Compare commits
27 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
65e046fb46 | ||
|
|
2407ba6fb2 | ||
|
|
ca7ca8ef9e | ||
|
|
9c3c4c93c1 | ||
|
|
3e3efd2c85 | ||
|
|
9d59b428f6 | ||
|
|
88eed74e59 | ||
|
|
3da191f2d8 | ||
|
|
1756da2d0e | ||
|
|
9af2e5cf71 | ||
|
|
c2ddb697c5 | ||
|
|
4cc4dd3b16 | ||
|
|
a67722e885 | ||
|
|
006427b2be | ||
|
|
adffb0da2c | ||
|
|
f1cd2ed649 | ||
|
|
f285053a57 | ||
|
|
60d950b055 | ||
|
|
99c45e8675 | ||
|
|
e82dfe8d91 | ||
|
|
6725b1a32f | ||
|
|
6d4d022461 | ||
|
|
1e2f2f617e | ||
|
|
1e14e1d501 | ||
|
|
baa99b0cf3 | ||
|
|
ad4e07f889 | ||
|
|
ef7f9b5845 |
2 changed files with 177 additions and 4 deletions
91
0001-Update-to-work-with-setools-4.3.patch
Normal file
91
0001-Update-to-work-with-setools-4.3.patch
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
From 66afa88fd1411ca3999ecca5cf0798fdc2f65813 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Wed, 24 Jun 2020 17:49:14 +0200
|
||||
Subject: [PATCH] Update to work with setools 4.3
|
||||
|
||||
* TERules cannot be altered from the outside any more
|
||||
** Use derive_expanded to perform partial expansion
|
||||
** Full expansion is now available via TERule.expand()
|
||||
|
||||
* "exception" module was moved from policyrep
|
||||
|
||||
* "typeattr" module was merged into policyrep
|
||||
---
|
||||
sepolicyanalysis/policy_data_collection.py | 34 ++++------------------
|
||||
1 file changed, 6 insertions(+), 28 deletions(-)
|
||||
|
||||
diff --git a/sepolicyanalysis/policy_data_collection.py b/sepolicyanalysis/policy_data_collection.py
|
||||
index 4bf45ce..3e3b9ea 100644
|
||||
--- a/sepolicyanalysis/policy_data_collection.py
|
||||
+++ b/sepolicyanalysis/policy_data_collection.py
|
||||
@@ -51,32 +51,10 @@ def half_expand_rule(rule, expand_source):
|
||||
expansion = rule.source.expand() if expand_source else rule.target.expand()
|
||||
if expand_source:
|
||||
for t in expansion:
|
||||
- results.append(setools.policyrep.terule.expanded_te_rule_factory(rule, t, rule.target))
|
||||
+ results.append(rule.derive_expanded(t, rule.target, rule.perms))
|
||||
else:
|
||||
for t in expansion:
|
||||
- results.append(setools.policyrep.terule.expanded_te_rule_factory(rule, rule.source, t))
|
||||
- return results
|
||||
-
|
||||
-# return set of rules where attributes were replaced by all types with given attribute
|
||||
-def expand_rule(rule):
|
||||
- results = []
|
||||
-
|
||||
- source_exp = rule.source.expand() if is_attribute(rule.source) else [rule.source]
|
||||
- target_exp = rule.target.expand() if is_attribute(rule.target) else [rule.target]
|
||||
-
|
||||
- for source in source_exp:
|
||||
- for target in target_exp:
|
||||
- if isinstance(rule, setools.policyrep.terule.ExpandedTERule):
|
||||
- #expanded_te_rule_factory ignores ExpandedTERules (doesn't set new source/target)
|
||||
- newrule = setools.policyrep.terule.ExpandedTERule(rule.policy, rule.qpol_symbol)
|
||||
- newrule.source = source
|
||||
- newrule.target = target
|
||||
- nwerule.origin = rule.origin
|
||||
-
|
||||
- else:
|
||||
- newrule = setools.policyrep.terule.expanded_te_rule_factory(rule, source, target)
|
||||
- results.append(newrule)
|
||||
-
|
||||
+ results.append(rule.derive_expanded(rule.source, t, rule.perms))
|
||||
return results
|
||||
|
||||
# expand all rules in given iterable
|
||||
@@ -90,7 +68,7 @@ def expand_rules(rules):
|
||||
# discard rules corresponding to unconfined attributes
|
||||
# TODO: add command line argument that switches this off - i.e. consider unconfined attributes
|
||||
if (not is_unconfined_attr(rule.source)) and (not is_unconfined_attr(rule.target)):
|
||||
- results.extend(expand_rule(rule))
|
||||
+ results.extend(rule.expand())
|
||||
|
||||
return results
|
||||
|
||||
@@ -223,7 +201,7 @@ def filter_terules_boolean(rules, bool_state = None):
|
||||
# return rules in agreement with boolean settings
|
||||
results.append(rule)
|
||||
|
||||
- except setools.policyrep.exception.RuleNotConditional:
|
||||
+ except setools.exception.RuleNotConditional:
|
||||
# return all unconditional rules
|
||||
results.append(rule)
|
||||
|
||||
@@ -256,12 +234,12 @@ def is_conditional(rule):
|
||||
boolean = str(rule.conditional)
|
||||
return boolean
|
||||
|
||||
- except setools.policyrep.exception.RuleNotConditional:
|
||||
+ except setools.exception.RuleNotConditional:
|
||||
False
|
||||
|
||||
# is given object of type "TypeAttribute" ?
|
||||
def is_attribute(obj):
|
||||
- return isinstance(obj, setools.policyrep.typeattr.TypeAttribute)
|
||||
+ return isinstance(obj, setools.policyrep.TypeAttribute)
|
||||
|
||||
# is given object of type "TypeAttribute" which is considered unconfined ?
|
||||
# TODO: refine -- limit to "strong" unconfined domains (associated with lots of privileges)
|
||||
--
|
||||
2.25.4
|
||||
|
||||
|
|
@ -1,18 +1,23 @@
|
|||
Name: sepolicy_analysis
|
||||
Version: 0.1
|
||||
Release: 10%{?dist}
|
||||
Release: 35%{?dist}
|
||||
Summary: SELinux policy analysis tool
|
||||
|
||||
License: GPLv3
|
||||
# Automatically converted from old format: GPLv3 - review is highly recommended.
|
||||
License: GPL-3.0-only
|
||||
URL: https://github.com/vmojzis/sepolicy_analysis
|
||||
#./setup.py egg_info --egg-base /tmp sdist
|
||||
Source0: https://github.com/vmojzis/sepolicy_analysis/releases/download/%{version}/%{name}-%{version}.tar.gz
|
||||
Patch0: 0001-Update-to-work-with-setools-4.3.patch
|
||||
|
||||
BuildArch: noarch
|
||||
|
||||
BuildRequires: python3-devel
|
||||
BuildRequires: python3-setuptools
|
||||
|
||||
Requires: setools-python3 >= 4.0
|
||||
Requires: python3-setools >= 4.0
|
||||
Requires: python3-networkx >= 1.11
|
||||
Requires: python3-matplotlib
|
||||
|
||||
%description
|
||||
Tool designed to help increase the quality of SELinux policy by identifying
|
||||
|
|
@ -20,7 +25,7 @@ possibly dangerous permission pathways, simplifying regression testing and
|
|||
providing policy visualization.
|
||||
|
||||
%prep
|
||||
%autosetup
|
||||
%autosetup -p 1
|
||||
|
||||
%build
|
||||
%py3_build
|
||||
|
|
@ -48,6 +53,83 @@ providing policy visualization.
|
|||
%doc %{_mandir}/man1/se*
|
||||
|
||||
%changelog
|
||||
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-35
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
|
||||
|
||||
* Wed Jun 03 2026 Python Maint <python-maint@redhat.com> - 0.1-34
|
||||
- Rebuilt for Python 3.15
|
||||
|
||||
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-33
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
|
||||
|
||||
* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 0.1-32
|
||||
- Rebuilt for Python 3.14.0rc3 bytecode
|
||||
|
||||
* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 0.1-31
|
||||
- Rebuilt for Python 3.14.0rc2 bytecode
|
||||
|
||||
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-30
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 0.1-29
|
||||
- Rebuilt for Python 3.14
|
||||
|
||||
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-28
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 0.1-27
|
||||
- convert license to SPDX
|
||||
|
||||
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-26
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 0.1-25
|
||||
- Rebuilt for Python 3.13
|
||||
|
||||
* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-24
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-23
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 0.1-22
|
||||
- Rebuilt for Python 3.12
|
||||
|
||||
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-21
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-20
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 0.1-19
|
||||
- Rebuilt for Python 3.11
|
||||
|
||||
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-18
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-17
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 0.1-16
|
||||
- Rebuilt for Python 3.10
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-15
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-14
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Wed Jun 24 2020 Vit Mojzis <vmojzis@redhat.com> - 0.1-13
|
||||
- Update to work with setools-4.3
|
||||
- Add missing dependency on python3-matplotlib
|
||||
|
||||
* Thu Jun 04 2020 Vit Mojzis <vmojzis@redhat.com> - 0.1-12
|
||||
- Add dependency on python3-networkx
|
||||
- Fix setools dependency (setools-python3 got renamed to python3-setools)
|
||||
|
||||
* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 0.1-11
|
||||
- Rebuilt for Python 3.9
|
||||
|
||||
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.1-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue