/packaging-guidelines/#_manpages When installing man pages, note that RPM will re-compress them into its preferred format. So the %files section MUST reference manpages with a pattern that takes this into account: %files %{_mandir}/man1/foo.1* --- policycoreutils.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ca70bcc..7a56a2a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -321,7 +321,7 @@ or level of a logged in user. %files newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole -%{_mandir}/man1/newrole.1.gz +%{_mandir}/man1/newrole.1* %config(noreplace) %{_sysconfdir}/pam.d/newrole %package gui @@ -386,8 +386,8 @@ system-config-selinux is a utility for managing the SELinux environment %{_unitdir}/selinux-autorelabel.target %{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf -%{_mandir}/man5/selinux_config.5.gz -%{_mandir}/man5/sestatus.conf.5.gz +%{_mandir}/man5/selinux_config.5* +%{_mandir}/man5/sestatus.conf.5* %{_mandir}/man8/fixfiles.8* %{_mandir}/man8/load_policy.8* %{_mandir}/man8/restorecon.8* From 3a3585431961a73db8413c40bd67f7e8a401a7a1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 08:06:57 +0100 Subject: [PATCH 75/79] Move %changelog entries to changelog --- changelog | 6 ++++++ policycoreutils.spec | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/changelog b/changelog index 956ef08..faed1db 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + * Tue Jul 29 2025 Miro Hrončok - 3.9-3 - Drop unused BuildRequires on python3-wheel diff --git a/policycoreutils.spec b/policycoreutils.spec index 7a56a2a..ef17aee 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -445,10 +445,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Sep 19 2025 Python Maint - 3.9-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.9-4 -- Rebuilt for Python 3.14.0rc2 bytecode - %autochangelog From 668dfbb056f2ae83b1897683c4792b736a37959e Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 11 Dec 2025 07:31:22 +0100 Subject: [PATCH 76/79] Bring back patches unintentionally dropped before --- changelog | 3 +++ policycoreutils.spec | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/changelog b/changelog index faed1db..c39d307 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Thu Dec 11 2025 Petr Lautrbach - 3.9-6 +- Bring back patches unintentionally dropped before + * Fri Sep 19 2025 Python Maint - 3.9-5 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/policycoreutils.spec b/policycoreutils.spec index ef17aee..19c599d 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -38,6 +38,11 @@ Source23: selinux-sandbox.zip # $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start +Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch +Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 109f2b2f0746042e9106c5466624dafc3a5fb641 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 24 Jul 2025 13:36:35 +0200 Subject: [PATCH 77/79] selinux-autorelabel: Improve comments The original comment of relabel_selinux() no longer applies. The system is restarted either way. Resolves: RHEL-93949 --- selinux-autorelabel | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-autorelabel b/selinux-autorelabel index 5290c8c..1ce0e87 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -30,8 +30,9 @@ efi_set_boot_next() { } relabel_selinux() { - # if /sbin/init is not labeled correctly this process is running in the - # wrong context, so a reboot will be required after relabel + # Switch SELinux to permissive mode, fix labeling issues (or execute shell + # and have the user fix them) and reboot the machine so that the correct + # labels are applied to all services. AUTORELABEL= . /etc/selinux/config echo "0" > /sys/fs/selinux/enforce From e0a0eb0859ae38b1d870c9960074a020b37f6fbd Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 7 Oct 2025 12:26:46 +0200 Subject: [PATCH 78/79] policycoreutils-3.9-7 - semanage: Reset active value when deleting boolean customizations (RHEL-111421) - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) - sepolicy: Fix detection of writeable locations Resolves: RHEL-111421, RHEL-111505 --- ...Fix-detection-of-writeable-locations.patch | 65 ++++++++++++ ...ption-to-disable-SELINUX_RESTORECON_.patch | 91 +++++++++++++++++ ...ctive-value-when-deleting-boolean-cu.patch | 98 +++++++++++++++++++ changelog | 5 + policycoreutils.spec | 5 +- 5 files changed, 263 insertions(+), 1 deletion(-) create mode 100644 0006-sepolicy-Fix-detection-of-writeable-locations.patch create mode 100644 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch create mode 100644 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch diff --git a/0006-sepolicy-Fix-detection-of-writeable-locations.patch b/0006-sepolicy-Fix-detection-of-writeable-locations.patch new file mode 100644 index 0000000..2cd313a --- /dev/null +++ b/0006-sepolicy-Fix-detection-of-writeable-locations.patch @@ -0,0 +1,65 @@ +From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 5 May 2025 18:28:40 +0200 +Subject: [PATCH] sepolicy: Fix detection of writeable locations + +- update substitutions from /etc/dnf/var + +It seems that by default dnf api does not read /etc/dnf/var/* files to +update substitutions and so it can't resolve correct mirror list when a +variable is part of the link. + +- alway run query.run() + +Fixes: + Traceback (most recent call last): + File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load + ret = self._repo.load() + ^^^^^^^^^^^^^^^^^ + File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load + return _repo.Repo_load(self) + ^^^^^^^^^^^^^^^^^^^^^ + libdnf._error.Error: Failed to download metadata for repo 'baseos': + Cannot prepare internal mirrorlist: Status code: 404 for + https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198) + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/generate.py | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index f726ad51..a0314a70 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s; + import dnf + + with dnf.Base() as base: ++ base.conf.substitutions.update_from_etc('/') + base.read_all_repos() + base.fill_sack(load_system_repo=True) + + query = base.sack.query() + +- pq = query.available() +- pq = pq.filter(file=self.program) ++ pq = query.filter(file=self.program) + +- for pkg in pq: ++ for pkg in pq.run(): + self.rpms.append(pkg.name) + for fname in pkg.files: + for b in self.DEFAULT_DIRS: +@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s; + self.add_dir(fname) + sq = query.available() + sq = sq.filter(provides=pkg.source_name) +- for bpkg in sq: ++ for bpkg in sq.run(): + for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": +-- +2.49.0 + diff --git a/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch new file mode 100644 index 0000000..e8ec6ff --- /dev/null +++ b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch @@ -0,0 +1,91 @@ +From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 10 Sep 2025 11:42:09 +0100 +Subject: [PATCH] setfiles: Add -A option to disable + SELINUX_RESTORECON_ADD_ASSOC + +SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with +multiple hard links or bind mounts that have differing contexts. +However doing this involves building a large internal hashtable that +stores the full path of every file examined by setfiles. For +filesystems that have very large numbers of files or long pathnames, +this uses a lot of memory, which makes SELinux relabelling in +constrained memory environments infeasible. + +This adds a new setfiles -A option that disables this tracking. + +For example, using setfiles to relabel a filesystem with 15 million +files took 3.7GB of RAM. Using this option, the same filesystem can +be relabelled in 121MB (albeit with no warnings or errors possible for +conflicting labels, but for our use case we don't care about that.) + +Fixes: https://issues.redhat.com/browse/RHEL-111505 +Signed-off-by: Richard W.M. Jones +Acked-by: Stephen Smalley +--- + policycoreutils/setfiles/setfiles.8 | 5 +++++ + policycoreutils/setfiles/setfiles.c | 11 +++++++---- + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 +index 187f4513..458f3f9f 100644 +--- a/policycoreutils/setfiles/setfiles.8 ++++ b/policycoreutils/setfiles/setfiles.8 +@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. + .RB [ \-I | \-D ] + .RB [ \-T + .IR nthreads ] ++.RB [ \-A ] + .I spec_file + .IR pathname \ ... + +@@ -187,6 +188,10 @@ use up to + threads. Specify 0 to create as many threads as there are available + CPU cores; 1 to use only a single thread (default); or any positive + number to use the given number of threads (if possible). ++.TP ++.B \-A ++do not track inodes with multiple hard links or bind mounts that would ++match different contexts (saves memory) + + .SH "ARGUMENTS" + .TP +diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c +index ad09f840..31034316 100644 +--- a/policycoreutils/setfiles/setfiles.c ++++ b/policycoreutils/setfiles/setfiles.c +@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) + name, name); + } else { + fprintf(stderr, +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" +- "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" ++ "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", + name, name, name); + } + exit(-1); +@@ -147,7 +147,7 @@ int main(int argc, char **argv) + const char *base; + int errors = 0; + const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; +- const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; ++ const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; + const char *opts; + union selinux_callback cb; + long unsigned skipped_errors; +@@ -375,6 +375,9 @@ int main(int argc, char **argv) + if (*optarg == '\0' || *endptr != '\0') + usage(argv[0]); + break; ++ case 'A': ++ r_opts.add_assoc = 0; ++ break; + case 'h': + case '?': + usage(argv[0]); +-- +2.49.0 + diff --git a/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch new file mode 100644 index 0000000..470fde9 --- /dev/null +++ b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch @@ -0,0 +1,98 @@ +From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 1 Sep 2025 18:17:10 +0200 +Subject: [PATCH] semanage: Reset active value when deleting boolean + customizations + +Currently, removal of boolean local customizations leaves their current +(active) value untouched. + +After the removal is complete, semanage_bool_query will return the +default value. But it needs to be called in a separate transaction. +This makes the fix a bit awkward, but I have not found a way to query +the default value before the first transation is committed. + +Fixes: + # getsebool smbd_anon_write + smbd_anon_write --> off + # semanage boolean -m1 smbd_anon_write + # semanage boolean -D + # getsebool smbd_anon_write + smbd_anon_write --> on + # manage boolean -l isemanage boolean --list | grep smbd_anon_write + smbd_anon_write (on , off) Allow smbd to anon write + +Signed-off-by: Vit Mojzis +--- + python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index 10963e81..6d6188fd 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords): + self.__delete(name) + self.commit() + ++ # New transaction to reset the boolean to its default value. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ self.__reset_value(name) ++ self.commit() ++ + def deleteall(self): ++ deleted = [] + (rc, self.blist) = semanage_bool_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list booleans")) +@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords): + + for boolean in self.blist: + name = semanage_bool_get_name(boolean) ++ deleted.append(name) + self.__delete(name) + + self.commit() + ++ # New transaction to reset all affected booleans to their default values. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ ++ for boolean in deleted: ++ self.__reset_value(boolean) ++ ++ self.commit() ++ ++ # Set active value to default ++ # Note: this needs to be called in a new transaction after removing local customizations ++ # in order for semanage_bool_query to fetch the default value ++ # (as opposed to the current one -- set by the local customizations) ++ def __reset_value(self, name): ++ name = selinux.selinux_boolean_sub(name) ++ ++ (rc, k) = semanage_bool_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) ++ ++ (rc, b) = semanage_bool_query(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not query boolean %s") % name) ++ ++ semanage_bool_set_value(b, semanage_bool_get_value(b)) ++ ++ rc = semanage_bool_set_active(self.sh, k, b) ++ if rc < 0: ++ raise ValueError(_("Could not set active value of boolean %s") % name) ++ ++ semanage_bool_key_free(k) ++ semanage_bool_free(b) ++ + def get_all(self, locallist=0): + ddict = {} + if locallist: +-- +2.49.0 + diff --git a/changelog b/changelog index c39d307..45f063d 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,8 @@ +* Thu Dec 11 2025 Vit Mojzis - 3.9-7 +- semanage: Reset active value when deleting boolean customizations (RHEL-111421) +- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) +- sepolicy: Fix detection of writeable locations + * Thu Dec 11 2025 Petr Lautrbach - 3.9-6 - Bring back patches unintentionally dropped before diff --git a/policycoreutils.spec b/policycoreutils.spec index 19c599d..bd0d6c5 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -43,6 +43,9 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch +Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch +Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 1e699f4433984366beee3846578c9d4a030cce21 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 16 Dec 2025 11:00:45 +0100 Subject: [PATCH 79/79] Do not use %autochangelog It can't be used without %autorelease. Use our own macro to add entries from SOURCE3: changelog to %changelog %add_changelog %SOURCE3 Also install changelog to /usr/share/doc/policycoreutils/changelog --- macros | 8 ++++++++ policycoreutils.spec | 12 ++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 macros diff --git a/macros b/macros new file mode 100644 index 0000000..7587d10 --- /dev/null +++ b/macros @@ -0,0 +1,8 @@ +%add_changelog(changelog:) %{lua: + local f = io.open(arg[1], 'r') + if f then + local content = f:read('*all') + f:close() + print(content) + end +} diff --git a/policycoreutils.spec b/policycoreutils.spec index bd0d6c5..29b6242 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -17,6 +17,8 @@ License: GPL-2.0-or-later Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg +Source3: changelog +Source4: macros URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -48,6 +50,9 @@ Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end +# gen_changelog +%{load:%{SOURCE4}} + Obsoletes: policycoreutils < 2.0.61-2 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138 # initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel @@ -177,6 +182,9 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ %find_lang selinux-gui %find_lang selinux-sandbox +# Install changelog to %{_docdir}/%{name} +install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name} + %package python-utils Summary: SELinux policy core python utilities Requires: python3-policycoreutils = %{version}-%{release} @@ -415,7 +423,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} %license policycoreutils/LICENSE -%doc %{_usr}/share/doc/%{name} +%doc %{_docdir}/%{name} %package restorecond Summary: SELinux restorecond utilities @@ -453,4 +461,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -%autochangelog +%add_changelog %SOURCE3