From 04c16e4e1e6733b4d4b04570ca5d901722da0a68 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 8 Jan 2016 23:17:47 +0100 Subject: [PATCH 001/111] setools-3.3.8-8.99.1.fc24 Update to latest upstream sources from https://github.com/TresysTechnology/setools3.git --- setools-TresysTechnology-setools3.patch | 18398 ++++++++++++++++++++++ setools.spec | 11 +- 2 files changed, 18406 insertions(+), 3 deletions(-) create mode 100644 setools-TresysTechnology-setools3.patch diff --git a/setools-TresysTechnology-setools3.patch b/setools-TresysTechnology-setools3.patch new file mode 100644 index 0000000..db82c60 --- /dev/null +++ b/setools-TresysTechnology-setools3.patch @@ -0,0 +1,18398 @@ +diff --git a/ChangeLog b/ChangeLog +index 1bce21d..c13a4dc 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,40 @@ ++2014-04-15 Richard Haines ++ ++ * Updates to libqpol to support policy source file expansion ++ to version 29. Source policies with the filename transition ++ rule will have their entries expanded twice, this is a bug ++ in libsepol. ++ Fixed bug in default_range to now diplay range component. ++ ++2014-04-14 Richard Haines ++ ++ * Updates to apol and the libapol/libqpol libraries to support ++ new policy statements and rules to version 29 (Note the features ++ for loading source code (policy.conf etc.) have not been updated ++ to support the new statements and rules. ++ These are the enhancements and bug fixes: ++ * Add permissive type and typebound support to Types tab. ++ * Add new Constraints tab to search all constraint statements. ++ * Add new Bounds tab to search for userbound, rolebound and ++ typebound statements. ++ * Add new policy capabilities tab. ++ * Add filename type_transition support on TE Rules tab. ++ * Add new Default Object tab to support defaultuser, defaultrole, ++ defaulttype and defaultrange rules. ++ * Add new Namespaces tab to list CIL namespaces. This will also ++ show any users, roles, types, classes, booleans, sensitivities ++ and categories declared in each namespace. ++ * Update Query/Policy Summary page to show the number of new ++ rules added plus the policy handle_unknown flag. ++ * Fixed File Contexts tab to stop hang when building the fc ++ index when broken links/files found (libsefs). ++ * Fixed Booleans tab to display CIL namespace booleans. ++ * Updated apol_help.txt to reflect the changes made plus how to ++ load the running policy. ++ ++2014-01-16 Chris PeBenito ++ * Fix bug preventing sediffx from starting. ++ + 2013-01-08 Steve Lawrence + + * SETools 3.3.8 +diff --git a/README b/README +index 04b159b..fcd6378 100644 +--- a/README ++++ b/README +@@ -1,4 +1,4 @@ +-SETools - Policy analysis tools for SELinux (C) 2001-2010 ++SETools - Policy analysis tools for SELinux (C) 2001-2014 + Tresys Technology + setools@tresys.com, http://oss.tresys.com/projects/setools + +@@ -9,7 +9,7 @@ TABLE OF CONTENTS + 1. Overview + 2. Installation + 2.1. compiling from official distribution +- 2.2. compiling from SVN checkout ++ 2.2. compiling from git clone + 2.3. configure flags + 2.4. using development version of SELinux + 2.5. Logwatch support +@@ -119,11 +119,11 @@ Assuming that /usr/local/bin is in your $PATH and /usr/local/lib in + $LD_LIBRARY_PATH everything should now work. + + +-2.2. compiling from SVN checkout ++2.2. compiling from git clone + -------------------------------- + + If you prefer the bleeding edge of SETools development, you could +-instead obtain the development version of SETools from the Subversion ++instead obtain the development version of SETools from the git + repository (see Section 4). + + $ cd setools +@@ -424,13 +424,13 @@ Open Source Software website, http://oss.tresys.com/projects/setools. + Tresys builds RPM packages of SETools. They may also be obtained from + the website listed above. + +-SETools source code is maintained within a Subversion repository. ++SETools source code is maintained within a git repository. + From the command line do: + +- $ svn co http://oss.tresys.com/repos/setools/trunk/ setools ++ $ git clone https://github.com/TresysTechnology/setools3.git + +-You may also browse the SVN repository at +-http://oss.tresys.com/projects/setools/browser. ++You may also browse the git repository at ++https://github.com/TresysTechnology/setools3 + + Other binary releases SETools are available for your favorite Linux + packaging system from third-party sources. Gentoo users have an +diff --git a/apol/Makefile.am b/apol/Makefile.am +index 646d8b1..4fc5562 100644 +--- a/apol/Makefile.am ++++ b/apol/Makefile.am +@@ -27,12 +27,15 @@ dist_setools_DATA = apol_help.txt domaintrans_help.txt file_relabel_help.txt \ + + EXTRA_DIST = \ + analysis_tab.tcl \ ++ bounds_tab.tcl \ + classes_perms_tab.tcl \ + common_widgets.tcl \ + cond_bools_tab.tcl \ + cond_rules_tab.tcl \ ++ constraints_tab.tcl \ + context_dialog.tcl \ + context_selector.tcl \ ++ default_objects_tab.tcl \ + directflow_module.tcl \ + domaintrans_module.tcl \ + file_contexts_tab.tcl \ +@@ -43,9 +46,11 @@ EXTRA_DIST = \ + initial_sids_tab.tcl \ + level_dialog.tcl \ + mls_tab.tcl \ ++ namespaces_tab.tcl \ + netcontexts_tab.tcl \ + open_policy_dialog.tcl \ + perms_map.tcl \ ++ polcap_tab.tcl \ + policyconf.tcl \ + progress_dialog.tcl \ + range_dialog.tcl \ +diff --git a/apol/apol_help.txt b/apol/apol_help.txt +index aad309b..1ed5a9e 100644 +--- a/apol/apol_help.txt ++++ b/apol/apol_help.txt +@@ -29,7 +29,7 @@ not report line numbers when searching monolithic binary polices. + + Apol provides compatibility with the current and previous policy + syntax. It supports analysis of monolithic policy versions 12 to the +-current version 21 and modular policy versions 5 and 6. ++current version 29 and modular policy versions to 17. + + See setools/ChangeLog for a list of new features in this release. See + setools/KNOWN_BUGS for a list of current bugs. +@@ -40,7 +40,12 @@ Menus + Use 'Open' from the File menu to open a valid policy. The policy may + be monolithic or be composed of a base linked with multiple modules. + Only one policy can be open at a time; opening a second policy will +-result in the first being closed. ++result in the first being closed. Note: If the kernel supports reading ++the currently loaded policy, then select "monolithic" and set the ++"Policy filename" path to either: ++ /selinux/policy ++ or ++ /sys/fs/selinux/policy + + The Query menu allows the user to save or load a query for a TE Rules + search or for an analysis module listed on the Analysis tab. Saving a +@@ -85,6 +90,8 @@ relate the core components of an SELinux policy. + to search for types and/or attributes using a POSIX-style regular + expression. + ++ Permissive and bound types may also be searched. ++ + Classes/Perms tab + ----------------- + Use the Classes/Perms tab to view and search object classes, common +@@ -149,6 +156,23 @@ relate the core components of an SELinux policy. + Select the FS Contexts tab to search filesystem-based contexts + (fs_use_ and genfscon statements) defined in the policy. + ++ Policy Capabilities tab ++ --------------- ++ Select the Policy Capabilities tab to display policy capabilities ++ defined in the policy. ++ ++ Policy Namespaces tab ++ --------------- ++ Select the Policy Namespaces tab to display the namespaces defined ++ in the policy. For policies with a single namespace there will be ++ one namespace displayed: "GLOBAL-NS". For policies that can define ++ multiple namespaces (e.g CIL), all namespaces will be displayed ++ including "GLOBAL-NS". ++ If the namespace entry is double clicked then a list of Users, Roles, ++ Types, Attributes, Classes and Booleans applicable to that namespace ++ will be displayed (also if MLS enabled the Sensitivities and ++ Categories will also be shown). ++ + + Policy Rules tabs + ----------------- +@@ -226,6 +250,10 @@ rules in a policy based on selected search criteria. + the checkbox is enabled, returned rules instead will contain + all of them. + ++ 4. FILENAME SUBTAB: provides options to refine a search ++ using the file name type_transition rule filename. Only rules ++ that contain the selected file name will be returned. ++ + In the Results Tab for a given search, all rules that meet the + search criteria are displayed. In addition, if the policy that is + opened is capable of showing line numbers, a hyperlink for each rule +@@ -260,6 +288,57 @@ rules in a policy based on selected search criteria. + [Enabled] - indicates the rule is enabled + [Disabled] - indicates the rule is disabled + ++ Constraints tab ++ --------------- ++ Select the Constraints tab to search through the constrain and ++ validatetrans constraint rules. If the current policy supports MLS ++ then these variants are also enabled. ++ ++ Four different types of search criteria exist for constraints: ++ ++ 1. CONSTRAINT SELECTION: provides options to limit the scope of the ++ search as only those constraints selected will be included in the ++ search. At least one must be selected. NOTE: If no additional ++ search criteria is specified, apol will search for all of the ++ selected constraints. ++ ++ 2. CLASSES/PERMISSIONS SUBTAB: provides options to refine a search ++ using object classes and/or permissions in the same way as the ++ TE Rules tab described above. Note that the validatetrans rules ++ do not use permissions. ++ ++ 3. LEFT SIDE OF EXPRESSION SUBTAB: provides an option to refine a ++ search based on the left keyword of a constraint. When checked ++ the left hand side of each expression is read from the policy and ++ displayed in the drop down box. A single keyword may then be ++ selected. ++ ++ 4. RIGHT SIDE OF EXPRESSION SUBTAB: provides options to refine a ++ search based on either the right keyword, user, role, type or type ++ attribute of a constraint. When one of the boxes is checked ++ the right keywords, users, roles, types or type attributes are ++ read from the policy and displayed in the drop down box. A single ++ item may then be selected. ++ ++ Note: When displaying the constraint details from a binary policy, the ++ result will depend on the policy version: ++ a) For versions <= 28 it will always display types as the ++ compiler expanded any attributes before writing the binary ++ policy. Therefore searches should always be for types. ++ b) For versions >= 29 it will display whatever was defined in ++ the source policy, therefore searches may be on types or ++ attributes. ++ ++ The Constraints Tab also supports multiple results windows. Each ++ active window remembers the search options used for it, and will set ++ all the options accordingly when selected. Use the "Update Search" ++ button to change the results displayed for the current window based ++ on the current search option. "New Search" creates a new results ++ window based on the current search options. Use the "Close Tab" bar ++ at the bottom to destroy a results window. Also, the Constraints tab ++ provides the means to save/load search criteria to a file (see Menus ++ section above). ++ + RBAC Rules tab + -------------- + Select the RBAC Rules tab to search role-based access control rules. +@@ -271,13 +350,18 @@ rules in a policy based on selected search criteria. + + Range Transition Rules tab + -------------------------- +- Select the Range Transition Rules tab to search to search ++ Select the Range Transition Rules tab to search for + range_transition rules by source and target types and by the MLS + range. There are three options when searching for ranges; find + exact matches to the entered range, find rules that have ranges + that contain the entered range, or find rules that have ranges + within the entered range. + ++ Bounds Rules tab ++ -------------------------- ++ Select the Bounds Rules tab to search for userbound, rolebound or ++ typebound rules by parent or child types. ++ + + File Contexts tab + ----------------- +diff --git a/apol/bounds_tab.tcl b/apol/bounds_tab.tcl +new file mode 100644 +index 0000000..906eade +--- /dev/null ++++ b/apol/bounds_tab.tcl +@@ -0,0 +1,433 @@ ++# Copyright (C) 2001-2007 Tresys Technology, LLC ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ ++namespace eval Apol_Bounds { ++ variable vals ++ variable widgets ++} ++ ++proc Apol_Bounds::create {tab_name nb} { ++ variable vals ++ variable widgets ++ ++ _initializeVars ++ ++ set frame [$nb insert end $tab_name -text "Bounds Rules"] ++ set topf [frame $frame.top] ++ set bottomf [frame $frame.bottom] ++ pack $topf -expand 0 -fill both -pady 2 ++ pack $bottomf -expand 1 -fill both -pady 2 ++ ++ set rsbox [TitleFrame $topf.rs -ipad 30 -text "Rule Selection"] ++ set obox [TitleFrame $topf.opts -text "Search Options"] ++ set dbox [TitleFrame $bottomf.results -text "Bounds Rules Display"] ++ pack $rsbox -side left -expand 0 -fill both -padx 2 ++ pack $obox -side left -expand 1 -fill both -padx 2 ++ pack $dbox -expand 1 -fill both -padx 2 ++ ++ # Rule selection subframe ++ set rs [$rsbox getframe] ++ radiobutton $rs.user -text user -value user \ ++ -variable Apol_Bounds::vals(rule_selection) ++ radiobutton $rs.role -text role -value role \ ++ -variable Apol_Bounds::vals(rule_selection) ++ radiobutton $rs.type -text type -value type \ ++ -variable Apol_Bounds::vals(rule_selection) ++ trace add variable Apol_Bounds::vals(rule_selection) write \ ++ [list Apol_Bounds::_ruleChanged] ++ pack $rs.user $rs.role $rs.type -side top -anchor w ++ ++ set widgets(options_pm) [PagesManager [$obox getframe].opts] ++ ++ _userCreate [$widgets(options_pm) add user] ++ _roleCreate [$widgets(options_pm) add role] ++ _typeCreate [$widgets(options_pm) add type] ++ ++ $widgets(options_pm) compute_size ++ pack $widgets(options_pm) -expand 1 -fill both -side left ++ $widgets(options_pm) raise type ++ ++ set ok [button [$obox getframe].ok -text OK -width 6 -command Apol_Bounds::_searchBounds] ++ pack $ok -side right -padx 5 -pady 5 -anchor ne ++ ++ set widgets(results) [Apol_Widget::makeSearchResults [$dbox getframe].results] ++ pack $widgets(results) -expand yes -fill both ++ ++ return $frame ++} ++ ++proc Apol_Bounds::open {ppath} { ++ variable vals ++ variable widgets ++ $widgets(user:user_parent) configure -values $Apol_Users::users_list ++ $widgets(user:user_child) configure -values $Apol_Users::users_list ++ $widgets(role:role_parent) configure -values $Apol_Roles::role_list ++ $widgets(role:role_child) configure -values $Apol_Roles::role_list ++ $widgets(type:type_parent) configure -values $Apol_Types::typelist ++ $widgets(type:type_child) configure -values $Apol_Types::typelist ++ ++ set vals(rule_selection) type ++} ++ ++proc Apol_Bounds::close {} { ++ variable widgets ++ ++ _initializeVars ++ $widgets(user:user_parent) configure -values {} ++ $widgets(user:user_child) configure -values {} ++ $widgets(role:role_parent) configure -values {} ++ $widgets(role:role_child) configure -values {} ++ $widgets(type:type_parent) configure -values {} ++ $widgets(type:type_child) configure -values {} ++} ++ ++proc Apol_Bounds::getTextWidget {} { ++ variable widgets ++} ++ ++#### private functions below #### ++ ++proc Apol_Bounds::_initializeVars {} { ++ variable vals ++ array set vals { ++ rule_selection type ++ ++ user_parent:use 0 ++ user_parent:sym {} ++ user_child:sym {} ++ user_child:use 0 ++ ++ role_parent:use 0 ++ role_parent:sym {} ++ role_child:sym {} ++ role_child:use 0 ++ ++ type_parent:use 0 ++ type_parent:sym {} ++ type_child:sym {} ++ type_child:use 0 ++ } ++} ++ ++proc Apol_Bounds::_userCreate {a_f} { ++ variable vals ++ variable widgets ++ ++ set user_parent [frame $a_f.user_parent] ++ set user_parent_cb [checkbutton $user_parent.enable -text "Parent user" \ ++ -variable Apol_Bounds::vals(user_parent:use)] ++ set widgets(user:user_parent) [ComboBox $user_parent.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(user_parent:sym) \ ++ -helptext "Select the bounding user" -autopost 1] ++ ++ trace add variable Apol_Bounds::vals(user_parent:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(user:user_parent) {}] ++ pack $user_parent_cb -side top -anchor w ++ pack $widgets(user:user_parent) -side top -expand 0 -fill x -padx 4 ++ ++ pack $user_parent -side left -padx 4 -pady 2 -expand 0 -anchor nw ++ ++ set user_child [frame $a_f.user_child] ++ set widgets(user:user_child_cb) [checkbutton $user_child.enable -text "Child user" \ ++ -variable Apol_Bounds::vals(user_child:use)] ++ set widgets(user:user_child) [ComboBox $user_child.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(user_child:sym) \ ++ -helptext "Select the bounded user" -autopost 1] ++ trace add variable Apol_Bounds::vals(user_child:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(user:user_child) {}] ++ pack $widgets(user:user_child_cb) -side top -anchor w ++ pack $widgets(user:user_child) -side top -expand 0 -fill x -padx 4 ++ pack $user_child -side left -padx 4 -pady 2 -expand 0 -fill y ++} ++ ++proc Apol_Bounds::_roleCreate {t_f} { ++ variable vals ++ variable widgets ++ ++ set role_parent [frame $t_f.role_parent] ++ set role_parent_cb [checkbutton $role_parent.enable -text "Parent role" \ ++ -variable Apol_Bounds::vals(role_parent:use)] ++ set widgets(role:role_parent) [ComboBox $role_parent.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(role_parent:sym) \ ++ -helptext "Select the bounding role" -autopost 1] ++ ++ trace add variable Apol_Bounds::vals(role_parent:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(role:role_parent) {}] ++ pack $role_parent_cb -side top -anchor w ++ pack $widgets(role:role_parent) -side top -expand 0 -fill x -padx 4 ++ ++ pack $role_parent -side left -padx 4 -pady 2 -expand 0 -anchor nw ++ ++ set role_child [frame $t_f.role_child] ++ set widgets(role:role_child_cb) [checkbutton $role_child.enable -text "Child role" \ ++ -variable Apol_Bounds::vals(role_child:use)] ++ set widgets(role:role_child) [ComboBox $role_child.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(role_child:sym) \ ++ -helptext "Select the bounded role" -autopost 1] ++ trace add variable Apol_Bounds::vals(role_child:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(role:role_child) {}] ++ pack $widgets(role:role_child_cb) -side top -anchor w ++ pack $widgets(role:role_child) -side top -expand 0 -fill x -padx 4 ++ pack $role_child -side left -padx 4 -pady 2 -expand 0 -fill y ++} ++ ++proc Apol_Bounds::_typeCreate {b_t} { ++ variable vals ++ variable widgets ++ ++ set type_parent [frame $b_t.type_parent] ++ set type_parent_cb [checkbutton $type_parent.enable -text "Parent type" \ ++ -variable Apol_Bounds::vals(type_parent:use)] ++ set widgets(type:type_parent) [ComboBox $type_parent.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(type_parent:sym) \ ++ -helptext "Select the bounding type" -autopost 1] ++ ++ trace add variable Apol_Bounds::vals(type_parent:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(type:type_parent) {}] ++ pack $type_parent_cb -side top -anchor w ++ pack $widgets(type:type_parent) -side top -expand 0 -fill x -padx 4 ++ ++ pack $type_parent -side left -padx 4 -pady 2 -expand 0 -anchor nw ++ ++ set type_child [frame $b_t.type_child] ++ set widgets(type:type_child_cb) [checkbutton $type_child.enable -text "Child type" \ ++ -variable Apol_Bounds::vals(type_child:use)] ++ set widgets(type:type_child) [ComboBox $type_child.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Bounds::vals(type_child:sym) \ ++ -helptext "Select the bounded type" -autopost 1] ++ trace add variable Apol_Bounds::vals(type_child:use) write \ ++ [list Apol_Bounds::_toggleCheckbutton $widgets(type:type_child) {}] ++ pack $widgets(type:type_child_cb) -side top -anchor w ++ pack $widgets(type:type_child) -side top -expand 0 -fill x -padx 4 ++ pack $type_child -side left -padx 4 -pady 2 -expand 0 -fill y ++} ++ ++proc Apol_Bounds::_toggleCheckbutton {cb w name1 name2 ops} { ++ variable vals ++ ++ if {$vals($name2)} { ++ $cb configure -state normal -entrybg white ++ foreach x $w { ++ $x configure -state normal ++ } ++ } else { ++ $cb configure -state disabled -entrybg $ApolTop::default_bg_color ++ foreach x $w { ++ $x configure -state disabled ++ } ++ } ++} ++ ++# callback invoked when the user changes which Bounds rule to search ++proc Apol_Bounds::_ruleChanged {name1 name2 ops} { ++ variable vals ++ variable widgets ++ Apol_Widget::clearSearchResults $widgets(results) ++ $widgets(options_pm) raise $vals(rule_selection) ++} ++ ++proc Apol_Bounds::_searchBounds {} { ++ variable vals ++ variable widgets ++ ++ Apol_Widget::clearSearchResults $widgets(results) ++ if {![ApolTop::is_policy_open]} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No current policy file is opened." ++ return ++ } ++ ++ if {$vals(rule_selection) == "user"} { ++ Apol_Bounds::_searchUserBounds ++ return ++ } ++ if {$vals(rule_selection) == "role"} { ++ Apol_Bounds::_searchRoleBounds ++ return ++ } ++ ++ if {$vals(rule_selection) == "type" } { ++ Apol_Bounds::_searchTypeBounds ++ return ++ } ++} ++ ++proc Apol_Bounds::_searchUserBounds {} { ++ variable vals ++ variable widgets ++ ++ set results {} ++ set bounds {} ++ set counter 0 ++ set printit 0 ++ set parent_regexp 0 ++ set child_regexp 0 ++ ++ if {$vals(user_parent:use) && $vals(user_parent:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No parent user selected." ++ } elseif {$vals(user_parent:use)} { ++ set parent_regexp 1 ++ } ++ if {$vals(user_child:use) && $vals(user_child:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No child user selected." ++ } elseif {$vals(user_child:use)} { ++ set child_regexp 1 ++ } ++ ++ set q [new_apol_userbounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_userbounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ set child [$q get_child_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ if {$parent_regexp == 1 && $parent == $vals(user_parent:sym)} { ++ set printit 1 ++ } ++ if {$child_regexp == 1 && $child == $vals(user_child:sym)} { ++ set printit 1 ++ } ++ if {$parent_regexp == 0 && $child_regexp == 0} { ++ set printit 1 ++ } ++ if {$printit == 1} { ++ append bounds "userbounds $parent " ++ append bounds "$child;\n" ++ set counter [expr $counter + 1] ++ } ++ } ++ set printit 0 ++ } ++ } ++ append results "$counter rules match search criteria.\n\n$bounds\n" ++ Apol_Widget::appendSearchResultText $widgets(results) $results ++} ++ ++proc Apol_Bounds::_searchRoleBounds {} { ++ variable vals ++ variable widgets ++ ++ set results {} ++ set bounds {} ++ set counter 0 ++ set printit 0 ++ set parent_regexp 0 ++ set child_regexp 0 ++ ++ if {$vals(role_parent:use) && $vals(role_parent:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No parent role selected." ++ } elseif {$vals(role_parent:use)} { ++ set parent_regexp 1 ++ } ++ if {$vals(role_child:use) && $vals(role_child:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No child role selected." ++ } elseif {$vals(role_child:use)} { ++ set child_regexp 1 ++ } ++ ++ set q [new_apol_rolebounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_rolebounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ set child [$q get_child_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ if {$parent_regexp == 1 && $parent == $vals(role_parent:sym)} { ++ set printit 1 ++ } ++ if {$child_regexp == 1 && $child == $vals(role_child:sym)} { ++ set printit 1 ++ } ++ if {$parent_regexp == 0 && $child_regexp == 0} { ++ set printit 1 ++ } ++ if {$printit == 1} { ++ append bounds "rolebounds $parent " ++ append bounds "$child;\n" ++ set counter [expr $counter + 1] ++ } ++ } ++ set printit 0 ++ } ++ } ++ append results "$counter rules match search criteria.\n\n$bounds\n" ++ Apol_Widget::appendSearchResultText $widgets(results) $results ++} ++ ++proc Apol_Bounds::_searchTypeBounds {} { ++ variable vals ++ variable widgets ++ ++ set results {} ++ set bounds {} ++ set counter 0 ++ set printit 0 ++ set parent_regexp 0 ++ set child_regexp 0 ++ ++ if {$vals(type_parent:use) && $vals(type_parent:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No parent type selected." ++ } elseif {$vals(type_parent:use)} { ++ set parent_regexp 1 ++ } ++ if {$vals(type_child:use) && $vals(type_child:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No child type selected." ++ } elseif {$vals(type_child:use)} { ++ set child_regexp 1 ++ } ++ ++ set q [new_apol_typebounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_typebounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ set child [$q get_child_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ if {$parent_regexp == 1 && $parent == $vals(type_parent:sym)} { ++ set printit 1 ++ } ++ if {$child_regexp == 1 && $child == $vals(type_child:sym)} { ++ set printit 1 ++ } ++ if {$parent_regexp == 0 && $child_regexp == 0} { ++ set printit 1 ++ } ++ if {$printit == 1} { ++ append bounds "typebounds $parent " ++ append bounds "$child;\n" ++ set counter [expr $counter + 1] ++ } ++ } ++ set printit 0 ++ } ++ } ++ append results "$counter rules match search criteria.\n\n$bounds\n" ++ Apol_Widget::appendSearchResultText $widgets(results) $results ++} ++ +diff --git a/apol/cond_bools_tab.tcl b/apol/cond_bools_tab.tcl +index 76356f1..25c8dee 100644 +--- a/apol/cond_bools_tab.tcl ++++ b/apol/cond_bools_tab.tcl +@@ -107,7 +107,9 @@ proc Apol_Cond_Bools::open {ppath} { + foreach bool $cond_bools_list { + set b [new_qpol_bool_t $::ApolTop::qpolicy $bool] + set cond_bools_defaults($bool) [$b get_state $::ApolTop::qpolicy] +- _insert_listbox_item $bool $cond_bools_defaults($bool) ++ # This is a workaround as frames do not like the "." in CIL booleans ++ set frame_bool [string map {. *} $bool] ++ _insert_listbox_item $bool $cond_bools_defaults($bool) $frame_bool + } + + variable widgets +@@ -161,21 +163,21 @@ proc Apol_Cond_Bools::_initializeVars {} { + } + } + +-proc Apol_Cond_Bools::_insert_listbox_item {bool initial_state} { ++proc Apol_Cond_Bools::_insert_listbox_item {bool initial_state frame_bool} { + variable widgets + variable cond_bools_values + + set cond_bools_values($bool) $initial_state + set subf [$widgets(listbox) getframe] +- set rb_true [radiobutton $subf.t:$bool -bg white \ ++ set rb_true [radiobutton $subf.t:$frame_bool -bg white \ + -variable Apol_Cond_Bools::cond_bools_values($bool) \ + -value 1 -highlightthickness 0 -text "True"] +- set rb_false [radiobutton $subf.f:$bool -bg white \ ++ set rb_false [radiobutton $subf.f:$frame_bool -bg white \ + -variable Apol_Cond_Bools::cond_bools_values($bool) \ + -value 0 -highlightthickness 0 -text "False"] + trace add variable Apol_Cond_Bools::cond_bools_values($bool) write \ + [list Apol_Cond_Bools::_set_bool_value] +- set rb_label [label $subf.l:$bool -bg white -text "- $bool"] ++ set rb_label [label $subf.l:$frame_bool -bg white -text "- $bool"] + grid $rb_true $rb_false $rb_label -padx 2 -pady 5 -sticky w + } + +diff --git a/apol/constraints_tab.tcl b/apol/constraints_tab.tcl +new file mode 100644 +index 0000000..965e584 +--- /dev/null ++++ b/apol/constraints_tab.tcl +@@ -0,0 +1,1589 @@ ++# This tab will allow searching of constrain and validatetrans constraint ++# rules within the policy. The mls versions are also searched if an ++# mls policy is loaded. ++# ++# This tab has been derived from the terules_tab. ++# ++# Author: Richard Haines richard_c_haines@btinternet.com ++# ++# Copyright (C) 2001-2007 Tresys Technology, LLC ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ ++namespace eval Apol_Constraint { ++ variable vals ++ variable widgets ++ variable tabs ++ variable enabled ++ ++ variable opts ++ variable constraint_list {} ++ variable left_expr_list {} ++ variable right_expr_list {} ++ variable mls_enabled {0} ++ variable match_right_type_names 0 ++ variable statement_count 0 ++} ++ ++proc Apol_Constraint::create {tab_name nb} { ++ variable vals ++ variable widgets ++ ++ _initializeVars ++ ++ set frame [$nb insert end $tab_name -text "Constraints"] ++ set pw [PanedWindow $frame.pw -side left -weights extra] ++ set topf [$pw add -weight 0] ++ set bottomf [$pw add -weight 1] ++ pack $pw -expand 1 -fill both ++ ++ # Major SubFrames: ++ # rsbox - constrain selection ++ # rbox - holds display window widgets ++ # abox - action buttons ++ set top_leftf [frame $topf.tl] ++ set widgets(search_opts) [NoteBook $topf.nb] ++ set abox [frame $topf.abox] ++ pack $top_leftf -side left -expand 0 -fill y ++ pack $widgets(search_opts) -side left -expand 1 -fill both -padx 10 ++ pack $abox -side right -fill y -padx 5 ++ set rsbox [TitleFrame $top_leftf.rsbox -text "Constraint Selection"] ++ set rbox [TitleFrame $bottomf.rbox -text "Constraint Search Results"] ++ pack $rsbox -side top -fill both -expand 1 ++ pack $rbox -expand yes -fill both -padx 2 ++ ++ # Constraint selection subframe ++ set fm_constraints [$rsbox getframe] ++ set constrain [checkbutton $fm_constraints.constrain -text "constrain" \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(rs:constrain_enabled)] ++ set mlsconstrain [checkbutton $fm_constraints.mlsconstrain -text "mlsconstrain" \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(rs:mlsconstrain_enabled)] ++ set validatetrans [checkbutton $fm_constraints.validatetrans -text "validatetrans" \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(rs:validatetrans_enabled)] ++ set mlsvalidatetrans [checkbutton $fm_constraints.mlsvalidatetrans -text "mlsvalidatetrans" \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(rs:mlsvalidatetrans_enabled)] ++ grid $constrain -sticky w -padx 10 ++ grid $mlsconstrain -sticky w -padx 10 ++ grid $validatetrans -sticky w -padx 10 -pady {30 0} ++ grid $mlsvalidatetrans -sticky w -padx 10 ++ ++ _createClassesPermsTab ++ _createLeftExpressionTab ++ _createRightExpressionTab ++ ++ # Action buttons ++ set widgets(new) [button $abox.new -text "New Search" -width 12 \ ++ -command [list Apol_Constraint::_search_constraints new]] ++ set widgets(update) [button $abox.update -text "Update Search" -width 12 -state disabled \ ++ -command [list Apol_Constraint::_search_constraints update]] ++ set widgets(reset) [button $abox.reset -text "Reset Criteria" -width 12 \ ++ -command Apol_Constraint::_reset] ++ pack $widgets(new) $widgets(update) $widgets(reset) \ ++ -side top -pady 5 -padx 5 -anchor ne ++ ++ $widgets(search_opts) compute_size ++ ++ # Popup menu widget ++ set popupTab_Menu [menu .popup_constrain_rules -tearoff 0] ++ set tab_menu_callbacks \ ++ [list {"Close Tab" Apol_Constraint::_delete_results} \ ++ {"Rename Tab" Apol_Constraint::_display_rename_tab_dialog}] ++ ++ # Notebook creation for results ++ set widgets(results) [NoteBook [$rbox getframe].results] ++ $widgets(results) bindtabs Apol_Constraint::_switch_to_tab ++ $widgets(results) bindtabs \ ++ [list ApolTop::popup \ ++ %W %x %y $popupTab_Menu $tab_menu_callbacks] ++ set close [button [$rbox getframe].close -text "Close Tab" \ ++ -command Apol_Constraint::_delete_current_results] ++ pack $widgets(results) -expand 1 -fill both -padx 4 ++ pack $close -expand 0 -fill x -padx 4 -pady 2 ++ ++ _initializeVars ++ return $frame ++} ++ ++ ++proc Apol_Constraint::open {ppath} { ++ variable mls_enabled ++ ++ if {[ApolTop::is_capable "mls"]} { ++ set mls_enabled 1 ++ } else { ++ set mls_enabled 0 ++ } ++ ++ _initializeVars ++ _initializeWidgets ++ _initializeTabs ++ ++ variable vals ++ variable enabled ++ set vals(cp:classes) [Apol_Class_Perms::getClasses] ++ set enabled(cp:classes) 1 ++ set enabled(cp:perms) 1 ++} ++ ++ ++proc Apol_Constraint::close {} { ++ _initializeTabs ++ _initializeWidgets ++ _initializeVars ++ set enabled(cp:perms) 1 ++ ++ variable constraint_list {} ++ variable left_expr_list {} ++ variable right_expr_list {} ++} ++ ++ ++proc Apol_Constraint::getTextWidget {} { ++ variable widgets ++ variable tabs ++ ++ if {[$widgets(results) pages] != {}} { ++ set raisedPage [$widgets(results) raise] ++ if {$raisedPage != {}} { ++ return $tabs($raisedPage).tb ++ } ++ } ++ return {} ++} ++ ++ ++proc Apol_Constraint::save_query_options {file_channel query_file} { ++ variable vals ++ ++ foreach {key value} [array get vals] { ++ if {$key != "cp:classes" && $key != "cp:perms"} { ++ puts $file_channel "$key $value" ++ } ++ } ++} ++ ++ ++proc Apol_Constraint::load_query_options {file_channel} { ++ variable vals ++ variable widgets ++ variable enabled ++ _initializeVars ++ ++ # load as many values as possible ++ set classes_selected {} ++ set perms_selected {} ++ while {[gets $file_channel line] >= 0} { ++ set line [string trim $line] ++ # Skip empty lines and comments ++ if {$line == {} || [string index $line 0] == "#"} { ++ continue ++ } ++ regexp -line -- {^(\S+)( (.+))?} $line -> key --> value ++ if {$key == "cp:classes_selected"} { ++ set classes_selected $value ++ } elseif {$key == "cp:perms_selected"} { ++ set perms_selected $value ++ } else { ++ set vals($key) $value ++ } ++ } ++ ++ # update the display ++ _initializeWidgets ++ set vals(cp:classes) [Apol_Class_Perms::getClasses] ++ set enabled(cp:classes) 1 ++ set enabled(cp:perms) 1 ++ _toggle_perms_toshow -> -> reset ++ ++ # then verify that selected object classes and permissions exist ++ # for this policy ++ set unknowns {} ++ set vals(cp:classes_selected) {} ++ foreach class $classes_selected { ++ if {[set i [lsearch $vals(cp:classes) $class]] >= 0} { ++ $widgets(cp:classes) selection set $i ++ lappend vals(cp:classes_selected) $class ++ } else { ++ lappend unknowns $class ++ } ++ } ++ if {[llength $unknowns] > 0} { ++ tk_messageBox -icon warning -type ok -title "Open Apol Query" \ ++ -message "The following object classes do not exist in the currently loaded policy and were ignored:\n\n[join $unknowns ", "]" \ ++ -parent . ++ } ++ ++ _toggle_perms_toshow {} {} {} ++ set unknowns {} ++ set vals(cp:perms_selected) {} ++ foreach perm $perms_selected { ++ if {[set i [lsearch $vals(cp:perms) $perm]] >= 0} { ++ $widgets(cp:perms) selection set $i ++ lappend vals(cp:perms_selected) $perm ++ } else { ++ lappend unknowns $perm ++ } ++ } ++ if {[llength $unknowns] > 0} { ++ tk_messageBox -icon warning -type ok -title "Open Apol Query" \ ++ -message "The following permissions do not exist in the currently loaded policy and were ignored:\n\n[join $unknowns ", "]" \ ++ -parent $parentDlg ++ } ++} ++ ++ ++#### private functions below #### ++ ++proc Apol_Constraint::_initializeVars {} { ++ variable vals ++ variable mls_enabled ++ ++ array set vals [list \ ++ rs:constrain_enabled 1 \ ++ rs:mlsconstrain_enabled $mls_enabled \ ++ rs:validatetrans_enabled 1 \ ++ rs:mlsvalidatetrans_enabled $mls_enabled \ ++ ++ kta:left_expr,left_keyword 1 \ ++ kta:right_expr,right_keyword 0 \ ++ kta:right_expr,types 0 \ ++ kta:right_expr,users 0 \ ++ kta:right_expr,roles 0 \ ++ kta:right_expr,attribs 0 \ ++ ] ++ ++ array set vals { ++ kta:use_left_expr 0 ++ kta:left_expr {} ++ ++ kta:use_right_expr 0 ++ kta:right_expr {} ++ kta:right_expr_replace_types 0 ++ ++ cp:classes {} ++ cp:classes_selected {} ++ cp:perms {} ++ cp:perms_selected {} ++ cp:perms_toshow all ++ cp:perms_matchall 0 ++ } ++ ++ variable enabled ++ array set enabled { ++ kta:use_left_expr 1 ++ kta:use_right_expr 1 ++ ++ cp:classes 0 ++ cp:perms 0 ++ } ++} ++ ++ ++proc Apol_Constraint::_initializeTabs {} { ++ variable widgets ++ variable tabs ++ ++ array set tabs { ++ next_result_id 1 ++ } ++ foreach p [$widgets(results) pages 0 end] { ++ _delete_results $p ++ } ++} ++ ++ ++proc Apol_Constraint::_initializeWidgets {} { ++ variable widgets ++ ++ $widgets(search_opts) raise left_expr_entry ++ $widgets(search_opts) raise right_expr_entry ++ ++ $widgets(cp:classes) selection clear 0 end ++ $widgets(cp:perms) selection clear 0 end ++} ++ ++ ++proc Apol_Constraint::_createLeftExpressionTab {} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ set ta_tab [$widgets(search_opts) insert end left_expr_entry -text "Left Side of Expression"] ++ set fm_left_expr [frame $ta_tab.left_expr] ++ grid $fm_left_expr -padx 4 -sticky ewns ++ foreach i {0} { ++ grid columnconfigure $ta_tab $i -weight 1 -uniform 1 ++ } ++ grid rowconfigure $ta_tab 0 -weight 1 ++# prefix frame title left_side right_side ++ _create_expression_box left_expr $fm_left_expr "Keyword" 1 0 ++ ++ $widgets(search_opts) raise left_expr_entry ++} ++ ++ ++proc Apol_Constraint::_createRightExpressionTab {} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ set ta_tab [$widgets(search_opts) insert end right_expr_entry -text "Right Side of Expression"] ++ set fm_right_expr [frame $ta_tab.right_expr] ++ grid $fm_right_expr -padx 4 -sticky ewns ++ foreach i {0} { ++ grid columnconfigure $ta_tab $i -weight 1 -uniform 1 ++ } ++ grid rowconfigure $ta_tab 0 -weight 1 ++# prefix frame title left_side right_side ++ _create_expression_box right_expr $fm_right_expr "Select either a keyword, user, role, type or type attribute" 0 1 ++ ++ $widgets(search_opts) raise right_expr_entry ++} ++ ++ ++proc Apol_Constraint::_create_expression_box {prefix f title left_expr right_expr} { ++ variable vals ++ variable widgets ++ ++ set widgets(kta:use_${prefix}) [checkbutton $f.use -text $title \ ++ -variable Apol_Constraint::vals(kta:use_${prefix})] ++ pack $widgets(kta:use_${prefix}) -side top -anchor w ++ trace add variable Apol_Constraint::vals(kta:use_${prefix}) write \ ++ [list Apol_Constraint::_toggle_expression_box $prefix] ++ ++ set w {} ++ ++ if {$right_expr} { ++ set helptext "Select a keyword, user, role, type or type attribute for the right hand side of the constraint expression e.g.: \ ++\n (left right) \ ++\n (t1 == mlstrustedobject) \ ++\n (r1 dom r2) \ ++\n (r1 != system_r)\n \ ++\nIf a type or attribute is selected the \"Only direct matches\" box can be used to determine searching as follows:\n \ ++\n - If selected the type or type attribute identifier will be used for the match.\n \ ++\n - If unselected and a type is selected: \ ++\n The type identifier will be used for matching, also any type attributes found within the constraints expression will \ ++\n be expanded and its list of types searched for a match.\n \ ++\n - If unselected and an attribute is selected: \ ++\n The type attribute identifier will be used for matching, also any types found within the constraints expression will \ ++\n have its associated type attributes searched for a match.\n" ++ } else { ++ set helptext "Select a keyword for the left hand side of the constraint expression e.g.: \ ++\n (left right)\n (r1 == r2)" ++ } ++ ++ set widgets(kta:${prefix}) [ComboBox $f.sym \ ++ -state disabled -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_Constraint::vals(kta:${prefix}) \ ++ -helptext $helptext -autopost 1] ++ pack $widgets(kta:${prefix}) -expand 0 -fill x -padx 8 ++ lappend w $widgets(kta:${prefix}) ++ ++ if {$left_expr} { ++ set ta_frame [frame $f.ta] ++ pack $ta_frame -expand 0 -anchor center -pady 2 ++ trace add variable Apol_Constraint::vals(kta:${prefix},left_keyword) write \ ++ [list Apol_Constraint::_toggle_left_side $prefix] ++ pack $widgets(kta:${prefix}) -expand 0 -fill x -padx 8 ++ lappend w $widgets(kta:${prefix}) ++ ++ } ++ ++ if {$right_expr} { ++ set ta_frame [frame $f.ta] ++ pack $ta_frame -expand 0 -anchor w -pady 2 ++ set right_keyword [checkbutton $ta_frame.right_keyword -text "Keyword" -state disabled \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(kta:${prefix},right_keyword)] ++ ++ set users [checkbutton $ta_frame.users -text "Users" -state disabled \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(kta:${prefix},users)] ++ ++ set roles [checkbutton $ta_frame.roles -text "Roles" -state disabled \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(kta:${prefix},roles)] ++ ++ set types [checkbutton $ta_frame.types -text "Types" -state disabled \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(kta:${prefix},types)] ++ set attribs [checkbutton $ta_frame.attribs -text "Attributes" -state disabled \ ++ -onvalue 1 -offvalue 0 \ ++ -variable Apol_Constraint::vals(kta:${prefix},attribs)] ++ ++ $right_keyword configure -command [list Apol_Constraint::_toggle_kta_pushed $prefix $right_keyword] ++ $users configure -command [list Apol_Constraint::_toggle_kta_pushed $prefix $users] ++ $roles configure -command [list Apol_Constraint::_toggle_kta_pushed $prefix $roles] ++ $types configure -command [list Apol_Constraint::_toggle_kta_pushed $prefix $types] ++ $attribs configure -command [list Apol_Constraint::_toggle_kta_pushed $prefix $attribs] ++ ++ trace add variable Apol_Constraint::vals(kta:${prefix},right_keyword) write \ ++ [list Apol_Constraint::_toggle_right_side $prefix] ++ trace add variable Apol_Constraint::vals(kta:${prefix},users) write \ ++ [list Apol_Constraint::_toggle_right_side $prefix] ++ trace add variable Apol_Constraint::vals(kta:${prefix},roles) write \ ++ [list Apol_Constraint::_toggle_right_side $prefix] ++ trace add variable Apol_Constraint::vals(kta:${prefix},types) write \ ++ [list Apol_Constraint::_toggle_right_side $prefix] ++ trace add variable Apol_Constraint::vals(kta:${prefix},attribs) write \ ++ [list Apol_Constraint::_toggle_right_side $prefix] ++ ++ pack $right_keyword $users $roles $types $attribs -side left -anchor w -padx 2 ++ lappend w $right_keyword $users $roles $types $attribs ++ } ++ ++ set widgets(kta:${prefix}_widgets) $w ++ trace add variable Apol_Constraint::enabled(kta:use_${prefix}) write \ ++ [list Apol_Constraint::_toggle_left_right_box $prefix] ++} ++ ++ ++# called when there is a change in state to the top checkbutton within ++# an expression box ++proc Apol_Constraint::_toggle_expression_box {col name1 name2 op} { ++ variable enabled ++ ++ # force a refresh of this box's state; this invokes ++ # _toggle_left_right_box callback ++ set enabled(kta:use_${col}) $enabled(kta:use_${col}) ++} ++ ++ ++# disallow keyword, types and attribs to be selected within a kta box ++proc Apol_Constraint::_toggle_kta_pushed {col cb} { ++ variable vals ++ ++ if {($vals(kta:${col},right_keyword) && $vals(kta:${col},attribs)) || \ ++ ($vals(kta:${col},right_keyword) && $vals(kta:${col},users)) || \ ++ ($vals(kta:${col},right_keyword) && $vals(kta:${col},roles)) || \ ++ ($vals(kta:${col},right_keyword) && $vals(kta:${col},types)) || \ ++ ($vals(kta:${col},attribs) && $vals(kta:${col},users)) || \ ++ ($vals(kta:${col},attribs) && $vals(kta:${col},roles)) || \ ++ ($vals(kta:${col},attribs) && $vals(kta:${col},types)) || \ ++ ($vals(kta:${col},users) && $vals(kta:${col},roles)) || \ ++ ($vals(kta:${col},users) && $vals(kta:${col},types)) || \ ++ ($vals(kta:${col},roles) && $vals(kta:${col},types)) } { ++ tk_messageBox -icon error -type ok -title "Constraint Search" -message "Select either a keyword, user, role, type or type attribute." ++ $cb deselect ++ return ++ } ++} ++ ++ ++# called whenever the left or right box is enabled or disabled ++proc Apol_Constraint::_toggle_left_right_box {col name1 name2 op} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ if {$enabled(kta:use_${col})} { ++ $widgets(kta:use_${col}) configure -state normal ++ } else { ++ $widgets(kta:use_${col}) configure -state disabled ++ } ++ if {$enabled(kta:use_${col}) && $vals(kta:use_${col})} { ++ foreach w $widgets(kta:${col}_widgets) { ++ $w configure -state normal ++ } ++ $widgets(kta:${col}) configure -entrybg white ++ } else { ++ foreach w $widgets(kta:${col}_widgets) { ++ $w configure -state disabled ++ } ++ $widgets(kta:${col}) configure -entrybg $ApolTop::default_bg_color ++ } ++ ++ # update this tab's name if one of the columns is enabled and used ++ if {($enabled(kta:use_left_expr) && $vals(kta:use_left_expr))} { ++ $widgets(search_opts) itemconfigure left_expr_entry -text "Left Side of Expression *" ++ } else { ++ $widgets(search_opts) itemconfigure left_expr_entry -text "Left Side of Expression" ++ } ++ ++ if {($enabled(kta:use_right_expr) && $vals(kta:use_right_expr))} { ++ $widgets(search_opts) itemconfigure right_expr_entry -text "Right Side of Expression *" ++ } else { ++ $widgets(search_opts) itemconfigure right_expr_entry -text "Right Side of Expression" ++ } ++} ++ ++ ++proc Apol_Constraint::_toggle_left_side {col name1 name2 op} { ++ variable vals ++ variable widgets ++ ++ set items {} ++ ++ if {$vals(kta:${col},left_keyword)} { ++ append items [Apol_Constraint::getLeftKeyword] ++ } ++ $widgets(kta:${col}) configure -values $items ++} ++ ++ ++proc Apol_Constraint::_toggle_right_side {col name1 name2 op} { ++ variable vals ++ variable widgets ++ ++ set items {} ++ ++ if {$vals(kta:${col},right_keyword)} { ++ append items [Apol_Constraint::getRightKeyword] ++ } ++ if {$vals(kta:${col},users)} { ++ append items [Apol_Users::getUsers] ++ } ++ if {$vals(kta:${col},roles)} { ++ append items [Apol_Roles::getRoles] ++ } ++ if {$vals(kta:${col},types)} { ++ append items [Apol_Types::getTypes] ++ } ++ if {$vals(kta:${col},attribs)} { ++ append items [Apol_Types::getAttributes] ++ } ++ ++ $widgets(kta:${col}) configure -values $items ++} ++ ++ ++# Returns a list of left keywords ++proc Apol_Constraint::getLeftKeyword {} { ++ variable vals ++ variable left_expr_list ++ set left_expr_list {} ++ ++ if {[ApolTop::is_policy_open]} { ++ if { $vals(rs:constrain_enabled) == 1 || $vals(rs:mlsconstrain_enabled) == 1 } { ++ append left_expr_list [Apol_Constraint::_getKeywords "l" new_apol_constraint_query_t] ++ } ++ if { $vals(rs:validatetrans_enabled) == 1 || $vals(rs:mlsvalidatetrans_enabled) == 1 } { ++ append left_expr_list [Apol_Constraint::_getKeywords "l" new_apol_validatetrans_query_t] ++ } ++ lsort -unique $left_expr_list ++ } else { ++ set left_expr_list "" ++ } ++} ++ ++ ++# Returns a list of right keywords ++proc Apol_Constraint::getRightKeyword {} { ++ variable vals ++ variable right_expr_list ++ set right_expr_list {} ++ ++ if {[ApolTop::is_policy_open]} { ++ if { $vals(rs:constrain_enabled) == 1 || $vals(rs:mlsconstrain_enabled) == 1 } { ++ append right_expr_list [Apol_Constraint::_getKeywords "r" new_apol_constraint_query_t] ++ } ++ if { $vals(rs:validatetrans_enabled) == 1 || $vals(rs:mlsvalidatetrans_enabled) == 1 } { ++ append right_expr_list [Apol_Constraint::_getKeywords "r" new_apol_validatetrans_query_t] ++ } ++ lsort -unique $right_expr_list ++ } else { ++ set right_expr_list "" ++ } ++} ++ ++ ++ ++# code to create and handle the classe/permissions subtab ++proc Apol_Constraint::_createClassesPermsTab {} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ set objects_tab [$widgets(search_opts) insert end classperms -text "Classes/Permissions"] ++ set fm_objs [TitleFrame $objects_tab.objs -text "Object Classes"] ++ set fm_perms [TitleFrame $objects_tab.perms -text "Permissions"] ++ pack $fm_objs -side left -expand 0 -fill both -padx 2 -pady 2 ++ pack $fm_perms -side left -expand 1 -fill both -padx 2 -pady 2 ++ ++ # object classes subframe ++ set sw [ScrolledWindow [$fm_objs getframe].sw -auto both] ++ set widgets(cp:classes) [listbox [$sw getframe].lb -height 5 -width 24 \ ++ -highlightthickness 0 -selectmode multiple \ ++ -exportselection 0 -state disabled \ ++ -bg $ApolTop::default_bg_color \ ++ -listvar Apol_Constraint::vals(cp:classes)] ++ $sw setwidget $widgets(cp:classes) ++ update ++ grid propagate $sw 0 ++ bind $widgets(cp:classes) <> \ ++ [list Apol_Constraint::_toggle_cp_select classes] ++ pack $sw -expand 1 -fill both ++ set clear [button [$fm_objs getframe].b -text "Clear" -width 6 -state disabled \ ++ -command [list Apol_Constraint::_clear_cp_listbox $widgets(cp:classes) classes]] ++ pack $clear -expand 0 -pady 2 ++ set widgets(cp:classes_widgets) [list $widgets(cp:classes) $clear] ++ ++ # permissions subframe ++ set f [$fm_perms getframe] ++ set sw [ScrolledWindow $f.sw -auto both] ++ set widgets(cp:perms) [listbox [$sw getframe].lb -height 5 -width 24 \ ++ -highlightthickness 0 -selectmode multiple \ ++ -exportselection 0 -bg white \ ++ -listvar Apol_Constraint::vals(cp:perms)] ++ $sw setwidget $widgets(cp:perms) ++ update ++ grid propagate $sw 0 ++ bind $widgets(cp:perms) <> \ ++ [list Apol_Constraint::_toggle_cp_select perms] ++ set clear [button $f.clear -text "Clear" \ ++ -command [list Apol_Constraint::_clear_cp_listbox $widgets(cp:perms) perms]] ++ set reverse [button $f.reverse -text "Reverse" \ ++ -command [list Apol_Constraint::_reverse_cp_listbox $widgets(cp:perms)]] ++ set perm_opts_f [frame $f.perms] ++ set perm_rb_f [frame $perm_opts_f.rb] ++ set l [label $perm_rb_f.l -text "Permissions to show:" -state disabled] ++ set all [radiobutton $perm_rb_f.all -text "All" \ ++ -variable Apol_Constraint::vals(cp:perms_toshow) -value all] ++ set union [radiobutton $perm_rb_f.union -text "All for selected classes" \ ++ -variable Apol_Constraint::vals(cp:perms_toshow) -value union] ++ set intersect [radiobutton $perm_rb_f.inter -text "Common to selected classes" \ ++ -variable Apol_Constraint::vals(cp:perms_toshow) -value intersect] ++ trace add variable Apol_Constraint::vals(cp:perms_toshow) write \ ++ Apol_Constraint::_toggle_perms_toshow ++ pack $l $all $union $intersect -anchor w ++ set all_perms [checkbutton $perm_opts_f.all -text "Constraint must have all selected permissions" \ ++ -variable Apol_Constraint::vals(cp:perms_matchall)] ++ pack $perm_rb_f $all_perms -anchor w -pady 4 -padx 4 ++ grid $sw - $perm_opts_f -sticky nsw ++ grid $clear $reverse ^ -pady 2 -sticky ew ++ grid columnconfigure $f 0 -weight 0 -uniform 1 -pad 2 ++ grid columnconfigure $f 1 -weight 0 -uniform 1 -pad 2 ++ grid columnconfigure $f 2 -weight 1 ++ grid rowconfigure $f 0 -weight 1 ++ set widgets(cp:perms_widgets) \ ++ [list $widgets(cp:perms) $clear $reverse $l $all $union $intersect $all_perms] ++ ++ trace add variable Apol_Constraint::vals(cp:classes_selected) write \ ++ [list Apol_Constraint::_update_cp_tabname] ++ trace add variable Apol_Constraint::vals(cp:perms_selected) write \ ++ [list Apol_Constraint::_update_cp_tabname] ++ trace add variable Apol_Constraint::enabled(cp:classes) write \ ++ [list Apol_Constraint::_toggle_enable_cp classes] ++ trace add variable Apol_Constraint::enabled(cp:perms) write \ ++ [list Apol_Constraint::_toggle_enable_cp perms] ++} ++ ++ ++proc Apol_Constraint::_toggle_enable_cp {prefix name1 name2 op} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ if {$enabled(cp:${prefix})} { ++ foreach w $widgets(cp:${prefix}_widgets) { ++ $w configure -state normal ++ } ++ $widgets(cp:${prefix}) configure -bg white ++ } else { ++ foreach w $widgets(cp:${prefix}_widgets) { ++ $w configure -state disabled ++ } ++ $widgets(cp:${prefix}) configure -bg $ApolTop::default_bg_color ++ } ++ # force a refresh of this tab's name ++ set vals(cp:${prefix}_selected) $vals(cp:${prefix}_selected) ++} ++ ++ ++proc Apol_Constraint::_toggle_perms_toshow {name1 name2 op} { ++ variable vals ++ variable widgets ++ ++ if {$vals(cp:perms_toshow) == "all"} { ++ # don't change the list of permissions if there was a new ++ # object class selection and the current radiobutton is all ++ if {$op != "update"} { ++ set vals(cp:perms) $Apol_Class_Perms::perms_list ++ set vals(cp:perms_selected) {} ++ } ++ } elseif {$vals(cp:perms_toshow) == "union"} { ++ set vals(cp:perms) {} ++ set vals(cp:perms_selected) {} ++ foreach class $vals(cp:classes_selected) { ++ set vals(cp:perms) [lsort -unique -dictionary [concat $vals(cp:perms) [Apol_Class_Perms::getPermsForClass $class]]] ++ } ++ } else { ;# intersection ++ set vals(cp:perms) {} ++ set vals(cp:perms_selected) {} ++ set classes {} ++ foreach i [$widgets(cp:classes) curselection] { ++ lappend classes [$widgets(cp:classes) get $i] ++ } ++ if {$classes == {}} { ++ return ++ } ++ set vals(cp:perms) [Apol_Class_Perms::getPermsForClass [lindex $classes 0]] ++ foreach class [lrange $classes 1 end] { ++ set this_perms [Apol_Class_Perms::getPermsForClass $class] ++ set new_perms {} ++ foreach p $vals(cp:perms) { ++ if {[lsearch -exact $this_perms $p] >= 0} { ++ lappend new_perms $p ++ } ++ } ++ set vals(cp:perms) $new_perms ++ } ++ } ++} ++ ++ ++# called whenever an item with a class/perm listbox is ++# selected/deselected ++proc Apol_Constraint::_toggle_cp_select {col} { ++ variable vals ++ variable widgets ++ ++ set items {} ++ foreach i [$widgets(cp:${col}) curselection] { ++ lappend items [$widgets(cp:${col}) get $i] ++ } ++ set vals(cp:${col}_selected) $items ++ if {$col == "classes"} { ++ _toggle_perms_toshow {} {} update ++ } ++} ++ ++ ++proc Apol_Constraint::_clear_cp_listbox {lb prefix} { ++ variable vals ++ ++ $lb selection clear 0 end ++ set vals(cp:${prefix}_selected) {} ++ if {$prefix == "classes"} { ++ _toggle_perms_toshow {} {} update ++ } ++} ++ ++ ++proc Apol_Constraint::_reverse_cp_listbox {lb} { ++ variable vals ++ ++ set old_selection [$lb curselection] ++ set items {} ++ for {set i 0} {$i < [$lb index end]} {incr i} { ++ if {[lsearch $old_selection $i] >= 0} { ++ $lb selection clear $i ++ } else { ++ $lb selection set $i ++ lappend items [$lb get $i] ++ } ++ } ++ set vals(cp:perms_selected) $items ++} ++ ++ ++proc Apol_Constraint::_update_cp_tabname {name1 name2 op} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ if {($enabled(cp:classes) && $vals(cp:classes_selected) > 0) || \ ++ ($enabled(cp:perms) && $vals(cp:perms_selected) > 0)} { ++ $widgets(search_opts) itemconfigure classperms -text "Classes/Permissions *" ++ } else { ++ $widgets(search_opts) itemconfigure classperms -text "Classes/Permissions" ++ } ++} ++ ++ ++proc Apol_Constraint::_delete_results {pageID} { ++ variable widgets ++ variable tabs ++ ++ # Remove tab and its widgets ++ set curpos [$widgets(results) index $pageID] ++ $widgets(results) delete $pageID ++ array unset tabs $pageID:* ++ array unset tabs $pageID ++ ++ # try to raise the next tab ++ if {[set next_id [$widgets(results) pages $curpos]] != {}} { ++ _switch_to_tab $next_id ++ } elseif {$curpos > 0} { ++ # raise the previous page instead ++ _switch_to_tab [$widgets(results) pages [expr {$curpos - 1}]] ++ } else { ++ # no tabs remaining ++ $widgets(update) configure -state disabled ++ } ++} ++ ++ ++proc Apol_Constraint::_display_rename_tab_dialog {pageID} { ++ variable widgets ++ variable tabs ++ ++ set d [Dialog .apol_te_tab_rename -homogeneous 1 -spacing 2 -cancel 1 \ ++ -default 0 -modal local -parent . -place center -separator 1 \ ++ -side bottom -title "Rename Results Tab"] ++ $d add -text "OK" -command [list $d enddialog "ok"] ++ $d add -text "Cancel" -command [list $d enddialog "cancel"] ++ set f [$d getframe] ++ set l [label $f.l -text "Tab name:"] ++ set tabs(tab:new_name) [$widgets(results) itemcget $pageID -text] ++ set e [entry $f.e -textvariable Apol_Constraint::tabs(tab:new_name) -width 16 -bg white] ++ pack $l $e -side left -padx 2 ++ set retval [$d draw] ++ destroy $d ++ if {$retval == "ok"} { ++ $widgets(results) itemconfigure $pageID -text $tabs(tab:new_name) ++ } ++} ++ ++ ++proc Apol_Constraint::_delete_current_results {} { ++ variable widgets ++ ++ if {[set curid [$widgets(results) raise]] != {}} { ++ _delete_results $curid ++ } ++} ++ ++ ++proc Apol_Constraint::_create_new_results_tab {} { ++ variable vals ++ variable widgets ++ variable tabs ++ ++ set i $tabs(next_result_id) ++ incr tabs(next_result_id) ++ set id "results$i" ++ set frame [$widgets(results) insert end "$id" -text "Results $i"] ++ $widgets(results) raise $id ++ set tabs($id) [Apol_Widget::makeSearchResults $frame.results] ++ pack $tabs($id) -expand 1 -fill both ++ ++ set tabs($id:vals) [array get vals] ++ return $tabs($id) ++} ++ ++ ++proc Apol_Constraint::_switch_to_tab {pageID} { ++ variable vals ++ variable widgets ++ variable tabs ++ ++ # check if switching to already visible tab ++ if {[$Apol_Constraint::widgets(results) raise] == $pageID} { ++ return ++ } ++ $widgets(results) raise $pageID ++ set cur_search_opts [$widgets(search_opts) raise] ++ ++ # restore the tab's search criteria ++ array set tmp_vals $tabs($pageID:vals) ++ set classes_selected $tmp_vals(cp:classes_selected) ++ set perms_selected $tmp_vals(cp:perms_selected) ++ array set vals $tabs($pageID:vals) ++ _initializeWidgets ++ set vals(cp:classes_selected) $classes_selected ++ set vals(cp:perms_selected) $perms_selected ++ foreach c $classes_selected { ++ $widgets(cp:classes) selection set [lsearch $vals(cp:classes) $c] ++ } ++ foreach p $perms_selected { ++ $widgets(cp:perms) selection set [lsearch $vals(cp:perms) $p] ++ } ++ $widgets(search_opts) raise $cur_search_opts ++} ++ ++ ++proc Apol_Constraint::_reset {} { ++ variable enabled ++ ++ set old_classes_enabled $enabled(cp:classes) ++ _initializeVars ++ _initializeWidgets ++ if {[set enabled(cp:classes) $old_classes_enabled]} { ++ variable vals ++ set vals(cp:classes) [Apol_Class_Perms::getClasses] ++ set enabled(cp:classes) 1 ++ set enabled(cp:perms) 1 ++ } ++} ++ ++# This is the main constraint search option ++proc Apol_Constraint::_search_constraints {whichButton} { ++ variable vals ++ variable widgets ++ variable enabled ++ variable tabs ++ variable statement_count ++ ++ if {![ApolTop::is_policy_open]} { ++ tk_messageBox -icon error -type ok -title "Constraint Search" \ ++ -message "No current policy file is opened." ++ return ++ } ++ ++ if { $vals(rs:constrain_enabled) == 0 && \ ++ $vals(rs:mlsconstrain_enabled) == 0 && \ ++ $vals(rs:validatetrans_enabled) == 0 && \ ++ $vals(rs:mlsvalidatetrans_enabled) == 0 } { ++ tk_messageBox -icon error -type ok -title "Constraint Search" \ ++ -message "At least one constraint must be selected." ++ return ++ } ++ ++ if {$whichButton == "new"} { ++ set sr [_create_new_results_tab] ++ } else { ++ set id [$widgets(results) raise] ++ set tabs($id:vals) [array get vals] ++ set sr $tabs($id) ++ Apol_Widget::clearSearchResults $sr ++ } ++ ++ if {$enabled(kta:use_left_expr) && $vals(kta:use_left_expr) && $vals(kta:left_expr) == {}} { ++ tk_messageBox -icon error -type ok -title "Constraint Search" -message "No left keyword has been selected." ++ return ++ } ++ if {$enabled(kta:use_right_expr) && $vals(kta:use_right_expr) && $vals(kta:right_expr) == {}} { ++ tk_messageBox -icon error -type ok -title "Constraint Search" -message "No right keyword, type or attribute has been selected." ++ return ++ } ++ ++ set results {} ++ set header {} ++ ++ # Check if the statements are enabled for mls/constrain and then get info ++ if { $vals(rs:constrain_enabled) == 1 } { ++ append results [Apol_Constraint::_searchForMatch "constrain" "constrain" new_apol_constraint_query_t] ++ append header "$statement_count constrain rules match the search criteria.\n" ++ } ++ if { $vals(rs:mlsconstrain_enabled) == 1 } { ++ append results [Apol_Constraint::_searchForMatch "mlsconstrain" "constrain" new_apol_constraint_query_t] ++ append header "$statement_count mlsconstrain rules match the search criteria.\n" ++ } ++ ++ # Check if the statements are enabled for mls/validatetrans and then get info ++ if { $vals(rs:validatetrans_enabled) == 1 } { ++ append results [Apol_Constraint::_searchForMatch "validatetrans" "validatetrans" new_apol_validatetrans_query_t] ++ append header "$statement_count validatetrans rules match the search criteria.\n" ++ } ++ if { $vals(rs:mlsvalidatetrans_enabled) == 1 } { ++ append results [Apol_Constraint::_searchForMatch "mlsvalidatetrans" "validatetrans" new_apol_validatetrans_query_t] ++ append header "$statement_count mlsvalidatetrans match the search criteria.\n" ++ } ++ ++ foreach x {new update reset} { ++ $widgets($x) configure -state disabled ++ } ++ ++ Apol_Progress_Dialog::wait "Constraint Rules" "Searching rules" { ++ Apol_Widget::appendSearchResultText $sr "$header\n" ++ Apol_Widget::appendSearchResultText $sr $results ++ } ++ ++ $widgets(new) configure -state normal ++ $widgets(reset) configure -state normal ++ if {[$widgets(results) pages] != {} || $retval == 0} { ++ $widgets(update) configure -state normal ++ } ++ return ++} ++ ++ ++# Start here to process constraints ++proc Apol_Constraint::_searchForMatch {statement family command} { ++ variable vals ++ variable widgets ++ variable enabled ++ variable match_right_type_names ++ variable statement_count ++ ++ set statement_count 0 ++ set entries {} ++ ++ set q [$command] ++ # This reads in the constraint info ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ ++ # This loop will process each constraint in the policy ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set constrain_type {} ++ set perm_list {} ++ set class_list {} ++ set expr_type {} ++ set op {} ++ set sym_type {} ++ ++ # These are used to check if the search criteria has been met when ++ # the left or right expression info has been set. ++ set match_left_keyword_names 0 ++ set match_left_keyword_attr 0 ++ set match_right_keyword_attr 0 ++ set match_right_type_names 0 ++ ++ set q [qpol_constraint_from_void [$v get_element $i]] ++ ++ # Find if this is an mls rule or not ++ set x [$q get_expr_iter $::ApolTop::qpolicy] ++ while {![$x end]} { ++ foreach t [iter_to_list $x] { ++ set t [qpol_constraint_expr_node_from_void $t] ++ # Get Symbol type and save it ++ set sym_type [$t get_sym_type $::ApolTop::qpolicy] ++ if { $sym_type >= $::QPOL_CEXPR_SYM_L1L2 } { ++ set constrain_type "mls" ++ break ++ } ++ } ++ } ++ append constrain_type $family ++ $x -acquire ++ $x -delete ++ ++ # Check if the statement is the requested type ++ if { $statement != $constrain_type } { ++ continue ++ } ++ ++ # This gets the class name ++ set match_class 0 ++ append class_list "\{ " ++ set class_name [[$q get_class $::ApolTop::qpolicy] get_name $::ApolTop::qpolicy] ++ append class_list $class_name ++ append class_list " \}" ++ ++ # Check if class selected ++ if {($enabled(cp:classes) && $vals(cp:classes_selected) > 0)} { ++ foreach c $vals(cp:classes_selected) { ++ if { $c == $class_name } { ++ set match_class 1 ++ } ++ } ++ } ++ # Skip this constraint if it does not match criteria ++ if {($match_class == 0 && $vals(cp:classes_selected) > 0)} { ++ continue ++ } ++ ++ # validatetrans does not use permissions ++ if { $family == "constrain" } { ++ # This gets perm list: ++ set x [$q get_perm_iter $::ApolTop::qpolicy] ++ set match_perm 0 ++ append perm_list "\{ " ++ foreach perm [iter_to_str_list $x] { ++ append perm_list "$perm " ++ # Check if perm selected ++ if {($enabled(cp:perms) && $vals(cp:perms_selected) > 0)} { ++ foreach c $vals(cp:perms_selected) { ++ if { $c == $perm } { ++ set match_perm 1 ++ } ++ } ++ } ++ } ++ # Skip this constraint as it does not match criteria ++ if {($match_perm == 0 && $vals(cp:perms_selected) > 0)} { ++ continue ++ } ++ append perm_list "\}" ++ $x -acquire ++ $x -delete ++ } ++ ++ # This get expressions ++ set x [$q get_expr_iter $::ApolTop::qpolicy] ++ ++ # This contains the number of constraint expr's processed. ++ set constraint_expr_counter 0 ++ # This is the constraint_expr buffer that is indexed by the ++ # $constraint_expr_counter ++ set array constraint_expr_buf($constraint_expr_counter) ++ array unset constraint_expr_buf ++ ++ # This loop will process each part of the expression consisting of: ++ # Operators: !, &&, ||. The ! applies only to an operand. ++ # Operands/expressions such as: (r1 == r2), (t1 != name) ++ while {![$x end]} { ++ foreach t [iter_to_list $x] { ++ set t [qpol_constraint_expr_node_from_void $t] ++ ++ # Get Operator and save it ++ set op [$t get_op $::ApolTop::qpolicy] ++ ++ # Get Symbol type and save it ++ set sym_type [$t get_sym_type $::ApolTop::qpolicy] ++ ++ # Get expression and save it ++ set expr_type [$t get_expr_type $::ApolTop::qpolicy] ++ ++ # Now check expression for entry type !, && or ||. ++ # These are the operators between constraint expressions ++ if { $expr_type == $::QPOL_CEXPR_TYPE_NOT } { ++ set constraint_expr_counter [expr $constraint_expr_counter + 1] ++ append constraint_expr_buf($constraint_expr_counter) "not" ++ } ++ ++ if { $expr_type == $::QPOL_CEXPR_TYPE_AND } { ++ set constraint_expr_counter [expr $constraint_expr_counter + 1] ++ append constraint_expr_buf($constraint_expr_counter) "and" ++ } ++ ++ if { $expr_type == $::QPOL_CEXPR_TYPE_OR } { ++ set constraint_expr_counter [expr $constraint_expr_counter + 1] ++ append constraint_expr_buf($constraint_expr_counter) "or" ++ } ++ ++ # If the expression is TYPE_ATTR then it's form is (t1 == t2) ++ if { $expr_type == $::QPOL_CEXPR_TYPE_ATTR } { ++ set constraint_expr_counter [expr $constraint_expr_counter + 1] ++ ++ # Get the symbol name, this will be used twice, once ++ # to retrieve the string name for source entry, then ++ # the string name for the target entry. ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append constraint_expr_buf($constraint_expr_counter) "( $sym_name " ++ ++ # Check if keyword selected ++ if {$vals(kta:use_left_expr) == 1 && $vals(kta:left_expr) == $sym_name} { ++ set match_left_keyword_attr 1 ++ } ++ ++ # Get the operator and change to "eq" if required ++ set op [$t get_op $::ApolTop::qpolicy] ++ set op_name [Apol_Constraint::_getOp $op] ++ if { $op_name == "==" && \ ++ ([string compare -length 1 $sym_name "r"] == 0 || \ ++ [string compare -length 1 $sym_name "l"] == 0 || \ ++ [string compare -length 1 $sym_name "h"] == 0) } { ++ set op_name "eq" ++ } ++ append constraint_expr_buf($constraint_expr_counter) $op_name ++ ++ # Then using the sym_name again, get the target entry. ++ set sym_type [expr $sym_type | $::QPOL_CEXPR_SYM_TARGET] ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append constraint_expr_buf($constraint_expr_counter) " $sym_name )" ++ ++ # Check if keyword selected ++ if {$vals(kta:use_right_expr) == 1 && \ ++ $vals(kta:right_expr) == $sym_name && \ ++ $vals(kta:right_expr,right_keyword) == 1} { ++ set match_right_keyword_attr 1 ++ } ++ } ++ ++ # If the expression is TYPE_NAMES then expand the source ++ # types or attributes using 'get_names_iter' ++ # Example entries: ( t1 == mlstrustedobject ) ++ # ( t1 != { unconfined_t init_t } ) ++ # Note that if an attribute has been selected it could be ++ # an empty_set. ++ if { $expr_type == $::QPOL_CEXPR_TYPE_NAMES } { ++ set constraint_expr_counter [expr $constraint_expr_counter + 1] ++ ++ # Get the symbol name, this is only used once to ++ # to retrieve the string name for source entry. ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append constraint_expr_buf($constraint_expr_counter) "( $sym_name " ++ ++ # Check if keyword selected ++ if {$vals(kta:use_left_expr) == 1 && \ ++ $vals(kta:left_expr) == $sym_name} { ++ set match_left_keyword_names 1 ++ } ++ ++ set op [$t get_op $::ApolTop::qpolicy] ++ set op_name [Apol_Constraint::_getOp $op] ++ append constraint_expr_buf($constraint_expr_counter) $op_name ++ ++ # Need to get the number of entries. These can be ++ # type or attribute identifiers. ++ set tmp_list {} ++ set return_list {} ++ set n [$t get_names_iter $::ApolTop::qpolicy] ++ set n_size [[$t get_names_iter $::ApolTop::qpolicy] get_size] ++ ++ # If > 0 then put entries in a tmp_list for later processing. ++ if { $n_size > 0 } { ++ foreach name [iter_to_str_list $n] { ++ append tmp_list "$name " ++ } ++ # ++ # Now check search parameters for the $name entries of ++ # the right side of the expression. The $tmp_list can ++ # contain user, role, type or type attribute names ++ # depending on the initial letter of $sym_name. ++ # ++ if { ([string compare -length 1 $sym_name "t"] == 0 && \ ++ $vals(kta:use_right_expr) == 1) && \ ++ ($vals(kta:right_expr,types) == 1 || \ ++ $vals(kta:right_expr,attribs) == 1) } { ++ # This calls type and attribute processing: ++ set tmp_list [Apol_Constraint::_process_TA $vals(kta:right_expr) $tmp_list] ++ } elseif { ($vals(kta:use_right_expr) == 1 && \ ++ $vals(kta:right_expr,roles) == 1 && \ ++ [string compare -length 1 $sym_name "r"] == 0) || \ ++ ($vals(kta:use_right_expr) == 1 && \ ++ $vals(kta:right_expr,users) == 1 && \ ++ [string compare -length 1 $sym_name "u"] == 0) } { ++ foreach c $tmp_list { ++ if { $c == $vals(kta:right_expr) } { ++ set match_right_type_names 1 ++ set tmp_list $name ++ continue ++ } ++ } ++ } ++ # else if size == 0 then just say an empty set. Also ++ # check if the requested attribute is an empty set. ++ } elseif { $n_size == 0 } { ++ set tmp_list "" ++ if { [Apol_Constraint::_checkIfEmptyAttr $vals(kta:right_expr)] && \ ++ [string compare -length 1 $sym_name "t"] == 0 } { ++ set match_right_type_names 1 ++ } ++ } ++ ++ # Copy tmp_list to the constraint buffer. ++ if { [llength $tmp_list] > 1 } { ++ append constraint_expr_buf($constraint_expr_counter) " \{ $tmp_list\} )" ++ } else { ++ append constraint_expr_buf($constraint_expr_counter) " $tmp_list )" ++ } ++ $n -acquire ++ $n -delete ++ } ++ } ++ } ++ $x -acquire ++ $x -delete ++ # Done with processing all the expressions, now check if they ++ # were enabled or not and valid search entries found. ++ if {($vals(kta:use_left_expr) == 1 && $vals(kta:use_right_expr) == 1) && \ ++ [expr (($match_left_keyword_names | $match_left_keyword_attr) & \ ++ ($match_right_keyword_attr | $match_right_type_names))] == 0} { ++ continue ++ } ++ ++ if {($vals(kta:use_left_expr) == 1 && $vals(kta:use_right_expr) == 0) && \ ++ [expr $match_left_keyword_names | $match_left_keyword_attr] == 0} { ++ continue ++ } ++ ++ if {($vals(kta:use_left_expr) == 0 && $vals(kta:use_right_expr) == 1) && \ ++ ($vals(kta:right_expr,users) == 1 || \ ++ $vals(kta:right_expr,roles) == 1 || \ ++ $vals(kta:right_expr,attribs) == 1 || \ ++ $vals(kta:right_expr,types) == 1 || \ ++ $vals(kta:right_expr,right_keyword) == 1) && \ ++ [expr $match_right_type_names | $match_right_keyword_attr ] == 0} { ++ continue ++ } ++ ++ # ++ # This takes each entry in the RPN formatted constraint_expr_buf and ++ # converts to infix format that resembles the constraint string in ++ # policy language format. It is a modified version from: ++ # http://rosettacode.org/wiki/Parsing/RPN_to_infix_conversion ++ # ++ set stack {} ++ foreach entry [lsort -integer [array names constraint_expr_buf]] { ++ set token $constraint_expr_buf($entry) ++ switch $token { ++ "not" - "and" - "or" { ++ lassign [Apol_Constraint::_pop stack] expr2rec expr2 ++ # The ! is not treated the same as && || as it only ++ # applies to a single expression i.e. !(expression) ++ # So just pop the stack and add the !. Should there be ++ # another ! in the expression, then add brackets. ++ if { $token == "not" } { ++ set ans [string compare -length 1 $expr2 "not"] ++ if { $ans == 0 } { ++ lappend stack [list 1 "$token \($expr2\)"] ++ } else { ++ lappend stack [list 1 "$token$expr2"] ++ } ++ continue ++ } else { ++ lassign [Apol_Constraint::_pop stack] expr1rec expr1 ++ lappend stack [list 1 "$expr1 $token $expr2"] ++ } ++ } ++ default { ++ lappend stack [list 2 $token] ++ } ++ } ++ } ++ if { [array size constraint_expr_buf] == 1 } { ++ set expression "[lindex $stack end 1];" ++ } else { ++ set expression "([lindex $stack end 1]);" ++ } ++ set statement_count [expr $statement_count + 1] ++ append entries "$constrain_type $class_list $perm_list\n $expression\n\n" ++ } ++ return $entries ++} ++ ++######### End of search routine - Start supporting procs ################ ++ ++# The pop stack routine for RPN conversion ++proc Apol_Constraint::_pop {stk} { ++ upvar 1 $stk s ++ set val [lindex $s end] ++ set s [lreplace $s end end] ++ return $val ++} ++ ++ ++# Take an attribute name and expands it to a list of types. ++proc Apol_Constraint::_renderAttrib {attrib_name} { ++ set type_list {} ++ set qpol_type_datum [new_qpol_type_t $::ApolTop::qpolicy $attrib_name] ++ set i [$qpol_type_datum get_type_iter $::ApolTop::qpolicy] ++ foreach t [iter_to_list $i] { ++ set t [qpol_type_from_void $t] ++ lappend type_list [$t get_name $::ApolTop::qpolicy] ++ } ++ if { $type_list == "" } { ++ lappend type_list "" ++ } ++ $i -acquire ++ $i -delete ++ return $type_list ++} ++ ++ ++# This will return a list of attributes linked to the type_name ++proc Apol_Constraint::_renderType {type_name} { ++ set qpol_type_datum [new_qpol_type_t $::ApolTop::qpolicy $type_name] ++ set aliases {} ++ set attribs {} ++ ++ set i [$qpol_type_datum get_alias_iter $::ApolTop::qpolicy] ++ set aliases [iter_to_str_list $i] ++ $i -acquire ++ $i -delete ++ ++ set i [$qpol_type_datum get_attr_iter $::ApolTop::qpolicy] ++ foreach a [iter_to_list $i] { ++ set a [qpol_type_from_void $a] ++ lappend attribs [$a get_name $::ApolTop::qpolicy] ++ } ++ $i -acquire ++ $i -delete ++ return $attribs ++} ++ ++ ++# Check if the name is a type or attribute. ++proc Apol_Constraint::_checkTypeOrAttr {name} { ++ set type_list {} ++ ++ set qpol_type_datum [new_qpol_type_t $::ApolTop::qpolicy $name] ++ set x [$qpol_type_datum get_isattr $::ApolTop::qpolicy ] ++ if { $x == 1 } { ++ return "attribute" ++ } else { ++ return "type" ++ } ++ $x -acquire ++ $x -delete ++} ++ ++ ++# Return Left or Right expr keywords ++proc Apol_Constraint::_getKeywords {side command} { ++ set list {} ++ set left_list {} ++ set right_list {} ++ ++ set q [$command] ++ # This reads in the constraint info ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ ++ # This loop will process each constraint in the policy ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set expr_type {} ++ set sym_type {} ++ set q [qpol_constraint_from_void [$v get_element $i]] ++ ++ # This get expressions ++ set x [$q get_expr_iter $::ApolTop::qpolicy] ++ while {![$x end]} { ++ foreach t [iter_to_list $x] { ++ set t [qpol_constraint_expr_node_from_void $t] ++ set sym_type [$t get_sym_type $::ApolTop::qpolicy] ++ set expr_type [$t get_expr_type $::ApolTop::qpolicy] ++ ++ if { $expr_type == $::QPOL_CEXPR_TYPE_ATTR } { ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append left_list "$sym_name " ++ # Then using the sym_name again, get the target entry. ++ set sym_type [expr $sym_type | $::QPOL_CEXPR_SYM_TARGET] ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append right_list "$sym_name " ++ } ++ ++ if { $expr_type == $::QPOL_CEXPR_TYPE_NAMES } { ++ set sym_name [Apol_Constraint::_getSym $sym_type] ++ append left_list "$sym_name " ++ } ++ } ++ } ++ $x -acquire ++ $x -delete ++ ++ if {$side == "l"} { ++ append list $left_list ++ } else { ++ append list $right_list ++ } ++ } ++ $v -acquire ++ $v -delete ++ return $list ++} ++ ++ ++# Here because a type or type_attribute search has been actioned ++proc Apol_Constraint::_process_TA {name search_list} { ++ variable match_right_type_names ++ variable vals ++ ++ foreach ta $search_list { ++ if { $ta == $name } { ++ set match_right_type_names 1 ++ return $search_list ++ } ++ } ++ return $search_list ++} ++ ++ ++# Get symbol from expression ++proc Apol_Constraint::_getSym {sym_type} { ++ set symbol {} ++ ++ # These are source for mls/constrain and old for mls/validatetrans ++ if { $sym_type == $::QPOL_CEXPR_SYM_USER } { ++ append symbol "u1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_ROLE } { ++ append symbol "r1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_TYPE } { ++ append symbol "t1" ++ } ++ ++ # These are target for mls/constrain and new for mls/validatetrans ++ if { $sym_type == $::QPOL_CEXPR_SYM_USER+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "u2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_ROLE+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "r2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_TYPE+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "t2" ++ } ++ # These are source for mls/validatetrans ++ if { $sym_type == $::QPOL_CEXPR_SYM_USER+$::QPOL_CEXPR_SYM_XTARGET } { ++ append symbol "u3" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_ROLE+$::QPOL_CEXPR_SYM_XTARGET } { ++ append symbol "r3" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_TYPE+$::QPOL_CEXPR_SYM_XTARGET } { ++ append symbol "t3" ++ } ++ ++ # Source levels for mlsconstrain and mlsvalidatetrans ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1L2 } { ++ append symbol "l1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1H2 } { ++ append symbol "l1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_H1L2 } { ++ append symbol "h1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_H1H2 } { ++ append symbol "h1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1H1 } { ++ append symbol "l1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L2H2 } { ++ append symbol "l2" ++ } ++ ++ # Target levels for mlsconstrain and mlsvalidatetrans ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1L2+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "l2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1H2+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "h2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_H1L2+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "l2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_H1H2+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "h2" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L1H1+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "h1" ++ } ++ if { $sym_type == $::QPOL_CEXPR_SYM_L2H2+$::QPOL_CEXPR_SYM_TARGET } { ++ append symbol "h2" ++ } ++ if { $symbol == "" } { ++ append symbol "err_sym_missing" ++ } ++ return $symbol ++} ++ ++ ++# Get Operator ++proc Apol_Constraint::_getOp {op} { ++ set entry {} ++ ++ if { $op == $::QPOL_CEXPR_OP_EQ } { ++ append entry "==" ++ } ++ if { $op == $::QPOL_CEXPR_OP_NEQ } { ++ append entry "!=" ++ } ++ if { $op == $::QPOL_CEXPR_OP_DOM } { ++ append entry "dom" ++ } ++ if { $op == $::QPOL_CEXPR_OP_DOMBY } { ++ append entry "domby" ++ } ++ if { $op == $::QPOL_CEXPR_OP_INCOMP } { ++ append entry "incomp" ++ } ++ if { $entry == "" } { ++ append entry "op_missing" ++ } ++ return $entry ++} ++ +diff --git a/apol/default_objects_tab.tcl b/apol/default_objects_tab.tcl +new file mode 100644 +index 0000000..6cf764b +--- /dev/null ++++ b/apol/default_objects_tab.tcl +@@ -0,0 +1,370 @@ ++# Copyright (C) 2001-2007 Tresys Technology, LLC ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ ++namespace eval Apol_DefaultObjects { ++ variable vals ++ variable widgets ++ variable mls_enabled {0} ++ variable statement_count ++} ++ ++proc Apol_DefaultObjects::create {tab_name nb} { ++ variable vals ++ variable widgets ++ ++ _initializeVars ++ ++ set frame [$nb insert end $tab_name -text "Default Object Rules"] ++ set topf [frame $frame.top] ++ set bottomf [frame $frame.bottom] ++ pack $topf -expand 0 -fill both -pady 2 ++ pack $bottomf -expand 1 -fill both -pady 2 ++ ++ set rsbox [TitleFrame $topf.rs -ipad 30 -text "Rule Selection"] ++ set obox [TitleFrame $topf.opts -text "Search Options"] ++ set dbox [TitleFrame $bottomf.results -text "Default Object Rules Display"] ++ pack $rsbox -side left -expand 0 -fill both -padx 2 ++ pack $obox -side left -expand 1 -fill both -padx 2 ++ pack $dbox -expand 1 -fill both -padx 2 ++ ++ # Rule selection subframe ++ set rs [$rsbox getframe] ++ checkbutton $rs.default_user -text "default_user" -onvalue 1 -offvalue 0 \ ++ -variable Apol_DefaultObjects::vals(default_user_enabled) ++ trace add variable Apol_DefaultObjects::vals(default_user_enabled) write \ ++ [list Apol_DefaultObjects::_ruleChanged] ++ checkbutton $rs.default_role -text "default_role" -onvalue 1 -offvalue 0 \ ++ -variable Apol_DefaultObjects::vals(default_role_enabled) ++ trace add variable Apol_DefaultObjects::vals(default_role_enabled) write \ ++ [list Apol_DefaultObjects::_ruleChanged] ++ checkbutton $rs.default_type -text "default_type" -onvalue 1 -offvalue 0 \ ++ -variable Apol_DefaultObjects::vals(default_type_enabled) ++ trace add variable Apol_DefaultObjects::vals(default_type_enabled) write \ ++ [list Apol_DefaultObjects::_ruleChanged] ++ checkbutton $rs.default_range -text "default_range" -onvalue 1 -offvalue 0 \ ++ -variable Apol_DefaultObjects::vals(default_range_enabled) ++ trace add variable Apol_DefaultObjects::vals(default_range_enabled) write \ ++ [list Apol_DefaultObjects::_ruleChanged] ++ pack $rs.default_user $rs.default_role $rs.default_type $rs.default_range -side top -anchor w ++ ++ set widgets(options_pm) [PagesManager [$obox getframe].opts] ++ ++ _defaultObjectCreate [$widgets(options_pm) add default_object] ++ ++ $widgets(options_pm) compute_size ++ pack $widgets(options_pm) -expand 1 -fill both -side left ++ $widgets(options_pm) raise default_object ++ ++ set ok [button [$obox getframe].ok -text OK -width 6 -command Apol_DefaultObjects::_searchDefaultObjects] ++ pack $ok -side right -padx 5 -pady 5 -anchor ne ++ ++ set widgets(results) [Apol_Widget::makeSearchResults [$dbox getframe].results] ++ pack $widgets(results) -expand yes -fill both ++ ++ return $frame ++} ++ ++proc Apol_DefaultObjects::open {ppath} { ++ variable vals ++ variable widgets ++ variable mls_enabled ++ ++ if {[ApolTop::is_capable "mls"]} { ++ set mls_enabled 1 ++ } else { ++ set mls_enabled 0 ++ } ++ ++ $widgets(default_object:class) configure -values [Apol_Class_Perms::getClasses] ++ $widgets(default_object:default) configure -values {"source" "target"} ++ $widgets(default_object:range) configure -values {"low" "high" "low_high"} ++ ++ set vals(default_range_enabled) $mls_enabled ++ set vals(default_type_enabled) [ApolTop::is_capable "default_type"] ++} ++ ++proc Apol_DefaultObjects::close {} { ++ variable widgets ++ variable mls_enabled ++ ++ _initializeVars ++ $widgets(default_object:class) configure -values {} ++ $widgets(default_object:default) configure -values {} ++ $widgets(default_object:range) configure -values {} ++ set mls_enabled 0 ++} ++ ++proc Apol_DefaultObjects::getTextWidget {} { ++ variable widgets ++} ++ ++proc Apol_DefaultObjects::_initializeVars {} { ++ variable vals ++ ++ array set vals { ++ class:use 0 ++ class:sym {} ++ default:sym {} ++ default:use 0 ++ range:sym {} ++ range:use 0 ++ ++ default_user_enabled 1 ++ default_role_enabled 1 ++ default_type_enabled 1 ++ default_range_enabled 0 ++ } ++} ++ ++proc Apol_DefaultObjects::_defaultObjectCreate {r_c} { ++ variable vals ++ variable widgets ++ ++ set class [frame $r_c.class] ++ set class_cb [checkbutton $class.enable -text "Object class" \ ++ -variable Apol_DefaultObjects::vals(class:use)] ++ set widgets(default_object:class) [ComboBox $class.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_DefaultObjects::vals(class:sym)] ++ ++ trace add variable Apol_DefaultObjects::vals(class:use) write \ ++ [list Apol_DefaultObjects::_toggleCheckbutton $widgets(default_object:class) {}] ++ pack $class_cb -side top -anchor w ++ pack $widgets(default_object:class) -side top -expand 0 -fill x -padx 4 ++ pack $class -side left -padx 4 -pady 2 -expand 0 -anchor nw ++ ++ set default [frame $r_c.default] ++ set widgets(default_object:default_cb) [checkbutton $default.enable -text "Default" \ ++ -variable Apol_DefaultObjects::vals(default:use)] ++ set widgets(default_object:default) [ComboBox $default.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_DefaultObjects::vals(default:sym)] ++ trace add variable Apol_DefaultObjects::vals(default:use) write \ ++ [list Apol_DefaultObjects::_toggleCheckbutton $widgets(default_object:default) {}] ++ pack $widgets(default_object:default_cb) -side top -anchor w ++ pack $widgets(default_object:default) -side top -expand 0 -fill x -padx 4 ++ pack $default -side left -padx 4 -pady 2 -expand 0 -fill y ++ ++ set range [frame $r_c.range] ++ set widgets(default_object:range_cb) [checkbutton $range.enable -text "Range" \ ++ -variable Apol_DefaultObjects::vals(range:use)] ++ set widgets(default_object:range) [ComboBox $range.cb -width 20 -state disabled \ ++ -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_DefaultObjects::vals(range:sym)] ++ trace add variable Apol_DefaultObjects::vals(range:use) write \ ++ [list Apol_DefaultObjects::_toggleCheckbutton $widgets(default_object:range) {}] ++ pack $widgets(default_object:range_cb) -side top -anchor w ++ pack $widgets(default_object:range) -side top -expand 0 -fill x -padx 4 ++ pack $range -side left -padx 4 -pady 2 -expand 0 -fill y ++} ++ ++proc Apol_DefaultObjects::_toggleCheckbutton {cb w name1 name2 ops} { ++ variable vals ++ variable mls_enabled ++ ++ if {$name2 == "range:use" && $mls_enabled == 0 || $vals(default_range_enabled) == 0} { ++ set vals(range:use) 0 ++ $cb configure -state disabled ++ } ++ ++ if {$vals($name2)} { ++ $cb configure -state normal -entrybg white ++ foreach x $w { ++ $x configure -state normal ++ } ++ } else { ++ $cb configure -state disabled -entrybg $ApolTop::default_bg_color ++ foreach x $w { ++ $x configure -state disabled ++ } ++ } ++} ++ ++proc Apol_DefaultObjects::_ruleChanged {name1 name2 ops} { ++ variable vals ++ variable widgets ++ Apol_Widget::clearSearchResults $widgets(results) ++ ++ if {$vals(default_user_enabled) == 0} { ++ set vals(user:use) 0 ++ } ++ if {$vals(default_role_enabled) == 0} { ++ set vals(role:use) 0 ++ } ++ if {$vals(default_type_enabled) == 0} { ++ set vals(type:use) 0 ++ } ++ if {$vals(default_range_enabled) == 0} { ++ set vals(range:use) 0 ++ } ++} ++ ++proc Apol_DefaultObjects::_searchDefaultObjects {} { ++ variable vals ++ variable widgets ++ variable statement_count ++ ++ Apol_Widget::clearSearchResults $widgets(results) ++ if {![ApolTop::is_policy_open]} { ++ tk_messageBox -icon error -type ok -title "Error" -message "No current policy file is opened." ++ } ++ ++ if {$vals(class:use) == 1 && $vals(class:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Default object Rule Search" -message "No class selected." ++ return ++ } ++ if {$vals(default:use) == 1 && $vals(default:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Default object Rule Search" -message "No default selected." ++ return ++ } ++ if {$vals(range:use) == 1 && $vals(range:sym) == {}} { ++ tk_messageBox -icon error -type ok -title "Default object Rule Search" -message "No range selected." ++ return ++ } ++ ++ set results {} ++ set header {} ++ set print_results {} ++ ++ if {$vals(default_user_enabled) == 1} { ++ append results [Apol_DefaultObjects::searchForDefault "user" get_user_default] ++ append header "$statement_count default_user rules match the search criteria.\n" ++ } ++ if {$vals(default_role_enabled) == 1} { ++ append results [Apol_DefaultObjects::searchForDefault "role" get_role_default] ++ append header "$statement_count default_role rules match the search criteria.\n" ++ } ++ if {$vals(default_type_enabled) == 1} { ++ append results [Apol_DefaultObjects::searchForDefault "type" get_type_default] ++ append header "$statement_count default_type rules match the search criteria.\n" ++ } ++ if {$vals(default_range_enabled) == 1} { ++ append results [Apol_DefaultObjects::searchDefaultRange "range" get_range_default] ++ append header "$statement_count default_range rules match the search criteria.\n" ++ } ++ append print_results "$header\n$results" ++ Apol_Widget::appendSearchResultText $widgets(results) $print_results ++} ++ ++proc Apol_DefaultObjects::searchForDefault {type type_cmd} { ++ variable vals ++ variable widgets ++ variable statement_count ++ set results {} ++ set printit 0 ++ set class_regexp 0 ++ set default_regexp 0 ++ set statement_count 0 ++ ++ if {$vals(class:use)} { ++ set class_regexp 1 ++ } ++ if {$vals(default:use)} { ++ set default_regexp 1 ++ } ++ ++ set q [new_apol_default_object_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_default_object_from_void [$v get_element $i]] ++ set class [$q get_class $::ApolTop::qpolicy] ++ set default [$q $type_cmd $::ApolTop::qpolicy] ++ if {$default != ""} { ++ if {$class_regexp == 1 && $class == $vals(class:sym) && $default_regexp == 1 && $default == $vals(default:sym)} { ++ set printit 1 ++ } elseif {$class_regexp == 1 && $class == $vals(class:sym) && $default_regexp == 0} { ++ set printit 1 ++ } elseif {$default_regexp == 1 && $default == $vals(default:sym) && $class_regexp == 0} { ++ set printit 1 ++ } elseif {$class_regexp == 0 && $default_regexp == 0} { ++ set printit 1 ++ } ++ if {$printit == 1} { ++ append results "default_$type $class $default;\n" ++ set statement_count [expr $statement_count + 1] ++ } ++ } ++ set printit 0 ++ } ++ } ++ return "$results\n" ++} ++ ++proc Apol_DefaultObjects::searchDefaultRange {type type_cmd} { ++ variable vals ++ variable widgets ++ variable statement_count ++ set results {} ++ set printit 0 ++ set class_regexp 0 ++ set default_regexp 0 ++ set range_regexp 0 ++ set statement_count 0 ++ ++ if {$vals(class:use)} { ++ set class_regexp 1 ++ } ++ if {$vals(default:use)} { ++ set default_regexp 1 ++ } ++ if {$vals(range:use)} { ++ set range_regexp 1 ++ } ++ ++ set q [new_apol_default_object_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_default_object_from_void [$v get_element $i]] ++ set class [$q get_class $::ApolTop::qpolicy] ++ set default [$q $type_cmd $::ApolTop::qpolicy] ++ if {$default != ""} { ++ # split into the two components ++ set entries [split $default " "] ++ lassign $entries src_tgt range ++ ++ if {$class_regexp == 1 && $class == $vals(class:sym) && $default_regexp == 1 && \ ++ $src_tgt== $vals(default:sym) && $range_regexp == 1 && $range == $vals(range:sym)} { ++ set printit 1 ++ } elseif {$class_regexp == 1 && $class == $vals(class:sym) && $default_regexp == 0 && $range_regexp == 0} { ++ set printit 1 ++ } elseif {$class_regexp == 0 && $default_regexp == 1 && $src_tgt == $vals(default:sym) && $range_regexp == 0} { ++ set printit 1 ++ } elseif {$class_regexp == 0 && $default_regexp == 0 && $range_regexp == 1 && $range == $vals(range:sym)} { ++ set printit 1 ++ } elseif {$class_regexp == 0 && $default_regexp == 1 && $src_tgt == $vals(default:sym) && \ ++ $range_regexp == 1 && $range == $vals(range:sym)} { ++ set printit 1 ++ } elseif {$class_regexp == 1 && $class == $vals(class:sym) && $default_regexp == 0 && \ ++ $range_regexp == 1 && $range == $vals(range:sym)} { ++ set printit 1 ++ } elseif {$class_regexp == 0 && $default_regexp == 0 && $range_regexp == 0} { ++ set printit 1 ++ } ++ if {$printit == 1} { ++ append results "default_$type $class $default;\n" ++ set statement_count [expr $statement_count + 1] ++ } ++ } ++ set printit 0 ++ } ++ } ++ return "$results\n" ++} +diff --git a/apol/initial_sids_tab.tcl b/apol/initial_sids_tab.tcl +index ff81a32..356a45a 100644 +--- a/apol/initial_sids_tab.tcl ++++ b/apol/initial_sids_tab.tcl +@@ -110,7 +110,7 @@ proc Apol_Initial_SIDS::_search {} { + $q set_context $::ApolTop::policy $context $range_match + } + +- set v [$q run $::ApolTop::policy] #line causing segfaulting ++ set v [$q run $::ApolTop::policy] + + $q -acquire + $q -delete +diff --git a/apol/namespaces_tab.tcl b/apol/namespaces_tab.tcl +new file mode 100644 +index 0000000..da8a1af +--- /dev/null ++++ b/apol/namespaces_tab.tcl +@@ -0,0 +1,206 @@ ++# Copyright (C) 2001-2007 Tresys Technology, LLC ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ ++namespace eval Apol_Namespaces { ++ variable widgets ++ variable namespace_list {} ++} ++ ++proc Apol_Namespaces::create {tab_name nb} { ++ variable widgets ++ variable namespace_list {} ++ ++ set frame [$nb insert end $tab_name -text "Policy Namespaces"] ++ set pw [PanedWindow $frame.pw -side top] ++ set leftf [$pw add -weight 0] ++ set rightf [$pw add -weight 1] ++ pack $pw -fill both -expand yes ++ ++ set namespaces_box [TitleFrame $leftf.namespaces_box -text "Policy Namespaces"] ++ pack $namespaces_box -fill both -expand yes ++ ++ set nlistbox [Apol_Widget::makeScrolledListbox [$namespaces_box getframe].lb \ ++ -width 60 -listvar Apol_Namespaces::namespace_list] ++ Apol_Widget::setListboxCallbacks $nlistbox \ ++ {{"Show Namespace Users, Roles, Types, Attributes and Classes Info" {Apol_Namespaces::popupNsInfo nfi}}} ++ pack $nlistbox -expand 1 -fill both ++ pack $nlistbox -fill both -expand yes ++ ++ return $frame ++} ++ ++proc Apol_Namespaces::open {ppath} { ++ variable namespace_list {} ++ ++ append list1 "$Apol_Users::users_list $Apol_Roles::role_list $Apol_Types::typelist $Apol_Types::attriblist $Apol_Class_Perms::class_list" ++ set names [split $list1 " "] ++ # Split on the ns separator, chop off the end entry then add "." back ++ set list1 {} ++ foreach n $names { ++ set ns [split $n "."] ++ set ns [lreplace $ns end end] ++ set l [string length $ns] ++ if {$l > 0} { ++ regsub -all " " $ns "." ns ++ lappend list1 "$ns" ++ } ++ } ++ set list2 {} ++ set namespace_list "GLOBAL-NS\n" ++ lappend list2 [lsort -dictionary -unique $list1] ++ ++ foreach entry $list2 { ++ append namespace_list "$entry\n" ++ } ++} ++ ++proc Apol_Namespaces::close {} { ++ variable namespace_list {} ++ ++ set namespace_list {} ++} ++ ++proc Apol_Namespaces::getTextWidget {} { ++ variable widgets ++} ++ ++ ++proc Apol_Namespaces::popupNsInfo {which ns} { ++ ++ set w .ns_infobox ++ destroy $w ++ ++ set w [Dialog .ns_infobox -cancel 0 -default 0 -modal none -parent . -separator 1 -title $ns] ++ $w add -text "Close" -command [list destroy $w] ++ ++ set notebook [NoteBook [$w getframe].nb] ++ pack $notebook -expand 1 -fill both ++ ++ set user_info_tab [$notebook insert end user_info_tab -text "Users"] ++ set role_info_tab [$notebook insert end role_info_tab -text "Roles"] ++ set type_info_tab [$notebook insert end type_info_tab -text "Types"] ++ set attrib_info_tab [$notebook insert end attrib_info_tab -text "Attributes"] ++ set class_info_tab [$notebook insert end class_info_tab -text "Classes"] ++ set boolean_info_tab [$notebook insert end boolean_info_tab -text "Booleans"] ++ ++ if {[ApolTop::is_capable "mls"]} { ++ set sensitivity_info_tab [$notebook insert end sensitivity_info_tab -text "Sensitivities"] ++ set category_info_tab [$notebook insert end category_info_tab -text "Categories"] ++ } ++ ++ # Display users ++ set sw [ScrolledWindow [$notebook getframe user_info_tab].sw -scrollbar both -auto both] ++ set user_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $user_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Users::users_list $user_text $ns "users" ++ ++ # Display roles ++ set sw [ScrolledWindow [$notebook getframe role_info_tab].sw -scrollbar both -auto both] ++ set role_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $role_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Roles::role_list $role_text $ns "roles" ++ ++ # Display types ++ set sw [ScrolledWindow [$notebook getframe type_info_tab].sw -scrollbar both -auto both] ++ set type_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $type_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Types::typelist $type_text $ns "types" ++ ++ # Display attributes ++ set sw [ScrolledWindow [$notebook getframe attrib_info_tab].sw -scrollbar both -auto both] ++ set attrib_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $attrib_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Types::attriblist $attrib_text $ns "attributes" ++ ++ # Display classes ++ set sw [ScrolledWindow [$notebook getframe class_info_tab].sw -scrollbar both -auto both] ++ set class_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $class_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Class_Perms::class_list $class_text $ns "classes" ++ ++ # Display booleans ++ set sw [ScrolledWindow [$notebook getframe boolean_info_tab].sw -scrollbar both -auto both] ++ set boolean_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $boolean_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_Cond_Bools::cond_bools_list $boolean_text $ns "booleans" ++ ++ if {[ApolTop::is_capable "mls"]} { ++ # Display sensitivities ++ set sw [ScrolledWindow [$notebook getframe sensitivity_info_tab].sw -scrollbar both -auto both] ++ set sensitivity_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $sensitivity_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_MLS::vals(senslist) $sensitivity_text $ns "sensitivities" ++ ++ # Display categories ++ set sw [ScrolledWindow [$notebook getframe category_info_tab].sw -scrollbar both -auto both] ++ set category_text [text [$sw getframe].text -wrap none -font {helvetica 10} -bg white] ++ $sw setwidget $category_text ++ pack $sw -expand 1 -fill both ++ Apol_Namespaces::DisplayMatches $Apol_MLS::vals(catslist) $category_text $ns "categories" ++ } ++ ++ $notebook raise [$notebook page 0] ++ $w draw {} 0 600x400 ++} ++ ++proc Apol_Namespaces::DisplayMatches {item_list display_entry ns text} { ++ set counter 0 ++ set print_list {} ++ ++ if {$ns == "GLOBAL-NS"} { ++ set ns {} ++ set off_set 0 ++ } else { ++ set off_set 1 ++ } ++ # Get len of the ns selected ++ set l [string length $ns] ++ #For each entry check if in this ns ++ foreach t $item_list { ++ set i [string compare -length $l $t $ns] ++ # kludge to get round a problem. ++ # If $z is same as $ns, but no . in $t then ignore as $t just ++ # happens to begin with a match to $ns. So reset $i ++ set z [string range $t 0 $l-1] ++ if {![regexp -nocase {[.]} $t] && $z == $ns && $ns != ""} { ++ set i 1 ++ } ++ ++ if {$i == 0} { ++ set x [string range $t $l+$off_set end] ++ if {![regexp -nocase {[.]} $x]} { ++ append print_list " $x\n" ++ set counter [expr $counter + 1] ++ } ++ } ++ } ++ if {$counter == 0} { ++ $display_entry insert end "No entries\n" ++ } else { ++ if {$ns == ""} { ++ set ns "global" ++ } ++ $display_entry insert end "$ns namespace ($counter $text)\n$print_list" ++ } ++ $display_entry configure -state disabled ++ ++} +diff --git a/apol/polcap_tab.tcl b/apol/polcap_tab.tcl +new file mode 100644 +index 0000000..dfeade4 +--- /dev/null ++++ b/apol/polcap_tab.tcl +@@ -0,0 +1,73 @@ ++# Copyright (C) 2001-2007 Tresys Technology, LLC ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ ++namespace eval Apol_Polcaps { ++ variable widgets ++ variable polcap_list {} ++} ++ ++proc Apol_Polcaps::create {tab_name nb} { ++ variable widgets ++ ++ set frame [$nb insert end $tab_name -text "Policy Capabilities"] ++ set pw [PanedWindow $frame.pw -side top] ++ set leftf [$pw add -weight 0] ++ set rightf [$pw add -weight 1] ++ pack $pw -fill both -expand yes ++ ++ set polcap_box [TitleFrame $leftf.polcap_box -text "Policy Capabilities"] ++ pack $polcap_box -fill both -expand yes ++ ++ set rlistbox [Apol_Widget::makeScrolledListbox [$polcap_box getframe].lb \ ++ -width 60 -listvar Apol_Polcaps::polcap_list] ++ pack $rlistbox -fill both -expand yes ++ ++ return $frame ++} ++ ++proc Apol_Polcaps::open {ppath} { ++ variable polcap_list ++ ++ set polcapnames {} ++ set q [new_apol_polcap_query_t] ++ # This reads in the polcap info ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ # This loop will process polcap name in the policy ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_polcap_from_void [$v get_element $i]] ++ append polcapnames [$q get_name $::ApolTop::qpolicy] ++ append polcapnames "\n" ++ } ++ } ++ ++ set polcap_list $polcapnames ++} ++ ++proc Apol_Polcaps::close {} { ++ variable widgets ++ variable polcap_list {} ++} ++ ++proc Apol_Polcaps::getTextWidget {} { ++ variable widgets ++} ++ ++#### private functions below #### ++ ++ ++ +diff --git a/apol/policyconf.tcl b/apol/policyconf.tcl +index 8f7e9c1..161f959 100644 +--- a/apol/policyconf.tcl ++++ b/apol/policyconf.tcl +@@ -63,7 +63,9 @@ proc Apol_PolicyConf::open {ppath} { + $textbox fakedelete 0.0 end + if {![ApolTop::is_capable "source"]} { + $textbox fakeinsert end "The currently loaded policy is not a source policy." ++ ApolTop::_toplevel_enable_tabs tag_source disabled + } else { ++ ApolTop::_toplevel_enable_tabs tag_source normal + set primary_file [$ppath get_primary] + if {[catch {::open $primary_file r} f]} { + $textbox fakeinsert end "$primary_file does not exist or could not be read by the user." +diff --git a/apol/terules_tab.tcl b/apol/terules_tab.tcl +index c5a490f..266d670 100644 +--- a/apol/terules_tab.tcl ++++ b/apol/terules_tab.tcl +@@ -93,6 +93,7 @@ proc Apol_TE::create {tab_name nb} { + + _createTypesAttribsTab + _createClassesPermsTab ++ _createFilenameTab + + # Action buttons + set widgets(new) [button $abox.new -text "New Search" -width 12 \ +@@ -138,6 +139,7 @@ proc Apol_TE::open {ppath} { + set vals(cp:classes) [Apol_Class_Perms::getClasses] + set enabled(cp:classes) 1 + set enabled(cp:perms) 1 ++ set vals(ta:use_filename) 0 + } + + proc Apol_TE::close {} { +@@ -252,6 +254,7 @@ proc Apol_TE::_initializeVars {} { + ta:source_sym,types $::APOL_QUERY_SYMBOL_IS_TYPE \ + ta:target_sym,types $::APOL_QUERY_SYMBOL_IS_TYPE \ + ta:default_sym,types $::APOL_QUERY_SYMBOL_IS_TYPE \ ++ ta:filename,files 1 \ + ] + + array set vals { +@@ -273,6 +276,10 @@ proc Apol_TE::_initializeVars {} { + ta:default_sym,attribs 0 + ta:default_sym {} + ++ ta:use_filename 0 ++ ta:filename {} ++ ta:filename,files 0 ++ + cp:classes {} + cp:classes_selected {} + cp:perms {} +@@ -286,6 +293,7 @@ proc Apol_TE::_initializeVars {} { + ta:use_source 1 + ta:use_target 1 + ta:use_default 1 ++ ta:use_filename 1 + + cp:classes 0 + cp:perms 0 +@@ -535,6 +543,156 @@ proc Apol_TE::_toggle_ta_pushed {col cb} { + } + } + ++proc Apol_TE::_createFilenameTab {} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ set fn_tab [$widgets(search_opts) insert end filename -text "Filename"] ++ set fm_filename [frame $fn_tab.filename] ++ grid $fm_filename -padx 4 -sticky ewns ++ foreach i {0 1 2} { ++ grid columnconfigure $fn_tab $i -weight 1 -uniform 1 ++ } ++ grid rowconfigure $fn_tab 0 -weight 1 ++ ++ set widgets(ta:use_filename) [checkbutton $fm_filename.use -text "type_transition filename" \ ++ -onvalue 1 -offvalue 0 -variable Apol_TE::vals(ta:use_filename)] ++ pack $widgets(ta:use_filename) -side top -anchor w ++ ++ trace add variable Apol_TE::vals(ta:use_filename) write \ ++ [list Apol_TE::_toggle_fn_box filename] ++ ++ set w {} ++ ++ set helptext "Select a filename - Note: no search using regular expr" ++ ++ set widgets(ta:filename_sym) [ComboBox $fm_filename.sym \ ++ -state normal -entrybg $ApolTop::default_bg_color \ ++ -textvariable Apol_TE::vals(ta:filename_sym) \ ++ -helptext $helptext -autopost 1] ++ pack $widgets(ta:filename_sym) -expand 0 -fill x -padx 8 ++ lappend w $widgets(ta:filename_sym) ++ ++ set widgets(ta:filename_widgets) $w ++ trace add variable Apol_TE::enabled(ta:use_filename) write \ ++ [list Apol_TE::_maybe_enable_filename filename] ++ ++ trace add variable Apol_TE::vals(ta:filename,files) write \ ++ [list Apol_TE::_toggle_FileNames filename] ++} ++ ++ ++proc Apol_TE::_toggle_fn_box {col name1 name2 op} { ++ variable vals ++ variable enabled ++ variable widgets ++ ++ if {$enabled(ta:use_${col})} { ++ $widgets(ta:use_${col}) configure -state normal ++ } else { ++ $widgets(ta:use_${col}) configure -state disabled ++ } ++ if {$enabled(ta:use_${col}) && $vals(ta:use_${col})} { ++ foreach w $widgets(ta:${col}_widgets) { ++ $w configure -state normal ++ } ++ $widgets(ta:${col}_sym) configure -entrybg white ++ } else { ++ foreach w $widgets(ta:${col}_widgets) { ++ $w configure -state disabled ++ } ++ $widgets(ta:${col}_sym) configure -entrybg $ApolTop::default_bg_color ++ } ++ ++ # update this tab's name if one of the columns is enabled and used ++ if {($enabled(ta:use_${col}) && $vals(ta:use_${col}))} { \ ++ $widgets(search_opts) itemconfigure filename -text "Filename *" ++ } else { ++ $widgets(search_opts) itemconfigure filename -text "Filename" ++ } ++} ++ ++proc Apol_TE::_maybe_enable_filename {col name1 name2 op} { ++ variable vals ++ variable enabled ++ variable widgets ++ ++ set typerule_set 0 ++ ++ foreach x {type_transition} { ++ if {$vals(rs:$x)} { ++ set typerule_set 1 ++ break ++ } ++ } ++ ++ if {$typerule_set && [ApolTop::is_capable "filename_trans"]} { ++ set enabled(ta:use_filename) 1 ++ } else { ++ set enabled(ta:use_filename) 0 ++ } ++ ++ set enabled(ta:use_${col}) $enabled(ta:use_${col}) ++} ++ ++ ++proc Apol_TE::_toggle_FileNames {col name1 name2 op} { ++ variable vals ++ variable widgets ++ variable enabled ++ ++ if {![ApolTop::is_policy_open]} { ++ return ++ } ++ ++ set items [lsort -unique -dictionary [Apol_TE::Get_FileNames]] ++ $widgets(ta:${col}_sym) configure -values $items ++} ++ ++proc Apol_TE::Get_FileNames {} { ++ set filenames {} ++ set q [new_apol_filename_trans_query_t] ++ # This reads in the filename_trans info ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ # This loop will process each filename_trans in the policy ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_filename_trans_from_void [$v get_element $i]] ++ lappend filenames [$q get_filename $::ApolTop::qpolicy] ++ } ++ } ++ return $filenames ++} ++ ++ ++proc Apol_TE::appendFilenameSearchResultRules {path indent rule_list cast filename} { ++ set curstate [$path.tb cget -state] ++ $path.tb configure -state normal ++ ++ variable enabled ++ variable vals ++ set num_rules 0 ++ ++ if { $vals(ta:use_filename) == 0} { ++ set filename "" ++ } ++ ++ for {set i 0} {$i < [$rule_list get_size]} {incr i} { ++ set rule [$cast [$rule_list get_element $i]] ++ if {$filename == "" || [$rule get_filename $::ApolTop::qpolicy] == $filename} { ++ $path.tb insert end [string repeat " " $indent] ++ $path.tb insert end [apol_filename_trans_render $::ApolTop::policy $rule] ++ incr num_rules ++ $path.tb insert end "\n" ++ } ++ } ++ $path.tb configure -state $curstate ++ list $num_rules $num_rules 0 ++} ++ + # code to create and handle the classe/permissions subtab + + proc Apol_TE::_createClassesPermsTab {} { +@@ -875,10 +1033,13 @@ proc Apol_TE::_search_terules {whichButton} { + return + } + if {$enabled(ta:use_default) && $vals(ta:use_default) && $vals(ta:default_sym) == {}} { +- + tk_messageBox -icon error -type ok -title "TE Rule Search" -message "No default type selected." + return + } ++ if {$enabled(ta:use_filename) && $vals(ta:use_filename) && $vals(ta:filename_sym) == {}} { ++ tk_messageBox -icon error -type ok -title "TE Rule Search" -message "No filename selected." ++ return ++ } + + set avrule_selection 0 + foreach {key value} [array get vals rs:avrule_*] { +@@ -896,6 +1057,7 @@ proc Apol_TE::_search_terules {whichButton} { + # start building queries + set avq [new_apol_avrule_query_t] + set teq [new_apol_terule_query_t] ++ set fnteq [new_apol_filename_trans_query_t] + + if {$enabled(ta:use_source) && $vals(ta:use_source)} { + if {$vals(ta:source_which) == "either"} { +@@ -905,21 +1067,28 @@ proc Apol_TE::_search_terules {whichButton} { + $avq set_source_component $::ApolTop::policy [expr {$vals(ta:source_sym,types) | $vals(ta:source_sym,attribs)}] + $teq set_source $::ApolTop::policy $vals(ta:source_sym) $vals(ta:source_indirect) + $teq set_source_component $::ApolTop::policy [expr {$vals(ta:source_sym,types) | $vals(ta:source_sym,attribs)}] ++ $fnteq set_source $::ApolTop::policy $vals(ta:source_sym) $vals(ta:source_indirect) + } + if {$enabled(ta:use_target) && $vals(ta:use_target)} { + $avq set_target $::ApolTop::policy $vals(ta:target_sym) $vals(ta:target_indirect) + $avq set_target_component $::ApolTop::policy [expr {$vals(ta:target_sym,types) | $vals(ta:target_sym,attribs)}] + $teq set_target $::ApolTop::policy $vals(ta:target_sym) $vals(ta:target_indirect) + $teq set_target_component $::ApolTop::policy [expr {$vals(ta:target_sym,types) | $vals(ta:target_sym,attribs)}] ++ $fnteq set_target $::ApolTop::policy $vals(ta:target_sym) $vals(ta:target_indirect) + } + if {$enabled(ta:use_default) && $vals(ta:use_default)} { + $teq set_default $::ApolTop::policy $vals(ta:default_sym) ++ $fnteq set_default $::ApolTop::policy $vals(ta:default_sym) ++ } ++ if {$enabled(ta:use_filename) && $vals(ta:use_filename)} { ++ $fnteq set_filename $::ApolTop::policy $vals(ta:filename_sym) + } + + if {$enabled(cp:classes)} { + foreach c $vals(cp:classes_selected) { + $avq append_class $::ApolTop::policy $c + $teq append_class $::ApolTop::policy $c ++ $fnteq append_class $::ApolTop::policy $c + } + } + if {$enabled(cp:perms)} { +@@ -935,6 +1104,7 @@ proc Apol_TE::_search_terules {whichButton} { + $teq set_enabled $::ApolTop::policy $vals(oo:enabled) + $avq set_regex $::ApolTop::policy $vals(oo:regexp) + $teq set_regex $::ApolTop::policy $vals(oo:regexp) ++ $fnteq set_regex $::ApolTop::policy $vals(oo:regexp) + + foreach x {new update reset} { + $widgets($x) configure -state disabled +@@ -952,16 +1122,20 @@ proc Apol_TE::_search_terules {whichButton} { + { + set numTEs {0 0 0} + set numAVs {0 0 0} ++ set numFNTEs {0 0 0} + set avresults NULL + set teresults NULL ++ set fnteresults NULL + set num_avresults 0 + set num_teresults 0 ++ set num_fnteresults 0 + if {![ApolTop::is_capable "syntactic rules"]} { + if {$avrule_selection != 0} { + set avresults [$avq run $::ApolTop::policy] + } + if {$terule_selection != 0} { + set teresults [$teq run $::ApolTop::policy] ++ set fnteresults [$fnteq run $::ApolTop::policy] + } + } else { + $::ApolTop::qpolicy build_syn_rule_table +@@ -972,11 +1146,16 @@ proc Apol_TE::_search_terules {whichButton} { + set teresults [$teq run_syn $::ApolTop::policy] + } + } ++ if {$terule_selection != 0} { ++ set fnteresults [$fnteq run $::ApolTop::policy] ++ } + + $avq -acquire + $avq -delete + $teq -acquire + $teq -delete ++ $fnteq -acquire ++ $fnteq -delete + if {$avresults != "NULL"} { + set num_avresults [$avresults get_size] + } +@@ -984,6 +1163,10 @@ proc Apol_TE::_search_terules {whichButton} { + set num_teresults [$teresults get_size] + } + ++ if {$fnteresults != "NULL"} { ++ set num_fnteresults [$fnteresults get_size] ++ } ++ + if {$whichButton == "new"} { + set sr [_create_new_results_tab] + } else { +@@ -1014,7 +1197,21 @@ proc Apol_TE::_search_terules {whichButton} { + set numTEs [Apol_Widget::appendSearchResultSynRules $sr 0 $teresults qpol_syn_terule_from_void] + } + } +- set num_rules [expr {[lindex $numAVs 0] + [lindex $numTEs 0]}] ++ ++ if { $vals(ta:use_filename) == 1 && $vals(ta:use_source) == 0 && $vals(ta:use_target) == 0 && $vals(ta:use_default) == 0} { ++ Apol_Widget::clearSearchResults $sr ++ set numTEs {0 0 0} ++ set numAVs {0 0 0} ++ } ++ ++ if {$vals(rs:type_transition) != 0} { ++ apol_tcl_set_info_string $::ApolTop::policy "Rendering $num_fnteresults Filename TE rule results" ++ if {$num_fnteresults > 0} { ++ set numFNTEs [Apol_TE::appendFilenameSearchResultRules $sr 0 $fnteresults qpol_filename_trans_from_void $vals(ta:filename_sym)] ++ } ++ } ++ ++ set num_rules [expr {[lindex $numAVs 0] + [lindex $numTEs 0] + [lindex $numFNTEs 0]}] + set num_enabled [expr {[lindex $numAVs 1] + [lindex $numTEs 1]}] + set num_disabled [expr {[lindex $numAVs 2] + [lindex $numTEs 2]}] + set header "$num_rules rule" +diff --git a/apol/top.tcl b/apol/top.tcl +index f930318..a267dde 100644 +--- a/apol/top.tcl ++++ b/apol/top.tcl +@@ -18,8 +18,9 @@ set COPYRIGHT_INFO "Copyright (C) 2001-2008 Tresys Technology, LLC" + namespace eval ApolTop { + variable policy {} ;# handle to an apol_policy, or {} if none opened + variable qpolicy {} ;# handle to policy's qpol_policy_t, or {} if none opened +- # these three are shown on the status line of the toplevel window ++ # these four are shown on the status line of the toplevel window + variable policy_version_string {} ++ variable policy_handle_unknown_string {} + variable policy_source_linenum {} + variable policy_stats_summary {} + variable policy_stats ;# array of statistics for the current policy +@@ -68,10 +69,15 @@ namespace eval ApolTop { + {Apol_Initial_SIDS components {}} + {Apol_NetContexts components {}} + {Apol_FSContexts components {}} ++ {Apol_Polcaps components {tag_polcap}} ++ {Apol_Namespaces components {}} + {Apol_TE rules {tag_query_saveable}} + {Apol_Cond_Rules rules {tag_conditionals}} ++ {Apol_Constraint rules {tag_query_saveable}} + {Apol_RBAC rules {}} + {Apol_Range rules {tag_mls}} ++ {Apol_Bounds rules {tag_bounds}} ++ {Apol_DefaultObjects rules {tag_default_objects}} + {Apol_File_Contexts {} {}} + {Apol_Analysis {} {tag_query_saveable}} + {Apol_PolicyConf {} {tag_source}} +@@ -108,6 +114,12 @@ proc ApolTop::is_capable {capability} { + "neverallow" { set cap $::QPOL_CAP_NEVERALLOW } + "source" { set cap $::QPOL_CAP_SOURCE } + "syntactic rules" { set cap $::QPOL_CAP_SYN_RULES } ++ "polcap" { set cap $::QPOL_CAP_POLCAPS } ++ "bounds" { set cap $::QPOL_CAP_BOUNDS } ++ "default_objects" { set cap $::QPOL_CAP_DEFAULT_OBJECTS } ++ "default_type" { set cap $::QPOL_CAP_DEFAULT_TYPE } ++ "permissive" { set cap $::QPOL_CAP_PERMISSIVE } ++ "filename_trans" { set cap $::QPOL_CAP_FILENAME_TRANS } + default { return 0 } + } + variable qpolicy +@@ -368,6 +380,15 @@ proc ApolTop::_toplevel_policy_open {ppath} { + if {![is_capable "source"]} { + _toplevel_enable_tabs tag_source disabled + } ++ if {![is_capable "polcap"]} { ++ _toplevel_enable_tabs tag_polcap disabled ++ } ++ if {![is_capable "bounds"]} { ++ _toplevel_enable_tabs tag_bounds disabled ++ } ++ if {![is_capable "default_objects"]} { ++ _toplevel_enable_tabs tag_default_objects disabled ++ } + _toplevel_tab_switched + + variable mainframe +@@ -376,6 +397,23 @@ proc ApolTop::_toplevel_policy_open {ppath} { + + _toplevel_update_stats + variable policy_version_string [$::ApolTop::policy get_version_type_mls_str] ++# Set how to handle unknown class/perms. ++#define SEPOL_DENY_UNKNOWN 0 ++#define SEPOL_REJECT_UNKNOWN 2 ++#define SEPOL_ALLOW_UNKNOWN 4 ++ variable policy_handle_unknown_string ++ set policy_handle_unknown -1 ++ set policy_handle_unknown [$::ApolTop::policy get_policy_handle_unknown] ++ ++ if {$policy_handle_unknown == 0} { ++ set policy_handle_unknown_string "deny" ++ } elseif {$policy_handle_unknown == 2} { ++ set policy_handle_unknown_string "reject" ++ } elseif {$policy_handle_unknown == 4} { ++ set policy_handle_unknown_string "allow" ++ } else { ++ set policy_handle_unknown_string "unknown" ++ } + + set primary_file [$ppath get_primary] + wm title . "SELinux Policy Analysis - $primary_file" +@@ -457,6 +495,9 @@ proc ApolTop::_toplevel_update_stats {} { + "sens" get_level_iter + "cats" get_cat_iter + "range_trans" get_range_trans_iter ++ "constraints" get_constraint_iter ++ "validatetrans" get_validatetrans_iter ++ "filename_trans" get_filename_trans_iter + + "sids" get_isid_iter + "portcons" get_portcon_iter +@@ -464,6 +505,8 @@ proc ApolTop::_toplevel_update_stats {} { + "nodecons" get_nodecon_iter + "genfscons" get_genfscon_iter + "fs_uses" get_fs_use_iter ++ "permissive" get_permissive_iter ++ "polcap" get_polcap_iter + } + foreach {key func} $iter_funcs { + set i [$::ApolTop::qpolicy $func] +@@ -518,6 +561,109 @@ proc ApolTop::_toplevel_update_stats {} { + $i -delete + } + ++ # Determine number of mlsconstrain and mlsvalidatetrans rules and ++ # recalculate the numbers accordingly. ++ if {[ApolTop::is_capable "mls"]} { ++ set mlsconstrain_count [ApolTop::_get_mls_count new_apol_constraint_query_t] ++ set policy_stats(constraints) [expr $policy_stats(constraints) - $mlsconstrain_count] ++ set policy_stats(mlsconstraints) $mlsconstrain_count ++ ++ set mlsvalidatetrans_count [ApolTop::_get_mls_count new_apol_validatetrans_query_t] ++ set policy_stats(validatetrans) [expr $policy_stats(validatetrans) - $mlsvalidatetrans_count] ++ set policy_stats(mlsvalidatetrans) $mlsvalidatetrans_count ++ } else { ++ set policy_stats(mlsconstraints) 0 ++ set policy_stats(mlsvalidatetrans) 0 ++ } ++ ++ # Determine number of bounds statements ++ set policy_stats(userbounds) 0 ++ set policy_stats(rolebounds) 0 ++ set policy_stats(typebounds) 0 ++ ++ if {[is_capable "bounds"]} { ++ # Determine number of userbounds statements ++ set q [new_apol_userbounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_userbounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ set policy_stats(userbounds) [expr $policy_stats(userbounds) + 1] ++ } ++ } ++ } ++ ++ # Determine number of rolebounds statements ++ set q [new_apol_rolebounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_rolebounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ set policy_stats(rolebounds) [expr $policy_stats(rolebounds) + 1] ++ } ++ } ++ } ++ ++ # Determine number of typebounds statements ++ set q [new_apol_typebounds_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_typebounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ set policy_stats(typebounds) [expr $policy_stats(typebounds) + 1] ++ } ++ } ++ } ++ } ++ ++ # Determine number of default_object statements ++ set policy_stats(default_user) 0 ++ set policy_stats(default_role) 0 ++ set policy_stats(default_type) 0 ++ set policy_stats(default_range) 0 ++ ++ if {[is_capable "default_objects"]} { ++ set q [new_apol_default_object_query_t] ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_default_object_from_void [$v get_element $i]] ++ set default [$q get_user_default $::ApolTop::qpolicy] ++ if {$default != ""} { ++ set policy_stats(default_user) [expr $policy_stats(default_user) + 1] ++ } ++ set default [$q get_role_default $::ApolTop::qpolicy] ++ if {$default != ""} { ++ set policy_stats(default_role) [expr $policy_stats(default_role) + 1] ++ } ++ if {[is_capable "default_type"]} { ++ set default [$q get_type_default $::ApolTop::qpolicy] ++ if {$default != ""} { ++ set policy_stats(default_type) [expr $policy_stats(default_type) + 1] ++ } ++ } ++ set default [$q get_range_default $::ApolTop::qpolicy] ++ if {$default != ""} { ++ set policy_stats(default_range) [expr $policy_stats(default_range) + 1] ++ } ++ } ++ } ++ } ++ + set policy_stats_summary "" + append policy_stats_summary "Classes: $policy_stats(classes) " + append policy_stats_summary "Perms: $policy_stats(perms) " +@@ -551,6 +697,7 @@ proc ApolTop::_user_close_policy {} { + + proc ApolTop::_close_policy {} { + variable policy_version_string {} ++ variable policy_handle_unknown {} + variable policy_stats_summary {} + + wm title . "SELinux Policy Analysis" +@@ -579,7 +726,9 @@ proc ApolTop::_close_policy {} { + + _toplevel_enable_tabs tag_conditionals normal + _toplevel_enable_tabs tag_mls normal +- _toplevel_enable_tabs tag_source normal ++ _toplevel_enable_tabs tag_polcap normal ++ _toplevel_enable_tabs tag_bounds normal ++ _toplevel_enable_tabs tag_default_objects normal + } + + proc ApolTop::_exit {} { +@@ -678,6 +827,7 @@ proc ApolTop::_save_query_file {} { + + proc ApolTop::_show_policy_summary {} { + variable policy_version_string ++ variable policy_handle_unknown_string + variable policy_stats + + if {![regexp -- {^([^\(]+) \(([^,]+), ([^\)]+)} $ApolTop::policy_version_string -> policy_version policy_type policy_mls_type]} { +@@ -696,8 +846,8 @@ proc ApolTop::_show_policy_summary {} { + + label $w.title -text "Policy Summary Statistics" + set f [frame $w.summary] +- label $f.l -justify left -text " Policy Version:\n Policy Type:\n MLS Status:" +- label $f.r -justify left -text "$policy_version\n$policy_type\n$policy_mls_type" ++ label $f.l -justify left -text " Policy Version:\n Policy Type:\n MLS Status:\n Handle unknown Class/Perms:" ++ label $f.r -justify left -text "$policy_version\n$policy_type\n$policy_mls_type\n$policy_handle_unknown_string" + grid $f.l $f.r -sticky w + grid configure $f.r -padx 30 + grid $w.title - -sticky w -padx 8 +@@ -714,6 +864,8 @@ proc ApolTop::_show_policy_summary {} { + } + "Number of Types and Attributes" { + "Types" types ++ " that includes permissive types" permissive ++ " that includes bounded types" typebounds + "Attributes" attribs + } + "Number of Type Enforcement Rules" { +@@ -722,16 +874,24 @@ proc ApolTop::_show_policy_summary {} { + "dontaudits" avrule_dontaudit + "neverallows" avrule_neverallow + "type_transitions" type_trans ++ "type_transitions - filename" filename_trans + "type_members" type_member + "type_changes" type_change + } + "Number of Roles" { + "Roles" roles ++ " that includes bounded roles" rolebounds + } + "Number of RBAC Rules" { + "allows" role_allow + "role_transitions" role_trans + } ++ "Number of Default Object Rules" { ++ "default_user" default_user ++ "default_role" default_role ++ "default_type" default_type ++ "default_range" default_range ++ } + } { + set ltext "$title:" + set rtext {} +@@ -754,16 +914,23 @@ proc ApolTop::_show_policy_summary {} { + foreach {title block} { + "Number of Users" { + "Users" users ++ " that includes bounded users" userbounds + } + "Number of Booleans" { + "Booleans" bools + } ++ "Number of Constraints" { ++ "constrain" constraints ++ "validatetrans" validatetrans ++ } + "Number of MLS Components" { + "Sensitivities" sens + "Categories" cats + } + "Number of MLS Rules" { + "range_transitions" range_trans ++ "mlsconstrain" mlsconstraints ++ "mlsvalidatetrans" mlsvalidatetrans + } + "Number of Initial SIDs" { + "SIDs" sids +@@ -775,6 +942,9 @@ proc ApolTop::_show_policy_summary {} { + "GenFSCons" genfscons + "fs_use statements" fs_uses + } ++ "Number of Policy Capabilities" { ++ "polcap" polcap ++ } + } { + set ltext "$title:" + set rtext {} +@@ -1067,6 +1237,41 @@ proc ApolTop::_write_configuration_file {} { + close $f + } + ++# This will work out how many mlsconstrain and mlsvalidatetrans rules ++# there are as the get_iter numbers are overall count. ++proc ApolTop::_get_mls_count {command} { ++ ++ set q [$command] ++ # This reads in the constraint info ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ ++ set mls_count 0 ++ ++ # This loop will process each constraint in the policy ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_constraint_from_void [$v get_element $i]] ++ ++ # Find if this is an mls rule or not ++ set x [$q get_expr_iter $::ApolTop::qpolicy] ++ while {![$x end]} { ++ foreach t [iter_to_list $x] { ++ set t [qpol_constraint_expr_node_from_void $t] ++ # Get Symbol type ++ set sym_type [$t get_sym_type $::ApolTop::qpolicy] ++ if { $sym_type >= $::QPOL_CEXPR_SYM_L1L2 } { ++ set mls_count [expr $mls_count + 1] ++ break ++ } ++ } ++ } ++ $x -acquire ++ $x -delete ++ } ++ return $mls_count ++} ++ + ####################################################### + # Start script here + +diff --git a/apol/types_tab.tcl b/apol/types_tab.tcl +index 26def34..fed82fa 100644 +--- a/apol/types_tab.tcl ++++ b/apol/types_tab.tcl +@@ -60,7 +60,8 @@ proc Apol_Types::create {tab_name nb} { + set ofm [$obox getframe] + set fm_types_select [frame $ofm.to] + set fm_attribs_select [frame $ofm.ao] +- pack $fm_types_select $fm_attribs_select -side left -padx 4 -pady 2 -anchor nw ++ set fm_permissive_bounds [frame $ofm.po] ++ pack $fm_types_select $fm_attribs_select $fm_permissive_bounds -side left -padx 4 -pady 2 -anchor nw + + set types_select [checkbutton $fm_types_select.type -text "Show types" -variable Apol_Types::opts(types)] + set typeattribs [checkbutton $fm_types_select.typeattribs -text "Include attributes" \ +@@ -81,6 +82,18 @@ proc Apol_Types::create {tab_name nb} { + trace add variable Apol_Types::opts(attribs) write \ + [list Apol_Types::_toggleCheckbuttons [list $a_typeattribs $a_types]] + ++ set permissive_select [checkbutton $fm_permissive_bounds.type -text "Show permissive types" \ ++ -variable Apol_Types::opts(permissive)] ++ pack $permissive_select -anchor w ++ trace add variable Apol_Types::opts(permissive:show_names) write \ ++ [list Apol_Types::_toggleCheckbuttons $permissive_select] ++ ++ set typebounds_select [checkbutton $fm_permissive_bounds.bounds -text "Show typebounds rules" \ ++ -variable Apol_Types::opts(typebounds)] ++ pack $typebounds_select -anchor w ++ trace add variable Apol_Types::opts(typebounds:show_names) write \ ++ [list Apol_Types::_toggleCheckbuttons $typebounds_select] ++ + set widgets(regexp) [Apol_Widget::makeRegexpEntry $ofm.regexpf] + Apol_Widget::setRegexpEntryState $widgets(regexp) 1 + +@@ -96,6 +109,11 @@ proc Apol_Types::create {tab_name nb} { + } + + proc Apol_Types::open {ppath} { ++ variable opts ++ ++ set opts(permissive:show_names) [ApolTop::is_capable "permissive"] ++ set opts(typebounds:show_names) [ApolTop::is_capable "bounds"] ++ + set q [new_apol_type_query_t] + set v [$q run $::ApolTop::policy] + $q -acquire +@@ -180,12 +198,15 @@ proc Apol_Types::_initializeVars {} { + array set opts { + types 1 types:show_attribs 1 types:show_aliases 1 + attribs 0 attribs:show_types 1 attribs:show_attribs 1 ++ permissive 1 permissive:show_names 0 ++ typebounds 1 typebounds:show_names 0 + } + } + + proc Apol_Types::_toggleCheckbuttons {w name1 name2 op} { + variable opts + variable widgets ++ + if {$opts($name2)} { + foreach x $w { + $x configure -state normal +@@ -195,7 +216,7 @@ proc Apol_Types::_toggleCheckbuttons {w name1 name2 op} { + $x configure -state disabled + } + } +- if {!$opts(types) && !$opts(attribs)} { ++ if {!$opts(types) && !$opts(attribs) && !$opts(typebounds)} { + Apol_Widget::setRegexpEntryState $widgets(regexp) 0 + } else { + Apol_Widget::setRegexpEntryState $widgets(regexp) 1 +@@ -210,7 +231,6 @@ proc Apol_Types::_popupTypeInfo {which ta} { + set entry_vector {} + set index_file_loaded 0 + } +- + if {$which == "type"} { + set info_ta [_renderType $ta 1 1] + } else { +@@ -283,7 +303,7 @@ proc Apol_Types::_searchTypes {} { + tk_messageBox -icon error -type ok -title "Error" -message "No current policy file is opened." + return + } +- if {$opts(types) == 0 && $opts(attribs) == 0} { ++ if {$opts(types) == 0 && $opts(attribs) == 0 && $opts(permissive) == 0 && $opts(typebounds) == 0} { + tk_messageBox -icon error -type ok -title "Error" -message "No search options provided." + return + } +@@ -332,6 +352,52 @@ proc Apol_Types::_searchTypes {} { + append results "[_renderAttrib $a $opts(attribs:show_types) $opts(attribs:show_attribs)]\n" + } + } ++ if {$opts(permissive) && [ApolTop::is_capable "permissive"]} { ++ set q [new_apol_permissive_query_t] ++ $q set_name $::ApolTop::policy $regexp ++ $q set_regex $::ApolTop::policy $use_regexp ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ set permissive_data [type_vector_to_list $v] ++ $v -acquire ++ $v -delete ++ if {$opts(types) || $opts(attribs)} { ++ append results "\n\n" ++ } ++ append results "PERMISSIVE TYPES ([llength $permissive_data]):\n\n" ++ foreach p [lsort $permissive_data] { ++ append results "[_renderType $p 0 0]\n" ++ } ++ } ++ if {$opts(typebounds) && [ApolTop::is_capable "bounds"]} { ++ set bounds {} ++ set counter 0 ++ ++ set q [new_apol_typebounds_query_t] ++ $q set_name $::ApolTop::policy $regexp ++ $q set_regex $::ApolTop::policy $use_regexp ++ ++ set v [$q run $::ApolTop::policy] ++ $q -acquire ++ $q -delete ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ for {set i 0} {$v != "NULL" && $i < [$v get_size]} {incr i} { ++ set q [qpol_typebounds_from_void [$v get_element $i]] ++ set parent [$q get_parent_name $::ApolTop::qpolicy] ++ if {$parent != ""} { ++ append bounds "typebounds $parent " ++ append bounds "[$q get_child_name $::ApolTop::qpolicy];\n" ++ set counter [expr $counter + 1] ++ } ++ } ++ } ++ if {$opts(types) || $opts(attribs) || $opts(permissive)} { ++ append results "\n\n" ++ } ++ append results "BOUNDED TYPES ($counter):\n\n" ++ append results "$bounds\n" ++ } + Apol_Widget::appendSearchResultText $widgets(results) $results + } + +@@ -369,6 +435,9 @@ proc Apol_Types::_renderType {type_name show_attribs show_aliases} { + } + + proc Apol_Types::_renderAttrib {attrib_name show_types show_attribs} { ++ ++ set permissive {} ++ + set qpol_type_datum [new_qpol_type_t $::ApolTop::qpolicy $attrib_name] + + set text "$attrib_name" +diff --git a/configure.ac b/configure.ac +index 577ce48..ae20da7 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -25,9 +25,9 @@ libseaudit_version=4.5 + setoolsdir='${prefix}/share/setools-3.3' + javadir='${prefix}/share/java' + +-version_min_sepol_major=1 +-version_min_sepol_minor=12 +-version_min_sepol_patch=27 ++version_min_sepol_major=2 ++version_min_sepol_minor=4 ++version_min_sepol_patch=0 + + dnl *** end of tunable values *** + +@@ -548,6 +548,36 @@ int main () { + fi + fi + ++dnl check for constraint names, added in libsepol version ?? ++AC_CHECK_DECL([POLICYDB_VERSION_CONSTRAINT_NAMES], ++ sepol_new_constraint_names="yes", ++ sepol_new_constraint_names="no", ++ [#include ]) ++ ++dnl check for default object type, added in libsepol version ?? ++AC_CHECK_DECL([POLICYDB_VERSION_DEFAULT_TYPE], ++ sepol_new_default_type="yes", ++ sepol_new_default_type="no", ++ [#include ]) ++ ++dnl check for default object user/role/range added in libsepol version ?? ++AC_CHECK_DECL([POLICYDB_VERSION_NEW_OBJECT_DEFAULTS], ++ sepol_new_object_defaults="yes", ++ sepol_new_object_defaults="no", ++ [#include ]) ++ ++dnl check for filename trans rule, added in libsepol version ?? ++AC_CHECK_DECL([POLICYDB_VERSION_FILENAME_TRANS], ++ sepol_new_filename_trans="yes", ++ sepol_new_filename_trans="no", ++ [#include ]) ++ ++dnl check for user/role/type bounds, added in libsepol version ?? ++AC_CHECK_DECL([POLICYDB_VERSION_BOUNDARY], ++ sepol_new_bounds="yes", ++ sepol_new_bounds="no", ++ [#include ]) ++ + dnl check for permissive types, added in libsepol version 2.0.26 + AC_CHECK_DECL([TYPE_FLAGS_PERMISSIVE], + sepol_new_permissive_types="yes", +@@ -855,6 +885,21 @@ fi + if test ${sepol_new_permissive_types} == "yes"; then + AC_DEFINE(HAVE_SEPOL_PERMISSIVE_TYPES, 1, [if types can be marked as permissive]) + fi ++if test ${sepol_new_constraint_names} == "yes"; then ++ AC_DEFINE(HAVE_SEPOL_CONSTRAINT_NAMES, 1, [if source policy types/attributes are present]) ++fi ++if test ${sepol_new_default_type} == "yes"; then ++ AC_DEFINE(HAVE_SEPOL_DEFAULT_TYPE, 1, [if default_user rule present]) ++fi ++if test ${sepol_new_object_defaults} == "yes"; then ++ AC_DEFINE(HAVE_SEPOL_NEW_OBJECT_DEFAULTS, 1, [if default_user/role/range rules are present]) ++fi ++if test ${sepol_new_filename_trans} == "yes"; then ++ AC_DEFINE(HAVE_SEPOL_FILENAME_TRANS, 1, [if the filename transition rule present]) ++fi ++if test ${sepol_new_bounds} == "yes"; then ++ AC_DEFINE(HAVE_SEPOL_BOUNDARY, 1, [if bounds rules are present]) ++fi + if test ${sepol_new_user_role_mapping} == "yes"; then + AC_DEFINE(HAVE_SEPOL_USER_ROLE_MAPPING, 1, [if users and roles are mapped during policy expansion]) + fi +diff --git a/libapol/include/apol/Makefile.am b/libapol/include/apol/Makefile.am +index e398ff2..dd94452 100644 +--- a/libapol/include/apol/Makefile.am ++++ b/libapol/include/apol/Makefile.am +@@ -3,11 +3,13 @@ apoldir = $(includedir)/apol + apol_HEADERS = \ + avrule-query.h \ + bool-query.h \ ++ bounds-query.h \ + bst.h \ + class-perm-query.h \ + condrule-query.h \ + constraint-query.h \ + context-query.h \ ++ default-object-query.h \ + domain-trans-analysis.h \ + fscon-query.h \ + infoflow-analysis.h \ +diff --git a/libapol/include/apol/bounds-query.h b/libapol/include/apol/bounds-query.h +new file mode 100644 +index 0000000..5559ab4 +--- /dev/null ++++ b/libapol/include/apol/bounds-query.h +@@ -0,0 +1,177 @@ ++/** ++ * @file ++ * ++ * Routines to query policy capabilities in policy. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2007 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#ifndef APOL_BOUNDS_QUERY_H ++#define APOL_BOUNDS_QUERY_H ++ ++#ifdef __cplusplus ++extern "C" ++{ ++#endif ++ ++#include "policy.h" ++#include "vector.h" ++#include ++ ++ /************ TYPEBOUNDS *************/ ++ typedef struct apol_typebounds_query apol_typebounds_query_t; ++/** ++ * Execute a query against all policy capabilities within the policy. ++ * ++ * @param p Policy within which to look up policy capabilities. ++ * @param t Structure containing parameters for query. If this is ++ * NULL then return all policy capabilities. ++ * @param v Reference to a vector of qpol_typebounds_t. The vector will be ++ * allocated by this function. The caller must call ++ * apol_vector_destroy() afterwards. This will be set to NULL upon no ++ * results or upon error. ++ * ++ * @return 0 on success (including none found), negative on error. ++ */ ++ extern int apol_typebounds_get_by_query(const apol_policy_t * p, apol_typebounds_query_t * t, apol_vector_t ** v); ++ ++/** ++ * Allocate and return a new typebounds query structure. All fields are ++ * initialized, such that running this blank query results in ++ * returning all policy capabilities within the policy. The caller must call ++ * apol_typebounds_query_destroy() upon the return value afterwards. ++ * ++ * @return An initialized typebounds query structure, or NULL upon error. ++ */ ++ extern apol_typebounds_query_t *apol_typebounds_query_create(void); ++ ++/** ++ * Deallocate all memory associated with the referenced typebounds query, ++ * and then set it to NULL. This function does nothing if the query ++ * is already NULL. ++ * ++ * @param t Reference to a typebounds query structure to destroy. ++ */ ++ extern void apol_typebounds_query_destroy(apol_typebounds_query_t ** t); ++ ++/** ++ * Set a typebounds query to return only policy capabilities that match this name. This function ++ * duplicates the incoming name. ++ * ++ * @param p Policy handler, to report errors. ++ * @param t typebounds query to set. ++ * @param name Limit query to only policy capabilities with this name, or ++ * NULL to unset this field. ++ * ++ * @return 0 on success, negative on error. ++ */ ++ extern int apol_typebounds_query_set_name(const apol_policy_t * p, apol_typebounds_query_t * t, const char *name); ++ ++/** ++ * Set a typebounds query to use regular expression searching for all of its ++ * fields. Strings will be treated as regexes instead of literals. ++ * Matching will occur against the policy capability name. ++ * ++ * @param p Policy handler, to report errors. ++ * @param t typebounds query to set. ++ * @param is_regex Non-zero to enable regex searching, 0 to disable. ++ * ++ * @return Always 0. ++ */ ++ extern int apol_typebounds_query_set_regex(const apol_policy_t * p, apol_typebounds_query_t * t, int is_regex); ++ ++ ++ /************ ROLEBOUNDS *************/ ++ typedef struct apol_rolebounds_query apol_rolebounds_query_t; ++/** ++ * Execute a query against all policy capabilities within the policy. ++ * ++ * @param p Policy within which to look up policy capabilities. ++ * @param t Structure containing parameters for query. If this is ++ * NULL then return all policy capabilities. ++ * @param v Reference to a vector of qpol_rolebounds_t. The vector will be ++ * allocated by this function. The caller must call ++ * apol_vector_destroy() afterwards. This will be set to NULL upon no ++ * results or upon error. ++ * ++ * @return 0 on success (including none found), negative on error. ++ */ ++ extern int apol_rolebounds_get_by_query(const apol_policy_t * p, apol_rolebounds_query_t * t, apol_vector_t ** v); ++ ++/** ++ * Allocate and return a new rolebounds query structure. All fields are ++ * initialized, such that running this blank query results in ++ * returning all policy capabilities within the policy. The caller must call ++ * apol_rolebounds_query_destroy() upon the return value afterwards. ++ * ++ * @return An initialized rolebounds query structure, or NULL upon error. ++ */ ++ extern apol_rolebounds_query_t *apol_rolebounds_query_create(void); ++ ++/** ++ * Deallocate all memory associated with the referenced rolebounds query, ++ * and then set it to NULL. This function does nothing if the query ++ * is already NULL. ++ * ++ * @param t Reference to a rolebounds query structure to destroy. ++ */ ++ extern void apol_rolebounds_query_destroy(apol_rolebounds_query_t ** t); ++ ++ /************ USERBOUNDS *************/ ++ typedef struct apol_userbounds_query apol_userbounds_query_t; ++/** ++ * Execute a query against all policy capabilities within the policy. ++ * ++ * @param p Policy within which to look up policy capabilities. ++ * @param t Structure containing parameters for query. If this is ++ * NULL then return all policy capabilities. ++ * @param v Reference to a vector of qpol_userbounds_t. The vector will be ++ * allocated by this function. The caller must call ++ * apol_vector_destroy() afterwards. This will be set to NULL upon no ++ * results or upon error. ++ * ++ * @return 0 on success (including none found), negative on error. ++ */ ++ extern int apol_userbounds_get_by_query(const apol_policy_t * p, apol_userbounds_query_t * t, apol_vector_t ** v); ++ ++/** ++ * Allocate and return a new userbounds query structure. All fields are ++ * initialized, such that running this blank query results in ++ * returning all policy capabilities within the policy. The caller must call ++ * apol_userbounds_query_destroy() upon the return value afterwards. ++ * ++ * @return An initialized userbounds query structure, or NULL upon error. ++ */ ++ extern apol_userbounds_query_t *apol_userbounds_query_create(void); ++ ++/** ++ * Deallocate all memory associated with the referenced userbounds query, ++ * and then set it to NULL. This function does nothing if the query ++ * is already NULL. ++ * ++ * @param t Reference to a userbounds query structure to destroy. ++ */ ++ extern void apol_userbounds_query_destroy(apol_userbounds_query_t ** t); ++ ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif +diff --git a/libapol/include/apol/default-object-query.h b/libapol/include/apol/default-object-query.h +new file mode 100644 +index 0000000..d30e002 +--- /dev/null ++++ b/libapol/include/apol/default-object-query.h +@@ -0,0 +1,78 @@ ++/** ++ * @file ++ * ++ * Routines to query default objects in policy. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2007 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#ifndef APOL_DEFAULT_OBJECT_QUERY_H ++#define APOL_DEFAULT_OBJECT_QUERY_H ++ ++#ifdef __cplusplus ++extern "C" ++{ ++#endif ++ ++#include "policy.h" ++#include "vector.h" ++#include ++ ++ typedef struct apol_default_object_query apol_default_object_query_t; ++/** ++ * Execute a query against all policy capabilities within the policy. ++ * ++ * @param p Policy within which to look up policy capabilities. ++ * @param t Structure containing parameters for query. If this is ++ * NULL then return all policy capabilities. ++ * @param v Reference to a vector of qpol_default_object_t. The vector will be ++ * allocated by this function. The caller must call ++ * apol_vector_destroy() afterwards. This will be set to NULL upon no ++ * results or upon error. ++ * ++ * @return 0 on success (including none found), negative on error. ++ */ ++ extern int apol_default_object_get_by_query(const apol_policy_t * p, apol_default_object_query_t * t, apol_vector_t ** v); ++ ++/** ++ * Allocate and return a new default_object query structure. All fields are ++ * initialized, such that running this blank query results in ++ * returning all policy capabilities within the policy. The caller must call ++ * apol_default_object_query_destroy() upon the return value afterwards. ++ * ++ * @return An initialized default_object query structure, or NULL upon error. ++ */ ++ extern apol_default_object_query_t *apol_default_object_query_create(void); ++ ++/** ++ * Deallocate all memory associated with the referenced default_object query, ++ * and then set it to NULL. This function does nothing if the query ++ * is already NULL. ++ * ++ * @param t Reference to a default_object query structure to destroy. ++ */ ++ extern void apol_default_object_query_destroy(apol_default_object_query_t ** t); ++ ++ ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif +diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h +index aee3ad0..276aab9 100644 +--- a/libapol/include/apol/ftrule-query.h ++++ b/libapol/include/apol/ftrule-query.h +@@ -130,7 +130,19 @@ extern "C" + * + * @return 0 on success, negative on error. + */ +- extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename); ++ extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *type); ++ ++/** ++ * Set a filename trans query to the filename. ++ * ++ * @param p Policy handler, to report errors. ++ * @param r FT rule query to set. ++ * @param is_any Non-zero to use source symbol for source or default ++ * field, 0 to keep source as only source. ++ * ++ * @return Always 0. ++ */ ++ extern int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename); + + /** + * Set at filename_trans query to return rules with this object (non-common) +diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h +index 665e4cb..f1a5c29 100644 +--- a/libapol/include/apol/policy-query.h ++++ b/libapol/include/apol/policy-query.h +@@ -66,6 +66,8 @@ extern "C" + #include "context-query.h" + #include "permissive-query.h" + #include "polcap-query.h" ++#include "bounds-query.h" ++#include "default-object-query.h" + + #include "avrule-query.h" + #include "terule-query.h" +diff --git a/libapol/include/apol/policy.h b/libapol/include/apol/policy.h +index 7b26af8..143153d 100644 +--- a/libapol/include/apol/policy.h ++++ b/libapol/include/apol/policy.h +@@ -91,6 +91,15 @@ extern "C" + extern int apol_policy_get_policy_type(const apol_policy_t * policy); + + /** ++ * Given a policy, return the handle_unknown flag. ++ * ++ * @param policy Policy to check. ++ * ++ * @return The policy handle_unknown flag, or < 0 upon error. ++ */ ++ extern int apol_policy_get_policy_handle_unknown(const apol_policy_t * policy); ++ ++/** + * Given a policy, return a pointer to the underlying qpol_policy. + * This is needed, for example, to access details of particulary qpol + * components. +diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am +index baaa4f6..22c80cf 100644 +--- a/libapol/src/Makefile.am ++++ b/libapol/src/Makefile.am +@@ -14,11 +14,13 @@ AM_LDFLAGS = @DEBUGLDFLAGS@ @WARNLDFLAGS@ @PROFILELDFLAGS@ + libapol_a_SOURCES = \ + avrule-query.c \ + bool-query.c \ ++ bounds-query.c \ + bst.c \ + class-perm-query.c \ + condrule-query.c \ + constraint-query.c \ + context-query.c \ ++ default-object-query.c \ + domain-trans-analysis.c domain-trans-analysis-internal.h \ + fscon-query.c \ + infoflow-analysis.c infoflow-analysis-internal.h \ +diff --git a/libapol/src/bounds-query.c b/libapol/src/bounds-query.c +new file mode 100644 +index 0000000..06662f4 +--- /dev/null ++++ b/libapol/src/bounds-query.c +@@ -0,0 +1,216 @@ ++/** ++ * @file ++ * ++ * Provides a way for setools to make queries about policy capabilities ++ * within a policy. The caller obtains a query object, ++ * fills in its parameters, and then runs the query; it obtains a ++ * vector of results. Searches are conjunctive -- all fields of the ++ * search query must match for a datum to be added to the results ++ * query. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2007 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#include "policy-query-internal.h" ++ ++#include ++ ++ /************ TYPEBOUNDS *************/ ++struct apol_typebounds_query ++{ ++ char *name; ++ unsigned int flags; ++ regex_t *regex; ++}; ++ ++int apol_typebounds_get_by_query(const apol_policy_t * p, apol_typebounds_query_t * q, apol_vector_t ** v) ++{ ++ qpol_iterator_t *iter; ++ int retval = -1; ++ ++ *v = NULL; ++ if (qpol_policy_get_typebounds_iter(p->p, &iter) < 0) { ++ return -1; ++ } ++ if ((*v = apol_vector_create(NULL)) == NULL) { ++ ERR(p, "%s", strerror(errno)); ++ goto cleanup; ++ } ++ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { ++ const qpol_typebounds_t *typebounds; ++ if (qpol_iterator_get_item(iter, (void **)&typebounds) < 0) { ++ goto cleanup; ++ } ++ if (q != NULL) { ++ if (apol_compare_typebounds(p, typebounds, q->name, ++ q->flags, &(q->regex)) == 1) { ++ if (apol_vector_append(*v, (void *)typebounds)) { ++ ERR(p, "%s", strerror(ENOMEM)); ++ goto cleanup; ++ } ++ } ++ } ++ } ++ ++ retval = 0; ++cleanup: ++ if (retval != 0) { ++ apol_vector_destroy(v); ++ } ++ qpol_iterator_destroy(&iter); ++ return retval; ++} ++ ++apol_typebounds_query_t *apol_typebounds_query_create(void) ++{ ++ return calloc(1, sizeof(apol_typebounds_query_t)); ++} ++ ++void apol_typebounds_query_destroy(apol_typebounds_query_t ** q) ++{ ++ if (*q != NULL) { ++ free((*q)->name); ++ apol_regex_destroy(&(*q)->regex); ++ free(*q); ++ *q = NULL; ++ } ++} ++ ++int apol_typebounds_query_set_name(const apol_policy_t * p, apol_typebounds_query_t * q, const char *name) ++{ ++ return apol_query_set(p, &q->name, &q->regex, name); ++} ++ ++int apol_typebounds_query_set_regex(const apol_policy_t * p, apol_typebounds_query_t * q, int is_regex) ++{ ++ return apol_query_set_regex(p, &q->flags, is_regex); ++} ++ ++ ++ /************ ROLEBOUNDS *************/ ++struct apol_rolebounds_query ++{ ++ char *name; ++}; ++ ++int apol_rolebounds_get_by_query(const apol_policy_t * p, apol_rolebounds_query_t * q, apol_vector_t ** v) ++{ ++ qpol_iterator_t *iter; ++ int retval = -1; ++ ++ *v = NULL; ++ if (qpol_policy_get_rolebounds_iter(p->p, &iter) < 0) { ++ return -1; ++ } ++ if ((*v = apol_vector_create(NULL)) == NULL) { ++ ERR(p, "%s", strerror(errno)); ++ goto cleanup; ++ } ++ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { ++ const qpol_rolebounds_t *rolebounds; ++ if (qpol_iterator_get_item(iter, (void **)&rolebounds) < 0) { ++ goto cleanup; ++ } ++ if (q != NULL) { ++ if (apol_vector_append(*v, (void *)rolebounds)) { ++ ERR(p, "%s", strerror(ENOMEM)); ++ goto cleanup; ++ } ++ } ++ } ++ ++ retval = 0; ++cleanup: ++ if (retval != 0) { ++ apol_vector_destroy(v); ++ } ++ qpol_iterator_destroy(&iter); ++ return retval; ++} ++ ++apol_rolebounds_query_t *apol_rolebounds_query_create(void) ++{ ++ return calloc(1, sizeof(apol_rolebounds_query_t)); ++} ++ ++void apol_rolebounds_query_destroy(apol_rolebounds_query_t ** q) ++{ ++ if (*q != NULL) { ++ free((*q)->name); ++ free(*q); ++ *q = NULL; ++ } ++} ++ ++ ++ /************ USERBOUNDS *************/ ++struct apol_userbounds_query ++{ ++ char *name; ++}; ++ ++int apol_userbounds_get_by_query(const apol_policy_t * p, apol_userbounds_query_t * q, apol_vector_t ** v) ++{ ++ qpol_iterator_t *iter; ++ int retval = -1; ++ ++ *v = NULL; ++ if (qpol_policy_get_userbounds_iter(p->p, &iter) < 0) { ++ return -1; ++ } ++ if ((*v = apol_vector_create(NULL)) == NULL) { ++ ERR(p, "%s", strerror(errno)); ++ goto cleanup; ++ } ++ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { ++ const qpol_userbounds_t *userbounds; ++ if (qpol_iterator_get_item(iter, (void **)&userbounds) < 0) { ++ goto cleanup; ++ } ++ if (q != NULL) { ++ if (apol_vector_append(*v, (void *)userbounds)) { ++ ERR(p, "%s", strerror(ENOMEM)); ++ goto cleanup; ++ } ++ } ++ } ++ ++ retval = 0; ++cleanup: ++ if (retval != 0) { ++ apol_vector_destroy(v); ++ } ++ qpol_iterator_destroy(&iter); ++ return retval; ++} ++ ++apol_userbounds_query_t *apol_userbounds_query_create(void) ++{ ++ return calloc(1, sizeof(apol_userbounds_query_t)); ++} ++ ++void apol_userbounds_query_destroy(apol_userbounds_query_t ** q) ++{ ++ if (*q != NULL) { ++ free((*q)->name); ++ free(*q); ++ *q = NULL; ++ } ++} ++ +diff --git a/libapol/src/default-object-query.c b/libapol/src/default-object-query.c +new file mode 100644 +index 0000000..3724e69 +--- /dev/null ++++ b/libapol/src/default-object-query.c +@@ -0,0 +1,87 @@ ++/** ++ * @file ++ * ++ * Provides a way for setools to make queries about policy capabilities ++ * within a policy. The caller obtains a query object, ++ * fills in its parameters, and then runs the query; it obtains a ++ * vector of results. Searches are conjunctive -- all fields of the ++ * search query must match for a datum to be added to the results ++ * query. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2007 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#include "policy-query-internal.h" ++ ++#include ++ ++struct apol_default_object_query ++{ ++ char *name; ++}; ++ ++int apol_default_object_get_by_query(const apol_policy_t * p, apol_default_object_query_t * q, apol_vector_t ** v) ++{ ++ qpol_iterator_t *iter; ++ int retval = -1; ++ ++ *v = NULL; ++ if (qpol_policy_get_default_object_iter(p->p, &iter) < 0) { ++ return -1; ++ } ++ if ((*v = apol_vector_create(NULL)) == NULL) { ++ ERR(p, "%s", strerror(errno)); ++ goto cleanup; ++ } ++ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { ++ const qpol_default_object_t *default_object; ++ if (qpol_iterator_get_item(iter, (void **)&default_object) < 0) { ++ goto cleanup; ++ } ++ if (q != NULL) { ++ if (apol_vector_append(*v, (void *)default_object)) { ++ ERR(p, "%s", strerror(ENOMEM)); ++ goto cleanup; ++ } ++ } ++ } ++ ++ retval = 0; ++cleanup: ++ if (retval != 0) { ++ apol_vector_destroy(v); ++ } ++ qpol_iterator_destroy(&iter); ++ return retval; ++} ++ ++apol_default_object_query_t *apol_default_object_query_create(void) ++{ ++ return calloc(1, sizeof(apol_default_object_query_t)); ++} ++ ++void apol_default_object_query_destroy(apol_default_object_query_t ** q) ++{ ++ if (*q != NULL) { ++ free((*q)->name); ++ free(*q); ++ *q = NULL; ++ } ++} ++ +diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c +index 50c6c7a..aeebc25 100644 +--- a/libapol/src/ftrule-query.c ++++ b/libapol/src/ftrule-query.c +@@ -215,10 +215,10 @@ void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** t) + } + } + +-int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect) ++int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect) + { + apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_SOURCE_INDIRECT); +- return apol_query_set(p, &t->source, NULL, filename); ++ return apol_query_set(p, &t->source, NULL, type); + } + + //TODO is the equivilent terule_query_set_{source,target}_compoenent needed? +diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map +index 7657a2d..8741bf4 100644 +--- a/libapol/src/libapol.map ++++ b/libapol/src/libapol.map +@@ -83,5 +83,9 @@ VERS_4.1{ + VERS_4.2{ + global: + apol_permissive_*; ++ apol_typebounds_*; ++ apol_rolebounds_*; ++ apol_userbounds_*; + apol_polcap_*; ++ apol_default_object_*; + } VERS_4.1; +diff --git a/libapol/src/policy-query-internal.h b/libapol/src/policy-query-internal.h +index 657c815..d7e57e0 100644 +--- a/libapol/src/policy-query-internal.h ++++ b/libapol/src/policy-query-internal.h +@@ -228,6 +228,25 @@ extern "C" + regex_t ** type_regex); + + /** ++ * Determines if a (partial) typebounds query matches a qpol_typebounds_t, ++ * by name. ++ * ++ * @param p Policy within which to look up types. ++ * @param type typebounds datum to compare against. ++ * @param name Source target from which to compare. ++ * @param flags If APOL_QUERY_REGEX bit is set, treat name as a ++ * regular expression. ++ * @param regex If using regexp comparison, the compiled regular ++ * expression to use; the pointer will be allocated space if regexp is ++ * legal. If NULL, then compile the regexp pattern given by name and ++ * cache it here. ++ * ++ * @return 1 If comparison succeeds, 0 if not; < 0 on error. ++ */ ++ int apol_compare_typebounds(const apol_policy_t * p, const qpol_typebounds_t * typebounds, const char *name, unsigned int flags, ++ regex_t ** type_regex); ++ ++/** + * Determines if a boolean is used within a particual conditional. + * + * @param p Policy within which to look up types. +diff --git a/libapol/src/policy-query.c b/libapol/src/policy-query.c +index 18152fb..5ce52a2 100644 +--- a/libapol/src/policy-query.c ++++ b/libapol/src/policy-query.c +@@ -188,6 +188,29 @@ int apol_compare_polcap(const apol_policy_t * p, const qpol_polcap_t * polcap, c + return compval; + } + ++int apol_compare_typebounds(const apol_policy_t * p, const qpol_typebounds_t * typebounds, const char *name, unsigned int flags, ++ regex_t ** typebounds_regex) ++{ ++ const char *typebounds_parent_name = NULL; ++ const char *typebounds_child_name = NULL; ++ ++ int compval = 0; ++ ++ qpol_typebounds_get_parent_name(p->p, typebounds, &typebounds_parent_name); ++ qpol_typebounds_get_child_name(p->p, typebounds, &typebounds_child_name); ++ ++ if (typebounds_parent_name != NULL) { ++ compval = apol_compare(p, typebounds_parent_name, name, flags, typebounds_regex); ++ } ++ if (typebounds_child_name != NULL && compval == 0) { ++ compval = apol_compare(p, typebounds_child_name, name, flags, typebounds_regex); ++ return compval; ++ } else { ++ return compval; ++ } ++ return 0; ++} ++ + int apol_compare_cond_expr(const apol_policy_t * p, const qpol_cond_t * cond, const char *name, unsigned int flags, + regex_t ** bool_regex) + { +diff --git a/libapol/src/policy.c b/libapol/src/policy.c +index 95ab7cd..f253db9 100644 +--- a/libapol/src/policy.c ++++ b/libapol/src/policy.c +@@ -155,6 +155,15 @@ int apol_policy_get_policy_type(const apol_policy_t * policy) + return policy->policy_type; + } + ++int apol_policy_get_policy_handle_unknown(const apol_policy_t * p) ++{ ++ unsigned int handle_unknown; ++ if (qpol_policy_get_policy_handle_unknown(p->p, &handle_unknown) < 0) { ++ return -1; ++ } ++ return handle_unknown; ++} ++ + qpol_policy_t *apol_policy_get_qpol(const apol_policy_t * policy) + { + if (policy == NULL) { +diff --git a/libapol/swig/apol.i b/libapol/swig/apol.i +index ae1262d..8a4a195 100644 +--- a/libapol/swig/apol.i ++++ b/libapol/swig/apol.i +@@ -256,7 +256,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); + } + %} + %extend apol_ip_t { +- apol_ip_t(const char *str) { ++ apol_ip(const char *str) { + apol_ip_t *ip = NULL; + BEGIN_EXCEPTION + ip = calloc(1, sizeof(*ip)); +@@ -274,7 +274,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); + fail: + return ip; + }; +- ~apol_ip_t() { ++ ~apol_ip() { + free(self); + }; + int get_protocol() { +@@ -303,31 +303,35 @@ char *apol_file_find_path(const char *file_name); + %} + typedef struct apol_vector {} apol_vector_t; + %extend apol_vector_t { +- apol_vector_t() { ++ apol_vector() { + return apol_vector_create(NULL); + }; +- apol_vector_t(qpol_iterator_t *iter) { ++ apol_vector(qpol_iterator_t *iter) { + return apol_vector_create_from_iter(iter, NULL); + }; +- apol_vector_t(apol_vector_t *v) { ++ apol_vector(apol_vector_t *v) { + return apol_vector_create_from_vector(v, NULL, NULL, NULL); + }; +- apol_vector_t(apol_vector_t *a, apol_vector_t *b) { ++ apol_vector(apol_vector_t *a, apol_vector_t *b) { + return apol_vector_create_from_intersection(a, b, NULL, NULL); + }; +- size_t get_size() { ++ %rename(get_size) wrap_get_size; ++ size_t wrap_get_size() { + return apol_vector_get_size(self); + }; +- size_t get_capacity() { ++ %rename(get_capacity) wrap_get_capacity; ++ size_t wrap_get_capacity() { + return apol_vector_get_capacity(self); + }; +- void *get_element(size_t i) { ++ %rename(get_element) wrap_get_element; ++ void *wrap_get_element(size_t i) { + return apol_vector_get_element(self, i); + }; +- ~apol_vector_t() { ++ ~apol_vector() { + apol_vector_destroy(&self); + }; +- void append(void *x) { ++ %rename(append) wrap_append; ++ void wrap_append(void *x) { + BEGIN_EXCEPTION + if (apol_vector_append(self, x)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -336,7 +340,8 @@ typedef struct apol_vector {} apol_vector_t; + fail: + return; + }; +- void append_unique(void *x) { ++ %rename(append_unique) wrap_append_unique; ++ void wrap_append_unique(void *x) { + BEGIN_EXCEPTION + if (apol_vector_append_unique(self, x, NULL, NULL)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -345,7 +350,8 @@ typedef struct apol_vector {} apol_vector_t; + fail: + return; + }; +- void cat(apol_vector_t *src) { ++ %rename(cat) wrap_cat; ++ void wrap_cat(apol_vector_t *src) { + BEGIN_EXCEPTION + if (apol_vector_cat(self, src)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -354,7 +360,8 @@ typedef struct apol_vector {} apol_vector_t; + fail: + return; + }; +- void remove(size_t idx) { ++ %rename(remove) wrap_remove; ++ void wrap_remove(size_t idx) { + BEGIN_EXCEPTION + if (apol_vector_remove(self, idx)) { + SWIG_exception(SWIG_RuntimeError, "Error removing vector element"); +@@ -363,10 +370,12 @@ typedef struct apol_vector {} apol_vector_t; + fail: + return; + }; +- void sort() { ++ %rename(sort) wrap_sort; ++ void wrap_sort() { + apol_vector_sort(self, NULL, NULL); + }; +- void sort_uniquify() { ++ %rename(sort_uniquify) wrap_sort_uniquify; ++ void wrap_sort_uniquify() { + apol_vector_sort_uniquify(self, NULL, NULL); + }; + }; +@@ -379,13 +388,13 @@ typedef struct apol_vector {} apol_vector_t; + %} + typedef struct apol_string_vector {} apol_string_vector_t; + %extend apol_string_vector_t { +- apol_string_vector_t() { ++ apol_string_vector() { + return (apol_string_vector_t*)apol_vector_create(free); + }; +- apol_string_vector_t(apol_string_vector_t *v) { ++ apol_string_vector(apol_string_vector_t *v) { + return (apol_string_vector_t*)apol_vector_create_from_vector((apol_vector_t*)v, apol_str_strdup, NULL, free); + }; +- apol_string_vector_t(apol_string_vector_t *a, apol_string_vector_t *b) { ++ apol_string_vector(apol_string_vector_t *a, apol_string_vector_t *b) { + return (apol_string_vector_t*)apol_vector_create_from_intersection((apol_vector_t*)a, (apol_vector_t*)b, apol_str_strcmp, NULL); + }; + size_t get_size() { +@@ -397,7 +406,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; + char *get_element(size_t i) { + return (char*)apol_vector_get_element((apol_vector_t*)self, i); + }; +- ~apol_string_vector_t() { ++ ~apol_string_vector() { + apol_vector_destroy((apol_vector_t**)&self); + }; + size_t get_index(char *str) { +@@ -462,7 +471,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; + } apol_policy_path_type_e; + typedef struct apol_policy_path {} apol_policy_path_t; + %extend apol_policy_path_t { +- apol_policy_path_t(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { ++ apol_policy_path(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { + apol_policy_path_t *p; + BEGIN_EXCEPTION + if ((p = apol_policy_path_create(type, primary, (apol_vector_t*)modules)) == NULL) { +@@ -472,7 +481,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; + fail: + return p; + }; +- apol_policy_path_t(char *path) { ++ apol_policy_path(char *path) { + apol_policy_path_t *p; + BEGIN_EXCEPTION + if ((p = apol_policy_path_create_from_file(path)) == NULL) { +@@ -482,7 +491,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; + fail: + return p; + }; +- apol_policy_path_t(char *str, int unused) { ++ apol_policy_path(char *str, int unused) { + apol_policy_path_t *p; + BEGIN_EXCEPTION + if ((p = apol_policy_path_create_from_string(str)) == NULL) { +@@ -492,7 +501,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; + fail: + return p; + }; +- apol_policy_path_t(apol_policy_path_t *in) { ++ apol_policy_path(apol_policy_path_t *in) { + apol_policy_path_t *p; + BEGIN_EXCEPTION + if ((p = apol_policy_path_create_from_policy_path(in)) == NULL) { +@@ -502,20 +511,24 @@ typedef struct apol_policy_path {} apol_policy_path_t; + fail: + return p; + }; +- ~apol_policy_path_t() { ++ ~apol_policy_path() { + apol_policy_path_destroy(&self); + }; +- apol_policy_path_type_e get_type() { ++ %rename(get_type) wrap_get_type; ++ apol_policy_path_type_e wrap_get_type() { + return apol_policy_path_get_type(self); + }; +- const char *get_primary() { ++ %rename(get_primary) wrap_get_primary; ++ const char *wrap_get_primary() { + return apol_policy_path_get_primary(self); + }; +- const apol_string_vector_t *get_modules() { ++ %rename(get_modules) wrap_get_modules; ++ const apol_string_vector_t *wrap_get_modules() { + return (apol_string_vector_t*)apol_policy_path_get_modules(self); + }; + %newobject to_string(); +- char *to_string() { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string() { + char *str; + BEGIN_EXCEPTION + str = apol_policy_path_to_string(self); +@@ -526,7 +539,8 @@ typedef struct apol_policy_path {} apol_policy_path_t; + fail: + return str; + }; +- void to_file(char *path) { ++ %rename(to_file) wrap_to_file; ++ void wrap_to_file(char *path) { + BEGIN_EXCEPTION + if (apol_policy_path_to_file(self, path)) { + SWIG_exception(SWIG_RuntimeError, "Input/outpet error"); +@@ -549,7 +563,7 @@ typedef struct apol_policy {} apol_policy_t; + #define APOL_PERMMAP_BOTH (APOL_PERMMAP_READ | APOL_PERMMAP_WRITE) + #define APOL_PERMMAP_NONE 0x10 + %extend apol_policy_t { +- apol_policy_t(apol_policy_path_t *path, int options = 0) { ++ apol_policy(apol_policy_path_t *path, int options = 0) { + apol_policy_t *p; + BEGIN_EXCEPTION + p = apol_policy_create_from_policy_path(path, options, apol_swig_message_callback, apol_swig_message_callback_arg); +@@ -564,20 +578,30 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return p; + }; +- ~apol_policy_t() { ++ ~apol_policy() { + apol_policy_destroy(&self); + }; +- int get_policy_type() { ++ %rename(get_policy_type) wrap_get_policy_type; ++ int wrap_get_policy_type() { + return apol_policy_get_policy_type(self); + }; +- qpol_policy_t *get_qpol() { ++ ++ %rename(get_policy_handle_unknown) wrap_get_policy_handle_unknown; ++ int wrap_get_policy_handle_unknown() { ++ return apol_policy_get_policy_handle_unknown(self); ++ }; ++ ++ %rename(get_qpol) wrap_get_qpol; ++ qpol_policy_t *wrap_get_qpol() { + return apol_policy_get_qpol(self); + }; +- int is_mls() { ++ %rename(is_mls) wrap_is_mls; ++ int wrap_is_mls() { + return apol_policy_is_mls(self); + }; + %newobject get_version_type_mls_str(); +- char *get_version_type_mls_str() { ++ %rename(get_version_type_mls_str) wrap_get_version_type_mls_str; ++ char *wrap_get_version_type_mls_str() { + char *str; + BEGIN_EXCEPTION + str = apol_policy_get_version_type_mls_str(self); +@@ -588,7 +612,8 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return str; + }; +- void open_permmap(const char *path) { ++ %rename(open_permmap) wrap_open_permmap; ++ void wrap_open_permmap(const char *path) { + BEGIN_EXCEPTION + if (apol_policy_open_permmap(self, path) < 0) { + SWIG_exception(SWIG_RuntimeError, "Error loading permission map"); +@@ -597,7 +622,8 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return; + }; +- void save_permmap(const char *path) { ++ %rename(save_permmap) wrap_save_permmap; ++ void wrap_save_permmap(const char *path) { + BEGIN_EXCEPTION + if (apol_policy_save_permmap(self, path)) { + SWIG_exception(SWIG_RuntimeError, "Could not save permission map"); +@@ -626,7 +652,8 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return dir; + }; +- void set_permmap(const char *class_name, const char *perm_name, int direction, int weight) { ++ %rename(set_permmap) wrap_set_permmap; ++ void wrap_set_permmap(const char *class_name, const char *perm_name, int direction, int weight) { + BEGIN_EXCEPTION + if (apol_policy_set_permmap(self, class_name, perm_name, direction, weight)) { + SWIG_exception(SWIG_RuntimeError, "Could not set permission mapping"); +@@ -635,7 +662,8 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return; + }; +- void build_domain_trans_table() { ++ %rename(build_domain_trans_table) wrap_build_domain_trans_table; ++ void wrap_build_domain_trans_table() { + BEGIN_EXCEPTION + if (apol_policy_build_domain_trans_table(self)) { + SWIG_exception(SWIG_RuntimeError, "Could not build domain transition table"); +@@ -644,7 +672,8 @@ typedef struct apol_policy {} apol_policy_t; + fail: + return; + }; +- void reset_domain_trans_table() { ++ %rename(reset_domain_trans_table) wrap_reset_domain_trans_table; ++ void wrap_reset_domain_trans_table() { + apol_policy_reset_domain_trans_table(self); + } + }; +@@ -652,7 +681,7 @@ typedef struct apol_policy {} apol_policy_t; + /* apol type query */ + typedef struct apol_type_query {} apol_type_query_t; + %extend apol_type_query_t { +- apol_type_query_t() { ++ apol_type_query() { + apol_type_query_t *tq; + BEGIN_EXCEPTION + tq = apol_type_query_create(); +@@ -663,7 +692,7 @@ typedef struct apol_type_query {} apol_type_query_t; + fail: + return tq; + }; +- ~apol_type_query_t() { ++ ~apol_type_query() { + apol_type_query_destroy(&self); + }; + %newobject run(apol_policy_t *); +@@ -677,7 +706,8 @@ typedef struct apol_type_query {} apol_type_query_t; + fail: + return v; + }; +- void set_type(apol_policy_t *p, char *name) { ++ %rename(set_type) wrap_set_type; ++ void wrap_set_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_type_query_set_type(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -686,7 +716,8 @@ typedef struct apol_type_query {} apol_type_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_type_query_set_regex(p, self, regex); + }; + }; +@@ -694,7 +725,7 @@ typedef struct apol_type_query {} apol_type_query_t; + /* apol attribute query */ + typedef struct apol_attr_query {} apol_attr_query_t; + %extend apol_attr_query_t { +- apol_attr_query_t() { ++ apol_attr_query() { + apol_attr_query_t *aq; + BEGIN_EXCEPTION + aq = apol_attr_query_create(); +@@ -705,7 +736,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; + fail: + return aq; + }; +- ~apol_attr_query_t() { ++ ~apol_attr_query() { + apol_attr_query_destroy(&self); + }; + %newobject run(apol_policy_t *); +@@ -719,7 +750,8 @@ typedef struct apol_attr_query {} apol_attr_query_t; + fail: + return v; + }; +- void set_attr(apol_policy_t *p, char *name) { ++ %rename(set_attr) wrap_set_attr; ++ void wrap_set_attr(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_attr_query_set_attr(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -728,7 +760,8 @@ typedef struct apol_attr_query {} apol_attr_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_attr_query_set_regex(p, self, regex); + }; + }; +@@ -736,7 +769,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; + /* apol role query */ + typedef struct apol_role_query {} apol_role_query_t; + %extend apol_role_query_t { +- apol_role_query_t() { ++ apol_role_query() { + apol_role_query_t *rq; + BEGIN_EXCEPTION + rq = apol_role_query_create(); +@@ -747,7 +780,7 @@ typedef struct apol_role_query {} apol_role_query_t; + fail: + return rq; + }; +- ~apol_role_query_t() { ++ ~apol_role_query() { + apol_role_query_destroy(&self); + }; + %newobject run(apol_policy_t *); +@@ -761,7 +794,8 @@ typedef struct apol_role_query {} apol_role_query_t; + fail: + return v; + }; +- void set_role(apol_policy_t *p, char *name) { ++ %rename(set_role) wrap_set_role; ++ void wrap_set_role(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_query_set_role(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -770,7 +804,8 @@ typedef struct apol_role_query {} apol_role_query_t; + fail: + return; + }; +- void set_type(apol_policy_t *p, char *name) { ++ %rename(set_type) wrap_set_type; ++ void wrap_set_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_query_set_type(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -779,7 +814,8 @@ typedef struct apol_role_query {} apol_role_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_role_query_set_regex(p, self, regex); + }; + }; +@@ -788,7 +824,7 @@ int apol_role_has_type(apol_policy_t * p, qpol_role_t * r, qpol_type_t * t); + /* apol class query */ + typedef struct apol_class_query {} apol_class_query_t; + %extend apol_class_query_t { +- apol_class_query_t() { ++ apol_class_query() { + apol_class_query_t *cq; + BEGIN_EXCEPTION + cq = apol_class_query_create(); +@@ -799,7 +835,7 @@ typedef struct apol_class_query {} apol_class_query_t; + fail: + return cq; + }; +- ~apol_class_query_t() { ++ ~apol_class_query() { + apol_class_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -813,7 +849,8 @@ typedef struct apol_class_query {} apol_class_query_t; + fail: + return v; + }; +- void set_class(apol_policy_t *p, char *name) { ++ %rename(set_class) wrap_set_class; ++ void wrap_set_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_class_query_set_class(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -822,7 +859,8 @@ typedef struct apol_class_query {} apol_class_query_t; + fail: + return; + }; +- void set_common(apol_policy_t *p, char *name) { ++ %rename(set_common) wrap_set_common; ++ void wrap_set_common(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_class_query_set_common(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -831,7 +869,8 @@ typedef struct apol_class_query {} apol_class_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_class_query_set_regex(p, self, regex); + }; + }; +@@ -839,7 +878,7 @@ typedef struct apol_class_query {} apol_class_query_t; + /* apol common query */ + typedef struct apol_common_query {} apol_common_query_t; + %extend apol_common_query_t { +- apol_common_query_t() { ++ apol_common_query() { + apol_common_query_t *cq; + BEGIN_EXCEPTION + cq = apol_common_query_create(); +@@ -850,7 +889,7 @@ typedef struct apol_common_query {} apol_common_query_t; + fail: + return cq; + }; +- ~apol_common_query_t() { ++ ~apol_common_query() { + apol_common_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -864,7 +903,8 @@ typedef struct apol_common_query {} apol_common_query_t; + fail: + return v; + }; +- void set_common(apol_policy_t *p, char *name) { ++ %rename(set_common) wrap_set_common; ++ void wrap_set_common(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_common_query_set_common(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -873,7 +913,8 @@ typedef struct apol_common_query {} apol_common_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_common_query_set_regex(p, self, regex); + }; + }; +@@ -881,7 +922,7 @@ typedef struct apol_common_query {} apol_common_query_t; + /* apol perm query */ + typedef struct apol_perm_query {} apol_perm_query_t; + %extend apol_perm_query_t { +- apol_perm_query_t() { ++ apol_perm_query() { + apol_perm_query_t *pq; + BEGIN_EXCEPTION + pq = apol_perm_query_create(); +@@ -892,7 +933,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; + fail: + return pq; + }; +- ~apol_perm_query_t() { ++ ~apol_perm_query() { + apol_perm_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -906,7 +947,8 @@ typedef struct apol_perm_query {} apol_perm_query_t; + fail: + return (apol_string_vector_t*)v; + }; +- void set_perm(apol_policy_t *p, char *name) { ++ %rename(set_perm) wrap_set_perm; ++ void wrap_set_perm(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_perm_query_set_perm(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -915,7 +957,8 @@ typedef struct apol_perm_query {} apol_perm_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_perm_query_set_regex(p, self, regex); + }; + }; +@@ -923,7 +966,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; + /* apol bool query */ + typedef struct apol_bool_query {} apol_bool_query_t; + %extend apol_bool_query_t { +- apol_bool_query_t() { ++ apol_bool_query() { + apol_bool_query_t *bq; + BEGIN_EXCEPTION + bq = apol_bool_query_create(); +@@ -934,7 +977,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; + fail: + return bq; + }; +- ~apol_bool_query_t() { ++ ~apol_bool_query() { + apol_bool_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -948,7 +991,8 @@ typedef struct apol_bool_query {} apol_bool_query_t; + fail: + return v; + }; +- void set_bool(apol_policy_t *p, char *name) { ++ %rename(set_bool) wrap_set_bool; ++ void wrap_set_bool(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_bool_query_set_bool(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -957,7 +1001,8 @@ typedef struct apol_bool_query {} apol_bool_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_bool_query_set_regex(p, self, regex); + }; + }; +@@ -965,7 +1010,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; + /* apol mls level */ + typedef struct apol_mls_level {} apol_mls_level_t; + %extend apol_mls_level_t { +- apol_mls_level_t() { ++ apol_mls_level() { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create(); +@@ -976,7 +1021,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- apol_mls_level_t(apol_mls_level_t *in) { ++ apol_mls_level(apol_mls_level_t *in) { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create_from_mls_level(in); +@@ -987,7 +1032,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- apol_mls_level_t(apol_policy_t *p, const char *str) { ++ apol_mls_level(apol_policy_t *p, const char *str) { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create_from_string(p, str); +@@ -998,7 +1043,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- apol_mls_level_t(const char *str) { ++ apol_mls_level(const char *str) { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create_from_literal(str); +@@ -1009,7 +1054,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- apol_mls_level_t(apol_policy_t *p, qpol_mls_level_t *qml) { ++ apol_mls_level(apol_policy_t *p, qpol_mls_level_t *qml) { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create_from_qpol_mls_level(p, qml); +@@ -1020,7 +1065,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- apol_mls_level_t(apol_policy_t *p, qpol_level_t *ql) { ++ apol_mls_level(apol_policy_t *p, qpol_level_t *ql) { + apol_mls_level_t *aml; + BEGIN_EXCEPTION + aml = apol_mls_level_create_from_qpol_level_datum(p, ql); +@@ -1031,10 +1076,11 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return aml; + }; +- ~apol_mls_level_t() { ++ ~apol_mls_level() { + apol_mls_level_destroy(&self); + }; +- void set_sens(apol_policy_t *p, char *sens) { ++ %rename(set_sens) wrap_set_sens; ++ void wrap_set_sens(apol_policy_t *p, char *sens) { + BEGIN_EXCEPTION + if (apol_mls_level_set_sens(p, self, sens)) { + SWIG_exception(SWIG_RuntimeError, "Could not set level sensitivity"); +@@ -1043,10 +1089,12 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return; + }; +- const char *get_sens() { ++ %rename(get_sens) wrap_get_sens; ++ const char *wrap_get_sens() { + return apol_mls_level_get_sens(self); + }; +- void append_cats(apol_policy_t *p, char *cats) { ++ %rename(append_cats) wrap_append_cats; ++ void wrap_append_cats(apol_policy_t *p, char *cats) { + BEGIN_EXCEPTION + if (apol_mls_level_append_cats(p, self, cats)) { + SWIG_exception(SWIG_RuntimeError, "Could not append level category"); +@@ -1055,10 +1103,12 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return; + }; +- const apol_string_vector_t *get_cats() { ++ %rename(get_cats) wrap_get_cats; ++ const apol_string_vector_t *wrap_get_cats() { + return (apol_string_vector_t *) apol_mls_level_get_cats(self); + }; +- int validate(apol_policy_t *p) { ++ %rename(validate) wrap_validate; ++ int wrap_validate(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_mls_level_validate(p, self); +@@ -1070,7 +1120,8 @@ typedef struct apol_mls_level {} apol_mls_level_t; + return ret; + } + %newobject render(apol_policy_t*); +- char *render(apol_policy_t *p) { ++ %rename(render) wrap_render; ++ char *wrap_render(apol_policy_t *p) { + char *str; + BEGIN_EXCEPTION + str = apol_mls_level_render(p, self); +@@ -1081,7 +1132,8 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return str; + }; +- int convert(apol_policy_t *p) { ++ %rename(convert) wrap_convert; ++ int wrap_convert(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_mls_level_convert(p, self); +@@ -1092,7 +1144,8 @@ typedef struct apol_mls_level {} apol_mls_level_t; + fail: + return ret; + } +- int is_literal() { ++ %rename(is_literal) wrap_is_literal; ++ int wrap_is_literal() { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_mls_level_is_literal(self); +@@ -1128,7 +1181,7 @@ int apol_mls_cats_compare(apol_policy_t * p, const char *cat1, const char *cat2) + #endif + typedef struct apol_mls_range {} apol_mls_range_t; + %extend apol_mls_range_t { +- apol_mls_range_t() { ++ apol_mls_range() { + apol_mls_range_t *amr; + BEGIN_EXCEPTION + amr = apol_mls_range_create(); +@@ -1139,7 +1192,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return amr; + }; +- apol_mls_range_t(apol_mls_range_t *in) { ++ apol_mls_range(apol_mls_range_t *in) { + apol_mls_range_t *amr; + BEGIN_EXCEPTION + amr = apol_mls_range_create_from_mls_range(in); +@@ -1150,7 +1203,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return amr; + }; +- apol_mls_range_t(apol_policy_t *p, const char *s) { ++ apol_mls_range(apol_policy_t *p, const char *s) { + apol_mls_range_t *amr; + BEGIN_EXCEPTION + amr = apol_mls_range_create_from_string(p, s); +@@ -1161,7 +1214,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return amr; + }; +- apol_mls_range_t(const char *s) { ++ apol_mls_range(const char *s) { + apol_mls_range_t *amr; + BEGIN_EXCEPTION + amr = apol_mls_range_create_from_literal(s); +@@ -1172,7 +1225,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return amr; + }; +- apol_mls_range_t(apol_policy_t *p, qpol_mls_range_t *in) { ++ apol_mls_range(apol_policy_t *p, qpol_mls_range_t *in) { + apol_mls_range_t *amr; + BEGIN_EXCEPTION + amr = apol_mls_range_create_from_qpol_mls_range(p, in); +@@ -1183,10 +1236,11 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return amr; + }; +- ~apol_mls_range_t() { ++ ~apol_mls_range() { + apol_mls_range_destroy(&self); + }; +- void set_low(apol_policy_t *p, apol_mls_level_t *lvl) { ++ %rename(set_low) wrap_set_low; ++ void wrap_set_low(apol_policy_t *p, apol_mls_level_t *lvl) { + BEGIN_EXCEPTION + if (apol_mls_range_set_low(p, self, lvl)) { + SWIG_exception(SWIG_RuntimeError, "Could not set low level"); +@@ -1195,7 +1249,8 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return; + }; +- void set_high(apol_policy_t *p, apol_mls_level_t *lvl) { ++ %rename(set_high) wrap_set_high; ++ void wrap_set_high(apol_policy_t *p, apol_mls_level_t *lvl) { + BEGIN_EXCEPTION + if (apol_mls_range_set_high(p, self, lvl)) { + SWIG_exception(SWIG_RuntimeError, "Could not set high level"); +@@ -1204,14 +1259,17 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return; + }; +- const apol_mls_level_t *get_low() { ++ %rename(get_low) wrap_get_low; ++ const apol_mls_level_t *wrap_get_low() { + return apol_mls_range_get_low(self); + } +- const apol_mls_level_t *get_high() { ++ %rename(get_high) wrap_get_high; ++ const apol_mls_level_t *wrap_get_high() { + return apol_mls_range_get_high(self); + } + %newobject render(apol_policy_t*); +- char *render(apol_policy_t *p) { ++ %rename(render) wrap_render; ++ char *wrap_render(apol_policy_t *p) { + char *str; + BEGIN_EXCEPTION + str = apol_mls_range_render(p, self); +@@ -1223,7 +1281,8 @@ typedef struct apol_mls_range {} apol_mls_range_t; + return str; + }; + %newobject get_levels(apol_policy_t*); +- apol_vector_t *get_levels(apol_policy_t *p) { ++ %rename(get_levels) wrap_get_levels; ++ apol_vector_t *wrap_get_levels(apol_policy_t *p) { + apol_vector_t *v; + BEGIN_EXCEPTION + v = apol_mls_range_get_levels(p, self); +@@ -1234,7 +1293,8 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return v; + }; +- int validate(apol_policy_t *p) { ++ %rename(validate) wrap_validate; ++ int wrap_validate(apol_policy_t *p) { + int ret = apol_mls_range_validate(p, self); + BEGIN_EXCEPTION + if (ret < 0) { +@@ -1244,7 +1304,8 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return ret; + } +- int is_literal() { ++ %rename(is_literal) wrap_is_literal; ++ int wrap_is_literal() { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_mls_range_is_literal(self); +@@ -1255,7 +1316,8 @@ typedef struct apol_mls_range {} apol_mls_range_t; + fail: + return ret; + } +- int convert(apol_policy_t *p) { ++ %rename(convert) wrap_convert; ++ int wrap_convert(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_mls_range_convert(p, self); +@@ -1278,7 +1340,7 @@ int apol_mls_range_contain_subrange(apol_policy_t * p, const apol_mls_range_t * + /* apol level query */ + typedef struct apol_level_query {} apol_level_query_t; + %extend apol_level_query_t { +- apol_level_query_t() { ++ apol_level_query() { + apol_level_query_t * alq; + BEGIN_EXCEPTION + alq = apol_level_query_create(); +@@ -1289,7 +1351,7 @@ typedef struct apol_level_query {} apol_level_query_t; + fail: + return alq; + }; +- ~apol_level_query_t() { ++ ~apol_level_query() { + apol_level_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1303,7 +1365,8 @@ typedef struct apol_level_query {} apol_level_query_t; + fail: + return v; + }; +- void set_sens(apol_policy_t *p, char *name) { ++ %rename(set_sens) wrap_set_sens; ++ void wrap_set_sens(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_level_query_set_sens(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1312,7 +1375,8 @@ typedef struct apol_level_query {} apol_level_query_t; + fail: + return; + }; +- void set_cat(apol_policy_t *p, char *name) { ++ %rename(set_cat) wrap_set_cat; ++ void wrap_set_cat(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_level_query_set_cat(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1321,7 +1385,8 @@ typedef struct apol_level_query {} apol_level_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_level_query_set_regex(p, self, regex); + }; + }; +@@ -1329,7 +1394,7 @@ typedef struct apol_level_query {} apol_level_query_t; + /* apol cat query */ + typedef struct apol_cat_query {} apol_cat_query_t; + %extend apol_cat_query_t { +- apol_cat_query_t() { ++ apol_cat_query() { + apol_cat_query_t * acq; + BEGIN_EXCEPTION + acq = apol_cat_query_create(); +@@ -1340,7 +1405,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; + fail: + return acq; + }; +- ~apol_cat_query_t() { ++ ~apol_cat_query() { + apol_cat_query_destroy(&self); + }; + %newobject run(apol_policy_t *); +@@ -1354,7 +1419,8 @@ typedef struct apol_cat_query {} apol_cat_query_t; + fail: + return v; + }; +- void set_cat(apol_policy_t *p, char *name) { ++ %rename(set_cat) wrap_set_cat; ++ void wrap_set_cat(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_cat_query_set_cat(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1363,7 +1429,8 @@ typedef struct apol_cat_query {} apol_cat_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_cat_query_set_regex(p, self, regex); + }; + }; +@@ -1379,7 +1446,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; + #endif + typedef struct apol_user_query {} apol_user_query_t; + %extend apol_user_query_t { +- apol_user_query_t() { ++ apol_user_query() { + apol_user_query_t *auq; + BEGIN_EXCEPTION + auq = apol_user_query_create(); +@@ -1390,7 +1457,7 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return auq; + }; +- ~apol_user_query_t() { ++ ~apol_user_query() { + apol_user_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1404,7 +1471,8 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return v; + }; +- void set_user(apol_policy_t *p, char *name) { ++ %rename(set_user) wrap_set_user; ++ void wrap_set_user(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_user_query_set_user(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1413,7 +1481,8 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return; + }; +- void set_role(apol_policy_t *p, char *name) { ++ %rename(set_role) wrap_set_role; ++ void wrap_set_role(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_user_query_set_role(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1422,7 +1491,8 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return; + }; +- void set_default_level(apol_policy_t *p, apol_mls_level_t *lvl) { ++ %rename(set_default_level) wrap_set_default_level; ++ void wrap_set_default_level(apol_policy_t *p, apol_mls_level_t *lvl) { + BEGIN_EXCEPTION + if (apol_user_query_set_default_level(p, self, lvl)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1431,7 +1501,8 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return; + }; +- void set_range(apol_policy_t *p, apol_mls_range_t *rng, int range_match) { ++ %rename(set_range) wrap_set_range; ++ void wrap_set_range(apol_policy_t *p, apol_mls_range_t *rng, int range_match) { + BEGIN_EXCEPTION + if (apol_user_query_set_range(p, self, rng, range_match)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1440,7 +1511,8 @@ typedef struct apol_user_query {} apol_user_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_user_query_set_regex(p, self, regex); + }; + }; +@@ -1448,7 +1520,7 @@ typedef struct apol_user_query {} apol_user_query_t; + /* apol context */ + typedef struct apol_context {} apol_context_t; + %extend apol_context_t { +- apol_context_t() { ++ apol_context() { + apol_context_t *ctx; + BEGIN_EXCEPTION + ctx = apol_context_create(); +@@ -1459,7 +1531,7 @@ typedef struct apol_context {} apol_context_t; + fail: + return ctx; + }; +- apol_context_t(apol_policy_t *p, qpol_context_t *in) { ++ apol_context(apol_policy_t *p, qpol_context_t *in) { + apol_context_t *ctx; + BEGIN_EXCEPTION + ctx = apol_context_create_from_qpol_context(p, in); +@@ -1470,7 +1542,7 @@ typedef struct apol_context {} apol_context_t; + fail: + return ctx; + }; +- apol_context_t(const char *str) { ++ apol_context(const char *str) { + apol_context_t *ctx; + BEGIN_EXCEPTION + ctx = apol_context_create_from_literal(str); +@@ -1481,10 +1553,11 @@ typedef struct apol_context {} apol_context_t; + fail: + return ctx; + }; +- ~apol_context_t() { ++ ~apol_context() { + apol_context_destroy(&self); + }; +- void set_user(apol_policy_t *p, char *name) { ++ %rename(set_user) wrap_set_user; ++ void wrap_set_user(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_context_set_user(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1493,10 +1566,12 @@ typedef struct apol_context {} apol_context_t; + fail: + return; + }; +- const char *get_user() { ++ %rename(get_user) wrap_get_user; ++ const char *wrap_get_user() { + return apol_context_get_user(self); + }; +- void set_role(apol_policy_t *p, char *name) { ++ %rename(set_role) wrap_set_role; ++ void wrap_set_role(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_context_set_role(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1505,10 +1580,12 @@ typedef struct apol_context {} apol_context_t; + fail: + return; + }; +- const char *get_role() { ++ %rename(get_role) wrap_get_role; ++ const char *wrap_get_role() { + return apol_context_get_role(self); + }; +- void set_type(apol_policy_t *p, char *name) { ++ %rename(set_type) wrap_set_type; ++ void wrap_set_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_context_set_type(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1517,10 +1594,12 @@ typedef struct apol_context {} apol_context_t; + fail: + return; + }; +- const char *get_type() { ++ %rename(get_type) wrap_get_type; ++ const char *wrap_get_type() { + return apol_context_get_type(self); + }; +- void set_range(apol_policy_t *p, apol_mls_range_t *rng) { ++ %rename(set_range) wrap_set_range; ++ void wrap_set_range(apol_policy_t *p, apol_mls_range_t *rng) { + BEGIN_EXCEPTION + if (apol_context_set_range(p, self, rng)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1529,10 +1608,12 @@ typedef struct apol_context {} apol_context_t; + fail: + return; + }; +- const apol_mls_range_t *get_range() { ++ %rename(get_range) wrap_get_range; ++ const apol_mls_range_t *wrap_get_range() { + return apol_context_get_range(self); + }; +- int validate(apol_policy_t *p) { ++ %rename(validate) wrap_validate; ++ int wrap_validate(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_context_validate(p, self); +@@ -1543,7 +1624,8 @@ typedef struct apol_context {} apol_context_t; + fail: + return ret; + } +- int validate_partial(apol_policy_t *p) { ++ %rename(validate_partial) wrap_validate_partial; ++ int wrap_validate_partial(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_context_validate_partial(p, self); +@@ -1555,7 +1637,8 @@ typedef struct apol_context {} apol_context_t; + return ret; + } + %newobject render(apol_policy_t*); +- char *render(apol_policy_t *p) { ++ %rename(render) wrap_render; ++ char *wrap_render(apol_policy_t *p) { + char *str; + BEGIN_EXCEPTION + str = apol_context_render(p, self); +@@ -1566,7 +1649,8 @@ typedef struct apol_context {} apol_context_t; + fail: + return str; + }; +- int convert(apol_policy_t *p) { ++ %rename(convert) wrap_convert; ++ int wrap_convert(apol_policy_t *p) { + int ret = -1; + BEGIN_EXCEPTION + ret = apol_context_convert(p, self); +@@ -1583,7 +1667,7 @@ int apol_context_compare(apol_policy_t * p, apol_context_t * target, apol_contex + /* apol constraint query */ + typedef struct apol_constraint_query {} apol_constraint_query_t; + %extend apol_constraint_query_t { +- apol_constraint_query_t() { ++ apol_constraint_query() { + apol_constraint_query_t *acq; + BEGIN_EXCEPTION + acq = apol_constraint_query_create(); +@@ -1594,7 +1678,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; + fail: + return acq; + }; +- ~apol_constraint_query_t() { ++ ~apol_constraint_query() { + apol_constraint_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1608,7 +1692,8 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; + fail: + return v; + }; +- void set_class(apol_policy_t *p, char *name) { ++ %rename(set_class) wrap_set_class; ++ void wrap_set_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_constraint_query_set_class(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1617,7 +1702,8 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; + fail: + return; + } +- void set_perm(apol_policy_t *p, char *name) { ++ %rename(set_perm) wrap_set_perm; ++ void wrap_set_perm(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_constraint_query_set_perm(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1626,7 +1712,8 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; + fail: + return; + } +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_constraint_query_set_regex(p, self, regex); + }; + }; +@@ -1634,7 +1721,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; + /* apol validatetrans query */ + typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; + %extend apol_validatetrans_query_t { +- apol_validatetrans_query_t() { ++ apol_validatetrans_query() { + apol_validatetrans_query_t *avq; + BEGIN_EXCEPTION + avq = apol_validatetrans_query_create(); +@@ -1645,7 +1732,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; + fail: + return avq; + }; +- ~apol_validatetrans_query_t() { ++ ~apol_validatetrans_query() { + apol_validatetrans_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1659,7 +1746,8 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; + fail: + return v; + }; +- void set_class(apol_policy_t *p, char *name) { ++ %rename(set_class) wrap_set_class; ++ void wrap_set_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_validatetrans_query_set_class(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1668,7 +1756,8 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; + fail: + return; + } +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_validatetrans_query_set_regex(p, self, regex); + }; + }; +@@ -1684,7 +1773,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; + #endif + typedef struct apol_genfscon_query {} apol_genfscon_query_t; + %extend apol_genfscon_query_t { +- apol_genfscon_query_t() { ++ apol_genfscon_query() { + apol_genfscon_query_t *agq; + BEGIN_EXCEPTION + agq = apol_genfscon_query_create(); +@@ -1695,7 +1784,7 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; + fail: + return agq; + }; +- ~apol_genfscon_query_t() { ++ ~apol_genfscon_query() { + apol_genfscon_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1709,7 +1798,8 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; + fail: + return v; + }; +- void set_filesystem(apol_policy_t *p, char *fs) { ++ %rename(set_filesystem) wrap_set_filesystem; ++ void wrap_set_filesystem(apol_policy_t *p, char *fs) { + BEGIN_EXCEPTION + if (apol_genfscon_query_set_filesystem(p, self, fs)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1718,7 +1808,8 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; + fail: + return; + }; +- void set_path(apol_policy_t *p, char *path) { ++ %rename(set_path) wrap_set_path; ++ void wrap_set_path(apol_policy_t *p, char *path) { + BEGIN_EXCEPTION + if (apol_genfscon_query_set_path(p, self, path)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1727,7 +1818,8 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; + fail: + return; + }; +- void set_objclass(apol_policy_t *p, int objclass) { ++ %rename(set_objclass) wrap_set_objclass; ++ void wrap_set_objclass(apol_policy_t *p, int objclass) { + BEGIN_EXCEPTION + if (apol_genfscon_query_set_objclass(p, self, objclass)) { + SWIG_exception(SWIG_RuntimeError, "Could not set object class for genfscon query"); +@@ -1736,7 +1828,8 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; + fail: + return; + }; +- void set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_context) wrap_set_context; ++ void wrap_set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_genfscon_query_set_context(p, self, ctx, range_match); + }; + }; +@@ -1746,7 +1839,7 @@ char *apol_genfscon_render(apol_policy_t * p, qpol_genfscon_t * genfscon); + /* apol fs_use query */ + typedef struct apol_fs_use_query {} apol_fs_use_query_t; + %extend apol_fs_use_query_t { +- apol_fs_use_query_t() { ++ apol_fs_use_query() { + apol_fs_use_query_t *afq; + BEGIN_EXCEPTION + afq = apol_fs_use_query_create(); +@@ -1757,7 +1850,7 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; + fail: + return afq; + }; +- ~apol_fs_use_query_t() { ++ ~apol_fs_use_query() { + apol_fs_use_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1771,7 +1864,8 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; + fail: + return v; + }; +- void set_filesystem(apol_policy_t *p, char *fs) { ++ %rename(set_filesystem) wrap_set_filesystem; ++ void wrap_set_filesystem(apol_policy_t *p, char *fs) { + BEGIN_EXCEPTION + if (apol_fs_use_query_set_filesystem(p, self, fs)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1780,7 +1874,8 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; + fail: + return; + }; +- void set_behavior(apol_policy_t *p, int behavior) { ++ %rename(set_behavior) wrap_set_behavior; ++ void wrap_set_behavior(apol_policy_t *p, int behavior) { + BEGIN_EXCEPTION + if (apol_fs_use_query_set_behavior(p, self, behavior)) { + SWIG_exception(SWIG_RuntimeError, "Could not set behavior for fs_use query"); +@@ -1789,7 +1884,8 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; + fail: + return; + }; +- void set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_context) wrap_set_context; ++ void wrap_set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_fs_use_query_set_context(p, self, ctx, range_match); + }; + }; +@@ -1799,7 +1895,7 @@ char *apol_fs_use_render(apol_policy_t * p, qpol_fs_use_t * fsuse); + /* apol initial sid query */ + typedef struct apol_isid_query {} apol_isid_query_t; + %extend apol_isid_query_t { +- apol_isid_query_t() { ++ apol_isid_query() { + apol_isid_query_t *aiq; + BEGIN_EXCEPTION + aiq = apol_isid_query_create(); +@@ -1810,7 +1906,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; + fail: + return aiq; + }; +- ~apol_isid_query_t() { ++ ~apol_isid_query() { + apol_isid_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1824,7 +1920,8 @@ typedef struct apol_isid_query {} apol_isid_query_t; + fail: + return v; + }; +- void set_name(apol_policy_t *p, char *name) { ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_isid_query_set_name(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1833,7 +1930,8 @@ typedef struct apol_isid_query {} apol_isid_query_t; + fail: + return; + }; +- void set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_context) wrap_set_context; ++ void wrap_set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_isid_query_set_context(p, self, ctx, range_match); + }; + }; +@@ -1841,7 +1939,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; + /* apol portcon query */ + typedef struct apol_portcon_query {} apol_portcon_query_t; + %extend apol_portcon_query_t { +- apol_portcon_query_t() { ++ apol_portcon_query() { + apol_portcon_query_t *apq; + BEGIN_EXCEPTION + apq = apol_portcon_query_create(); +@@ -1852,7 +1950,7 @@ typedef struct apol_portcon_query {} apol_portcon_query_t; + fail: + return apq; + }; +- ~apol_portcon_query_t() { ++ ~apol_portcon_query() { + apol_portcon_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1866,16 +1964,20 @@ typedef struct apol_portcon_query {} apol_portcon_query_t; + fail: + return v; + }; +- void set_protocol(apol_policy_t *p, int protocol) { ++ %rename(set_protocol) wrap_set_protocol; ++ void wrap_set_protocol(apol_policy_t *p, int protocol) { + apol_portcon_query_set_protocol(p, self, protocol); + }; +- void set_low(apol_policy_t *p, int port) { ++ %rename(set_low) wrap_set_low; ++ void wrap_set_low(apol_policy_t *p, int port) { + apol_portcon_query_set_low(p, self, port); + }; +- void set_high(apol_policy_t *p, int port) { ++ %rename(set_high) wrap_set_high; ++ void wrap_set_high(apol_policy_t *p, int port) { + apol_portcon_query_set_high(p, self, port); + }; +- void set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_context) wrap_set_context; ++ void wrap_set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_portcon_query_set_context(p, self, ctx, range_match); + }; + }; +@@ -1884,8 +1986,9 @@ char *apol_portcon_render(apol_policy_t * p, qpol_portcon_t * portcon); + + /* apol netifcon query */ + typedef struct apol_netifcon_query {} apol_netifcon_query_t; ++%rename(apol_netifcon_query_set_msg_context) apol_netifcon_query_set_msg_context; + %extend apol_netifcon_query_t { +- apol_netifcon_query_t() { ++ apol_netifcon_query() { + apol_netifcon_query_t *anq; + BEGIN_EXCEPTION + anq = apol_netifcon_query_create(); +@@ -1896,7 +1999,7 @@ typedef struct apol_netifcon_query {} apol_netifcon_query_t; + fail: + return anq; + }; +- ~apol_netifcon_query_t() { ++ ~apol_netifcon_query() { + apol_netifcon_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1910,7 +2013,8 @@ typedef struct apol_netifcon_query {} apol_netifcon_query_t; + fail: + return v; + }; +- void set_device(apol_policy_t *p, char *name) { ++ %rename(set_device) wrap_set_device; ++ void wrap_set_device(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_netifcon_query_set_device(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -1919,10 +2023,12 @@ typedef struct apol_netifcon_query {} apol_netifcon_query_t; + fail: + return; + }; +- void set_if_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_if_context) wrap_set_if_context; ++ void wrap_set_if_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_netifcon_query_set_if_context(p, self, ctx, range_match); + }; +- void set_msg_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_msg_context) wrap_set_msg_context; ++ void wrap_set_msg_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_netifcon_query_set_msg_context(p, self, ctx, range_match); + }; + }; +@@ -1932,7 +2038,7 @@ char *apol_netifcon_render(apol_policy_t * p, qpol_netifcon_t * netifcon); + /* apol nodecon query */ + typedef struct apol_nodecon_query {} apol_nodecon_query_t; + %extend apol_nodecon_query_t { +- apol_nodecon_query_t() { ++ apol_nodecon_query() { + apol_nodecon_query_t *anq; + BEGIN_EXCEPTION + anq = apol_nodecon_query_create(); +@@ -1943,7 +2049,7 @@ typedef struct apol_nodecon_query {} apol_nodecon_query_t; + fail: + return anq; + }; +- ~apol_nodecon_query_t() { ++ ~apol_nodecon_query() { + apol_nodecon_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -1957,7 +2063,8 @@ typedef struct apol_nodecon_query {} apol_nodecon_query_t; + fail: + return v; + }; +- void set_protocol(apol_policy_t *p, int protocol) { ++ %rename(set_protocol) wrap_set_protocol; ++ void wrap_set_protocol(apol_policy_t *p, int protocol) { + BEGIN_EXCEPTION + if (apol_nodecon_query_set_protocol(p, self, protocol)) { + SWIG_exception(SWIG_RuntimeError, "Could not set protocol for nodecon query"); +@@ -2002,7 +2109,8 @@ typedef struct apol_nodecon_query {} apol_nodecon_query_t; + fail: + return; + }; +- void set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { ++ %rename(set_context) wrap_set_context; ++ void wrap_set_context(apol_policy_t *p, apol_context_t *ctx, int range_match) { + apol_nodecon_query_set_context(p, self, ctx, range_match); + }; + }; +@@ -2012,7 +2120,7 @@ char *apol_nodecon_render(apol_policy_t * p, qpol_nodecon_t * nodecon); + /* apol avrule query */ + typedef struct apol_avrule_query {} apol_avrule_query_t; + %extend apol_avrule_query_t { +- apol_avrule_query_t() { ++ apol_avrule_query() { + apol_avrule_query_t *avq; + BEGIN_EXCEPTION + avq = apol_avrule_query_create(); +@@ -2023,7 +2131,7 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return avq; + }; +- ~apol_avrule_query_t() { ++ ~apol_avrule_query() { + apol_avrule_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2048,10 +2156,12 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return v; + }; +- void set_rules(apol_policy_t *p, int rules) { ++ %rename(set_rules) wrap_set_rules; ++ void wrap_set_rules(apol_policy_t *p, int rules) { + apol_avrule_query_set_rules(p, self, rules); + }; +- void set_source(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_avrule_query_set_source(p, self, name, indirect)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source for avrule query"); +@@ -2060,7 +2170,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void set_source_component(apol_policy_t *p, int component) { ++ %rename(set_source_component) wrap_set_source_component; ++ void wrap_set_source_component(apol_policy_t *p, int component) { + BEGIN_EXCEPTION + if (apol_avrule_query_set_source_component(p, self, component)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source component for avrule query"); +@@ -2069,7 +2180,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void set_target(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_avrule_query_set_target(p, self, name, indirect)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target for avrule query"); +@@ -2078,7 +2190,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void set_target_component(apol_policy_t *p, int component) { ++ %rename(set_target_component) wrap_set_target_component; ++ void wrap_set_target_component(apol_policy_t *p, int component) { + BEGIN_EXCEPTION + if (apol_avrule_query_set_target_component(p, self, component)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target component for avrule query"); +@@ -2087,7 +2200,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void append_class(apol_policy_t *p, char *name) { ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_avrule_query_append_class(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append class to avrule query"); +@@ -2096,7 +2210,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void append_perm(apol_policy_t *p, char *name) { ++ %rename(append_perm) wrap_append_perm; ++ void wrap_append_perm(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_avrule_query_append_perm(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append permission to avrule query"); +@@ -2105,7 +2220,8 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void set_bool(apol_policy_t *p, char *name) { ++ %rename(set_bool) wrap_set_bool; ++ void wrap_set_bool(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_avrule_query_set_bool(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set boolean for avrule query"); +@@ -2114,16 +2230,20 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; + fail: + return; + }; +- void set_enabled(apol_policy_t *p, int enabled) { ++ %rename(set_enabled) wrap_set_enabled; ++ void wrap_set_enabled(apol_policy_t *p, int enabled) { + apol_avrule_query_set_enabled(p, self, enabled); + }; +- void set_all_perms(apol_policy_t *p, int all_perms) { ++ %rename(set_all_perms) wrap_set_all_perms; ++ void wrap_set_all_perms(apol_policy_t *p, int all_perms) { + apol_avrule_query_set_all_perms(p, self, all_perms); + }; +- void set_source_any(apol_policy_t *p, int is_any) { ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { + apol_avrule_query_set_source_any(p, self, is_any); + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_avrule_query_set_regex(p, self, regex); + }; + }; +@@ -2163,7 +2283,7 @@ char *apol_syn_avrule_render(apol_policy_t * policy, qpol_syn_avrule_t * rule); + /* apol terule query */ + typedef struct apol_terule_query {} apol_terule_query_t; + %extend apol_terule_query_t { +- apol_terule_query_t() { ++ apol_terule_query() { + apol_terule_query_t *atq; + BEGIN_EXCEPTION + atq = apol_terule_query_create(); +@@ -2174,7 +2294,7 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return atq; + }; +- ~apol_terule_query_t() { ++ ~apol_terule_query() { + apol_terule_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2199,10 +2319,12 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return v; + }; +- void set_rules(apol_policy_t *p, int rules) { ++ %rename(set_rules) wrap_set_rules; ++ void wrap_set_rules(apol_policy_t *p, int rules) { + apol_terule_query_set_rules(p, self, rules); + }; +- void set_source(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_terule_query_set_source(p, self, name, indirect)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source for terule query"); +@@ -2211,7 +2333,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_source_component(apol_policy_t *p, int component) { ++ %rename(set_source_component) wrap_set_source_component; ++ void wrap_set_source_component(apol_policy_t *p, int component) { + BEGIN_EXCEPTION + if (apol_terule_query_set_source_component(p, self, component)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source component for terule query"); +@@ -2220,7 +2343,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_target(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_terule_query_set_target(p, self, name, indirect)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target for terule query"); +@@ -2229,7 +2353,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_target_component(apol_policy_t *p, int component) { ++ %rename(set_target_component) wrap_set_target_component; ++ void wrap_set_target_component(apol_policy_t *p, int component) { + BEGIN_EXCEPTION + if (apol_terule_query_set_target_component(p, self, component)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target component for terule query"); +@@ -2238,7 +2363,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void append_class(apol_policy_t *p, char *name) { ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_terule_query_append_class(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append class to terule query"); +@@ -2247,7 +2373,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_default(apol_policy_t *p, char *name) { ++ %rename(set_default) wrap_set_default; ++ void wrap_set_default(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_terule_query_set_default(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set default for terule query"); +@@ -2256,7 +2383,8 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_bool(apol_policy_t *p, char *name) { ++ %rename(set_bool) wrap_set_bool; ++ void wrap_set_bool(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_terule_query_set_bool(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set boolean for terule query"); +@@ -2265,13 +2393,16 @@ typedef struct apol_terule_query {} apol_terule_query_t; + fail: + return; + }; +- void set_enabled(apol_policy_t *p, int enabled) { ++ %rename(set_enabled) wrap_set_enabled; ++ void wrap_set_enabled(apol_policy_t *p, int enabled) { + apol_terule_query_set_enabled(p, self, enabled); + }; +- void set_source_any(apol_policy_t *p, int is_any) { ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { + apol_terule_query_set_source_any(p, self, is_any); + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_terule_query_set_regex(p, self, regex); + }; + }; +@@ -2287,7 +2418,7 @@ apol_vector_t *apol_terule_list_to_syn_terules(apol_policy_t * p, apol_vector_t + /* apol cond rule query */ + typedef struct apol_cond_query {} apol_cond_query_t; + %extend apol_cond_query_t { +- apol_cond_query_t() { ++ apol_cond_query() { + apol_cond_query_t *acq; + BEGIN_EXCEPTION + acq = apol_cond_query_create(); +@@ -2298,7 +2429,7 @@ typedef struct apol_cond_query {} apol_cond_query_t; + fail: + return acq; + }; +- ~apol_cond_query_t() { ++ ~apol_cond_query() { + apol_cond_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2312,7 +2443,8 @@ typedef struct apol_cond_query {} apol_cond_query_t; + fail: + return v; + }; +- void set_bool(apol_policy_t *p, char *name) { ++ %rename(set_bool) wrap_set_bool; ++ void wrap_set_bool(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_cond_query_set_bool(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set boolean for condiional query"); +@@ -2321,7 +2453,8 @@ typedef struct apol_cond_query {} apol_cond_query_t; + fail: + return; + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_cond_query_set_regex(p, self, regex); + }; + }; +@@ -2331,7 +2464,7 @@ char *apol_cond_expr_render(apol_policy_t * p, qpol_cond_t * cond); + /* apol role allow query */ + typedef struct apol_role_allow_query {} apol_role_allow_query_t; + %extend apol_role_allow_query_t { +- apol_role_allow_query_t() { ++ apol_role_allow_query() { + apol_role_allow_query_t *arq; + BEGIN_EXCEPTION + arq = apol_role_allow_query_create(); +@@ -2342,7 +2475,7 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; + fail: + return arq; + }; +- ~apol_role_allow_query_t() { ++ ~apol_role_allow_query() { + apol_role_allow_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2356,7 +2489,8 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; + fail: + return v; + }; +- void set_source(apol_policy_t *p, char *name) { ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_allow_query_set_source(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2365,7 +2499,8 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; + fail: + return; + }; +- void set_target(apol_policy_t *p, char *name) { ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_allow_query_set_target(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2374,10 +2509,12 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; + fail: + return; + }; +- void set_source_any(apol_policy_t *p, int is_any) { ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { + apol_role_allow_query_set_source_any(p, self, is_any); + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_role_allow_query_set_regex(p, self, regex); + }; + }; +@@ -2387,7 +2524,7 @@ char *apol_role_allow_render(apol_policy_t * policy, qpol_role_allow_t * rule); + /* apol role transition rule query */ + typedef struct apol_role_trans_query {} apol_role_trans_query_t; + %extend apol_role_trans_query_t { +- apol_role_trans_query_t() { ++ apol_role_trans_query() { + apol_role_trans_query_t *arq; + BEGIN_EXCEPTION + arq = apol_role_trans_query_create(); +@@ -2398,7 +2535,7 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; + fail: + return arq; + }; +- ~apol_role_trans_query_t() { ++ ~apol_role_trans_query() { + apol_role_trans_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2412,7 +2549,8 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; + fail: + return v; + }; +- void set_source(apol_policy_t *p, char *name) { ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_trans_query_set_source(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2421,7 +2559,8 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; + fail: + return; + }; +- void set_target(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_role_trans_query_set_target(p, self, name, indirect)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2430,7 +2569,8 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; + fail: + return; + }; +- void set_default(apol_policy_t *p, char *name) { ++ %rename(set_default) wrap_set_default; ++ void wrap_set_default(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_role_trans_query_set_default(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2439,10 +2579,12 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; + fail: + return; + }; +- void set_source_any(apol_policy_t *p, int is_any) { ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { + apol_role_trans_query_set_source_any(p, self, is_any); + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_role_trans_query_set_regex(p, self, regex); + }; + }; +@@ -2452,7 +2594,7 @@ char *apol_role_trans_render(apol_policy_t * policy, qpol_role_trans_t * rule); + /* apol range transition rule query */ + typedef struct apol_range_trans_query {} apol_range_trans_query_t; + %extend apol_range_trans_query_t { +- apol_range_trans_query_t() { ++ apol_range_trans_query() { + apol_range_trans_query_t *arq; + BEGIN_EXCEPTION + arq = apol_range_trans_query_create(); +@@ -2463,7 +2605,7 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return arq; + }; +- ~apol_range_trans_query_t() { ++ ~apol_range_trans_query() { + apol_range_trans_query_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2477,7 +2619,8 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return v; + }; +- void set_source(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_range_trans_query_set_source(p, self, name, indirect)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2486,7 +2629,8 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return; + }; +- void set_target(apol_policy_t *p, char *name, int indirect) { ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name, int indirect) { + BEGIN_EXCEPTION + if (apol_range_trans_query_set_target(p, self, name, indirect)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2495,7 +2639,8 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return; + }; +- void append_class(apol_policy_t *p, char *name) { ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_range_trans_query_append_class(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append class to range transition query"); +@@ -2504,7 +2649,8 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return; + }; +- void set_range(apol_policy_t *p, apol_mls_range_t *rng, int range_match) { ++ %rename(set_range) wrap_set_range; ++ void wrap_set_range(apol_policy_t *p, apol_mls_range_t *rng, int range_match) { + BEGIN_EXCEPTION + if (apol_range_trans_query_set_range(p, self, rng, range_match)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2513,16 +2659,336 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; + fail: + return; + }; +- void set_source_any(apol_policy_t *p, int is_any) { ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { + apol_range_trans_query_set_source_any(p, self, is_any); + }; +- void set_regex(apol_policy_t *p, int regex) { ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { + apol_range_trans_query_set_regex(p, self, regex); + }; + }; + %newobject apol_range_trans_render(apol_policy_t*, qpol_range_trans_t*); + char *apol_range_trans_render(apol_policy_t * policy, qpol_range_trans_t * rule); + ++/* apol filename transition rule query */ ++typedef struct apol_filename_trans_query {} apol_filename_trans_query_t; ++%extend apol_filename_trans_query_t { ++ apol_filename_trans_query() { ++ apol_filename_trans_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_filename_trans_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_filename_trans_query() { ++ apol_filename_trans_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run filename transition query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++ %rename(set_source) wrap_set_source; ++ void wrap_set_source(apol_policy_t *p, char *name, int indirect) { ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_query_set_source(p, self, name, indirect)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ %rename(set_target) wrap_set_target; ++ void wrap_set_target(apol_policy_t *p, char *name, int indirect) { ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_query_set_target(p, self, name, indirect)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *name) { ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_query_append_class(p, self, name)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not append class to filename transition query"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ ++ %rename(set_default) wrap_set_default; ++ void wrap_set_default(apol_policy_t *p, char *name) { ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_query_set_default(p, self, name)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not set default for filename transition query"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ ++ void set_filename(apol_policy_t *p, char *filename) { ++ BEGIN_EXCEPTION ++ if (apol_filename_trans_query_set_name(p, self, filename)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ ++ %rename(set_source_any) wrap_set_source_any; ++ void wrap_set_source_any(apol_policy_t *p, int is_any) { ++ apol_filename_trans_query_set_source_any(p, self, is_any); ++ }; ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { ++ apol_filename_trans_query_set_regex(p, self, regex); ++ }; ++}; ++%newobject apol_filename_trans_render(apol_policy_t*, qpol_filename_trans_t*); ++char *apol_filename_trans_render(apol_policy_t * policy, qpol_filename_trans_t * rule); ++ ++/* apol permissive query */ ++typedef struct apol_permissive_query {} apol_permissive_query_t; ++%extend apol_permissive_query_t { ++ apol_permissive_query() { ++ apol_permissive_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_permissive_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_permissive_query() { ++ apol_permissive_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_permissive_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run permissive query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++ ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(apol_policy_t *p, char *name) { ++ BEGIN_EXCEPTION ++ if (apol_permissive_query_set_name(p, self, name)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { ++ apol_permissive_query_set_regex(p, self, regex); ++ }; ++}; ++ ++/* apol polcap query */ ++typedef struct apol_polcap_query {} apol_polcap_query_t; ++%extend apol_polcap_query_t { ++ apol_polcap_query() { ++ apol_polcap_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_polcap_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_polcap_query() { ++ apol_polcap_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_polcap_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run polcap query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++ ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(apol_policy_t *p, char *name) { ++ BEGIN_EXCEPTION ++ if (apol_polcap_query_set_name(p, self, name)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { ++ apol_polcap_query_set_regex(p, self, regex); ++ }; ++}; ++ ++/* apol typebounds query */ ++typedef struct apol_typebounds_query {} apol_typebounds_query_t; ++%extend apol_typebounds_query_t { ++ apol_typebounds_query() { ++ apol_typebounds_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_typebounds_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_typebounds_query() { ++ apol_typebounds_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_typebounds_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run typebounds query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(apol_policy_t *p, char *name) { ++ BEGIN_EXCEPTION ++ if (apol_typebounds_query_set_name(p, self, name)) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return; ++ }; ++ %rename(set_regex) wrap_set_regex; ++ void wrap_set_regex(apol_policy_t *p, int regex) { ++ apol_typebounds_query_set_regex(p, self, regex); ++ }; ++}; ++ ++/* apol rolebounds query */ ++typedef struct apol_rolebounds_query {} apol_rolebounds_query_t; ++%extend apol_rolebounds_query_t { ++ apol_rolebounds_query() { ++ apol_rolebounds_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_rolebounds_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_rolebounds_query() { ++ apol_rolebounds_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_rolebounds_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run rolebounds query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++}; ++ ++/* apol userbounds query */ ++typedef struct apol_userbounds_query {} apol_userbounds_query_t; ++%extend apol_userbounds_query_t { ++ apol_userbounds_query() { ++ apol_userbounds_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_userbounds_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_userbounds_query() { ++ apol_userbounds_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_userbounds_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run userbounds query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++}; ++ ++/* apol default_object query */ ++typedef struct apol_default_object_query {} apol_default_object_query_t; ++%extend apol_default_object_query_t { ++ apol_default_object_query() { ++ apol_default_object_query_t *arq; ++ BEGIN_EXCEPTION ++ arq = apol_default_object_query_create(); ++ if (!arq) { ++ SWIG_exception(SWIG_MemoryError, "Out of memory"); ++ } ++ END_EXCEPTION ++ fail: ++ return arq; ++ }; ++ ~apol_default_object_query() { ++ apol_default_object_query_destroy(&self); ++ }; ++ %newobject run(apol_policy_t*); ++ apol_vector_t *run(apol_policy_t *p) { ++ apol_vector_t *v; ++ BEGIN_EXCEPTION ++ if (apol_default_object_get_by_query(p, self, &v)) { ++ SWIG_exception(SWIG_RuntimeError, "Could not run default object query"); ++ } ++ END_EXCEPTION ++ fail: ++ return v; ++ }; ++}; ++ + /* domain transition analysis */ + #define APOL_DOMAIN_TRANS_DIRECTION_FORWARD 0x01 + #define APOL_DOMAIN_TRANS_DIRECTION_REVERSE 0x02 +@@ -2531,7 +2997,7 @@ char *apol_range_trans_render(apol_policy_t * policy, qpol_range_trans_t * rule) + #define APOL_DOMAIN_TRANS_SEARCH_BOTH (APOL_DOMAIN_TRANS_SEARCH_VALID|APOL_DOMAIN_TRANS_SEARCH_INVALID) + typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + %extend apol_domain_trans_analysis_t { +- apol_domain_trans_analysis_t() { ++ apol_domain_trans_analysis() { + apol_domain_trans_analysis_t *dta; + BEGIN_EXCEPTION + dta = apol_domain_trans_analysis_create(); +@@ -2542,10 +3008,11 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return dta; + }; +- ~apol_domain_trans_analysis_t() { ++ ~apol_domain_trans_analysis() { + apol_domain_trans_analysis_destroy(&self); + }; +- void set_direction(apol_policy_t *p, int direction) { ++ %rename(set_direction) wrap_set_direction; ++ void wrap_set_direction(apol_policy_t *p, int direction) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_set_direction(p, self, (unsigned char)direction)) { + SWIG_exception(SWIG_RuntimeError, "Could not set direction for domain transition analysis"); +@@ -2554,7 +3021,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void set_valid(apol_policy_t *p, int valid) { ++ %rename(set_valid) wrap_set_valid; ++ void wrap_set_valid(apol_policy_t *p, int valid) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_set_valid(p, self, (unsigned char)valid)) { + SWIG_exception(SWIG_RuntimeError, "Could not set valid flag for domain transition analysis"); +@@ -2563,7 +3031,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void set_start_type(apol_policy_t *p, char *name) { ++ %rename(set_start_type) wrap_set_start_type; ++ void wrap_set_start_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_set_start_type(p, self, name)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2572,7 +3041,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void set_result_regex(apol_policy_t *p, char *regex) { ++ %rename(set_result_regex) wrap_set_result_regex; ++ void wrap_set_result_regex(apol_policy_t *p, char *regex) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_set_result_regex(p, self, regex)) { + SWIG_exception(SWIG_MemoryError, "Out of memory"); +@@ -2581,7 +3051,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void append_access_type(apol_policy_t *p, char *name) { ++ %rename(append_access_type) wrap_append_access_type; ++ void wrap_append_access_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_append_access_type(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append access type for domain transition analysis"); +@@ -2590,7 +3061,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void append_class(apol_policy_t *p, char *class_name) { ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *class_name) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_append_class(p, self, class_name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append access class for domain transition analysis"); +@@ -2599,7 +3071,8 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + fail: + return; + }; +- void append_perm(apol_policy_t *p, char *perm_name) { ++ %rename(append_perm) wrap_append_perm; ++ void wrap_append_perm(apol_policy_t *p, char *perm_name) { + BEGIN_EXCEPTION + if (apol_domain_trans_analysis_append_perm(p, self, perm_name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append access permission for domain transition analysis"); +@@ -2622,7 +3095,7 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; + }; + typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; + %extend apol_domain_trans_result_t { +- apol_domain_trans_result_t(apol_domain_trans_result_t *in) { ++ apol_domain_trans_result(apol_domain_trans_result_t *in) { + apol_domain_trans_result_t *dtr; + BEGIN_EXCEPTION + dtr = apol_domain_trans_result_create_from_domain_trans_result(in); +@@ -2633,37 +3106,46 @@ typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; + fail: + return dtr; + }; +- ~apol_domain_trans_result_t() { ++ ~apol_domain_trans_result() { + apol_domain_trans_result_destroy(&self); + }; +- const qpol_type_t *get_start_type() { ++ %rename(get_start_type) wrap_get_start_type; ++ const qpol_type_t *wrap_get_start_type() { + return apol_domain_trans_result_get_start_type(self); + }; +- const qpol_type_t *get_entrypoint_type() { ++ %rename(get_entrypoint_type) wrap_get_entrypoint_type; ++ const qpol_type_t *wrap_get_entrypoint_type() { + return apol_domain_trans_result_get_entrypoint_type(self); + }; +- const qpol_type_t *get_end_type() { ++ %rename(get_end_type) wrap_get_end_type; ++ const qpol_type_t *wrap_get_end_type() { + return apol_domain_trans_result_get_end_type(self); + }; + int get_is_valid() { + return apol_domain_trans_result_is_trans_valid(self); + }; +- const apol_vector_t *get_proc_trans_rules() { ++ %rename(get_proc_trans_rules) wrap_get_proc_trans_rules; ++ const apol_vector_t *wrap_get_proc_trans_rules() { + return apol_domain_trans_result_get_proc_trans_rules(self); + }; +- const apol_vector_t *get_entrypoint_rules() { ++ %rename(get_entrypoint_rules) wrap_get_entrypoint_rules; ++ const apol_vector_t *wrap_get_entrypoint_rules() { + return apol_domain_trans_result_get_entrypoint_rules(self); + }; +- const apol_vector_t *get_exec_rules() { ++ %rename(get_exec_rules) wrap_get_exec_rules; ++ const apol_vector_t *wrap_get_exec_rules() { + return apol_domain_trans_result_get_exec_rules(self); + }; +- const apol_vector_t *get_setexec_rules() { ++ %rename(get_setexec_rules) wrap_get_setexec_rules; ++ const apol_vector_t *wrap_get_setexec_rules() { + return apol_domain_trans_result_get_setexec_rules(self); + }; +- const apol_vector_t *get_type_trans_rules() { ++ %rename(get_type_trans_rules) wrap_get_type_trans_rules; ++ const apol_vector_t *wrap_get_type_trans_rules() { + return apol_domain_trans_result_get_type_trans_rules(self); + }; +- const apol_vector_t *get_access_rules() { ++ %rename(get_access_rules) wrap_get_access_rules; ++ const apol_vector_t *wrap_get_access_rules() { + return apol_domain_trans_result_get_access_rules(self); + }; + }; +@@ -2705,14 +3187,14 @@ int apol_domain_trans_table_verify_trans(apol_policy_t * policy, qpol_type_t * s + %} + typedef struct apol_infoflow {} apol_infoflow_t; + %extend apol_infoflow_t { +- apol_infoflow_t() { ++ apol_infoflow() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_infoflow_t() { ++ ~apol_infoflow() { + apol_infoflow_destroy(&self); + }; + %newobject extract_graph(); +@@ -2730,7 +3212,7 @@ typedef struct apol_infoflow {} apol_infoflow_t; + }; + typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + %extend apol_infoflow_analysis_t { +- apol_infoflow_analysis_t() { ++ apol_infoflow_analysis() { + apol_infoflow_analysis_t *aia; + BEGIN_EXCEPTION + aia = apol_infoflow_analysis_create(); +@@ -2741,7 +3223,7 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return aia; + }; +- ~apol_infoflow_analysis_t() { ++ ~apol_infoflow_analysis() { + apol_infoflow_analysis_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2763,7 +3245,8 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + apol_infoflow_destroy(&ai); + return NULL; + }; +- void set_mode(apol_policy_t *p, int mode) { ++ %rename(set_mode) wrap_set_mode; ++ void wrap_set_mode(apol_policy_t *p, int mode) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_set_mode(p, self, (unsigned int)mode)) { + SWIG_exception(SWIG_RuntimeError, "Could not set mode for information flow analysis"); +@@ -2772,7 +3255,8 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return; + }; +- void set_dir(apol_policy_t *p, int direction) { ++ %rename(set_dir) wrap_set_dir; ++ void wrap_set_dir(apol_policy_t *p, int direction) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_set_dir(p, self, (unsigned int)direction)) { + SWIG_exception(SWIG_RuntimeError, "Could not set direction for information flow analysis"); +@@ -2781,7 +3265,8 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return; + }; +- void set_type(apol_policy_t *p, char *name) { ++ %rename(set_type) wrap_set_type; ++ void wrap_set_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_set_type(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set type for information flow analysis"); +@@ -2790,7 +3275,8 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return; + }; +- void append_intermediate(apol_policy_t *p, char *name) { ++ %rename(append_intermediate) wrap_append_intermediate; ++ void wrap_append_intermediate(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_append_intermediate(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append intermediate type for information flow analysis"); +@@ -2799,7 +3285,8 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return; + }; +- void append_class_perm(apol_policy_t *p, char *class_name, char *perm_name) { ++ %rename(append_class_perm) wrap_append_class_perm; ++ void wrap_append_class_perm(apol_policy_t *p, char *class_name, char *perm_name) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_append_class_perm(p, self, class_name, perm_name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append class and permission for information flow analysis"); +@@ -2808,10 +3295,12 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + fail: + return; + }; +- void set_min_weight(apol_policy_t *p, int weight) { ++ %rename(set_min_weight) wrap_set_min_weight; ++ void wrap_set_min_weight(apol_policy_t *p, int weight) { + apol_infoflow_analysis_set_min_weight(p, self, weight); + }; +- void set_result_regex(apol_policy_t *p, char *regex) { ++ %rename(set_result_regex) wrap_set_result_regex; ++ void wrap_set_result_regex(apol_policy_t *p, char *regex) { + BEGIN_EXCEPTION + if (apol_infoflow_analysis_set_result_regex(p, self, regex)) { + SWIG_exception(SWIG_RuntimeError, "Could not set result regular expression for information flow analysis"); +@@ -2823,14 +3312,14 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; + }; + typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; + %extend apol_infoflow_graph_t { +- apol_infoflow_graph_t() { ++ apol_infoflow_graph() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_graph_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_infoflow_graph_t() { ++ ~apol_infoflow_graph() { + apol_infoflow_graph_destroy(&self); + }; + %newobject do_more(apol_policy_t*, char*); +@@ -2867,30 +3356,35 @@ typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; + }; + typedef struct apol_infoflow_result {} apol_infoflow_result_t; + %extend apol_infoflow_result_t { +- apol_infoflow_result_t() { ++ apol_infoflow_result() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_result_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_infoflow_result_t() { ++ ~apol_infoflow_result() { + /* no op - vector will destroy */ + return; + }; +- int get_dir() { ++ %rename(get_dir) wrap_get_dir; ++ int wrap_get_dir() { + return (int)apol_infoflow_result_get_dir(self); + }; +- const qpol_type_t *get_start_type() { ++ %rename(get_start_type) wrap_get_start_type; ++ const qpol_type_t *wrap_get_start_type() { + return apol_infoflow_result_get_start_type(self); + }; +- const qpol_type_t *get_end_type() { ++ %rename(get_end_type) wrap_get_end_type; ++ const qpol_type_t *wrap_get_end_type() { + return apol_infoflow_result_get_end_type(self); + }; +- int get_length() { ++ %rename(get_length) wrap_get_length; ++ int wrap_get_length() { + return (int) apol_infoflow_result_get_length(self); + } +- const apol_vector_t *get_steps() { ++ %rename(get_steps) wrap_get_steps; ++ const apol_vector_t *wrap_get_steps() { + return apol_infoflow_result_get_steps(self); + }; + }; +@@ -2901,27 +3395,31 @@ typedef struct apol_infoflow_result {} apol_infoflow_result_t; + %} + typedef struct apol_infoflow_step {} apol_infoflow_step_t; + %extend apol_infoflow_step_t { +- apol_infoflow_step_t() { ++ apol_infoflow_step() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_step_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_infoflow_step_t() { ++ ~apol_infoflow_step() { + /* no op */ + return; + }; +- const qpol_type_t *get_start_type() { ++ %rename(get_start_type) wrap_get_start_type; ++ const qpol_type_t *wrap_get_start_type() { + return apol_infoflow_step_get_start_type(self); + }; +- const qpol_type_t *get_end_type() { ++ %rename(get_end_type) wrap_get_end_type; ++ const qpol_type_t *wrap_get_end_type() { + return apol_infoflow_step_get_end_type(self); + }; +- int get_weight() { ++ %rename(get_weight) wrap_get_weight; ++ int wrap_get_weight() { + return apol_infoflow_step_get_weight(self); + }; +- const apol_vector_t *get_rules() { ++ %rename(get_rules) wrap_get_rules; ++ const apol_vector_t *wrap_get_rules() { + return apol_infoflow_step_get_rules(self); + }; + }; +@@ -2938,7 +3436,7 @@ typedef struct apol_infoflow_step {} apol_infoflow_step_t; + #define APOL_RELABEL_DIR_SUBJECT 0x04 + typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + %extend apol_relabel_analysis_t { +- apol_relabel_analysis_t() { ++ apol_relabel_analysis() { + apol_relabel_analysis_t *ara; + BEGIN_EXCEPTION + ara = apol_relabel_analysis_create(); +@@ -2949,7 +3447,7 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return ara; + }; +- ~apol_relabel_analysis_t() { ++ ~apol_relabel_analysis() { + apol_relabel_analysis_destroy(&self); + }; + %newobject run(apol_policy_t*); +@@ -2963,7 +3461,8 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return v; + }; +- void set_dir(apol_policy_t *p, int direction) { ++ %rename(set_dir) wrap_set_dir; ++ void wrap_set_dir(apol_policy_t *p, int direction) { + BEGIN_EXCEPTION + if (apol_relabel_analysis_set_dir(p, self, (unsigned int)direction)) { + SWIG_exception(SWIG_RuntimeError, "Could not set direction for relabel analysis"); +@@ -2972,7 +3471,8 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return; + }; +- void set_type(apol_policy_t *p, char *name) { ++ %rename(set_type) wrap_set_type; ++ void wrap_set_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_relabel_analysis_set_type(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set type for relabel analysis"); +@@ -2981,7 +3481,8 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return; + }; +- void append_class(apol_policy_t *p, char *name) { ++ %rename(append_class) wrap_append_class; ++ void wrap_append_class(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_relabel_analysis_append_class(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append class to relabel analysis"); +@@ -2990,7 +3491,8 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return; + }; +- void append_subject(apol_policy_t *p, char *name) { ++ %rename(append_subject) wrap_append_subject; ++ void wrap_append_subject(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_relabel_analysis_append_subject(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not append subject to relabel analysis"); +@@ -2999,7 +3501,8 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + fail: + return; + }; +- void set_result_regex(apol_policy_t *p, char *regex) { ++ %rename(set_result_regex) wrap_set_result_regex; ++ void wrap_set_result_regex(apol_policy_t *p, char *regex) { + BEGIN_EXCEPTION + if (apol_relabel_analysis_set_result_regex(p, self, regex)) { + SWIG_exception(SWIG_RuntimeError, "Could not set result regular expression for relabel analysis"); +@@ -3011,27 +3514,31 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; + }; + typedef struct apol_relabel_result {} apol_relabel_result_t; + %extend apol_relabel_result_t { +- apol_relabel_result_t() { ++ apol_relabel_result() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_relabel_result_t() { ++ ~apol_relabel_result() { + /* no op - vector will destroy */ + return; + }; +- const apol_vector_t *get_to() { ++ %rename(get_to) wrap_get_to; ++ const apol_vector_t *wrap_get_to() { + return apol_relabel_result_get_to(self); + }; +- const apol_vector_t *get_from() { ++ %rename(get_from) wrap_get_from; ++ const apol_vector_t *wrap_get_from() { + return apol_relabel_result_get_from(self); + }; +- const apol_vector_t *get_both() { ++ %rename(get_both) wrap_get_both; ++ const apol_vector_t *wrap_get_both() { + return apol_relabel_result_get_both(self); + }; +- const qpol_type_t *get_result_type() { ++ %rename(get_result_type) wrap_get_result_type; ++ const qpol_type_t *wrap_get_result_type() { + return apol_relabel_result_get_result_type(self); + }; + }; +@@ -3042,24 +3549,27 @@ typedef struct apol_relabel_result {} apol_relabel_result_t; + %} + typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; + %extend apol_relabel_result_pair_t { +- apol_relabel_result_pair_t() { ++ apol_relabel_result_pair() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_pair_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_relabel_result_pair_t() { ++ ~apol_relabel_result_pair() { + /* no op - owned and free()'d by apol_relabel_result_t */ + return; + }; +- const qpol_avrule_t *get_ruleA() { ++ %rename(get_ruleA) wrap_get_ruleA; ++ const qpol_avrule_t *wrap_get_ruleA() { + return apol_relabel_result_pair_get_ruleA(self); + }; +- const qpol_avrule_t *get_ruleB() { ++ %rename(get_ruleB) wrap_get_ruleB; ++ const qpol_avrule_t *wrap_get_ruleB() { + return apol_relabel_result_pair_get_ruleB(self); + }; +- const qpol_type_t *get_intermediate_type() { ++ %rename(get_intermediate_type) wrap_get_intermediate_type; ++ const qpol_type_t *wrap_get_intermediate_type() { + return apol_relabel_result_pair_get_intermediate_type(self); + }; + }; +@@ -3084,7 +3594,7 @@ typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; + #define APOL_TYPES_RELATION_TRANS_FLOW_BA 0x8000 + typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + %extend apol_types_relation_analysis_t { +- apol_types_relation_analysis_t() { ++ apol_types_relation_analysis() { + apol_types_relation_analysis_t *atr; + BEGIN_EXCEPTION + atr = apol_types_relation_analysis_create(); +@@ -3095,7 +3605,7 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + fail: + return atr; + }; +- ~apol_types_relation_analysis_t() { ++ ~apol_types_relation_analysis() { + apol_types_relation_analysis_destroy(&self); + } + %newobject run(apol_policy_t*); +@@ -3109,7 +3619,8 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + fail: + return res; + }; +- void set_first_type(apol_policy_t *p, char *name) { ++ %rename(set_first_type) wrap_set_first_type; ++ void wrap_set_first_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_types_relation_analysis_set_first_type(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set first type for types relation analysis"); +@@ -3118,7 +3629,8 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + fail: + return; + }; +- void set_other_type(apol_policy_t *p, char *name) { ++ %rename(set_other_type) wrap_set_other_type; ++ void wrap_set_other_type(apol_policy_t *p, char *name) { + BEGIN_EXCEPTION + if (apol_types_relation_analysis_set_other_type(p, self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set other type for types relation analysis"); +@@ -3127,7 +3639,8 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + fail: + return; + }; +- void set_analyses(apol_policy_t *p, int analyses) { ++ %rename(set_analyses) wrap_set_analyses; ++ void wrap_set_analyses(apol_policy_t *p, int analyses) { + BEGIN_EXCEPTION + if (apol_types_relation_analysis_set_analyses(p, self, (unsigned int)analyses)) { + SWIG_exception(SWIG_RuntimeError, "Could not set analyses to run for types relation analysis"); +@@ -3139,76 +3652,92 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; + }; + typedef struct apol_types_relation_result {} apol_types_relation_result_t; + %extend apol_types_relation_result_t { +- apol_types_relation_result_t() { ++ apol_types_relation_result() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_result_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_types_relation_result_t() { ++ ~apol_types_relation_result() { + apol_types_relation_result_destroy(&self); + }; +- const apol_vector_t *get_attributes() { ++ %rename(get_attributes) wrap_get_attributes; ++ const apol_vector_t *wrap_get_attributes() { + return apol_types_relation_result_get_attributes(self); + }; +- const apol_vector_t *get_roles() { ++ %rename(get_roles) wrap_get_roles; ++ const apol_vector_t *wrap_get_roles() { + return apol_types_relation_result_get_roles(self); + }; +- const apol_vector_t *get_users() { ++ %rename(get_users) wrap_get_users; ++ const apol_vector_t *wrap_get_users() { + return apol_types_relation_result_get_users(self); + }; +- const apol_vector_t *get_similar_first() { ++ %rename(get_similar_first) wrap_get_similar_first; ++ const apol_vector_t *wrap_get_similar_first() { + return apol_types_relation_result_get_similar_first(self); + }; +- const apol_vector_t *get_similar_other() { ++ %rename(get_similar_other) wrap_get_similar_other; ++ const apol_vector_t *wrap_get_similar_other() { + return apol_types_relation_result_get_similar_other(self); + }; +- const apol_vector_t *get_dissimilar_first() { ++ %rename(get_dissimilar_first) wrap_get_dissimilar_first; ++ const apol_vector_t *wrap_get_dissimilar_first() { + return apol_types_relation_result_get_dissimilar_first(self); + }; +- const apol_vector_t *get_dissimilar_other() { ++ %rename(get_dissimilar_other) wrap_get_dissimilar_other; ++ const apol_vector_t *wrap_get_dissimilar_other() { + return apol_types_relation_result_get_dissimilar_other(self); + }; +- const apol_vector_t *get_allowrules() { ++ %rename(get_allowrules) wrap_get_allowrules; ++ const apol_vector_t *wrap_get_allowrules() { + return apol_types_relation_result_get_allowrules(self); + }; +- const apol_vector_t *get_typerules() { ++ %rename(get_typerules) wrap_get_typerules; ++ const apol_vector_t *wrap_get_typerules() { + return apol_types_relation_result_get_typerules(self); + }; +- const apol_vector_t *get_directflows() { ++ %rename(get_directflows) wrap_get_directflows; ++ const apol_vector_t *wrap_get_directflows() { + return apol_types_relation_result_get_directflows(self); + }; +- const apol_vector_t *get_transflowsAB() { ++ %rename(get_transflowsAB) wrap_get_transflowsAB; ++ const apol_vector_t *wrap_get_transflowsAB() { + return apol_types_relation_result_get_transflowsAB(self); + }; +- const apol_vector_t *get_transflowsBA() { ++ %rename(get_transflowsBA) wrap_get_transflowsBA; ++ const apol_vector_t *wrap_get_transflowsBA() { + return apol_types_relation_result_get_transflowsBA(self); + }; +- const apol_vector_t*get_domainsAB() { ++ %rename(get_domainsAB) wrap_get_domainsAB; ++ const apol_vector_t*wrap_get_domainsAB() { + return apol_types_relation_result_get_domainsAB(self); + }; +- const apol_vector_t*get_domainsBA() { ++ %rename(get_domainsBA) wrap_get_domainsBA; ++ const apol_vector_t*wrap_get_domainsBA() { + return apol_types_relation_result_get_domainsBA(self); + }; + }; + typedef struct apol_types_relation_access {} apol_types_relation_access_t; + %extend apol_types_relation_access_t { +- apol_types_relation_access_t() { ++ apol_types_relation_access() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_access_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~apol_types_relation_access_t() { ++ ~apol_types_relation_access() { + /* no op - vector will destroy */ + return; + }; +- const qpol_type_t *get_type() { ++ %rename(get_type) wrap_get_type; ++ const qpol_type_t *wrap_get_type() { + return apol_types_relation_access_get_type(self); + }; +- const apol_vector_t *get_rules() { ++ %rename(get_rules) wrap_get_rules; ++ const apol_vector_t *wrap_get_rules() { + return apol_types_relation_access_get_rules(self); + }; + }; +diff --git a/libpoldiff/swig/poldiff.i b/libpoldiff/swig/poldiff.i +index 29767a8..addbb21 100644 +--- a/libpoldiff/swig/poldiff.i ++++ b/libpoldiff/swig/poldiff.i +@@ -273,7 +273,7 @@ typedef enum poldiff_form + %} + typedef struct poldiff_stats {} poldiff_stats_t; + %extend poldiff_stats_t { +- poldiff_stats_t() { ++ poldiff_stats() { + poldiff_stats_t *s; + BEGIN_EXCEPTION + s = poldiff_stats_create(); +@@ -284,7 +284,7 @@ typedef struct poldiff_stats {} poldiff_stats_t; + fail: + return s; + }; +- ~poldiff_stats_t() { ++ ~poldiff_stats() { + poldiff_stats_destroy(&self); + }; + size_t get_stat(poldiff_form_e form) { +@@ -348,7 +348,7 @@ unsigned long to_ulong(void *x); + #endif + typedef struct poldiff {} poldiff_t; + %extend poldiff_t { +- poldiff_t(apol_policy_t *op, apol_policy_t *mp) { ++ poldiff(apol_policy_t *op, apol_policy_t *mp) { + poldiff_t *p; + BEGIN_EXCEPTION + p = poldiff_create(op, mp, poldiff_swig_message_callback, poldiff_swig_message_callback_arg); +@@ -360,10 +360,11 @@ typedef struct poldiff {} poldiff_t; + fail: + return NULL; + }; +- ~poldiff_t() { ++ ~poldiff() { + poldiff_destroy(&self); + }; +- void run(uint32_t flags) { ++ %rename(run) wrap_run; ++ void wrap_run(uint32_t flags) { + BEGIN_EXCEPTION + if (poldiff_run(self, flags)) { + SWIG_exception(SWIG_RuntimeError, "Could not run diff"); +@@ -372,11 +373,13 @@ typedef struct poldiff {} poldiff_t; + fail: + return; + }; +- int is_run(uint32_t flags) { ++ %rename(is_run) wrap_is_run; ++ int wrap_is_run(uint32_t flags) { + return poldiff_is_run(self, flags); + }; + %newobject get_stats(uint32_t); +- poldiff_stats_t *get_stats(uint32_t flags) { ++ %rename(get_stats) wrap_get_stats; ++ poldiff_stats_t *wrap_get_stats(uint32_t flags) { + poldiff_stats_t *s = NULL; + BEGIN_EXCEPTION + s = poldiff_stats_create(); +@@ -392,7 +395,8 @@ typedef struct poldiff {} poldiff_t; + poldiff_stats_destroy(&s); + return NULL; + }; +- void enable_line_numbers() { ++ %rename(enable_line_numbers) wrap_enable_line_numbers; ++ void wrap_enable_line_numbers() { + BEGIN_EXCEPTION + if (poldiff_enable_line_numbers(self)) { + SWIG_exception(SWIG_RuntimeError, "Could not enable line numbers"); +@@ -401,67 +405,88 @@ typedef struct poldiff {} poldiff_t; + fail: + return; + }; +- const apol_vector_t *get_attrib_vector() { ++ %rename(get_attrib_vector) wrap_get_attrib_vector; ++ const apol_vector_t *wrap_get_attrib_vector() { + return poldiff_get_attrib_vector(self); + }; +- const apol_vector_t *get_avrule_vector_allow() { ++ %rename(get_avrule_vector_allow) wrap_get_avrule_vector_allow; ++ const apol_vector_t *wrap_get_avrule_vector_allow() { + return poldiff_get_avrule_vector_allow(self); + }; +- const apol_vector_t *get_avrule_vector_auditallow() { ++ %rename(get_avrule_vector_auditallow) wrap_get_avrule_vector_auditallow; ++ const apol_vector_t *wrap_get_avrule_vector_auditallow() { + return poldiff_get_avrule_vector_auditallow(self); + }; +- const apol_vector_t *get_avrule_vector_dontaudit() { ++ %rename(get_avrule_vector_dontaudit) wrap_get_avrule_vector_dontaudit; ++ const apol_vector_t *wrap_get_avrule_vector_dontaudit() { + return poldiff_get_avrule_vector_dontaudit(self); + }; +- const apol_vector_t *get_avrule_vector_neverallow() { ++ %rename(get_avrule_vector_neverallow) wrap_get_avrule_vector_neverallow; ++ const apol_vector_t *wrap_get_avrule_vector_neverallow() { + return poldiff_get_avrule_vector_neverallow(self); + }; +- const apol_vector_t *get_bool_vector() { ++ %rename(get_bool_vector) wrap_get_bool_vector; ++ const apol_vector_t *wrap_get_bool_vector() { + return poldiff_get_bool_vector(self); + }; +- const apol_vector_t *get_cat_vector() { ++ %rename(get_cat_vector) wrap_get_cat_vector; ++ const apol_vector_t *wrap_get_cat_vector() { + return poldiff_get_cat_vector(self); + }; +- const apol_vector_t *get_class_vector() { ++ %rename(get_class_vector) wrap_get_class_vector; ++ const apol_vector_t *wrap_get_class_vector() { + return poldiff_get_class_vector(self); + }; +- const apol_vector_t *get_common_vector() { ++ %rename(get_common_vector) wrap_get_common_vector; ++ const apol_vector_t *wrap_get_common_vector() { + return poldiff_get_common_vector(self); + }; +- const apol_vector_t *get_level_vector() { ++ %rename(get_level_vector) wrap_get_level_vector; ++ const apol_vector_t *wrap_get_level_vector() { + return poldiff_get_level_vector(self); + }; +- const apol_vector_t *get_range_trans_vector() { ++ %rename(get_range_trans_vector) wrap_get_range_trans_vector; ++ const apol_vector_t *wrap_get_range_trans_vector() { + return poldiff_get_range_trans_vector(self); + }; +- const apol_vector_t *get_role_allow_vector() { ++ %rename(get_role_allow_vector) wrap_get_role_allow_vector; ++ const apol_vector_t *wrap_get_role_allow_vector() { + return poldiff_get_role_allow_vector(self); + }; +- const apol_vector_t *get_role_trans_vector() { ++ %rename(get_role_trans_vector) wrap_get_role_trans_vector; ++ const apol_vector_t *wrap_get_role_trans_vector() { + return poldiff_get_role_trans_vector(self); + }; +- const apol_vector_t *get_role_vector() { ++ %rename(get_role_vector) wrap_get_role_vector; ++ const apol_vector_t *wrap_get_role_vector() { + return poldiff_get_role_vector(self); + }; +- const apol_vector_t *get_terule_vector_change() { ++ %rename(get_terule_vector_change) wrap_get_terule_vector_change; ++ const apol_vector_t *wrap_get_terule_vector_change() { + return poldiff_get_terule_vector_change(self); + }; +- const apol_vector_t *get_terule_vector_member() { ++ %rename(get_terule_vector_member) wrap_get_terule_vector_member; ++ const apol_vector_t *wrap_get_terule_vector_member() { + return poldiff_get_terule_vector_member(self); + }; +- const apol_vector_t *get_terule_vector_trans() { ++ %rename(get_terule_vector_trans) wrap_get_terule_vector_trans; ++ const apol_vector_t *wrap_get_terule_vector_trans() { + return poldiff_get_terule_vector_trans(self); + }; +- const apol_vector_t *get_type_vector() { ++ %rename(get_type_vector) wrap_get_type_vector; ++ const apol_vector_t *wrap_get_type_vector() { + return poldiff_get_type_vector(self); + }; +- const apol_vector_t *get_user_vector() { ++ %rename(get_user_vector) wrap_get_user_vector; ++ const apol_vector_t *wrap_get_user_vector() { + return poldiff_get_user_vector(self); + }; +- const apol_vector_t *get_type_remap_entries() { ++ %rename(get_type_remap_entries) wrap_get_type_remap_entries; ++ const apol_vector_t *wrap_get_type_remap_entries() { + return poldiff_type_remap_get_entries(self); + }; +- void type_remap_create(apol_string_vector_t *orig_types, apol_string_vector_t *mod_types) { ++ %rename(type_remap_create) wrap_type_remap_create; ++ void wrap_type_remap_create(apol_string_vector_t *orig_types, apol_string_vector_t *mod_types) { + BEGIN_EXCEPTION + if (poldiff_type_remap_create(self, (apol_vector_t*)orig_types, (apol_vector_t*)mod_types)) { + SWIG_exception(SWIG_RuntimeError, "Could not remap types"); +@@ -478,19 +503,20 @@ typedef struct poldiff {} poldiff_t; + /* attribute diff */ + typedef struct poldiff_attrib {} poldiff_attrib_t; + %extend poldiff_attrib_t { +- poldiff_attrib_t () { ++ poldiff_attrib () { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_attrib_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_attrib_t() { ++ ~poldiff_attrib() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_attrib_to_string(p, self); +@@ -501,16 +527,20 @@ typedef struct poldiff_attrib {} poldiff_attrib_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_attrib_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_attrib_get_form(self); + }; +- const apol_string_vector_t *get_added_types() { ++ %rename(get_added_types) wrap_get_added_types; ++ const apol_string_vector_t *wrap_get_added_types() { + return (apol_string_vector_t*)poldiff_attrib_get_added_types(self); + }; +- const apol_string_vector_t *get_removed_types() { ++ %rename(get_removed_types) wrap_get_removed_types; ++ const apol_string_vector_t *wrap_get_removed_types() { + return (apol_string_vector_t*)poldiff_attrib_get_removed_types(self); + }; + }; +@@ -523,19 +553,20 @@ typedef struct poldiff_attrib {} poldiff_attrib_t; + /* av rule diff */ + typedef struct poldiff_avrule {} poldiff_avrule_t; + %extend poldiff_avrule_t { +- poldiff_avrule_t() { ++ poldiff_avrule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_avrule_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_avrule_t() { ++ ~poldiff_avrule() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_avrule_to_string(p, self); +@@ -546,22 +577,28 @@ typedef struct poldiff_avrule {} poldiff_avrule_t; + fail: + return str; + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_avrule_get_form(self); + }; +- uint32_t get_rule_type() { ++ %rename(get_rule_type) wrap_get_rule_type; ++ uint32_t wrap_get_rule_type() { + return poldiff_avrule_get_rule_type(self); + }; +- const char *get_source_type() { ++ %rename(get_source_type) wrap_get_source_type; ++ const char *wrap_get_source_type() { + return poldiff_avrule_get_source_type(self); + }; +- const char *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const char *wrap_get_target_type() { + return poldiff_avrule_get_target_type(self); + }; +- const char *get_object_class() { ++ %rename(get_object_class) wrap_get_object_class; ++ const char *wrap_get_object_class() { + return poldiff_avrule_get_object_class(self); + }; +- const qpol_cond_t *get_cond(poldiff_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(poldiff_t *p) { + const qpol_cond_t *cond; + uint32_t which_list; + const apol_policy_t *which_pol; +@@ -582,20 +619,25 @@ typedef struct poldiff_avrule {} poldiff_avrule_t; + poldiff_avrule_get_cond(p, self, &cond, &which_list, &which_pol); + return which_pol; + }; +- const apol_string_vector_t *get_unmodified_perms() { ++ %rename(get_unmodified_perms) wrap_get_unmodified_perms; ++ const apol_string_vector_t *wrap_get_unmodified_perms() { + return (apol_string_vector_t*)poldiff_avrule_get_unmodified_perms(self); + }; +- const apol_string_vector_t *get_added_perms() { ++ %rename(get_added_perms) wrap_get_added_perms; ++ const apol_string_vector_t *wrap_get_added_perms() { + return (apol_string_vector_t*)poldiff_avrule_get_added_perms(self); + }; +- const apol_string_vector_t *get_removed_perms() { ++ %rename(get_removed_perms) wrap_get_removed_perms; ++ const apol_string_vector_t *wrap_get_removed_perms() { + return (apol_string_vector_t*)poldiff_avrule_get_removed_perms(self); + }; +- const apol_vector_t *get_orig_line_numbers() { ++ %rename(get_orig_line_numbers) wrap_get_orig_line_numbers; ++ const apol_vector_t *wrap_get_orig_line_numbers() { + return poldiff_avrule_get_orig_line_numbers(self); + }; + %newobject get_orig_line_numbers_for_perm(poldiff_t*, char*); +- apol_vector_t *get_orig_line_numbers_for_perm(poldiff_t *p, char *perm) { ++ %rename(get_orig_line_numbers_for_perm) wrap_get_orig_line_numbers_for_perm; ++ apol_vector_t *wrap_get_orig_line_numbers_for_perm(poldiff_t *p, char *perm) { + apol_vector_t *v; + BEGIN_EXCEPTION + v = poldiff_avrule_get_orig_line_numbers_for_perm(p, self, perm); +@@ -606,11 +648,13 @@ typedef struct poldiff_avrule {} poldiff_avrule_t; + fail: + return v; + }; +- const apol_vector_t *get_mod_line_numbers() { ++ %rename(get_mod_line_numbers) wrap_get_mod_line_numbers; ++ const apol_vector_t *wrap_get_mod_line_numbers() { + return poldiff_avrule_get_mod_line_numbers(self); + }; + %newobject get_mod_line_numbers_for_perm(poldiff_t*, char*); +- apol_vector_t *get_mod_line_numbers_for_perm(poldiff_t *p, char *perm) { ++ %rename(get_mod_line_numbers_for_perm) wrap_get_mod_line_numbers_for_perm; ++ apol_vector_t *wrap_get_mod_line_numbers_for_perm(poldiff_t *p, char *perm) { + apol_vector_t *v; + BEGIN_EXCEPTION + v = poldiff_avrule_get_mod_line_numbers_for_perm(p, self, perm); +@@ -631,19 +675,20 @@ typedef struct poldiff_avrule {} poldiff_avrule_t; + /* boolean diff */ + typedef struct poldiff_bool {} poldiff_bool_t; + %extend poldiff_bool_t { +- poldiff_bool_t() { ++ poldiff_bool() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_bool_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_bool_t() { ++ ~poldiff_bool() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_bool_to_string(p, self); +@@ -654,10 +699,12 @@ typedef struct poldiff_bool {} poldiff_bool_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_bool_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_bool_get_form(self); + }; + }; +@@ -670,19 +717,20 @@ typedef struct poldiff_bool {} poldiff_bool_t; + /* category diff */ + typedef struct poldiff_cat {} poldiff_cat_t; + %extend poldiff_cat_t { +- poldiff_cat_t() { ++ poldiff_cat() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_cat_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_cat_t() { ++ ~poldiff_cat() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_cat_to_string(p, self); +@@ -693,10 +741,12 @@ typedef struct poldiff_cat {} poldiff_cat_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_cat_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_cat_get_form(self); + }; + }; +@@ -709,19 +759,20 @@ typedef struct poldiff_cat {} poldiff_cat_t; + /* class diff */ + typedef struct poldiff_class {} poldiff_class_t; + %extend poldiff_class_t { +- poldiff_class_t() { ++ poldiff_class() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_class_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_class_t() { ++ ~poldiff_class() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_class_to_string(p, self); +@@ -732,16 +783,20 @@ typedef struct poldiff_class {} poldiff_class_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_class_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_class_get_form(self); + }; +- const apol_string_vector_t *get_added_perms() { ++ %rename(get_added_perms) wrap_get_added_perms; ++ const apol_string_vector_t *wrap_get_added_perms() { + return (apol_string_vector_t*)poldiff_class_get_added_perms(self); + }; +- const apol_string_vector_t *get_removed_perms() { ++ %rename(get_removed_perms) wrap_get_removed_perms; ++ const apol_string_vector_t *wrap_get_removed_perms() { + return (apol_string_vector_t*)poldiff_class_get_removed_perms(self); + }; + }; +@@ -754,19 +809,20 @@ typedef struct poldiff_class {} poldiff_class_t; + /* common diff */ + typedef struct poldiff_common {} poldiff_common_t; + %extend poldiff_common_t { +- poldiff_common_t() { ++ poldiff_common() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_common_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_common_t() { ++ ~poldiff_common() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_common_to_string(p, self); +@@ -777,16 +833,20 @@ typedef struct poldiff_common {} poldiff_common_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_common_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_common_get_form(self); + }; +- const apol_string_vector_t *get_added_perms() { ++ %rename(get_added_perms) wrap_get_added_perms; ++ const apol_string_vector_t *wrap_get_added_perms() { + return (apol_string_vector_t*)poldiff_common_get_added_perms(self); + }; +- const apol_string_vector_t *get_removed_perms() { ++ %rename(get_removed_perms) wrap_get_removed_perms; ++ const apol_string_vector_t *wrap_get_removed_perms() { + return (apol_string_vector_t*)poldiff_common_get_removed_perms(self); + }; + }; +@@ -799,19 +859,20 @@ typedef struct poldiff_common {} poldiff_common_t; + /* level diff */ + typedef struct poldiff_level {} poldiff_level_t; + %extend poldiff_level_t { +- poldiff_level_t() { ++ poldiff_level() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_level_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_level_t() { ++ ~poldiff_level() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_level_to_string(p, self); +@@ -823,7 +884,8 @@ typedef struct poldiff_level {} poldiff_level_t; + return str; + }; + %newobject to_string_brief(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string_brief) wrap_to_string_brief; ++ char *wrap_to_string_brief(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_level_to_string_brief(p, self); +@@ -834,19 +896,24 @@ typedef struct poldiff_level {} poldiff_level_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_level_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_level_get_form(self); + }; +- const apol_string_vector_t *get_unmodified_cats() { ++ %rename(get_unmodified_cats) wrap_get_unmodified_cats; ++ const apol_string_vector_t *wrap_get_unmodified_cats() { + return (apol_string_vector_t*)poldiff_level_get_unmodified_cats(self); + }; +- const apol_string_vector_t *get_added_cats() { ++ %rename(get_added_cats) wrap_get_added_cats; ++ const apol_string_vector_t *wrap_get_added_cats() { + return (apol_string_vector_t*)poldiff_level_get_added_cats(self); + }; +- const apol_string_vector_t *get_removed_cats() { ++ %rename(get_removed_cats) wrap_get_removed_cats; ++ const apol_string_vector_t *wrap_get_removed_cats() { + return (apol_string_vector_t*)poldiff_level_get_removed_cats(self); + }; + }; +@@ -859,14 +926,14 @@ typedef struct poldiff_level {} poldiff_level_t; + /* range diff */ + typedef struct poldiff_range {} poldiff_range_t; + %extend poldiff_range_t { +- poldiff_range_t() { ++ poldiff_range() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_range_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_range_t() { ++ ~poldiff_range() { + /* no op */ + return; + }; +@@ -882,22 +949,28 @@ typedef struct poldiff_range {} poldiff_range_t; + fail: + return str; + }; +- const apol_vector_t *get_levels() { ++ %rename(get_levels) wrap_get_levels; ++ const apol_vector_t *wrap_get_levels() { + return poldiff_range_get_levels(self); + }; +- const apol_mls_range_t *get_original_range() { ++ %rename(get_original_range) wrap_get_original_range; ++ const apol_mls_range_t *wrap_get_original_range() { + return poldiff_range_get_original_range(self); + }; +- const apol_mls_range_t *get_modified_range() { ++ %rename(get_modified_range) wrap_get_modified_range; ++ const apol_mls_range_t *wrap_get_modified_range() { + return poldiff_range_get_modified_range(self); + }; +- const apol_string_vector_t *get_min_added_cats() { ++ %rename(get_min_added_cats) wrap_get_min_added_cats; ++ const apol_string_vector_t *wrap_get_min_added_cats() { + return (apol_string_vector_t*)poldiff_range_get_min_added_cats(self); + }; +- const apol_string_vector_t *get_min_removed_cats() { ++ %rename(get_min_removed_cats) wrap_get_min_removed_cats; ++ const apol_string_vector_t *wrap_get_min_removed_cats() { + return (apol_string_vector_t*)poldiff_range_get_min_removed_cats(self); + }; +- const apol_string_vector_t *get_min_unmodified_cats() { ++ %rename(get_min_unmodified_cats) wrap_get_min_unmodified_cats; ++ const apol_string_vector_t *wrap_get_min_unmodified_cats() { + return (apol_string_vector_t*)poldiff_range_get_min_unmodified_cats(self); + }; + }; +@@ -910,19 +983,20 @@ typedef struct poldiff_range {} poldiff_range_t; + /* range_transition rule diff */ + typedef struct poldiff_range_trans {} poldiff_range_trans_t; + %extend poldiff_range_trans_t { +- poldiff_range_trans_t() { ++ poldiff_range_trans() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_range_trans_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_range_trans_t() { ++ ~poldiff_range_trans() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_range_trans_to_string(p, self); +@@ -933,19 +1007,24 @@ typedef struct poldiff_range_trans {} poldiff_range_trans_t; + fail: + return str; + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_range_trans_get_form(self); + }; +- const char *get_source_type() { ++ %rename(get_source_type) wrap_get_source_type; ++ const char *wrap_get_source_type() { + return poldiff_range_trans_get_source_type(self); + }; +- const char *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const char *wrap_get_target_type() { + return poldiff_range_trans_get_target_type(self); + }; +- const char *get_target_class() { ++ %rename(get_target_class) wrap_get_target_class; ++ const char *wrap_get_target_class() { + return poldiff_range_trans_get_target_class(self); + }; +- const poldiff_range_t *get_range() { ++ %rename(get_range) wrap_get_range; ++ const poldiff_range_t *wrap_get_range() { + return poldiff_range_trans_get_range(self); + }; + }; +@@ -958,19 +1037,20 @@ typedef struct poldiff_range_trans {} poldiff_range_trans_t; + /* role allow rule diff */ + typedef struct poldiff_role_allow {} poldiff_role_allow_t; + %extend poldiff_role_allow_t { +- poldiff_role_allow_t() { ++ poldiff_role_allow() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_role_allow_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_role_allow_t() { ++ ~poldiff_role_allow() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_role_allow_to_string(p, self); +@@ -981,19 +1061,24 @@ typedef struct poldiff_role_allow {} poldiff_role_allow_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_role_allow_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_role_allow_get_form(self); + }; +- const apol_string_vector_t *get_unmodified_roles() { ++ %rename(get_unmodified_roles) wrap_get_unmodified_roles; ++ const apol_string_vector_t *wrap_get_unmodified_roles() { + return (apol_string_vector_t*)poldiff_role_allow_get_unmodified_roles(self); + }; +- const apol_string_vector_t *get_added_roles() { ++ %rename(get_added_roles) wrap_get_added_roles; ++ const apol_string_vector_t *wrap_get_added_roles() { + return (apol_string_vector_t*)poldiff_role_allow_get_added_roles(self); + }; +- const apol_string_vector_t *get_removed_roles() { ++ %rename(get_removed_roles) wrap_get_removed_roles; ++ const apol_string_vector_t *wrap_get_removed_roles() { + return (apol_string_vector_t*)poldiff_role_allow_get_removed_roles(self); + }; + }; +@@ -1006,19 +1091,20 @@ typedef struct poldiff_role_allow {} poldiff_role_allow_t; + /* role_transition rule diff */ + typedef struct poldiff_role_trans {} poldiff_role_trans_t; + %extend poldiff_role_trans_t { +- poldiff_role_trans_t() { ++ poldiff_role_trans() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_role_trans_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_role_trans_t() { ++ ~poldiff_role_trans() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_role_trans_to_string(p, self); +@@ -1029,19 +1115,24 @@ typedef struct poldiff_role_trans {} poldiff_role_trans_t; + fail: + return str; + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_role_trans_get_form(self); + }; +- const char *get_source_role() { ++ %rename(get_source_role) wrap_get_source_role; ++ const char *wrap_get_source_role() { + return poldiff_role_trans_get_source_role(self); + }; +- const char *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const char *wrap_get_target_type() { + return poldiff_role_trans_get_target_type(self); + }; +- const char *get_original_default() { ++ %rename(get_original_default) wrap_get_original_default; ++ const char *wrap_get_original_default() { + return poldiff_role_trans_get_original_default(self); + }; +- const char *get_modified_default() { ++ %rename(get_modified_default) wrap_get_modified_default; ++ const char *wrap_get_modified_default() { + return poldiff_role_trans_get_modified_default(self); + }; + }; +@@ -1054,19 +1145,20 @@ typedef struct poldiff_role_trans {} poldiff_role_trans_t; + /* role diff */ + typedef struct poldiff_role {} poldiff_role_t; + %extend poldiff_role_t { +- poldiff_role_t() { ++ poldiff_role() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_role_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_role_t() { ++ ~poldiff_role() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_role_to_string(p, self); +@@ -1077,16 +1169,20 @@ typedef struct poldiff_role {} poldiff_role_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_role_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_role_get_form(self); + }; +- const apol_string_vector_t *get_added_types() { ++ %rename(get_added_types) wrap_get_added_types; ++ const apol_string_vector_t *wrap_get_added_types() { + return (apol_string_vector_t*)poldiff_role_get_added_types(self); + }; +- const apol_string_vector_t *get_removed_types() { ++ %rename(get_removed_types) wrap_get_removed_types; ++ const apol_string_vector_t *wrap_get_removed_types() { + return (apol_string_vector_t*)poldiff_role_get_removed_types(self); + }; + }; +@@ -1099,19 +1195,20 @@ typedef struct poldiff_role {} poldiff_role_t; + /* te rule diff */ + typedef struct poldiff_terule {} poldiff_terule_t; + %extend poldiff_terule_t { +- poldiff_terule_t() { ++ poldiff_terule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_terule_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_terule_t() { ++ ~poldiff_terule() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_terule_to_string(p, self); +@@ -1122,22 +1219,28 @@ typedef struct poldiff_terule {} poldiff_terule_t; + fail: + return str; + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_terule_get_form(self); + }; +- uint32_t get_rule_type() { ++ %rename(get_rule_type) wrap_get_rule_type; ++ uint32_t wrap_get_rule_type() { + return poldiff_terule_get_rule_type(self); + }; +- const char *get_source_type() { ++ %rename(get_source_type) wrap_get_source_type; ++ const char *wrap_get_source_type() { + return poldiff_terule_get_source_type(self); + }; +- const char *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const char *wrap_get_target_type() { + return poldiff_terule_get_target_type(self); + }; +- const char *get_object_class() { ++ %rename(get_object_class) wrap_get_object_class; ++ const char *wrap_get_object_class() { + return poldiff_terule_get_object_class(self); + }; +- const qpol_cond_t *get_cond(poldiff_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(poldiff_t *p) { + const qpol_cond_t *cond; + uint32_t which_list; + const apol_policy_t *which_pol; +@@ -1158,16 +1261,20 @@ typedef struct poldiff_terule {} poldiff_terule_t; + poldiff_terule_get_cond(p, self, &cond, &which_list, &which_pol); + return which_pol; + }; +- const char *get_original_default() { ++ %rename(get_original_default) wrap_get_original_default; ++ const char *wrap_get_original_default() { + return poldiff_terule_get_original_default(self); + }; +- const char *get_modified_default() { ++ %rename(get_modified_default) wrap_get_modified_default; ++ const char *wrap_get_modified_default() { + return poldiff_terule_get_modified_default(self); + }; +- const apol_vector_t *get_orig_line_numbers() { ++ %rename(get_orig_line_numbers) wrap_get_orig_line_numbers; ++ const apol_vector_t *wrap_get_orig_line_numbers() { + return poldiff_terule_get_orig_line_numbers(self); + }; +- const apol_vector_t *get_mod_line_numbers() { ++ %rename(get_mod_line_numbers) wrap_get_mod_line_numbers; ++ const apol_vector_t *wrap_get_mod_line_numbers() { + return poldiff_terule_get_mod_line_numbers(self); + }; + }; +@@ -1180,19 +1287,20 @@ typedef struct poldiff_terule {} poldiff_terule_t; + /* type diff */ + typedef struct poldiff_type {} poldiff_type_t; + %extend poldiff_type_t { +- poldiff_type_t() { ++ poldiff_type() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_type_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_type_t() { ++ ~poldiff_type() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_type_to_string(p, self); +@@ -1203,16 +1311,20 @@ typedef struct poldiff_type {} poldiff_type_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_type_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_type_get_form(self); + }; +- const apol_string_vector_t *get_added_attribs() { ++ %rename(get_added_attribs) wrap_get_added_attribs; ++ const apol_string_vector_t *wrap_get_added_attribs() { + return (apol_string_vector_t*)poldiff_type_get_added_attribs(self); + }; +- const apol_string_vector_t *get_removed_attribs() { ++ %rename(get_removed_attribs) wrap_get_removed_attribs; ++ const apol_string_vector_t *wrap_get_removed_attribs() { + return (apol_string_vector_t*)poldiff_type_get_removed_attribs(self); + }; + }; +@@ -1225,19 +1337,20 @@ typedef struct poldiff_type {} poldiff_type_t; + /* user diff */ + typedef struct poldiff_user {} poldiff_user_t; + %extend poldiff_user_t { +- poldiff_user_t() { ++ poldiff_user() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_user_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_user_t() { ++ ~poldiff_user() { + /* no op */ + return; + }; + %newobject to_string(poldiff_t*); +- char *to_string(poldiff_t *p) { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string(poldiff_t *p) { + char *str; + BEGIN_EXCEPTION + str = poldiff_user_to_string(p, self); +@@ -1248,28 +1361,36 @@ typedef struct poldiff_user {} poldiff_user_t; + fail: + return str; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return poldiff_user_get_name(self); + }; +- poldiff_form_e get_form() { ++ %rename(get_form) wrap_get_form; ++ poldiff_form_e wrap_get_form() { + return poldiff_user_get_form(self); + }; +- const apol_string_vector_t *get_unmodified_roles() { ++ %rename(get_unmodified_roles) wrap_get_unmodified_roles; ++ const apol_string_vector_t *wrap_get_unmodified_roles() { + return (apol_string_vector_t*)poldiff_user_get_unmodified_roles(self); + }; +- const apol_string_vector_t *get_added_roles() { ++ %rename(get_added_roles) wrap_get_added_roles; ++ const apol_string_vector_t *wrap_get_added_roles() { + return (apol_string_vector_t*)poldiff_user_get_added_roles(self); + }; +- const apol_string_vector_t *get_removed_roles() { ++ %rename(get_removed_roles) wrap_get_removed_roles; ++ const apol_string_vector_t *wrap_get_removed_roles() { + return (apol_string_vector_t*)poldiff_user_get_removed_roles(self); + }; +- const poldiff_level_t *get_original_dfltlevel() { ++ %rename(get_original_dfltlevel) wrap_get_original_dfltlevel; ++ const poldiff_level_t *wrap_get_original_dfltlevel() { + return poldiff_user_get_original_dfltlevel(self); + }; +- const poldiff_level_t *get_modified_dfltlevel() { ++ %rename(get_modified_dfltlevel) wrap_get_modified_dfltlevel; ++ const poldiff_level_t *wrap_get_modified_dfltlevel() { + return poldiff_user_get_modified_dfltlevel(self); + }; +- const poldiff_range_t *get_range() { ++ %rename(get_range) wrap_get_range; ++ const poldiff_range_t *wrap_get_range() { + return poldiff_user_get_range(self); + }; + }; +@@ -1282,19 +1403,20 @@ typedef struct poldiff_user {} poldiff_user_t; + /* type remap */ + typedef struct poldiff_type_remap_entry {} poldiff_type_remap_entry_t; + %extend poldiff_type_remap_entry_t { +- poldiff_type_remap_entry_t() { ++ poldiff_type_remap_entry() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create poldiff_type_remap_entry_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~poldiff_type_remap_entry_t() { ++ ~poldiff_type_remap_entry() { + /* no op */ + return; + }; + %newobject get_original_types(poldiff_t*); +- apol_string_vector_t *get_original_types(poldiff_t *p) { ++ %rename(get_original_types) wrap_get_original_types; ++ apol_string_vector_t *wrap_get_original_types(poldiff_t *p) { + apol_vector_t *v; + BEGIN_EXCEPTION + v = poldiff_type_remap_entry_get_original_types(p, self); +@@ -1306,7 +1428,8 @@ typedef struct poldiff_type_remap_entry {} poldiff_type_remap_entry_t; + return (apol_string_vector_t*)v; + }; + %newobject get_modified_types(poldiff_t*); +- apol_string_vector_t *get_modified_types(poldiff_t *p) { ++ %rename(get_modified_types) wrap_get_modified_types; ++ apol_string_vector_t *wrap_get_modified_types(poldiff_t *p) { + apol_vector_t *v; + BEGIN_EXCEPTION + v = poldiff_type_remap_entry_get_modified_types(p, self); +@@ -1317,13 +1440,16 @@ typedef struct poldiff_type_remap_entry {} poldiff_type_remap_entry_t; + fail: + return (apol_string_vector_t*)v; + }; +- int get_is_inferred() { ++ %rename(get_is_inferred) wrap_get_is_inferred; ++ int wrap_get_is_inferred() { + return poldiff_type_remap_entry_get_is_inferred(self); + }; +- int get_is_enabled() { ++ %rename(get_is_enabled) wrap_get_is_enabled; ++ int wrap_get_is_enabled() { + return poldiff_type_remap_entry_get_is_enabled(self); + }; +- void set_enabled(int enable) { ++ %rename(set_enabled) wrap_set_enabled; ++ void wrap_set_enabled(int enable) { + poldiff_type_remap_entry_set_enabled(self, enable); + }; + }; +diff --git a/libqpol/include/qpol/Makefile.am b/libqpol/include/qpol/Makefile.am +index 9b570e1..cfd4b12 100644 +--- a/libqpol/include/qpol/Makefile.am ++++ b/libqpol/include/qpol/Makefile.am +@@ -7,6 +7,7 @@ qpol_HEADERS = \ + cond_query.h \ + constraint_query.h \ + context_query.h \ ++ default_object_query.h \ + fs_use_query.h \ + genfscon_query.h \ + isid_query.h \ +@@ -17,6 +18,7 @@ qpol_HEADERS = \ + netifcon_query.h \ + nodecon_query.h \ + permissive_query.h \ ++ bounds_query.h \ + polcap_query.h \ + policy.h \ + policy_extend.h \ +diff --git a/libqpol/include/qpol/bounds_query.h b/libqpol/include/qpol/bounds_query.h +new file mode 100644 +index 0000000..da5e525 +--- /dev/null ++++ b/libqpol/include/qpol/bounds_query.h +@@ -0,0 +1,162 @@ ++/** ++ * @file ++ * Defines the public interface for searching and iterating over the permissive types. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2009 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#ifndef QPOL_BOUNDS_QUERY_H ++#define QPOL_BOUNDS_QUERY_H ++ ++#ifdef __cplusplus ++extern "C" ++{ ++#endif ++ ++#include ++#include ++#include ++#include ++ ++ ++ /************ TYPEBOUNDS *************/ ++ typedef struct qpol_typebounds qpol_typebounds_t; ++ ++/** ++ * Get an iterator for the typebounds types in a policy. ++ * @param policy The policy from which to create the iterator. ++ * @param iter Iterator over items of type qpol_isid_t returned. ++ * The caller is responsible for calling qpol_iterator_destroy ++ * to free memory used by this iterator. ++ * It is important to note that this iterator is only valid as long ++ * as the policy is unmodified. ++ * @return 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *iter will be NULL. ++ */ ++ extern int qpol_policy_get_typebounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter); ++ ++ ++/** ++ * Get the name which identifies a typebounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum typebounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_typebounds_get_parent_name(const qpol_policy_t *policy, const qpol_typebounds_t *datum, const char **name); ++ ++/** ++ * Get the name which identifies a typebounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum typebounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_typebounds_get_child_name(const qpol_policy_t *policy, const qpol_typebounds_t *datum, const char **name); ++ ++ /************ ROLEBOUNDS *************/ ++ typedef struct qpol_rolebounds qpol_rolebounds_t; ++ ++/** ++ * Get an iterator for the rolebounds types in a policy. ++ * @param policy The policy from which to create the iterator. ++ * @param iter Iterator over items of type qpol_isid_t returned. ++ * The caller is responsible for calling qpol_iterator_destroy ++ * to free memory used by this iterator. ++ * It is important to note that this iterator is only valid as long ++ * as the policy is unmodified. ++ * @return 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *iter will be NULL. ++ */ ++ extern int qpol_policy_get_rolebounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter); ++ ++ ++/** ++ * Get the name which identifies a rolebounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum rolebounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_rolebounds_get_parent_name(const qpol_policy_t *policy, const qpol_rolebounds_t *datum, const char **name); ++ ++/** ++ * Get the name which identifies a rolebounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum rolebounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_rolebounds_get_child_name(const qpol_policy_t *policy, const qpol_rolebounds_t *datum, const char **name); ++ ++ /************ USERBOUNDS *************/ ++ typedef struct qpol_userbounds qpol_userbounds_t; ++ ++/** ++ * Get an iterator for the userbounds types in a policy. ++ * @param policy The policy from which to create the iterator. ++ * @param iter Iterator over items of type qpol_isid_t returned. ++ * The caller is responsible for calling qpol_iterator_destroy ++ * to free memory used by this iterator. ++ * It is important to note that this iterator is only valid as long ++ * as the policy is unmodified. ++ * @return 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *iter will be NULL. ++ */ ++ extern int qpol_policy_get_userbounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter); ++ ++ ++/** ++ * Get the name which identifies a userbounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum userbounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_userbounds_get_parent_name(const qpol_policy_t *policy, const qpol_userbounds_t *datum, const char **name); ++ ++/** ++ * Get the name which identifies a userbounds type from its datum. ++ * @param policy The policy with which the type bounds type is associated. ++ * @param datum userbounds datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_userbounds_get_child_name(const qpol_policy_t *policy, const qpol_userbounds_t *datum, const char **name); ++ ++ ++ ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif /* QPOL_BOUNDS_QUERY_H */ +diff --git a/libqpol/include/qpol/default_object_query.h b/libqpol/include/qpol/default_object_query.h +new file mode 100644 +index 0000000..e077287 +--- /dev/null ++++ b/libqpol/include/qpol/default_object_query.h +@@ -0,0 +1,113 @@ ++/** ++ * @file ++ * Defines the public interface for searching and iterating over default objects. ++ * ++ * @author Richard Haines richard_c_haines@btinternet.com ++ * ++ * Copyright (C) 2006-2009 Tresys Technology, LLC ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++ */ ++ ++#ifndef QPOL_DEFAULT_OBJECT_QUERY_H ++#define QPOL_DEFAULT_OBJECT_QUERY_H ++ ++#ifdef __cplusplus ++extern "C" ++{ ++#endif ++ ++#include ++#include ++#include ++#include ++ ++ ++ typedef struct qpol_default_object qpol_default_object_t; ++ ++/** ++ * Get an iterator for the default_object types in a policy. ++ * @param policy The policy from which to create the iterator. ++ * @param iter Iterator over items of type qpol_isid_t returned. ++ * The caller is responsible for calling qpol_iterator_destroy ++ * to free memory used by this iterator. ++ * It is important to note that this iterator is only valid as long ++ * as the policy is unmodified. ++ * @return 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *iter will be NULL. ++ */ ++ extern int qpol_policy_get_default_object_iter(const qpol_policy_t *policy, qpol_iterator_t **iter); ++ ++/** ++ * Get the name which identifies a default_object class from its datum. ++ * @param policy The policy with which class is associated. ++ * @param datum default_object datum for which to get the name. Must be non-NULL. ++ * @param name Pointer to the string in which to store the name. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *name will be NULL. ++ */ ++ extern int qpol_default_object_get_class(const qpol_policy_t *policy, const qpol_default_object_t *datum, const char **name); ++ ++/** ++ * Get the value of a default user source/dest from its datum. ++ * @param policy The policy with which the default object is associated. ++ * @param datum default_object datum for which to get the value. Must be non-NULL. ++ * @param default Pointer to the value in which to store the default. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *default will be 0. ++ */ ++ extern int qpol_default_object_get_user_default(const qpol_policy_t *policy, const qpol_default_object_t *datum, const char **value); ++ ++/** ++ * Get the value of a default role source/dest from its datum. ++ * @param policy The policy with which the default object type is associated. ++ * @param datum default_object datum for which to get the value. Must be non-NULL. ++ * @param default Pointer to the value in which to store the default. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *default will be 0. ++ */ ++ extern int qpol_default_object_get_role_default(const qpol_policy_t *policy, const qpol_default_object_t *datum, const char **value); ++ ++/** ++ * Get the value of a default type source/dest from its datum. ++ * @param policy The policy with which the default object type is associated. ++ * @param datum default_object datum for which to get the value. Must be non-NULL. ++ * @param default Pointer to the value in which to store the default. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *default will be 0. ++ */ ++ extern int qpol_default_object_get_type_default(const qpol_policy_t *policy, const qpol_default_object_t *datum, const char **value); ++ ++/** ++ * Get the value of a default range source/dest from its datum. ++ * @param policy The policy with which the default object type is associated. ++ * @param datum default_object datum for which to get the value. Must be non-NULL. ++ * @param default Pointer to the value in which to store the default. ++ * Must be non-NULL. The caller should not free the string. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *default will be 0. ++ */ ++ extern int qpol_default_object_get_range_default(const qpol_policy_t *policy, const qpol_default_object_t *datum, const char **value); ++ ++ ++#ifdef __cplusplus ++} ++#endif ++ ++#endif +diff --git a/libqpol/include/qpol/policy.h b/libqpol/include/qpol/policy.h +index bf85718..4e01cdb 100644 +--- a/libqpol/include/qpol/policy.h ++++ b/libqpol/include/qpol/policy.h +@@ -52,6 +52,8 @@ extern "C" + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -117,7 +119,18 @@ extern "C" + /** The policy source may be displayed. */ + QPOL_CAP_SOURCE, + /** The policy supports and was loaded with neverallow rules. */ +- QPOL_CAP_NEVERALLOW ++ QPOL_CAP_NEVERALLOW, ++ /** The policy supports bounds rules. */ ++ QPOL_CAP_BOUNDS, ++ /** The policy supports default object rules. */ ++ QPOL_CAP_DEFAULT_OBJECTS, ++ QPOL_CAP_DEFAULT_TYPE, ++ /** The policy supports permissive types. */ ++ QPOL_CAP_PERMISSIVE, ++ /** The policy supports filename type_transition rules. */ ++ QPOL_CAP_FILENAME_TRANS, ++ /** The policy supports role transition rules. */ ++ QPOL_CAP_ROLETRANS + } qpol_capability_e; + + /** +@@ -255,6 +268,15 @@ extern "C" + */ + extern int qpol_policy_has_capability(const qpol_policy_t * policy, qpol_capability_e cap); + ++/** ++ * Get the handle_unknown classes/perms flag for the policy. ++ * @param policy The policy for which to get the version. ++ * @param handle_unknown Pointer to the integer to set to the version number. ++ * @return Returns 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *handle_unknown will be 0. ++ */ ++ extern int qpol_policy_get_policy_handle_unknown(const qpol_policy_t * policy, unsigned int *handle_unknown); ++ + #ifdef __cplusplus + } + #endif +diff --git a/libqpol/include/qpol/rbacrule_query.h b/libqpol/include/qpol/rbacrule_query.h +index 342e597..cb26600 100644 +--- a/libqpol/include/qpol/rbacrule_query.h ++++ b/libqpol/include/qpol/rbacrule_query.h +@@ -112,6 +112,17 @@ extern "C" + const qpol_type_t ** target); + + /** ++ * Get the object class from a role transition rule. ++ * @param rule The rule from which to get the object class. ++ * @param obj_class Pointer in which to store the object class. ++ * The caller should not free this pointer. ++ * @return 0 on success and < 0 on failure; if the call fails, ++ * errno will be set and *target will be NULL. ++ */ ++ extern int qpol_role_trans_get_object_class(const qpol_policy_t * policy, const qpol_role_trans_t * rule, ++ const qpol_class_t ** obj_class); ++ ++/** + * Get the default role from a role transition rule. + * @param policy The policy from which the rule comes. + * @param rule The rule from which to get the default role. +diff --git a/libqpol/src/Makefile.am b/libqpol/src/Makefile.am +index 0889a61..77213f4 100644 +--- a/libqpol/src/Makefile.am ++++ b/libqpol/src/Makefile.am +@@ -21,6 +21,7 @@ libqpol_a_SOURCES = \ + cond_query.c \ + constraint_query.c \ + context_query.c \ ++ default_object_query.c \ + expand.c \ + expand.h \ + fs_use_query.c \ +@@ -35,6 +36,7 @@ libqpol_a_SOURCES = \ + netifcon_query.c \ + nodecon_query.c \ + permissive_query.c \ ++ bounds_query.c \ + polcap_query.c \ + policy.c \ + policy_define.c policy_define.h \ +diff --git a/libqpol/src/bounds_query.c b/libqpol/src/bounds_query.c +new file mode 100644 +index 0000000..c3eb020 +--- /dev/null ++++ b/libqpol/src/bounds_query.c +@@ -0,0 +1,332 @@ ++/** ++* @file ++* Defines the public interface for searching and iterating over the permissive types. ++* ++* @author Richard Haines richard_c_haines@btinternet.com ++* ++* Copyright (C) 2006-2007 Tresys Technology, LLC ++* ++* This library is free software; you can redistribute it and/or ++* modify it under the terms of the GNU Lesser General Public ++* License as published by the Free Software Foundation; either ++* version 2.1 of the License, or (at your option) any later version. ++* ++* This library is distributed in the hope that it will be useful, ++* but WITHOUT ANY WARRANTY; without even the implied warranty of ++* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++* Lesser General Public License for more details. ++* ++* You should have received a copy of the GNU Lesser General Public ++* License along with this library; if not, write to the Free Software ++* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++*/ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include "qpol_internal.h" ++#include "iterator_internal.h" ++ ++ /************ TYPEBOUNDS *************/ ++int qpol_typebounds_get_parent_name(const qpol_policy_t *policy, const qpol_typebounds_t * datum, const char **name) ++{ ++ type_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (type_datum_t *)datum; ++ ++ /* This will be zero if not a typebounds statement */ ++ if (internal_datum->flavor == TYPE_TYPE && internal_datum->bounds != 0) { ++ *name = db->p_type_val_to_name[internal_datum->bounds - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_typebounds_get_child_name(const qpol_policy_t *policy, const qpol_typebounds_t * datum, const char **name) ++{ ++ type_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (type_datum_t *)datum; ++ ++ if (internal_datum->flavor == TYPE_TYPE && internal_datum->bounds != 0) { ++ *name = db->p_type_val_to_name[internal_datum->s.value - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++/* As type bounds are in types use these, however will need to calc number of bounds manually in top.tcl*/ ++int qpol_policy_get_typebounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter) ++{ ++ policydb_t *db; ++ int error = 0; ++ hash_state_t *hs = NULL; ++ ++ if (policy == NULL || iter == NULL) { ++ if (iter != NULL) ++ *iter = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++/* ++ struct type_datum *type; ++ size_t i; ++ int count = 0; ++ ++ for (i = 0; i < db->p_types.nprim - 1; i++) { ++ type = db->type_val_to_struct[i]; ++ if (type->flavor == TYPE_TYPE && type->bounds != 0) { ++ printf("PARENT DOMAIN: %s\n", db->p_type_val_to_name[type->bounds - 1]); ++ printf("CHILD NAME: %s\n", db->p_type_val_to_name[type->s.value - 1]); ++ count++; ++ } ++ } ++ printf("Type Bounds count: %d\n", count); ++*/ ++ hs = calloc(1, sizeof(hash_state_t)); ++ if (hs == NULL) { ++ error = errno; ++ ERR(policy, "%s", strerror(ENOMEM)); ++ errno = error; ++ return STATUS_ERR; ++ } ++ hs->table = &db->p_types.table; ++ hs->node = (*(hs->table))->htable[0]; ++ ++ if (qpol_iterator_create(policy, (void *)hs, hash_state_get_cur, ++ hash_state_next, hash_state_end, hash_state_size, free, iter)) { ++ free(hs); ++ return STATUS_ERR; ++ } ++ ++ if (hs->node == NULL) ++ hash_state_next(*iter); ++ ++ return STATUS_SUCCESS; ++} ++ ++ /************ ROLEBOUNDS *************/ ++int qpol_rolebounds_get_parent_name(const qpol_policy_t *policy, const qpol_rolebounds_t * datum, const char **name) ++{ ++ role_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (role_datum_t *)datum; ++ ++ /* This will be zero if not a rolebounds statement */ ++ if (internal_datum->flavor == ROLE_ROLE && internal_datum->bounds != 0) { ++ *name = db->p_role_val_to_name[internal_datum->bounds - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_rolebounds_get_child_name(const qpol_policy_t *policy, const qpol_rolebounds_t * datum, const char **name) ++{ ++ role_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (role_datum_t *)datum; ++ ++ if (internal_datum->flavor == ROLE_ROLE && internal_datum->bounds != 0) { ++ *name = db->p_role_val_to_name[internal_datum->s.value - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++/* As rolebounds are in roles use these, however will need to calc number of bounds manually in top.tcl*/ ++int qpol_policy_get_rolebounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter) ++{ ++ policydb_t *db; ++ int error = 0; ++ hash_state_t *hs = NULL; ++ ++ if (policy == NULL || iter == NULL) { ++ if (iter != NULL) ++ *iter = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++ ++ hs = calloc(1, sizeof(hash_state_t)); ++ if (hs == NULL) { ++ error = errno; ++ ERR(policy, "%s", strerror(ENOMEM)); ++ errno = error; ++ return STATUS_ERR; ++ } ++ hs->table = &db->p_roles.table; ++ hs->node = (*(hs->table))->htable[0]; ++ ++ if (qpol_iterator_create(policy, (void *)hs, hash_state_get_cur, ++ hash_state_next, hash_state_end, hash_state_size, free, iter)) { ++ free(hs); ++ return STATUS_ERR; ++ } ++ ++ if (hs->node == NULL) ++ hash_state_next(*iter); ++ ++ return STATUS_SUCCESS; ++} ++ ++ /************ USERBOUNDS *************/ ++int qpol_userbounds_get_parent_name(const qpol_policy_t *policy, const qpol_userbounds_t * datum, const char **name) ++{ ++ user_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (user_datum_t *)datum; ++ ++ /* This will be zero if not a userbounds statement */ ++ if (internal_datum->bounds != 0) { ++ *name = db->p_user_val_to_name[internal_datum->bounds - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_userbounds_get_child_name(const qpol_policy_t *policy, const qpol_userbounds_t * datum, const char **name) ++{ ++ user_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ /* The bounds rules started in ver 24 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_BOUNDS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (user_datum_t *)datum; ++ ++ if (internal_datum->bounds != 0) { ++ *name = db->p_user_val_to_name[internal_datum->s.value - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++/* As userbounds are in users use these, however will need to calc number of bounds manually in top.tcl*/ ++int qpol_policy_get_userbounds_iter(const qpol_policy_t *policy, qpol_iterator_t **iter) ++{ ++ policydb_t *db; ++ int error = 0; ++ hash_state_t *hs = NULL; ++ ++ if (policy == NULL || iter == NULL) { ++ if (iter != NULL) ++ *iter = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++ ++ hs = calloc(1, sizeof(hash_state_t)); ++ if (hs == NULL) { ++ error = errno; ++ ERR(policy, "%s", strerror(ENOMEM)); ++ errno = error; ++ return STATUS_ERR; ++ } ++ hs->table = &db->p_users.table; ++ hs->node = (*(hs->table))->htable[0]; ++ ++ if (qpol_iterator_create(policy, (void *)hs, hash_state_get_cur, ++ hash_state_next, hash_state_end, hash_state_size, free, iter)) { ++ free(hs); ++ return STATUS_ERR; ++ } ++ ++ if (hs->node == NULL) ++ hash_state_next(*iter); ++ ++ return STATUS_SUCCESS; ++} ++ +diff --git a/libqpol/src/constraint_query.c b/libqpol/src/constraint_query.c +index 1545ad7..28111b7 100644 +--- a/libqpol/src/constraint_query.c ++++ b/libqpol/src/constraint_query.c +@@ -778,9 +778,16 @@ int qpol_constraint_expr_node_get_names_iter(const qpol_policy_t * policy, const + errno = ENOMEM; + return STATUS_ERR; + } ++ ++ int policy_version; ++ if (qpol_policy_get_policy_version(policy, &policy_version)) ++ return STATUS_ERR; ++ + if (internal_expr->attr & QPOL_CEXPR_SYM_TYPE) { +- if (policy_type == QPOL_POLICY_KERNEL_BINARY) { ++ if (policy_type == QPOL_POLICY_KERNEL_BINARY && policy_version <= 28) { + cns->inc = &(internal_expr->names); ++ } else if (policy_type == QPOL_POLICY_KERNEL_BINARY && policy_version > 28) { ++ cns->inc = &(internal_expr->type_names->types); + } else { + cns->inc = &(internal_expr->type_names->types); + cns->sub = &(internal_expr->type_names->negset); +diff --git a/libqpol/src/default_object_query.c b/libqpol/src/default_object_query.c +new file mode 100644 +index 0000000..4143674 +--- /dev/null ++++ b/libqpol/src/default_object_query.c +@@ -0,0 +1,281 @@ ++/** ++* @file ++* Defines the public interface for searching and iterating over default objects. ++* ++* @author Richard Haines richard_c_haines@btinternet.com ++* ++* Copyright (C) 2006-2007 Tresys Technology, LLC ++* ++* This library is free software; you can redistribute it and/or ++* modify it under the terms of the GNU Lesser General Public ++* License as published by the Free Software Foundation; either ++* version 2.1 of the License, or (at your option) any later version. ++* ++* This library is distributed in the hope that it will be useful, ++* but WITHOUT ANY WARRANTY; without even the implied warranty of ++* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++* Lesser General Public License for more details. ++* ++* You should have received a copy of the GNU Lesser General Public ++* License along with this library; if not, write to the Free Software ++* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ++*/ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include "qpol_internal.h" ++#include "iterator_internal.h" ++ ++int qpol_default_object_get_class(const qpol_policy_t *policy, const qpol_default_object_t * datum, const char **name) ++{ ++ class_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || name == NULL) { ++ if (name != NULL) ++ *name = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *name = NULL; ++ ++ db = &policy->p->p; ++ internal_datum = (class_datum_t *)datum; ++ ++ /* These will be zero if no default_objects set */ ++ if (internal_datum->default_user || internal_datum->default_role || ++ internal_datum->default_type || ++ internal_datum->default_range) { ++ *name = db->p_class_val_to_name[internal_datum->s.value - 1]; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_default_object_get_user_default(const qpol_policy_t *policy, const qpol_default_object_t * datum, const char **value) ++{ ++ class_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || value == NULL) { ++ if (value != NULL) ++ *value = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *value = NULL; ++ ++ /* The user default started in ver 27 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_DEFAULT_OBJECTS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (class_datum_t *)datum; ++ ++ if (internal_datum->default_user == DEFAULT_SOURCE) { ++ *value = "source"; ++ } else if (internal_datum->default_user == DEFAULT_TARGET) { ++ *value = "target"; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_default_object_get_role_default(const qpol_policy_t *policy, const qpol_default_object_t * datum, const char **value) ++{ ++ class_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || value == NULL) { ++ if (value != NULL) ++ *value = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *value = NULL; ++ ++ /* The role default started in ver 27 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_DEFAULT_OBJECTS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (class_datum_t *)datum; ++ ++ if (internal_datum->default_role == DEFAULT_SOURCE) { ++ *value = "source"; ++ } else if (internal_datum->default_role == DEFAULT_TARGET) { ++ *value = "target"; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_default_object_get_type_default(const qpol_policy_t *policy, const qpol_default_object_t * datum, const char **value) ++{ ++ class_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || value == NULL) { ++ if (value != NULL) ++ *value = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *value = NULL; ++ ++ /* The type default started in ver 28 */ ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_DEFAULT_TYPE)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (class_datum_t *)datum; ++ ++ if (internal_datum->default_type == DEFAULT_SOURCE) { ++ *value = "source"; ++ } else if (internal_datum->default_type == DEFAULT_TARGET) { ++ *value = "target"; ++ } ++ return STATUS_SUCCESS; ++} ++ ++int qpol_default_object_get_range_default(const qpol_policy_t *policy, const qpol_default_object_t * datum, const char **value) ++{ ++ class_datum_t *internal_datum = NULL; ++ policydb_t *db = NULL; ++ ++ if (policy == NULL || datum == NULL || value == NULL) { ++ if (value != NULL) ++ *value = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ *value = NULL; ++ ++ /* The range default started in ver 27 */ ++ int policy_version; ++ if (!qpol_policy_has_capability(policy, QPOL_CAP_DEFAULT_OBJECTS)) ++ return STATUS_SUCCESS; ++ ++ db = &policy->p->p; ++ internal_datum = (class_datum_t *)datum; ++ ++ switch (internal_datum->default_range) { ++ case DEFAULT_SOURCE_LOW: ++ *value = "source low"; ++ break; ++ case DEFAULT_SOURCE_HIGH: ++ *value = "source high"; ++ break; ++ case DEFAULT_SOURCE_LOW_HIGH: ++ *value = "source low_high"; ++ break; ++ case DEFAULT_TARGET_LOW: ++ *value = "target low"; ++ break; ++ case DEFAULT_TARGET_HIGH: ++ *value = "target high"; ++ break; ++ case DEFAULT_TARGET_LOW_HIGH: ++ *value = "target low_high"; ++ break; ++ default: ++ break; ++ } ++ return STATUS_SUCCESS; ++} ++ ++/* As default objects are in classes use these, however will need to calc number of default objects manually in top.tcl*/ ++int qpol_policy_get_default_object_iter(const qpol_policy_t *policy, qpol_iterator_t **iter) ++{ ++ policydb_t *db; ++ int error = 0; ++ hash_state_t *hs = NULL; ++ ++ if (policy == NULL || iter == NULL) { ++ if (iter != NULL) ++ *iter = NULL; ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++/* ++ class_datum_t *cladatum; ++ sepol_security_class_t tclass; ++ char *class; ++ ++ for (tclass = 1; tclass <= db->p_classes.nprim; tclass++) { ++ cladatum = db->class_val_to_struct[tclass - 1]; ++ class = db->p_class_val_to_name[tclass - 1]; ++ ++ if (cladatum->default_user == DEFAULT_SOURCE) { ++ printf("default_user %s source;\n", class); ++ } else if (cladatum->default_user == DEFAULT_TARGET) { ++ printf("default_user %s target;\n", class); ++ } ++ ++ if (cladatum->default_role == DEFAULT_SOURCE) { ++ printf("default_role %s source;\n", class); ++ } else if (cladatum->default_role == DEFAULT_TARGET) { ++ printf("default_role %s target;\n", class); ++ } ++ ++ if (cladatum->default_type == DEFAULT_SOURCE) { ++ printf("default_type %s source;\n", class); ++ } else if (cladatum->default_type == DEFAULT_TARGET) { ++ printf("default_type %s target;\n", class); ++ } ++ ++ switch (cladatum->default_range) { ++ case DEFAULT_SOURCE_LOW: ++ printf("default_range %s source low;\n", class); ++ break; ++ case DEFAULT_SOURCE_HIGH: ++ printf("default_range %s source high;\n", class); ++ break; ++ case DEFAULT_SOURCE_LOW_HIGH: ++ printf("default_range %s source low_high;\n", class); ++ break; ++ case DEFAULT_TARGET_LOW: ++ printf("default_range %s target low;\n", class); ++ break; ++ case DEFAULT_TARGET_HIGH: ++ printf("default_range %s target high;\n", class); ++ break; ++ case DEFAULT_TARGET_LOW_HIGH: ++ printf("default_range %s target low_high;\n", class); ++ break; ++ default: ++ break; ++ } ++ } ++*/ ++ hs = calloc(1, sizeof(hash_state_t)); ++ if (hs == NULL) { ++ error = errno; ++ ERR(policy, "%s", strerror(ENOMEM)); ++ errno = error; ++ return STATUS_ERR; ++ } ++ hs->table = &db->p_classes.table; ++ hs->node = (*(hs->table))->htable[0]; ++ ++ if (qpol_iterator_create(policy, (void *)hs, hash_state_get_cur, ++ hash_state_next, hash_state_end, hash_state_size, free, iter)) { ++ free(hs); ++ return STATUS_ERR; ++ } ++ ++ if (hs->node == NULL) ++ hash_state_next(*iter); ++ ++ return STATUS_SUCCESS; ++} +diff --git a/libqpol/src/libqpol.map b/libqpol/src/libqpol.map +index 6973cca..1e80308 100644 +--- a/libqpol/src/libqpol.map ++++ b/libqpol/src/libqpol.map +@@ -63,12 +63,17 @@ VERS_1.3 { + VERS_1.4 { + global: + qpol_type_get_ispermissive; ++ qpol_type_get_parent_name; + } VERS_1.3; + + VERS_1.5 { + global: + qpol_policy_permissive_*; + qpol_permissive_*; ++ qpol_typebounds_*; ++ qpol_rolebounds_*; ++ qpol_userbounds_*; + qpol_policy_polcap_*; + qpol_polcap_*; ++ qpol_default_object_*; + } VERS_1.4; +diff --git a/libqpol/src/module_compiler.c b/libqpol/src/module_compiler.c +index b06e285..b00d97e 100644 +--- a/libqpol/src/module_compiler.c ++++ b/libqpol/src/module_compiler.c +@@ -14,6 +14,7 @@ + * the Free Software Foundation, version 2. + */ + ++/* Required for SETools libqpol services */ + #include + + #include +@@ -28,21 +29,19 @@ + #include "queue.h" + #include "module_compiler.h" + +-union stack_item_u +-{ ++union stack_item_u { + avrule_block_t *avrule; + cond_list_t *cond_list; + }; + +-typedef struct scope_stack +-{ ++typedef struct scope_stack { + union stack_item_u u; +- int type; /* for above union: 1 = avrule block, 2 = conditional */ +- avrule_decl_t *decl; /* if in an avrule block, which +- * declaration is current */ ++ int type; /* for above union: 1 = avrule block, 2 = conditional */ ++ avrule_decl_t *decl; /* if in an avrule block, which ++ * declaration is current */ + avrule_t *last_avrule; +- int in_else; /* if in an avrule block, within ELSE branch */ +- int require_given; /* 1 if this block had at least one require */ ++ int in_else; /* if in an avrule block, within ELSE branch */ ++ int require_given; /* 1 if this block had at least one require */ + struct scope_stack *parent, *child; + } scope_stack_t; + +@@ -65,7 +64,8 @@ int define_policy(int pass, int module_header_given) + + if (module_header_given) { + if (policydbp->policy_type != POLICY_MOD) { +- yyerror("Module specification found while not building a policy module.\n"); ++ yyerror ++ ("Module specification found while not building a policy module.\n"); + return -1; + } + +@@ -79,14 +79,17 @@ int define_policy(int pass, int module_header_given) + return -1; + } + policydbp->name = id; +- if ((policydbp->version = queue_remove(id_queue)) == NULL) { +- yyerror("Expected a module version but none was found."); ++ if ((policydbp->version = ++ queue_remove(id_queue)) == NULL) { ++ yyerror ++ ("Expected a module version but none was found."); + return -1; + } + } + } else { + if (policydbp->policy_type == POLICY_MOD) { +- yyerror("Building a policy module, but no module specification found.\n"); ++ yyerror ++ ("Building a policy module, but no module specification found.\n"); + return -1; + } + } +@@ -98,7 +101,8 @@ int define_policy(int pass, int module_header_given) + while (stack_top != NULL) { + pop_stack(); + } +- if (push_stack(1, policydbp->global, policydbp->global->branch_list) == -1) { ++ if (push_stack(1, policydbp->global, policydbp->global->branch_list) == ++ -1) { + return -1; + } + last_block = policydbp->global; +@@ -127,7 +131,9 @@ static int is_declaration_allowed(void) + * For duplicate declarations return -2. For all else, including out + * of memory, return -3. Note that dest_value and datum_value might + * not be restricted pointers. */ +-int declare_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datum, uint32_t * dest_value, uint32_t * datum_value) ++int declare_symbol(uint32_t symbol_type, ++ hashtab_key_t key, hashtab_datum_t datum, ++ uint32_t * dest_value, uint32_t * datum_value) + { + avrule_decl_t *decl = stack_top->decl; + int retval; +@@ -136,14 +142,17 @@ int declare_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datu + if (!is_declaration_allowed()) { + return -1; + } +- retval = symtab_insert(policydbp, symbol_type, key, datum, SCOPE_DECL, decl->decl_id, dest_value); ++ retval = symtab_insert(policydbp, symbol_type, key, datum, ++ SCOPE_DECL, decl->decl_id, dest_value); + if (retval == 1 && dest_value) { +- symtab_datum_t *s = (symtab_datum_t *) hashtab_search(policydbp->symtab[symbol_type].table, +- key); ++ symtab_datum_t *s = ++ (symtab_datum_t *) hashtab_search(policydbp-> ++ symtab[symbol_type].table, ++ key); + assert(s != NULL); +- ++ + if (symbol_type == SYM_LEVELS) { +- *dest_value = ((level_datum_t *) s)->level->sens; ++ *dest_value = ((level_datum_t *)s)->level->sens; + } else { + *dest_value = s->value; + } +@@ -151,35 +160,38 @@ int declare_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datu + return -2; + } else if (retval < 0) { + return -3; +- } else { /* fall through possible if retval is 0 */ ++ } else { /* fall through possible if retval is 0 */ + } + if (datum_value != NULL) { +- if (ebitmap_set_bit(decl->declared.scope + symbol_type, *datum_value - 1, 1)) { ++ if (ebitmap_set_bit(decl->declared.scope + symbol_type, ++ *datum_value - 1, 1)) { + return -3; + } + } + return retval; + } + +-static int role_implicit_bounds(hashtab_t roles_tab, char *role_id, role_datum_t * role) ++static int role_implicit_bounds(hashtab_t roles_tab, ++ char *role_id, role_datum_t *role) + { + role_datum_t *bounds; + char *bounds_id, *delim; + + delim = strrchr(role_id, '.'); + if (!delim) +- return 0; /* no implicit boundary */ ++ return 0; /* no implicit boundary */ + + bounds_id = strdup(role_id); + if (!bounds_id) { + yyerror("out of memory"); + return -1; + } +- bounds_id[(size_t) (delim - role_id)] = '\0'; ++ bounds_id[(size_t)(delim - role_id)] = '\0'; + + bounds = hashtab_search(roles_tab, bounds_id); + if (!bounds) { +- yyerror2("role %s doesn't exist, is implicit bounds of %s", bounds_id, role_id); ++ yyerror2("role %s doesn't exist, is implicit bounds of %s", ++ bounds_id, role_id); + return -1; + } + +@@ -187,7 +199,8 @@ static int role_implicit_bounds(hashtab_t roles_tab, char *role_id, role_datum_t + role->bounds = bounds->s.value; + else if (role->bounds != bounds->s.value) { + yyerror2("role %s has inconsistent bounds %s/%s", +- role_id, bounds_id, policydbp->p_role_val_to_name[role->bounds - 1]); ++ role_id, bounds_id, ++ policydbp->p_role_val_to_name[role->bounds - 1]); + return -1; + } + free(bounds_id); +@@ -195,7 +208,7 @@ static int role_implicit_bounds(hashtab_t roles_tab, char *role_id, role_datum_t + return 0; + } + +-role_datum_t *declare_role(void) ++role_datum_t *declare_role(unsigned char isattr) + { + char *id = queue_remove(id_queue), *dest_id = NULL; + role_datum_t *role = NULL, *dest_role = NULL; +@@ -212,8 +225,10 @@ role_datum_t *declare_role(void) + return NULL; + } + role_datum_init(role); +- +- retval = declare_symbol(SYM_ROLES, id, (hashtab_datum_t *) role, &value, &value); ++ role->flavor = isattr ? ROLE_ATTRIB : ROLE_ROLE; ++ retval = ++ declare_symbol(SYM_ROLES, id, (hashtab_datum_t *) role, &value, ++ &value); + if (retval == 0) { + role->s.value = value; + if ((dest_id = strdup(id)) == NULL) { +@@ -238,13 +253,16 @@ role_datum_t *declare_role(void) + } + dest_role = (role_datum_t *) hashtab_search(roles_tab, dest_id); + if (dest_role == NULL) { +- if ((dest_role = (role_datum_t *) malloc(sizeof(*dest_role))) == NULL) { ++ if ((dest_role = ++ (role_datum_t *) malloc(sizeof(*dest_role))) == ++ NULL) { + yyerror("Out of memory!"); + free(dest_id); + return NULL; + } + role_datum_init(dest_role); + dest_role->s.value = value; ++ dest_role->flavor = isattr ? ROLE_ATTRIB : ROLE_ROLE; + if (role_implicit_bounds(roles_tab, dest_id, dest_role)) { + free(dest_id); + role_datum_destroy(dest_role); +@@ -266,30 +284,31 @@ role_datum_t *declare_role(void) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return NULL; +- } ++ yyerror("Out of memory!"); ++ return NULL; ++ } + case -2:{ +- yyerror("duplicate declaration of role"); +- return NULL; +- } ++ yyerror("duplicate declaration of role"); ++ return NULL; ++ } + case -1:{ +- yyerror("could not declare role here"); +- return NULL; +- } +- case 0:{ +- if (ebitmap_set_bit(&dest_role->dominates, role->s.value - 1, 1)) { +- yyerror("out of memory"); ++ yyerror("could not declare role here"); + return NULL; + } +- return dest_role; +- } ++ case 0:{ ++ if (ebitmap_set_bit ++ (&dest_role->dominates, role->s.value - 1, 1)) { ++ yyerror("out of memory"); ++ return NULL; ++ } ++ return dest_role; ++ } + case 1:{ +- return dest_role; /* role already declared for this block */ +- } ++ return dest_role; /* role already declared for this block */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -306,7 +325,8 @@ type_datum_t *declare_type(unsigned char primary, unsigned char isattr) + return NULL; + } + if (strcmp(id, "self") == 0) { +- yyerror("'self' is a reserved type name and may not be declared."); ++ yyerror ++ ("'self' is a reserved type name and may not be declared."); + free(id); + return NULL; + } +@@ -334,46 +354,48 @@ type_datum_t *declare_type(unsigned char primary, unsigned char isattr) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return NULL; +- } ++ yyerror("Out of memory!"); ++ return NULL; ++ } + case -2:{ +- yyerror2("duplicate declaration of type/attribute"); +- return NULL; +- } ++ yyerror2("duplicate declaration of type/attribute"); ++ return NULL; ++ } + case -1:{ +- yyerror("could not declare type/attribute here"); +- return NULL; +- } ++ yyerror("could not declare type/attribute here"); ++ return NULL; ++ } + case 0: + case 1:{ +- return typdatum; +- } ++ return typdatum; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +-static int user_implicit_bounds(hashtab_t users_tab, char *user_id, user_datum_t * user) ++static int user_implicit_bounds(hashtab_t users_tab, ++ char *user_id, user_datum_t *user) + { + user_datum_t *bounds; + char *bounds_id, *delim; + + delim = strrchr(user_id, '.'); + if (!delim) +- return 0; /* no implicit boundary */ ++ return 0; /* no implicit boundary */ + + bounds_id = strdup(user_id); + if (!bounds_id) { + yyerror("out of memory"); + return -1; + } +- bounds_id[(size_t) (delim - user_id)] = '\0'; ++ bounds_id[(size_t)(delim - user_id)] = '\0'; + + bounds = hashtab_search(users_tab, bounds_id); + if (!bounds) { +- yyerror2("user %s doesn't exist, is implicit bounds of %s", bounds_id, user_id); ++ yyerror2("user %s doesn't exist, is implicit bounds of %s", ++ bounds_id, user_id); + return -1; + } + +@@ -381,7 +403,8 @@ static int user_implicit_bounds(hashtab_t users_tab, char *user_id, user_datum_t + user->bounds = bounds->s.value; + else if (user->bounds != bounds->s.value) { + yyerror2("user %s has inconsistent bounds %s/%s", +- user_id, bounds_id, policydbp->p_role_val_to_name[user->bounds - 1]); ++ user_id, bounds_id, ++ policydbp->p_role_val_to_name[user->bounds - 1]); + return -1; + } + free(bounds_id); +@@ -407,7 +430,9 @@ user_datum_t *declare_user(void) + } + user_datum_init(user); + +- retval = declare_symbol(SYM_USERS, id, (hashtab_datum_t *) user, &value, &value); ++ retval = ++ declare_symbol(SYM_USERS, id, (hashtab_datum_t *) user, &value, ++ &value); + + if (retval == 0) { + user->s.value = value; +@@ -433,7 +458,9 @@ user_datum_t *declare_user(void) + } + dest_user = (user_datum_t *) hashtab_search(users_tab, dest_id); + if (dest_user == NULL) { +- if ((dest_user = (user_datum_t *) malloc(sizeof(*dest_user))) == NULL) { ++ if ((dest_user = ++ (user_datum_t *) malloc(sizeof(*dest_user))) == ++ NULL) { + yyerror("Out of memory!"); + free(dest_id); + return NULL; +@@ -461,26 +488,26 @@ user_datum_t *declare_user(void) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return NULL; +- } ++ yyerror("Out of memory!"); ++ return NULL; ++ } + case -2:{ +- yyerror("duplicate declaration of user"); +- return NULL; +- } ++ yyerror("duplicate declaration of user"); ++ return NULL; ++ } + case -1:{ +- yyerror("could not declare user here"); +- return NULL; +- } ++ yyerror("could not declare user here"); ++ return NULL; ++ } + case 0:{ +- return dest_user; +- } ++ return dest_user; ++ } + case 1:{ +- return dest_user; /* user already declared for this block */ +- } ++ return dest_user; /* user already declared for this block */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -530,6 +557,55 @@ type_datum_t *get_local_type(char *id, uint32_t value, unsigned char isattr) + return dest_typdatum; + } + ++/* Return a role_datum_t for the local avrule_decl with the given ID. ++ * If it does not exist, create one with the same value as 'value'. ++ * This function assumes that the ID is within scope. c.f., ++ * is_id_in_scope(). ++ * ++ * NOTE: this function usurps ownership of id afterwards. The caller ++ * shall not reference it nor free() it afterwards. ++ */ ++role_datum_t *get_local_role(char *id, uint32_t value, unsigned char isattr) ++{ ++ role_datum_t *dest_roledatum; ++ hashtab_t roles_tab; ++ ++ assert(stack_top->type == 1); ++ ++ if (stack_top->parent == NULL) { ++ /* in global, so use global symbol table */ ++ roles_tab = policydbp->p_roles.table; ++ } else { ++ roles_tab = stack_top->decl->p_roles.table; ++ } ++ ++ dest_roledatum = hashtab_search(roles_tab, id); ++ if (!dest_roledatum) { ++ dest_roledatum = (role_datum_t *)malloc(sizeof(role_datum_t)); ++ if (dest_roledatum == NULL) { ++ free(id); ++ return NULL; ++ } ++ ++ role_datum_init(dest_roledatum); ++ dest_roledatum->s.value = value; ++ dest_roledatum->flavor = isattr ? ROLE_ATTRIB : ROLE_ROLE; ++ ++ if (hashtab_insert(roles_tab, id, dest_roledatum)) { ++ free(id); ++ role_datum_destroy(dest_roledatum); ++ free(dest_roledatum); ++ return NULL; ++ } ++ } else { ++ free(id); ++ if (dest_roledatum->flavor != isattr ? ROLE_ATTRIB : ROLE_ROLE) ++ return NULL; ++ } ++ ++ return dest_roledatum; ++} ++ + /* Given the current parse stack, returns 1 if a requirement would be + * allowed here or 0 if not. For example, the ELSE branch may never + * have its own requirements. +@@ -550,7 +626,9 @@ static int is_require_allowed(void) + * return -3.. Note that dest_value and datum_value might not be + * restricted pointers. + */ +-int require_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datum, uint32_t * dest_value, uint32_t * datum_value) ++int require_symbol(uint32_t symbol_type, ++ hashtab_key_t key, hashtab_datum_t datum, ++ uint32_t * dest_value, uint32_t * datum_value) + { + avrule_decl_t *decl = stack_top->decl; + int retval; +@@ -559,14 +637,17 @@ int require_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datu + if (!is_require_allowed()) { + return -1; + } +- retval = symtab_insert(policydbp, symbol_type, key, datum, SCOPE_REQ, decl->decl_id, dest_value); ++ retval = symtab_insert(policydbp, symbol_type, key, datum, ++ SCOPE_REQ, decl->decl_id, dest_value); + if (retval == 1) { +- symtab_datum_t *s = (symtab_datum_t *) hashtab_search(policydbp->symtab[symbol_type].table, +- key); ++ symtab_datum_t *s = ++ (symtab_datum_t *) hashtab_search(policydbp-> ++ symtab[symbol_type].table, ++ key); + assert(s != NULL); +- ++ + if (symbol_type == SYM_LEVELS) { +- *dest_value = ((level_datum_t *) s)->level->sens; ++ *dest_value = ((level_datum_t *)s)->level->sens; + } else { + *dest_value = s->value; + } +@@ -578,11 +659,17 @@ int require_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datu + if (symbol_type == SYM_TYPES) { + /* check that previous symbol has same + * type/attribute-ness */ +- unsigned char new_isattr = ((type_datum_t *) datum)->flavor; +- type_datum_t *old_datum = (type_datum_t *) hashtab_search(policydbp->symtab[SYM_TYPES].table, key); ++ unsigned char new_isattr = ++ ((type_datum_t *) datum)->flavor; ++ type_datum_t *old_datum = ++ (type_datum_t *) hashtab_search(policydbp-> ++ symtab ++ [SYM_TYPES]. ++ table, key); + assert(old_datum != NULL); + unsigned char old_isattr = old_datum->flavor; +- prev_declaration_ok = (old_isattr == new_isattr ? 1 : 0); ++ prev_declaration_ok = ++ (old_isattr == new_isattr ? 1 : 0); + } else { + prev_declaration_ok = 1; + } +@@ -600,10 +687,11 @@ int require_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datu + } + } else if (retval < 0) { + return -3; +- } else { /* fall through possible if retval is 0 or 1 */ ++ } else { /* fall through possible if retval is 0 or 1 */ + } + if (datum_value != NULL) { +- if (ebitmap_set_bit(decl->required.scope + symbol_type, *datum_value - 1, 1)) { ++ if (ebitmap_set_bit(decl->required.scope + symbol_type, ++ *datum_value - 1, 1)) { + return -3; + } + } +@@ -632,13 +720,15 @@ int add_perm_to_class(uint32_t perm_value, uint32_t class_value) + } + scope->class_perms_len = class_value; + } +- if (ebitmap_set_bit(scope->class_perms_map + class_value - 1, perm_value - 1, 1)) { ++ if (ebitmap_set_bit(scope->class_perms_map + class_value - 1, ++ perm_value - 1, 1)) { + return -1; + } + return 0; + } + +-static int perm_destroy(hashtab_key_t key, hashtab_datum_t datum, void *p __attribute__ ((unused))) ++static int perm_destroy(hashtab_key_t key, hashtab_datum_t datum, void *p ++ __attribute__ ((unused))) + { + if (key) + free(key); +@@ -676,48 +766,53 @@ int require_class(int pass) + return -1; + } + +- if ((datum = calloc(1, sizeof(*datum))) == NULL || symtab_init(&datum->permissions, PERM_SYMTAB_SIZE)) { ++ if ((datum = calloc(1, sizeof(*datum))) == NULL || ++ symtab_init(&datum->permissions, PERM_SYMTAB_SIZE)) { + yyerror("Out of memory!"); + goto cleanup; + } +- ret = require_symbol(SYM_CLASSES, class_id, datum, &datum->s.value, &datum->s.value); ++ ret = ++ require_symbol(SYM_CLASSES, class_id, datum, &datum->s.value, ++ &datum->s.value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- free(class_id); +- class_datum_destroy(datum); +- goto cleanup; +- } ++ yyerror("Out of memory!"); ++ free(class_id); ++ class_datum_destroy(datum); ++ goto cleanup; ++ } + case -2:{ +- yyerror("duplicate declaration of class"); +- free(class_id); +- class_datum_destroy(datum); +- goto cleanup; +- } ++ yyerror("duplicate declaration of class"); ++ free(class_id); ++ class_datum_destroy(datum); ++ goto cleanup; ++ } + case -1:{ +- yyerror("could not require class here"); +- free(class_id); +- class_datum_destroy(datum); +- goto cleanup; +- } +- case 0:{ +- /* a new class was added; reindex everything */ +- if (policydb_index_classes(policydbp)) { +- yyerror("Out of memory!"); ++ yyerror("could not require class here"); ++ free(class_id); ++ class_datum_destroy(datum); + goto cleanup; + } +- break; +- } ++ case 0:{ ++ /* a new class was added; reindex everything */ ++ if (policydb_index_classes(policydbp)) { ++ yyerror("Out of memory!"); ++ goto cleanup; ++ } ++ break; ++ } + case 1:{ +- class_datum_destroy(datum); +- datum = hashtab_search(policydbp->p_classes.table, class_id); +- assert(datum); /* the class datum should have existed */ +- free(class_id); +- break; +- } ++ class_datum_destroy(datum); ++ datum = ++ hashtab_search(policydbp->p_classes.table, ++ class_id); ++ assert(datum); /* the class datum should have existed */ ++ free(class_id); ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + + /* now add each of the permissions to this class's requirements */ +@@ -727,14 +822,18 @@ int require_class(int pass) + /* Is the permission already in the table? */ + perm = hashtab_search(datum->permissions.table, perm_id); + if (!perm && datum->comdatum) +- perm = hashtab_search(datum->comdatum->permissions.table, perm_id); ++ perm = ++ hashtab_search(datum->comdatum->permissions.table, ++ perm_id); + if (perm) { + /* Yes, drop the name. */ + free(perm_id); + } else { + /* No - allocate and insert an entry for it. */ + if (policydbp->policy_type == POLICY_BASE) { +- yyerror2("Base policy - require of permission %s without prior declaration.", perm_id); ++ yyerror2 ++ ("Base policy - require of permission %s without prior declaration.", ++ perm_id); + free(perm_id); + goto cleanup; + } +@@ -745,7 +844,9 @@ int require_class(int pass) + goto cleanup; + } + memset(perm, 0, sizeof(*perm)); +- ret = hashtab_insert(datum->permissions.table, perm_id, perm); ++ ret = ++ hashtab_insert(datum->permissions.table, perm_id, ++ perm); + if (ret) { + yyerror("Out of memory!"); + free(perm_id); +@@ -769,7 +870,7 @@ int require_class(int pass) + return -1; + } + +-int require_role(int pass) ++static int require_role_or_attribute(int pass, unsigned char isattr) + { + char *id = queue_remove(id_queue); + role_datum_t *role = NULL; +@@ -788,7 +889,10 @@ int require_role(int pass) + return -1; + } + role_datum_init(role); +- retval = require_symbol(SYM_ROLES, id, (hashtab_datum_t *) role, &role->s.value, &role->s.value); ++ role->flavor = isattr ? ROLE_ATTRIB : ROLE_ROLE; ++ retval = ++ require_symbol(SYM_ROLES, id, (hashtab_datum_t *) role, ++ &role->s.value, &role->s.value); + if (retval != 0) { + free(id); + role_datum_destroy(role); +@@ -796,34 +900,45 @@ int require_role(int pass) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of role"); +- return -1; +- } ++ yyerror("duplicate declaration of role"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require role here"); +- return -1; +- } +- case 0:{ +- /* all roles dominate themselves */ +- if (ebitmap_set_bit(&role->dominates, role->s.value - 1, 1)) { +- yyerror("Out of memory"); ++ yyerror("could not require role here"); + return -1; + } +- return 0; +- } ++ case 0:{ ++ /* all roles dominate themselves */ ++ if (ebitmap_set_bit ++ (&role->dominates, role->s.value - 1, 1)) { ++ yyerror("Out of memory"); ++ return -1; ++ } ++ return 0; ++ } + case 1:{ +- return 0; /* role already required */ +- } ++ return 0; /* role already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + ++int require_role(int pass) ++{ ++ return require_role_or_attribute(pass, 0); ++} ++ ++int require_attribute_role(int pass) ++{ ++ return require_role_or_attribute(pass, 1); ++} ++ + static int require_type_or_attribute(int pass, unsigned char isattr) + { + char *id = queue_remove(id_queue); +@@ -845,33 +960,35 @@ static int require_type_or_attribute(int pass, unsigned char isattr) + type_datum_init(type); + type->primary = 1; + type->flavor = isattr ? TYPE_ATTRIB : TYPE_TYPE; +- retval = require_symbol(SYM_TYPES, id, (hashtab_datum_t *) type, &type->s.value, &type->s.value); ++ retval = ++ require_symbol(SYM_TYPES, id, (hashtab_datum_t *) type, ++ &type->s.value, &type->s.value); + if (retval != 0) { + free(id); + free(type); + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of type/attribute"); +- return -1; +- } ++ yyerror("duplicate declaration of type/attribute"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require type/attribute here"); +- return -1; +- } ++ yyerror("could not require type/attribute here"); ++ return -1; ++ } + case 0:{ +- return 0; +- } ++ return 0; ++ } + case 1:{ +- return 0; /* type already required */ +- } ++ return 0; /* type already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -904,37 +1021,39 @@ int require_user(int pass) + return -1; + } + user_datum_init(user); +- retval = require_symbol(SYM_USERS, id, (hashtab_datum_t *) user, &user->s.value, &user->s.value); ++ retval = ++ require_symbol(SYM_USERS, id, (hashtab_datum_t *) user, ++ &user->s.value, &user->s.value); + if (retval != 0) { + free(id); + user_datum_destroy(user); + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of user"); +- return -1; +- } ++ yyerror("duplicate declaration of user"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require user here"); +- return -1; +- } ++ yyerror("could not require user here"); ++ return -1; ++ } + case 0:{ +- return 0; +- } ++ return 0; ++ } + case 1:{ +- return 0; /* user already required */ +- } ++ return 0; /* user already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +-int require_bool(int pass) ++static int require_bool_tunable(int pass, int is_tunable) + { + char *id = queue_remove(id_queue); + cond_bool_datum_t *booldatum = NULL; +@@ -952,35 +1071,49 @@ int require_bool(int pass) + yyerror("Out of memory!"); + return -1; + } +- retval = require_symbol(SYM_BOOLS, id, (hashtab_datum_t *) booldatum, &booldatum->s.value, &booldatum->s.value); ++ if (is_tunable) ++ booldatum->flags |= COND_BOOL_FLAGS_TUNABLE; ++ retval = ++ require_symbol(SYM_BOOLS, id, (hashtab_datum_t *) booldatum, ++ &booldatum->s.value, &booldatum->s.value); + if (retval != 0) { + cond_destroy_bool(id, booldatum, NULL); + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of boolean"); +- return -1; +- } ++ yyerror("duplicate declaration of boolean"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require boolean here"); +- return -1; +- } ++ yyerror("could not require boolean here"); ++ return -1; ++ } + case 0:{ +- return 0; +- } ++ return 0; ++ } + case 1:{ +- return 0; /* boolean already required */ +- } ++ return 0; /* boolean already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + ++int require_bool(int pass) ++{ ++ return require_bool_tunable(pass, 0); ++} ++ ++int require_tunable(int pass) ++{ ++ return require_bool_tunable(pass, 1); ++} ++ + int require_sens(int pass) + { + char *id = queue_remove(id_queue); +@@ -1010,7 +1143,8 @@ int require_sens(int pass) + return -1; + } + mls_level_init(level->level); +- retval = require_symbol(SYM_LEVELS, id, (hashtab_datum_t *) level, &level->level->sens, &level->level->sens); ++ retval = require_symbol(SYM_LEVELS, id, (hashtab_datum_t *) level, ++ &level->level->sens, &level->level->sens); + if (retval != 0) { + free(id); + mls_level_destroy(level->level); +@@ -1020,26 +1154,26 @@ int require_sens(int pass) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of sensitivity"); +- return -1; +- } ++ yyerror("duplicate declaration of sensitivity"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require sensitivity here"); +- return -1; +- } ++ yyerror("could not require sensitivity here"); ++ return -1; ++ } + case 0:{ +- return 0; +- } ++ return 0; ++ } + case 1:{ +- return 0; /* sensitivity already required */ +- } ++ return 0; /* sensitivity already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -1064,7 +1198,8 @@ int require_cat(int pass) + } + cat_datum_init(cat); + +- retval = require_symbol(SYM_CATS, id, (hashtab_datum_t *) cat, &cat->s.value, &cat->s.value); ++ retval = require_symbol(SYM_CATS, id, (hashtab_datum_t *) cat, ++ &cat->s.value, &cat->s.value); + if (retval != 0) { + free(id); + cat_datum_destroy(cat); +@@ -1072,26 +1207,26 @@ int require_cat(int pass) + } + switch (retval) { + case -3:{ +- yyerror("Out of memory!"); +- return -1; +- } ++ yyerror("Out of memory!"); ++ return -1; ++ } + case -2:{ +- yyerror("duplicate declaration of category"); +- return -1; +- } ++ yyerror("duplicate declaration of category"); ++ return -1; ++ } + case -1:{ +- yyerror("could not require category here"); +- return -1; +- } ++ yyerror("could not require category here"); ++ return -1; ++ } + case 0:{ +- return 0; +- } ++ return 0; ++ } + case 1:{ +- return 0; /* category already required */ +- } ++ return 0; /* category already required */ ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -1099,7 +1234,7 @@ static int is_scope_in_stack(scope_datum_t * scope, scope_stack_t * stack) + { + int i; + if (stack == NULL) { +- return 0; /* no matching scope found */ ++ return 0; /* no matching scope found */ + } + if (stack->type == 1) { + avrule_decl_t *decl = stack->decl; +@@ -1119,33 +1254,40 @@ static int is_scope_in_stack(scope_datum_t * scope, scope_stack_t * stack) + + int is_id_in_scope(uint32_t symbol_type, hashtab_key_t id) + { +- scope_datum_t *scope = (scope_datum_t *) hashtab_search(policydbp->scope[symbol_type].table, id); ++ scope_datum_t *scope = ++ (scope_datum_t *) hashtab_search(policydbp->scope[symbol_type]. ++ table, id); + if (scope == NULL) { +- return 1; /* id is not known, so return success */ ++ return 1; /* id is not known, so return success */ + } + return is_scope_in_stack(scope, stack_top); + } + +-static int is_perm_in_scope_index(uint32_t perm_value, uint32_t class_value, scope_index_t * scope) ++static int is_perm_in_scope_index(uint32_t perm_value, uint32_t class_value, ++ scope_index_t * scope) + { + if (class_value > scope->class_perms_len) { + return 1; + } +- if (ebitmap_get_bit(scope->class_perms_map + class_value - 1, perm_value - 1)) { ++ if (ebitmap_get_bit(scope->class_perms_map + class_value - 1, ++ perm_value - 1)) { + return 1; + } + return 0; + } + +-static int is_perm_in_stack(uint32_t perm_value, uint32_t class_value, scope_stack_t * stack) ++static int is_perm_in_stack(uint32_t perm_value, uint32_t class_value, ++ scope_stack_t * stack) + { + if (stack == NULL) { +- return 0; /* no matching scope found */ ++ return 0; /* no matching scope found */ + } + if (stack->type == 1) { + avrule_decl_t *decl = stack->decl; +- if (is_perm_in_scope_index(perm_value, class_value, &decl->required) +- || is_perm_in_scope_index(perm_value, class_value, &decl->declared)) { ++ if (is_perm_in_scope_index ++ (perm_value, class_value, &decl->required) ++ || is_perm_in_scope_index(perm_value, class_value, ++ &decl->declared)) { + return 1; + } + } else { +@@ -1159,17 +1301,20 @@ static int is_perm_in_stack(uint32_t perm_value, uint32_t class_value, scope_sta + + int is_perm_in_scope(hashtab_key_t perm_id, hashtab_key_t class_id) + { +- class_datum_t *cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table, +- class_id); ++ class_datum_t *cladatum = ++ (class_datum_t *) hashtab_search(policydbp->p_classes.table, ++ class_id); + perm_datum_t *perdatum; + if (cladatum == NULL) { + return 1; + } +- perdatum = (perm_datum_t *) hashtab_search(cladatum->permissions.table, perm_id); ++ perdatum = (perm_datum_t *) hashtab_search(cladatum->permissions.table, ++ perm_id); + if (perdatum == NULL) { + return 1; + } +- return is_perm_in_stack(perdatum->s.value, cladatum->s.value, stack_top); ++ return is_perm_in_stack(perdatum->s.value, cladatum->s.value, ++ stack_top); + } + + cond_list_t *get_current_cond_list(cond_list_t * cond) +@@ -1188,19 +1333,23 @@ void append_cond_list(cond_list_t * cond) + { + cond_list_t *old_cond = get_current_cond_list(cond); + avrule_t *tmp; +- assert(old_cond != NULL); /* probably out of memory */ ++ assert(old_cond != NULL); /* probably out of memory */ + if (old_cond->avtrue_list == NULL) { + old_cond->avtrue_list = cond->avtrue_list; + } else { +- for (tmp = old_cond->avtrue_list; tmp->next != NULL; tmp = tmp->next) ; ++ for (tmp = old_cond->avtrue_list; tmp->next != NULL; ++ tmp = tmp->next) ; + tmp->next = cond->avtrue_list; + } + if (old_cond->avfalse_list == NULL) { + old_cond->avfalse_list = cond->avfalse_list; + } else { +- for (tmp = old_cond->avfalse_list; tmp->next != NULL; tmp = tmp->next) ; ++ for (tmp = old_cond->avfalse_list; tmp->next != NULL; ++ tmp = tmp->next) ; + tmp->next = cond->avfalse_list; + } ++ ++ old_cond->flags |= cond->flags; + } + + void append_avrule(avrule_t * avrule) +@@ -1276,7 +1425,8 @@ int begin_optional(int pass) + avrule_decl_t *decl; + if (pass == 1) { + /* allocate a new avrule block for this optional block */ +- if ((block = avrule_block_create()) == NULL || (decl = avrule_decl_create(next_decl_id)) == NULL) { ++ if ((block = avrule_block_create()) == NULL || ++ (decl = avrule_decl_create(next_decl_id)) == NULL) { + goto cleanup; + } + block->flags |= AVRULE_OPTIONAL; +@@ -1285,7 +1435,9 @@ int begin_optional(int pass) + } else { + /* select the next block from the chain built during pass 1 */ + block = last_block->next; +- assert(block != NULL && block->branch_list != NULL && block->branch_list->decl_id == next_decl_id); ++ assert(block != NULL && ++ block->branch_list != NULL && ++ block->branch_list->decl_id == next_decl_id); + decl = block->branch_list; + } + if (push_stack(1, block, decl) == -1) { +@@ -1324,7 +1476,8 @@ int begin_optional_else(int pass) + /* pick the (hopefully last) declaration of this + avrule block, built from pass 1 */ + decl = stack_top->decl->next; +- assert(decl != NULL && decl->next == NULL && decl->decl_id == next_decl_id); ++ assert(decl != NULL && ++ decl->next == NULL && decl->decl_id == next_decl_id); + } + stack_top->in_else = 1; + stack_top->decl = decl; +@@ -1353,21 +1506,26 @@ static int copy_requirements(avrule_decl_t * dest, scope_stack_t * stack) + } + /* now copy class permissions */ + if (src_scope->class_perms_len > dest_scope->class_perms_len) { +- ebitmap_t *new_map = realloc(dest_scope->class_perms_map, +- src_scope->class_perms_len * sizeof(*new_map)); ++ ebitmap_t *new_map = ++ realloc(dest_scope->class_perms_map, ++ src_scope->class_perms_len * ++ sizeof(*new_map)); + if (new_map == NULL) { + yyerror("Out of memory!"); + return -1; + } + dest_scope->class_perms_map = new_map; +- for (i = dest_scope->class_perms_len; i < src_scope->class_perms_len; i++) { ++ for (i = dest_scope->class_perms_len; ++ i < src_scope->class_perms_len; i++) { + ebitmap_init(dest_scope->class_perms_map + i); + } +- dest_scope->class_perms_len = src_scope->class_perms_len; ++ dest_scope->class_perms_len = ++ src_scope->class_perms_len; + } + for (i = 0; i < src_scope->class_perms_len; i++) { + ebitmap_t *src_bitmap = &src_scope->class_perms_map[i]; +- ebitmap_t *dest_bitmap = &dest_scope->class_perms_map[i]; ++ ebitmap_t *dest_bitmap = ++ &dest_scope->class_perms_map[i]; + if (ebitmap_union(dest_bitmap, src_bitmap)) { + yyerror("Out of memory!"); + return -1; +@@ -1394,7 +1552,8 @@ int end_avrule_block(int pass) + return 0; + } + if (!stack_top->in_else && !stack_top->require_given) { +- if (policydbp->policy_type == POLICY_BASE && stack_top->parent != NULL) { ++ if (policydbp->policy_type == POLICY_BASE ++ && stack_top->parent != NULL) { + /* if this is base no require should be in the global block */ + return 0; + } else { +@@ -1418,14 +1577,14 @@ static int push_stack(int stack_type, ...) + va_start(ap, stack_type); + switch (s->type = stack_type) { + case 1:{ +- s->u.avrule = va_arg(ap, avrule_block_t *); +- s->decl = va_arg(ap, avrule_decl_t *); +- break; +- } ++ s->u.avrule = va_arg(ap, avrule_block_t *); ++ s->decl = va_arg(ap, avrule_decl_t *); ++ break; ++ } + case 2:{ +- s->u.cond_list = va_arg(ap, cond_list_t *); +- break; +- } ++ s->u.cond_list = va_arg(ap, cond_list_t *); ++ break; ++ } + default: + /* invalid stack type given */ + assert(0); +diff --git a/libqpol/src/module_compiler.h b/libqpol/src/module_compiler.h +index d46dca6..b9c0526 100644 +--- a/libqpol/src/module_compiler.h ++++ b/libqpol/src/module_compiler.h +@@ -17,6 +17,7 @@ + #ifndef MODULE_COMPILER_H + #define MODULE_COMPILER_H + ++/* Required for SETools libqpol services */ + #ifdef __cplusplus + extern "C" + { +@@ -36,18 +37,23 @@ int define_policy(int pass, int module_header_given); + * needs to free() the datum), -1 if declarations not allowed, -2 for + * duplicate declarations, -3 for all else. + */ +-int declare_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datum, uint32_t * dest_value, uint32_t * datum_value); ++int declare_symbol(uint32_t symbol_type, ++ hashtab_key_t key, hashtab_datum_t datum, ++ uint32_t * dest_value, uint32_t * datum_value); + +-role_datum_t *declare_role(void); ++role_datum_t *declare_role(unsigned char isattr); + type_datum_t *declare_type(unsigned char primary, unsigned char isattr); + user_datum_t *declare_user(void); + + type_datum_t *get_local_type(char *id, uint32_t value, unsigned char isattr); ++role_datum_t *get_local_role(char *id, uint32_t value, unsigned char isattr); + + /* Add a symbol to the current avrule_block's require section. Note + * that a module may not both declare and require the same symbol. + * Returns 0 on success, -1 on error. */ +-int require_symbol(uint32_t symbol_type, hashtab_key_t key, hashtab_datum_t datum, uint32_t * dest_value, uint32_t * datum_value); ++int require_symbol(uint32_t symbol_type, ++ hashtab_key_t key, hashtab_datum_t datum, ++ uint32_t * dest_value, uint32_t * datum_value); + + /* Enable a permission for a class within the current avrule_decl. + * Return 0 on success, -1 if out of memory. */ +@@ -60,8 +66,10 @@ int require_class(int pass); + int require_role(int pass); + int require_type(int pass); + int require_attribute(int pass); ++int require_attribute_role(int pass); + int require_user(int pass); + int require_bool(int pass); ++int require_tunable(int pass); + int require_sens(int pass); + int require_cat(int pass); + +diff --git a/libqpol/src/policy.c b/libqpol/src/policy.c +index 7180556..717c079 100644 +--- a/libqpol/src/policy.c ++++ b/libqpol/src/policy.c +@@ -412,6 +412,45 @@ static int infer_policy_version(qpol_policy_t * policy) + } + qpol_iterator_destroy(&iter); + ++/* Check each version change from 29 to 24 */ ++/* If this is available then just set version 29 */ ++#ifdef HAVE_SEPOL_CONSTRAINT_NAMES ++ db->policyvers = 29; ++ return STATUS_SUCCESS; ++#endif ++ ++/* ++ * These will remove the rules from policy_define.c if libsepol ++ * does not have the support listed in policydb.h. The earlier code ++ * checked for at least one rule before enabling - this patch does not ++ * as if in policydb.h then must be capable of being built. ++ */ ++#ifdef HAVE_SEPOL_DEFAULT_TYPE ++ db->policyvers = 28; ++ return STATUS_SUCCESS; ++#endif ++ ++#ifdef HAVE_SEPOL_NEW_OBJECT_DEFAULTS ++ db->policyvers = 27; ++ return STATUS_SUCCESS; ++#endif ++ ++/* This seems to be in place already ?? ++#ifdef HAVE_SEPOL_ROLETRANS ++ db->policyvers = 26; ++ return STATUS_SUCCESS; ++#endif */ ++ ++#ifdef HAVE_SEPOL_FILENAME_TRANS ++ db->policyvers = 25; ++ return STATUS_SUCCESS; ++#endif ++ ++#ifdef HAVE_SEPOL_BOUNDARY ++ db->policyvers = 24; ++ return STATUS_SUCCESS; ++#endif ++ + #if defined(HAVE_SEPOL_PERMISSIVE_TYPES) || defined(HAVE_SEPOL_POLICYCAPS) + ebitmap_node_t *node = NULL; + unsigned int i = 0; +@@ -1466,6 +1505,25 @@ int qpol_policy_get_policy_version(const qpol_policy_t * policy, unsigned int *v + return STATUS_SUCCESS; + } + ++int qpol_policy_get_policy_handle_unknown(const qpol_policy_t * policy, unsigned int *handle_unknown) ++{ ++ policydb_t *db; ++ ++ if (handle_unknown != NULL) ++ *handle_unknown = 0; ++ ++ if (policy == NULL || handle_unknown == NULL) { ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++ *handle_unknown = db->handle_unknown; ++ ++ return STATUS_SUCCESS; ++} ++ + int qpol_policy_get_type(const qpol_policy_t * policy, int *type) + { + if (!policy || !type) { +@@ -1534,6 +1592,55 @@ int qpol_policy_has_capability(const qpol_policy_t * policy, qpol_capability_e c + return 1; + break; + } ++ case QPOL_CAP_BOUNDS: ++ { ++ if (version >= 24 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 9 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } ++ case QPOL_CAP_PERMISSIVE: ++ { ++ if (version >= 23 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 8 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } ++ case QPOL_CAP_FILENAME_TRANS: ++ { ++ if (version >= 25 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 11 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } ++ case QPOL_CAP_ROLETRANS: ++ { ++ if (version >= 26 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 12 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } ++ /* This indicates the user, role and range - types were ate 28/16 */ ++ case QPOL_CAP_DEFAULT_OBJECTS: ++ { ++ if (version >= 27 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 15 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } ++ case QPOL_CAP_DEFAULT_TYPE: ++ { ++ if (version >= 28 && policy->type != QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ if (version >= 16 && policy->type == QPOL_POLICY_MODULE_BINARY) ++ return 1; ++ break; ++ } + case QPOL_CAP_RULES_LOADED: + { + if (!(policy->options & QPOL_POLICY_OPTION_NO_RULES)) +diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c +index fad6b60..15f70ba 100644 +--- a/libqpol/src/policy_define.c ++++ b/libqpol/src/policy_define.c +@@ -3,6 +3,8 @@ + * + * This file is based upon checkpolicy/policy_define.c from NSA's SVN + * repository. It has been modified to support older policy formats. ++ * The older format just seems to be PSID support (see ++ * int define_fs_use(int behavior). + */ + + /* +@@ -33,7 +35,7 @@ + */ + + /* FLASK */ +- ++/* Required for SETools libqpol */ + #include + + #include +@@ -54,6 +56,7 @@ + #include + #include + #include ++/* Required for SETools libqpol */ + #ifdef HAVE_SEPOL_POLICYCAPS + #include + #endif +@@ -62,15 +65,15 @@ + #endif + + #include "queue.h" ++/* Required for SETools libqpol - Removed #include "checkpolicy.h"*/ + #include ++ + #include "module_compiler.h" + #include "policy_define.h" + + policydb_t *policydbp; + queue_t id_queue = 0; + unsigned int pass; +-static int load_rules; +-static unsigned int num_rules = 0; + char *curfile = 0; + int mlspol = 0; + +@@ -82,12 +85,15 @@ extern int yywarn(char *msg); + extern int yyerror(char *msg); + + #define ERRORMSG_LEN 255 +-static char errormsg[ERRORMSG_LEN + 1] = { 0 }; ++static char errormsg[ERRORMSG_LEN + 1] = {0}; + + static int id_has_dot(char *id); +-static int parse_security_context(context_struct_t * c); ++static int parse_security_context(context_struct_t *c); + + /* initialize all of the state variables for the scanner/parser */ ++/* Modified for SETools libqpol */ ++static int load_rules; ++static unsigned int num_rules = 0; + void init_parser(int pass_number, int do_rules) + { + policydb_lineno = 1; +@@ -107,6 +113,7 @@ void yyerror2(char *fmt, ...) + va_end(ap); + } + ++/* Required for SETools libqpol */ + int define_mls(void) + { + mlspol = 1; +@@ -115,6 +122,7 @@ int define_mls(void) + return 0; + } + ++/* Required for SETools libqpol */ + /* Add a rule onto an avtab hash table only if it does not already + * exist. (Note that the avtab is discarded afterwards; it will be + * regenerated during expansion.) Return 1 if rule was added (or +@@ -135,11 +143,13 @@ static int insert_check_type_rule(avrule_t * rule, avtab_t * avtab, cond_av_list + #endif + + ret = expand_rule(NULL, policydbp, rule, avtab, list, other, 0); ++ + if (ret < 0) { + yyerror("Failed on expanding rule"); + } + return ret; + } ++ + int insert_separator(int push) + { + int error; +@@ -217,24 +227,24 @@ int define_class(void) + ret = declare_symbol(SYM_CLASSES, id, datum, &value, &value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto bad; +- } ++ yyerror("Out of memory!"); ++ goto bad; ++ } + case -2:{ +- yyerror2("duplicate declaration of class %s", id); +- goto bad; +- } ++ yyerror2("duplicate declaration of class %s", id); ++ goto bad; ++ } + case -1:{ +- yyerror("could not declare class here"); +- goto bad; +- } ++ yyerror("could not declare class here"); ++ goto bad; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + datum->s.value = value; + return 0; +@@ -282,12 +292,13 @@ int define_permissive(void) + rc = -1; + goto out; + } ++/* Required for SETools libqpol */ + #ifdef HAVE_SEPOL_PERMISSIVE_TYPES + t->flags |= TYPE_FLAGS_PERMISSIVE; + #else + yyerror("This version of SETools does not have permissive types enabled."); + #endif +- out: ++out: + free(type); + return rc; + } +@@ -308,6 +319,7 @@ int define_polcap(void) + yyerror("no capability name for policycap definition?"); + goto bad; + } ++/* Required for SETools libqpol */ + #ifdef HAVE_SEPOL_POLICYCAPS + /* Check for valid cap name -> number mapping */ + capnum = sepol_polcap_getnum(id); +@@ -384,6 +396,178 @@ int define_initial_sid(void) + return -1; + } + ++static int read_classes(ebitmap_t *e_classes) ++{ ++ char *id; ++ class_datum_t *cladatum; ++ ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_CLASSES, id)) { ++ yyerror2("class %s is not within scope", id); ++ return -1; ++ } ++ cladatum = hashtab_search(policydbp->p_classes.table, id); ++ if (!cladatum) { ++ yyerror2("unknown class %s", id); ++ return -1; ++ } ++ if (ebitmap_set_bit(e_classes, cladatum->s.value - 1, TRUE)) { ++ yyerror("Out of memory"); ++ return -1; ++ } ++ free(id); ++ } ++ return 0; ++} ++ ++int define_default_user(int which) ++{ ++ char *id; ++ ++ if (pass == 1) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ return 0; ++ } ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_NEW_OBJECT_DEFAULTS ++ class_datum_t *cladatum; ++ ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_CLASSES, id)) { ++ yyerror2("class %s is not within scope", id); ++ return -1; ++ } ++ cladatum = hashtab_search(policydbp->p_classes.table, id); ++ if (!cladatum) { ++ yyerror2("unknown class %s", id); ++ return -1; ++ } ++ if (cladatum->default_user && cladatum->default_user != which) { ++ yyerror2("conflicting default user information for class %s", id); ++ return -1; ++ } ++ cladatum->default_user = which; ++ free(id); ++ } ++ ++ return 0; ++#else ++ yyerror("This version of SETools does not have default_user enabled."); ++#endif ++} ++ ++int define_default_role(int which) ++{ ++ char *id; ++ ++ if (pass == 1) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ return 0; ++ } ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_NEW_OBJECT_DEFAULTS ++ class_datum_t *cladatum; ++ ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_CLASSES, id)) { ++ yyerror2("class %s is not within scope", id); ++ return -1; ++ } ++ cladatum = hashtab_search(policydbp->p_classes.table, id); ++ if (!cladatum) { ++ yyerror2("unknown class %s", id); ++ return -1; ++ } ++ if (cladatum->default_role && cladatum->default_role != which) { ++ yyerror2("conflicting default role information for class %s", id); ++ return -1; ++ } ++ cladatum->default_role = which; ++ free(id); ++ } ++ ++ return 0; ++#else ++ yyerror("This version of SETools does not have default_role enabled."); ++#endif ++} ++ ++int define_default_type(int which) ++{ ++ char *id; ++ ++ if (pass == 1) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ return 0; ++ } ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_DEFAULT_TYPE ++ class_datum_t *cladatum; ++ ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_CLASSES, id)) { ++ yyerror2("class %s is not within scope", id); ++ return -1; ++ } ++ cladatum = hashtab_search(policydbp->p_classes.table, id); ++ if (!cladatum) { ++ yyerror2("unknown class %s", id); ++ return -1; ++ } ++ if (cladatum->default_type && cladatum->default_type != which) { ++ yyerror2("conflicting default type information for class %s", id); ++ return -1; ++ } ++ cladatum->default_type = which; ++ free(id); ++ } ++ ++ return 0; ++#else ++ yyerror("This version of SETools does not have default_type enabled."); ++#endif ++} ++ ++int define_default_range(int which) ++{ ++ char *id; ++ ++ if (pass == 1) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ return 0; ++ } ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_NEW_OBJECT_DEFAULTS ++ class_datum_t *cladatum; ++ ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_CLASSES, id)) { ++ yyerror2("class %s is not within scope", id); ++ return -1; ++ } ++ cladatum = hashtab_search(policydbp->p_classes.table, id); ++ if (!cladatum) { ++ yyerror2("unknown class %s", id); ++ return -1; ++ } ++ if (cladatum->default_range && cladatum->default_range != which) { ++ yyerror2("conflicting default range information for class %s", id); ++ return -1; ++ } ++ cladatum->default_range = which; ++ free(id); ++ } ++ ++ return 0; ++#else ++ yyerror("This version of SETools does not have default_range enabled."); ++#endif ++} ++ + int define_common_perms(void) + { + char *id = 0, *perm = 0; +@@ -413,7 +597,8 @@ int define_common_perms(void) + goto bad; + } + memset(comdatum, 0, sizeof(common_datum_t)); +- ret = hashtab_insert(policydbp->p_commons.table, (hashtab_key_t) id, (hashtab_datum_t) comdatum); ++ ret = hashtab_insert(policydbp->p_commons.table, ++ (hashtab_key_t) id, (hashtab_datum_t) comdatum); + + if (ret == SEPOL_EEXIST) { + yyerror("duplicate common definition"); +@@ -439,13 +624,17 @@ int define_common_perms(void) + perdatum->s.value = comdatum->permissions.nprim + 1; + + if (perdatum->s.value > (sizeof(sepol_access_vector_t) * 8)) { +- yyerror("too many permissions to fit in an access vector"); ++ yyerror ++ ("too many permissions to fit in an access vector"); + goto bad_perm; + } +- ret = hashtab_insert(comdatum->permissions.table, (hashtab_key_t) perm, (hashtab_datum_t) perdatum); ++ ret = hashtab_insert(comdatum->permissions.table, ++ (hashtab_key_t) perm, ++ (hashtab_datum_t) perdatum); + + if (ret == SEPOL_EEXIST) { +- yyerror2("duplicate permission %s in common %s", perm, id); ++ yyerror2("duplicate permission %s in common %s", perm, ++ id); + goto bad_perm; + } + if (ret == SEPOL_ENOMEM) { +@@ -491,7 +680,8 @@ int define_av_perms(int inherits) + yyerror("no tclass name for av perm definition?"); + return -1; + } +- cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table, (hashtab_key_t) id); ++ cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table, ++ (hashtab_key_t) id); + if (!cladatum) { + yyerror2("class %s is not defined", id); + goto bad; +@@ -509,10 +699,14 @@ int define_av_perms(int inherits) + if (inherits) { + id = (char *)queue_remove(id_queue); + if (!id) { +- yyerror("no inherits name for access vector definition?"); ++ yyerror ++ ("no inherits name for access vector definition?"); + return -1; + } +- comdatum = (common_datum_t *) hashtab_search(policydbp->p_commons.table, (hashtab_key_t) id); ++ comdatum = ++ (common_datum_t *) hashtab_search(policydbp->p_commons. ++ table, ++ (hashtab_key_t) id); + + if (!comdatum) { + yyerror2("common %s is not defined", id); +@@ -537,7 +731,8 @@ int define_av_perms(int inherits) + perdatum->s.value = ++cladatum->permissions.nprim; + + if (perdatum->s.value > (sizeof(sepol_access_vector_t) * 8)) { +- yyerror("too many permissions to fit in an access vector"); ++ yyerror ++ ("too many permissions to fit in an access vector"); + goto bad; + } + if (inherits) { +@@ -546,13 +741,19 @@ int define_av_perms(int inherits) + * common permissions exist in the same + * name space. + */ +- perdatum2 = (perm_datum_t *) hashtab_search(cladatum->comdatum->permissions.table, (hashtab_key_t) id); ++ perdatum2 = ++ (perm_datum_t *) hashtab_search(cladatum->comdatum-> ++ permissions.table, ++ (hashtab_key_t) id); + if (perdatum2) { +- yyerror2("permission %s conflicts with an " "inherited permission", id); ++ yyerror2("permission %s conflicts with an " ++ "inherited permission", id); + goto bad; + } + } +- ret = hashtab_insert(cladatum->permissions.table, (hashtab_key_t) id, (hashtab_datum_t) perdatum); ++ ret = hashtab_insert(cladatum->permissions.table, ++ (hashtab_key_t) id, ++ (hashtab_datum_t) perdatum); + + if (ret == SEPOL_EEXIST) { + yyerror2("duplicate permission %s", id); +@@ -584,7 +785,7 @@ int define_sens(void) + mls_level_t *level = 0; + level_datum_t *datum = 0, *aliasdatum = 0; + int ret; +- uint32_t value; /* dummy variable -- its value is never used */ ++ uint32_t value; /* dummy variable -- its value is never used */ + + if (!mlspol) { + yyerror("sensitivity definition in non-MLS configuration"); +@@ -612,8 +813,8 @@ int define_sens(void) + goto bad; + } + mls_level_init(level); +- level->sens = 0; /* actual value set in define_dominance */ +- ebitmap_init(&level->cat); /* actual value set in define_level */ ++ level->sens = 0; /* actual value set in define_dominance */ ++ ebitmap_init(&level->cat); /* actual value set in define_level */ + + datum = (level_datum_t *) malloc(sizeof(level_datum_t)); + if (!datum) { +@@ -627,24 +828,24 @@ int define_sens(void) + ret = declare_symbol(SYM_LEVELS, id, datum, &value, &value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto bad; +- } ++ yyerror("Out of memory!"); ++ goto bad; ++ } + case -2:{ +- yyerror("duplicate declaration of sensitivity level"); +- goto bad; +- } ++ yyerror("duplicate declaration of sensitivity level"); ++ goto bad; ++ } + case -1:{ +- yyerror("could not declare sensitivity level here"); +- goto bad; +- } ++ yyerror("could not declare sensitivity level here"); ++ goto bad; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + + while ((id = queue_remove(id_queue))) { +@@ -664,24 +865,26 @@ int define_sens(void) + ret = declare_symbol(SYM_LEVELS, id, aliasdatum, NULL, &value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto bad_alias; +- } ++ yyerror("Out of memory!"); ++ goto bad_alias; ++ } + case -2:{ +- yyerror("duplicate declaration of sensitivity alias"); +- goto bad_alias; +- } ++ yyerror ++ ("duplicate declaration of sensitivity alias"); ++ goto bad_alias; ++ } + case -1:{ +- yyerror("could not declare sensitivity alias here"); +- goto bad_alias; +- } ++ yyerror ++ ("could not declare sensitivity alias here"); ++ goto bad_alias; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -727,14 +930,18 @@ int define_dominance(void) + + order = 0; + while ((id = (char *)queue_remove(id_queue))) { +- datum = (level_datum_t *) hashtab_search(policydbp->p_levels.table, (hashtab_key_t) id); ++ datum = ++ (level_datum_t *) hashtab_search(policydbp->p_levels.table, ++ (hashtab_key_t) id); + if (!datum) { +- yyerror2("unknown sensitivity %s used in dominance " "definition", id); ++ yyerror2("unknown sensitivity %s used in dominance " ++ "definition", id); + free(id); + return -1; + } + if (datum->level->sens != 0) { +- yyerror2("sensitivity %s occurs multiply in dominance " "definition", id); ++ yyerror2("sensitivity %s occurs multiply in dominance " ++ "definition", id); + free(id); + return -1; + } +@@ -745,7 +952,8 @@ int define_dominance(void) + } + + if (order != policydbp->p_levels.nprim) { +- yyerror("all sensitivities must be specified in dominance definition"); ++ yyerror ++ ("all sensitivities must be specified in dominance definition"); + return -1; + } + return 0; +@@ -789,24 +997,24 @@ int define_category(void) + ret = declare_symbol(SYM_CATS, id, datum, &value, &value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto bad; +- } ++ yyerror("Out of memory!"); ++ goto bad; ++ } + case -2:{ +- yyerror("duplicate declaration of category"); +- goto bad; +- } ++ yyerror("duplicate declaration of category"); ++ goto bad; ++ } + case -1:{ +- yyerror("could not declare category here"); +- goto bad; +- } ++ yyerror("could not declare category here"); ++ goto bad; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + datum->s.value = value; + +@@ -824,27 +1032,31 @@ int define_category(void) + aliasdatum->isalias = TRUE; + aliasdatum->s.value = datum->s.value; + +- ret = declare_symbol(SYM_CATS, id, aliasdatum, NULL, &datum->s.value); ++ ret = ++ declare_symbol(SYM_CATS, id, aliasdatum, NULL, ++ &datum->s.value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto bad_alias; +- } ++ yyerror("Out of memory!"); ++ goto bad_alias; ++ } + case -2:{ +- yyerror("duplicate declaration of category aliases"); +- goto bad_alias; +- } ++ yyerror ++ ("duplicate declaration of category aliases"); ++ goto bad_alias; ++ } + case -1:{ +- yyerror("could not declare category aliases here"); +- goto bad_alias; +- } ++ yyerror ++ ("could not declare category aliases here"); ++ goto bad_alias; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + +@@ -911,14 +1123,16 @@ int define_level(void) + yyerror("no level name for level definition?"); + return -1; + } +- levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table, (hashtab_key_t) id); ++ levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table, ++ (hashtab_key_t) id); + if (!levdatum) { + yyerror2("unknown sensitivity %s used in level definition", id); + free(id); + return -1; + } + if (ebitmap_length(&levdatum->level->cat)) { +- yyerror2("sensitivity %s used in multiple level definitions", id); ++ yyerror2("sensitivity %s used in multiple level definitions", ++ id); + free(id); + return -1; + } +@@ -936,16 +1150,22 @@ int define_level(void) + + *(id_end++) = '\0'; + +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) +- id_start); ++ cdatum = ++ (cat_datum_t *) hashtab_search(policydbp->p_cats. ++ table, ++ (hashtab_key_t) ++ id_start); + if (!cdatum) { + yyerror2("unknown category %s", id_start); + free(id); + return -1; + } + range_start = cdatum->s.value - 1; +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) +- id_end); ++ cdatum = ++ (cat_datum_t *) hashtab_search(policydbp->p_cats. ++ table, ++ (hashtab_key_t) ++ id_end); + if (!cdatum) { + yyerror2("unknown category %s", id_end); + free(id); +@@ -959,7 +1179,10 @@ int define_level(void) + return -1; + } + } else { +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) id); ++ cdatum = ++ (cat_datum_t *) hashtab_search(policydbp->p_cats. ++ table, ++ (hashtab_key_t) id); + range_start = range_end = cdatum->s.value - 1; + } + +@@ -974,7 +1197,8 @@ int define_level(void) + free(id); + } + +- if (hashtab_map(policydbp->p_levels.table, clone_level, levdatum->level)) { ++ if (hashtab_map ++ (policydbp->p_levels.table, clone_level, levdatum->level)) { + yyerror("out of memory"); + return -1; + } +@@ -1003,7 +1227,8 @@ static int add_aliases_to_type(type_datum_t * type) + while ((id = queue_remove(id_queue))) { + if (id_has_dot(id)) { + free(id); +- yyerror("type alias identifiers may not contain periods"); ++ yyerror ++ ("type alias identifiers may not contain periods"); + return -1; + } + aliasdatum = (type_datum_t *) malloc(sizeof(type_datum_t)); +@@ -1015,39 +1240,40 @@ static int add_aliases_to_type(type_datum_t * type) + memset(aliasdatum, 0, sizeof(type_datum_t)); + aliasdatum->s.value = type->s.value; + +- ret = declare_symbol(SYM_TYPES, id, aliasdatum, NULL, &aliasdatum->s.value); ++ ret = declare_symbol(SYM_TYPES, id, aliasdatum, ++ NULL, &aliasdatum->s.value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto cleanup; +- } ++ yyerror("Out of memory!"); ++ goto cleanup; ++ } + case -2:{ +- yyerror2("duplicate declaration of alias %s", id); +- goto cleanup; +- } ++ yyerror2("duplicate declaration of alias %s", ++ id); ++ goto cleanup; ++ } + case -1:{ +- yyerror("could not declare alias here"); +- goto cleanup; +- } +- case 0: +- break; ++ yyerror("could not declare alias here"); ++ goto cleanup; ++ } ++ case 0: break; + case 1:{ +- /* ret == 1 means the alias was required and therefore already +- * has a value. Set it up as an alias with a different primary. */ +- type_datum_destroy(aliasdatum); +- free(aliasdatum); ++ /* ret == 1 means the alias was required and therefore already ++ * has a value. Set it up as an alias with a different primary. */ ++ type_datum_destroy(aliasdatum); ++ free(aliasdatum); + +- aliasdatum = hashtab_search(policydbp->symtab[SYM_TYPES].table, id); +- assert(aliasdatum); ++ aliasdatum = hashtab_search(policydbp->symtab[SYM_TYPES].table, id); ++ assert(aliasdatum); + +- aliasdatum->primary = type->s.value; +- aliasdatum->flavor = TYPE_ALIAS; ++ aliasdatum->primary = type->s.value; ++ aliasdatum->flavor = TYPE_ALIAS; + +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + } + return 0; +@@ -1082,11 +1308,11 @@ int define_typealias(void) + } + t = hashtab_search(policydbp->p_types.table, id); + if (!t || t->flavor == TYPE_ATTRIB) { +- yyerror2("unknown type %s, or it was already declared as an " "attribute", id); ++ yyerror2("unknown type %s, or it was already declared as an " ++ "attribute", id); + free(id); + return -1; + } +- free(id); + return add_aliases_to_type(t); + } + +@@ -1118,7 +1344,6 @@ int define_typeattribute(void) + free(id); + return -1; + } +- free(id); + + while ((id = queue_remove(id_queue))) { + if (!is_id_in_scope(SYM_TYPES, id)) { +@@ -1191,7 +1416,8 @@ static int define_typebounds_helper(char *bounds_id, char *type_id) + else if (type->bounds != bounds->s.value) { + yyerror2("type %s has inconsistent master {%s,%s}", + type_id, +- policydbp->p_type_val_to_name[type->bounds - 1], policydbp->p_type_val_to_name[bounds->s.value - 1]); ++ policydbp->p_type_val_to_name[type->bounds - 1], ++ policydbp->p_type_val_to_name[bounds->s.value - 1]); + return -1; + } + +@@ -1200,15 +1426,18 @@ static int define_typebounds_helper(char *bounds_id, char *type_id) + + int define_typebounds(void) + { +- char *bounds, *id; ++ char *id; + + if (pass == 1) { + while ((id = queue_remove(id_queue))) + free(id); + return 0; + } ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_BOUNDARY ++ char *bounds; + +- bounds = (char *)queue_remove(id_queue); ++ bounds = (char *) queue_remove(id_queue); + if (!bounds) { + yyerror("no type name for typebounds definition?"); + return -1; +@@ -1222,13 +1451,15 @@ int define_typebounds(void) + free(bounds); + + return 0; ++#else ++ yyerror("This version of SETools does not have typebounds enabled."); ++#endif + } + + int define_type(int alias) + { + char *id; + type_datum_t *datum, *attr; +- int newattr = 0; + + if (pass == 2) { + /* +@@ -1241,7 +1472,7 @@ int define_type(int alias) + + if ((delim = strrchr(id, '.')) + && (bounds = strdup(id))) { +- bounds[(size_t) (delim - id)] = '\0'; ++ bounds[(size_t)(delim - id)] = '\0'; + + if (define_typebounds_helper(bounds, id)) + return -1; +@@ -1281,8 +1512,6 @@ int define_type(int alias) + /* treat it as a fatal error */ + yyerror2("attribute %s is not declared", id); + return -1; +- } else { +- newattr = 0; + } + + if (attr->flavor != TYPE_ATTRIB) { +@@ -1304,8 +1533,7 @@ int define_type(int alias) + return 0; + } + +-struct val_to_name +-{ ++struct val_to_name { + unsigned int val; + char *name; + }; +@@ -1379,7 +1607,6 @@ int define_compute_type_helper(int which, avrule_t ** rule) + { + char *id; + type_datum_t *datum; +- class_datum_t *cladatum; + ebitmap_t tclasses; + ebitmap_node_t *node; + avrule_t *avrule; +@@ -1397,32 +1624,17 @@ int define_compute_type_helper(int which, avrule_t ** rule) + + while ((id = queue_remove(id_queue))) { + if (set_types(&avrule->stypes, id, &add, 0)) +- return -1; ++ goto bad; + } + add = 1; + while ((id = queue_remove(id_queue))) { + if (set_types(&avrule->ttypes, id, &add, 0)) +- return -1; ++ goto bad; + } + + ebitmap_init(&tclasses); +- while ((id = queue_remove(id_queue))) { +- if (!is_id_in_scope(SYM_CLASSES, id)) { +- yyerror2("class %s is not within scope", id); +- free(id); +- goto bad; +- } +- cladatum = hashtab_search(policydbp->p_classes.table, id); +- if (!cladatum) { +- yyerror2("unknown class %s", id); +- goto bad; +- } +- if (ebitmap_set_bit(&tclasses, cladatum->s.value - 1, TRUE)) { +- yyerror("Out of memory"); +- goto bad; +- } +- free(id); +- } ++ if (read_classes(&tclasses)) ++ goto bad; + + id = (char *)queue_remove(id_queue); + if (!id) { +@@ -1434,22 +1646,22 @@ int define_compute_type_helper(int which, avrule_t ** rule) + free(id); + goto bad; + } +- datum = (type_datum_t *) hashtab_search(policydbp->p_types.table, (hashtab_key_t) id); ++ datum = (type_datum_t *) hashtab_search(policydbp->p_types.table, ++ (hashtab_key_t) id); + if (!datum || datum->flavor == TYPE_ATTRIB) { + yyerror2("unknown type %s", id); + goto bad; + } +- free(id); + + ebitmap_for_each_bit(&tclasses, node, i) { + if (ebitmap_node_get_bit(node, i)) { + perm = malloc(sizeof(class_perm_node_t)); + if (!perm) { + yyerror("out of memory"); +- return -1; ++ goto bad; + } + class_perm_node_init(perm); +- perm->class = i + 1; ++ perm->tclass = i + 1; + perm->data = datum->s.value; + perm->next = avrule->perms; + avrule->perms = perm; +@@ -1472,7 +1684,7 @@ int define_compute_type(int which) + avrule_t *avrule; + int retval; + +- if (pass == 1 || (num_rules && !load_rules)) { ++ if (pass == 1 || (num_rules && !load_rules)) { /* Required for SETools libqpol */ + while ((id = queue_remove(id_queue))) + free(id); + while ((id = queue_remove(id_queue))) +@@ -1519,7 +1731,7 @@ avrule_t *define_cond_compute_type(int which) + char *id; + avrule_t *avrule; + +- if (pass == 1 || (num_rules && !load_rules)) { ++ if (pass == 1 || (num_rules && !load_rules)) { /* Required for SETools libqpol */ + while ((id = queue_remove(id_queue))) + free(id); + while ((id = queue_remove(id_queue))) +@@ -1539,7 +1751,7 @@ avrule_t *define_cond_compute_type(int which) + return avrule; + } + +-int define_bool(void) ++int define_bool_tunable(int is_tunable) + { + char *id, *bool_value; + cond_bool_datum_t *datum; +@@ -1569,27 +1781,29 @@ int define_bool(void) + return -1; + } + memset(datum, 0, sizeof(cond_bool_datum_t)); ++ if (is_tunable) ++ datum->flags |= COND_BOOL_FLAGS_TUNABLE; + ret = declare_symbol(SYM_BOOLS, id, datum, &value, &value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto cleanup; +- } ++ yyerror("Out of memory!"); ++ goto cleanup; ++ } + case -2:{ +- yyerror2("duplicate declaration of boolean %s", id); +- goto cleanup; +- } ++ yyerror2("duplicate declaration of boolean %s", id); ++ goto cleanup; ++ } + case -1:{ +- yyerror("could not declare boolean here"); +- goto cleanup; +- } ++ yyerror("could not declare boolean here"); ++ goto cleanup; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + datum->s.value = value; + +@@ -1601,7 +1815,6 @@ int define_bool(void) + } + + datum->state = (int)(bool_value[0] == 'T') ? 1 : 0; +- free(bool_value); + return 0; + cleanup: + cond_destroy_bool(id, datum, NULL); +@@ -1610,7 +1823,7 @@ int define_bool(void) + + avrule_t *define_cond_pol_list(avrule_t * avlist, avrule_t * sl) + { +- if (pass == 1 || (num_rules && !load_rules)) { ++ if (pass == 1 || (num_rules && !load_rules)) { /* Required for SETools libqpol */ + /* return something so we get through pass 1 */ + return (avrule_t *) 1; + } +@@ -1649,7 +1862,9 @@ int define_te_avtab_helper(int which, avrule_t ** rule) + avrule->line = policydb_lineno; + + while ((id = queue_remove(id_queue))) { +- if (set_types(&avrule->stypes, id, &add, which == AVRULE_NEVERALLOW ? 1 : 0)) { ++ if (set_types ++ (&avrule->stypes, id, &add, ++ which == AVRULE_NEVERALLOW ? 1 : 0)) { + ret = -1; + goto out; + } +@@ -1661,45 +1876,32 @@ int define_te_avtab_helper(int which, avrule_t ** rule) + avrule->flags |= RULE_SELF; + continue; + } +- if (set_types(&avrule->ttypes, id, &add, which == AVRULE_NEVERALLOW ? 1 : 0)) { ++ if (set_types ++ (&avrule->ttypes, id, &add, ++ which == AVRULE_NEVERALLOW ? 1 : 0)) { + ret = -1; + goto out; + } + } + + ebitmap_init(&tclasses); +- while ((id = queue_remove(id_queue))) { +- if (!is_id_in_scope(SYM_CLASSES, id)) { +- yyerror2("class %s is not within scope", id); +- ret = -1; +- goto out; +- } +- cladatum = hashtab_search(policydbp->p_classes.table, id); +- if (!cladatum) { +- yyerror2("unknown class %s used in rule", id); +- ret = -1; +- goto out; +- } +- if (ebitmap_set_bit(&tclasses, cladatum->s.value - 1, TRUE)) { +- yyerror("Out of memory"); +- ret = -1; +- goto out; +- } +- free(id); +- } ++ ret = read_classes(&tclasses); ++ if (ret) ++ goto out; + + perms = NULL; + ebitmap_for_each_bit(&tclasses, node, i) { + if (!ebitmap_node_get_bit(node, i)) + continue; +- cur_perms = (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); ++ cur_perms = ++ (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); + if (!cur_perms) { + yyerror("out of memory"); + ret = -1; + goto out; + } + class_perm_node_init(cur_perms); +- cur_perms->class = i + 1; ++ cur_perms->tclass = i + 1; + if (!perms) + perms = cur_perms; + if (tail) +@@ -1728,21 +1930,29 @@ int define_te_avtab_helper(int which, avrule_t ** rule) + goto next; + } + +- perdatum = hashtab_search(cladatum->permissions.table, id); ++ perdatum = ++ hashtab_search(cladatum->permissions.table, id); + if (!perdatum) { + if (cladatum->comdatum) { +- perdatum = hashtab_search(cladatum->comdatum->permissions.table, id); ++ perdatum = ++ hashtab_search(cladatum->comdatum-> ++ permissions.table, ++ id); + } + } + if (!perdatum) { + if (!suppress) + yyerror2("permission %s is not defined" +- " for class %s", id, policydbp->p_class_val_to_name[i]); ++ " for class %s", id, ++ policydbp->p_class_val_to_name[i]); + continue; +- } else if (!is_perm_in_scope(id, policydbp->p_class_val_to_name[i])) { ++ } else ++ if (!is_perm_in_scope ++ (id, policydbp->p_class_val_to_name[i])) { + if (!suppress) { + yyerror2("permission %s of class %s is" +- " not within scope", id, policydbp->p_class_val_to_name[i]); ++ " not within scope", id, ++ policydbp->p_class_val_to_name[i]); + } + continue; + } else { +@@ -1765,70 +1975,216 @@ int define_te_avtab_helper(int which, avrule_t ** rule) + + } + +-avrule_t *define_cond_te_avtab(int which) ++avrule_t *define_cond_te_avtab(int which) ++{ ++ char *id; ++ avrule_t *avrule; ++ int i; ++ ++ if (pass == 1 || (num_rules && !load_rules)) { /* Required for SETools libqpol */ ++ for (i = 0; i < 4; i++) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ } ++ return (avrule_t *) 1; /* any non-NULL value */ ++ } ++ ++ num_rules++; ++ ++ if (define_te_avtab_helper(which, &avrule)) ++ return COND_ERR; ++ ++ return avrule; ++} ++ ++int define_te_avtab(int which) ++{ ++ char *id; ++ avrule_t *avrule; ++ int i; ++ ++ if (pass == 1 || (num_rules && !load_rules)) { /* Required for SETools libqpol */ ++ for (i = 0; i < 4; i++) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ } ++ return 0; ++ } ++ ++ num_rules++; ++ ++ if (define_te_avtab_helper(which, &avrule)) ++ return -1; ++ ++ /* append this avrule to the end of the current rules list */ ++ append_avrule(avrule); ++ return 0; ++} ++ ++/* The role-types rule is no longer used to declare regular role or ++ * role attribute, but solely aimed for declaring role-types associations. ++ */ ++int define_role_types(void) ++{ ++ role_datum_t *role; ++ char *id; ++ int add = 1; ++ ++ if (pass == 1) { ++ while ((id = queue_remove(id_queue))) ++ free(id); ++ return 0; ++ } ++ ++ id = (char *)queue_remove(id_queue); ++ if (!id) { ++ yyerror("no role name for role-types rule?"); ++ return -1; ++ } ++ ++ if (!is_id_in_scope(SYM_ROLES, id)) { ++ yyerror2("role %s is not within scope", id); ++ free(id); ++ return -1; ++ } ++ ++ role = hashtab_search(policydbp->p_roles.table, id); ++ if (!role) { ++ yyerror2("unknown role %s", id); ++ free(id); ++ return -1; ++ } ++ ++ while ((id = queue_remove(id_queue))) { ++ if (set_types(&role->types, id, &add, 0)) ++ return -1; ++ } ++ ++ return 0; ++} ++ ++int define_attrib_role(void) + { +- char *id; +- avrule_t *avrule; +- int i; +- +- if (pass == 1 || (num_rules && !load_rules)) { +- for (i = 0; i < 4; i++) { +- while ((id = queue_remove(id_queue))) +- free(id); +- } +- return (avrule_t *) 1; /* any non-NULL value */ ++ if (pass == 2) { ++ free(queue_remove(id_queue)); ++ return 0; + } + +- num_rules++; +- +- if (define_te_avtab_helper(which, &avrule)) +- return COND_ERR; ++ /* Declare a role attribute */ ++ if (declare_role(TRUE) == NULL) ++ return -1; + +- return avrule; ++ return 0; + } + +-int define_te_avtab(int which) ++int define_role_attr(void) + { + char *id; +- avrule_t *avrule; +- int i; ++ role_datum_t *r, *attr; + +- if (pass == 1 || (num_rules && !load_rules)) { +- for (i = 0; i < 4; i++) { +- while ((id = queue_remove(id_queue))) +- free(id); +- } ++ if (pass == 2) { ++ while ((id = queue_remove(id_queue))) ++ free(id); + return 0; + } ++ ++ /* Declare a regular role */ ++ if ((r = declare_role(FALSE)) == NULL) ++ return -1; + +- num_rules++; ++ while ((id = queue_remove(id_queue))) { ++ if (!is_id_in_scope(SYM_ROLES, id)) { ++ yyerror2("attribute %s is not within scope", id); ++ free(id); ++ return -1; ++ } ++ attr = hashtab_search(policydbp->p_roles.table, id); ++ if (!attr) { ++ /* treat it as a fatal error */ ++ yyerror2("role attribute %s is not declared", id); ++ free(id); ++ return -1; ++ } + +- if (define_te_avtab_helper(which, &avrule)) +- return -1; ++ if (attr->flavor != ROLE_ATTRIB) { ++ yyerror2("%s is a regular role, not an attribute", id); ++ free(id); ++ return -1; ++ } ++ ++ if ((attr = get_local_role(id, attr->s.value, 1)) == NULL) { ++ yyerror("Out of memory!"); ++ return -1; ++ } ++ ++ if (ebitmap_set_bit(&attr->roles, (r->s.value - 1), TRUE)) { ++ yyerror("out of memory"); ++ return -1; ++ } ++ } + +- /* append this avrule to the end of the current rules list */ +- append_avrule(avrule); + return 0; + } + +-int define_role_types(void) ++int define_roleattribute(void) + { +- role_datum_t *role; + char *id; +- int add = 1; ++ role_datum_t *r, *attr; + +- if (pass == 1) { ++ if (pass == 2) { + while ((id = queue_remove(id_queue))) + free(id); + return 0; + } + +- if ((role = declare_role()) == NULL) { ++ id = (char *)queue_remove(id_queue); ++ if (!id) { ++ yyerror("no role name for roleattribute definition?"); ++ return -1; ++ } ++ ++ if (!is_id_in_scope(SYM_ROLES, id)) { ++ yyerror2("role %s is not within scope", id); ++ free(id); ++ return -1; ++ } ++ r = hashtab_search(policydbp->p_roles.table, id); ++ /* We support adding one role attribute into another */ ++ if (!r) { ++ yyerror2("unknown role %s", id); ++ free(id); + return -1; + } ++ + while ((id = queue_remove(id_queue))) { +- if (set_types(&role->types, id, &add, 0)) ++ if (!is_id_in_scope(SYM_ROLES, id)) { ++ yyerror2("attribute %s is not within scope", id); ++ free(id); ++ return -1; ++ } ++ attr = hashtab_search(policydbp->p_roles.table, id); ++ if (!attr) { ++ /* treat it as a fatal error */ ++ yyerror2("role attribute %s is not declared", id); ++ free(id); ++ return -1; ++ } ++ ++ if (attr->flavor != ROLE_ATTRIB) { ++ yyerror2("%s is a regular role, not an attribute", id); ++ free(id); ++ return -1; ++ } ++ ++ if ((attr = get_local_role(id, attr->s.value, 1)) == NULL) { ++ yyerror("Out of memory!"); ++ return -1; ++ } ++ ++ if (ebitmap_set_bit(&attr->roles, (r->s.value - 1), TRUE)) { ++ yyerror("out of memory"); + return -1; ++ } + } + + return 0; +@@ -1848,13 +2204,15 @@ role_datum_t *merge_roles_dom(role_datum_t * r1, role_datum_t * r2) + return NULL; + } + memset(new, 0, sizeof(role_datum_t)); +- new->s.value = 0; /* temporary role */ ++ new->s.value = 0; /* temporary role */ + if (ebitmap_or(&new->dominates, &r1->dominates, &r2->dominates)) { + yyerror("out of memory"); ++ free(new); + return NULL; + } + if (ebitmap_or(&new->types.types, &r1->types.types, &r2->types.types)) { + yyerror("out of memory"); ++ free(new); + return NULL; + } + if (!r1->s.value) { +@@ -1874,7 +2232,8 @@ role_datum_t *merge_roles_dom(role_datum_t * r1, role_datum_t * r2) + } + + /* This function eliminates the ordering dependency of role dominance rule */ +-static int dominate_role_recheck(hashtab_key_t key, hashtab_datum_t datum, void *arg) ++static int dominate_role_recheck(hashtab_key_t key, hashtab_datum_t datum, ++ void *arg) + { + role_datum_t *rdp = (role_datum_t *) arg; + role_datum_t *rdatum = (role_datum_t *) datum; +@@ -1896,12 +2255,14 @@ static int dominate_role_recheck(hashtab_key_t key, hashtab_datum_t datum, void + /* raise types and dominates from dominated role */ + ebitmap_for_each_bit(&rdp->dominates, node, i) { + if (ebitmap_node_get_bit(node, i)) +- if (ebitmap_set_bit(&rdatum->dominates, i, TRUE)) ++ if (ebitmap_set_bit ++ (&rdatum->dominates, i, TRUE)) + goto oom; + } + ebitmap_for_each_bit(&types, node, i) { + if (ebitmap_node_get_bit(node, i)) +- if (ebitmap_set_bit(&rdatum->types.types, i, TRUE)) ++ if (ebitmap_set_bit ++ (&rdatum->types.types, i, TRUE)) + goto oom; + } + ebitmap_destroy(&types); +@@ -1936,7 +2297,8 @@ role_datum_t *define_role_dom(role_datum_t * r) + free(role_id); + return NULL; + } +- role = (role_datum_t *) hashtab_search(policydbp->p_roles.table, role_id); ++ role = (role_datum_t *) hashtab_search(policydbp->p_roles.table, ++ role_id); + if (!role) { + role = (role_datum_t *) malloc(sizeof(role_datum_t)); + if (!role) { +@@ -1945,27 +2307,31 @@ role_datum_t *define_role_dom(role_datum_t * r) + return NULL; + } + memset(role, 0, sizeof(role_datum_t)); +- ret = declare_symbol(SYM_ROLES, (hashtab_key_t) role_id, (hashtab_datum_t) role, &role->s.value, &role->s.value); ++ ret = ++ declare_symbol(SYM_ROLES, (hashtab_key_t) role_id, ++ (hashtab_datum_t) role, &role->s.value, ++ &role->s.value); + switch (ret) { + case -3:{ +- yyerror("Out of memory!"); +- goto cleanup; +- } ++ yyerror("Out of memory!"); ++ goto cleanup; ++ } + case -2:{ +- yyerror2("duplicate declaration of role %s", role_id); +- goto cleanup; +- } ++ yyerror2("duplicate declaration of role %s", ++ role_id); ++ goto cleanup; ++ } + case -1:{ +- yyerror("could not declare role here"); +- goto cleanup; +- } ++ yyerror("could not declare role here"); ++ goto cleanup; ++ } + case 0: + case 1:{ +- break; +- } ++ break; ++ } + default:{ +- assert(0); /* should never get here */ +- } ++ assert(0); /* should never get here */ ++ } + } + if (ebitmap_set_bit(&role->dominates, role->s.value - 1, TRUE)) { + yyerror("Out of memory!"); +@@ -1986,7 +2352,8 @@ role_datum_t *define_role_dom(role_datum_t * r) + } + ebitmap_for_each_bit(&types, node, i) { + if (ebitmap_node_get_bit(node, i)) +- if (ebitmap_set_bit(&role->types.types, i, TRUE)) ++ if (ebitmap_set_bit ++ (&role->types.types, i, TRUE)) + goto oom; + } + ebitmap_destroy(&types); +@@ -2000,7 +2367,8 @@ role_datum_t *define_role_dom(role_datum_t * r) + * Now go through all the roles and escalate this role's + * dominates and types if a role dominates this role. + */ +- hashtab_map(policydbp->p_roles.table, dominate_role_recheck, role); ++ hashtab_map(policydbp->p_roles.table, ++ dominate_role_recheck, role); + } + return role; + cleanup: +@@ -2013,7 +2381,8 @@ role_datum_t *define_role_dom(role_datum_t * r) + goto cleanup; + } + +-static int role_val_to_name_helper(hashtab_key_t key, hashtab_datum_t datum, void *p) ++static int role_val_to_name_helper(hashtab_key_t key, hashtab_datum_t datum, ++ void *p) + { + struct val_to_name *v = p; + role_datum_t *roldatum; +@@ -2076,17 +2445,18 @@ static int set_roles(role_set_t * set, char *id) + return 0; + } + +-int define_role_trans(void) ++int define_role_trans(int class_specified) + { + char *id; + role_datum_t *role; + role_set_t roles; + type_set_t types; +- ebitmap_t e_types, e_roles; +- ebitmap_node_t *tnode, *rnode; ++ class_datum_t *cladatum; ++ ebitmap_t e_types, e_roles, e_classes; ++ ebitmap_node_t *tnode, *rnode, *cnode; + struct role_trans *tr = NULL; + struct role_trans_rule *rule = NULL; +- unsigned int i, j; ++ unsigned int i, j, k; + int add = 1; + + if (pass == 1) { +@@ -2094,6 +2464,9 @@ int define_role_trans(void) + free(id); + while ((id = queue_remove(id_queue))) + free(id); ++ if (class_specified) ++ while ((id = queue_remove(id_queue))) ++ free(id); + id = queue_remove(id_queue); + free(id); + return 0; +@@ -2103,6 +2476,7 @@ int define_role_trans(void) + ebitmap_init(&e_roles); + type_set_init(&types); + ebitmap_init(&e_types); ++ ebitmap_init(&e_classes); + + while ((id = queue_remove(id_queue))) { + if (set_roles(&roles, id)) +@@ -2114,6 +2488,24 @@ int define_role_trans(void) + return -1; + } + ++ if (class_specified) { ++ if (read_classes(&e_classes)) ++ return -1; ++ } else { ++ cladatum = hashtab_search(policydbp->p_classes.table, ++ "process"); ++ if (!cladatum) { ++ yyerror2("could not find process class for " ++ "legacy role_transition statement"); ++ return -1; ++ } ++ ++ if (ebitmap_set_bit(&e_classes, cladatum->s.value - 1, TRUE)) { ++ yyerror("out of memory"); ++ return -1; ++ } ++ } ++ + id = (char *)queue_remove(id_queue); + if (!id) { + yyerror("no new role in transition definition?"); +@@ -2129,9 +2521,14 @@ int define_role_trans(void) + yyerror2("unknown role %s used in transition definition", id); + goto bad; + } +- free(id); ++ ++ if (role->flavor != ROLE_ROLE) { ++ yyerror2("the new role %s must be a regular role", id); ++ goto bad; ++ } + + /* This ebitmap business is just to ensure that there are not conflicting role_trans rules */ ++/* Required for SETools libqpol */ + #ifdef HAVE_SEPOL_ROLE_ATTRS + if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL)) + #elif HAVE_SEPOL_USER_ROLE_MAPPING +@@ -2150,26 +2547,37 @@ int define_role_trans(void) + ebitmap_for_each_bit(&e_types, tnode, j) { + if (!ebitmap_node_get_bit(tnode, j)) + continue; +- +- for (tr = policydbp->role_tr; tr; tr = tr->next) { +- if (tr->role == (i + 1) && tr->type == (j + 1)) { +- yyerror2("duplicate role transition for (%s,%s)", +- role_val_to_name(i + 1), policydbp->p_type_val_to_name[j]); +- goto bad; ++ ebitmap_for_each_bit(&e_classes, cnode, k) { ++ if (!ebitmap_node_get_bit(cnode, k)) ++ continue; ++ for (tr = policydbp->role_tr; tr; ++ tr = tr->next) { ++ if (tr->role == (i + 1) && ++ tr->type == (j + 1) && ++ tr->tclass == (k + 1)) { ++ yyerror2("duplicate role " ++ "transition for " ++ "(%s,%s,%s)", ++ role_val_to_name(i+1), ++ policydbp->p_type_val_to_name[j], ++ policydbp->p_class_val_to_name[k]); ++ goto bad; ++ } + } +- } + +- tr = malloc(sizeof(struct role_trans)); +- if (!tr) { +- yyerror("out of memory"); +- return -1; ++ tr = malloc(sizeof(struct role_trans)); ++ if (!tr) { ++ yyerror("out of memory"); ++ return -1; ++ } ++ memset(tr, 0, sizeof(struct role_trans)); ++ tr->role = i + 1; ++ tr->type = j + 1; ++ tr->tclass = k + 1; ++ tr->new_role = role->s.value; ++ tr->next = policydbp->role_tr; ++ policydbp->role_tr = tr; + } +- memset(tr, 0, sizeof(struct role_trans)); +- tr->role = i + 1; +- tr->type = j + 1; +- tr->new_role = role->s.value; +- tr->next = policydbp->role_tr; +- policydbp->role_tr = tr; + } + } + /* Now add the real rule */ +@@ -2181,6 +2589,7 @@ int define_role_trans(void) + memset(rule, 0, sizeof(struct role_trans_rule)); + rule->roles = roles; + rule->types = types; ++ rule->classes = e_classes; + rule->new_role = role->s.value; + + append_role_trans(rule); +@@ -2215,13 +2624,17 @@ int define_role_allow(void) + role_allow_rule_init(ra); + + while ((id = queue_remove(id_queue))) { +- if (set_roles(&ra->roles, id)) ++ if (set_roles(&ra->roles, id)) { ++ free(ra); + return -1; ++ } + } + + while ((id = queue_remove(id_queue))) { +- if (set_roles(&ra->new_roles, id)) ++ if (set_roles(&ra->new_roles, id)) { ++ free(ra); + return -1; ++ } + } + + append_role_allow(ra); +@@ -2237,18 +2650,7 @@ avrule_t *define_cond_filename_trans(void) + + int define_filename_trans(void) + { +- char *id, *name = NULL; +- type_set_t stypes, ttypes; +- ebitmap_t e_stypes, e_ttypes; +- ebitmap_t e_tclasses; +- ebitmap_node_t *snode, *tnode, *cnode; +- filename_trans_t *ft; +- filename_trans_rule_t *ftr; +- class_datum_t *cladatum; +- type_datum_t *typdatum; +- uint32_t otype; +- unsigned int c, s, t; +- int add; ++ char *id; + + if (pass == 1) { + /* stype */ +@@ -2268,7 +2670,19 @@ int define_filename_trans(void) + free(id); + return 0; + } +- ++/* Required for SETools libqpol */ ++#ifdef HAVE_SEPOL_FILENAME_TRANS ++ char *name = NULL; ++ type_set_t stypes, ttypes; ++ ebitmap_t e_stypes, e_ttypes; ++ ebitmap_t e_tclasses; ++ ebitmap_node_t *snode, *tnode, *cnode; ++ filename_trans_t *ft; ++ filename_trans_rule_t *ftr; ++ type_datum_t *typdatum; ++ uint32_t otype; ++ unsigned int c, s, t; ++ int add; + + add = 1; + type_set_init(&stypes); +@@ -2285,23 +2699,8 @@ int define_filename_trans(void) + } + + ebitmap_init(&e_tclasses); +- while ((id = queue_remove(id_queue))) { +- if (!is_id_in_scope(SYM_CLASSES, id)) { +- yyerror2("class %s is not within scope", id); +- free(id); +- goto bad; +- } +- cladatum = hashtab_search(policydbp->p_classes.table, id); +- if (!cladatum) { +- yyerror2("unknown class %s", id); +- goto bad; +- } +- if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) { +- yyerror("Out of memory"); +- goto bad; +- } +- free(id); +- } ++ if (read_classes(&e_tclasses)) ++ goto bad; + + id = (char *)queue_remove(id_queue); + if (!id) { +@@ -2360,8 +2759,7 @@ int define_filename_trans(void) + policydbp->p_class_val_to_name[c]); + goto bad; + } +- } +- ++ } + ft = malloc(sizeof(*ft)); + if (!ft) { + yyerror("out of memory"); +@@ -2383,7 +2781,6 @@ int define_filename_trans(void) + ft->otype = otype; + } + } +- + /* Now add the real rule since we didn't find any duplicates */ + ftr = malloc(sizeof(*ftr)); + if (!ftr) { +@@ -2410,6 +2807,9 @@ int define_filename_trans(void) + bad: + free(name); + return -1; ++#else ++ yyerror("This version of SETools does not have filename type_transition rules enabled."); ++#endif + } + + static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr) +@@ -2433,7 +2833,8 @@ static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr) + newe->op = e->op; + if (newe->expr_type == CEXPR_NAMES) { + if (newe->attr & CEXPR_TYPE) { +- if (type_set_cpy(newe->type_names, e->type_names)) ++ if (type_set_cpy ++ (newe->type_names, e->type_names)) + goto oom; + } else { + if (ebitmap_cpy(&newe->names, &e->names)) +@@ -2520,7 +2921,9 @@ int define_constraint(constraint_expr_t * expr) + free(id); + return -1; + } +- cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table, (hashtab_key_t) id); ++ cladatum = ++ (class_datum_t *) hashtab_search(policydbp->p_classes.table, ++ (hashtab_key_t) id); + if (!cladatum) { + yyerror2("class %s is not defined", id); + ebitmap_destroy(&classmap); +@@ -2536,6 +2939,7 @@ int define_constraint(constraint_expr_t * expr) + node = malloc(sizeof(struct constraint_node)); + if (!node) { + yyerror("out of memory"); ++ free(node); + return -1; + } + memset(node, 0, sizeof(constraint_node_t)); +@@ -2547,6 +2951,7 @@ int define_constraint(constraint_expr_t * expr) + } + if (!node->expr) { + yyerror("out of memory"); ++ free(node); + return -1; + } + node->permissions = 0; +@@ -2563,22 +2968,33 @@ int define_constraint(constraint_expr_t * expr) + cladatum = policydbp->class_val_to_struct[i]; + node = cladatum->constraints; + +- perdatum = (perm_datum_t *) hashtab_search(cladatum->permissions.table, (hashtab_key_t) +- id); ++ perdatum = ++ (perm_datum_t *) hashtab_search(cladatum-> ++ permissions. ++ table, ++ (hashtab_key_t) ++ id); + if (!perdatum) { + if (cladatum->comdatum) { +- perdatum = (perm_datum_t *) +- hashtab_search(cladatum->comdatum->permissions.table, (hashtab_key_t) +- id); ++ perdatum = ++ (perm_datum_t *) ++ hashtab_search(cladatum-> ++ comdatum-> ++ permissions. ++ table, ++ (hashtab_key_t) ++ id); + } + if (!perdatum) { +- yyerror2("permission %s is not" " defined", id); ++ yyerror2("permission %s is not" ++ " defined", id); + free(id); + ebitmap_destroy(&classmap); + return -1; + } + } +- node->permissions |= (1 << (perdatum->s.value - 1)); ++ node->permissions |= ++ (1 << (perdatum->s.value - 1)); + } + } + free(id); +@@ -2647,7 +3063,9 @@ int define_validatetrans(constraint_expr_t * expr) + free(id); + return -1; + } +- cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table, (hashtab_key_t) id); ++ cladatum = ++ (class_datum_t *) hashtab_search(policydbp->p_classes.table, ++ (hashtab_key_t) id); + if (!cladatum) { + yyerror2("class %s is not defined", id); + ebitmap_destroy(&classmap); +@@ -2701,10 +3119,11 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2) + while ((id = queue_remove(id_queue))) + free(id); + } +- return 1; /* any non-NULL value */ ++ return 1; /* any non-NULL value */ + } + +- if ((expr = malloc(sizeof(*expr))) == NULL || constraint_expr_init(expr) == -1) { ++ if ((expr = malloc(sizeof(*expr))) == NULL || ++ constraint_expr_init(expr) == -1) { + yyerror("out of memory"); + free(expr); + return 0; +@@ -2766,12 +3185,17 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2) + while ((id = (char *)queue_remove(id_queue))) { + if (expr->attr & CEXPR_USER) { + if (!is_id_in_scope(SYM_USERS, id)) { +- yyerror2("user %s is not within scope", id); ++ yyerror2("user %s is not within scope", ++ id); + constraint_expr_destroy(expr); + return 0; + } +- user = (user_datum_t *) hashtab_search(policydbp->p_users.table, (hashtab_key_t) +- id); ++ user = ++ (user_datum_t *) hashtab_search(policydbp-> ++ p_users. ++ table, ++ (hashtab_key_t) ++ id); + if (!user) { + yyerror2("unknown user %s", id); + constraint_expr_destroy(expr); +@@ -2780,12 +3204,17 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2) + val = user->s.value; + } else if (expr->attr & CEXPR_ROLE) { + if (!is_id_in_scope(SYM_ROLES, id)) { +- yyerror2("role %s is not within scope", id); ++ yyerror2("role %s is not within scope", ++ id); + constraint_expr_destroy(expr); + return 0; + } +- role = (role_datum_t *) hashtab_search(policydbp->p_roles.table, (hashtab_key_t) +- id); ++ role = ++ (role_datum_t *) hashtab_search(policydbp-> ++ p_roles. ++ table, ++ (hashtab_key_t) ++ id); + if (!role) { + yyerror2("unknown role %s", id); + constraint_expr_destroy(expr); +@@ -2814,22 +3243,19 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2) + ebitmap_destroy(&negset); + return (uintptr_t) expr; + default: +- yyerror("invalid constraint expression"); +- constraint_expr_destroy(expr); +- return 0; ++ break; + } + + yyerror("invalid constraint expression"); +- free(expr); ++ constraint_expr_destroy(expr); + return 0; + } + + int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f) + { + cond_expr_t *e; +- int depth, retval; ++ int depth; + cond_node_t cn, *cn_old; +- avrule_t *tmp, *last_tmp; + + /* expression cannot be NULL */ + if (!expr) { +@@ -2858,7 +3284,8 @@ int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f) + switch (e->expr_type) { + case COND_NOT: + if (depth < 0) { +- yyerror("illegal conditional expression; Bad NOT"); ++ yyerror ++ ("illegal conditional expression; Bad NOT"); + return -1; + } + break; +@@ -2868,14 +3295,16 @@ int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f) + case COND_EQ: + case COND_NEQ: + if (depth < 1) { +- yyerror("illegal conditional expression; Bad binary op"); ++ yyerror ++ ("illegal conditional expression; Bad binary op"); + return -1; + } + depth--; + break; + case COND_BOOL: + if (depth == (COND_EXPR_MAXDEPTH - 1)) { +- yyerror("conditional expression is like totally too deep"); ++ yyerror ++ ("conditional expression is like totally too deep"); + return -1; + } + depth++; +@@ -2908,11 +3337,14 @@ int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f) + return -1; + } + ++ /* Required for SETools libqpol */ ++ avrule_t *tmp, *last_tmp; ++ int retval; + /* verify te rules -- both true and false branches of conditional */ + tmp = cn.avtrue_list; + last_tmp = NULL; + while (tmp) { +- if (!tmp->specified & AVRULE_TRANSITION) ++ if (!(tmp->specified & AVRULE_TRANSITION)) + continue; + retval = insert_check_type_rule(tmp, &policydbp->te_cond_avtab, &cn_old->true_list, &cn_old->false_list); + switch (retval) { +@@ -2951,7 +3383,7 @@ int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f) + tmp = cn.avfalse_list; + last_tmp = NULL; + while (tmp) { +- if (!tmp->specified & AVRULE_TRANSITION) ++ if (!(tmp->specified & AVRULE_TRANSITION)) + continue; + retval = insert_check_type_rule(tmp, &policydbp->te_cond_avtab, &cn_old->false_list, &cn_old->true_list); + switch (retval) { +@@ -3053,7 +3485,8 @@ cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2) + e2 = e2->next; + } + if (!e1 || e1->next) { +- yyerror("illegal left side of conditional binary op expression"); ++ yyerror ++ ("illegal left side of conditional binary op expression"); + free(expr); + return NULL; + } +@@ -3066,7 +3499,8 @@ cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2) + e2 = e2->next; + } + if (!e1 || e1->next) { +- yyerror("illegal right side of conditional binary op expression"); ++ yyerror ++ ("illegal right side of conditional binary op expression"); + free(expr); + return NULL; + } +@@ -3086,9 +3520,13 @@ cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2) + free(expr); + return NULL; + } +- bool_var = (cond_bool_datum_t *) hashtab_search(policydbp->p_bools.table, (hashtab_key_t) id); ++ bool_var = ++ (cond_bool_datum_t *) hashtab_search(policydbp->p_bools. ++ table, ++ (hashtab_key_t) id); + if (!bool_var) { +- yyerror2("unknown boolean %s in conditional expression", id); ++ yyerror2("unknown boolean %s in conditional expression", ++ id); + free(expr); + free(id); + return NULL; +@@ -3098,6 +3536,7 @@ cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2) + return expr; + default: + yyerror("illegal conditional expression"); ++ free(expr); + return NULL; + } + } +@@ -3156,14 +3595,16 @@ static int parse_categories(char *id, level_datum_t * levdatum, ebitmap_t * cats + + *(id_end++) = '\0'; + +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) + id_start); + if (!cdatum) { + yyerror2("unknown category %s", id_start); + return -1; + } + range_start = cdatum->s.value - 1; +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) id_end); ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) id_end); + if (!cdatum) { + yyerror2("unknown category %s", id_end); + return -1; +@@ -3175,7 +3616,8 @@ static int parse_categories(char *id, level_datum_t * levdatum, ebitmap_t * cats + return -1; + } + } else { +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) id); ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) id); + if (!cdatum) { + yyerror2("unknown category %s", id); + return -1; +@@ -3188,7 +3630,9 @@ static int parse_categories(char *id, level_datum_t * levdatum, ebitmap_t * cats + uint32_t level_value = levdatum->level->sens - 1; + policydb_index_others(NULL, policydbp, 0); + yyerror2("category %s can not be associated " +- "with level %s", policydbp->p_cat_val_to_name[i], policydbp->p_sens_val_to_name[level_value]); ++ "with level %s", ++ policydbp->p_cat_val_to_name[i], ++ policydbp->p_sens_val_to_name[level_value]); + return -1; + } + if (ebitmap_set_bit(cats, i, TRUE)) { +@@ -3200,7 +3644,8 @@ static int parse_categories(char *id, level_datum_t * levdatum, ebitmap_t * cats + return 0; + } + +-static int parse_semantic_categories(char *id, level_datum_t * levdatum, mls_semantic_cat_t ** cats) ++static int parse_semantic_categories(char *id, level_datum_t * levdatum, ++ mls_semantic_cat_t ** cats) + { + cat_datum_t *cdatum; + mls_semantic_cat_t *newcat; +@@ -3212,7 +3657,8 @@ static int parse_semantic_categories(char *id, level_datum_t * levdatum, mls_sem + + *(id_end++) = '\0'; + +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) + id_start); + if (!cdatum) { + yyerror2("unknown category %s", id_start); +@@ -3220,14 +3666,16 @@ static int parse_semantic_categories(char *id, level_datum_t * levdatum, mls_sem + } + range_start = cdatum->s.value; + +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) id_end); ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) id_end); + if (!cdatum) { + yyerror2("unknown category %s", id_end); + return -1; + } + range_end = cdatum->s.value; + } else { +- cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, (hashtab_key_t) id); ++ cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table, ++ (hashtab_key_t) id); + if (!cdatum) { + yyerror2("unknown category %s", id); + return -1; +@@ -3296,9 +3744,11 @@ int define_user(void) + } + + levdatum = (level_datum_t *) +- hashtab_search(policydbp->p_levels.table, (hashtab_key_t) id); ++ hashtab_search(policydbp->p_levels.table, ++ (hashtab_key_t) id); + if (!levdatum) { +- yyerror2("unknown sensitivity %s used in user" " level definition", id); ++ yyerror2("unknown sensitivity %s used in user" ++ " level definition", id); + free(id); + return -1; + } +@@ -3307,7 +3757,8 @@ int define_user(void) + usrdatum->dfltlevel.sens = levdatum->level->sens; + + while ((id = queue_remove(id_queue))) { +- if (parse_semantic_categories(id, levdatum, &usrdatum->dfltlevel.cat)) { ++ if (parse_semantic_categories(id, levdatum, ++ &usrdatum->dfltlevel.cat)) { + free(id); + return -1; + } +@@ -3318,9 +3769,11 @@ int define_user(void) + + for (l = 0; l < 2; l++) { + levdatum = (level_datum_t *) +- hashtab_search(policydbp->p_levels.table, (hashtab_key_t) id); ++ hashtab_search(policydbp->p_levels.table, ++ (hashtab_key_t) id); + if (!levdatum) { +- yyerror2("unknown sensitivity %s used in user" " range definition", id); ++ yyerror2("unknown sensitivity %s used in user" ++ " range definition", id); + free(id); + return -1; + } +@@ -3329,7 +3782,8 @@ int define_user(void) + usrdatum->range.level[l].sens = levdatum->level->sens; + + while ((id = queue_remove(id_queue))) { +- if (parse_semantic_categories(id, levdatum, &usrdatum->range.level[l].cat)) { ++ if (parse_semantic_categories(id, levdatum, ++ &usrdatum->range.level[l].cat)) { + free(id); + return -1; + } +@@ -3342,7 +3796,8 @@ int define_user(void) + } + + if (l == 0) { +- if (mls_semantic_level_cpy(&usrdatum->range.level[1], &usrdatum->range.level[0])) { ++ if (mls_semantic_level_cpy(&usrdatum->range.level[1], ++ &usrdatum->range.level[0])) { + yyerror("out of memory"); + return -1; + } +@@ -3362,11 +3817,11 @@ static int parse_security_context(context_struct_t * c) + + if (pass == 1) { + id = queue_remove(id_queue); +- free(id); /* user */ ++ free(id); /* user */ + id = queue_remove(id_queue); +- free(id); /* role */ ++ free(id); /* role */ + id = queue_remove(id_queue); +- free(id); /* type */ ++ free(id); /* type */ + if (mlspol) { + id = queue_remove(id_queue); + free(id); +@@ -3383,6 +3838,12 @@ static int parse_security_context(context_struct_t * c) + return 0; + } + ++ /* check context c to make sure ok to dereference c later */ ++ if (c == NULL) { ++ yyerror("null context pointer!"); ++ return -1; ++ } ++ + context_init(c); + + /* extract the user */ +@@ -3396,7 +3857,8 @@ static int parse_security_context(context_struct_t * c) + free(id); + goto bad; + } +- usrdatum = (user_datum_t *) hashtab_search(policydbp->p_users.table, (hashtab_key_t) id); ++ usrdatum = (user_datum_t *) hashtab_search(policydbp->p_users.table, ++ (hashtab_key_t) id); + if (!usrdatum) { + yyerror2("user %s is not defined", id); + free(id); +@@ -3418,7 +3880,8 @@ static int parse_security_context(context_struct_t * c) + free(id); + return -1; + } +- role = (role_datum_t *) hashtab_search(policydbp->p_roles.table, (hashtab_key_t) id); ++ role = (role_datum_t *) hashtab_search(policydbp->p_roles.table, ++ (hashtab_key_t) id); + if (!role) { + yyerror2("role %s is not defined", id); + free(id); +@@ -3440,7 +3903,8 @@ static int parse_security_context(context_struct_t * c) + free(id); + return -1; + } +- typdatum = (type_datum_t *) hashtab_search(policydbp->p_types.table, (hashtab_key_t) id); ++ typdatum = (type_datum_t *) hashtab_search(policydbp->p_types.table, ++ (hashtab_key_t) id); + if (!typdatum || typdatum->flavor == TYPE_ATTRIB) { + yyerror2("type %s is not defined or is an attribute", id); + free(id); +@@ -3455,14 +3919,16 @@ static int parse_security_context(context_struct_t * c) + /* extract the low sensitivity */ + id = (char *)queue_head(id_queue); + if (!id) { +- yyerror("no sensitivity name for sid context" " definition?"); ++ yyerror("no sensitivity name for sid context" ++ " definition?"); + return -1; + } + + id = (char *)queue_remove(id_queue); + for (l = 0; l < 2; l++) { + levdatum = (level_datum_t *) +- hashtab_search(policydbp->p_levels.table, (hashtab_key_t) id); ++ hashtab_search(policydbp->p_levels.table, ++ (hashtab_key_t) id); + if (!levdatum) { + yyerror2("Sensitivity %s is not defined", id); + free(id); +@@ -3473,7 +3939,8 @@ static int parse_security_context(context_struct_t * c) + + /* extract low category set */ + while ((id = queue_remove(id_queue))) { +- if (parse_categories(id, levdatum, &c->range.level[l].cat)) { ++ if (parse_categories(id, levdatum, ++ &c->range.level[l].cat)) { + free(id); + return -1; + } +@@ -3488,7 +3955,8 @@ static int parse_security_context(context_struct_t * c) + + if (l == 0) { + c->range.level[1].sens = c->range.level[0].sens; +- if (ebitmap_cpy(&c->range.level[1].cat, &c->range.level[0].cat)) { ++ if (ebitmap_cpy(&c->range.level[1].cat, ++ &c->range.level[0].cat)) { + + yyerror("out of memory"); + goto bad; +@@ -3554,12 +4022,10 @@ int define_fs_context(unsigned int major, unsigned int minor) + { + ocontext_t *newc, *c, *head; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("fscon not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + parse_security_context(NULL); +@@ -3597,7 +4063,8 @@ int define_fs_context(unsigned int major, unsigned int minor) + + for (c = head; c; c = c->next) { + if (!strcmp(newc->u.name, c->u.name)) { +- yyerror2("duplicate entry for file system %s", newc->u.name); ++ yyerror2("duplicate entry for file system %s", ++ newc->u.name); + context_destroy(&newc->context[0]); + context_destroy(&newc->context[1]); + free(newc->u.name); +@@ -3617,17 +4084,13 @@ int define_pirq_context(unsigned int pirq) + ocontext_t *newc, *c, *l, *head; + char *id; + +-#ifndef SEPOL_TARGET_XEN +- yyerror("pirqcon not supported for target"); +- return -1; +-#else + if (policydbp->target_platform != SEPOL_TARGET_XEN) { + yyerror("pirqcon not supported for target"); + return -1; + } + + if (pass == 1) { +- id = (char *)queue_remove(id_queue); ++ id = (char *) queue_remove(id_queue); + free(id); + parse_security_context(NULL); + return 0; +@@ -3665,10 +4128,9 @@ int define_pirq_context(unsigned int pirq) + + return 0; + +- bad: ++bad: + free(newc); + return -1; +-#endif + } + + int define_iomem_context(unsigned long low, unsigned long high) +@@ -3676,10 +4138,6 @@ int define_iomem_context(unsigned long low, unsigned long high) + ocontext_t *newc, *c, *l, *head; + char *id; + +-#ifndef SEPOL_TARGET_XEN +- yyerror("iomemcon not supported for target"); +- return -1; +-#else + if (policydbp->target_platform != SEPOL_TARGET_XEN) { + yyerror("iomemcon not supported for target"); + return -1; +@@ -3699,7 +4157,7 @@ int define_iomem_context(unsigned long low, unsigned long high) + } + memset(newc, 0, sizeof(ocontext_t)); + +- newc->u.iomem.low_iomem = low; ++ newc->u.iomem.low_iomem = low; + newc->u.iomem.high_iomem = high; + + if (low > high) { +@@ -3720,7 +4178,9 @@ int define_iomem_context(unsigned long low, unsigned long high) + low2 = c->u.iomem.low_iomem; + high2 = c->u.iomem.high_iomem; + if (low <= high2 && low2 <= high) { +- yyerror2("iomemcon entry for 0x%x-0x%x overlaps with " "earlier entry 0x%x-0x%x", low, high, low2, high2); ++ yyerror2("iomemcon entry for 0x%x-0x%x overlaps with " ++ "earlier entry 0x%x-0x%x", low, high, ++ low2, high2); + goto bad; + } + } +@@ -3732,10 +4192,9 @@ int define_iomem_context(unsigned long low, unsigned long high) + + return 0; + +- bad: ++bad: + free(newc); + return -1; +-#endif + } + + int define_ioport_context(unsigned long low, unsigned long high) +@@ -3743,10 +4202,6 @@ int define_ioport_context(unsigned long low, unsigned long high) + ocontext_t *newc, *c, *l, *head; + char *id; + +-#ifndef SEPOL_TARGET_XEN +- yyerror("ioportcon not supported for target"); +- return -1; +-#else + if (policydbp->target_platform != SEPOL_TARGET_XEN) { + yyerror("ioportcon not supported for target"); + return -1; +@@ -3766,7 +4221,7 @@ int define_ioport_context(unsigned long low, unsigned long high) + } + memset(newc, 0, sizeof(ocontext_t)); + +- newc->u.ioport.low_ioport = low; ++ newc->u.ioport.low_ioport = low; + newc->u.ioport.high_ioport = high; + + if (low > high) { +@@ -3787,7 +4242,9 @@ int define_ioport_context(unsigned long low, unsigned long high) + low2 = c->u.ioport.low_ioport; + high2 = c->u.ioport.high_ioport; + if (low <= high2 && low2 <= high) { +- yyerror2("ioportcon entry for 0x%x-0x%x overlaps with" "earlier entry 0x%x-0x%x", low, high, low2, high2); ++ yyerror2("ioportcon entry for 0x%x-0x%x overlaps with" ++ "earlier entry 0x%x-0x%x", low, high, ++ low2, high2); + goto bad; + } + } +@@ -3799,10 +4256,9 @@ int define_ioport_context(unsigned long low, unsigned long high) + + return 0; + +- bad: ++bad: + free(newc); + return -1; +-#endif + } + + int define_pcidevice_context(unsigned long device) +@@ -3810,17 +4266,13 @@ int define_pcidevice_context(unsigned long device) + ocontext_t *newc, *c, *l, *head; + char *id; + +-#ifndef SEPOL_TARGET_XEN +- yyerror("pcidevicecon not supported for target"); +- return -1; +-#else + if (policydbp->target_platform != SEPOL_TARGET_XEN) { + yyerror("pcidevicecon not supported for target"); + return -1; + } + + if (pass == 1) { +- id = (char *)queue_remove(id_queue); ++ id = (char *) queue_remove(id_queue); + free(id); + parse_security_context(NULL); + return 0; +@@ -3846,7 +4298,8 @@ int define_pcidevice_context(unsigned long device) + + device2 = c->u.device; + if (device == device2) { +- yyerror2("duplicate pcidevicecon entry for 0x%x ", device); ++ yyerror2("duplicate pcidevicecon entry for 0x%x ", ++ device); + goto bad; + } + } +@@ -3858,10 +4311,9 @@ int define_pcidevice_context(unsigned long device) + + return 0; + +- bad: ++bad: + free(newc); + return -1; +-#endif + } + + int define_port_context(unsigned int low, unsigned int high) +@@ -3870,12 +4322,10 @@ int define_port_context(unsigned int low, unsigned int high) + unsigned int protocol; + char *id; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("portcon not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + id = (char *)queue_remove(id_queue); +@@ -3932,15 +4382,16 @@ int define_port_context(unsigned int low, unsigned int high) + if (protocol != prot2) + continue; + if (low == low2 && high == high2) { +- yyerror2("duplicate portcon entry for %s %d-%d ", id, low, high); ++ yyerror2("duplicate portcon entry for %s %d-%d ", id, ++ low, high); + goto bad; + } + if (low2 <= low && high2 >= high) { +- yyerror2("portcon entry for %s %d-%d hidden by earlier " "entry for %d-%d", id, low, high, low2, high2); ++ yyerror2("portcon entry for %s %d-%d hidden by earlier " ++ "entry for %d-%d", id, low, high, low2, high2); + goto bad; + } + } +- free(id); + + if (l) + l->next = newc; +@@ -3958,12 +4409,10 @@ int define_netif_context(void) + { + ocontext_t *newc, *c, *head; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("netifcon not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + free(queue_remove(id_queue)); +@@ -3999,7 +4448,8 @@ int define_netif_context(void) + + for (c = head; c; c = c->next) { + if (!strcmp(newc->u.name, c->u.name)) { +- yyerror2("duplicate entry for network interface %s", newc->u.name); ++ yyerror2("duplicate entry for network interface %s", ++ newc->u.name); + context_destroy(&newc->context[0]); + context_destroy(&newc->context[1]); + free(newc->u.name); +@@ -4014,18 +4464,16 @@ int define_netif_context(void) + } + + int define_ipv4_node_context() +-{ ++{ + char *id; + int rc = 0; + struct in_addr addr, mask; + ocontext_t *newc, *c, *l, *head; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("nodecon not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + free(queue_remove(id_queue)); +@@ -4097,7 +4545,7 @@ int define_ipv4_node_context() + else + policydbp->ocontexts[OCON_NODE] = newc; + rc = 0; +- out: ++out: + return rc; + } + +@@ -4108,12 +4556,10 @@ int define_ipv6_node_context(void) + struct in6_addr addr, mask; + ocontext_t *newc, *c, *l, *head; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("nodecon not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + free(queue_remove(id_queue)); +@@ -4162,8 +4608,14 @@ int define_ipv6_node_context(void) + } + + memset(newc, 0, sizeof(ocontext_t)); ++ ++#ifdef DARWIN ++ memcpy(&newc->u.node6.addr[0], &addr.s6_addr[0], 16); ++ memcpy(&newc->u.node6.mask[0], &mask.s6_addr[0], 16); ++#else + memcpy(&newc->u.node6.addr[0], &addr.s6_addr32[0], 16); + memcpy(&newc->u.node6.mask[0], &mask.s6_addr32[0], 16); ++#endif + + if (parse_security_context(&newc->context[0])) { + free(newc); +@@ -4195,15 +4647,14 @@ int define_fs_use(int behavior) + { + ocontext_t *newc, *c, *head; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("fsuse not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + free(queue_remove(id_queue)); ++ /* Required for SETools libqpol */ + if (behavior != SECURITY_FS_USE_PSIDS) + parse_security_context(NULL); + return 0; +@@ -4222,6 +4673,7 @@ int define_fs_use(int behavior) + return -1; + } + newc->v.behavior = behavior; ++ /* Required for SETools libqpol */ + if (newc->v.behavior != SECURITY_FS_USE_PSIDS) { + if (parse_security_context(&newc->context[0])) { + free(newc->u.name); +@@ -4235,7 +4687,8 @@ int define_fs_use(int behavior) + + for (c = head; c; c = c->next) { + if (!strcmp(newc->u.name, c->u.name)) { +- yyerror2("duplicate fs_use entry for filesystem type %s", newc->u.name); ++ yyerror2("duplicate fs_use entry for filesystem type %s", ++ newc->u.name); + context_destroy(&newc->context[0]); + free(newc->u.name); + free(newc); +@@ -4255,12 +4708,10 @@ int define_genfs_context_helper(char *fstype, int has_type) + char *type = NULL; + int len, len2; + +-#ifdef SEPOL_TARGET_XEN + if (policydbp->target_platform != SEPOL_TARGET_SELINUX) { + yyerror("genfs not supported for target"); + return -1; + } +-#endif + + if (pass == 1) { + free(fstype); +@@ -4271,7 +4722,8 @@ int define_genfs_context_helper(char *fstype, int has_type) + return 0; + } + +- for (genfs_p = NULL, genfs = policydbp->genfs; genfs; genfs_p = genfs, genfs = genfs->next) { ++ for (genfs_p = NULL, genfs = policydbp->genfs; ++ genfs; genfs_p = genfs, genfs = genfs->next) { + if (strcmp(fstype, genfs->fstype) <= 0) + break; + } +@@ -4290,9 +4742,6 @@ int define_genfs_context_helper(char *fstype, int has_type) + else + policydbp->genfs = newgenfs; + genfs = newgenfs; +- } else { +- free(fstype); +- fstype=NULL; + } + + newc = (ocontext_t *) malloc(sizeof(ocontext_t)); +@@ -4340,16 +4789,17 @@ int define_genfs_context_helper(char *fstype, int has_type) + goto fail; + } + } +- free(type); +- type = NULL; + if (parse_security_context(&newc->context[0])) + goto fail; + + head = genfs->head; + + for (p = NULL, c = head; c; p = c, c = c->next) { +- if (!strcmp(newc->u.name, c->u.name) && (!newc->v.sclass || !c->v.sclass || newc->v.sclass == c->v.sclass)) { +- yyerror2("duplicate entry for genfs entry (%s, %s)", fstype, newc->u.name); ++ if (!strcmp(newc->u.name, c->u.name) && ++ (!newc->v.sclass || !c->v.sclass ++ || newc->v.sclass == c->v.sclass)) { ++ yyerror2("duplicate entry for genfs entry (%s, %s)", ++ fstype, newc->u.name); + goto fail; + } + len = strlen(newc->u.name); +@@ -4434,29 +4884,21 @@ int define_range_trans(int class_specified) + } + + if (class_specified) { +- while ((id = queue_remove(id_queue))) { +- if (!is_id_in_scope(SYM_CLASSES, id)) { +- yyerror2("class %s is not within scope", id); +- free(id); +- goto out; +- } +- cladatum = hashtab_search(policydbp->p_classes.table, id); +- if (!cladatum) { +- yyerror2("unknown class %s", id); +- goto out; +- } +- +- ebitmap_set_bit(&rule->tclasses, cladatum->s.value - 1, TRUE); +- free(id); +- } ++ if (read_classes(&rule->tclasses)) ++ goto out; + } else { +- cladatum = hashtab_search(policydbp->p_classes.table, "process"); ++ cladatum = hashtab_search(policydbp->p_classes.table, ++ "process"); + if (!cladatum) { +- yyerror2("could not find process class for " "legacy range_transition statement"); ++ yyerror2("could not find process class for " ++ "legacy range_transition statement"); + goto out; + } + +- ebitmap_set_bit(&rule->tclasses, cladatum->s.value - 1, TRUE); ++ if (ebitmap_set_bit(&rule->tclasses, cladatum->s.value - 1, TRUE)) { ++ yyerror("out of memory"); ++ goto out; ++ } + } + + id = (char *)queue_remove(id_queue); +@@ -4467,7 +4909,8 @@ int define_range_trans(int class_specified) + for (l = 0; l < 2; l++) { + levdatum = hashtab_search(policydbp->p_levels.table, id); + if (!levdatum) { +- yyerror2("unknown level %s used in range_transition " "definition", id); ++ yyerror2("unknown level %s used in range_transition " ++ "definition", id); + free(id); + goto out; + } +@@ -4476,7 +4919,8 @@ int define_range_trans(int class_specified) + rule->trange.level[l].sens = levdatum->level->sens; + + while ((id = queue_remove(id_queue))) { +- if (parse_semantic_categories(id, levdatum, &rule->trange.level[l].cat)) { ++ if (parse_semantic_categories(id, levdatum, ++ &rule->trange.level[l].cat)) { + free(id); + goto out; + } +@@ -4488,7 +4932,8 @@ int define_range_trans(int class_specified) + break; + } + if (l == 0) { +- if (mls_semantic_level_cpy(&rule->trange.level[1], &rule->trange.level[0])) { ++ if (mls_semantic_level_cpy(&rule->trange.level[1], ++ &rule->trange.level[0])) { + yyerror("out of memory"); + goto out; + } +@@ -4497,8 +4942,9 @@ int define_range_trans(int class_specified) + append_range_trans(rule); + return 0; + +- out: ++out: + range_trans_rule_destroy(rule); ++ free(rule); + return -1; + } + +diff --git a/libqpol/src/policy_define.h b/libqpol/src/policy_define.h +index f273fed..14c1747 100644 +--- a/libqpol/src/policy_define.h ++++ b/libqpol/src/policy_define.h +@@ -19,24 +19,32 @@ + #define TRUE 1 + #define FALSE 0 + ++/* Used by SETools libqpol */ + /** parser used to support fs_use_psid declarations, so revert that bit + * of code here */ + #define SECURITY_FS_USE_PSIDS 6 ++/* Used by SETools to determine if source MLS or not */ ++int define_mls(void); + + avrule_t *define_cond_compute_type(int which); +-avrule_t *define_cond_pol_list(avrule_t * avlist, avrule_t * stmt); ++avrule_t *define_cond_pol_list(avrule_t *avlist, avrule_t *stmt); + avrule_t *define_cond_te_avtab(int which); + avrule_t *define_cond_filename_trans(void); +-cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2); ++cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void* arg2); + int define_attrib(void); ++int define_attrib_role(void); + int define_av_perms(int inherits); +-int define_bool(void); ++int define_bool_tunable(int is_tunable); + int define_category(void); + int define_class(void); ++int define_default_user(int which); ++int define_default_role(int which); ++int define_default_type(int which); ++int define_default_range(int which); + int define_common_perms(void); + int define_compute_type(int which); +-int define_conditional(cond_expr_t * expr, avrule_t * t_list, avrule_t * f_list); +-int define_constraint(constraint_expr_t * expr); ++int define_conditional(cond_expr_t *expr, avrule_t *t_list, avrule_t *f_list ); ++int define_constraint(constraint_expr_t *expr); + int define_dominance(void); + int define_fs_context(unsigned int major, unsigned int minor); + int define_fs_use(int behavior); +@@ -46,7 +54,6 @@ int define_initial_sid(void); + int define_ipv4_node_context(void); + int define_ipv6_node_context(void); + int define_level(void); +-int define_mls(void); + int define_netif_context(void); + int define_permissive(void); + int define_polcap(void); +@@ -57,8 +64,10 @@ int define_ioport_context(unsigned long low, unsigned long high); + int define_pcidevice_context(unsigned long device); + int define_range_trans(int class_specified); + int define_role_allow(void); +-int define_role_trans(void); ++int define_role_trans(int class_specified); + int define_role_types(void); ++int define_role_attr(void); ++int define_roleattribute(void); + int define_filename_trans(void); + int define_sens(void); + int define_te_avtab(int which); +@@ -67,11 +76,11 @@ int define_typeattribute(void); + int define_typebounds(void); + int define_type(int alias); + int define_user(void); +-int define_validatetrans(constraint_expr_t * expr); +-int insert_id(char *id, int push); ++int define_validatetrans(constraint_expr_t *expr); ++int insert_id(char *id,int push); + int insert_separator(int push); +-role_datum_t *define_role_dom(role_datum_t * r); +-role_datum_t *merge_roles_dom(role_datum_t * r1, role_datum_t * r2); ++role_datum_t *define_role_dom(role_datum_t *r); ++role_datum_t *merge_roles_dom(role_datum_t *r1,role_datum_t *r2); + uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2); + +-#endif /* _POLICY_DEFINE_H_ */ ++#endif /* _POLICY_DEFINE_H_ */ +diff --git a/libqpol/src/policy_extend.c b/libqpol/src/policy_extend.c +index 5325a87..1417271 100644 +--- a/libqpol/src/policy_extend.c ++++ b/libqpol/src/policy_extend.c +@@ -843,7 +843,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ + for (class_node = rule->perms; class_node; class_node = class_node->next) { + key.rule_type = rule->specified; + key.source_val = key.target_val = i + 1; +- key.class_val = class_node->class; ++ key.class_val = class_node->tclass; + key.cond = cond; + if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) + goto err; +@@ -856,7 +856,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ + key.rule_type = rule->specified; + key.source_val = i + 1; + key.target_val = j + 1; +- key.class_val = class_node->class; ++ key.class_val = class_node->tclass; + key.cond = cond; + if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) + goto err; +diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y +index dc16c6f..357f3d8 100644 +--- a/libqpol/src/policy_parse.y ++++ b/libqpol/src/policy_parse.y +@@ -3,6 +3,8 @@ + * + * This file is based upon checkpolicy/policy_parse.y from NSA's SVN + * repository. It has been modified to support older policy formats. ++ * The older format just seems to be FSUSEPSID support (see fs_use_def ++ * entry. + */ + + /* +@@ -35,6 +37,7 @@ + /* FLASK */ + + %{ ++/* Add for SETools */ + #include + + #include +@@ -55,12 +58,16 @@ + #include + #include + #include ++/* Add for SETools libqpol */ + #ifdef HAVE_SEPOL_POLICYCAPS + #include + #endif + + #include "queue.h" ++ ++/* #include "checkpolicy.h" - Remove for setools and replace with: */ + #include ++ + #include "module_compiler.h" + #include "policy_define.h" + +@@ -74,6 +81,7 @@ extern int yyerror(char *msg); + + typedef int (* require_func_t)(); + ++/* Add for SETools libqpol */ + /* redefine input so we can read from a string */ + /* borrowed from O'Reilly lex and yacc pg 157 */ + extern char qpol_src_input[]; +@@ -107,6 +115,8 @@ extern char *qpol_src_inputlim;/* end of data */ + %token INHERITS + %token SID + %token ROLE ++%token ROLEATTRIBUTE ++%token ATTRIBUTE_ROLE + %token ROLES + %token TYPEALIAS + %token TYPEATTRIBUTE +@@ -116,6 +126,7 @@ extern char *qpol_src_inputlim;/* end of data */ + %token ALIAS + %token ATTRIBUTE + %token BOOL ++%token TUNABLE + %token IF + %token ELSE + %token TYPE_TRANSITION +@@ -156,6 +167,9 @@ extern char *qpol_src_inputlim;/* end of data */ + %token MODULE VERSION_IDENTIFIER REQUIRE OPTIONAL + %token POLICYCAP + %token PERMISSIVE ++%token FILESYSTEM ++%token DEFAULT_USER DEFAULT_ROLE DEFAULT_TYPE DEFAULT_RANGE ++%token LOW_HIGH LOW HIGH + + %left OR + %left XOR +@@ -170,7 +184,7 @@ base_policy : { if (define_policy(pass, 0) == -1) return -1; } + classes initial_sids access_vectors + { if (pass == 1) { if (policydb_index_classes(policydbp)) return -1; } + else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1; }} +- opt_mls te_rbac users opt_constraints ++ opt_default_rules opt_mls te_rbac users opt_constraints + { if (pass == 1) { if (policydb_index_bools(policydbp)) return -1;} + else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1;}} + initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts +@@ -208,6 +222,46 @@ av_perms_def : CLASS identifier '{' identifier_list '}' + | CLASS identifier INHERITS identifier '{' identifier_list '}' + {if (define_av_perms(TRUE)) return -1;} + ; ++opt_default_rules : default_rules ++ | ++ ; ++default_rules : default_user_def ++ | default_role_def ++ | default_type_def ++ | default_range_def ++ | default_rules default_user_def ++ | default_rules default_role_def ++ | default_rules default_type_def ++ | default_rules default_range_def ++ ; ++default_user_def : DEFAULT_USER names SOURCE ';' ++ {if (define_default_user(DEFAULT_SOURCE)) return -1; } ++ | DEFAULT_USER names TARGET ';' ++ {if (define_default_user(DEFAULT_TARGET)) return -1; } ++ ; ++default_role_def : DEFAULT_ROLE names SOURCE ';' ++ {if (define_default_role(DEFAULT_SOURCE)) return -1; } ++ | DEFAULT_ROLE names TARGET ';' ++ {if (define_default_role(DEFAULT_TARGET)) return -1; } ++ ; ++default_type_def : DEFAULT_TYPE names SOURCE ';' ++ {if (define_default_type(DEFAULT_SOURCE)) return -1; } ++ | DEFAULT_TYPE names TARGET ';' ++ {if (define_default_type(DEFAULT_TARGET)) return -1; } ++ ; ++default_range_def : DEFAULT_RANGE names SOURCE LOW ';' ++ {if (define_default_range(DEFAULT_SOURCE_LOW)) return -1; } ++ | DEFAULT_RANGE names SOURCE HIGH ';' ++ {if (define_default_range(DEFAULT_SOURCE_HIGH)) return -1; } ++ | DEFAULT_RANGE names SOURCE LOW_HIGH ';' ++ {if (define_default_range(DEFAULT_SOURCE_LOW_HIGH)) return -1; } ++ | DEFAULT_RANGE names TARGET LOW ';' ++ {if (define_default_range(DEFAULT_TARGET_LOW)) return -1; } ++ | DEFAULT_RANGE names TARGET HIGH ';' ++ {if (define_default_range(DEFAULT_TARGET_HIGH)) return -1; } ++ | DEFAULT_RANGE names TARGET LOW_HIGH ';' ++ {if (define_default_range(DEFAULT_TARGET_LOW_HIGH)) return -1; } ++ ; + opt_mls : mls + | + ; +@@ -216,8 +270,14 @@ mls : sensitivities dominance opt_categories levels mlspolicy + sensitivities : sensitivity_def + | sensitivities sensitivity_def + ; +-/* Need to call define_mls here, as we are working with files */ +-/* only, not command line options */ ++/*sensitivity_def : SENSITIVITY identifier alias_def ';' ++ {if (define_sens()) return -1;} ++ | SENSITIVITY identifier ';' ++ {if (define_sens()) return -1;} ++ ; ++The above has been replaced by: */ ++/* Needed for SETools to call define_mls here, as we are working */ ++/* with files only, not command line options */ + sensitivity_def : SENSITIVITY identifier alias_def ';' + {if (define_mls() | define_sens()) return -1;} + | SENSITIVITY identifier ';' +@@ -271,10 +331,13 @@ te_rbac_decl : te_decl + | policycap_def + | ';' + ; +-rbac_decl : role_type_def ++rbac_decl : attribute_role_def ++ | role_type_def + | role_dominance + | role_trans_def + | role_allow_def ++ | roleattribute_def ++ | role_attr_def + ; + te_decl : attribute_def + | type_def +@@ -282,6 +345,7 @@ te_decl : attribute_def + | typeattribute_def + | typebounds_def + | bool_def ++ | tunable_def + | transition_def + | range_trans_def + | te_avtab_def +@@ -308,8 +372,11 @@ opt_attr_list : ',' id_comma_list + | + ; + bool_def : BOOL identifier bool_val ';' +- {if (define_bool()) return -1;} ++ { if (define_bool_tunable(0)) return -1; } + ; ++tunable_def : TUNABLE identifier bool_val ';' ++ { if (define_bool_tunable(1)) return -1; } ++ ; + bool_val : CTRUE + { if (insert_id("T",0)) return -1; } + | CFALSE +@@ -364,7 +431,7 @@ cond_rule_def : cond_transition_def + cond_transition_def : TYPE_TRANSITION names names ':' names identifier filename ';' + { $$ = define_cond_filename_trans() ; + if ($$ == COND_ERR) return -1;} +- | TYPE_TRANSITION names names ':' names identifier ';' ++ | TYPE_TRANSITION names names ':' names identifier ';' + { $$ = define_cond_compute_type(AVRULE_TRANSITION) ; + if ($$ == COND_ERR) return -1;} + | TYPE_MEMBER names names ':' names identifier ';' +@@ -399,6 +466,7 @@ cond_dontaudit_def : DONTAUDIT names names ':' names names ';' + { $$ = define_cond_te_avtab(AVRULE_DONTAUDIT); + if ($$ == COND_ERR) return -1; } + ; ++ ; + transition_def : TYPE_TRANSITION names names ':' names identifier filename ';' + {if (define_filename_trans()) return -1; } + | TYPE_TRANSITION names names ':' names identifier ';' +@@ -434,15 +502,21 @@ dontaudit_def : DONTAUDIT names names ':' names names ';' + neverallow_def : NEVERALLOW names names ':' names names ';' + {if (define_te_avtab(AVRULE_NEVERALLOW)) return -1; } + ; ++attribute_role_def : ATTRIBUTE_ROLE identifier ';' ++ {if (define_attrib_role()) return -1; } ++ ; + role_type_def : ROLE identifier TYPES names ';' + {if (define_role_types()) return -1;} +- | ROLE identifier';' +- {if (define_role_types()) return -1;} ++ ; ++role_attr_def : ROLE identifier opt_attr_list ';' ++ {if (define_role_attr()) return -1;} + ; + role_dominance : DOMINANCE '{' roles '}' + ; + role_trans_def : ROLE_TRANSITION names names identifier ';' +- {if (define_role_trans()) return -1; } ++ {if (define_role_trans(0)) return -1; } ++ | ROLE_TRANSITION names names ':' names identifier ';' ++ {if (define_role_trans(1)) return -1;} + ; + role_allow_def : ALLOW names names ';' + {if (define_role_allow()) return -1; } +@@ -457,6 +531,9 @@ role_def : ROLE identifier_push ';' + | ROLE identifier_push '{' roles '}' + {$$ = define_role_dom((role_datum_t*)$4); if ($$ == 0) return -1;} + ; ++roleattribute_def : ROLEATTRIBUTE identifier id_comma_list ';' ++ {if (define_roleattribute()) return -1;} ++ ; + opt_constraints : constraints + | + ; +@@ -662,7 +739,7 @@ opt_fs_uses : fs_uses + fs_uses : fs_use_def + | fs_uses fs_use_def + ; +-fs_use_def : FSUSEXATTR identifier security_context_def ';' ++fs_use_def : FSUSEXATTR filesystem security_context_def ';' + {if (define_fs_use(SECURITY_FS_USE_XATTR)) return -1;} + | FSUSETASK identifier security_context_def ';' + {if (define_fs_use(SECURITY_FS_USE_TASK)) return -1;} +@@ -677,11 +754,11 @@ opt_genfs_contexts : genfs_contexts + genfs_contexts : genfs_context_def + | genfs_contexts genfs_context_def + ; +-genfs_context_def : GENFSCON identifier path '-' identifier security_context_def ++genfs_context_def : GENFSCON filesystem path '-' identifier security_context_def + {if (define_genfs_context(1)) return -1;} +- | GENFSCON identifier path '-' '-' {insert_id("-", 0);} security_context_def ++ | GENFSCON filesystem path '-' '-' {insert_id("-", 0);} security_context_def + {if (define_genfs_context(1)) return -1;} +- | GENFSCON identifier path security_context_def ++ | GENFSCON filesystem path security_context_def + {if (define_genfs_context(0)) return -1;} + ; + ipv4_addr_def : IPV4_ADDR +@@ -755,6 +832,11 @@ nested_id_element : identifier | '-' { if (insert_id("-", 0)) return -1; } + identifier : IDENTIFIER + { if (insert_id(yytext,0)) return -1; } + ; ++filesystem : FILESYSTEM ++ { if (insert_id(yytext,0)) return -1; } ++ | IDENTIFIER ++ { if (insert_id(yytext,0)) return -1; } ++ ; + path : PATH + { if (insert_id(yytext,0)) return -1; } + ; +@@ -785,6 +867,8 @@ module_def : MODULE identifier version_identifier ';' + ; + version_identifier : VERSION_IDENTIFIER + { if (insert_id(yytext,0)) return -1; } ++ | number ++ { if (insert_id(yytext,0)) return -1; } + | ipv4_addr_def /* version can look like ipv4 address */ + ; + avrules_block : avrule_decls avrule_user_defs +@@ -813,8 +897,10 @@ require_class : CLASS identifier names + require_decl_def : ROLE { $$ = require_role; } + | TYPE { $$ = require_type; } + | ATTRIBUTE { $$ = require_attribute; } ++ | ATTRIBUTE_ROLE { $$ = require_attribute_role; } + | USER { $$ = require_user; } + | BOOL { $$ = require_bool; } ++ | TUNABLE { $$ = require_tunable; } + | SENSITIVITY { $$ = require_sens; } + | CATEGORY { $$ = require_cat; } + ; +diff --git a/libqpol/src/policy_scan.l b/libqpol/src/policy_scan.l +index 30203cd..b4e3fe1 100644 +--- a/libqpol/src/policy_scan.l ++++ b/libqpol/src/policy_scan.l +@@ -3,6 +3,8 @@ + * + * This file is based upon checkpolicy/policy_scan.l fram NSA's SVN + * repository. It has been modified to support older policy formats. ++ * The older format just seems to be FSUSEPSID support (see fs_use_psid ++ * entry. + * + * Author : Stephen Smalley, + * +@@ -22,6 +24,7 @@ + + /* FLASK */ + ++/* Required for SETools libqpol services */ + %{ + #undef YY_INPUT + #define YY_INPUT(b, r, ms) (r = qpol_src_yyinput(b, ms)) +@@ -35,7 +38,12 @@ + + typedef int (* require_func_t)(); + ++/* For SETools libqpol services leave this as policy_parse.h */ ++/* #ifdef ANDROID */ + #include "policy_parse.h" ++/*#else ++#include "y.tab.h" ++#endif */ + + static char linebuf[2][255]; + static unsigned int lno = 0; +@@ -50,17 +58,16 @@ unsigned long policydb_lineno = 1; + + unsigned int policydb_errors = 0; + ++/* These are required for SETools libqpol services */ + /* redefine input so we can read from a string */ + /* borrowed from O'Reilly lex and yacc pg 157 */ + extern char qpol_src_input[]; + extern char *qpol_src_inputptr;/* current position in myinput */ + extern char *qpol_src_inputlim;/* end of data */ + int qpol_src_yyinput(char *buf, int max_size); +- + %} + +-%option nounput +-%option noyywrap ++%option noinput nounput noyywrap + + %array + letter [A-Za-z] +@@ -93,6 +100,10 @@ ROLE | + role { return(ROLE); } + ROLES | + roles { return(ROLES); } ++ROLEATTRIBUTE | ++roleattribute { return(ROLEATTRIBUTE);} ++ATTRIBUTE_ROLE | ++attribute_role { return(ATTRIBUTE_ROLE);} + TYPES | + types { return(TYPES); } + TYPEALIAS | +@@ -105,6 +116,8 @@ TYPE | + type { return(TYPE); } + BOOL | + bool { return(BOOL); } ++TUNABLE | ++tunable { return(TUNABLE); } + IF | + if { return(IF); } + ELSE | +@@ -234,9 +247,24 @@ policycap | + POLICYCAP { return(POLICYCAP); } + permissive | + PERMISSIVE { return(PERMISSIVE); } ++default_user | ++DEFAULT_USER { return(DEFAULT_USER); } ++default_role | ++DEFAULT_ROLE { return(DEFAULT_ROLE); } ++default_type | ++DEFAULT_TYPE { return(DEFAULT_TYPE); } ++default_range | ++DEFAULT_RANGE { return(DEFAULT_RANGE); } ++low-high | ++LOW-HIGH { return(LOW_HIGH); } ++high | ++HIGH { return(HIGH); } ++low | ++LOW { return(LOW); } + "/"({alnum}|[_\.\-/])* { return(PATH); } +-\"({alnum}|[_\.\-])+\" { return(FILENAME); } ++\"({alnum}|[_\.\-\+\~\: ])+\" { return(FILENAME); } + {letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))* { return(IDENTIFIER); } ++{alnum}*{letter}{alnum}* { return(FILESYSTEM); } + {digit}+|0x{hexval}+ { return(NUMBER); } + {digit}{1,3}(\.{digit}{1,3}){3} { return(IPV4_ADDR); } + {hexval}{0,4}":"{hexval}{0,4}":"({hexval}|[:.])* { return(IPV6_ADDR); } +@@ -304,6 +332,7 @@ void set_source_file(const char *name) + source_file[sizeof(source_file)-1] = '\0'; + } + ++/* Required for SETools libqpol services */ + int qpol_src_yyinput(char *buf, int max_size) + { + int n = max_size < (qpol_src_inputlim - qpol_src_inputptr) ? max_size : (qpol_src_inputlim - qpol_src_inputptr); +@@ -315,6 +344,7 @@ int qpol_src_yyinput(char *buf, int max_size) + return n; + } + ++/* Required for SETools libqpol services */ + void init_scanner(void) + { + yy_flush_buffer(YY_CURRENT_BUFFER); +diff --git a/libqpol/src/queue.c b/libqpol/src/queue.c +index 18667d5..45a510a 100644 +--- a/libqpol/src/queue.c ++++ b/libqpol/src/queue.c +@@ -6,6 +6,8 @@ + * Author : Stephen Smalley, + */ + ++/* No changes for SETools libqpol services - Just the header */ ++ + /* FLASK */ + + /* +@@ -144,7 +146,9 @@ int queue_map(queue_t q, int (*f) (queue_element_t, void *), void *vp) + return 0; + } + +-void queue_map_remove_on_error(queue_t q, int (*f) (queue_element_t, void *), void (*g) (queue_element_t, void *), void *vp) ++void queue_map_remove_on_error(queue_t q, ++ int (*f) (queue_element_t, void *), ++ void (*g) (queue_element_t, void *), void *vp) + { + queue_node_ptr_t p, last, temp; + int ret; +diff --git a/libqpol/src/queue.h b/libqpol/src/queue.h +index bca304b..dca1b2e 100644 +--- a/libqpol/src/queue.h ++++ b/libqpol/src/queue.h +@@ -6,6 +6,8 @@ + * Author : Stephen Smalley, + */ + ++/* No changes for SETools libqpol services - Just the header */ ++ + /* FLASK */ + + /* +@@ -21,14 +23,12 @@ typedef void *queue_element_t; + + typedef struct queue_node *queue_node_ptr_t; + +-typedef struct queue_node +-{ ++typedef struct queue_node { + queue_element_t element; + queue_node_ptr_t next; + } queue_node_t; + +-typedef struct queue_info +-{ ++typedef struct queue_info { + queue_node_ptr_t head; + queue_node_ptr_t tail; + } queue_info_t; +@@ -60,7 +60,9 @@ int queue_map(queue_t, int (*f) (queue_element_t, void *), void *); + then the element will be removed from the queue and the g + function will be applied to the element. + */ +-void queue_map_remove_on_error(queue_t, int (*f) (queue_element_t, void *), void (*g) (queue_element_t, void *), void *); ++void queue_map_remove_on_error(queue_t, ++ int (*f) (queue_element_t, void *), ++ void (*g) (queue_element_t, void *), void *); + + #endif + +diff --git a/libqpol/src/rbacrule_query.c b/libqpol/src/rbacrule_query.c +index 7f84459..28449b3 100644 +--- a/libqpol/src/rbacrule_query.c ++++ b/libqpol/src/rbacrule_query.c +@@ -334,6 +334,29 @@ int qpol_role_trans_get_target_type(const qpol_policy_t * policy, const qpol_rol + return STATUS_SUCCESS; + } + ++int qpol_role_trans_get_object_class(const qpol_policy_t * policy, const qpol_role_trans_t * rule, const qpol_class_t ** obj_class) ++{ ++ policydb_t *db = NULL; ++ role_trans_t *rt = NULL; ++ ++ if (obj_class) { ++ *obj_class = NULL; ++ } ++ ++ if (!policy || !rule || !obj_class) { ++ ERR(policy, "%s", strerror(EINVAL)); ++ errno = EINVAL; ++ return STATUS_ERR; ++ } ++ ++ db = &policy->p->p; ++ rt = (role_trans_t *) rule; ++ ++ *obj_class = (qpol_class_t *) db->class_val_to_struct[rt->tclass - 1]; ++ ++ return STATUS_SUCCESS; ++} ++ + int qpol_role_trans_get_default_role(const qpol_policy_t * policy, const qpol_role_trans_t * rule, const qpol_role_t ** dflt) + { + policydb_t *db = NULL; +diff --git a/libqpol/src/syn_rule_query.c b/libqpol/src/syn_rule_query.c +index 3e63204..d7578f1 100644 +--- a/libqpol/src/syn_rule_query.c ++++ b/libqpol/src/syn_rule_query.c +@@ -67,7 +67,7 @@ static void *syn_rule_class_state_get_cur(const qpol_iterator_t * iter) + return NULL; + } + +- return db->class_val_to_struct[srcs->cur->class - 1]; ++ return db->class_val_to_struct[srcs->cur->tclass - 1]; + } + + static int syn_rule_class_state_next(qpol_iterator_t * iter) +@@ -465,10 +465,10 @@ int qpol_syn_avrule_get_perm_iter(const qpol_policy_t * policy, const qpol_syn_a + } + + for (node = internal_rule->perms; node; node = node->next) { +- for (i = 0; i < db->class_val_to_struct[node->class - 1]->permissions.nprim; i++) { ++ for (i = 0; i < db->class_val_to_struct[node->tclass - 1]->permissions.nprim; i++) { + if (!(node->data & (1 << i))) + continue; +- tmp = sepol_av_to_string(db, node->class, (sepol_access_vector_t) (1 << i)); ++ tmp = sepol_av_to_string(db, node->tclass, (sepol_access_vector_t) (1 << i)); + if (tmp) { + tmp++; /* remove prepended space */ + for (cur = 0; cur < perm_list_sz; cur++) +diff --git a/libqpol/swig/qpol.i b/libqpol/swig/qpol.i +index 45a2403..b604488 100644 +--- a/libqpol/swig/qpol.i ++++ b/libqpol/swig/qpol.i +@@ -228,7 +228,7 @@ SWIGEXPORT int Tqpol_Init(Tcl_Interp *interp) { + #define QPOL_MODULE_OTHER 2 + typedef struct qpol_module {} qpol_module_t; + %extend qpol_module_t { +- qpol_module_t(const char *path) { ++ qpol_module(const char *path) { + qpol_module_t *m; + BEGIN_EXCEPTION + if (qpol_module_create_from_file(path, &m)) { +@@ -239,10 +239,11 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return NULL; + }; +- ~qpol_module_t() { ++ ~qpol_module() { + qpol_module_destroy(&self); + }; +- const char *get_path() { ++ %rename(get_path) wrap_get_path; ++ const char *wrap_get_path() { + const char *p; + BEGIN_EXCEPTION + if (qpol_module_get_path(self, &p)) { +@@ -253,7 +254,8 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return NULL; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + const char *n; + BEGIN_EXCEPTION + if (qpol_module_get_name(self, &n)) { +@@ -264,7 +266,8 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return NULL; + }; +- const char *get_version() { ++ %rename(get_version) wrap_get_version; ++ const char *wrap_get_version() { + const char *v; + BEGIN_EXCEPTION + if (qpol_module_get_version(self, &v)) { +@@ -275,7 +278,8 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return NULL; + }; +- int get_type() { ++ %rename(get_type) wrap_get_type; ++ int wrap_get_type() { + int t; + BEGIN_EXCEPTION + if (qpol_module_get_type(self, &t)) { +@@ -285,7 +289,8 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return t; + }; +- int get_enabled() { ++ %rename(get_enabled) wrap_get_enabled; ++ int wrap_get_enabled() { + int e; + BEGIN_EXCEPTION + if (qpol_module_get_enabled(self, &e)) { +@@ -295,7 +300,8 @@ typedef struct qpol_module {} qpol_module_t; + fail: + return e; + }; +- void set_enabled(int state) { ++ %rename(set_enabled) wrap_set_enabled; ++ void wrap_set_enabled(int state) { + BEGIN_EXCEPTION + if (qpol_module_set_enabled(self, state)) { + SWIG_exception(SWIG_RuntimeError, "Could not set module state"); +@@ -326,11 +332,18 @@ typedef enum qpol_capability + QPOL_CAP_MODULES, + QPOL_CAP_RULES_LOADED, + QPOL_CAP_SOURCE, +- QPOL_CAP_NEVERALLOW ++ QPOL_CAP_NEVERALLOW, ++ QPOL_CAP_POLCAPS, ++ QPOL_CAP_BOUNDS, ++ QPOL_CAP_DEFAULT_OBJECTS, ++ QPOL_CAP_DEFAULT_TYPE, ++ QPOL_CAP_PERMISSIVE, ++ QPOL_CAP_FILENAME_TRANS, ++ QPOL_CAP_ROLETRANS + } qpol_capability_e; + + %extend qpol_policy_t { +- qpol_policy_t(const char *path, const int options) { ++ qpol_policy(const char *path, const int options) { + qpol_policy_t *p; + BEGIN_EXCEPTION + if (qpol_policy_open_from_file(path, &p, qpol_swig_message_callback, qpol_swig_message_callback_arg, options) < 0) { +@@ -341,10 +354,11 @@ typedef enum qpol_capability + fail: + return NULL; + } +- ~qpol_policy_t() { ++ ~qpol_policy() { + qpol_policy_destroy(&self); + }; +- void reevaluate_conds() { ++ %rename(reevaluate_conds) wrap_reevaluate_conds; ++ void wrap_reevaluate_conds() { + BEGIN_EXCEPTION + if (qpol_policy_reevaluate_conds(self)) { + SWIG_exception(SWIG_ValueError, "Error evaluating conditional expressions"); +@@ -353,7 +367,8 @@ typedef enum qpol_capability + fail: + return; + }; +- void append_module(qpol_module_t *mod) { ++ %rename(append_module) wrap_append_module; ++ void wrap_append_module(qpol_module_t *mod) { + BEGIN_EXCEPTION + if (qpol_policy_append_module(self, mod)) { + SWIG_exception(SWIG_MemoryError, "Out of Memory"); +@@ -362,7 +377,8 @@ typedef enum qpol_capability + fail: + return; + }; +- void rebuild (const int options) { ++ %rename(rebuild) wrap_rebuild; ++ void wrap_rebuild (const int options) { + BEGIN_EXCEPTION + if (qpol_policy_rebuild(self, options)) { + SWIG_exception(SWIG_RuntimeError, "Failed rebuilding policy"); +@@ -376,15 +392,25 @@ typedef enum qpol_capability + (void)qpol_policy_get_policy_version(self, &v); /* only error is on null parameters neither can be here */ + return (int) v; + }; +- int get_type () { ++ ++ int get_handle_unknown () { ++ unsigned int h; ++ (void)qpol_policy_get_policy_handle_unknown(self, &h); ++ return (int) h; ++ }; ++ ++ %rename(get_type) wrap_get_type; ++ int wrap_get_type () { + int t; + (void)qpol_policy_get_type(self, &t); /* only error is on null parameters neither can be here */ + return t; + }; +- int has_capability (qpol_capability_e cap) { ++ %rename(has_capability) wrap_has_capability; ++ int wrap_has_capability (qpol_capability_e cap) { + return qpol_policy_has_capability(self, cap); + }; +- void build_syn_rule_table() { ++ %rename(build_syn_rule_table) wrap_build_syn_rule_table; ++ void wrap_build_syn_rule_table() { + BEGIN_EXCEPTION + if (qpol_policy_build_syn_rule_table(self)) { + SWIG_exception(SWIG_MemoryError, "Out of Memory"); +@@ -394,7 +420,8 @@ typedef enum qpol_capability + return; + }; + %newobject get_module_iter(); +- qpol_iterator_t *get_module_iter() { ++ %rename(get_module_iter) wrap_get_module_iter; ++ qpol_iterator_t *wrap_get_module_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_module_iter(self, &iter)) { +@@ -406,7 +433,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_type_iter(); +- qpol_iterator_t *get_type_iter() { ++ %rename(get_type_iter) wrap_get_type_iter; ++ qpol_iterator_t *wrap_get_type_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_type_iter(self, &iter)) { +@@ -418,7 +446,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_role_iter(); +- qpol_iterator_t *get_role_iter() { ++ %rename(get_role_iter) wrap_get_role_iter; ++ qpol_iterator_t *wrap_get_role_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_role_iter(self, &iter)) { +@@ -430,7 +459,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_level_iter(); +- qpol_iterator_t *get_level_iter() { ++ %rename(get_level_iter) wrap_get_level_iter; ++ qpol_iterator_t *wrap_get_level_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_level_iter(self, &iter)) { +@@ -442,7 +472,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_cat_iter(); +- qpol_iterator_t *get_cat_iter() { ++ %rename(get_cat_iter) wrap_get_cat_iter; ++ qpol_iterator_t *wrap_get_cat_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_cat_iter(self, &iter)) { +@@ -454,7 +485,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_user_iter(); +- qpol_iterator_t *get_user_iter() { ++ %rename(get_user_iter) wrap_get_user_iter; ++ qpol_iterator_t *wrap_get_user_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_user_iter(self, &iter)) { +@@ -466,7 +498,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_bool_iter(); +- qpol_iterator_t *get_bool_iter() { ++ %rename(get_bool_iter) wrap_get_bool_iter; ++ qpol_iterator_t *wrap_get_bool_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_bool_iter(self, &iter)) { +@@ -478,7 +511,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_class_iter(char*); +- qpol_iterator_t *get_class_iter(char *perm=NULL) { ++ %rename(get_class_iter) wrap_get_class_iter; ++ qpol_iterator_t *wrap_get_class_iter(char *perm=NULL) { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (perm) { +@@ -496,7 +530,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_common_iter(char*); +- qpol_iterator_t *get_common_iter(char *perm=NULL) { ++ %rename(get_common_iter) wrap_get_common_iter; ++ qpol_iterator_t *wrap_get_common_iter(char *perm=NULL) { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (perm) { +@@ -514,7 +549,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_fs_use_iter(); +- qpol_iterator_t *get_fs_use_iter() { ++ %rename(get_fs_use_iter) wrap_get_fs_use_iter; ++ qpol_iterator_t *wrap_get_fs_use_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_fs_use_iter(self, &iter)) { +@@ -526,7 +562,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_genfscon_iter(); +- qpol_iterator_t *get_genfscon_iter() { ++ %rename(get_genfscon_iter) wrap_get_genfscon_iter; ++ qpol_iterator_t *wrap_get_genfscon_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_genfscon_iter(self, &iter)) { +@@ -538,7 +575,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_isid_iter(); +- qpol_iterator_t *get_isid_iter() { ++ %rename(get_isid_iter) wrap_get_isid_iter; ++ qpol_iterator_t *wrap_get_isid_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_isid_iter(self, &iter)) { +@@ -550,7 +588,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_netifcon_iter(); +- qpol_iterator_t *get_netifcon_iter() { ++ %rename(get_netifcon_iter) wrap_get_netifcon_iter; ++ qpol_iterator_t *wrap_get_netifcon_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_netifcon_iter(self, &iter)) { +@@ -562,7 +601,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_nodecon_iter(); +- qpol_iterator_t *get_nodecon_iter() { ++ %rename(get_nodecon_iter) wrap_get_nodecon_iter; ++ qpol_iterator_t *wrap_get_nodecon_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_nodecon_iter(self, &iter)) { +@@ -574,7 +614,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_portcon_iter(); +- qpol_iterator_t *get_portcon_iter() { ++ %rename(get_portcon_iter) wrap_get_portcon_iter; ++ qpol_iterator_t *wrap_get_portcon_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_portcon_iter(self, &iter)) { +@@ -586,7 +627,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_constraint_iter(); +- qpol_iterator_t *get_constraint_iter() { ++ %rename(get_constraint_iter) wrap_get_constraint_iter; ++ qpol_iterator_t *wrap_get_constraint_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_constraint_iter(self, &iter)) { +@@ -598,7 +640,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_validatetrans_iter(); +- qpol_iterator_t *get_validatetrans_iter() { ++ %rename(get_validatetrans_iter) wrap_get_validatetrans_iter; ++ qpol_iterator_t *wrap_get_validatetrans_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_validatetrans_iter(self, &iter)) { +@@ -610,7 +653,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_role_allow_iter(); +- qpol_iterator_t *get_role_allow_iter() { ++ %rename(get_role_allow_iter) wrap_get_role_allow_iter; ++ qpol_iterator_t *wrap_get_role_allow_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_role_allow_iter(self, &iter)) { +@@ -622,7 +666,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_role_trans_iter(); +- qpol_iterator_t *get_role_trans_iter() { ++ %rename(get_role_trans_iter) wrap_get_role_trans_iter; ++ qpol_iterator_t *wrap_get_role_trans_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_role_trans_iter(self, &iter)) { +@@ -634,7 +679,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_range_trans_iter(); +- qpol_iterator_t *get_range_trans_iter() { ++ %rename(get_range_trans_iter) wrap_get_range_trans_iter; ++ qpol_iterator_t *wrap_get_range_trans_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_range_trans_iter(self, &iter)) { +@@ -646,7 +692,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_avrule_iter(int); +- qpol_iterator_t *get_avrule_iter(int rule_types) { ++ %rename(get_avrule_iter) wrap_get_avrule_iter; ++ qpol_iterator_t *wrap_get_avrule_iter(int rule_types) { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_avrule_iter(self, rule_types, &iter)) { +@@ -658,7 +705,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_terule_iter(int); +- qpol_iterator_t *get_terule_iter(int rule_types) { ++ %rename(get_terule_iter) wrap_get_terule_iter; ++ qpol_iterator_t *wrap_get_terule_iter(int rule_types) { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_terule_iter(self, rule_types, &iter)) { +@@ -670,7 +718,8 @@ typedef enum qpol_capability + return NULL; + }; + %newobject get_cond_iter(); +- qpol_iterator_t *get_cond_iter() { ++ %rename(get_cond_iter) wrap_get_cond_iter; ++ qpol_iterator_t *wrap_get_cond_iter() { + BEGIN_EXCEPTION + qpol_iterator_t *iter; + if (qpol_policy_get_cond_iter(self, &iter)) { +@@ -681,23 +730,76 @@ typedef enum qpol_capability + fail: + return NULL; + }; ++ %newobject get_filename_trans_iter(); ++ %rename(get_filename_trans_iter) wrap_get_filename_trans_iter; ++ qpol_iterator_t *wrap_get_filename_trans_iter() { ++ BEGIN_EXCEPTION ++ qpol_iterator_t *iter; ++ if (qpol_policy_get_filename_trans_iter(self, &iter)) { ++ SWIG_exception(SWIG_MemoryError, "Out of Memory"); ++ } ++ return iter; ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ %newobject get_permissive_iter(); ++ %rename(get_permissive_iter) wrap_get_permissive_iter; ++ qpol_iterator_t *wrap_get_permissive_iter() { ++ BEGIN_EXCEPTION ++ qpol_iterator_t *iter; ++ if (qpol_policy_get_permissive_iter(self, &iter)) { ++ SWIG_exception(SWIG_MemoryError, "Out of Memory"); ++ } ++ return iter; ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ %newobject get_typebounds_iter(); ++ %rename(get_typebounds_iter) wrap_get_typebounds_iter; ++ qpol_iterator_t *wrap_get_typebounds_iter() { ++ BEGIN_EXCEPTION ++ qpol_iterator_t *iter; ++ if (qpol_policy_get_typebounds_iter(self, &iter)) { ++ SWIG_exception(SWIG_MemoryError, "Out of Memory"); ++ } ++ return iter; ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ %newobject get_polcap_iter(); ++ %rename(get_polcap_iter) wrap_get_polcap_iter; ++ qpol_iterator_t *wrap_get_polcap_iter() { ++ BEGIN_EXCEPTION ++ qpol_iterator_t *iter; ++ if (qpol_policy_get_polcap_iter(self, &iter)) { ++ SWIG_exception(SWIG_MemoryError, "Out of Memory"); ++ } ++ return iter; ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; + }; + + /* qpol iterator */ + typedef struct qpol_iterator {} qpol_iterator_t; + %extend qpol_iterator_t { + /* user never directly creates, but SWIG expects a constructor */ +- qpol_iterator_t() { ++ qpol_iterator() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_TypeError, "User may not create iterators difectly"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_iterator_t() { ++ ~qpol_iterator() { + qpol_iterator_destroy(&self); + }; +- void *get_item() { ++ %rename(get_item) wrap_get_item; ++ void *wrap_get_item() { + BEGIN_EXCEPTION + void *i; + if (qpol_iterator_get_item(self, &i)) { +@@ -708,7 +810,8 @@ typedef struct qpol_iterator {} qpol_iterator_t; + fail: + return NULL; + }; +- void next() { ++ %rename(next) wrap_next; ++ void wrap_next() { + BEGIN_EXCEPTION + if (qpol_iterator_next(self)) { + SWIG_exception(SWIG_RuntimeError, "Error advancing iterator"); +@@ -717,10 +820,12 @@ typedef struct qpol_iterator {} qpol_iterator_t; + fail: + return; + }; +- int end() { ++ %rename(end) wrap_end; ++ int wrap_end() { + return qpol_iterator_end(self); + }; +- size_t get_size() { ++ %rename(get_size) wrap_get_size; ++ size_t wrap_get_size() { + BEGIN_EXCEPTION + size_t s; + if (qpol_iterator_get_size(self, &s)) { +@@ -736,7 +841,7 @@ typedef struct qpol_iterator {} qpol_iterator_t; + /* qpol type */ + typedef struct qpol_type {} qpol_type_t; + %extend qpol_type_t { +- qpol_type_t(qpol_policy_t *p, const char *name) { ++ qpol_type(qpol_policy_t *p, const char *name) { + BEGIN_EXCEPTION + const qpol_type_t *t; + if (qpol_policy_get_type_by_name(p, name, &t)) { +@@ -747,11 +852,12 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return NULL; + }; +- ~qpol_type_t() { ++ ~qpol_type() { + /* no op */ + return; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + BEGIN_EXCEPTION + const char *name; + if (qpol_type_get_name(p, self, &name)) { +@@ -762,7 +868,8 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return NULL; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_type_get_value(p, self, &v)) { +@@ -772,7 +879,8 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return (int) v; + }; +- int get_isalias(qpol_policy_t *p) { ++ %rename(get_isalias) wrap_get_isalias; ++ int wrap_get_isalias(qpol_policy_t *p) { + unsigned char i; + BEGIN_EXCEPTION + if (qpol_type_get_isalias(p, self, &i)) { +@@ -782,7 +890,8 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return (int)i; + }; +- int get_isattr(qpol_policy_t *p) { ++ %rename(get_isattr) wrap_get_isattr; ++ int wrap_get_isattr(qpol_policy_t *p) { + unsigned char i; + BEGIN_EXCEPTION + if (qpol_type_get_isattr(p, self, &i)) { +@@ -792,7 +901,8 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return (int)i; + }; +- int get_ispermissive(qpol_policy_t *p) { ++ %rename(get_ispermissive) wrap_get_ispermissive; ++ int wrap_get_ispermissive(qpol_policy_t *p) { + unsigned char i; + BEGIN_EXCEPTION + if (qpol_type_get_ispermissive(p, self, &i)) { +@@ -803,7 +913,8 @@ typedef struct qpol_type {} qpol_type_t; + return (int)i; + }; + %newobject get_type_iter(qpol_policy_t*); +- qpol_iterator_t *get_type_iter(qpol_policy_t *p) { ++ %rename(get_type_iter) wrap_get_type_iter; ++ qpol_iterator_t *wrap_get_type_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + int retv = qpol_type_get_type_iter(p, self, &iter); +@@ -817,7 +928,8 @@ typedef struct qpol_type {} qpol_type_t; + return iter; + }; + %newobject get_attr_iter(qpol_policy_t*); +- qpol_iterator_t *get_attr_iter(qpol_policy_t *p) { ++ %rename(get_attr_iter) wrap_get_attr_iter; ++ qpol_iterator_t *wrap_get_attr_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + int retv = qpol_type_get_attr_iter(p, self, &iter); +@@ -831,7 +943,8 @@ typedef struct qpol_type {} qpol_type_t; + return iter; + }; + %newobject get_alias_iter(qpol_policy_t*); +- qpol_iterator_t *get_alias_iter(qpol_policy_t *p) { ++ %rename(get_alias_iter) wrap_get_alias_iter; ++ qpol_iterator_t *wrap_get_alias_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_type_get_alias_iter(p, self, &iter)) { +@@ -841,6 +954,18 @@ typedef struct qpol_type {} qpol_type_t; + fail: + return iter; + }; ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { ++ BEGIN_EXCEPTION ++ const char *name; ++ if (qpol_permissive_get_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get permissive type name"); ++ } ++ return name; ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; + }; + %inline %{ + qpol_type_t *qpol_type_from_void(void *x) { +@@ -851,7 +976,7 @@ typedef struct qpol_type {} qpol_type_t; + /* qpol role */ + typedef struct qpol_role {} qpol_role_t; + %extend qpol_role_t { +- qpol_role_t(qpol_policy_t *p, const char *name) { ++ qpol_role(qpol_policy_t *p, const char *name) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_policy_get_role_by_name(p, name, &r)) { +@@ -862,11 +987,12 @@ typedef struct qpol_role {} qpol_role_t; + fail: + return NULL; + }; +- ~qpol_role_t() { ++ ~qpol_role() { + /* no op */ + return; + }; +- int get_value (qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value (qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_role_get_value(p, self, &v)) { +@@ -876,7 +1002,8 @@ typedef struct qpol_role {} qpol_role_t; + fail: + return (int) v; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_role_get_name(p, self, &name)) { +@@ -888,7 +1015,8 @@ typedef struct qpol_role {} qpol_role_t; + return NULL; + }; + %newobject get_type_iter(qpol_policy_t*); +- qpol_iterator_t *get_type_iter(qpol_policy_t *p) { ++ %rename(get_type_iter) wrap_get_type_iter; ++ qpol_iterator_t *wrap_get_type_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_role_get_type_iter(p, self, &iter)) { +@@ -899,7 +1027,8 @@ typedef struct qpol_role {} qpol_role_t; + return iter; + }; + %newobject get_dominate_iter(qpol_policy_t*); +- qpol_iterator_t *get_dominate_iter(qpol_policy_t *p) { ++ %rename(get_dominate_iter) wrap_get_dominate_iter; ++ qpol_iterator_t *wrap_get_dominate_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_role_get_dominate_iter(p, self, &iter)) { +@@ -919,7 +1048,7 @@ typedef struct qpol_role {} qpol_role_t; + /* qpol level */ + typedef struct qpol_level {} qpol_level_t; + %extend qpol_level_t { +- qpol_level_t(qpol_policy_t *p, const char *name) { ++ qpol_level(qpol_policy_t *p, const char *name) { + const qpol_level_t *l; + BEGIN_EXCEPTION + if (qpol_policy_get_level_by_name(p, name, &l)) { +@@ -930,11 +1059,12 @@ typedef struct qpol_level {} qpol_level_t; + fail: + return NULL; + }; +- ~qpol_level_t() { ++ ~qpol_level() { + /* no op */ + return; + }; +- int get_isalias(qpol_policy_t *p) { ++ %rename(get_isalias) wrap_get_isalias; ++ int wrap_get_isalias(qpol_policy_t *p) { + unsigned char i; + BEGIN_EXCEPTION + if (qpol_level_get_isalias(p, self, &i)) { +@@ -944,7 +1074,8 @@ typedef struct qpol_level {} qpol_level_t; + fail: + return (int)i; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_level_get_value(p, self, &v)) { +@@ -954,7 +1085,8 @@ typedef struct qpol_level {} qpol_level_t; + fail: + return (int) v; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_level_get_name(p, self, &name)) { +@@ -966,7 +1098,8 @@ typedef struct qpol_level {} qpol_level_t; + return NULL; + }; + %newobject get_cat_iter(qpol_policy_t*); +- qpol_iterator_t *get_cat_iter(qpol_policy_t *p) { ++ %rename(get_cat_iter) wrap_get_cat_iter; ++ qpol_iterator_t *wrap_get_cat_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_level_get_cat_iter(p, self, &iter)) { +@@ -977,7 +1110,8 @@ typedef struct qpol_level {} qpol_level_t; + return iter; + }; + %newobject get_alias_iter(qpol_policy_t*); +- qpol_iterator_t *get_alias_iter(qpol_policy_t *p) { ++ %rename(get_alias_iter) wrap_get_alias_iter; ++ qpol_iterator_t *wrap_get_alias_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_level_get_alias_iter(p, self, &iter)) { +@@ -997,7 +1131,7 @@ typedef struct qpol_level {} qpol_level_t; + /* qpol cat */ + typedef struct qpol_cat {} qpol_cat_t; + %extend qpol_cat_t { +- qpol_cat_t(qpol_policy_t *p, const char *name) { ++ qpol_cat(qpol_policy_t *p, const char *name) { + const qpol_cat_t *c; + BEGIN_EXCEPTION + if (qpol_policy_get_cat_by_name(p, name, &c)) { +@@ -1008,11 +1142,12 @@ typedef struct qpol_cat {} qpol_cat_t; + fail: + return NULL; + }; +- ~qpol_cat_t() { ++ ~qpol_cat() { + /* no op */ + return; + }; +- int get_isalias(qpol_policy_t *p) { ++ %rename(get_isalias) wrap_get_isalias; ++ int wrap_get_isalias(qpol_policy_t *p) { + unsigned char i; + BEGIN_EXCEPTION + if (qpol_cat_get_isalias(p, self, &i)) { +@@ -1022,7 +1157,8 @@ typedef struct qpol_cat {} qpol_cat_t; + fail: + return (int)i; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_cat_get_value(p, self, &v)) { +@@ -1032,7 +1168,8 @@ typedef struct qpol_cat {} qpol_cat_t; + fail: + return (int) v; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_cat_get_name(p, self, &name)) { +@@ -1044,7 +1181,8 @@ typedef struct qpol_cat {} qpol_cat_t; + return NULL; + }; + %newobject get_alias_iter(qpol_policy_t*); +- qpol_iterator_t *get_alias_iter(qpol_policy_t *p) { ++ %rename(get_alias_iter) wrap_get_alias_iter; ++ qpol_iterator_t *wrap_get_alias_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cat_get_alias_iter(p, self, &iter)) { +@@ -1064,18 +1202,19 @@ typedef struct qpol_cat {} qpol_cat_t; + /* qpol mls range */ + typedef struct qpol_mls_range {} qpol_mls_range_t; + %extend qpol_mls_range_t { +- qpol_mls_range_t() { ++ qpol_mls_range() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_range_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~qpol_mls_range_t() { ++ ~qpol_mls_range() { + /* no op */ + return; + }; +- const qpol_mls_level_t *get_high_level(qpol_policy_t *p) { ++ %rename(get_high_level) wrap_get_high_level; ++ const qpol_mls_level_t *wrap_get_high_level(qpol_policy_t *p) { + const qpol_mls_level_t *l; + BEGIN_EXCEPTION + if (qpol_mls_range_get_high_level(p, self, &l)) { +@@ -1085,7 +1224,8 @@ typedef struct qpol_mls_range {} qpol_mls_range_t; + fail: + return l; + }; +- const qpol_mls_level_t *get_low_level(qpol_policy_t *p) { ++ %rename(get_low_level) wrap_get_low_level; ++ const qpol_mls_level_t *wrap_get_low_level(qpol_policy_t *p) { + const qpol_mls_level_t *l; + BEGIN_EXCEPTION + if (qpol_mls_range_get_low_level(p, self, &l)) { +@@ -1105,18 +1245,19 @@ typedef struct qpol_mls_range {} qpol_mls_range_t; + /* qpol mls level */ + typedef struct qpol_mls_level {} qpol_mls_level_t; + %extend qpol_mls_level_t { +- qpol_mls_level_t() { ++ qpol_mls_level() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_level_t objects"); + END_EXCEPTION + fail: + return NULL; + } +- ~qpol_mls_level_t() { ++ ~qpol_mls_level() { + /* no op */ + return; + }; +- const char *get_sens_name(qpol_policy_t *p) { ++ %rename(get_sens_name) wrap_get_sens_name; ++ const char *wrap_get_sens_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_mls_level_get_sens_name(p, self, &name)) { +@@ -1127,7 +1268,8 @@ typedef struct qpol_mls_level {} qpol_mls_level_t; + return name; + }; + %newobject get_cat_iter(qpol_policy_t*); +- qpol_iterator_t *get_cat_iter(qpol_policy_t *p) { ++ %rename(get_cat_iter) wrap_get_cat_iter; ++ qpol_iterator_t *wrap_get_cat_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_mls_level_get_cat_iter(p, self, &iter)) { +@@ -1147,7 +1289,7 @@ typedef struct qpol_mls_level {} qpol_mls_level_t; + /* qpol user */ + typedef struct qpol_user {} qpol_user_t; + %extend qpol_user_t { +- qpol_user_t(qpol_policy_t *p, const char *name) { ++ qpol_user(qpol_policy_t *p, const char *name) { + const qpol_user_t *u; + BEGIN_EXCEPTION + if (qpol_policy_get_user_by_name(p, name, &u)) { +@@ -1158,11 +1300,12 @@ typedef struct qpol_user {} qpol_user_t; + fail: + return NULL; + }; +- ~qpol_user_t() { ++ ~qpol_user() { + /* no op */ + return; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_user_get_value(p, self, &v)) { +@@ -1173,7 +1316,8 @@ typedef struct qpol_user {} qpol_user_t; + return (int) v; + }; + %newobject get_role_iter(qpol_policy_t*); +- qpol_iterator_t *get_role_iter(qpol_policy_t *p) { ++ %rename(get_role_iter) wrap_get_role_iter; ++ qpol_iterator_t *wrap_get_role_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_user_get_role_iter(p, self, &iter)) { +@@ -1183,7 +1327,8 @@ typedef struct qpol_user {} qpol_user_t; + fail: + return iter; + }; +- const qpol_mls_range_t *get_range(qpol_policy_t *p) { ++ %rename(get_range) wrap_get_range; ++ const qpol_mls_range_t *wrap_get_range(qpol_policy_t *p) { + const qpol_mls_range_t *r; + BEGIN_EXCEPTION + if (qpol_user_get_range(p, self, &r)) { +@@ -1193,7 +1338,8 @@ typedef struct qpol_user {} qpol_user_t; + fail: + return r; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_user_get_name(p, self, &name)) { +@@ -1203,7 +1349,8 @@ typedef struct qpol_user {} qpol_user_t; + fail: + return name; + }; +- const qpol_mls_level_t *get_dfltlevel(qpol_policy_t *p) { ++ %rename(get_dfltlevel) wrap_get_dfltlevel; ++ const qpol_mls_level_t *wrap_get_dfltlevel(qpol_policy_t *p) { + const qpol_mls_level_t *l; + BEGIN_EXCEPTION + if (qpol_user_get_dfltlevel(p, self, &l)) { +@@ -1223,7 +1370,7 @@ typedef struct qpol_user {} qpol_user_t; + /* qpol bool */ + typedef struct qpol_bool {} qpol_bool_t; + %extend qpol_bool_t { +- qpol_bool_t(qpol_policy_t *p, const char *name) { ++ qpol_bool(qpol_policy_t *p, const char *name) { + qpol_bool_t *b; + BEGIN_EXCEPTION + if (qpol_policy_get_bool_by_name(p, name, &b)) { +@@ -1233,11 +1380,12 @@ typedef struct qpol_bool {} qpol_bool_t; + fail: + return b; + }; +- ~qpol_bool_t() { ++ ~qpol_bool() { + /* no op */ + return; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_bool_get_value(p, self, &v)) { +@@ -1247,7 +1395,8 @@ typedef struct qpol_bool {} qpol_bool_t; + fail: + return (int) v; + }; +- int get_state(qpol_policy_t *p) { ++ %rename(get_state) wrap_get_state; ++ int wrap_get_state(qpol_policy_t *p) { + int s; + BEGIN_EXCEPTION + if (qpol_bool_get_state(p, self, &s)) { +@@ -1257,7 +1406,8 @@ typedef struct qpol_bool {} qpol_bool_t; + fail: + return s; + }; +- void set_state(qpol_policy_t *p, int state) { ++ %rename(set_state) wrap_set_state; ++ void wrap_set_state(qpol_policy_t *p, int state) { + BEGIN_EXCEPTION + if (qpol_bool_set_state(p, self, state)) { + SWIG_exception(SWIG_RuntimeError, "Error setting boolean state"); +@@ -1266,7 +1416,8 @@ typedef struct qpol_bool {} qpol_bool_t; + fail: + return; + }; +- void set_state_no_eval(qpol_policy_t *p, int state) { ++ %rename(set_state_no_eval) wrap_set_state_no_eval; ++ void wrap_set_state_no_eval(qpol_policy_t *p, int state) { + BEGIN_EXCEPTION + if (qpol_bool_set_state_no_eval(p, self, state)) { + SWIG_exception(SWIG_RuntimeError, "Error setting boolean state"); +@@ -1275,7 +1426,8 @@ typedef struct qpol_bool {} qpol_bool_t; + fail: + return; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_bool_get_name(p, self, &name)) { +@@ -1295,18 +1447,18 @@ typedef struct qpol_bool {} qpol_bool_t; + /* qpol context */ + typedef struct qpol_context {} qpol_context_t; + %extend qpol_context_t { +- qpol_context_t() { ++ qpol_context() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_context_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_context_t() { ++ ~qpol_context() { + /* no op */ + return; + }; +- const qpol_user_t *get_user(qpol_policy_t *p) { ++ const qpol_user_t *wrap_get_user(qpol_policy_t *p) { + const qpol_user_t *u; + BEGIN_EXCEPTION + if (qpol_context_get_user(p, self, &u)) { +@@ -1316,7 +1468,7 @@ typedef struct qpol_context {} qpol_context_t; + fail: + return u; + }; +- const qpol_role_t *get_role(qpol_policy_t *p) { ++ const qpol_role_t *wrap_get_role(qpol_policy_t *p) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_context_get_role(p, self, &r)) { +@@ -1326,7 +1478,7 @@ typedef struct qpol_context {} qpol_context_t; + fail: + return r; + }; +- const qpol_type_t *get_type(qpol_policy_t *p) { ++ const qpol_type_t *wrap_get_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_context_get_type(p, self, &t)) { +@@ -1336,7 +1488,7 @@ typedef struct qpol_context {} qpol_context_t; + fail: + return t; + }; +- const qpol_mls_range_t *get_range(qpol_policy_t *p) { ++ const qpol_mls_range_t *wrap_get_range(qpol_policy_t *p) { + const qpol_mls_range_t *r; + BEGIN_EXCEPTION + if (qpol_context_get_range(p, self, &r)) { +@@ -1356,7 +1508,7 @@ typedef struct qpol_context {} qpol_context_t; + /* qpol class */ + typedef struct qpol_class {} qpol_class_t; + %extend qpol_class_t { +- qpol_class_t(qpol_policy_t *p, const char *name) { ++ qpol_class(qpol_policy_t *p, const char *name) { + const qpol_class_t *c; + BEGIN_EXCEPTION + if (qpol_policy_get_class_by_name(p, name, &c)) { +@@ -1366,11 +1518,12 @@ typedef struct qpol_class {} qpol_class_t; + fail: + return (qpol_class_t*)c; + }; +- ~qpol_class_t() { ++ ~qpol_class() { + /* no op */ + return; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_class_get_value(p, self, &v)) { +@@ -1380,7 +1533,8 @@ typedef struct qpol_class {} qpol_class_t; + fail: + return (int) v; + }; +- const qpol_common_t *get_common(qpol_policy_t *p) { ++ %rename(get_common) wrap_get_common; ++ const qpol_common_t *wrap_get_common(qpol_policy_t *p) { + const qpol_common_t *c; + BEGIN_EXCEPTION + if(qpol_class_get_common(p, self, &c)) { +@@ -1391,7 +1545,8 @@ typedef struct qpol_class {} qpol_class_t; + return c; + }; + %newobject get_perm_iter(qpol_policy_t*); +- qpol_iterator_t *get_perm_iter(qpol_policy_t *p) { ++ %rename(get_perm_iter) wrap_get_perm_iter; ++ qpol_iterator_t *wrap_get_perm_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if(qpol_class_get_perm_iter(p, self, &iter)) { +@@ -1402,7 +1557,8 @@ typedef struct qpol_class {} qpol_class_t; + return iter; + }; + %newobject get_constraint_iter(qpol_policy_t*); +- qpol_iterator_t *get_constraint_iter(qpol_policy_t *p) { ++ %rename(get_constraint_iter) wrap_get_constraint_iter; ++ qpol_iterator_t *wrap_get_constraint_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if(qpol_class_get_constraint_iter(p, self, &iter)) { +@@ -1413,7 +1569,8 @@ typedef struct qpol_class {} qpol_class_t; + return iter; + }; + %newobject get_validatetrans_iter(qpol_policy_t*); +- qpol_iterator_t *get_validatetrans_iter(qpol_policy_t *p) { ++ %rename(get_validatetrans_iter) wrap_get_validatetrans_iter; ++ qpol_iterator_t *wrap_get_validatetrans_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if(qpol_class_get_validatetrans_iter(p, self, &iter)) { +@@ -1423,7 +1580,8 @@ typedef struct qpol_class {} qpol_class_t; + fail: + return iter; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_class_get_name(p, self, &name)) { +@@ -1443,7 +1601,7 @@ typedef struct qpol_class {} qpol_class_t; + /* qpol common */ + typedef struct qpol_common {} qpol_common_t; + %extend qpol_common_t { +- qpol_common_t(qpol_policy_t *p, const char *name) { ++ qpol_common(qpol_policy_t *p, const char *name) { + const qpol_common_t *c; + BEGIN_EXCEPTION + if (qpol_policy_get_common_by_name(p, name, &c)) { +@@ -1453,11 +1611,12 @@ typedef struct qpol_common {} qpol_common_t; + fail: + return (qpol_common_t*)c; + }; +- ~qpol_common_t() { ++ ~qpol_common() { + /* no op */ + return; + }; +- int get_value(qpol_policy_t *p) { ++ %rename(get_value) wrap_get_value; ++ int wrap_get_value(qpol_policy_t *p) { + uint32_t v; + BEGIN_EXCEPTION + if (qpol_common_get_value(p, self, &v)) { +@@ -1468,7 +1627,8 @@ typedef struct qpol_common {} qpol_common_t; + return (int) v; + }; + %newobject get_perm_iter(qpol_policy_t*); +- qpol_iterator_t *get_perm_iter(qpol_policy_t *p) { ++ %rename(get_perm_iter) wrap_get_perm_iter; ++ qpol_iterator_t *wrap_get_perm_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if(qpol_common_get_perm_iter(p, self, &iter)) { +@@ -1478,7 +1638,8 @@ typedef struct qpol_common {} qpol_common_t; + fail: + return iter; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_common_get_name(p, self, &name)) { +@@ -1516,7 +1677,7 @@ typedef struct qpol_common {} qpol_common_t; + #endif + typedef struct qpol_fs_use {} qpol_fs_use_t; + %extend qpol_fs_use_t { +- qpol_fs_use_t(qpol_policy_t *p, const char *name) { ++ qpol_fs_use(qpol_policy_t *p, const char *name) { + const qpol_fs_use_t *f; + BEGIN_EXCEPTION + if (qpol_policy_get_fs_use_by_name(p, name, &f)) { +@@ -1526,11 +1687,12 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; + fail: + return (qpol_fs_use_t*)f; + }; +- ~qpol_fs_use_t() { ++ ~qpol_fs_use() { + /* no op */ + return; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_fs_use_get_name(p, self, &name)) { +@@ -1540,7 +1702,8 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; + fail: + return name; + }; +- int get_behavior(qpol_policy_t *p) { ++ %rename(get_behavior) wrap_get_behavior; ++ int wrap_get_behavior(qpol_policy_t *p) { + uint32_t behav; + BEGIN_EXCEPTION + if (qpol_fs_use_get_behavior(p, self, &behav)) { +@@ -1550,7 +1713,8 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; + fail: + return (int) behav; + }; +- const qpol_context_t *get_context(qpol_policy_t *p) { ++ %rename(get_context) wrap_get_context; ++ const qpol_context_t *wrap_get_context(qpol_policy_t *p) { + uint32_t behav; + const qpol_context_t *ctx = NULL; + BEGIN_EXCEPTION +@@ -1594,7 +1758,7 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; + #endif + typedef struct qpol_genfscon {} qpol_genfscon_t; + %extend qpol_genfscon_t { +- qpol_genfscon_t(qpol_policy_t *p, const char *name, const char *path) { ++ qpol_genfscon(qpol_policy_t *p, const char *name, const char *path) { + qpol_genfscon_t *g; + BEGIN_EXCEPTION + if (qpol_policy_get_genfscon_by_name(p, name, path, &g)) { +@@ -1604,10 +1768,11 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; + fail: + return g; + }; +- ~qpol_genfscon_t() { ++ ~qpol_genfscon() { + free(self); + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_genfscon_get_name(p, self, &name)) { +@@ -1617,7 +1782,8 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; + fail: + return name; + }; +- const char *get_path(qpol_policy_t *p) { ++ %rename(get_path) wrap_get_path; ++ const char *wrap_get_path(qpol_policy_t *p) { + const char *path; + BEGIN_EXCEPTION + if (qpol_genfscon_get_path(p, self, &path)) { +@@ -1627,7 +1793,8 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; + fail: + return path; + }; +- int get_class(qpol_policy_t *p) { ++ %rename(get_class) wrap_get_class; ++ int wrap_get_class(qpol_policy_t *p) { + uint32_t cls; + BEGIN_EXCEPTION + if (qpol_genfscon_get_class(p, self, &cls)) { +@@ -1637,7 +1804,8 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; + fail: + return (int) cls; + }; +- const qpol_context_t *get_context(qpol_policy_t *p) { ++ %rename(get_context) wrap_get_context; ++ const qpol_context_t *wrap_get_context(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_genfscon_get_context(p, self, &ctx)) { +@@ -1657,7 +1825,7 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; + /* qpol isid */ + typedef struct qpol_isid {} qpol_isid_t; + %extend qpol_isid_t { +- qpol_isid_t(qpol_policy_t *p, const char *name) { ++ qpol_isid(qpol_policy_t *p, const char *name) { + const qpol_isid_t *i; + BEGIN_EXCEPTION + if (qpol_policy_get_isid_by_name(p, name, &i)) { +@@ -1667,11 +1835,12 @@ typedef struct qpol_isid {} qpol_isid_t; + fail: + return (qpol_isid_t*)i; + }; +- ~qpol_isid_t() { ++ ~qpol_isid() { + /* no op */ + return; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_isid_get_name(p, self, &name)) { +@@ -1681,7 +1850,8 @@ typedef struct qpol_isid {} qpol_isid_t; + fail: + return name; + }; +- const qpol_context_t *get_context(qpol_policy_t *p) { ++ %rename(get_context) wrap_get_context; ++ const qpol_context_t *wrap_get_context(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_isid_get_context(p, self, &ctx)) { +@@ -1701,7 +1871,7 @@ typedef struct qpol_isid {} qpol_isid_t; + /* qpol netifcon */ + typedef struct qpol_netifcon {} qpol_netifcon_t; + %extend qpol_netifcon_t { +- qpol_netifcon_t(qpol_policy_t *p, const char *name) { ++ qpol_netifcon(qpol_policy_t *p, const char *name) { + const qpol_netifcon_t *n; + BEGIN_EXCEPTION + if (qpol_policy_get_netifcon_by_name(p, name, &n)) { +@@ -1711,11 +1881,12 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; + fail: + return (qpol_netifcon_t*)n; + }; +- ~qpol_netifcon_t() { ++ ~qpol_netifcon() { + /* no op */ + return; + }; +- const char *get_name(qpol_policy_t *p) { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { + const char *name; + BEGIN_EXCEPTION + if (qpol_netifcon_get_name(p, self, &name)) { +@@ -1725,7 +1896,8 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; + fail: + return name; + }; +- const qpol_context_t *get_msg_con(qpol_policy_t *p) { ++ %rename(get_msg_con) wrap_get_msg_con; ++ const qpol_context_t *wrap_get_msg_con(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_netifcon_get_msg_con(p, self, &ctx)) { +@@ -1735,7 +1907,8 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; + fail: + return ctx; + }; +- const qpol_context_t *get_if_con(qpol_policy_t *p) { ++ %rename(get_if_con) wrap_get_if_con; ++ const qpol_context_t *wrap_get_if_con(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_netifcon_get_if_con(p, self, &ctx)) { +@@ -1757,7 +1930,7 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; + #define QPOL_IPV6 1 + typedef struct qpol_nodecon {} qpol_nodecon_t; + %extend qpol_nodecon_t { +- qpol_nodecon_t(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { ++ qpol_nodecon(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { + uint32_t a[4], m[4]; + qpol_nodecon_t *n; + BEGIN_EXCEPTION +@@ -1772,10 +1945,11 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; + fail: + return n; + } +- ~qpol_nodecon_t() { ++ ~qpol_nodecon() { + free(self); + }; +- uint32_t *get_addr(qpol_policy_t *p) { ++ %rename(get_addr) wrap_get_addr; ++ uint32_t *wrap_get_addr(qpol_policy_t *p) { + uint32_t *a; + BEGIN_EXCEPTION + unsigned char proto; /* currently dropped; stores the protocol - call get_protocol() */ +@@ -1786,7 +1960,8 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; + fail: + return a; + }; +- uint32_t *get_mask(qpol_policy_t *p) { ++ %rename(get_mask) wrap_get_mask; ++ uint32_t *wrap_get_mask(qpol_policy_t *p) { + uint32_t *m; + BEGIN_EXCEPTION + unsigned char proto; /* currently dropped; stores the protocol - call get_protocol() */ +@@ -1797,7 +1972,8 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; + fail: + return m; + }; +- int get_protocol(qpol_policy_t *p) { ++ %rename(get_protocol) wrap_get_protocol; ++ int wrap_get_protocol(qpol_policy_t *p) { + unsigned char proto; + BEGIN_EXCEPTION + if (qpol_nodecon_get_protocol(p, self, &proto)) { +@@ -1807,7 +1983,8 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; + fail: + return proto; + }; +- const qpol_context_t *get_context(qpol_policy_t *p) { ++ %rename(get_context) wrap_get_context; ++ const qpol_context_t *wrap_get_context(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_nodecon_get_context(p, self, &ctx)) { +@@ -1830,7 +2007,7 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; + #define IPPROTO_UDP 17 + typedef struct qpol_portcon {} qpol_portcon_t; + %extend qpol_portcon_t { +- qpol_portcon_t(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { ++ qpol_portcon(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { + const qpol_portcon_t *qp; + BEGIN_EXCEPTION + if (qpol_policy_get_portcon_by_port(p, low, high, protocol, &qp)) { +@@ -1840,11 +2017,12 @@ typedef struct qpol_portcon {} qpol_portcon_t; + fail: + return (qpol_portcon_t*)qp; + }; +- ~qpol_portcon_t() { ++ ~qpol_portcon() { + /* no op */ + return; + }; +- uint16_t get_low_port(qpol_policy_t *p) { ++ %rename(get_low_port) wrap_get_low_port; ++ uint16_t wrap_get_low_port(qpol_policy_t *p) { + uint16_t port = 0; + BEGIN_EXCEPTION + if(qpol_portcon_get_low_port(p, self, &port)) { +@@ -1854,7 +2032,8 @@ typedef struct qpol_portcon {} qpol_portcon_t; + fail: + return port; + }; +- uint16_t get_high_port(qpol_policy_t *p) { ++ %rename(get_high_port) wrap_get_high_port; ++ uint16_t wrap_get_high_port(qpol_policy_t *p) { + uint16_t port = 0; + BEGIN_EXCEPTION + if(qpol_portcon_get_high_port(p, self, &port)) { +@@ -1864,7 +2043,8 @@ typedef struct qpol_portcon {} qpol_portcon_t; + fail: + return port; + }; +- uint8_t get_protocol(qpol_policy_t *p) { ++ %rename(get_protocol) wrap_get_protocol; ++ uint8_t wrap_get_protocol(qpol_policy_t *p) { + uint8_t proto = 0; + BEGIN_EXCEPTION + if (qpol_portcon_get_protocol(p, self, &proto)) { +@@ -1874,7 +2054,8 @@ typedef struct qpol_portcon {} qpol_portcon_t; + fail: + return proto; + }; +- const qpol_context_t *get_context(qpol_policy_t *p) { ++ %rename(get_context) wrap_get_context; ++ const qpol_context_t *wrap_get_context(qpol_policy_t *p) { + const qpol_context_t *ctx; + BEGIN_EXCEPTION + if (qpol_portcon_get_context(p, self, &ctx)) { +@@ -1894,17 +2075,18 @@ typedef struct qpol_portcon {} qpol_portcon_t; + /* qpol constraint */ + typedef struct qpol_constraint {} qpol_constraint_t; + %extend qpol_constraint_t { +- qpol_constraint_t() { ++ qpol_constraint() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_constraint_t() { ++ ~qpol_constraint() { + free(self); + }; +- const qpol_class_t *get_class(qpol_policy_t *p) { ++ %rename(get_class) wrap_get_class; ++ const qpol_class_t *wrap_get_class(qpol_policy_t *p) { + const qpol_class_t *cls; + BEGIN_EXCEPTION + if (qpol_constraint_get_class(p, self, &cls)) { +@@ -1915,7 +2097,8 @@ typedef struct qpol_constraint {} qpol_constraint_t; + return cls; + }; + %newobject get_perm_iter(qpol_policy_t*); +- qpol_iterator_t *get_perm_iter(qpol_policy_t *p) { ++ %rename(get_perm_iter) wrap_get_perm_iter; ++ qpol_iterator_t *wrap_get_perm_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_constraint_get_perm_iter(p, self, &iter)) { +@@ -1926,7 +2109,8 @@ typedef struct qpol_constraint {} qpol_constraint_t; + return iter; + }; + %newobject get_expr_iter(qpol_policy_t*); +- qpol_iterator_t *get_expr_iter(qpol_policy_t *p) { ++ %rename(get_expr_iter) wrap_get_expr_iter; ++ qpol_iterator_t *wrap_get_expr_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_constraint_get_expr_iter(p, self, &iter)) { +@@ -1946,17 +2130,18 @@ typedef struct qpol_constraint {} qpol_constraint_t; + /* qpol validatetrans */ + typedef struct qpol_validatetrans {} qpol_validatetrans_t; + %extend qpol_validatetrans_t { +- qpol_validatetrans_t() { ++ qpol_validatetrans() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_validatetrans_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_validatetrans_t() { ++ ~qpol_validatetrans() { + free(self); + }; +- const qpol_class_t *get_class(qpol_policy_t *p) { ++ %rename(get_class) wrap_get_class; ++ const qpol_class_t *wrap_get_class(qpol_policy_t *p) { + const qpol_class_t *cls; + BEGIN_EXCEPTION + if (qpol_validatetrans_get_class(p, self, &cls)) { +@@ -1967,7 +2152,8 @@ typedef struct qpol_validatetrans {} qpol_validatetrans_t; + return cls; + }; + %newobject get_expr_iter(qpol_policy_t*); +- qpol_iterator_t *get_expr_iter(qpol_policy_t *p) { ++ %rename(get_expr_iter) wrap_get_expr_iter; ++ qpol_iterator_t *wrap_get_expr_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_validatetrans_get_expr_iter(p, self, &iter)) { +@@ -2011,18 +2197,19 @@ typedef struct qpol_validatetrans {} qpol_validatetrans_t; + #define QPOL_CEXPR_OP_INCOMP 5 + typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; + %extend qpol_constraint_expr_node_t { +- qpol_constraint_expr_node_t() { ++ qpol_constraint_expr_node() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_expr_node_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_constraint_expr_node_t() { ++ ~qpol_constraint_expr_node() { + /* no op */ + return; + }; +- int get_expr_type(qpol_policy_t *p) { ++ %rename(get_expr_type) wrap_get_expr_type; ++ int wrap_get_expr_type(qpol_policy_t *p) { + uint32_t et; + BEGIN_EXCEPTION + if (qpol_constraint_expr_node_get_expr_type(p, self, &et)) { +@@ -2032,7 +2219,8 @@ typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; + fail: + return (int) et; + }; +- int get_sym_type(qpol_policy_t *p) { ++ %rename(get_sym_type) wrap_get_sym_type; ++ int wrap_get_sym_type(qpol_policy_t *p) { + uint32_t st; + BEGIN_EXCEPTION + if (qpol_constraint_expr_node_get_sym_type(p, self, &st)) { +@@ -2042,7 +2230,8 @@ typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; + fail: + return (int) st; + }; +- int get_op(qpol_policy_t *p) { ++ %rename(get_op) wrap_get_op; ++ int wrap_get_op(qpol_policy_t *p) { + uint32_t op; + BEGIN_EXCEPTION + if (qpol_constraint_expr_node_get_op(p, self, &op)) { +@@ -2053,7 +2242,8 @@ typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; + return (int) op; + }; + %newobject get_names_iter(qpol_policy_t*); +- qpol_iterator_t *get_names_iter(qpol_policy_t *p) { ++ %rename(get_names_iter) wrap_get_names_iter; ++ qpol_iterator_t *wrap_get_names_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_constraint_expr_node_get_names_iter(p, self, &iter)) { +@@ -2073,18 +2263,19 @@ typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; + /* qpol role allow */ + typedef struct qpol_role_allow {} qpol_role_allow_t; + %extend qpol_role_allow_t { +- qpol_role_allow_t() { ++ qpol_role_allow() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_allow_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_role_allow_t() { ++ ~qpol_role_allow() { + /* no op */ + return; + }; +- const qpol_role_t *get_source_role(qpol_policy_t *p) { ++ %rename(get_source_role) wrap_get_source_role; ++ const qpol_role_t *wrap_get_source_role(qpol_policy_t *p) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_role_allow_get_source_role(p, self, &r)) { +@@ -2094,7 +2285,8 @@ typedef struct qpol_role_allow {} qpol_role_allow_t; + fail: + return r; + }; +- const qpol_role_t *get_target_role(qpol_policy_t *p) { ++ %rename(get_target_role) wrap_get_target_role; ++ const qpol_role_t *wrap_get_target_role(qpol_policy_t *p) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_role_allow_get_target_role(p, self, &r)) { +@@ -2114,18 +2306,19 @@ typedef struct qpol_role_allow {} qpol_role_allow_t; + /* qpol role trans */ + typedef struct qpol_role_trans {} qpol_role_trans_t; + %extend qpol_role_trans_t { +- qpol_role_trans_t() { ++ qpol_role_trans() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_trans_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_role_trans_t() { ++ ~qpol_role_trans() { + /* no op */ + return; + }; +- const qpol_role_t *get_source_role(qpol_policy_t *p) { ++ %rename(get_source_role) wrap_get_source_role; ++ const qpol_role_t *wrap_get_source_role(qpol_policy_t *p) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_role_trans_get_source_role(p, self, &r)) { +@@ -2135,7 +2328,8 @@ typedef struct qpol_role_trans {} qpol_role_trans_t; + fail: + return r; + }; +- const qpol_type_t *get_target_type(qpol_policy_t *p) { ++ %rename(get_target_type) wrap_get_target_type; ++ const qpol_type_t *wrap_get_target_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_role_trans_get_target_type(p, self, &t)) { +@@ -2145,7 +2339,19 @@ typedef struct qpol_role_trans {} qpol_role_trans_t; + fail: + return t; + }; +- const qpol_role_t *get_default_role(qpol_policy_t *p) { ++ %rename(get_object_class) wrap_get_object_class; ++ const qpol_class_t *wrap_get_object_class(qpol_policy_t *p) { ++ const qpol_class_t *c; ++ BEGIN_EXCEPTION ++ if (qpol_role_trans_get_object_class(p, self, &c)) { ++ SWIG_exception(SWIG_ValueError, "Could not get class for role_transition rule"); ++ } ++ END_EXCEPTION ++ fail: ++ return c; ++ }; ++ %rename(get_default_role) wrap_get_default_role; ++ const qpol_role_t *wrap_get_default_role(qpol_policy_t *p) { + const qpol_role_t *r; + BEGIN_EXCEPTION + if (qpol_role_trans_get_default_role(p, self, &r)) { +@@ -2165,18 +2371,19 @@ typedef struct qpol_role_trans {} qpol_role_trans_t; + /* qpol range trans */ + typedef struct qpol_range_trans {} qpol_range_trans_t; + %extend qpol_range_trans_t { +- qpol_range_trans_t() { ++ qpol_range_trans() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_range_trans_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_range_trans_t() { ++ ~qpol_range_trans() { + /* no op */ + return; + }; +- const qpol_type_t *get_source_type (qpol_policy_t *p) { ++ %rename(get_source_type) wrap_get_source_type; ++ const qpol_type_t *wrap_get_source_type (qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_range_trans_get_source_type(p, self, &t)) { +@@ -2186,7 +2393,8 @@ typedef struct qpol_range_trans {} qpol_range_trans_t; + fail: + return t; + }; +- const qpol_type_t *get_target_type (qpol_policy_t *p) { ++ %rename(get_target_type) wrap_get_target_type; ++ const qpol_type_t *wrap_get_target_type (qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_range_trans_get_target_type(p, self, &t)) { +@@ -2195,7 +2403,8 @@ typedef struct qpol_range_trans {} qpol_range_trans_t; + fail: + return t; + }; +- const qpol_class_t *get_target_class(qpol_policy_t *p) { ++ %rename(get_target_class) wrap_get_target_class; ++ const qpol_class_t *wrap_get_target_class(qpol_policy_t *p) { + const qpol_class_t *cls; + BEGIN_EXCEPTION + if (qpol_range_trans_get_target_class(p, self, &cls)) { +@@ -2204,7 +2413,8 @@ typedef struct qpol_range_trans {} qpol_range_trans_t; + fail: + return cls; + }; +- const qpol_mls_range_t *get_range(qpol_policy_t *p) { ++ %rename(get_range) wrap_get_range; ++ const qpol_mls_range_t *wrap_get_range(qpol_policy_t *p) { + const qpol_mls_range_t *r; + BEGIN_EXCEPTION + if (qpol_range_trans_get_range(p, self, &r)) { +@@ -2228,18 +2438,19 @@ typedef struct qpol_range_trans {} qpol_range_trans_t; + #define QPOL_RULE_DONTAUDIT 4 + typedef struct qpol_avrule {} qpol_avrule_t; + %extend qpol_avrule_t { +- qpol_avrule_t() { ++ qpol_avrule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_avrule_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_avrule_t() { ++ ~qpol_avrule() { + /* no op */ + return; + }; +- int get_rule_type(qpol_policy_t *p) { ++ %rename(get_rule_type) wrap_get_rule_type; ++ int wrap_get_rule_type(qpol_policy_t *p) { + uint32_t rt; + BEGIN_EXCEPTION + if (qpol_avrule_get_rule_type(p, self, &rt)) { +@@ -2249,7 +2460,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return (int) rt; + }; +- const qpol_type_t *get_source_type(qpol_policy_t *p) { ++ %rename(get_source_type) wrap_get_source_type; ++ const qpol_type_t *wrap_get_source_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_avrule_get_source_type(p, self, &t)) { +@@ -2259,7 +2471,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return t; + }; +- const qpol_type_t *get_target_type(qpol_policy_t *p) { ++ %rename(get_target_type) wrap_get_target_type; ++ const qpol_type_t *wrap_get_target_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_avrule_get_target_type(p, self, &t)) { +@@ -2269,7 +2482,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return t; + }; +- const qpol_class_t *get_object_class(qpol_policy_t *p) { ++ %rename(get_object_class) wrap_get_object_class; ++ const qpol_class_t *wrap_get_object_class(qpol_policy_t *p) { + const qpol_class_t *cls; + BEGIN_EXCEPTION + if (qpol_avrule_get_object_class(p, self, &cls)) { +@@ -2280,7 +2494,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + return cls; + }; + %newobject get_perm_iter(qpol_policy_t *p); +- qpol_iterator_t *get_perm_iter(qpol_policy_t *p) { ++ %rename(get_perm_iter) wrap_get_perm_iter; ++ qpol_iterator_t *wrap_get_perm_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_avrule_get_perm_iter(p, self, &iter)) { +@@ -2290,7 +2505,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return iter; + }; +- const qpol_cond_t *get_cond(qpol_policy_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(qpol_policy_t *p) { + const qpol_cond_t *c; + BEGIN_EXCEPTION + if (qpol_avrule_get_cond(p, self, &c)) { +@@ -2300,7 +2516,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return c; + }; +- int get_is_enabled(qpol_policy_t *p) { ++ %rename(get_is_enabled) wrap_get_is_enabled; ++ int wrap_get_is_enabled(qpol_policy_t *p) { + uint32_t e; + BEGIN_EXCEPTION + if (qpol_avrule_get_is_enabled(p, self, &e)) { +@@ -2310,7 +2527,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + fail: + return (int) e; + }; +- int get_which_list(qpol_policy_t *p) { ++ %rename(get_which_list) wrap_get_which_list; ++ int wrap_get_which_list(qpol_policy_t *p) { + const qpol_cond_t *c; + uint32_t which = 0; + BEGIN_EXCEPTION +@@ -2325,7 +2543,8 @@ typedef struct qpol_avrule {} qpol_avrule_t; + return (int) which; + }; + %newobject get_syn_avrule_iter(qpol_policy_t*); +- qpol_iterator_t *get_syn_avrule_iter(qpol_policy_t *p) { ++ %rename(get_syn_avrule_iter) wrap_get_syn_avrule_iter; ++ qpol_iterator_t *wrap_get_syn_avrule_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_avrule_get_syn_avrule_iter(p, self, &iter)) { +@@ -2348,18 +2567,19 @@ typedef struct qpol_avrule {} qpol_avrule_t; + #define QPOL_RULE_TYPE_MEMBER 32 + typedef struct qpol_terule {} qpol_terule_t; + %extend qpol_terule_t { +- qpol_terule_t() { ++ qpol_terule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_terule_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_terule_t() { ++ ~qpol_terule() { + /* no op */ + return; + }; +- int get_rule_type(qpol_policy_t *p) { ++ %rename(get_rule_type) wrap_get_rule_type; ++ int wrap_get_rule_type(qpol_policy_t *p) { + uint32_t rt; + BEGIN_EXCEPTION + if (qpol_terule_get_rule_type(p, self, &rt)) { +@@ -2369,7 +2589,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return (int) rt; + }; +- const qpol_type_t *get_source_type(qpol_policy_t *p) { ++ %rename(get_source_type) wrap_get_source_type; ++ const qpol_type_t *wrap_get_source_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_terule_get_source_type(p, self, &t)) { +@@ -2379,7 +2600,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return t; + }; +- const qpol_type_t *get_target_type(qpol_policy_t *p) { ++ %rename(get_target_type) wrap_get_target_type; ++ const qpol_type_t *wrap_get_target_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_terule_get_target_type(p, self, &t)) { +@@ -2389,7 +2611,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return t; + }; +- const qpol_class_t *get_object_class(qpol_policy_t *p) { ++ %rename(get_object_class) wrap_get_object_class; ++ const qpol_class_t *wrap_get_object_class(qpol_policy_t *p) { + const qpol_class_t *cls; + BEGIN_EXCEPTION + if (qpol_terule_get_object_class(p, self, &cls)) { +@@ -2399,7 +2622,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return cls; + }; +- const qpol_type_t *get_default_type(qpol_policy_t *p) { ++ %rename(get_default_type) wrap_get_default_type; ++ const qpol_type_t *wrap_get_default_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_terule_get_default_type(p, self, &t)) { +@@ -2409,7 +2633,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return t; + }; +- const qpol_cond_t *get_cond(qpol_policy_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(qpol_policy_t *p) { + const qpol_cond_t *c; + BEGIN_EXCEPTION + if (qpol_terule_get_cond(p, self, &c)) { +@@ -2419,7 +2644,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return c; + }; +- int get_is_enabled(qpol_policy_t *p) { ++ %rename(get_is_enabled) wrap_get_is_enabled; ++ int wrap_get_is_enabled(qpol_policy_t *p) { + uint32_t e; + BEGIN_EXCEPTION + if (qpol_terule_get_is_enabled(p, self, &e)) { +@@ -2429,7 +2655,8 @@ typedef struct qpol_terule {} qpol_terule_t; + fail: + return (int) e; + }; +- int get_which_list(qpol_policy_t *p) { ++ %rename(get_which_list) wrap_get_which_list; ++ int wrap_get_which_list(qpol_policy_t *p) { + const qpol_cond_t *c; + uint32_t which = 0; + BEGIN_EXCEPTION +@@ -2444,7 +2671,8 @@ typedef struct qpol_terule {} qpol_terule_t; + return (int) which; + }; + %newobject get_syn_terule_iter(qpol_policy_t*); +- qpol_iterator_t *get_syn_terule_iter(qpol_policy_t *p) { ++ %rename(get_syn_terule_iter) wrap_get_syn_terule_iter; ++ qpol_iterator_t *wrap_get_syn_terule_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_terule_get_syn_terule_iter(p, self, &iter)) { +@@ -2464,19 +2692,20 @@ typedef struct qpol_terule {} qpol_terule_t; + /* qpol conditional */ + typedef struct qpol_cond {} qpol_cond_t; + %extend qpol_cond_t { +- qpol_cond_t() { ++ qpol_cond() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_cond_t() { ++ ~qpol_cond() { + /* no op */ + return; + }; + %newobject get_expr_node_iter(qpol_policy_t*); +- qpol_iterator_t *get_expr_node_iter(qpol_policy_t *p) { ++ %rename(get_expr_node_iter) wrap_get_expr_node_iter; ++ qpol_iterator_t *wrap_get_expr_node_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cond_get_expr_node_iter(p, self, &iter)) { +@@ -2487,7 +2716,8 @@ typedef struct qpol_cond {} qpol_cond_t; + return iter; + }; + %newobject get_av_true_iter(qpol_policy_t*, int); +- qpol_iterator_t *get_av_true_iter(qpol_policy_t *p, int rule_types) { ++ %rename(get_av_true_iter) wrap_get_av_true_iter; ++ qpol_iterator_t *wrap_get_av_true_iter(qpol_policy_t *p, int rule_types) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cond_get_av_true_iter(p, self, rule_types, &iter)) { +@@ -2498,7 +2728,8 @@ typedef struct qpol_cond {} qpol_cond_t; + return iter; + }; + %newobject get_av_false_iter(qpol_policy_t*, int); +- qpol_iterator_t *get_av_false_iter(qpol_policy_t *p, int rule_types) { ++ %rename(get_av_false_iter) wrap_get_av_false_iter; ++ qpol_iterator_t *wrap_get_av_false_iter(qpol_policy_t *p, int rule_types) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cond_get_av_false_iter(p, self, rule_types, &iter)) { +@@ -2509,7 +2740,8 @@ typedef struct qpol_cond {} qpol_cond_t; + return iter; + }; + %newobject get_te_true_iter(qpol_policy_t*, int); +- qpol_iterator_t *get_te_true_iter(qpol_policy_t *p, int rule_types) { ++ %rename(get_te_true_iter) wrap_get_te_true_iter; ++ qpol_iterator_t *wrap_get_te_true_iter(qpol_policy_t *p, int rule_types) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cond_get_te_true_iter(p, self, rule_types, &iter)) { +@@ -2520,7 +2752,8 @@ typedef struct qpol_cond {} qpol_cond_t; + return iter; + }; + %newobject get_te_false_iter(qpol_policy_t*, int); +- qpol_iterator_t *get_te_false_iter(qpol_policy_t *p, int rule_types) { ++ %rename(get_te_false_iter) wrap_get_te_false_iter; ++ qpol_iterator_t *wrap_get_te_false_iter(qpol_policy_t *p, int rule_types) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_cond_get_te_false_iter(p, self, rule_types, &iter)) { +@@ -2530,7 +2763,8 @@ typedef struct qpol_cond {} qpol_cond_t; + fail: + return iter; + }; +- int eval(qpol_policy_t *p) { ++ %rename(eval) wrap_eval; ++ int wrap_eval(qpol_policy_t *p) { + uint32_t e; + BEGIN_EXCEPTION + if (qpol_cond_eval(p, self, &e)) { +@@ -2557,18 +2791,19 @@ typedef struct qpol_cond {} qpol_cond_t; + #define QPOL_COND_EXPR_NEQ 7 /* bool != bool */ + typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; + %extend qpol_cond_expr_node_t { +- qpol_cond_expr_node_t() { ++ qpol_cond_expr_node() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_expr_node_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_cond_expr_node_t() { ++ ~qpol_cond_expr_node() { + /* no op */ + return; + }; +- int get_expr_type(qpol_policy_t *p) { ++ %rename(get_expr_type) wrap_get_expr_type; ++ int wrap_get_expr_type(qpol_policy_t *p) { + uint32_t et; + BEGIN_EXCEPTION + if (qpol_cond_expr_node_get_expr_type(p, self, &et)) { +@@ -2578,7 +2813,8 @@ typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; + fail: + return (int) et; + }; +- qpol_bool_t *get_bool(qpol_policy_t *p) { ++ %rename(get_bool) wrap_get_bool; ++ qpol_bool_t *wrap_get_bool(qpol_policy_t *p) { + uint32_t et; + qpol_bool_t *b = NULL; + BEGIN_EXCEPTION +@@ -2602,19 +2838,20 @@ typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; + /* qpol type set */ + typedef struct qpol_type_set {} qpol_type_set_t; + %extend qpol_type_set_t { +- qpol_type_set_t() { ++ qpol_type_set() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_type_set_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_type_set_t() { ++ ~qpol_type_set() { + /* no op */ + return; + }; + %newobject get_included_types_iter(qpol_policy_t*); +- qpol_iterator_t *get_included_types_iter(qpol_policy_t *p) { ++ %rename(get_included_types_iter) wrap_get_included_types_iter; ++ qpol_iterator_t *wrap_get_included_types_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_type_set_get_included_types_iter(p, self, &iter)) { +@@ -2625,7 +2862,8 @@ typedef struct qpol_type_set {} qpol_type_set_t; + return iter; + }; + %newobject get_subtracted_types_iter(qpol_policy_t*); +- qpol_iterator_t *get_subtracted_types_iter(qpol_policy_t *p) { ++ %rename(get_subtracted_types_iter) wrap_get_subtracted_types_iter; ++ qpol_iterator_t *wrap_get_subtracted_types_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_type_set_get_subtracted_types_iter(p, self, &iter)) { +@@ -2635,7 +2873,8 @@ typedef struct qpol_type_set {} qpol_type_set_t; + fail: + return iter; + }; +- int get_is_star(qpol_policy_t *p) { ++ %rename(get_is_star) wrap_get_is_star; ++ int wrap_get_is_star(qpol_policy_t *p) { + uint32_t s; + BEGIN_EXCEPTION + if (qpol_type_set_get_is_star(p, self, &s)) { +@@ -2645,7 +2884,8 @@ typedef struct qpol_type_set {} qpol_type_set_t; + fail: + return (int) s; + }; +- int get_is_comp(qpol_policy_t *p) { ++ %rename(get_is_comp) wrap_get_is_comp; ++ int wrap_get_is_comp(qpol_policy_t *p) { + uint32_t c; + BEGIN_EXCEPTION + if (qpol_type_set_get_is_comp(p, self, &c)) { +@@ -2665,18 +2905,19 @@ typedef struct qpol_type_set {} qpol_type_set_t; + /* qpol syn av rule */ + typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + %extend qpol_syn_avrule_t { +- qpol_syn_avrule_t() { ++ qpol_syn_avrule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_avrule_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_syn_avrule_t() { ++ ~qpol_syn_avrule() { + /* no op */ + return; + }; +- int get_rule_type(qpol_policy_t *p) { ++ %rename(get_rule_type) wrap_get_rule_type; ++ int wrap_get_rule_type(qpol_policy_t *p) { + uint32_t rt; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_rule_type(p, self, &rt)) { +@@ -2686,7 +2927,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return (int) rt; + }; +- const qpol_type_set_t *get_source_type_set(qpol_policy_t *p) { ++ %rename(get_source_type_set) wrap_get_source_type_set; ++ const qpol_type_set_t *wrap_get_source_type_set(qpol_policy_t *p) { + const qpol_type_set_t *ts; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_source_type_set(p, self, &ts)) { +@@ -2696,7 +2938,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return ts; + }; +- const qpol_type_set_t *get_target_type_set(qpol_policy_t *p) { ++ %rename(get_target_type_set) wrap_get_target_type_set; ++ const qpol_type_set_t *wrap_get_target_type_set(qpol_policy_t *p) { + const qpol_type_set_t *ts; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_target_type_set(p, self, &ts)) { +@@ -2706,7 +2949,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return ts; + }; +- int get_is_target_self(qpol_policy_t *p) { ++ %rename(get_is_target_self) wrap_get_is_target_self; ++ int wrap_get_is_target_self(qpol_policy_t *p) { + uint32_t i; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_is_target_self(p, self, &i)) { +@@ -2717,7 +2961,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + return (int) i; + }; + %newobject get_class_iter(qpol_policy_t*); +- qpol_iterator_t *get_class_iter(qpol_policy_t *p) { ++ %rename(get_class_iter) wrap_get_class_iter; ++ qpol_iterator_t *wrap_get_class_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_class_iter(p, self, &iter)) { +@@ -2728,7 +2973,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + return iter; + }; + %newobject get_perm_iter(qpol_policy_t*); +- qpol_iterator_t *get_perm_iter(qpol_policy_t *p) { ++ %rename(get_perm_iter) wrap_get_perm_iter; ++ qpol_iterator_t *wrap_get_perm_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_perm_iter(p, self, &iter)) { +@@ -2738,7 +2984,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return iter; + }; +- long get_lineno(qpol_policy_t *p) { ++ %rename(get_lineno) wrap_get_lineno; ++ long wrap_get_lineno(qpol_policy_t *p) { + unsigned long l; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_lineno(p, self, &l)) { +@@ -2748,7 +2995,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return (long)l; + }; +- const qpol_cond_t *get_cond(qpol_policy_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(qpol_policy_t *p) { + const qpol_cond_t *c; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_cond(p, self, &c)) { +@@ -2758,7 +3006,8 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + fail: + return c; + }; +- int get_is_enabled(qpol_policy_t *p) { ++ %rename(get_is_enabled) wrap_get_is_enabled; ++ int wrap_get_is_enabled(qpol_policy_t *p) { + uint32_t e; + BEGIN_EXCEPTION + if (qpol_syn_avrule_get_is_enabled(p, self, &e)) { +@@ -2778,18 +3027,19 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; + /* qpol syn te rule */ + typedef struct qpol_syn_terule {} qpol_syn_terule_t; + %extend qpol_syn_terule_t { +- qpol_syn_terule_t() { ++ qpol_syn_terule() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_terule_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~qpol_syn_terule_t() { ++ ~qpol_syn_terule() { + /* no op */ + return; + }; +- int get_rule_type(qpol_policy_t *p) { ++ %rename(get_rule_type) wrap_get_rule_type; ++ int wrap_get_rule_type(qpol_policy_t *p) { + uint32_t rt; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_rule_type(p, self, &rt)) { +@@ -2799,7 +3049,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return rt; + }; +- const qpol_type_set_t *get_source_type_set(qpol_policy_t *p) { ++ %rename(get_source_type_set) wrap_get_source_type_set; ++ const qpol_type_set_t *wrap_get_source_type_set(qpol_policy_t *p) { + const qpol_type_set_t *ts; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_source_type_set(p, self, &ts)) { +@@ -2809,7 +3060,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return ts; + }; +- const qpol_type_set_t *get_target_type_set(qpol_policy_t *p) { ++ %rename(get_target_type_set) wrap_get_target_type_set; ++ const qpol_type_set_t *wrap_get_target_type_set(qpol_policy_t *p) { + const qpol_type_set_t *ts; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_target_type_set(p, self, &ts)) { +@@ -2820,7 +3072,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + return ts; + }; + %newobject get_class_iter(qpol_policy_t*); +- qpol_iterator_t *get_class_iter(qpol_policy_t *p) { ++ %rename(get_class_iter) wrap_get_class_iter; ++ qpol_iterator_t *wrap_get_class_iter(qpol_policy_t *p) { + qpol_iterator_t *iter; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_class_iter(p, self, &iter)) { +@@ -2830,7 +3083,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return iter; + }; +- const qpol_type_t *get_default_type(qpol_policy_t *p) { ++ %rename(get_default_type) wrap_get_default_type; ++ const qpol_type_t *wrap_get_default_type(qpol_policy_t *p) { + const qpol_type_t *t; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_default_type(p, self, &t)) { +@@ -2840,7 +3094,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return t; + }; +- long get_lineno(qpol_policy_t *p) { ++ %rename(get_lineno) wrap_get_lineno; ++ long wrap_get_lineno(qpol_policy_t *p) { + unsigned long l; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_lineno(p, self, &l)) { +@@ -2850,7 +3105,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return (long)l; + }; +- const qpol_cond_t *get_cond(qpol_policy_t *p) { ++ %rename(get_cond) wrap_get_cond; ++ const qpol_cond_t *wrap_get_cond(qpol_policy_t *p) { + const qpol_cond_t *c; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_cond(p, self, &c)) { +@@ -2860,7 +3116,8 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + fail: + return c; + }; +- int get_is_enabled(qpol_policy_t *p) { ++ %rename(get_is_enabled) wrap_get_is_enabled; ++ int wrap_get_is_enabled(qpol_policy_t *p) { + uint32_t e; + BEGIN_EXCEPTION + if (qpol_syn_terule_get_is_enabled(p, self, &e)) { +@@ -2876,4 +3133,317 @@ typedef struct qpol_syn_terule {} qpol_syn_terule_t; + return (qpol_syn_terule_t*)x; + }; + %} ++ ++/* qpol filename trans */ ++typedef struct qpol_filename_trans {} qpol_filename_trans_t; ++%extend qpol_filename_trans_t { ++ qpol_filename_trans() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_filename_trans_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_filename_trans() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_source_type) wrap_get_source_type; ++ const qpol_type_t *wrap_get_source_type (qpol_policy_t *p) { ++ const qpol_type_t *t; ++ BEGIN_EXCEPTION ++ if (qpol_filename_trans_get_source_type(p, self, &t)) { ++ SWIG_exception(SWIG_ValueError, "Could not get source for filename transition rule"); ++ } ++ END_EXCEPTION ++ fail: ++ return t; ++ }; ++ %rename(get_target_type) wrap_get_target_type; ++ const qpol_type_t *wrap_get_target_type (qpol_policy_t *p) { ++ const qpol_type_t *t; ++ BEGIN_EXCEPTION ++ if (qpol_filename_trans_get_target_type(p, self, &t)) { ++ SWIG_exception(SWIG_ValueError, "Could not get target for filename transition rule"); } ++ END_EXCEPTION ++ fail: ++ return t; ++ }; ++ %rename(get_object_class) wrap_get_object_class; ++ const qpol_class_t *wrap_get_object_class(qpol_policy_t *p) { ++ const qpol_class_t *cls; ++ BEGIN_EXCEPTION ++ if (qpol_filename_trans_get_object_class(p, self, &cls)) { ++ SWIG_exception(SWIG_ValueError, "Could not get class for filename transition rule"); } ++ END_EXCEPTION ++ fail: ++ return cls; ++ }; ++ %rename(get_default_type) wrap_get_default_type; ++ const qpol_type_t *wrap_get_default_type(qpol_policy_t *p) { ++ const qpol_type_t *t; ++ BEGIN_EXCEPTION ++ if (qpol_filename_trans_get_default_type(p, self, &t)) { ++ SWIG_exception(SWIG_ValueError, "Could not get default for filename transition rule"); ++ } ++ END_EXCEPTION ++ fail: ++ return t; ++ }; ++ %rename(get_filename) wrap_get_filename; ++ const char *wrap_get_filename(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_filename_trans_get_filename(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get file for filename transition rule"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ ++}; ++%inline %{ ++ qpol_filename_trans_t *qpol_filename_trans_from_void(void *x) { ++ return (qpol_filename_trans_t*)x; ++ }; ++%} ++ ++/* qpol polcap */ ++typedef struct qpol_polcap {} qpol_polcap_t; ++%extend qpol_polcap_t { ++ qpol_polcap() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_polcap_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_polcap() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_polcap_get_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get polcap name rule"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ ++}; ++%inline %{ ++ qpol_polcap_t *qpol_polcap_from_void(void *x) { ++ return (qpol_polcap_t*)x; ++ }; ++%} ++ ++/* qpol typebounds */ ++typedef struct qpol_typebounds {} qpol_typebounds_t; ++%extend qpol_typebounds_t { ++ qpol_typebounds() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_typebounds_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_typebounds() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_parent_name) wrap_get_parent_name; ++ const char *wrap_get_parent_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_typebounds_get_parent_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get parent name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ %rename(get_child_name) wrap_get_child_name; ++ const char *wrap_get_child_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_typebounds_get_child_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get child name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++}; ++%inline %{ ++ qpol_typebounds_t *qpol_typebounds_from_void(void *x) { ++ return (qpol_typebounds_t*)x; ++ }; ++%} ++ ++/* qpol rolebounds */ ++typedef struct qpol_rolebounds {} qpol_rolebounds_t; ++%extend qpol_rolebounds_t { ++ qpol_rolebounds() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_rolebounds_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_rolebounds() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_parent_name) wrap_get_parent_name; ++ const char *wrap_get_parent_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_rolebounds_get_parent_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get parent name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ %rename(get_child_name) wrap_get_child_name; ++ const char *wrap_get_child_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_rolebounds_get_child_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get child name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++}; ++%inline %{ ++ qpol_rolebounds_t *qpol_rolebounds_from_void(void *x) { ++ return (qpol_rolebounds_t*)x; ++ }; ++%} ++ ++/* qpol userbounds */ ++typedef struct qpol_userbounds {} qpol_userbounds_t; ++%extend qpol_userbounds_t { ++ qpol_userbounds() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_userbounds_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_userbounds() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_parent_name) wrap_get_parent_name; ++ const char *wrap_get_parent_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_userbounds_get_parent_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get parent name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ %rename(get_child_name) wrap_get_child_name; ++ const char *wrap_get_child_name(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_userbounds_get_child_name(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get child name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++}; ++%inline %{ ++ qpol_userbounds_t *qpol_userbounds_from_void(void *x) { ++ return (qpol_userbounds_t*)x; ++ }; ++%} ++ ++/* qpol default_object */ ++typedef struct qpol_default_object {} qpol_default_object_t; ++%extend qpol_default_object_t { ++ qpol_default_object() { ++ BEGIN_EXCEPTION ++ SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_default_object_t objects"); ++ END_EXCEPTION ++ fail: ++ return NULL; ++ }; ++ ~qpol_default_object() { ++ /* no op */ ++ return; ++ }; ++ %rename(get_class) wrap_get_class; ++ const char *wrap_get_class(qpol_policy_t *p) { ++ const char *name; ++ BEGIN_EXCEPTION ++ if (qpol_default_object_get_class(p, self, &name)) { ++ SWIG_exception(SWIG_ValueError, "Could not get class name"); ++ } ++ END_EXCEPTION ++ fail: ++ return name; ++ }; ++ %rename(get_user_default) wrap_get_user_default; ++ const char *wrap_get_user_default(qpol_policy_t *p) { ++ const char *value; ++ BEGIN_EXCEPTION ++ if (qpol_default_object_get_user_default(p, self, &value)) { ++ SWIG_exception(SWIG_ValueError, "Could not get user default"); ++ } ++ END_EXCEPTION ++ fail: ++ return value; ++ }; ++ %rename(get_role_default) wrap_get_role_default; ++ const char *wrap_get_role_default(qpol_policy_t *p) { ++ const char *value; ++ BEGIN_EXCEPTION ++ if (qpol_default_object_get_role_default(p, self, &value)) { ++ SWIG_exception(SWIG_ValueError, "Could not get role default"); ++ } ++ END_EXCEPTION ++ fail: ++ return value; ++ }; ++ %rename(get_type_default) wrap_get_type_default; ++ const char *wrap_get_type_default(qpol_policy_t *p) { ++ const char *value; ++ BEGIN_EXCEPTION ++ if (qpol_default_object_get_type_default(p, self, &value)) { ++ SWIG_exception(SWIG_ValueError, "Could not get type default"); ++ } ++ END_EXCEPTION ++ fail: ++ return value; ++ }; ++ %rename(get_range_default) wrap_get_range_default; ++ const char *wrap_get_range_default(qpol_policy_t *p) { ++ const char *value; ++ BEGIN_EXCEPTION ++ if (qpol_default_object_get_range_default(p, self, &value)) { ++ SWIG_exception(SWIG_ValueError, "Could not get range defaults"); ++ } ++ END_EXCEPTION ++ fail: ++ return value; ++ }; ++}; ++%inline %{ ++ qpol_default_object_t *qpol_default_object_from_void(void *x) { ++ return (qpol_default_object_t*)x; ++ }; ++%} + // vim:ft=c noexpandtab +diff --git a/libseaudit/swig/seaudit.i b/libseaudit/swig/seaudit.i +index 8c96d89..3bd5fe4 100644 +--- a/libseaudit/swig/seaudit.i ++++ b/libseaudit/swig/seaudit.i +@@ -252,7 +252,7 @@ typedef struct tm { + int tm_isdst; /* daylight saving time */ + } tm_t; + %extend tm_t { +- tm_t() { ++ tm() { + struct tm *t; + BEGIN_EXCEPTION + t = calloc(1, sizeof(struct tm)); +@@ -263,7 +263,7 @@ typedef struct tm { + fail: + return t; + }; +- ~tm_t() { ++ ~tm() { + free(self); + } + /* use default accessor style for the rest */ +@@ -280,7 +280,7 @@ typedef enum seaudit_log_type + } seaudit_log_type_e; + typedef struct seaudit_log {} seaudit_log_t; + %extend seaudit_log_t { +- seaudit_log_t() { ++ seaudit_log() { + seaudit_log_t *slog; + BEGIN_EXCEPTION + slog = seaudit_log_create(seaudit_swig_message_callback, seaudit_swig_message_callback_arg); +@@ -291,14 +291,16 @@ typedef struct seaudit_log {} seaudit_log_t; + fail: + return slog; + }; +- ~seaudit_log_t() { ++ ~seaudit_log() { + seaudit_log_destroy(&self); + }; +- void clear () { ++ %rename(clear) wrap_clear; ++ void wrap_clear () { + seaudit_log_clear(self); + }; + %newobject get_users(); +- apol_string_vector_t *get_users() { ++ %rename(get_users) wrap_get_users; ++ apol_string_vector_t *wrap_get_users() { + apol_vector_t *v; + BEGIN_EXCEPTION + v = seaudit_log_get_users(self); +@@ -310,7 +312,8 @@ typedef struct seaudit_log {} seaudit_log_t; + return (apol_string_vector_t*)v; + }; + %newobject get_roles(); +- apol_string_vector_t *get_roles() { ++ %rename(get_roles) wrap_get_roles; ++ apol_string_vector_t *wrap_get_roles() { + apol_vector_t *v; + BEGIN_EXCEPTION + v = seaudit_log_get_roles(self); +@@ -322,7 +325,8 @@ typedef struct seaudit_log {} seaudit_log_t; + return (apol_string_vector_t*)v; + }; + %newobject get_types(); +- apol_string_vector_t *get_types() { ++ %rename(get_types) wrap_get_types; ++ apol_string_vector_t *wrap_get_types() { + apol_vector_t *v; + BEGIN_EXCEPTION + v = seaudit_log_get_types(self); +@@ -334,7 +338,8 @@ typedef struct seaudit_log {} seaudit_log_t; + return (apol_string_vector_t*)v; + }; + %newobject get_classes(); +- apol_string_vector_t *get_classes() { ++ %rename(get_classes) wrap_get_classes; ++ apol_string_vector_t *wrap_get_classes() { + apol_vector_t *v; + BEGIN_EXCEPTION + v = seaudit_log_get_classes(self); +@@ -357,14 +362,14 @@ typedef enum seaudit_message_type + } seaudit_message_type_e; + typedef struct seaudit_message {} seaudit_message_t; + %extend seaudit_message_t { +- seaudit_message_t() { ++ seaudit_message() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Canot directly create seaudit_message_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~seaudit_message_t() { ++ ~seaudit_message() { + /* no op */ + return; + }; +@@ -373,18 +378,22 @@ typedef struct seaudit_message {} seaudit_message_t; + (void)seaudit_message_get_data(self, &te); + return te; + }; +- void *get_data() { ++ %rename(get_data) wrap_get_data; ++ void *wrap_get_data() { + seaudit_message_type_e te; + return seaudit_message_get_data(self, &te); + }; +- const char *get_host() { ++ %rename(get_host) wrap_get_host; ++ const char *wrap_get_host() { + return seaudit_message_get_host(self); + }; +- const tm_t *get_time() { ++ %rename(get_time) wrap_get_time; ++ const tm_t *wrap_get_time() { + return seaudit_message_get_time(self); + } + %newobject to_string(); +- char *to_string() { ++ %rename(to_string) wrap_to_string; ++ char *wrap_to_string() { + char *str; + BEGIN_EXCEPTION + str = seaudit_message_to_string(self); +@@ -396,7 +405,8 @@ typedef struct seaudit_message {} seaudit_message_t; + return str; + }; + %newobject to_string_html(); +- char *to_string_html() { ++ %rename(to_string_html) wrap_to_string_html; ++ char *wrap_to_string_html() { + char *str; + BEGIN_EXCEPTION + str = seaudit_message_to_string_html(self); +@@ -408,7 +418,8 @@ typedef struct seaudit_message {} seaudit_message_t; + return str; + }; + %newobject to_misc_string(); +- char *to_misc_string() { ++ %rename(to_misc_string) wrap_to_misc_string; ++ char *wrap_to_misc_string() { + char *str; + BEGIN_EXCEPTION + str = seaudit_message_to_misc_string(self); +@@ -429,14 +440,14 @@ typedef struct seaudit_message {} seaudit_message_t; + /* seaudit load message */ + typedef struct seaudit_load_message {} seaudit_load_message_t; + %extend seaudit_load_message_t { +- seaudit_load_message_t() { ++ seaudit_load_message() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create seaudit_load_message_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~seaudit_load_message_t() { ++ ~seaudit_load_message() { + /* no op */ + return; + }; +@@ -450,14 +461,14 @@ typedef struct seaudit_load_message {} seaudit_load_message_t; + /* seaudit bool message */ + typedef struct seaudit_bool_message {} seaudit_bool_message_t; + %extend seaudit_bool_message_t { +- seaudit_bool_message_t(void *msg) { ++ seaudit_bool_message(void *msg) { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create seaudit_bool_message_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~seaudit_bool_message_t() { ++ ~seaudit_bool_message() { + /* no op */ + return; + }; +@@ -477,102 +488,131 @@ typedef enum seaudit_avc_message_type + } seaudit_avc_message_type_e; + typedef struct seaudit_avc_message {} seaudit_avc_message_t; + %extend seaudit_avc_message_t { +- seaudit_avc_message_t() { ++ seaudit_avc_message() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create seaudit_avc_message_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- ~seaudit_avc_message_t() { ++ ~seaudit_avc_message() { + /* no op */ + return; + }; +- seaudit_avc_message_type_e get_message_type() { ++ %rename(get_message_type) wrap_get_message_type; ++ seaudit_avc_message_type_e wrap_get_message_type() { + return seaudit_avc_message_get_message_type(self); + }; +- long get_timestamp_nano() { ++ %rename(get_timestamp_nano) wrap_get_timestamp_nano; ++ long wrap_get_timestamp_nano() { + return seaudit_avc_message_get_timestamp_nano(self); + }; +- const char *get_source_user() { ++ %rename(get_source_user) wrap_get_source_user; ++ const char *wrap_get_source_user() { + return seaudit_avc_message_get_source_user(self); + }; +- const char *get_source_role() { ++ %rename(get_source_role) wrap_get_source_role; ++ const char *wrap_get_source_role() { + return seaudit_avc_message_get_source_role(self); + }; +- const char *get_source_type() { ++ %rename(get_source_type) wrap_get_source_type; ++ const char *wrap_get_source_type() { + return seaudit_avc_message_get_source_type(self); + }; +- const char *get_target_user() { ++ %rename(get_target_user) wrap_get_target_user; ++ const char *wrap_get_target_user() { + return seaudit_avc_message_get_target_user(self); + }; +- const char *get_target_role() { ++ %rename(get_target_role) wrap_get_target_role; ++ const char *wrap_get_target_role() { + return seaudit_avc_message_get_target_role(self); + }; +- const char *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const char *wrap_get_target_type() { + return seaudit_avc_message_get_target_type(self); + }; +- const char *get_object_class() { ++ %rename(get_object_class) wrap_get_object_class; ++ const char *wrap_get_object_class() { + return seaudit_avc_message_get_object_class(self); + }; +- const apol_string_vector_t *get_perm() { ++ %rename(get_perm) wrap_get_perm; ++ const apol_string_vector_t *wrap_get_perm() { + return (apol_string_vector_t*)seaudit_avc_message_get_perm(self); + }; +- const char *get_exe() { ++ %rename(get_exe) wrap_get_exe; ++ const char *wrap_get_exe() { + return seaudit_avc_message_get_exe(self); + }; +- const char *get_comm() { ++ %rename(get_comm) wrap_get_comm; ++ const char *wrap_get_comm() { + return seaudit_avc_message_get_comm(self); + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return seaudit_avc_message_get_name(self); + }; +- int get_pid() { ++ %rename(get_pid) wrap_get_pid; ++ int wrap_get_pid() { + return (int)seaudit_avc_message_get_pid(self); + }; +- long get_inode() { ++ %rename(get_inode) wrap_get_inode; ++ long wrap_get_inode() { + return (long)seaudit_avc_message_get_inode(self); + }; +- const char *get_path() { ++ %rename(get_path) wrap_get_path; ++ const char *wrap_get_path() { + return seaudit_avc_message_get_path(self); + }; +- const char *get_dev() { ++ %rename(get_dev) wrap_get_dev; ++ const char *wrap_get_dev() { + return seaudit_avc_message_get_dev(self); + }; +- const char *get_netif() { ++ %rename(get_netif) wrap_get_netif; ++ const char *wrap_get_netif() { + return seaudit_avc_message_get_netif(self); + }; +- int get_port() { ++ %rename(get_port) wrap_get_port; ++ int wrap_get_port() { + return seaudit_avc_message_get_port(self); + }; +- const char *get_laddr() { ++ %rename(get_laddr) wrap_get_laddr; ++ const char *wrap_get_laddr() { + return seaudit_avc_message_get_laddr(self); + }; +- int get_lport() { ++ %rename(get_lport) wrap_get_lport; ++ int wrap_get_lport() { + return seaudit_avc_message_get_lport(self); + }; +- const char *get_faddr() { ++ %rename(get_faddr) wrap_get_faddr; ++ const char *wrap_get_faddr() { + return seaudit_avc_message_get_faddr(self); + }; +- int get_fport() { ++ %rename(get_fport) wrap_get_fport; ++ int wrap_get_fport() { + return seaudit_avc_message_get_fport(self); + }; +- const char *get_saddr() { ++ %rename(get_saddr) wrap_get_saddr; ++ const char *wrap_get_saddr() { + return seaudit_avc_message_get_saddr(self); + }; +- int get_sport() { ++ %rename(get_sport) wrap_get_sport; ++ int wrap_get_sport() { + return seaudit_avc_message_get_sport(self); + }; +- const char *get_daddr() { ++ %rename(get_daddr) wrap_get_daddr; ++ const char *wrap_get_daddr() { + return seaudit_avc_message_get_daddr(self); + }; +- int get_dport() { ++ %rename(get_dport) wrap_get_dport; ++ int wrap_get_dport() { + return seaudit_avc_message_get_dport(self); + }; +- int get_key() { ++ %rename(get_key) wrap_get_key; ++ int wrap_get_key() { + return seaudit_avc_message_get_key(self); + }; +- int get_cap() { ++ %rename(get_cap) wrap_get_cap; ++ int wrap_get_cap() { + return seaudit_avc_message_get_cap(self); + }; + }; +@@ -608,7 +648,7 @@ typedef enum seaudit_filter_date_match + } seaudit_filter_date_match_e; + typedef struct seaudit_filter {} seaudit_filter_t; + %extend seaudit_filter_t { +- seaudit_filter_t(char *name = NULL) { ++ seaudit_filter(char *name = NULL) { + seaudit_filter_t *sf = NULL; + BEGIN_EXCEPTION + sf = seaudit_filter_create(name); +@@ -619,7 +659,7 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return sf; + }; +- seaudit_filter_t(seaudit_filter_t *in) { ++ seaudit_filter(seaudit_filter_t *in) { + seaudit_filter_t *sf = NULL; + BEGIN_EXCEPTION + sf = seaudit_filter_create_from_filter(in); +@@ -630,7 +670,7 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return sf; + }; +- ~seaudit_filter_t() { ++ ~seaudit_filter() { + seaudit_filter_destroy(&self); + }; + void save(char *path) { +@@ -642,7 +682,8 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- void set_match(seaudit_filter_match_e match) { ++ %rename(set_match) wrap_set_match; ++ void wrap_set_match(seaudit_filter_match_e match) { + BEGIN_EXCEPTION + if (seaudit_filter_set_match(self, match)) { + SWIG_exception(SWIG_RuntimeError, "Could not set filter matching method"); +@@ -651,10 +692,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + } +- seaudit_filter_match_e get_match() { ++ %rename(get_match) wrap_get_match; ++ seaudit_filter_match_e wrap_get_match() { + return seaudit_filter_get_match(self); + }; +- void set_name(char *name) { ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_name(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set filter name"); +@@ -663,10 +706,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return seaudit_filter_get_name(self); + }; +- void set_description(char *description) { ++ %rename(set_description) wrap_set_description; ++ void wrap_set_description(char *description) { + BEGIN_EXCEPTION + if (seaudit_filter_set_description(self, description)) { + SWIG_exception(SWIG_RuntimeError, "Could not set filter description"); +@@ -675,16 +720,20 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_description() { ++ %rename(get_description) wrap_get_description; ++ const char *wrap_get_description() { + return seaudit_filter_get_description(self); + }; +- void set_strict(bool is_strict) { ++ %rename(set_strict) wrap_set_strict; ++ void wrap_set_strict(bool is_strict) { + seaudit_filter_set_strict(self, is_strict); + }; +- bool get_strict() { ++ %rename(get_strict) wrap_get_strict; ++ bool wrap_get_strict() { + return seaudit_filter_get_strict(self); + }; +- void set_source_user(apol_string_vector_t *v) { ++ %rename(set_source_user) wrap_set_source_user; ++ void wrap_set_source_user(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_source_user(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source user list for filter"); +@@ -693,10 +742,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_source_user() { ++ %rename(get_source_user) wrap_get_source_user; ++ const apol_string_vector_t *wrap_get_source_user() { + return (apol_string_vector_t*)seaudit_filter_get_source_user(self); + }; +- void set_source_role(apol_string_vector_t *v) { ++ %rename(set_source_role) wrap_set_source_role; ++ void wrap_set_source_role(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_source_role(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source role list for filter"); +@@ -705,10 +756,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_source_role() { ++ %rename(get_source_role) wrap_get_source_role; ++ const apol_string_vector_t *wrap_get_source_role() { + return (apol_string_vector_t*)seaudit_filter_get_source_role(self); + }; +- void set_source_type(apol_string_vector_t *v) { ++ %rename(set_source_type) wrap_set_source_type; ++ void wrap_set_source_type(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_source_type(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source type list for filter"); +@@ -717,10 +770,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_source_type() { ++ %rename(get_source_type) wrap_get_source_type; ++ const apol_string_vector_t *wrap_get_source_type() { + return (apol_string_vector_t*)seaudit_filter_get_source_type(self); + }; +- void set_target_user(apol_string_vector_t *v) { ++ %rename(set_target_user) wrap_set_target_user; ++ void wrap_set_target_user(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_target_user(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target user list for filter"); +@@ -729,10 +784,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_target_user() { ++ %rename(get_target_user) wrap_get_target_user; ++ const apol_string_vector_t *wrap_get_target_user() { + return (apol_string_vector_t*)seaudit_filter_get_target_user(self); + }; +- void set_target_role(apol_string_vector_t *v) { ++ %rename(set_target_role) wrap_set_target_role; ++ void wrap_set_target_role(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_target_role(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target role list for filter"); +@@ -741,10 +798,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_target_role() { ++ %rename(get_target_role) wrap_get_target_role; ++ const apol_string_vector_t *wrap_get_target_role() { + return (apol_string_vector_t*)seaudit_filter_get_target_role(self); + }; +- void set_target_type(apol_string_vector_t *v) { ++ %rename(set_target_type) wrap_set_target_type; ++ void wrap_set_target_type(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_target_type(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target type list for filter"); +@@ -753,10 +812,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_target_type() { ++ %rename(get_target_type) wrap_get_target_type; ++ const apol_string_vector_t *wrap_get_target_type() { + return (apol_string_vector_t*)seaudit_filter_get_target_type(self); + }; +- void set_target_class(apol_string_vector_t *v) { ++ %rename(set_target_class) wrap_set_target_class; ++ void wrap_set_target_class(apol_string_vector_t *v) { + BEGIN_EXCEPTION + if (seaudit_filter_set_target_class(self, (apol_vector_t*)v)) { + SWIG_exception(SWIG_RuntimeError, "Could not set target class list for filter"); +@@ -765,10 +826,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const apol_string_vector_t *get_target_class() { ++ %rename(get_target_class) wrap_get_target_class; ++ const apol_string_vector_t *wrap_get_target_class() { + return (apol_string_vector_t*)seaudit_filter_get_target_class(self); + }; +- void set_permission(char *name) { ++ %rename(set_permission) wrap_set_permission; ++ void wrap_set_permission(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_permission(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set permission for filter"); +@@ -777,10 +840,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_permission() { ++ %rename(get_permission) wrap_get_permission; ++ const char *wrap_get_permission() { + return seaudit_filter_get_permission(self); + }; +- void set_executable(char *name) { ++ %rename(set_executable) wrap_set_executable; ++ void wrap_set_executable(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_executable(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set executable for filter"); +@@ -789,10 +854,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_executable() { ++ %rename(get_executable) wrap_get_executable; ++ const char *wrap_get_executable() { + return seaudit_filter_get_executable(self); + }; +- void set_host(char *name) { ++ %rename(set_host) wrap_set_host; ++ void wrap_set_host(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_host(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set host for filter"); +@@ -801,10 +868,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_host() { ++ %rename(get_host) wrap_get_host; ++ const char *wrap_get_host() { + return seaudit_filter_get_host(self); + }; +- void set_path(char *path) { ++ %rename(set_path) wrap_set_path; ++ void wrap_set_path(char *path) { + BEGIN_EXCEPTION + if (seaudit_filter_set_path(self, path)) { + SWIG_exception(SWIG_RuntimeError, "Could not set path for filter"); +@@ -813,10 +882,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_path() { ++ %rename(get_path) wrap_get_path; ++ const char *wrap_get_path() { + return seaudit_filter_get_path(self); + }; +- void set_command(char *name) { ++ %rename(set_command) wrap_set_command; ++ void wrap_set_command(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_command(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set command for filter"); +@@ -825,22 +896,28 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- void set_inode(long inode) { ++ %rename(set_inode) wrap_set_inode; ++ void wrap_set_inode(long inode) { + seaudit_filter_set_inode(self, (long) inode); + }; +- long get_inode() { ++ %rename(get_inode) wrap_get_inode; ++ long wrap_get_inode() { + return (long) seaudit_filter_get_inode(self); + }; +- void set_pid(long pid) { ++ %rename(set_pid) wrap_set_pid; ++ void wrap_set_pid(long pid) { + seaudit_filter_set_pid(self, (unsigned int) pid); + }; +- long get_pid() { ++ %rename(get_pid) wrap_get_pid; ++ long wrap_get_pid() { + return (long) seaudit_filter_get_pid(self); + }; +- const char *get_command() { ++ %rename(get_command) wrap_get_command; ++ const char *wrap_get_command() { + return seaudit_filter_get_command(self); + }; +- void set_anyaddr(char *name) { ++ %rename(set_anyaddr) wrap_set_anyaddr; ++ void wrap_set_anyaddr(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_anyaddr(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set ip address for filter"); +@@ -849,16 +926,20 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_anyaddr() { ++ %rename(get_anyaddr) wrap_get_anyaddr; ++ const char *wrap_get_anyaddr() { + return seaudit_filter_get_anyaddr(self); + }; +- void set_anyport(int port) { ++ %rename(set_anyport) wrap_set_anyport; ++ void wrap_set_anyport(int port) { + seaudit_filter_set_anyport(self, port); + }; +- int get_anyport() { ++ %rename(get_anyport) wrap_get_anyport; ++ int wrap_get_anyport() { + return seaudit_filter_get_anyport(self); + }; +- void set_laddr(char *name) { ++ %rename(set_laddr) wrap_set_laddr; ++ void wrap_set_laddr(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_laddr(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set local address for filter"); +@@ -867,16 +948,20 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_laddr() { ++ %rename(get_laddr) wrap_get_laddr; ++ const char *wrap_get_laddr() { + return seaudit_filter_get_laddr(self); + }; +- void set_lport(int port) { ++ %rename(set_lport) wrap_set_lport; ++ void wrap_set_lport(int port) { + seaudit_filter_set_lport(self, port); + }; +- int get_lport() { ++ %rename(get_lport) wrap_get_lport; ++ int wrap_get_lport() { + return seaudit_filter_get_lport(self); + }; +- void set_faddr(char *name) { ++ %rename(set_faddr) wrap_set_faddr; ++ void wrap_set_faddr(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_faddr(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set foreign address for filter"); +@@ -885,16 +970,20 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_faddr() { ++ %rename(get_faddr) wrap_get_faddr; ++ const char *wrap_get_faddr() { + return seaudit_filter_get_faddr(self); + }; +- void set_fport(int port) { ++ %rename(set_fport) wrap_set_fport; ++ void wrap_set_fport(int port) { + seaudit_filter_set_fport(self, port); + }; +- int get_fport() { ++ %rename(get_fport) wrap_get_fport; ++ int wrap_get_fport() { + return seaudit_filter_get_fport(self); + }; +- void set_saddr(char *name) { ++ %rename(set_saddr) wrap_set_saddr; ++ void wrap_set_saddr(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_saddr(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set source address for filter"); +@@ -903,16 +992,20 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_saddr() { ++ %rename(get_saddr) wrap_get_saddr; ++ const char *wrap_get_saddr() { + return seaudit_filter_get_saddr(self); + }; +- void set_sport(int port) { ++ %rename(set_sport) wrap_set_sport; ++ void wrap_set_sport(int port) { + seaudit_filter_set_sport(self, port); + }; +- int get_sport() { ++ %rename(get_sport) wrap_get_sport; ++ int wrap_get_sport() { + return seaudit_filter_get_sport(self); + }; +- void set_daddr(char *name) { ++ %rename(set_daddr) wrap_set_daddr; ++ void wrap_set_daddr(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_daddr(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set destination address for filter"); +@@ -921,22 +1014,28 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_daddr() { ++ %rename(get_daddr) wrap_get_daddr; ++ const char *wrap_get_daddr() { + return seaudit_filter_get_daddr(self); + }; +- void set_dport(int port) { ++ %rename(set_dport) wrap_set_dport; ++ void wrap_set_dport(int port) { + seaudit_filter_set_dport(self, port); + }; +- int get_dport() { ++ %rename(get_dport) wrap_get_dport; ++ int wrap_get_dport() { + return seaudit_filter_get_dport(self); + }; +- void set_port(int port) { ++ %rename(set_port) wrap_set_port; ++ void wrap_set_port(int port) { + seaudit_filter_set_port(self, port); + }; +- int get_port() { ++ %rename(get_port) wrap_get_port; ++ int wrap_get_port() { + return seaudit_filter_get_port(self); + }; +- void set_netif(char *name) { ++ %rename(set_netif) wrap_set_netif; ++ void wrap_set_netif(char *name) { + BEGIN_EXCEPTION + if (seaudit_filter_set_netif(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set network interface for filter"); +@@ -945,22 +1044,28 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- const char *get_netif() { ++ %rename(get_netif) wrap_get_netif; ++ const char *wrap_get_netif() { + return seaudit_filter_get_netif(self); + }; +- void set_key(int key) { ++ %rename(set_key) wrap_set_key; ++ void wrap_set_key(int key) { + seaudit_filter_set_key(self, key); + }; +- int get_key() { ++ %rename(get_key) wrap_get_key; ++ int wrap_get_key() { + return seaudit_filter_get_key(self); + }; +- void set_cap(int cap) { ++ %rename(set_cap) wrap_set_cap; ++ void wrap_set_cap(int cap) { + seaudit_filter_set_cap(self, cap); + }; +- int get_cap() { ++ %rename(get_cap) wrap_get_cap; ++ int wrap_get_cap() { + return seaudit_filter_get_cap(self); + }; +- void set_message_type(seaudit_avc_message_type_e mtype) { ++ %rename(set_message_type) wrap_set_message_type; ++ void wrap_set_message_type(seaudit_avc_message_type_e mtype) { + BEGIN_EXCEPTION + if (seaudit_filter_set_message_type(self, mtype)) { + SWIG_exception(SWIG_RuntimeError, "Could not set message type for filter"); +@@ -969,10 +1074,12 @@ typedef struct seaudit_filter {} seaudit_filter_t; + fail: + return; + }; +- seaudit_message_type_e get_message_type() { ++ %rename(get_message_type) wrap_get_message_type; ++ seaudit_message_type_e wrap_get_message_type() { + return seaudit_filter_get_message_type(self); + }; +- void set_date(struct tm *start, struct tm *end, seaudit_filter_date_match_e match) { ++ %rename(set_date) wrap_set_date; ++ void wrap_set_date(struct tm *start, struct tm *end, seaudit_filter_date_match_e match) { + BEGIN_EXCEPTION + if (seaudit_filter_set_date(self, start, end, match)) { + SWIG_exception(SWIG_RuntimeError, "Could not set date for filter"); +@@ -1014,14 +1121,14 @@ apol_vector_t *seaudit_filter_create_from_file(const char *filename); + /* seaudit sort */ + typedef struct seaudit_sort {} seaudit_sort_t; + %extend seaudit_sort_t { +- seaudit_sort_t() { ++ seaudit_sort() { + BEGIN_EXCEPTION + SWIG_exception(SWIG_RuntimeError, "Cannot directly create seaudit_sort_t objects"); + END_EXCEPTION + fail: + return NULL; + }; +- seaudit_sort_t(seaudit_sort_t *in) { ++ seaudit_sort(seaudit_sort_t *in) { + seaudit_sort_t *ss = NULL; + BEGIN_EXCEPTION + ss = seaudit_sort_create_from_sort(in); +@@ -1032,7 +1139,7 @@ typedef struct seaudit_sort {} seaudit_sort_t; + fail: + return ss; + }; +- ~seaudit_sort_t() { ++ ~seaudit_sort() { + seaudit_sort_destroy(&self); + }; + }; +@@ -1113,7 +1220,7 @@ extern seaudit_sort_t *seaudit_sort_by_cap(const int direction); + #endif + typedef struct seaudit_model {} seaudit_model_t; + %extend seaudit_model_t { +- seaudit_model_t(char *name = NULL, seaudit_log_t *slog = NULL) { ++ seaudit_model(char *name = NULL, seaudit_log_t *slog = NULL) { + seaudit_model_t *smod; + BEGIN_EXCEPTION + smod = seaudit_model_create(name, slog); +@@ -1124,7 +1231,7 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return smod; + }; +- seaudit_model_t(seaudit_model_t *in) { ++ seaudit_model(seaudit_model_t *in) { + seaudit_model_t *smod; + BEGIN_EXCEPTION + smod = seaudit_model_create_from_model(in); +@@ -1135,7 +1242,7 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return smod; + }; +- seaudit_model_t(char *path) { ++ seaudit_model(char *path) { + seaudit_model_t *smod; + BEGIN_EXCEPTION + smod = seaudit_model_create_from_file(path); +@@ -1146,7 +1253,7 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return smod; + } +- ~seaudit_model_t() { ++ ~seaudit_model() { + seaudit_model_destroy(&self); + }; + void save(char *path) { +@@ -1158,10 +1265,12 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + } +- const char *get_name() { ++ %rename(get_name) wrap_get_name; ++ const char *wrap_get_name() { + return seaudit_model_get_name(self); + }; +- void set_name(char *name) { ++ %rename(set_name) wrap_set_name; ++ void wrap_set_name(char *name) { + BEGIN_EXCEPTION + if (seaudit_model_set_name(self, name)) { + SWIG_exception(SWIG_RuntimeError, "Could not set model name"); +@@ -1170,7 +1279,8 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- void append_log(seaudit_log_t *slog) { ++ %rename(append_log) wrap_append_log; ++ void wrap_append_log(seaudit_log_t *slog) { + BEGIN_EXCEPTION + if (seaudit_model_append_log(self, slog)) { + SWIG_exception(SWIG_RuntimeError, "Could not append log to model"); +@@ -1179,7 +1289,8 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- void append_filter(seaudit_filter_t *filter) { ++ %rename(append_filter) wrap_append_filter; ++ void wrap_append_filter(seaudit_filter_t *filter) { + BEGIN_EXCEPTION + #ifdef SWIGJAVA /* duplicate so the garbage collector does not double free */ + seaudit_filter_t *tmp = seaudit_filter_create_from_filter(filter); +@@ -1196,11 +1307,13 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- const apol_vector_t *get_filters() { ++ %rename(get_filters) wrap_get_filters; ++ const apol_vector_t *wrap_get_filters() { + return seaudit_model_get_filters(self); + }; + %delobject remove_filter(); +- void remove_filter(seaudit_filter_t *filter) { ++ %rename(remove_filter) wrap_remove_filter; ++ void wrap_remove_filter(seaudit_filter_t *filter) { + BEGIN_EXCEPTION + if (seaudit_model_remove_filter(self, filter)) { + SWIG_exception(SWIG_ValueError, "Could not remove filter"); +@@ -1209,7 +1322,8 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- void set_filter_match(seaudit_filter_match_e match) { ++ %rename(set_filter_match) wrap_set_filter_match; ++ void wrap_set_filter_match(seaudit_filter_match_e match) { + BEGIN_EXCEPTION + if (seaudit_model_set_filter_match(self, match)) { + SWIG_exception(SWIG_RuntimeError, "Could not set filter matching method for model"); +@@ -1218,10 +1332,12 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- seaudit_filter_match_e get_filter_match() { ++ %rename(get_filter_match) wrap_get_filter_match; ++ seaudit_filter_match_e wrap_get_filter_match() { + return seaudit_model_get_filter_match(self); + }; +- void set_filter_visible(seaudit_filter_visible_e vis) { ++ %rename(set_filter_visible) wrap_set_filter_visible; ++ void wrap_set_filter_visible(seaudit_filter_visible_e vis) { + BEGIN_EXCEPTION + if (seaudit_model_set_filter_visible(self, vis)) { + SWIG_exception(SWIG_RuntimeError, "Could not set filter visibility for model"); +@@ -1230,10 +1346,12 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- seaudit_filter_visible_e get_filter_visible() { ++ %rename(get_filter_visible) wrap_get_filter_visible; ++ seaudit_filter_visible_e wrap_get_filter_visible() { + return seaudit_model_get_filter_visible(self); + }; +- void append_sort(seaudit_sort_t *ssort) { ++ %rename(append_sort) wrap_append_sort; ++ void wrap_append_sort(seaudit_sort_t *ssort) { + BEGIN_EXCEPTION + #ifdef SWIGJAVA + seaudit_sort_t *tmp = seaudit_sort_create_from_sort(ssort); +@@ -1250,7 +1368,8 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- void clear_sorts() { ++ %rename(clear_sorts) wrap_clear_sorts; ++ void wrap_clear_sorts() { + BEGIN_EXCEPTION + if (seaudit_model_clear_sorts(self)) { + SWIG_exception(SWIG_RuntimeError, "Could not clear model sorting criteria"); +@@ -1259,11 +1378,13 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return; + }; +- int is_changed() { ++ %rename(is_changed) wrap_is_changed; ++ int wrap_is_changed() { + return seaudit_model_is_changed(self); + }; + %newobject get_messages(seaudit_log_t*); +- apol_vector_t *get_messages(seaudit_log_t *slog) { ++ %rename(get_messages) wrap_get_messages; ++ apol_vector_t *wrap_get_messages(seaudit_log_t *slog) { + apol_vector_t *v = NULL; + BEGIN_EXCEPTION + v = seaudit_model_get_messages(slog, self); +@@ -1275,7 +1396,8 @@ typedef struct seaudit_model {} seaudit_model_t; + return v; + }; + %newobject get_malformed_messages(seaudit_log_t*); +- apol_vector_t *get_malformed_messages(seaudit_log_t *slog) { ++ %rename(get_malformed_messages) wrap_get_malformed_messages; ++ apol_vector_t *wrap_get_malformed_messages(seaudit_log_t *slog) { + apol_vector_t *v = NULL; + BEGIN_EXCEPTION + v = seaudit_model_get_malformed_messages(slog, self); +@@ -1286,19 +1408,24 @@ typedef struct seaudit_model {} seaudit_model_t; + fail: + return v; + }; +- void hide_message(seaudit_message_t *message) { ++ %rename(hide_message) wrap_hide_message; ++ void wrap_hide_message(seaudit_message_t *message) { + seaudit_model_hide_message(self, message); + }; +- size_t get_num_allows(seaudit_log_t *slog) { ++ %rename(get_num_allows) wrap_get_num_allows; ++ size_t wrap_get_num_allows(seaudit_log_t *slog) { + return seaudit_model_get_num_allows(slog, self); + }; +- size_t get_num_denies(seaudit_log_t *slog) { ++ %rename(get_num_denies) wrap_get_num_denies; ++ size_t wrap_get_num_denies(seaudit_log_t *slog) { + return seaudit_model_get_num_denies(slog, self); + }; +- size_t get_num_bools(seaudit_log_t *slog) { ++ %rename(get_num_bools) wrap_get_num_bools; ++ size_t wrap_get_num_bools(seaudit_log_t *slog) { + return seaudit_model_get_num_bools(slog, self); + }; +- size_t get_num_loads(seaudit_log_t *slog) { ++ %rename(get_num_loads) wrap_get_num_loads; ++ size_t wrap_get_num_loads(seaudit_log_t *slog) { + return seaudit_model_get_num_loads(slog, self); + }; + }; +@@ -1311,7 +1438,7 @@ typedef enum seaudit_report_format + } seaudit_report_format_e; + typedef struct seaudit_report {} seaudit_report_t; + %extend seaudit_report_t { +- seaudit_report_t(seaudit_model_t *m) { ++ seaudit_report(seaudit_model_t *m) { + seaudit_report_t *sr; + BEGIN_EXCEPTION + sr = seaudit_report_create(m); +@@ -1322,10 +1449,11 @@ typedef struct seaudit_report {} seaudit_report_t; + fail: + return sr; + }; +- ~seaudit_report_t() { ++ ~seaudit_report() { + seaudit_report_destroy(&self); + }; +- void write(seaudit_log_t *slog, char *path) { ++ %rename(write) wrap_write; ++ void wrap_write(seaudit_log_t *slog, char *path) { + BEGIN_EXCEPTION + if (seaudit_report_write(slog, self, path)) { + SWIG_exception(SWIG_RuntimeError, "Could not write report to file"); +@@ -1334,7 +1462,8 @@ typedef struct seaudit_report {} seaudit_report_t; + fail: + return; + }; +- void set_format(seaudit_log_t *slog, seaudit_report_format_e format) { ++ %rename(set_format) wrap_set_format; ++ void wrap_set_format(seaudit_log_t *slog, seaudit_report_format_e format) { + BEGIN_EXCEPTION + if (seaudit_report_set_format(slog, self, format)) { + SWIG_exception(SWIG_RuntimeError, "Could not set report format"); +@@ -1343,7 +1472,8 @@ typedef struct seaudit_report {} seaudit_report_t; + fail: + return; + }; +- void set_configuration(seaudit_log_t *slog, char *path) { ++ %rename(set_configuration) wrap_set_configuration; ++ void wrap_set_configuration(seaudit_log_t *slog, char *path) { + BEGIN_EXCEPTION + if (seaudit_report_set_configuration(slog, self, path)) { + SWIG_exception(SWIG_RuntimeError, "Could not set report configuration file"); +@@ -1352,7 +1482,8 @@ typedef struct seaudit_report {} seaudit_report_t; + fail: + return; + }; +- void set_stylesheet(seaudit_log_t *slog, char *path, int use_stylesheet) { ++ %rename(set_stylesheet) wrap_set_stylesheet; ++ void wrap_set_stylesheet(seaudit_log_t *slog, char *path, int use_stylesheet) { + BEGIN_EXCEPTION + if (seaudit_report_set_stylesheet(slog, self, path, use_stylesheet)) { + SWIG_exception(SWIG_RuntimeError, "Could not set report stylesheet"); +@@ -1361,7 +1492,8 @@ typedef struct seaudit_report {} seaudit_report_t; + fail: + return; + }; +- void set_malformed(seaudit_log_t *slog, int do_malformed) { ++ %rename(set_malformed) wrap_set_malformed; ++ void wrap_set_malformed(seaudit_log_t *slog, int do_malformed) { + BEGIN_EXCEPTION + if (seaudit_report_set_malformed(slog, self, do_malformed)) { + SWIG_exception(SWIG_RuntimeError, "Could not set report malformed flag"); +diff --git a/libsefs/src/db.cc b/libsefs/src/db.cc +index 88ad588..191d796 100644 +--- a/libsefs/src/db.cc ++++ b/libsefs/src/db.cc +@@ -479,8 +479,13 @@ int db_create_from_filesystem(sefs_fclist * fclist __attribute__ ((unused)), con + struct stat64 sb; + if (stat64(path, &sb) == -1) + { +- SEFS_ERR(dbc->_db, "%s", strerror(errno)); +- throw std::bad_alloc(); ++ /* If sym link broken/file not found, then ignore as this will allow ++ the index to be built. Useful when investigating broken systems. ++ Also see new_ftw.c comment regarding "lstat calls go through the ++ wrapper function" to stop index hanging on broken files. */ ++ link_target[127] = '\0'; ++ sb.st_mode = 0; ++ SEFS_WARN(dbc->_db, "Could not stat file: %s - ignoring", path); + } + if (S_ISLNK(sb.st_mode)) + { +diff --git a/libsefs/src/new_ftw.c b/libsefs/src/new_ftw.c +index 5ebaf29..10eb78f 100644 +--- a/libsefs/src/new_ftw.c ++++ b/libsefs/src/new_ftw.c +@@ -131,7 +131,11 @@ extern char *xgetcwd(void); + /* Arrange to make lstat calls go through the wrapper function + on systems with an lstat function that does not dereference symlinks + that are specified with a trailing slash. */ +-#if ! _LIBC && ! LSTAT_FOLLOWS_SLASHED_SYMLINK ++/* If this is used on Linux (Fedora) when a sym link or file is broken, ++ the file context function will hang forever: ++ #if ! _LIBC && ! LSTAT_FOLLOWS_SLASHED_SYMLINK ++ Therefore changed to this so uses Linux lstat function. */ ++#if _LIBC && ! LSTAT_FOLLOWS_SLASHED_SYMLINK + int rpl_lstat(const char *, struct stat *); + # undef lstat + # define lstat(Name, Stat_buf) rpl_lstat(Name, Stat_buf) +diff --git a/secmds/replcon.cc b/secmds/replcon.cc +index 34f7c1a..307c39f 100644 +--- a/secmds/replcon.cc ++++ b/secmds/replcon.cc +@@ -60,7 +60,7 @@ static struct option const longopts[] = { + {NULL, 0, NULL, 0} + }; + +-extern int lsetfilecon_raw(const char *, security_context_t) __attribute__ ((weak)); ++extern int lsetfilecon_raw(const char *, const char *) __attribute__ ((weak)); + + /** + * As that setools must work with older libselinux versions that may +diff --git a/sediff/progress.c b/sediff/progress.c +index efaa120..09730dc 100644 +--- a/sediff/progress.c ++++ b/sediff/progress.c +@@ -99,7 +99,7 @@ void progress_hide(progress_t * progress) + + int progress_wait(progress_t * progress) + { +- GTimeVal wait_time = { 0, 50000 }; ++ gint64 wait_time; + g_mutex_lock(progress->mutex); + while (!progress->done) { + if (progress->s != NULL) { +@@ -111,7 +111,8 @@ int progress_wait(progress_t * progress) + // still be loading, and this dialog should not block + // until the entire source has been read + gtk_main_iteration_do(FALSE); +- g_cond_timed_wait(progress->cond, progress->mutex, &wait_time); ++ wait_time = g_get_monotonic_time () + 50000; ++ g_cond_wait_until(progress->cond, progress->mutex, wait_time); + } + g_mutex_unlock(progress->mutex); + if (progress->done < 0) { diff --git a/setools.spec b/setools.spec index ceaf5f8..aad7228 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 7%{?dist} +Release: 8.99.1%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -11,6 +11,7 @@ Source: http://oss.tresys.com/projects/setools/chrome/site/dists/setools-%{versi Source1: setools.pam Source2: apol.desktop Source3: seaudit.desktop +Patch0: setools-TresysTechnology-setools3.patch Patch1: 0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch Patch2: 0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch Patch3: 0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch @@ -150,16 +151,17 @@ This package includes the following graphical tools: %prep %setup -q +%patch0 -p 1 -b .TresysTechnology-setools3 %patch1 -p 1 -b .neverallow %patch2 -p 1 -b .libsepol -%patch3 -p 1 -b .swig +# %patch3 -p 1 -b .swig %patch4 -p 1 -b .current_policy %patch5 -p 1 -b .seaudit %patch6 -p 1 -b .boolean-subs %patch7 -p 1 -b .noship %patch8 -p 1 -b .seinfo-t %patch9 -p 1 -b .sesearch-D -%patch10 -p 1 -b .wig-patch +# %patch10 -p 1 -b .wig-patch %patch11 -p 1 -b .Wformat-security %patch12 -p 1 -b .version @@ -281,6 +283,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Fri Jan 08 2016 Petr Lautrbach 3.3.8-8.99.1 +- Update to latest upstream sources from https://github.com/TresysTechnology/setools3.git + * Fri Jun 19 2015 Fedora Release Engineering - 3.3.8-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild From 300f5dde54d5d3affd7f5e0afe76c0eb01970f56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Hor=C3=A1k?= Date: Fri, 29 Jan 2016 14:01:11 +0100 Subject: [PATCH 002/111] - Add patch for libsepool 2.4 support --- 0017-update-to-libsepool-2.4-parser.patch | 101 ++++++++++++++++++++++ setools.spec | 7 +- 2 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 0017-update-to-libsepool-2.4-parser.patch diff --git a/0017-update-to-libsepool-2.4-parser.patch b/0017-update-to-libsepool-2.4-parser.patch new file mode 100644 index 0000000..bfd807a --- /dev/null +++ b/0017-update-to-libsepool-2.4-parser.patch @@ -0,0 +1,101 @@ +From 0e41755e0364df7666f286a3b6f8d663933c3149 Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Wed, 4 Feb 2015 14:34:47 -0500 +Subject: [PATCH] Update to libsepol 2.4 parser. + +There was a struct change internally. Now setools requires libsepol 2.4. +--- + README | 4 ++-- + libqpol/src/policy_define.c | 4 ++-- + libqpol/src/policy_extend.c | 4 ++-- + libqpol/src/syn_rule_query.c | 6 +++--- + 4 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/README b/README +index 04b159b..c08d786 100644 +--- a/README ++++ b/README +@@ -71,8 +71,8 @@ compilation: + bison + pkg-config 0.23 or greater + libselinux 2.0.87 or greater +- libsepol 2.0.38 or greater +- libsepol-static 2.0.38 or greater ++ libsepol 2.4 or greater ++ libsepol-static 2.4 or greater + libxml2 + sqlite 3.6.20 or greater + +diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c +index fad6b60..231962f 100644 +--- a/libqpol/src/policy_define.c ++++ b/libqpol/src/policy_define.c +@@ -1449,7 +1449,7 @@ int define_compute_type_helper(int which, avrule_t ** rule) + return -1; + } + class_perm_node_init(perm); +- perm->class = i + 1; ++ perm->tclass = i + 1; + perm->data = datum->s.value; + perm->next = avrule->perms; + avrule->perms = perm; +@@ -1699,7 +1699,7 @@ int define_te_avtab_helper(int which, avrule_t ** rule) + goto out; + } + class_perm_node_init(cur_perms); +- cur_perms->class = i + 1; ++ cur_perms->tclass = i + 1; + if (!perms) + perms = cur_perms; + if (tail) +diff --git a/libqpol/src/policy_extend.c b/libqpol/src/policy_extend.c +index 5325a87..1417271 100644 +--- a/libqpol/src/policy_extend.c ++++ b/libqpol/src/policy_extend.c +@@ -843,7 +843,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ + for (class_node = rule->perms; class_node; class_node = class_node->next) { + key.rule_type = rule->specified; + key.source_val = key.target_val = i + 1; +- key.class_val = class_node->class; ++ key.class_val = class_node->tclass; + key.cond = cond; + if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) + goto err; +@@ -856,7 +856,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ + key.rule_type = rule->specified; + key.source_val = i + 1; + key.target_val = j + 1; +- key.class_val = class_node->class; ++ key.class_val = class_node->tclass; + key.cond = cond; + if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) + goto err; +diff --git a/libqpol/src/syn_rule_query.c b/libqpol/src/syn_rule_query.c +index 3e63204..d7578f1 100644 +--- a/libqpol/src/syn_rule_query.c ++++ b/libqpol/src/syn_rule_query.c +@@ -67,7 +67,7 @@ static void *syn_rule_class_state_get_cur(const qpol_iterator_t * iter) + return NULL; + } + +- return db->class_val_to_struct[srcs->cur->class - 1]; ++ return db->class_val_to_struct[srcs->cur->tclass - 1]; + } + + static int syn_rule_class_state_next(qpol_iterator_t * iter) +@@ -465,10 +465,10 @@ int qpol_syn_avrule_get_perm_iter(const qpol_policy_t * policy, const qpol_syn_a + } + + for (node = internal_rule->perms; node; node = node->next) { +- for (i = 0; i < db->class_val_to_struct[node->class - 1]->permissions.nprim; i++) { ++ for (i = 0; i < db->class_val_to_struct[node->tclass - 1]->permissions.nprim; i++) { + if (!(node->data & (1 << i))) + continue; +- tmp = sepol_av_to_string(db, node->class, (sepol_access_vector_t) (1 << i)); ++ tmp = sepol_av_to_string(db, node->tclass, (sepol_access_vector_t) (1 << i)); + if (tmp) { + tmp++; /* remove prepended space */ + for (cur = 0; cur < perm_list_sz; cur++) +-- +1.8.3.1 + diff --git a/setools.spec b/setools.spec index ceaf5f8..94f0598 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 7%{?dist} +Release: 8%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -23,6 +23,7 @@ Patch9: 0009-Fix-help-message-on-sesearch-D.patch Patch10: 0010-Apply-swig-patch-to-make-apol-work-again.patch Patch11: 0011-Fix-Wformat-security-issues.patch Patch12: 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch +Patch17: 0017-update-to-libsepool-2.4-parser.patch Summary: Policy analysis tools for SELinux Group: System Environment/Base @@ -162,6 +163,7 @@ This package includes the following graphical tools: %patch10 -p 1 -b .wig-patch %patch11 -p 1 -b .Wformat-security %patch12 -p 1 -b .version +%patch17 -p 1 -b .libsepool24 %ifarch sparc sparcv9 sparc64 s390 s390x for file in `find . -name Makefile.am`; do @@ -281,6 +283,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Fri Sep 25 2015 David Sommerseth - 3.3.8-8 +- Add patch for libsepool 2.4 support + * Fri Jun 19 2015 Fedora Release Engineering - 3.3.8-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild From e46f55812d4bcad26f6cedb52165f2a15e6ce3ba Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 29 Jan 2016 15:01:57 +0100 Subject: [PATCH 003/111] use %global instead of %define in setools.spec --- setools.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index 94f0598..f80aaef 100644 --- a/setools.spec +++ b/setools.spec @@ -1,5 +1,5 @@ -%define setools_maj_ver 3.3 -%define setools_min_ver 8 +%global setools_maj_ver 3.3 +%global setools_min_ver 8 Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} From a4af57962c5ea137830e1b48beaa5af8e6f20d04 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 29 Jan 2016 15:24:03 +0100 Subject: [PATCH 004/111] Rebase to the latest setools3 sources Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1266520 --- .gitignore | 1 + setools.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 23cf756..eb7f628 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ setools-3.3.7.tar.bz2 setools-3.3.8.tar.bz2 +setools-3.3.8-f1e5b20.tar.bz2 diff --git a/setools.spec b/setools.spec index f80aaef..4b15b42 100644 --- a/setools.spec +++ b/setools.spec @@ -1,5 +1,6 @@ %global setools_maj_ver 3.3 %global setools_min_ver 8 +%global gitver f1e5b20 Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} @@ -7,23 +8,25 @@ Release: 8%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root -Source: http://oss.tresys.com/projects/setools/chrome/site/dists/setools-%{version}/setools-%{version}.tar.bz2 +# Source: http://oss.tresys.com/projects/setools/chrome/site/dists/setools-%{version}/setools-%{version}.tar.bz2 +# git clone https://github.com/TresysTechnology/setools3.git +# cd setools3 +# gitrev=`git rev-parse --verify --short HEAD` +# git archive --format=tar --prefix=setools-3.3.8/ HEAD | bzip2 > setools-3.3.8-$gitrev.tar.bz2 +Source: setools-%{version}-%{gitver}.tar.bz2 Source1: setools.pam Source2: apol.desktop Source3: seaudit.desktop Patch1: 0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch Patch2: 0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch -Patch3: 0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch Patch4: 0004-Apply-selinux_current_policy_path-patch.patch Patch5: 0005-Apply-seaudit-patch-for-progress.c.patch Patch6: 0006-Add-support-for-boolean-subs.patch Patch7: 0007-Setools-noship.patch Patch8: 0008-Add-alias-support-to-seinfo-t.patch Patch9: 0009-Fix-help-message-on-sesearch-D.patch -Patch10: 0010-Apply-swig-patch-to-make-apol-work-again.patch Patch11: 0011-Fix-Wformat-security-issues.patch Patch12: 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch -Patch17: 0017-update-to-libsepool-2.4-parser.patch Summary: Policy analysis tools for SELinux Group: System Environment/Base @@ -153,17 +156,14 @@ This package includes the following graphical tools: %setup -q %patch1 -p 1 -b .neverallow %patch2 -p 1 -b .libsepol -%patch3 -p 1 -b .swig %patch4 -p 1 -b .current_policy %patch5 -p 1 -b .seaudit %patch6 -p 1 -b .boolean-subs %patch7 -p 1 -b .noship %patch8 -p 1 -b .seinfo-t %patch9 -p 1 -b .sesearch-D -%patch10 -p 1 -b .wig-patch %patch11 -p 1 -b .Wformat-security %patch12 -p 1 -b .version -%patch17 -p 1 -b .libsepool24 %ifarch sparc sparcv9 sparc64 s390 s390x for file in `find . -name Makefile.am`; do @@ -283,6 +283,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Fri Jan 29 2016 Petr Lautrbach 3.3.8-8 +- Rebase to the latest setools3 sources (#1266520) + * Fri Sep 25 2015 David Sommerseth - 3.3.8-8 - Add patch for libsepool 2.4 support diff --git a/sources b/sources index 8bc4061..6b2ffc9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d68d0d4e4da0f01da0f208782ff04b91 setools-3.3.8.tar.bz2 +d262b1d4bacaa8c4890d644a03b5e73d setools-3.3.8-f1e5b20.tar.bz2 From 26a78c68baa5c827b40f69ef767d580babc1f8b4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 4 Feb 2016 23:52:58 +0000 Subject: [PATCH 005/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 4b15b42..ad297b0 100644 --- a/setools.spec +++ b/setools.spec @@ -4,7 +4,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 8%{?dist} +Release: 9%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -283,6 +283,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Thu Feb 04 2016 Fedora Release Engineering - 3.3.8-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + * Fri Jan 29 2016 Petr Lautrbach 3.3.8-8 - Rebase to the latest setools3 sources (#1266520) From a34c9ef118e04908ff8bad5bd7749c57e6e46d94 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 19 Feb 2016 11:42:00 +0100 Subject: [PATCH 006/111] libqpol: Skip types when building type attribute map Fixes: rhbz#1291336 --- ...pes-when-building-type-attribute-map.patch | 29 +++++++++++++++++++ setools.spec | 2 ++ 2 files changed, 31 insertions(+) create mode 100644 0013-libqpol-Skip-types-when-building-type-attribute-map.patch diff --git a/0013-libqpol-Skip-types-when-building-type-attribute-map.patch b/0013-libqpol-Skip-types-when-building-type-attribute-map.patch new file mode 100644 index 0000000..efdd8a9 --- /dev/null +++ b/0013-libqpol-Skip-types-when-building-type-attribute-map.patch @@ -0,0 +1,29 @@ +From f7b31b7e28a4f89bcfcd0d139cfca78777a4333e Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Thu, 4 Feb 2016 14:06:49 -0500 +Subject: [PATCH] libqpol: Skip types when building type attribute map. + +Fix originally from Richard Haines. + +Closes #94. +--- + libqpol/src/policy_extend.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/libqpol/src/policy_extend.c b/libqpol/src/policy_extend.c +index 1417271..416bddb 100644 +--- a/libqpol/src/policy_extend.c ++++ b/libqpol/src/policy_extend.c +@@ -201,6 +201,9 @@ static int qpol_policy_build_attrs_from_map(qpol_policy_t * policy) + memset(&buff, 0, 10 * sizeof(char)); + + for (i = 0; i < db->p_types.nprim; i++) { ++ /* skip types */ ++ if (db->type_val_to_struct[i]->flavor == TYPE_TYPE) ++ continue; + count = 0; + ebitmap_for_each_bit(&db->attr_type_map[i], node, bit) { + if (ebitmap_node_get_bit(node, bit)) +-- +2.5.0 + diff --git a/setools.spec b/setools.spec index ad297b0..e80868c 100644 --- a/setools.spec +++ b/setools.spec @@ -27,6 +27,7 @@ Patch8: 0008-Add-alias-support-to-seinfo-t.patch Patch9: 0009-Fix-help-message-on-sesearch-D.patch Patch11: 0011-Fix-Wformat-security-issues.patch Patch12: 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch +Patch13: 0013-libqpol-Skip-types-when-building-type-attribute-map.patch Summary: Policy analysis tools for SELinux Group: System Environment/Base @@ -164,6 +165,7 @@ This package includes the following graphical tools: %patch9 -p 1 -b .sesearch-D %patch11 -p 1 -b .Wformat-security %patch12 -p 1 -b .version +%patch13 -p 1 -b .libqpol %ifarch sparc sparcv9 sparc64 s390 s390x for file in `find . -name Makefile.am`; do From 04f559dd9df2cc4db72ab00434cb5660b20f3929 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sun, 21 Feb 2016 12:08:24 +0100 Subject: [PATCH 007/111] setools-3.3.8-10.fc24 - libqpol: Skip types when building type attribute map (#1291336) - Rebase for SELinuxProject userspace release 2016-01-07 --- setools.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index e80868c..08cc12e 100644 --- a/setools.spec +++ b/setools.spec @@ -4,7 +4,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 9%{?dist} +Release: 10%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -37,8 +37,8 @@ Requires: setools-libs = %{version}-%{release} setools-libs-tcl = %{version}-%{r %define autoconf_ver 2.59 %define bwidget_ver 1.8 %define gtk_ver 2.8 -%define sepol_ver 2.1.8-5 -%define selinux_ver 2.1.12-10 +%define sepol_ver 2.5-0 +%define selinux_ver 2.5-0 %define sqlite_ver 3.2.0 %define swig_ver 3.0.0 %define tcltk_ver 8.4.9 @@ -285,6 +285,10 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Sun Feb 21 2016 Petr Lautrbach 3.3.8-10 +- libqpol: Skip types when building type attribute map (#1291336) +- Rebase for SELinuxProject userspace release 2016-01-07 + * Thu Feb 04 2016 Fedora Release Engineering - 3.3.8-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild From 362ac1c3451cf11d61fcd25791602a52addf161b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 29 Apr 2016 17:11:39 +0200 Subject: [PATCH 008/111] setools-3.3.8-11 - Rebuilt with libsepol-2.5-5 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 08cc12e..cf65595 100644 --- a/setools.spec +++ b/setools.spec @@ -4,7 +4,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -285,6 +285,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Fri Apr 29 2016 Petr Lautrbach - 3.3.8-11 +- Rebuilt with libsepol-2.5-5 + * Sun Feb 21 2016 Petr Lautrbach 3.3.8-10 - libqpol: Skip types when building type attribute map (#1291336) - Rebase for SELinuxProject userspace release 2016-01-07 From 1299b6abea0d88387b36229f55963684ac80d4bb Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 11 May 2016 10:20:57 +0200 Subject: [PATCH 009/111] setools-3.3.8-12 - Rebuilt with libsepol-2.5-6 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index cf65595..b9edf47 100644 --- a/setools.spec +++ b/setools.spec @@ -4,7 +4,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 11%{?dist} +Release: 12%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -285,6 +285,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Wed May 11 2016 Petr Lautrbach - 3.3.8-12 +- Rebuilt with libsepol-2.5-6 + * Fri Apr 29 2016 Petr Lautrbach - 3.3.8-11 - Rebuilt with libsepol-2.5-5 From 2123a2995d888c9e80b12cb87851eaaf6777c99a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 11 Feb 2017 13:19:58 +0000 Subject: [PATCH 010/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index b9edf47..3405d9e 100644 --- a/setools.spec +++ b/setools.spec @@ -4,7 +4,7 @@ Name: setools Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv2 URL: http://oss.tresys.com/projects/setools BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -285,6 +285,9 @@ rm -rf ${RPM_BUILD_ROOT} %postun libs-tcl -p /sbin/ldconfig %changelog +* Sat Feb 11 2017 Fedora Release Engineering - 3.3.8-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + * Wed May 11 2016 Petr Lautrbach - 3.3.8-12 - Rebuilt with libsepol-2.5-6 From d5a84f04a0555ff71f93971f2e9d9fc32e25dbc0 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 15 Feb 2017 13:54:11 +0100 Subject: [PATCH 011/111] setools-4.1.0-1 - New upstream release --- .gitignore | 1 + setools.spec | 864 +++++++++------------------------------------------ sources | 2 +- 3 files changed, 148 insertions(+), 719 deletions(-) diff --git a/.gitignore b/.gitignore index eb7f628..f811d80 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ setools-3.3.7.tar.bz2 setools-3.3.8.tar.bz2 setools-3.3.8-f1e5b20.tar.bz2 +/4.1.0.tar.gz diff --git a/setools.spec b/setools.spec index 3405d9e..08904c9 100644 --- a/setools.spec +++ b/setools.spec @@ -1,126 +1,57 @@ -%global setools_maj_ver 3.3 -%global setools_min_ver 8 -%global gitver f1e5b20 +# sitelib for noarch packages, sitearch for others (remove the unneeded one) +%{!?__python2: %global __python2 %__python} +%{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} +%{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} -Name: setools -Version: %{setools_maj_ver}.%{setools_min_ver} -Release: 13%{?dist} -License: GPLv2 -URL: http://oss.tresys.com/projects/setools -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root -# Source: http://oss.tresys.com/projects/setools/chrome/site/dists/setools-%{version}/setools-%{version}.tar.bz2 -# git clone https://github.com/TresysTechnology/setools3.git -# cd setools3 -# gitrev=`git rev-parse --verify --short HEAD` -# git archive --format=tar --prefix=setools-3.3.8/ HEAD | bzip2 > setools-3.3.8-$gitrev.tar.bz2 -Source: setools-%{version}-%{gitver}.tar.bz2 -Source1: setools.pam -Source2: apol.desktop -Source3: seaudit.desktop -Patch1: 0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch -Patch2: 0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch -Patch4: 0004-Apply-selinux_current_policy_path-patch.patch -Patch5: 0005-Apply-seaudit-patch-for-progress.c.patch -Patch6: 0006-Add-support-for-boolean-subs.patch -Patch7: 0007-Setools-noship.patch -Patch8: 0008-Add-alias-support-to-seinfo-t.patch -Patch9: 0009-Fix-help-message-on-sesearch-D.patch -Patch11: 0011-Fix-Wformat-security-issues.patch -Patch12: 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch -Patch13: 0013-libqpol-Skip-types-when-building-type-attribute-map.patch +%if 0%{?fedora} +%bcond_without python3 +%else +%bcond_with python3 +%endif -Summary: Policy analysis tools for SELinux -Group: System Environment/Base -Requires: setools-libs = %{version}-%{release} setools-libs-tcl = %{version}-%{release} setools-gui = %{version}-%{release} setools-console = %{version}-%{release} +# % global setools_pre_ver beta.1.8e09d95 +# % global gitver f1e5b20 -# external requirements -%define autoconf_ver 2.59 -%define bwidget_ver 1.8 -%define gtk_ver 2.8 -%define sepol_ver 2.5-0 -%define selinux_ver 2.5-0 -%define sqlite_ver 3.2.0 -%define swig_ver 3.0.0 -%define tcltk_ver 8.4.9 +%global sepol_ver 2.6-0 +%global selinux_ver 2.6-0 + +Name: setools +Version: 4.1.0 +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Summary: Policy analysis tools for SELinux + +License: GPLv2 +URL: https://github.com/TresysTechnology/setools/wiki +Source0: https://github.com/TresysTechnology/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz +Source1: setools.pam +Source2: apol.desktop + +Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 +BuildRequires: flex, bison +BuildRequires: glibc-devel gcc +BuildRequires: libsepol-devel, libsepol-static +BuildRequires: qt5-qtbase-devel +BuildRequires: swig +BuildRequires: python-devel + +# BuildArch: +BuildRequires: python-devel +%if %{with python3} +Requires: %{name}-python3 = %{version}-%{release} +BuildRequires: python3-devel +%else +Requires: %{name}-python = %{version}-%{release} +%endif # with python3 %description SETools is a collection of graphical tools, command-line tools, and -libraries designed to facilitate SELinux policy analysis. - -This meta-package depends upon the main packages necessary to run -SETools. - -%package libs -License: LGPLv2 -Summary: Policy analysis support libraries for SELinux -Group: System Environment/Libraries -Requires: libselinux >= %{selinux_ver} libsepol >= %{sepol_ver} sqlite >= %{sqlite_ver} -Obsoletes: setools-libs-java -Obsoletes: setools-libs-python < 3.3.7-36 -BuildRequires: flex bison pkgconfig bzip2-devel -BuildRequires: glibc-devel libstdc++-devel gcc gcc-c++ -BuildRequires: libselinux-devel >= %{selinux_ver} libsepol-devel >= %{sepol_ver} -BuildRequires: libsepol-static >= %{sepol_ver} -BuildRequires: sqlite-devel >= %{sqlite_ver} libxml2-devel -BuildRequires: tcl-devel >= %{tcltk_ver} -BuildRequires: autoconf >= %{autoconf_ver} automake - -%description libs -SETools is a collection of graphical tools, command-line tools, and -libraries designed to facilitate SELinux policy analysis. - -This package includes the following run-time libraries: - - libapol policy analysis library - libpoldiff semantic policy difference library - libqpol library that abstracts policy internals - libseaudit parse and filter SELinux audit messages in log files - libsefs SELinux file contexts library - -%package libs-tcl -License: LGPLv2 -Summary: Tcl bindings for SELinux policy analysis -Group: Development/Languages -Requires: setools-libs = %{version}-%{release} tcl >= %{tcltk_ver} -BuildRequires: tcl-devel >= %{tcltk_ver} swig >= %{swig_ver} - -%description libs-tcl -SETools is a collection of graphical tools, command-line tools, and -libraries designed to facilitate SELinux policy analysis. - -This package includes Tcl bindings for the following libraries: - - libapol policy analysis library - libpoldiff semantic policy difference library - libqpol library that abstracts policy internals - libseaudit parse and filter SELinux audit messages in log files - libsefs SELinux file contexts library - -%package devel -License: LGPLv2 -Summary: Policy analysis development files for SELinux -Group: Development/Libraries -Requires: libselinux-devel >= %{selinux_ver} libsepol-devel >= %{sepol_ver} setools-libs = %{version}-%{release} -BuildRequires: sqlite-devel >= %{sqlite_ver} libxml2-devel - -%description devel -SETools is a collection of graphical tools, command-line tools, and -libraries designed to facilitate SELinux policy analysis. - -This package includes header files and archives for the following -libraries: - - libapol policy analysis library - libpoldiff semantic policy difference library - libqpol library that abstracts policy internals - libseaudit parse and filter SELinux audit messages in log files - libsefs SELinux file contexts library +Python modules designed to facilitate SELinux policy analysis. %package console Summary: Policy analysis command-line tools for SELinux Group: System Environment/Base License: GPLv2 -Requires: setools-libs = %{version}-%{release} +Requires: setools-python3 = %{version}-%{release} Requires: libselinux >= %{selinux_ver} %description console @@ -129,634 +60,131 @@ libraries designed to facilitate SELinux policy analysis. This package includes the following console tools: - secmds command line tools: seinfo, sesearch - sediff semantic policy difference tool + sediff Compare two policies to find differences. + sedta Perform domain transition analyses. + seinfo List policy components. + seinfoflow Perform information flow analyses. + sesearch Search rules (allow, type_transition, etc.) -%package gui -Summary: Policy analysis graphical tools for SELinux -Group: System Environment/Base -Requires: tcl >= %{tcltk_ver} tk >= %{tcltk_ver} bwidget >= %{bwidget_ver} -Requires: setools-libs = %{version}-%{release} setools-libs-tcl = %{version}-%{release} -Requires: glib2 gtk2 >= %{gtk_ver} usermode -BuildRequires: gtk2-devel >= %{gtk_ver} libglade2-devel libxml2-devel tk-devel >= %{tcltk_ver} -BuildRequires: desktop-file-utils + +%package python +Summary: Policy analysis tools for SELinux +Requires: python-networkx + +%description python +SETools is a collection of graphical tools, command-line tools, and +Python 2 modules designed to facilitate SELinux policy analysis. + +%if %{with python3} +%package python3 +Summary: Policy analysis tools for SELinux +Obsoletes: setools-libs < 4.0.0, setools-libs-tcl +Requires: python3-networkx + +%description python3 +SETools is a collection of graphical tools, command-line tools, and +Python 3 modules designed to facilitate SELinux policy analysis. + +%endif # with python3 + +%package gui +Summary: Policy analysis graphical tools for SELinux +Requires: python3-qt5 %description gui SETools is a collection of graphical tools, command-line tools, and -libraries designed to facilitate SELinux policy analysis. +Python modules designed to facilitate SELinux policy analysis. -This package includes the following graphical tools: - - apol policy analysis tool - seaudit audit log analysis tool - -%define setoolsdir %{_datadir}/setools-%{setools_maj_ver} -%define tcllibdir %{_libdir}/setools %prep -%setup -q -%patch1 -p 1 -b .neverallow -%patch2 -p 1 -b .libsepol -%patch4 -p 1 -b .current_policy -%patch5 -p 1 -b .seaudit -%patch6 -p 1 -b .boolean-subs -%patch7 -p 1 -b .noship -%patch8 -p 1 -b .seinfo-t -%patch9 -p 1 -b .sesearch-D -%patch11 -p 1 -b .Wformat-security -%patch12 -p 1 -b .version -%patch13 -p 1 -b .libqpol +%setup +sed -i "s%'-Werror', '-Wextra'%'-Wextra'%" setup.py + +# mv setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} python2 + +%if %{with python3} +cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 +%endif # with python4 -%ifarch sparc sparcv9 sparc64 s390 s390x - for file in `find . -name Makefile.am`; do - sed -i -e 's:-fpic:-fPIC:' $file; - done -%endif -# Fixup expected version of SWIG: -sed -i -e "s|AC_PROG_SWIG(1.3.28)|AC_PROG_SWIG(3.0.0)|g" configure.ac -# and rebuild the autotooled files: -aclocal -autoreconf -if %build -automake -%configure --libdir=%{_libdir} --disable-bwidget-check --disable-selinux-check \ - --enable-swig-tcl -# work around issue with gcc 4.3 + gnu99 + swig-generated code: -make %{?_smp_mflags} +# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} +# Remove CFLAGS=... for noarch packages (unneeded) +CFLAGS="%{optflags}" %{__python2} setup.py build +# popd + +%if %{with python3} +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 +# Remove CFLAGS=... for noarch packages (unneeded) +CFLAGS="%{optflags}" %{__python3} setup.py build +popd +%endif # with python3 + %install -rm -rf ${RPM_BUILD_ROOT} -make DESTDIR=${RPM_BUILD_ROOT} INSTALL="install -p" install -mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/applications -mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/pixmaps -install -d -m 755 ${RPM_BUILD_ROOT}%{_sysconfdir}/pam.d -install -p -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/pam.d/seaudit -install -d -m 755 ${RPM_BUILD_ROOT}%{_sysconfdir}/security/console.apps -install -p -m 644 packages/rpm/seaudit.console ${RPM_BUILD_ROOT}%{_sysconfdir}/security/console.apps/seaudit -install -d -m 755 ${RPM_BUILD_ROOT}%{_datadir}/applications -install -p -m 644 apol/apol.png ${RPM_BUILD_ROOT}%{_datadir}/pixmaps/apol.png -install -p -m 644 seaudit/seaudit.png ${RPM_BUILD_ROOT}%{_datadir}/pixmaps/seaudit.png -desktop-file-install --dir ${RPM_BUILD_ROOT}%{_datadir}/applications %{SOURCE2} -ln -sf consolehelper ${RPM_BUILD_ROOT}/%{_bindir}/seaudit -# remove static libs -rm -f ${RPM_BUILD_ROOT}/%{_libdir}/*.a -# ensure permissions are correct -chmod 0755 ${RPM_BUILD_ROOT}/%{_libdir}/*.so.* -chmod 0755 ${RPM_BUILD_ROOT}/%{_libdir}/%{name}/*/*.so.* -chmod 0644 ${RPM_BUILD_ROOT}/%{tcllibdir}/*/pkgIndex.tcl +rm -rf %{buildroot} +# REMOVEME this comment +# Must do the python3 install first because the scripts in /usr/bin are +# overwritten with every setup.py install (and we want the python2 version +# to be the default for now). + +# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} +%{__python2} setup.py install --root %{buildroot} +# popd + +%if %{with python3} +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 +%{__python3} setup.py install --root %{buildroot} +popd +%endif # with python3 + + +%check +%if %{?_with_check:1}%{!?_with_check:0} +# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} +%{__python2} setup.py test +# popd + +%if %{with python3} +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 +%{__python2} setup.py test +popd +%endif +%endif -%clean -rm -rf ${RPM_BUILD_ROOT} %files %defattr(-,root,root,-) -%files libs -%defattr(-,root,root,-) -%{!?_licensedir:%global license %%doc} -%license COPYING COPYING.GPL COPYING.LGPL -%doc AUTHORS ChangeLog KNOWN-BUGS NEWS README -%{_libdir}/libqpol.so.* -%{_libdir}/libapol.so.* -%{_libdir}/libpoldiff.so.* -%{_libdir}/libsefs.so.* -%{_libdir}/libseaudit.so.* -%dir %{setoolsdir} - -%files libs-tcl -%defattr(-,root,root,-) -%dir %{tcllibdir} -%{tcllibdir}/qpol/ -%{tcllibdir}/apol/ -%{tcllibdir}/poldiff/ -%{tcllibdir}/seaudit/ -%{tcllibdir}/sefs/ - -%files devel -%defattr(-,root,root,-) -%{_libdir}/*.so -%{_libdir}/pkgconfig/* -%{_includedir}/qpol/ -%{_includedir}/apol/ -%{_includedir}/poldiff/ -%{_includedir}/seaudit/ -%{_includedir}/sefs/ - %files console -%defattr(-,root,root,-) -%{_bindir}/seinfo -%{_bindir}/sesearch %{_bindir}/sediff -%{_mandir}/man1/sediff.1.gz -%{_mandir}/man1/seinfo.1.gz -%{_mandir}/man1/sesearch.1.gz +%{_bindir}/sedta +%{_bindir}/seinfo +%{_bindir}/seinfoflow +%{_bindir}/sesearch +%{_mandir}/man1/* + +%files python +# %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README +%license COPYING COPYING.GPL COPYING.LGPL +# For noarch packages: sitelib +# %{python2_sitelib}/* +# For arch-specific packages: sitearch +%{python2_sitearch}/* + +%if %{with python3} +%files python3 +%license COPYING COPYING.GPL COPYING.LGPL +# %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README +# For noarch packages: sitelib +# %{python3_sitelib}/* +# For arch-specific packages: sitearch +%{python3_sitearch}/* +%endif # with python3 %files gui -%defattr(-,root,root,-) -%{_bindir}/seaudit %{_bindir}/apol -%{tcllibdir}/apol_tcl/ -%{setoolsdir}/apol_help.txt -%{setoolsdir}/domaintrans_help.txt -%{setoolsdir}/file_relabel_help.txt -%{setoolsdir}/infoflow_help.txt -%{setoolsdir}/types_relation_help.txt -%{setoolsdir}/apol_perm_mapping_* -%{setoolsdir}/seaudit_help.txt -%{setoolsdir}/*.glade -%{setoolsdir}/*.png -%{setoolsdir}/apol.gif -%{setoolsdir}/dot_seaudit -%{_mandir}/man1/apol.1.gz -%{_mandir}/man8/seaudit.8.gz -%{_sbindir}/seaudit -%config(noreplace) %{_sysconfdir}/pam.d/seaudit -%config(noreplace) %{_sysconfdir}/security/console.apps/seaudit -%{_datadir}/applications/* -%attr(0644,root,root) %{_datadir}/pixmaps/*.png - -%post libs -p /sbin/ldconfig - -%postun libs -p /sbin/ldconfig - -%post libs-tcl -p /sbin/ldconfig - -%postun libs-tcl -p /sbin/ldconfig %changelog -* Sat Feb 11 2017 Fedora Release Engineering - 3.3.8-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Wed May 11 2016 Petr Lautrbach - 3.3.8-12 -- Rebuilt with libsepol-2.5-6 - -* Fri Apr 29 2016 Petr Lautrbach - 3.3.8-11 -- Rebuilt with libsepol-2.5-5 - -* Sun Feb 21 2016 Petr Lautrbach 3.3.8-10 -- libqpol: Skip types when building type attribute map (#1291336) -- Rebase for SELinuxProject userspace release 2016-01-07 - -* Thu Feb 04 2016 Fedora Release Engineering - 3.3.8-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jan 29 2016 Petr Lautrbach 3.3.8-8 -- Rebase to the latest setools3 sources (#1266520) - -* Fri Sep 25 2015 David Sommerseth - 3.3.8-8 -- Add patch for libsepool 2.4 support - -* Fri Jun 19 2015 Fedora Release Engineering - 3.3.8-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Sat May 02 2015 Kalev Lember - 3.3.8-6 -- Rebuilt for GCC 5 C++11 ABI change - -* Mon Aug 18 2014 Fedora Release Engineering - 3.3.8-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Mon Aug 4 2014 Tom Callaway - 3.3.8-4 -- fix license handling - -* Sun Jun 08 2014 Fedora Release Engineering - 3.3.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Wed May 21 2014 Jaroslav Škarvada - 3.3.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Changes/f21tcl86 - -* Fri Apr 11 2014 Miroslav Grepl - 3.3.8-1 -- Update to upstream - -* Mon Sep 16 2013 Dan Walsh - 3.3.7-41 -- Cleanup Destop files. - -* Fri Jul 19 2013 Dan Walsh - 3.3.7-40 -- Fix help message on sesearch -D - -* Thu May 16 2013 Dan Walsh - 3.3.7-39 -- Remove --default and --audit from sesearch -- Make -D == --dontaudit in sesearch - -* Thu Mar 28 2013 Dan Walsh - 3.3.7-38 -- Add alias support to seinfo -t - -* Wed Mar 27 2013 Kalev Lember - 3.3.7-37 -- Obsolete the removed setools-libs-python subpackage - -* Fri Mar 15 2013 Dan Walsh - 3.3.7-36 -- Drop support for python bindings - -* Thu Mar 14 2013 Dan Walsh - 3.3.7-35 -- Add support for substituting bools to sesearch and seinfo - -* Wed Jan 30 2013 Dan Walsh - 3.3.7-34 -- Rebuild using pristine source from Tresys - -* Tue Jan 29 2013 Dan Walsh - 3.3.7-33 -- Apply swig patch to make apol work again. - -* Mon Jan 7 2013 Dan Walsh - 3.3.7-32 -- Rebuild with new tool chain - -* Fri Sep 28 2012 Dan Walsh - 3.3.7-31 -- Add filename_trans to python/setools/sesearch bindings - -* Fri Sep 28 2012 Dan Walsh - 3.3.7-30 -- Apply Lars Jensen patch to fix seaudit -- Remove java bindings, not supported - -* Sun Sep 16 2012 Dan Walsh - 3.3.7-29 -- Remove tools that we do not want to support - -* Mon Aug 20 2012 Dan Horák - 3.3.7-28 -- use autoreconf to rebuild all autotooled files (FTBFS) - -* Sat Jul 21 2012 Fedora Release Engineering - 3.3.7-27 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Wed Jul 11 2012 Dan Walsh - 3.3.7-26 -- mgrepl patch to Fix swig coding style for structures related to SWIG changes - -* Wed Jul 4 2012 Dan Walsh - 3.3.7-25 -- Fix swig coding style for structures related to SWIG changes - -* Wed May 2 2012 Dan Walsh - 3.3.7-24 -- Revert setools current patch - -- Rebuild to get latest libsepol which fixes the file_name transition problems -- Use selinux_current_policy_path to read by default policy - -* Tue Feb 28 2012 Fedora Release Engineering - 3.3.7-22 -- Rebuilt for c++ ABI breakage - -* Sat Jan 14 2012 Fedora Release Engineering - 3.3.7-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Tue Dec 20 2011 Dan Walsh - 3.3.7-20 -- Rebuild to use latest libsepol - -* Wed Oct 26 2011 Dan Walsh - 3.3.7-19 -- Add ftrule*h in apol and qpol - -* Wed Sep 21 2011 Dan Walsh - 3.3.7-18 -- Fix output to match input in policy - -* Tue Sep 20 2011 Dan Walsh - 3.3.7-17 -- Fix to build with latest libsepol -- Show filename transition files - -* Thu Apr 21 2011 Dan Walsh - 3.3.7-16 -- Rebuild for new sepol - -* Fri Apr 15 2011 Dan Walsh - 3.3.7-15 -- Rebuild for new sepol - -* Sat Apr 9 2011 Dan Walsh - 3.3.7-14 -- Rebuild for new sepol - -* Sun Feb 27 2011 Dennis Gilmore - 3.3.7-13 -- switch in -fPIC in Makefile.am in prep stage - -* Wed Feb 09 2011 Fedora Release Engineering - 3.3.7-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Fri Nov 5 2010 Dan Walsh 3.3.6-10 -- Exit seinfo and sesearch with proper status - -* Fri Nov 5 2010 Dan Walsh 3.3.6-9 -- Rebuild for new libxml2 - -* Thu Oct 14 2010 Dan Walsh 3.3.6-8 -- Return None when no records match python setools.sesearch - -* Thu Aug 19 2010 Dan Walsh 3.3.6-7 -- Add range to ports in seinfo python - -* Tue Aug 3 2010 Dan Walsh 3.3.6-6 -- Return range with ports - -* Tue Aug 3 2010 Dan Walsh 3.3.6-5 -- Add port support to setools python - -* Mon Jul 26 2010 David Malcolm - 3.3.7-4 -- fixup configure.ac to expect SWIG 2.0.0; bump the python version to 2.7 in -patch 1 - -* Thu Jul 22 2010 David Malcolm - 3.3.7-3 -- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild - -* Wed May 12 2010 Chris PeBenito 3.3.7-2 -- Add missing bzip2 dependencies. - -* Wed May 12 2010 Chris PeBenito 3.3.7-1 +* Wed Feb 15 2017 Petr Lautrbach - 4.1.0-1 - New upstream release. - -* Tue Aug 11 2009 Dan Walsh 3.3.6-4 -- Add python bindings for sesearch and seinfo - -* Tue Jul 28 2009 Dan Walsh 3.3.6-3 -- Fix qpol install of include files - -* Sun Jul 26 2009 Fedora Release Engineering - 3.3.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Wed Jul 22 2009 Chris PeBenito 3.3.6-1 -- New upstream release. - -* Sun Apr 5 2009 Dan Horák - 3.3.5-8 -- don't expect that java-devel resolves as gcj - -* Sun Apr 5 2009 Dan Horák - 3.3.5-7 -- add support for s390x - -* Wed Feb 25 2009 Fedora Release Engineering - 3.3.5-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Thu Dec 04 2008 Ignacio Vazquez-Abrams - 3.3.5-5 -- Rebuild for Python 2.6 - -* Mon Dec 1 2008 Michael Schwendt - 3.3.5-4 -- Include %%tcllibdir directory in -libs-tcl package. - -* Sat Nov 29 2008 Ignacio Vazquez-Abrams - 3.3.5-3 -- Rebuild for Python 2.6 - -* Wed Sep 17 2008 Dennis Gilmore 3.3.5-2 -- fix building in sparc and s390 arches - -* Tue Aug 26 2008 Chris PeBenito 3.3.5-1 -- Update to upstream version 3.3.5. - -* Wed Feb 27 2008 Chris PeBenito 3.3.4-1 -- Fixes gcc 4.3, glibc 2.7, tcl 8.5, and libsepol 2.0.20 issues. -- Fix policy loading when policy on disk is higher version than the kernel. - -* Tue Feb 19 2008 Fedora Release Engineering - 3.3.2-3 -- Autorebuild for GCC 4.3 - -* Tue Jan 29 2008 Chris Pebenito 3.3.2-2.fc9 -- Bump to pick up new libsepol and policy 22. - -* Wed Nov 28 2007 Chris Pebenito 3.3.2-1.fc9 -- Update for 3.3.2. - -* Thu Oct 18 2007 Chris PeBenito 3.3.1-7.fc8 -- Rebuild to fix ppc64 issue. - -* Wed Oct 17 2007 Chris PeBenito 3.3.1-6.fc8 -- Update for 3.3.1. - -* Tue Aug 28 2007 Fedora Release Engineering - 3.2-4 -- Rebuild for selinux ppc32 issue. - -* Fri Jul 20 2007 Dan Walsh 3.2-3 -- Move to Tresys spec file - -* Wed Jun 13 2007 Dan Walsh 3.2-2 -- Bump for rebuild - -* Mon Apr 30 2007 Dan Walsh 3.2-1 -- Start shipping the rest of the setools command line apps - -* Wed Apr 25 2007 Jason Tang 3.2-0 -- update to SETools 3.2 release - -* Fri Feb 02 2007 Jason Tang 3.1-1 -- update to SETools 3.1 release - -* Mon Oct 30 2006 Dan Walsh 3.0-2.fc6 -- bump for fc6 - -* Thu Oct 26 2006 Dan Walsh 3.0-2 -- Build on rawhide - -* Sun Oct 15 2006 Dan Walsh 3.0-1 -- Update to upstream - -* Wed Jul 12 2006 Jesse Keating - sh: line 0: fg: no job control -- rebuild - -* Tue May 23 2006 Dan Walsh 2.4-2 -- Remove sqlite include directory - -* Wed May 3 2006 Dan Walsh 2.4-1 -- Update from upstream - -* Mon Apr 10 2006 Dan Walsh 2.3-3 -- Fix help -- Add icons - -* Tue Mar 21 2006 Dan Walsh 2.3-2 -- Remove console apps for sediff, sediffx and apol - -* Fri Feb 10 2006 Jesse Keating - 2.3-1.2 -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jesse Keating - 2.3-1.1 -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Tue Jan 31 2006 Dan Walsh 2.3-1 -- Update from upstream - * apol: - added new MLS components tab for sensitivities, - levels, and categories. - Changed users tab to support ranges and default - levels. - added range transition tab for searching range - Transition rules. - added new tab for network context components. - added new tab for file system context components. - * libapol: - added binpol support for MLS, network contexts, - and file system contexts. - * seinfo: - added command line options for MLS components. - added command line options for network contexts - and file system contexts. - * sesearch: - added command line option for searching for rules - by conditional boolean name. - * seaudit: - added new column in the log view for the 'comm' - field found in auditd log files. - added filters for the 'comm' field and 'message' - field. - * manpages: - added manpages for all tools. - - - -* Fri Dec 16 2005 Jesse Keating -- rebuilt for new gcj - -* Wed Dec 14 2005 Dan Walsh 2.2-4 -- Fix dessktop files -- Apply fixes from bkyoung - -* Fri Dec 09 2005 Jesse Keating -- rebuilt - -* Thu Nov 3 2005 Dan Walsh 2.2-3 -- Move more gui files out of base into gui - -* Thu Nov 3 2005 Dan Walsh 2.2-2 -- Move sediff from gui to main package - -* Thu Nov 3 2005 Dan Walsh 2.2-1 -- Upgrade to upstream version - -* Thu Oct 13 2005 Dan Walsh 2.1.3-1 -- Upgrade to upstream version - -* Mon Oct 10 2005 Tomas Mraz 2.1.2-3 -- use include instead of pam_stack in pam config - -* Thu Sep 1 2005 Dan Walsh 2.1.2-2 -- Fix spec file - -* Thu Sep 1 2005 Dan Walsh 2.1.2-1 -- Upgrade to upstream version - -* Thu Aug 18 2005 Florian La Roche -- do not package debug files into the -devel package - -* Wed Aug 17 2005 Jeremy Katz - 2.1.1-3 -- rebuild against new cairo - -* Wed May 25 2005 Dan Walsh 2.1.1-0 -- Upgrade to upstream version - -* Mon May 23 2005 Bill Nottingham 2.1.0-5 -- put libraries in the right place (also puts debuginfo in the right - package) -- add %%defattr for -devel too - -* Thu May 12 2005 Dan Walsh 2.1.0-4 -- Move sepcut to gui apps. - -* Fri May 6 2005 Dan Walsh 2.1.0-3 -- Fix Missing return code. - -* Wed Apr 20 2005 Dan Walsh 2.1.0-2 -- Fix requires line - -* Tue Apr 19 2005 Dan Walsh 2.1.0-1 -- Update to latest from tresys - -* Tue Apr 5 2005 Dan Walsh 2.0.0-2 -- Fix buildrequires lines in spec file - -* Wed Mar 2 2005 Dan Walsh 2.0.0-1 -- Update to latest from tresys - -* Mon Nov 29 2004 Dan Walsh 1.5.1-6 -- add FALLBACK=true to /etc/security/console.apps/apol - -* Wed Nov 10 2004 Dan Walsh 1.5.1-3 -- Add badtcl patch from Tresys. - -* Mon Nov 8 2004 Dan Walsh 1.5.1-2 -- Apply malloc problem patch provided by Sami Farin - -* Mon Nov 1 2004 Dan Walsh 1.5.1-1 -- Update to latest from Upstream - -* Wed Oct 6 2004 Dan Walsh 1.4.1-5 -- Update tresys patch - -* Mon Oct 4 2004 Dan Walsh 1.4.1-4 -- Fix directory ownership - -* Thu Jul 8 2004 Dan Walsh 1.4.1-1 -- Latest from Tresys - -* Wed Jun 23 2004 Dan Walsh 1.4-5 -- Add build requires libselinux - -* Tue Jun 22 2004 Dan Walsh 1.4-4 -- Add support for policy.18 - -* Tue Jun 15 2004 Elliot Lee -- rebuilt - -* Thu Jun 10 2004 Dan Walsh 1.4-2 -- Fix install locations of policy_src_dir - -* Wed Jun 2 2004 Dan Walsh 1.4-1 -- Update to latest from TRESYS. - -* Tue Jun 1 2004 Dan Walsh 1.3-3 -- Make changes to work with targeted/strict policy -* Fri Apr 16 2004 Dan Walsh 1.3-2 -- Take out requirement for policy file - -* Fri Apr 16 2004 Dan Walsh 1.3-1 -- Fix doc location - -* Fri Apr 16 2004 Dan Walsh 1.3-1 -- Latest from TRESYS - -* Tue Apr 13 2004 Dan Walsh 1.2.1-8 -- fix location of policy.conf file - -* Tue Apr 6 2004 Dan Walsh 1.2.1-7 -- Obsolete setools-devel -* Tue Apr 6 2004 Dan Walsh 1.2.1-6 -- Fix location of -* Tue Apr 6 2004 Dan Walsh 1.2.1-5 -- Remove devel libraries -- Fix installdir for lib64 - -* Sat Apr 3 2004 Dan Walsh 1.2.1-4 -- Add usr_t file read to policy - -* Thu Mar 25 2004 Dan Walsh 1.2.1-3 -- Use tcl8.4 - -* Tue Mar 02 2004 Elliot Lee -- rebuilt - -* Fri Feb 13 2004 Elliot Lee -- rebuilt - -* Fri Feb 6 2004 Dan Walsh 1.2.1-1 -- New patch - -* Fri Feb 6 2004 Dan Walsh 1.2-1 -- Latest upstream version - -* Tue Dec 30 2003 Dan Walsh 1.1.1-1 -- New version from upstream -- Remove seuser.te. Now in policy file. - -* Tue Dec 30 2003 Dan Walsh 1.1-2 -- Add Defattr to devel -- move libs to base kit - -* Fri Dec 19 2003 Dan Walsh 1.1-1 -- Update to latest code from tresys -- Break into three separate packages for cmdline, devel and gui -- Incorporate the tcl patch - -* Mon Dec 15 2003 Jens Petersen - 1.0.1-3 -- apply setools-1.0.1-tcltk.patch to build against tcl/tk 8.4 -- buildrequire tk-devel - -* Thu Nov 20 2003 Dan Walsh 1.0.1-2 -- Add Bwidgets to this RPM - -* Tue Nov 4 2003 Dan Walsh 1.0.1-1 -- Upgrade to 1.0.1 - -* Wed Oct 15 2003 Dan Walsh 1.0-6 -- Clean up build - -* Tue Oct 14 2003 Dan Walsh 1.0-5 -- Update with correct seuser.te - -* Wed Oct 1 2003 Dan Walsh 1.0-4 -- Update with final release from Tresys - -* Mon Jun 2 2003 Dan Walsh 1.0-1 -- Initial version diff --git a/sources b/sources index 6b2ffc9..ac0490d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d262b1d4bacaa8c4890d644a03b5e73d setools-3.3.8-f1e5b20.tar.bz2 +SHA512 (4.1.0.tar.gz) = 047f969a347c5d015885aef0c7a341ae4393c8e0d61a7112b7bd0380d7c6161765f1ac5d875777ac84430bbe4d21bcb8a748f1b8484ae3a4d3f0137e90a07f2b From 689c2145848322ccebf2577086709d6d541ff721 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 08:09:58 +0100 Subject: [PATCH 012/111] Drop unused patches --- ...ship-neverallow-rules-all-always-fai.patch | 28 - ...l-calls-to-work-with-latest-libsepol.patch | 34 - ...xit-with-an-error-status-if-it-gets-.patch | 133 - ...ship-neverallow-rules-all-always-fai.patch | 28 - ...Fix-swig-coding-style-for-structures.patch | 596 ---- ...ly-selinux_current_policy_path-patch.patch | 97 - 0004-Fix-man-pages-and-getoptions.patch | 78 - 0005-Apply-seaudit-patch-for-progress.c.patch | 24 - ...l-calls-to-work-with-latest-libsepol.patch | 34 - 0006-Add-support-for-boolean-subs.patch | 39 - ...es-to-support-named-file_trans-rules.patch | 1505 --------- 0007-Remove-unused-variables.patch | 277 -- 0007-Setools-noship.patch | 276 -- 0008-Add-alias-support-to-seinfo-t.patch | 92 - 0008-Fix-output-to-match-policy-lines.patch | 34 - 0009-Fix-help-message-on-sesearch-D.patch | 258 -- ...Fix-swig-coding-style-for-structures.patch | 583 ---- ...y-swig-patch-to-make-apol-work-again.patch | 964 ------ 0010-selinux_current_policy_path.patch | 84 - 0011-Fix-Wformat-security-issues.patch | 154 - 0011-setools-noship.patch | 255 -- 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch | 51 - 0012-seaudit.patch | 28 - ...pes-when-building-type-attribute-map.patch | 29 - 0013-swig.patch | 956 ------ 0014-boolsub.patch | 24 - 0015-aliases.patch | 82 - 0016-cmdline.patch | 107 - 0017-update-to-libsepool-2.4-parser.patch | 101 - setools-exitstatus.patch | 119 - setools-neverallow.patch | 15 - setools-python.patch | 2747 ----------------- 32 files changed, 9832 deletions(-) delete mode 100644 0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch delete mode 100644 0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch delete mode 100644 0002-setools-should-exit-with-an-error-status-if-it-gets-.patch delete mode 100644 0003-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch delete mode 100644 0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch delete mode 100644 0004-Apply-selinux_current_policy_path-patch.patch delete mode 100644 0004-Fix-man-pages-and-getoptions.patch delete mode 100644 0005-Apply-seaudit-patch-for-progress.c.patch delete mode 100644 0005-Fix-sepol-calls-to-work-with-latest-libsepol.patch delete mode 100644 0006-Add-support-for-boolean-subs.patch delete mode 100644 0006-Changes-to-support-named-file_trans-rules.patch delete mode 100644 0007-Remove-unused-variables.patch delete mode 100644 0007-Setools-noship.patch delete mode 100644 0008-Add-alias-support-to-seinfo-t.patch delete mode 100644 0008-Fix-output-to-match-policy-lines.patch delete mode 100644 0009-Fix-help-message-on-sesearch-D.patch delete mode 100644 0009-Fix-swig-coding-style-for-structures.patch delete mode 100644 0010-Apply-swig-patch-to-make-apol-work-again.patch delete mode 100644 0010-selinux_current_policy_path.patch delete mode 100644 0011-Fix-Wformat-security-issues.patch delete mode 100644 0011-setools-noship.patch delete mode 100644 0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch delete mode 100644 0012-seaudit.patch delete mode 100644 0013-libqpol-Skip-types-when-building-type-attribute-map.patch delete mode 100644 0013-swig.patch delete mode 100644 0014-boolsub.patch delete mode 100644 0015-aliases.patch delete mode 100644 0016-cmdline.patch delete mode 100644 0017-update-to-libsepool-2.4-parser.patch delete mode 100644 setools-exitstatus.patch delete mode 100644 setools-neverallow.patch delete mode 100644 setools-python.patch diff --git a/0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch b/0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch deleted file mode 100644 index 51a1e01..0000000 --- a/0001-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 852dfaa124379e84f6363c30c0ef56f00fa4b235 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:40:28 -0400 -Subject: [PATCH 01/11] Since-we-do-not-ship-neverallow-rules-all-always-fail - ---- - libqpol/src/avrule_query.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/libqpol/src/avrule_query.c b/libqpol/src/avrule_query.c -index 749565b..76dcaa3 100644 ---- a/libqpol/src/avrule_query.c -+++ b/libqpol/src/avrule_query.c -@@ -57,8 +57,9 @@ int qpol_policy_get_avrule_iter(const qpol_policy_t * policy, uint32_t rule_type - - if ((rule_type_mask & QPOL_RULE_NEVERALLOW) && !qpol_policy_has_capability(policy, QPOL_CAP_NEVERALLOW)) { - ERR(policy, "%s", "Cannot get avrules: Neverallow rules requested but not available"); -- errno = ENOTSUP; -- return STATUS_ERR; -+/* errno = ENOTSUP; -+ return STATUS_ERR; */ -+ return STATUS_SUCCESS; - } - - db = &policy->p->p; --- -1.8.5.3 - diff --git a/0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch b/0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch deleted file mode 100644 index 882a127..0000000 --- a/0002-Fix-sepol-calls-to-work-with-latest-libsepol.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 0332c009bd0581ab9a75a4ea80af92bb2d6b8b1f Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:46:38 -0400 -Subject: [PATCH 02/11] Fix sepol calls to work with latest libsepol - ---- - configure.ac | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 577ce48..2a5b55b 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -521,7 +521,7 @@ else - [AC_LANG_SOURCE([ - #include - int main () { -- return role_set_expand(NULL, NULL, NULL, NULL); -+ return role_set_expand(NULL, NULL, NULL, NULL, NULL); - }])], - sepol_new_user_role_mapping="yes", - sepol_new_user_role_mapping="no") -@@ -578,7 +578,7 @@ if test ${sepol_check_boolmap} = "yes"; then - [AC_LANG_SOURCE([ - #include - int main () { -- return expand_module_avrules(NULL, NULL, NULL, NULL, NULL, 0, 0); -+ return expand_module_avrules(NULL, NULL, NULL, NULL, NULL, 0, 0, 0, 0); - }])], - AC_MSG_RESULT([yes]), - AC_MSG_ERROR([this version of libsepol is incompatible with SETools])) --- -1.8.5.3 - diff --git a/0002-setools-should-exit-with-an-error-status-if-it-gets-.patch b/0002-setools-should-exit-with-an-error-status-if-it-gets-.patch deleted file mode 100644 index 62a8050..0000000 --- a/0002-setools-should-exit-with-an-error-status-if-it-gets-.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 667fe9187c203ffcba855e821dff11c8f71ef000 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:39:51 -0400 -Subject: [PATCH 2/6] setools-should-exit-with-an-error-status-if-it-gets-an - error - ---- - secmds/seinfo.c | 51 +++++++++++++++++++++++++++------------------------ - 1 files changed, 27 insertions(+), 24 deletions(-) - -diff --git a/secmds/seinfo.c b/secmds/seinfo.c -index fdf23e9..3088f88 100644 ---- a/secmds/seinfo.c -+++ b/secmds/seinfo.c -@@ -827,7 +827,7 @@ static int print_sens(FILE * fp, const char *name, int expand, const apol_policy - */ - static int print_cats(FILE * fp, const char *name, int expand, const apol_policy_t * policydb) - { -- int retval = 0; -+ int retval = -1; - apol_cat_query_t *query = NULL; - apol_vector_t *v = NULL; - const qpol_cat_t *cat_datum = NULL; -@@ -911,9 +911,10 @@ static int print_fsuse(FILE * fp, const char *type, const apol_policy_t * policy - fprintf(fp, " %s\n", tmp); - free(tmp); - } -- if (type && !apol_vector_get_size(v)) -+ if (type && !apol_vector_get_size(v)) { - ERR(policydb, "No fs_use statement for filesystem of type %s.", type); -- -+ goto cleanup; -+ } - retval = 0; - cleanup: - apol_fs_use_query_destroy(&query); -@@ -949,7 +950,6 @@ static int print_genfscon(FILE * fp, const char *type, const apol_policy_t * pol - ERR(policydb, "%s", strerror(ENOMEM)); - goto cleanup; - } -- - if (apol_genfscon_query_set_filesystem(policydb, query, type)) - goto cleanup; - if (apol_genfscon_get_by_query(policydb, query, &v)) -@@ -967,8 +967,10 @@ static int print_genfscon(FILE * fp, const char *type, const apol_policy_t * pol - free(tmp); - } - -- if (type && !apol_vector_get_size(v)) -+ if (type && !apol_vector_get_size(v)) { - ERR(policydb, "No genfscon statement for filesystem of type %s.", type); -+ goto cleanup; -+ } - - retval = 0; - cleanup: -@@ -1646,6 +1648,7 @@ cleanup: // close and destroy iterators etc. - - int main(int argc, char **argv) - { -+ int rc = 0; - int classes, types, attribs, roles, users, all, expand, stats, rt, optc, isids, bools, sens, cats, fsuse, genfs, netif, - node, port, permissives, polcaps, constrain, linebreaks; - apol_policy_t *policydb = NULL; -@@ -1851,46 +1854,46 @@ int main(int argc, char **argv) - - /* display requested info */ - if (stats || all) -- print_stats(stdout, policydb); -+ rc = print_stats(stdout, policydb); - if (classes || all) -- print_classes(stdout, class_name, expand, policydb); -+ rc = print_classes(stdout, class_name, expand, policydb); - if (types || all) -- print_types(stdout, type_name, expand, policydb); -+ rc = print_types(stdout, type_name, expand, policydb); - if (attribs || all) -- print_attribs(stdout, attrib_name, expand, policydb); -+ rc = print_attribs(stdout, attrib_name, expand, policydb); - if (roles || all) -- print_roles(stdout, role_name, expand, policydb); -+ rc = print_roles(stdout, role_name, expand, policydb); - if (users || all) -- print_users(stdout, user_name, expand, policydb); -+ rc = print_users(stdout, user_name, expand, policydb); - if (bools || all) -- print_booleans(stdout, bool_name, expand, policydb); -+ rc = print_booleans(stdout, bool_name, expand, policydb); - if (sens || all) -- print_sens(stdout, sens_name, expand, policydb); -+ rc = print_sens(stdout, sens_name, expand, policydb); - if (cats || all) -- print_cats(stdout, cat_name, expand, policydb); -+ rc = print_cats(stdout, cat_name, expand, policydb); - if (fsuse || all) -- print_fsuse(stdout, fsuse_type, policydb); -+ rc = print_fsuse(stdout, fsuse_type, policydb); - if (genfs || all) -- print_genfscon(stdout, genfs_type, policydb); -+ rc = print_genfscon(stdout, genfs_type, policydb); - if (netif || all) -- print_netifcon(stdout, netif_name, policydb); -+ rc = print_netifcon(stdout, netif_name, policydb); - if (node || all) -- print_nodecon(stdout, node_addr, policydb); -+ rc = print_nodecon(stdout, node_addr, policydb); - if (port || all) -- print_portcon(stdout, port_num, protocol, policydb); -+ rc = print_portcon(stdout, port_num, protocol, policydb); - if (isids || all) -- print_isids(stdout, isid_name, expand, policydb); -+ rc = print_isids(stdout, isid_name, expand, policydb); - if (permissives || all) -- print_permissives(stdout, permissive_name, expand, policydb); -+ rc = print_permissives(stdout, permissive_name, expand, policydb); - if (polcaps || all) -- print_polcaps(stdout, polcap_name, expand, policydb); -+ rc = print_polcaps(stdout, polcap_name, expand, policydb); - if (constrain || all) -- print_constraints(stdout, expand, policydb, linebreaks); -+ rc = print_constraints(stdout, expand, policydb, linebreaks); - - apol_policy_destroy(&policydb); - apol_policy_path_destroy(&pol_path); - free(policy_file); -- exit(0); -+ exit(rc); - } - - /** --- -1.7.6.2 - diff --git a/0003-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch b/0003-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch deleted file mode 100644 index ae30696..0000000 --- a/0003-Since-we-do-not-ship-neverallow-rules-all-always-fai.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 252b7c8bf311d615164a20f4f402767e5859d972 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:40:28 -0400 -Subject: [PATCH 3/6] Since-we-do-not-ship-neverallow-rules-all-always-fail - ---- - libqpol/src/avrule_query.c | 5 +++-- - 1 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/libqpol/src/avrule_query.c b/libqpol/src/avrule_query.c -index 749565b..76dcaa3 100644 ---- a/libqpol/src/avrule_query.c -+++ b/libqpol/src/avrule_query.c -@@ -57,8 +57,9 @@ int qpol_policy_get_avrule_iter(const qpol_policy_t * policy, uint32_t rule_type - - if ((rule_type_mask & QPOL_RULE_NEVERALLOW) && !qpol_policy_has_capability(policy, QPOL_CAP_NEVERALLOW)) { - ERR(policy, "%s", "Cannot get avrules: Neverallow rules requested but not available"); -- errno = ENOTSUP; -- return STATUS_ERR; -+/* errno = ENOTSUP; -+ return STATUS_ERR; */ -+ return STATUS_SUCCESS; - } - - db = &policy->p->p; --- -1.7.6.2 - diff --git a/0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch b/0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch deleted file mode 100644 index e0bc2f3..0000000 --- a/0003-mgrepl-patch-to-Fix-swig-coding-style-for-structures.patch +++ /dev/null @@ -1,596 +0,0 @@ -From 295cc6c22440038c1b633602c0f1b38ded57e1a0 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 10:47:32 +0200 -Subject: [PATCH 03/11] mgrepl patch to Fix swig coding style for structures - related to SWIG changes - ---- - libqpol/swig/qpol.i | 132 ++++++++++++++++++++++++++-------------------------- - 1 file changed, 66 insertions(+), 66 deletions(-) - -diff --git a/libqpol/swig/qpol.i b/libqpol/swig/qpol.i -index 45a2403..0f937d1 100644 ---- a/libqpol/swig/qpol.i -+++ b/libqpol/swig/qpol.i -@@ -228,7 +228,7 @@ SWIGEXPORT int Tqpol_Init(Tcl_Interp *interp) { - #define QPOL_MODULE_OTHER 2 - typedef struct qpol_module {} qpol_module_t; - %extend qpol_module_t { -- qpol_module_t(const char *path) { -+ qpol_module(const char *path) { - qpol_module_t *m; - BEGIN_EXCEPTION - if (qpol_module_create_from_file(path, &m)) { -@@ -239,7 +239,7 @@ typedef struct qpol_module {} qpol_module_t; - fail: - return NULL; - }; -- ~qpol_module_t() { -+ ~qpol_module() { - qpol_module_destroy(&self); - }; - const char *get_path() { -@@ -330,7 +330,7 @@ typedef enum qpol_capability - } qpol_capability_e; - - %extend qpol_policy_t { -- qpol_policy_t(const char *path, const int options) { -+ qpol_policy(const char *path, const int options) { - qpol_policy_t *p; - BEGIN_EXCEPTION - if (qpol_policy_open_from_file(path, &p, qpol_swig_message_callback, qpol_swig_message_callback_arg, options) < 0) { -@@ -341,7 +341,7 @@ typedef enum qpol_capability - fail: - return NULL; - } -- ~qpol_policy_t() { -+ ~qpol_policy() { - qpol_policy_destroy(&self); - }; - void reevaluate_conds() { -@@ -687,14 +687,14 @@ typedef enum qpol_capability - typedef struct qpol_iterator {} qpol_iterator_t; - %extend qpol_iterator_t { - /* user never directly creates, but SWIG expects a constructor */ -- qpol_iterator_t() { -+ qpol_iterator() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_TypeError, "User may not create iterators difectly"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_iterator_t() { -+ ~qpol_iterator() { - qpol_iterator_destroy(&self); - }; - void *get_item() { -@@ -736,7 +736,7 @@ typedef struct qpol_iterator {} qpol_iterator_t; - /* qpol type */ - typedef struct qpol_type {} qpol_type_t; - %extend qpol_type_t { -- qpol_type_t(qpol_policy_t *p, const char *name) { -+ qpol_type(qpol_policy_t *p, const char *name) { - BEGIN_EXCEPTION - const qpol_type_t *t; - if (qpol_policy_get_type_by_name(p, name, &t)) { -@@ -747,7 +747,7 @@ typedef struct qpol_type {} qpol_type_t; - fail: - return NULL; - }; -- ~qpol_type_t() { -+ ~qpol_type() { - /* no op */ - return; - }; -@@ -851,7 +851,7 @@ typedef struct qpol_type {} qpol_type_t; - /* qpol role */ - typedef struct qpol_role {} qpol_role_t; - %extend qpol_role_t { -- qpol_role_t(qpol_policy_t *p, const char *name) { -+ qpol_role(qpol_policy_t *p, const char *name) { - const qpol_role_t *r; - BEGIN_EXCEPTION - if (qpol_policy_get_role_by_name(p, name, &r)) { -@@ -862,7 +862,7 @@ typedef struct qpol_role {} qpol_role_t; - fail: - return NULL; - }; -- ~qpol_role_t() { -+ ~qpol_role() { - /* no op */ - return; - }; -@@ -919,7 +919,7 @@ typedef struct qpol_role {} qpol_role_t; - /* qpol level */ - typedef struct qpol_level {} qpol_level_t; - %extend qpol_level_t { -- qpol_level_t(qpol_policy_t *p, const char *name) { -+ qpol_level(qpol_policy_t *p, const char *name) { - const qpol_level_t *l; - BEGIN_EXCEPTION - if (qpol_policy_get_level_by_name(p, name, &l)) { -@@ -930,7 +930,7 @@ typedef struct qpol_level {} qpol_level_t; - fail: - return NULL; - }; -- ~qpol_level_t() { -+ ~qpol_level() { - /* no op */ - return; - }; -@@ -997,7 +997,7 @@ typedef struct qpol_level {} qpol_level_t; - /* qpol cat */ - typedef struct qpol_cat {} qpol_cat_t; - %extend qpol_cat_t { -- qpol_cat_t(qpol_policy_t *p, const char *name) { -+ qpol_cat(qpol_policy_t *p, const char *name) { - const qpol_cat_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_cat_by_name(p, name, &c)) { -@@ -1008,7 +1008,7 @@ typedef struct qpol_cat {} qpol_cat_t; - fail: - return NULL; - }; -- ~qpol_cat_t() { -+ ~qpol_cat() { - /* no op */ - return; - }; -@@ -1064,14 +1064,14 @@ typedef struct qpol_cat {} qpol_cat_t; - /* qpol mls range */ - typedef struct qpol_mls_range {} qpol_mls_range_t; - %extend qpol_mls_range_t { -- qpol_mls_range_t() { -+ qpol_mls_range() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_range_t objects"); - END_EXCEPTION - fail: - return NULL; - } -- ~qpol_mls_range_t() { -+ ~qpol_mls_range() { - /* no op */ - return; - }; -@@ -1105,14 +1105,14 @@ typedef struct qpol_mls_range {} qpol_mls_range_t; - /* qpol mls level */ - typedef struct qpol_mls_level {} qpol_mls_level_t; - %extend qpol_mls_level_t { -- qpol_mls_level_t() { -+ qpol_mls_level() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_level_t objects"); - END_EXCEPTION - fail: - return NULL; - } -- ~qpol_mls_level_t() { -+ ~qpol_mls_level() { - /* no op */ - return; - }; -@@ -1147,7 +1147,7 @@ typedef struct qpol_mls_level {} qpol_mls_level_t; - /* qpol user */ - typedef struct qpol_user {} qpol_user_t; - %extend qpol_user_t { -- qpol_user_t(qpol_policy_t *p, const char *name) { -+ qpol_user(qpol_policy_t *p, const char *name) { - const qpol_user_t *u; - BEGIN_EXCEPTION - if (qpol_policy_get_user_by_name(p, name, &u)) { -@@ -1158,7 +1158,7 @@ typedef struct qpol_user {} qpol_user_t; - fail: - return NULL; - }; -- ~qpol_user_t() { -+ ~qpol_user() { - /* no op */ - return; - }; -@@ -1223,7 +1223,7 @@ typedef struct qpol_user {} qpol_user_t; - /* qpol bool */ - typedef struct qpol_bool {} qpol_bool_t; - %extend qpol_bool_t { -- qpol_bool_t(qpol_policy_t *p, const char *name) { -+ qpol_bool(qpol_policy_t *p, const char *name) { - qpol_bool_t *b; - BEGIN_EXCEPTION - if (qpol_policy_get_bool_by_name(p, name, &b)) { -@@ -1233,7 +1233,7 @@ typedef struct qpol_bool {} qpol_bool_t; - fail: - return b; - }; -- ~qpol_bool_t() { -+ ~qpol_bool() { - /* no op */ - return; - }; -@@ -1295,14 +1295,14 @@ typedef struct qpol_bool {} qpol_bool_t; - /* qpol context */ - typedef struct qpol_context {} qpol_context_t; - %extend qpol_context_t { -- qpol_context_t() { -+ qpol_context() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_context_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_context_t() { -+ ~qpol_context() { - /* no op */ - return; - }; -@@ -1356,7 +1356,7 @@ typedef struct qpol_context {} qpol_context_t; - /* qpol class */ - typedef struct qpol_class {} qpol_class_t; - %extend qpol_class_t { -- qpol_class_t(qpol_policy_t *p, const char *name) { -+ qpol_class(qpol_policy_t *p, const char *name) { - const qpol_class_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_class_by_name(p, name, &c)) { -@@ -1366,7 +1366,7 @@ typedef struct qpol_class {} qpol_class_t; - fail: - return (qpol_class_t*)c; - }; -- ~qpol_class_t() { -+ ~qpol_class() { - /* no op */ - return; - }; -@@ -1443,7 +1443,7 @@ typedef struct qpol_class {} qpol_class_t; - /* qpol common */ - typedef struct qpol_common {} qpol_common_t; - %extend qpol_common_t { -- qpol_common_t(qpol_policy_t *p, const char *name) { -+ qpol_common(qpol_policy_t *p, const char *name) { - const qpol_common_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_common_by_name(p, name, &c)) { -@@ -1453,7 +1453,7 @@ typedef struct qpol_common {} qpol_common_t; - fail: - return (qpol_common_t*)c; - }; -- ~qpol_common_t() { -+ ~qpol_common() { - /* no op */ - return; - }; -@@ -1515,7 +1515,7 @@ typedef struct qpol_common {} qpol_common_t; - #define QPOL_FS_USE_PSID 6U - #endif - typedef struct qpol_fs_use {} qpol_fs_use_t; --%extend qpol_fs_use_t { -+%extend qpol_fs_use { - qpol_fs_use_t(qpol_policy_t *p, const char *name) { - const qpol_fs_use_t *f; - BEGIN_EXCEPTION -@@ -1526,7 +1526,7 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; - fail: - return (qpol_fs_use_t*)f; - }; -- ~qpol_fs_use_t() { -+ ~qpol_fs_use() { - /* no op */ - return; - }; -@@ -1594,7 +1594,7 @@ typedef struct qpol_fs_use {} qpol_fs_use_t; - #endif - typedef struct qpol_genfscon {} qpol_genfscon_t; - %extend qpol_genfscon_t { -- qpol_genfscon_t(qpol_policy_t *p, const char *name, const char *path) { -+ qpol_genfscon(qpol_policy_t *p, const char *name, const char *path) { - qpol_genfscon_t *g; - BEGIN_EXCEPTION - if (qpol_policy_get_genfscon_by_name(p, name, path, &g)) { -@@ -1604,7 +1604,7 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; - fail: - return g; - }; -- ~qpol_genfscon_t() { -+ ~qpol_genfscon() { - free(self); - }; - const char *get_name(qpol_policy_t *p) { -@@ -1656,7 +1656,7 @@ typedef struct qpol_genfscon {} qpol_genfscon_t; - - /* qpol isid */ - typedef struct qpol_isid {} qpol_isid_t; --%extend qpol_isid_t { -+%extend qpol_isid { - qpol_isid_t(qpol_policy_t *p, const char *name) { - const qpol_isid_t *i; - BEGIN_EXCEPTION -@@ -1667,7 +1667,7 @@ typedef struct qpol_isid {} qpol_isid_t; - fail: - return (qpol_isid_t*)i; - }; -- ~qpol_isid_t() { -+ ~qpol_isid() { - /* no op */ - return; - }; -@@ -1701,7 +1701,7 @@ typedef struct qpol_isid {} qpol_isid_t; - /* qpol netifcon */ - typedef struct qpol_netifcon {} qpol_netifcon_t; - %extend qpol_netifcon_t { -- qpol_netifcon_t(qpol_policy_t *p, const char *name) { -+ qpol_netifcon(qpol_policy_t *p, const char *name) { - const qpol_netifcon_t *n; - BEGIN_EXCEPTION - if (qpol_policy_get_netifcon_by_name(p, name, &n)) { -@@ -1711,7 +1711,7 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; - fail: - return (qpol_netifcon_t*)n; - }; -- ~qpol_netifcon_t() { -+ ~qpol_netifcon() { - /* no op */ - return; - }; -@@ -1757,7 +1757,7 @@ typedef struct qpol_netifcon {} qpol_netifcon_t; - #define QPOL_IPV6 1 - typedef struct qpol_nodecon {} qpol_nodecon_t; - %extend qpol_nodecon_t { -- qpol_nodecon_t(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { -+ qpol_nodecon(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { - uint32_t a[4], m[4]; - qpol_nodecon_t *n; - BEGIN_EXCEPTION -@@ -1772,7 +1772,7 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; - fail: - return n; - } -- ~qpol_nodecon_t() { -+ ~qpol_nodecon() { - free(self); - }; - uint32_t *get_addr(qpol_policy_t *p) { -@@ -1830,7 +1830,7 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; - #define IPPROTO_UDP 17 - typedef struct qpol_portcon {} qpol_portcon_t; - %extend qpol_portcon_t { -- qpol_portcon_t(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { -+ qpol_portcon(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { - const qpol_portcon_t *qp; - BEGIN_EXCEPTION - if (qpol_policy_get_portcon_by_port(p, low, high, protocol, &qp)) { -@@ -1840,7 +1840,7 @@ typedef struct qpol_portcon {} qpol_portcon_t; - fail: - return (qpol_portcon_t*)qp; - }; -- ~qpol_portcon_t() { -+ ~qpol_portcon() { - /* no op */ - return; - }; -@@ -1893,7 +1893,7 @@ typedef struct qpol_portcon {} qpol_portcon_t; - - /* qpol constraint */ - typedef struct qpol_constraint {} qpol_constraint_t; --%extend qpol_constraint_t { -+%extend qpol_constraint { - qpol_constraint_t() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_t objects"); -@@ -1901,7 +1901,7 @@ typedef struct qpol_constraint {} qpol_constraint_t; - fail: - return NULL; - }; -- ~qpol_constraint_t() { -+ ~qpol_constraint() { - free(self); - }; - const qpol_class_t *get_class(qpol_policy_t *p) { -@@ -1945,7 +1945,7 @@ typedef struct qpol_constraint {} qpol_constraint_t; - - /* qpol validatetrans */ - typedef struct qpol_validatetrans {} qpol_validatetrans_t; --%extend qpol_validatetrans_t { -+%extend qpol_validatetrans { - qpol_validatetrans_t() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_validatetrans_t objects"); -@@ -1953,7 +1953,7 @@ typedef struct qpol_validatetrans {} qpol_validatetrans_t; - fail: - return NULL; - }; -- ~qpol_validatetrans_t() { -+ ~qpol_validatetrans() { - free(self); - }; - const qpol_class_t *get_class(qpol_policy_t *p) { -@@ -2011,14 +2011,14 @@ typedef struct qpol_validatetrans {} qpol_validatetrans_t; - #define QPOL_CEXPR_OP_INCOMP 5 - typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; - %extend qpol_constraint_expr_node_t { -- qpol_constraint_expr_node_t() { -+ qpol_constraint_expr_node() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_expr_node_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_constraint_expr_node_t() { -+ ~qpol_constraint_expr_node() { - /* no op */ - return; - }; -@@ -2073,14 +2073,14 @@ typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; - /* qpol role allow */ - typedef struct qpol_role_allow {} qpol_role_allow_t; - %extend qpol_role_allow_t { -- qpol_role_allow_t() { -+ qpol_role_allow() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_allow_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_role_allow_t() { -+ ~qpol_role_allow() { - /* no op */ - return; - }; -@@ -2114,14 +2114,14 @@ typedef struct qpol_role_allow {} qpol_role_allow_t; - /* qpol role trans */ - typedef struct qpol_role_trans {} qpol_role_trans_t; - %extend qpol_role_trans_t { -- qpol_role_trans_t() { -+ qpol_role_trans() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_trans_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_role_trans_t() { -+ ~qpol_role_trans() { - /* no op */ - return; - }; -@@ -2165,14 +2165,14 @@ typedef struct qpol_role_trans {} qpol_role_trans_t; - /* qpol range trans */ - typedef struct qpol_range_trans {} qpol_range_trans_t; - %extend qpol_range_trans_t { -- qpol_range_trans_t() { -+ qpol_range_trans() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_range_trans_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_range_trans_t() { -+ ~qpol_range_trans() { - /* no op */ - return; - }; -@@ -2228,14 +2228,14 @@ typedef struct qpol_range_trans {} qpol_range_trans_t; - #define QPOL_RULE_DONTAUDIT 4 - typedef struct qpol_avrule {} qpol_avrule_t; - %extend qpol_avrule_t { -- qpol_avrule_t() { -+ qpol_avrule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_avrule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_avrule_t() { -+ ~qpol_avrule() { - /* no op */ - return; - }; -@@ -2348,14 +2348,14 @@ typedef struct qpol_avrule {} qpol_avrule_t; - #define QPOL_RULE_TYPE_MEMBER 32 - typedef struct qpol_terule {} qpol_terule_t; - %extend qpol_terule_t { -- qpol_terule_t() { -+ qpol_terule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_terule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_terule_t() { -+ ~qpol_terule() { - /* no op */ - return; - }; -@@ -2464,14 +2464,14 @@ typedef struct qpol_terule {} qpol_terule_t; - /* qpol conditional */ - typedef struct qpol_cond {} qpol_cond_t; - %extend qpol_cond_t { -- qpol_cond_t() { -+ qpol_cond() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_cond_t() { -+ ~qpol_cond() { - /* no op */ - return; - }; -@@ -2557,14 +2557,14 @@ typedef struct qpol_cond {} qpol_cond_t; - #define QPOL_COND_EXPR_NEQ 7 /* bool != bool */ - typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; - %extend qpol_cond_expr_node_t { -- qpol_cond_expr_node_t() { -+ qpol_cond_expr_node() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_expr_node_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_cond_expr_node_t() { -+ ~qpol_cond_expr_node() { - /* no op */ - return; - }; -@@ -2602,14 +2602,14 @@ typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; - /* qpol type set */ - typedef struct qpol_type_set {} qpol_type_set_t; - %extend qpol_type_set_t { -- qpol_type_set_t() { -+ qpol_type_set() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_type_set_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_type_set_t() { -+ ~qpol_type_set() { - /* no op */ - return; - }; -@@ -2665,14 +2665,14 @@ typedef struct qpol_type_set {} qpol_type_set_t; - /* qpol syn av rule */ - typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; - %extend qpol_syn_avrule_t { -- qpol_syn_avrule_t() { -+ qpol_syn_avrule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_avrule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_syn_avrule_t() { -+ ~qpol_syn_avrule() { - /* no op */ - return; - }; -@@ -2778,14 +2778,14 @@ typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; - /* qpol syn te rule */ - typedef struct qpol_syn_terule {} qpol_syn_terule_t; - %extend qpol_syn_terule_t { -- qpol_syn_terule_t() { -+ qpol_syn_terule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_terule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_syn_terule_t() { -+ ~qpol_syn_terule() { - /* no op */ - return; - }; --- -1.8.5.3 - diff --git a/0004-Apply-selinux_current_policy_path-patch.patch b/0004-Apply-selinux_current_policy_path-patch.patch deleted file mode 100644 index 14cdbb6..0000000 --- a/0004-Apply-selinux_current_policy_path-patch.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 85a12d481d664120865b46cd1c4c325307179471 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 10:53:54 +0200 -Subject: [PATCH 04/11] Apply selinux_current_policy_path patch - ---- - libqpol/src/util.c | 73 ++++-------------------------------------------------- - 1 file changed, 5 insertions(+), 68 deletions(-) - -diff --git a/libqpol/src/util.c b/libqpol/src/util.c -index 7c49876..8f74b2b 100644 ---- a/libqpol/src/util.c -+++ b/libqpol/src/util.c -@@ -84,75 +84,12 @@ static int get_binpol_version(const char *policy_fname) - - static int search_policy_binary_file(char **path) - { -- const char *binary_path; -- if ((binary_path = selinux_binary_policy_path()) == NULL) { -- return -1; -- } -- -- int expected_version = -1, latest_version = -1; --#ifdef LIBSELINUX -- /* if the system has SELinux enabled, prefer the policy whose -- name matches the current policy version */ -- if ((expected_version = security_policyvers()) < 0) { -- return -1; -- } --#endif -- -- glob_t glob_buf; -- struct stat fs; -- int rt, error = 0, retval = -1; -- size_t i; -- char *pattern = NULL; -- if (asprintf(&pattern, "%s.*", binary_path) < 0) { -- return -1; -- } -- glob_buf.gl_offs = 1; -- glob_buf.gl_pathc = 0; -- rt = glob(pattern, GLOB_DOOFFS, NULL, &glob_buf); -- if (rt != 0 && rt != GLOB_NOMATCH) { -- errno = EIO; -- return -1; -- } -- -- for (i = 0; i < glob_buf.gl_pathc; i++) { -- char *p = glob_buf.gl_pathv[i + glob_buf.gl_offs]; -- if (stat(p, &fs) != 0) { -- error = errno; -- goto cleanup; -- } -- if (S_ISDIR(fs.st_mode)) -- continue; -- -- if ((rt = get_binpol_version(p)) < 0) { -- error = errno; -- goto cleanup; -- } -- -- if (rt > latest_version || rt == expected_version) { -- free(*path); -- if ((*path = strdup(p)) == NULL) { -- error = errno; -- goto cleanup; -- } -- if (rt == expected_version) { -- break; -- } -- latest_version = rt; -- } -- } -- -- if (*path == NULL) { -- retval = 1; -- } else { -- retval = 0; -- } -- cleanup: -- free(pattern); -- globfree(&glob_buf); -- if (retval == -1) { -- errno = error; -+ const char *binary_path = selinux_current_policy_path(); -+ if (binary_path) { -+ *path = strdup(binary_path); -+ if (*path) return 0; - } -- return retval; -+ return -1; - } - - int qpol_default_policy_find(char **path) --- -1.8.5.3 - diff --git a/0004-Fix-man-pages-and-getoptions.patch b/0004-Fix-man-pages-and-getoptions.patch deleted file mode 100644 index c06270e..0000000 --- a/0004-Fix-man-pages-and-getoptions.patch +++ /dev/null @@ -1,78 +0,0 @@ -From b3c8ef5822dbf3e3272fc29627ddac7e20e936d5 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:41:12 -0400 -Subject: [PATCH 4/6] Fix-man-pages-and-getoptions - ---- - man/replcon.1 | 2 ++ - man/seinfo.1 | 6 +++++- - seaudit/seaudit-report.c | 2 +- - sediff/sediff.c | 2 +- - 4 files changed, 9 insertions(+), 3 deletions(-) - -diff --git a/man/replcon.1 b/man/replcon.1 -index 8aca08a..478dc51 100644 ---- a/man/replcon.1 -+++ b/man/replcon.1 -@@ -44,6 +44,8 @@ Search for files which include PATH. - .IP "-c CLASS, --class=CLASS" - Search only files of object class CLASS. - .SH OPTIONS -+.IP "-R, --regex" -+Enable regular expressions - .IP "-v, --verbose" - Display context info during replacement. - .IP "-h, --help" -diff --git a/man/seinfo.1 b/man/seinfo.1 -index 8612119..6bc17db 100644 ---- a/man/seinfo.1 -+++ b/man/seinfo.1 -@@ -76,6 +76,10 @@ There is no expanded information for this component. - .IP "--nodecon[=ADDR]" - Print a list of node contexts or, if ADDR is provided, print the statement for the node with address ADDR. - There is no expanded information for this component. -+.IP "--polcap" -+Print policy capabilities. -+.IP "--permissive" -+Print permissive types. - .IP "--portcon[=PORT]" - Print a list of port contexts or, if PORT is provided, print the statement for port PORT. - There is no expanded information for this component. -@@ -93,7 +97,7 @@ These details include the types assigned to an attribute or role and the permiss - This option is not available for all component types; see the description of each component for the details this option will provide. - .IP "--stats" - Print policy statistics including policy type and version information and counts of all components and rules. --.IP "-l" -+.IP "-l, --line-breaks" - Print line breaks when displaying constraint statements. - .IP "-h, --help" - Print help information and exit. -diff --git a/seaudit/seaudit-report.c b/seaudit/seaudit-report.c -index af3c6fb..d436c18 100644 ---- a/seaudit/seaudit-report.c -+++ b/seaudit/seaudit-report.c -@@ -100,7 +100,7 @@ static void seaudit_report_info_usage(const char *program_name, int brief) - printf(" -s, --stdin read log data from standard input\n"); - printf(" -m, --malformed include malformed log messages\n"); - printf(" -o FILE, --output=FILE output to FILE\n"); -- printf(" --config=FILE read configuration from FILE\n"); -+ printf(" -c FILE, --config=FILE read configuration from FILE\n"); - printf(" --html set output format to HTML\n"); - printf(" --stylesheet=FILE HTML style sheet for formatting HTML report\n"); - printf(" (ignored if --html is not given)\n"); -diff --git a/sediff/sediff.c b/sediff/sediff.c -index 6022775..341c650 100644 ---- a/sediff/sediff.c -+++ b/sediff/sediff.c -@@ -420,7 +420,7 @@ int main(int argc, char **argv) - poldiff_t *diff = NULL; - size_t total = 0; - -- while ((optc = getopt_long(argc, argv, "ctarubANDLMCRqhV", longopts, NULL)) != -1) { -+ while ((optc = getopt_long(argc, argv, "ctarubAqhV", longopts, NULL)) != -1) { - switch (optc) { - case 0: - break; --- -1.7.6.2 - diff --git a/0005-Apply-seaudit-patch-for-progress.c.patch b/0005-Apply-seaudit-patch-for-progress.c.patch deleted file mode 100644 index 29e5a0c..0000000 --- a/0005-Apply-seaudit-patch-for-progress.c.patch +++ /dev/null @@ -1,24 +0,0 @@ -From ba8e76cd514e8ce92a48931963e97fe79589a71a Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 11:12:37 +0200 -Subject: [PATCH 05/11] Apply seaudit patch for progress.c - ---- - libqpol/swig/java/Makefile.am | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/libqpol/swig/java/Makefile.am b/libqpol/swig/java/Makefile.am -index a25eacb..533b55a 100644 ---- a/libqpol/swig/java/Makefile.am -+++ b/libqpol/swig/java/Makefile.am -@@ -48,7 +48,6 @@ BUILT_SOURCES = qpol_wrap.c \ - qpol_type_t.java \ - qpol_user_t.java \ - qpol_validatetrans_t.java \ -- SWIGTYPE_p_int.java \ - SWIGTYPE_p_unsigned_int.java \ - SWIGTYPE_p_void.java - --- -1.8.5.3 - diff --git a/0005-Fix-sepol-calls-to-work-with-latest-libsepol.patch b/0005-Fix-sepol-calls-to-work-with-latest-libsepol.patch deleted file mode 100644 index 01f545d..0000000 --- a/0005-Fix-sepol-calls-to-work-with-latest-libsepol.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 2b58d92add64b53b16cbb438e7b69e85d046afd1 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:46:38 -0400 -Subject: [PATCH 5/6] Fix sepol calls to work with latest libsepol - ---- - configure.ac | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/configure.ac b/configure.ac -index e837e03..3c11e23 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -505,7 +505,7 @@ AC_COMPILE_IFELSE( - [AC_LANG_SOURCE([ - #include - int main () { -- return role_set_expand(NULL, NULL, NULL, NULL); -+ return role_set_expand(NULL, NULL, NULL, NULL, NULL); - }])], - sepol_new_user_role_mapping="yes", - sepol_new_user_role_mapping="no") -@@ -541,7 +541,7 @@ if test ${sepol_check_boolmap} = "yes"; then - [AC_LANG_SOURCE([ - #include - int main () { -- return expand_module_avrules(NULL, NULL, NULL, NULL, NULL, 0, 0); -+ return expand_module_avrules(NULL, NULL, NULL, NULL, NULL, 0, 0, 0, 0); - }])], - AC_MSG_RESULT([yes]), - AC_MSG_ERROR([this version of libsepol is incompatible with SETools])) --- -1.7.6.2 - diff --git a/0006-Add-support-for-boolean-subs.patch b/0006-Add-support-for-boolean-subs.patch deleted file mode 100644 index a495755..0000000 --- a/0006-Add-support-for-boolean-subs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 61d3d40e791a4ac392930f11785e4057f67a5b09 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 11:14:50 +0200 -Subject: [PATCH 06/11] Add support for boolean subs - ---- - secmds/seinfo.c | 2 +- - secmds/sesearch.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/secmds/seinfo.c b/secmds/seinfo.c -index a970890..54b2a6a 100644 ---- a/secmds/seinfo.c -+++ b/secmds/seinfo.c -@@ -1720,7 +1720,7 @@ int main(int argc, char **argv) - case 'b': /* conditional booleans */ - bools = 1; - if (optarg != 0) -- bool_name = optarg; -+ bool_name = selinux_boolean_sub(optarg); - break; - case OPT_INITIALSID: - isids = 1; -diff --git a/secmds/sesearch.c b/secmds/sesearch.c -index 387d526..e1436a7 100644 ---- a/secmds/sesearch.c -+++ b/secmds/sesearch.c -@@ -1067,7 +1067,7 @@ int main(int argc, char **argv) - printf("Missing boolean for -b (--bool)\n"); - exit(1); - } -- cmd_opts.bool_name = strdup(optarg); -+ cmd_opts.bool_name = strdup(selinux_boolean_sub(optarg)); - if (!cmd_opts.bool_name) { - fprintf(stderr, "%s\n", strerror(errno)); - exit(1); --- -1.8.5.3 - diff --git a/0006-Changes-to-support-named-file_trans-rules.patch b/0006-Changes-to-support-named-file_trans-rules.patch deleted file mode 100644 index 3cd7127..0000000 --- a/0006-Changes-to-support-named-file_trans-rules.patch +++ /dev/null @@ -1,1505 +0,0 @@ -From 287f507657e162bc09b5c186bbd580901fbc942a Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 15:47:28 -0400 -Subject: [PATCH 6/6] Changes to support named file_trans rules - ---- - libapol/include/apol/ftrule-query.h | 198 +++++++++++++++++++ - libapol/include/apol/policy-query.h | 1 + - libapol/src/Makefile.am | 1 + - libapol/src/ftrule-query.c | 363 +++++++++++++++++++++++++++++++++++ - libapol/src/libapol.map | 1 + - libqpol/include/qpol/ftrule_query.h | 116 +++++++++++ - libqpol/include/qpol/policy.h | 1 + - libqpol/src/Makefile.am | 1 + - libqpol/src/ftrule_query.c | 277 ++++++++++++++++++++++++++ - libqpol/src/libqpol.map | 1 + - libqpol/src/module_compiler.c | 12 ++ - libqpol/src/policy_define.c | 186 ++++++++++++++++++- - libqpol/src/policy_parse.y | 13 +- - libqpol/src/policy_scan.l | 1 + - secmds/sesearch.c | 101 ++++++++++ - 15 files changed, 1270 insertions(+), 3 deletions(-) - create mode 100644 libapol/include/apol/ftrule-query.h - create mode 100644 libapol/src/ftrule-query.c - create mode 100644 libqpol/include/qpol/ftrule_query.h - create mode 100644 libqpol/src/ftrule_query.c - -diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h -new file mode 100644 -index 0000000..119c52f ---- /dev/null -+++ b/libapol/include/apol/ftrule-query.h -@@ -0,0 +1,198 @@ -+/** -+ * @file -+ * -+ * Routines to query filename_transition rules of a -+ * policy. -+ * -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Jason Tang jtang@tresys.com -+ * -+ * Copyright (C) 2006-2007 Tresys Technology, LLC -+ * -+ * This library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+#ifndef APOL_FILENAMERULE_QUERY_H -+#define APOL_FILENAMERULE_QUERY_H -+ -+#ifdef __cplusplus -+extern "C" -+{ -+#endif -+ -+#include "policy.h" -+#include "vector.h" -+#include -+ -+ typedef struct apol_filename_trans_query apol_filename_trans_query_t; -+ -+ -+/******************** filename_transition queries ********************/ -+ -+/** -+ * Execute a query against all filename_transition rules within the -+ * policy. -+ * -+ * @param p Policy within which to look up filename_transition rules. -+ * @param r Structure containing parameters for query. If this is -+ * NULL then return all filename_transition rules. -+ * @param v Reference to a vector of qpol_filename_trans_t. The vector -+ * will be allocated by this function. The caller must call -+ * apol_vector_destroy() afterwards. This will be set to NULL upon no -+ * results or upon error. -+ * -+ * @return 0 on success (including none found), negative on error. -+ */ -+ extern int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * r, apol_vector_t ** v); -+ -+/** -+ * Allocate and return a new filename trans query structure. All fields -+ * are initialized, such that running this blank query results in -+ * returning all filename_transitions within the policy. The caller must -+ * call apol_filename_trans_query_destroy() upon the return value -+ * afterwards. -+ * -+ * @return An initialized filename trans query structure, or NULL upon -+ * error. -+ */ -+ extern apol_filename_trans_query_t *apol_filename_trans_query_create(void); -+ -+/** -+ * Deallocate all memory associated with the referenced filename trans -+ * query, and then set it to NULL. This function does nothing if the -+ * query is already NULL. -+ * -+ * @param r Reference to a filename trans query structure to destroy. -+ */ -+ extern void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r); -+ -+/** -+ * Set a filename_trans query to return rules whose source symbol matches -+ * symbol. Symbol may be a type or attribute; if it is an alias then -+ * the query will convert it to its primary prior to searching. If -+ * is_indirect is non-zero then the search will be done indirectly. -+ * If the symbol is a type, then the query matches rules with one of -+ * the type's attributes. If the symbol is an attribute, then it -+ * matches rule with any of the attribute's types. -+ * -+ * @param p Policy handler, to report errors. -+ * @param t TE rule query to set. -+ * @param symbol Limit query to rules with this symbol as their -+ * source, or NULL to unset this field. -+ * @param is_indirect If non-zero, perform indirect matching. -+ * -+ * @return 0 on success, negative on error. -+ */ -+ extern int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol, -+ int is_indirect); -+ -+/** -+ * Set a filename trans query to return rules with a particular target -+ * symbol. Symbol may be a type or attribute; if it is an alias then -+ * the query will convert it to its primary prior to searching. If -+ * is_indirect is non-zero then the search will be done indirectly. -+ * If the symbol is a type, then the query matches rules with one of -+ * the type's attributes. If the symbol is an attribute, then it -+ * matches rule with any of the attribute's types. -+ * -+ * @param p Policy handler, to report errors. -+ * @param r Role trans query to set. -+ * @param symbol Limit query to rules with this type or attribute as -+ * their target, or NULL to unset this field. -+ * @param is_indirect If non-zero, perform indirect matching. -+ * -+ * @return 0 on success, negative on error. -+ */ -+ extern int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *symbol, -+ int is_indirect); -+ -+/** -+ * Set a filename trans query to return rules with a particular default -+ * filename. This field is ignored if -+ * apol_filename_trans_query_set_source_any() is set to non-zero. -+ * -+ * @param p Policy handler, to report errors. -+ * @param r Role trans query to set. -+ * @param filename Limit query to rules with this filename as their default, or -+ * NULL to unset this field. -+ * -+ * @return 0 on success, negative on error. -+ */ -+ extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename); -+ -+/** -+ * Set at filename_trans query to return rules with this object (non-common) -+ * class. If more than one class are appended to the query, the -+ * rule's class must be one of those appended. (I.e., the rule's -+ * class must be a member of the query's classes.) Pass a NULL to -+ * clear all classes. Note that this performs straight string -+ * comparison, ignoring the regex flag. -+ -+ * -+ * @param p Policy handler, to report errors. -+ * @param t TE rule query to set. -+ * @param obj_class Name of object class to add to search set. -+ * -+ * @return 0 on success, negative on error. -+ */ -+ extern int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class); -+ -+/** -+ * Set a filename trans query to treat the source filename as any. That is, -+ * use the same symbol for either source or default of a -+ * filename_transition rule. This flag does nothing if the source filename is -+ * not set. Note that a filename_transition's target is a type, so thus -+ * this flag does not affect its searching. -+ * -+ * @param p Policy handler, to report errors. -+ * @param r Role trans query to set. -+ * @param is_any Non-zero to use source symbol for source or default -+ * field, 0 to keep source as only source. -+ * -+ * @return Always 0. -+ */ -+ extern int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_any); -+ -+/** -+ * Set a filename trans query to use regular expression searching for -+ * source, target, and default fields. Strings will be treated as -+ * regexes instead of literals. For the target type, matching will -+ * occur against the type name or any of its aliases. -+ * -+ * @param p Policy handler, to report errors. -+ * @param r Role trans query to set. -+ * @param is_regex Non-zero to enable regex searching, 0 to disable. -+ * -+ * @return Always 0. -+ */ -+ extern int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_regex); -+ -+/** -+ * Render a filename_transition rule to a string. -+ * -+ * @param policy Policy handler, to report errors. -+ * @param rule The rule to render. -+ * -+ * @return A newly malloc()'d string representation of the rule, or NULL on -+ * failure; if the call fails, errno will be set. The caller is responsible -+ * for calling free() on the returned string. -+ */ -+ extern char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * rule); -+ -+#ifdef __cplusplus -+} -+#endif -+ -+#endif -diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h -index 315f70e..665e4cb 100644 ---- a/libapol/include/apol/policy-query.h -+++ b/libapol/include/apol/policy-query.h -@@ -71,6 +71,7 @@ extern "C" - #include "terule-query.h" - #include "condrule-query.h" - #include "rbacrule-query.h" -+#include "ftrule-query.h" - #include "range_trans-query.h" - #include "constraint-query.h" - -diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am -index 3fa4f06..baaa4f6 100644 ---- a/libapol/src/Makefile.am -+++ b/libapol/src/Makefile.am -@@ -40,6 +40,7 @@ libapol_a_SOURCES = \ - render.c \ - role-query.c \ - terule-query.c \ -+ ftrule-query.c \ - type-query.c \ - types-relation-analysis.c \ - user-query.c \ -diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c -new file mode 100644 -index 0000000..dc248de ---- /dev/null -+++ b/libapol/src/ftrule-query.c -@@ -0,0 +1,363 @@ -+/** -+ * @file -+ * -+ * Provides a way for setools to make queries about type enforcement -+ * filename_transs within a policy. The caller obtains a query object, fills in -+ * its parameters, and then runs the query; it obtains a vector of -+ * results. Searches are conjunctive -- all fields of the search -+ * query must match for a datum to be added to the results query. -+ * -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Jason Tang jtang@tresys.com -+ * -+ * Copyright (C) 2006-2007 Tresys Technology, LLC -+ * -+ * This library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+#include "policy-query-internal.h" -+ -+#include -+#include -+ -+struct apol_filename_trans_query -+{ -+ char *source, *target, *default_type, *name; -+ apol_vector_t *classes; -+ unsigned int flags; -+}; -+ -+ -+/******************** filename_transition queries ********************/ -+ -+int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v) -+{ -+ apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL; -+ int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans; -+ char *bool_name = NULL; -+ *v = NULL; -+ unsigned int flags = 0; -+ qpol_iterator_t *iter = NULL, *type_iter = NULL; -+ -+ if (t != NULL) { -+ flags = t->flags; -+ is_regex = t->flags & APOL_QUERY_REGEX; -+ if (t->source != NULL && -+ (source_list = -+ apol_query_create_candidate_type_list(p, t->source, is_regex, -+ t->flags & APOL_QUERY_SOURCE_INDIRECT, -+ ((t->flags & (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE)) / -+ APOL_QUERY_SOURCE_TYPE))) == NULL) { -+ goto cleanup; -+ } -+ -+ if ((t->flags & APOL_QUERY_SOURCE_AS_ANY) && t->source != NULL) { -+ default_list = target_list = source_list; -+ source_as_any = 1; -+ } else { -+ if (t->target != NULL && -+ (target_list = -+ apol_query_create_candidate_type_list(p, t->target, is_regex, -+ t->flags & APOL_QUERY_TARGET_INDIRECT, -+ ((t-> -+ flags & (APOL_QUERY_TARGET_TYPE | APOL_QUERY_TARGET_ATTRIBUTE)) -+ / APOL_QUERY_TARGET_TYPE))) == NULL) { -+ goto cleanup; -+ } -+ if (t->default_type != NULL && -+ (default_list = -+ apol_query_create_candidate_type_list(p, t->default_type, is_regex, 0, -+ APOL_QUERY_SYMBOL_IS_TYPE)) == NULL) { -+ goto cleanup; -+ } -+ } -+ if (t->classes != NULL && -+ apol_vector_get_size(t->classes) > 0 && -+ (class_list = apol_query_create_candidate_class_list(p, t->classes)) == NULL) { -+ goto cleanup; -+ } -+ } -+ -+ if (qpol_policy_get_filename_trans_iter(p->p, &iter) < 0) { -+ return -1; -+ } -+ -+ if ((*v = apol_vector_create(NULL)) == NULL) { -+ ERR(p, "%s", strerror(errno)); -+ goto cleanup; -+ } -+ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ qpol_filename_trans_t *filename_trans; -+ if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) { -+ goto cleanup; -+ } -+ int match_source = 0, match_target = 0, match_default = 0, match_bool = 0; -+ size_t i; -+ -+ if (source_list == NULL) { -+ match_source = 1; -+ } else { -+ const qpol_type_t *source_type; -+ if (qpol_filename_trans_get_source_type(p->p, filename_trans, &source_type) < 0) { -+ goto cleanup; -+ } -+ if (apol_vector_get_index(source_list, source_type, NULL, NULL, &i) == 0) { -+ match_source = 1; -+ } -+ } -+ -+ /* if source did not match, but treating source symbol -+ * as any field, then delay rejecting this filename_trans until -+ * the target and default have been checked */ -+ if (!source_as_any && !match_source) { -+ continue; -+ } -+ -+ if (target_list == NULL || (source_as_any && match_source)) { -+ match_target = 1; -+ } else { -+ const qpol_type_t *target_type; -+ if (qpol_filename_trans_get_target_type(p->p, filename_trans, &target_type) < 0) { -+ goto cleanup; -+ } -+ if (apol_vector_get_index(target_list, target_type, NULL, NULL, &i) == 0) { -+ match_target = 1; -+ } -+ } -+ -+ if (!source_as_any && !match_target) { -+ continue; -+ } -+ -+ if (default_list == NULL || (source_as_any && match_source) || (source_as_any && match_target)) { -+ match_default = 1; -+ } else { -+ const qpol_type_t *default_type; -+ if (qpol_filename_trans_get_default_type(p->p, filename_trans, &default_type) < 0) { -+ goto cleanup; -+ } -+ if (apol_vector_get_index(default_list, default_type, NULL, NULL, &i) == 0) { -+ match_default = 1; -+ } -+ } -+ -+ if (!source_as_any && !match_default) { -+ continue; -+ } -+ /* at least one thing must match if source_as_any was given */ -+ if (source_as_any && (!match_source && !match_target && !match_default)) { -+ continue; -+ } -+ -+ if (class_list != NULL) { -+ const qpol_class_t *obj_class; -+ if (qpol_filename_trans_get_object_class(p->p, filename_trans, &obj_class) < 0) { -+ goto cleanup; -+ } -+ if (apol_vector_get_index(class_list, obj_class, NULL, NULL, &i) < 0) { -+ continue; -+ } -+ } -+ -+ if (apol_vector_append(*v, filename_trans)) { -+ ERR(p, "%s", strerror(ENOMEM)); -+ goto cleanup; -+ } -+ } -+ -+ retval = 0; -+ cleanup: -+ if (retval != 0) { -+ apol_vector_destroy(v); -+ } -+ apol_vector_destroy(&source_list); -+ if (!source_as_any) { -+ apol_vector_destroy(&target_list); -+ apol_vector_destroy(&default_list); -+ } -+ apol_vector_destroy(&class_list); -+ return retval; -+} -+ -+apol_filename_trans_query_t *apol_filename_trans_query_create(void) -+{ -+ apol_filename_trans_query_t *t = calloc(1, sizeof(apol_filename_trans_query_t)); -+ if (t != NULL) { -+ t->flags = -+ (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE | APOL_QUERY_TARGET_TYPE | -+ APOL_QUERY_TARGET_ATTRIBUTE); -+ } -+ return t; -+} -+ -+void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r) -+{ -+ if (r != NULL && *r != NULL) { -+ free((*r)->source); -+ free((*r)->target); -+ free((*r)->default_type); -+ free((*r)->name); -+ free(*r); -+ *r = NULL; -+ } -+} -+ -+int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect) -+{ -+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT); -+ return apol_query_set(p, &t->source, NULL, filename); -+} -+ -+int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect) -+{ -+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT); -+ return apol_query_set(p, &t->target, NULL, type); -+} -+ -+int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol) -+{ -+ return apol_query_set(p, &t->default_type, NULL, symbol); -+} -+ -+int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class) -+{ -+ char *s = NULL; -+ if (obj_class == NULL) { -+ apol_vector_destroy(&t->classes); -+ } else if ((s = strdup(obj_class)) == NULL || (t->classes == NULL && (t->classes = apol_vector_create(free)) == NULL) -+ || apol_vector_append(t->classes, s) < 0) { -+ ERR(p, "%s", strerror(errno)); -+ free(s); -+ return -1; -+ } -+ return 0; -+} -+ -+int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename) -+{ -+ return apol_query_set(p, &t->name, NULL, filename); -+} -+ -+int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_any) -+{ -+ return apol_query_set_flag(p, &t->flags, is_any, APOL_QUERY_SOURCE_AS_ANY); -+} -+ -+int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_regex) -+{ -+ return apol_query_set_regex(p, &t->flags, is_regex); -+} -+ -+char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans) -+{ -+ char *tmp = NULL; -+ const char *tmp_name = NULL; -+ const char *filename_trans_type_str; -+ int error = 0; -+ size_t tmp_sz = 0; -+ uint32_t filename_trans_type = 0; -+ const qpol_type_t *type = NULL; -+ const qpol_class_t *obj_class = NULL; -+ -+ if (!policy || !filename_trans) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return NULL; -+ } -+ -+ /* source type */ -+ if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) { -+ error = errno; -+ goto err; -+ } -+ if (qpol_type_get_name(policy->p, type, &tmp_name)) { -+ error = errno; -+ goto err; -+ } -+ if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ -+ /* target type */ -+ if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) { -+ error = errno; -+ goto err; -+ } -+ if (qpol_type_get_name(policy->p, type, &tmp_name)) { -+ error = errno; -+ goto err; -+ } -+ if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ -+ /* object class */ -+ if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) { -+ error = errno; -+ goto err; -+ } -+ if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) { -+ error = errno; -+ goto err; -+ } -+ if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ -+ /* default type */ -+ if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) { -+ error = errno; -+ goto err; -+ } -+ if (qpol_type_get_name(policy->p, type, &tmp_name)) { -+ error = errno; -+ goto err; -+ } -+ if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ -+ if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) { -+ error = errno; -+ goto err; -+ } -+ -+ if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ -+ if (apol_str_appendf(&tmp, &tmp_sz, ";")) { -+ error = errno; -+ ERR(policy, "%s", strerror(error)); -+ goto err; -+ } -+ return tmp; -+ -+ err: -+ free(tmp); -+ errno = error; -+ return NULL; -+} -diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map -index 4894374..7657a2d 100644 ---- a/libapol/src/libapol.map -+++ b/libapol/src/libapol.map -@@ -34,6 +34,7 @@ VERS_4.0{ - apol_protocol_to_str; - apol_qpol_context_render; - apol_range_trans_*; -+ apol_filename_trans_*; - apol_relabel_*; - apol_role_*; - apol_role_allow_*; -diff --git a/libqpol/include/qpol/ftrule_query.h b/libqpol/include/qpol/ftrule_query.h -new file mode 100644 -index 0000000..1f533a4 ---- /dev/null -+++ b/libqpol/include/qpol/ftrule_query.h -@@ -0,0 +1,116 @@ -+/** -+ * @file -+ * Defines public interface for iterating over FTRULE rules. -+ * -+ * @author Kevin Carr kcarr@tresys.com -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Jason Tang jtang@tresys.com -+ * -+ * Copyright (C) 2006-2007 Tresys Technology, LLC -+ * -+ * This library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+#ifndef QPOL_FTRULERULE_QUERY -+#define QPOL_FTRULERULE_QUERY -+ -+#ifdef __cplusplus -+extern "C" -+{ -+#endif -+ -+#include -+#include -+ -+ typedef struct qpol_filename_trans qpol_filename_trans_t; -+ -+/** -+ * Get an iterator over all filename transition rules in the policy. -+ * @param policy Policy from which to create the iterator. -+ * @param iter Iterator over items of type qpol_filename_trans_t returned. -+ * The caller is responsible for calling qpol_iterator_destroy() -+ * to free memory used by this iterator. -+ * It is important to note that this iterator is only valid as long as -+ * the policy is unmodifed. -+ * @returm 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *iter will be NULL. -+ */ -+ extern int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter); -+ -+/** -+ * Get the source type from a filename transition rule. -+ * @param policy The policy from which the rule comes. -+ * @param rule The rule from which to get the source type. -+ * @param source Pointer in which to store the source type. -+ * The caller should not free this pointer. -+ * @return 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *source will be NULL. -+ */ -+ extern int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const qpol_type_t ** source); -+ -+/** -+ * Get the target type from a filename transition rule. -+ * @param policy The policy from which the rule comes. -+ * @param rule The rule from which to get the target type. -+ * @param target Pointer in which to store the target type. -+ * The caller should not free this pointer. -+ * @return 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *target will be NULL. -+ */ -+ extern int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const qpol_type_t ** target); -+ -+/** -+ * Get the default type from a type rule. -+ * @param policy Policy from which the rule comes. -+ * @param rule The rule from which to get the default type. -+ * @param dflt Pointer in which to store the default type. -+ * The caller should not free this pointer. -+ * @returm 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *dflt will be NULL. -+ */ -+ extern int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const qpol_type_t ** dflt); -+ -+/** -+ * Get the object class from a type rule. -+ * @param policy Policy from which the rule comes. -+ * @param rule The rule from which to get the object class. -+ * @param obj_class Pointer in which to store the object class. -+ * The caller should not free this pointer. -+ * @returm 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *obj_class will be NULL. -+ */ -+ extern int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const qpol_class_t ** obj_class); -+ -+/** -+ * Get the transition filename type from a type rule. -+ * @param policy Policy from which the rule comes. -+ * @param rule The rule from which to get the transition filename. -+ * @param target Pointer in which to store the transition filename. -+ * The caller should not free this pointer. -+ * @returm 0 on success and < 0 on failure; if the call fails, -+ * errno will be set and *target will be NULL. -+ */ -+ extern int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const char ** name); -+ -+#ifdef __cplusplus -+} -+#endif -+ -+#endif /* QPOL_FTRULERULE_QUERY */ -diff --git a/libqpol/include/qpol/policy.h b/libqpol/include/qpol/policy.h -index ae4ea08..bf85718 100644 ---- a/libqpol/include/qpol/policy.h -+++ b/libqpol/include/qpol/policy.h -@@ -55,6 +55,7 @@ extern "C" - #include - #include - #include -+#include - #include - #include - #include -diff --git a/libqpol/src/Makefile.am b/libqpol/src/Makefile.am -index 34d87a6..0889a61 100644 ---- a/libqpol/src/Makefile.am -+++ b/libqpol/src/Makefile.am -@@ -48,6 +48,7 @@ libqpol_a_SOURCES = \ - syn_rule_internal.h \ - syn_rule_query.c \ - terule_query.c \ -+ ftrule_query.c \ - type_query.c \ - user_query.c \ - util.c \ -diff --git a/libqpol/src/ftrule_query.c b/libqpol/src/ftrule_query.c -new file mode 100644 -index 0000000..d6db848 ---- /dev/null -+++ b/libqpol/src/ftrule_query.c -@@ -0,0 +1,277 @@ -+/** -+ * @file -+ * Defines public interface for iterating over RBAC rules. -+ * -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Jason Tang jtang@tresys.com -+ * -+ * Copyright (C) 2006-2007 Tresys Technology, LLC -+ * -+ * This library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public -+ * License as published by the Free Software Foundation; either -+ * version 2.1 of the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public -+ * License along with this library; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+#include -+#include -+#include -+#include -+#include "iterator_internal.h" -+#include "qpol_internal.h" -+#include -+ -+typedef struct filename_trans_state -+{ -+ filename_trans_t *head; -+ filename_trans_t *cur; -+} filename_trans_state_t; -+ -+static int filename_trans_state_end(const qpol_iterator_t * iter) -+{ -+ filename_trans_state_t *fts = NULL; -+ -+ if (!iter || !(fts = qpol_iterator_state(iter))) { -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ return fts->cur ? 0 : 1; -+} -+ -+static void *filename_trans_state_get_cur(const qpol_iterator_t * iter) -+{ -+ filename_trans_state_t *fts = NULL; -+ const policydb_t *db = NULL; -+ -+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter)) || filename_trans_state_end(iter)) { -+ errno = EINVAL; -+ return NULL; -+ } -+ -+ return fts->cur; -+} -+ -+static int filename_trans_state_next(qpol_iterator_t * iter) -+{ -+ filename_trans_state_t *fts = NULL; -+ const policydb_t *db = NULL; -+ -+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) { -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ if (filename_trans_state_end(iter)) { -+ errno = ERANGE; -+ return STATUS_ERR; -+ } -+ -+ fts->cur = fts->cur->next; -+ -+ return STATUS_SUCCESS; -+} -+ -+static size_t filename_trans_state_size(const qpol_iterator_t * iter) -+{ -+ filename_trans_state_t *fts = NULL; -+ const policydb_t *db = NULL; -+ filename_trans_t *tmp = NULL; -+ size_t count = 0; -+ -+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) { -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ for (tmp = fts->head; tmp; tmp = tmp->next) -+ count++; -+ -+ return count; -+} -+ -+int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter) -+{ -+ policydb_t *db = NULL; -+ filename_trans_state_t *fts = NULL; -+ int error = 0; -+ -+ if (iter) -+ *iter = NULL; -+ -+ if (!policy || !iter) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ -+ fts = calloc(1, sizeof(filename_trans_state_t)); -+ if (!fts) { -+ /* errno set by calloc */ -+ ERR(policy, "%s", strerror(errno)); -+ return STATUS_ERR; -+ } -+ fts->head = fts->cur = db->filename_trans; -+ -+ if (qpol_iterator_create -+ (policy, (void *)fts, filename_trans_state_get_cur, filename_trans_state_next, filename_trans_state_end, filename_trans_state_size, -+ free, iter)) { -+ error = errno; -+ free(fts); -+ errno = error; -+ return STATUS_ERR; -+ } -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** source) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (source) { -+ *source = NULL; -+ } -+ -+ if (!policy || !rule || !source) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *source = (qpol_type_t *) db->type_val_to_struct[ft->stype - 1]; -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** target) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (target) { -+ *target = NULL; -+ } -+ -+ if (!policy || !rule || !target) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *target = (qpol_type_t *) db->type_val_to_struct[ft->ttype - 1]; -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, -+ const qpol_class_t ** obj_class) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (obj_class) { -+ *obj_class = NULL; -+ } -+ -+ if (!policy || !rule || !obj_class) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *obj_class = (qpol_class_t *) db->class_val_to_struct[ft->tclass - 1]; -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_trans_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** output_type) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (output_type) { -+ *output_type = NULL; -+ } -+ -+ if (!policy || !rule || !output_type) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *output_type = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1]; -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** dflt) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (dflt) { -+ *dflt = NULL; -+ } -+ -+ if (!policy || !rule || !dflt) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *dflt = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1]; -+ -+ return STATUS_SUCCESS; -+} -+ -+int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name) -+{ -+ policydb_t *db = NULL; -+ filename_trans_t *ft = NULL; -+ -+ if (name) { -+ *name = NULL; -+ } -+ -+ if (!policy || !rule || !name) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return STATUS_ERR; -+ } -+ -+ db = &policy->p->p; -+ ft = (filename_trans_t *) rule; -+ -+ *name = ft->name; -+ -+ return STATUS_SUCCESS; -+} -+ -diff --git a/libqpol/src/libqpol.map b/libqpol/src/libqpol.map -index dd293bc..6973cca 100644 ---- a/libqpol/src/libqpol.map -+++ b/libqpol/src/libqpol.map -@@ -34,6 +34,7 @@ VERS_1.2 { - qpol_policy_reevaluate_conds; - qpol_portcon_*; - qpol_range_trans_*; -+ qpol_filename_trans_*; - qpol_role_*; - qpol_syn_avrule_*; - qpol_syn_terule_*; -diff --git a/libqpol/src/module_compiler.c b/libqpol/src/module_compiler.c -index dc19798..b06e285 100644 ---- a/libqpol/src/module_compiler.c -+++ b/libqpol/src/module_compiler.c -@@ -1247,6 +1247,18 @@ void append_role_allow(role_allow_rule_t * role_allow_rules) - } - - /* this doesn't actually append, but really prepends it */ -+void append_filename_trans(filename_trans_rule_t * filename_trans_rules) -+{ -+ avrule_decl_t *decl = stack_top->decl; -+ -+ /* filename transitions are not allowed within conditionals */ -+ assert(stack_top->type == 1); -+ -+ filename_trans_rules->next = decl->filename_trans_rules; -+ decl->filename_trans_rules = filename_trans_rules; -+} -+ -+/* this doesn't actually append, but really prepends it */ - void append_range_trans(range_trans_rule_t * range_tr_rules) - { - avrule_decl_t *decl = stack_top->decl; -diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c -index c94f7aa..0f3a45a 100644 ---- a/libqpol/src/policy_define.c -+++ b/libqpol/src/policy_define.c -@@ -2133,7 +2133,7 @@ int define_role_trans(void) - - /* This ebitmap business is just to ensure that there are not conflicting role_trans rules */ - #ifdef HAVE_SEPOL_USER_ROLE_MAPPING -- if (role_set_expand(&roles, &e_roles, policydbp, NULL)) -+ if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL)) - #else - if (role_set_expand(&roles, &e_roles, policydbp)) - #endif -@@ -2226,6 +2226,190 @@ int define_role_allow(void) - return 0; - } - -+avrule_t *define_cond_filename_trans(void) -+{ -+ yyerror("type transitions with a filename not allowed inside " -+ "conditionals\n"); -+ return COND_ERR; -+} -+ -+int define_filename_trans(void) -+{ -+ char *id, *name = NULL; -+ type_set_t stypes, ttypes; -+ ebitmap_t e_stypes, e_ttypes; -+ ebitmap_t e_tclasses; -+ ebitmap_node_t *snode, *tnode, *cnode; -+ filename_trans_t *ft; -+ filename_trans_rule_t *ftr; -+ class_datum_t *cladatum; -+ type_datum_t *typdatum; -+ uint32_t otype; -+ unsigned int c, s, t; -+ int add; -+ -+ if (pass == 1) { -+ /* stype */ -+ while ((id = queue_remove(id_queue))) -+ free(id); -+ /* ttype */ -+ while ((id = queue_remove(id_queue))) -+ free(id); -+ /* tclass */ -+ while ((id = queue_remove(id_queue))) -+ free(id); -+ /* otype */ -+ id = queue_remove(id_queue); -+ free(id); -+ /* name */ -+ id = queue_remove(id_queue); -+ free(id); -+ return 0; -+ } -+ -+ -+ add = 1; -+ type_set_init(&stypes); -+ while ((id = queue_remove(id_queue))) { -+ if (set_types(&stypes, id, &add, 0)) -+ goto bad; -+ } -+ -+ add =1; -+ type_set_init(&ttypes); -+ while ((id = queue_remove(id_queue))) { -+ if (set_types(&ttypes, id, &add, 0)) -+ goto bad; -+ } -+ -+ ebitmap_init(&e_tclasses); -+ while ((id = queue_remove(id_queue))) { -+ if (!is_id_in_scope(SYM_CLASSES, id)) { -+ yyerror2("class %s is not within scope", id); -+ free(id); -+ goto bad; -+ } -+ cladatum = hashtab_search(policydbp->p_classes.table, id); -+ if (!cladatum) { -+ yyerror2("unknown class %s", id); -+ goto bad; -+ } -+ if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) { -+ yyerror("Out of memory"); -+ goto bad; -+ } -+ free(id); -+ } -+ -+ id = (char *)queue_remove(id_queue); -+ if (!id) { -+ yyerror("no otype in transition definition?"); -+ goto bad; -+ } -+ if (!is_id_in_scope(SYM_TYPES, id)) { -+ yyerror2("type %s is not within scope", id); -+ free(id); -+ goto bad; -+ } -+ typdatum = hashtab_search(policydbp->p_types.table, id); -+ if (!typdatum) { -+ yyerror2("unknown type %s used in transition definition", id); -+ goto bad; -+ } -+ free(id); -+ otype = typdatum->s.value; -+ -+ name = queue_remove(id_queue); -+ if (!name) { -+ yyerror("no pathname specified in filename_trans definition?"); -+ goto bad; -+ } -+ -+ /* We expand the class set into seperate rules. We expand the types -+ * just to make sure there are not duplicates. They will get turned -+ * into seperate rules later */ -+ ebitmap_init(&e_stypes); -+ if (type_set_expand(&stypes, &e_stypes, policydbp, 1)) -+ goto bad; -+ -+ ebitmap_init(&e_ttypes); -+ if (type_set_expand(&ttypes, &e_ttypes, policydbp, 1)) -+ goto bad; -+ -+ ebitmap_for_each_bit(&e_tclasses, cnode, c) { -+ if (!ebitmap_node_get_bit(cnode, c)) -+ continue; -+ ebitmap_for_each_bit(&e_stypes, snode, s) { -+ if (!ebitmap_node_get_bit(snode, s)) -+ continue; -+ ebitmap_for_each_bit(&e_ttypes, tnode, t) { -+ if (!ebitmap_node_get_bit(tnode, t)) -+ continue; -+ -+ for (ft = policydbp->filename_trans; ft; ft = ft->next) { -+ if (ft->stype == (s + 1) && -+ ft->ttype == (t + 1) && -+ ft->tclass == (c + 1) && -+ !strcmp(ft->name, name)) { -+ yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s", -+ name, -+ policydbp->p_type_val_to_name[s], -+ policydbp->p_type_val_to_name[t], -+ policydbp->p_class_val_to_name[c]); -+ goto bad; -+ } -+ } -+ -+ ft = malloc(sizeof(*ft)); -+ if (!ft) { -+ yyerror("out of memory"); -+ goto bad; -+ } -+ memset(ft, 0, sizeof(*ft)); -+ -+ ft->next = policydbp->filename_trans; -+ policydbp->filename_trans = ft; -+ -+ ft->name = strdup(name); -+ if (!ft->name) { -+ yyerror("out of memory"); -+ goto bad; -+ } -+ ft->stype = s + 1; -+ ft->ttype = t + 1; -+ ft->tclass = c + 1; -+ ft->otype = otype; -+ } -+ } -+ -+ /* Now add the real rule since we didn't find any duplicates */ -+ ftr = malloc(sizeof(*ftr)); -+ if (!ftr) { -+ yyerror("out of memory"); -+ goto bad; -+ } -+ filename_trans_rule_init(ftr); -+ append_filename_trans(ftr); -+ -+ ftr->name = strdup(name); -+ ftr->stypes = stypes; -+ ftr->ttypes = ttypes; -+ ftr->tclass = c + 1; -+ ftr->otype = otype; -+ } -+ -+ free(name); -+ ebitmap_destroy(&e_stypes); -+ ebitmap_destroy(&e_ttypes); -+ ebitmap_destroy(&e_tclasses); -+ -+ return 0; -+ -+bad: -+ free(name); -+ return -1; -+} -+ - static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr) - { - constraint_expr_t *h = NULL, *l = NULL, *e, *newe; -diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y -index 84f4114..dc16c6f 100644 ---- a/libqpol/src/policy_parse.y -+++ b/libqpol/src/policy_parse.y -@@ -98,6 +98,7 @@ extern char *qpol_src_inputlim;/* end of data */ - %type require_decl_def - - %token PATH -+%token FILENAME - %token CLONE - %token COMMON - %token CLASS -@@ -360,7 +361,10 @@ cond_rule_def : cond_transition_def - | require_block - { $$ = NULL; } - ; --cond_transition_def : TYPE_TRANSITION names names ':' names identifier ';' -+cond_transition_def : TYPE_TRANSITION names names ':' names identifier filename ';' -+ { $$ = define_cond_filename_trans() ; -+ if ($$ == COND_ERR) return -1;} -+ | TYPE_TRANSITION names names ':' names identifier ';' - { $$ = define_cond_compute_type(AVRULE_TRANSITION) ; - if ($$ == COND_ERR) return -1;} - | TYPE_MEMBER names names ':' names identifier ';' -@@ -395,7 +399,9 @@ cond_dontaudit_def : DONTAUDIT names names ':' names names ';' - { $$ = define_cond_te_avtab(AVRULE_DONTAUDIT); - if ($$ == COND_ERR) return -1; } - ; --transition_def : TYPE_TRANSITION names names ':' names identifier ';' -+transition_def : TYPE_TRANSITION names names ':' names identifier filename ';' -+ {if (define_filename_trans()) return -1; } -+ | TYPE_TRANSITION names names ':' names identifier ';' - {if (define_compute_type(AVRULE_TRANSITION)) return -1;} - | TYPE_MEMBER names names ':' names identifier ';' - {if (define_compute_type(AVRULE_MEMBER)) return -1;} -@@ -752,6 +758,9 @@ identifier : IDENTIFIER - path : PATH - { if (insert_id(yytext,0)) return -1; } - ; -+filename : FILENAME -+ { yytext[strlen(yytext) - 1] = '\0'; if (insert_id(yytext + 1,0)) return -1; } -+ ; - number : NUMBER - { $$ = strtoul(yytext,NULL,0); } - ; -diff --git a/libqpol/src/policy_scan.l b/libqpol/src/policy_scan.l -index 75485f3..30203cd 100644 ---- a/libqpol/src/policy_scan.l -+++ b/libqpol/src/policy_scan.l -@@ -235,6 +235,7 @@ POLICYCAP { return(POLICYCAP); } - permissive | - PERMISSIVE { return(PERMISSIVE); } - "/"({alnum}|[_\.\-/])* { return(PATH); } -+\"({alnum}|[_\.\-])+\" { return(FILENAME); } - {letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))* { return(IDENTIFIER); } - {digit}+|0x{hexval}+ { return(NUMBER); } - {digit}{1,3}(\.{digit}{1,3}){3} { return(IPV4_ADDR); } -diff --git a/secmds/sesearch.c b/secmds/sesearch.c -index ec0315f..e44b3bc 100644 ---- a/secmds/sesearch.c -+++ b/secmds/sesearch.c -@@ -575,6 +575,95 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt - free(expr); - } - -+static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -+{ -+ apol_filename_trans_query_t *ftq = NULL; -+ int error = 0; -+ -+ if (!policy || !opt || !v) { -+ ERR(policy, "%s", strerror(EINVAL)); -+ errno = EINVAL; -+ return -1; -+ } -+ -+ if (!opt->type == QPOL_RULE_TYPE_TRANS && !opt->all) { -+ *v = NULL; -+ return 0; /* no search to do */ -+ } -+ -+ ftq = apol_filename_trans_query_create(); -+ if (!ftq) { -+ ERR(policy, "%s", strerror(ENOMEM)); -+ errno = ENOMEM; -+ return -1; -+ } -+ -+ apol_filename_trans_query_set_regex(policy, ftq, opt->useregex); -+ if (opt->src_name) { -+ if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name)) { -+ error = errno; -+ goto err; -+ } -+ } -+ if (opt->tgt_name) { -+ if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) { -+ error = errno; -+ goto err; -+ } -+ } -+ -+ if (apol_filename_trans_get_by_query(policy, ftq, v)) { -+ error = errno; -+ goto err; -+ } -+ -+ apol_filename_trans_query_destroy(&ftq); -+ return 0; -+ -+ err: -+ apol_vector_destroy(v); -+ apol_filename_trans_query_destroy(&ftq); -+ ERR(policy, "%s", strerror(error)); -+ errno = error; -+ return -1; -+} -+ -+static void print_ft_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v) -+{ -+ qpol_policy_t *q = apol_policy_get_qpol(policy); -+ size_t i, num_rules = 0; -+ const qpol_filename_trans_t *rule = NULL; -+ char *tmp = NULL, *rule_str = NULL, *expr = NULL; -+ char enable_char = ' ', branch_char = ' '; -+ qpol_iterator_t *iter = NULL; -+ const qpol_cond_t *cond = NULL; -+ uint32_t enabled = 0, list = 0; -+ -+ if (!(num_rules = apol_vector_get_size(v))) -+ goto cleanup; -+ -+ fprintf(stdout, "Found %zd named file transition rules:\n", num_rules); -+ -+ for (i = 0; i < num_rules; i++) { -+ enable_char = branch_char = ' '; -+ if (!(rule = apol_vector_get_element(v, i))) -+ goto cleanup; -+ -+ if (!(rule_str = apol_filename_trans_render(policy, rule))) -+ goto cleanup; -+ fprintf(stdout, "%s %s\n", rule_str, expr ? expr : ""); -+ free(rule_str); -+ rule_str = NULL; -+ free(expr); -+ expr = NULL; -+ } -+ -+ cleanup: -+ free(tmp); -+ free(rule_str); -+ free(expr); -+} -+ - static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) - { - apol_role_allow_query_t *raq = NULL; -@@ -1128,6 +1217,18 @@ int main(int argc, char **argv) - print_te_results(policy, &cmd_opts, v); - fprintf(stdout, "\n"); - } -+ -+ if (cmd_opts.all || cmd_opts.type == QPOL_RULE_TYPE_TRANS) { -+ apol_vector_destroy(&v); -+ if (perform_ft_query(policy, &cmd_opts, &v)) { -+ rt = 1; -+ goto cleanup; -+ } -+ -+ print_ft_results(policy, &cmd_opts, v); -+ fprintf(stdout, "\n"); -+ } -+ - apol_vector_destroy(&v); - if (perform_ra_query(policy, &cmd_opts, &v)) { - rt = 1; --- -1.7.6.2 - -diff -up setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans setools-3.3.7/libapol/include/apol/Makefile.am ---- setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans 2009-07-14 14:03:27.000000000 -0400 -+++ setools-3.3.7/libapol/include/apol/Makefile.am 2011-10-26 16:24:59.948130442 -0400 -@@ -27,6 +27,7 @@ apol_HEADERS = \ - relabel-analysis.h \ - render.h \ - role-query.h \ -+ ftrule-query.h \ - terule-query.h \ - type-query.h \ - types-relation-analysis.h \ -diff -up setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans setools-3.3.7/libqpol/include/qpol/Makefile.am ---- setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans 2011-10-26 16:22:28.723523155 -0400 -+++ setools-3.3.7/libqpol/include/qpol/Makefile.am 2011-10-26 16:22:41.283493767 -0400 -@@ -25,6 +25,7 @@ qpol_HEADERS = \ - role_query.h \ - syn_rule_query.h \ - terule_query.h \ -+ ftrule_query.h \ - type_query.h \ - user_query.h \ - util.h diff --git a/0007-Remove-unused-variables.patch b/0007-Remove-unused-variables.patch deleted file mode 100644 index dfa532c..0000000 --- a/0007-Remove-unused-variables.patch +++ /dev/null @@ -1,277 +0,0 @@ -From e30036e358b8f1c3f56048b467e8646fa3bfffb6 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Tue, 20 Sep 2011 16:40:26 -0400 -Subject: [PATCH 7/7] Remove unused variables - ---- - libapol/src/ftrule-query.c | 11 ++---- - libqpol/src/ftrule_query.c | 2 - - secmds/sesearch.c | 86 +++++++++++++++++++++++++++++++++----------- - 3 files changed, 68 insertions(+), 31 deletions(-) - -diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c -index dc248de..9c7a23b 100644 ---- a/libapol/src/ftrule-query.c -+++ b/libapol/src/ftrule-query.c -@@ -45,14 +45,11 @@ struct apol_filename_trans_query - int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v) - { - apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL; -- int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans; -- char *bool_name = NULL; -+ int retval = -1, source_as_any = 0, is_regex = 0; - *v = NULL; -- unsigned int flags = 0; -- qpol_iterator_t *iter = NULL, *type_iter = NULL; -+ qpol_iterator_t *iter = NULL; - - if (t != NULL) { -- flags = t->flags; - is_regex = t->flags & APOL_QUERY_REGEX; - if (t->source != NULL && - (source_list = -@@ -104,7 +101,7 @@ int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filenam - if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) { - goto cleanup; - } -- int match_source = 0, match_target = 0, match_default = 0, match_bool = 0; -+ int match_source = 0, match_target = 0, match_default = 0; - size_t i; - - if (source_list == NULL) { -@@ -265,10 +262,8 @@ char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filena - { - char *tmp = NULL; - const char *tmp_name = NULL; -- const char *filename_trans_type_str; - int error = 0; - size_t tmp_sz = 0; -- uint32_t filename_trans_type = 0; - const qpol_type_t *type = NULL; - const qpol_class_t *obj_class = NULL; - -diff --git a/libqpol/src/ftrule_query.c b/libqpol/src/ftrule_query.c -index d6db848..3148d30 100644 ---- a/libqpol/src/ftrule_query.c -+++ b/libqpol/src/ftrule_query.c -@@ -254,7 +254,6 @@ int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpo - - int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name) - { -- policydb_t *db = NULL; - filename_trans_t *ft = NULL; - - if (name) { -@@ -267,7 +266,6 @@ int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_fi - return STATUS_ERR; - } - -- db = &policy->p->p; - ft = (filename_trans_t *) rule; - - *name = ft->name; -diff --git a/secmds/sesearch.c b/secmds/sesearch.c -index e44b3bc..319ffe7 100644 ---- a/secmds/sesearch.c -+++ b/secmds/sesearch.c -@@ -72,6 +72,7 @@ static struct option const longopts[] = { - - {"source", required_argument, NULL, 's'}, - {"target", required_argument, NULL, 't'}, -+ {"default", required_argument, NULL, 'D'}, - {"role_source", required_argument, NULL, EXPR_ROLE_SOURCE}, - {"role_target", required_argument, NULL, EXPR_ROLE_TARGET}, - {"class", required_argument, NULL, 'c'}, -@@ -92,6 +93,7 @@ typedef struct options - { - char *src_name; - char *tgt_name; -+ char *default_name; - char *src_role_name; - char *tgt_role_name; - char *class_name; -@@ -293,7 +295,8 @@ static void print_syn_av_results(const apol_policy_t * policy, const options_t * - tmp = apol_cond_expr_render(policy, cond); - enable_char = (enabled ? 'E' : 'D'); - branch_char = ((is_true && enabled) || (!is_true && !enabled) ? 'T' : 'F'); -- asprintf(&expr, "[ %s ]", tmp); -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) -+ goto cleanup; - free(tmp); - tmp = NULL; - if (!expr) -@@ -356,7 +359,8 @@ static void print_av_results(const apol_policy_t * policy, const options_t * opt - qpol_iterator_destroy(&iter); - enable_char = (enabled ? 'E' : 'D'); - branch_char = (list ? 'T' : 'F'); -- asprintf(&expr, "[ %s ]", tmp); -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) -+ goto cleanup; - free(tmp); - tmp = NULL; - if (!expr) -@@ -488,7 +492,8 @@ static void print_syn_te_results(const apol_policy_t * policy, const options_t * - tmp = apol_cond_expr_render(policy, cond); - enable_char = (enabled ? 'E' : 'D'); - branch_char = ((is_true && enabled) || (!is_true && !enabled) ? 'T' : 'F'); -- asprintf(&expr, "[ %s ]", tmp); -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) -+ goto cleanup; - free(tmp); - tmp = NULL; - if (!expr) -@@ -553,7 +558,8 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt - qpol_iterator_destroy(&iter); - enable_char = (enabled ? 'E' : 'D'); - branch_char = (list ? 'T' : 'F'); -- asprintf(&expr, "[ %s ]", tmp); -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) -+ goto cleanup; - free(tmp); - tmp = NULL; - if (!expr) -@@ -586,7 +592,7 @@ static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, - return -1; - } - -- if (!opt->type == QPOL_RULE_TYPE_TRANS && !opt->all) { -+ if (!opt->type && !opt->all) { - *v = NULL; - return 0; /* no search to do */ - } -@@ -600,17 +606,44 @@ static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, - - apol_filename_trans_query_set_regex(policy, ftq, opt->useregex); - if (opt->src_name) { -- if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name)) { -+ if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name, opt->indirect)) { - error = errno; - goto err; - } - } -+ - if (opt->tgt_name) { - if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) { - error = errno; - goto err; - } - } -+ if (opt->default_name) { -+ if (apol_filename_trans_query_set_default(policy, ftq, opt->default_name)) { -+ error = errno; -+ goto err; -+ } -+ } -+ -+ if (opt->class_name) { -+ if (opt->class_vector == NULL) { -+ if (apol_filename_trans_query_append_class(policy, ftq, opt->class_name)) { -+ error = errno; -+ goto err; -+ } -+ } else { -+ for (size_t i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { -+ char *class_name; -+ class_name = apol_vector_get_element(opt->class_vector, i); -+ if (!class_name) -+ continue; -+ if (apol_filename_trans_query_append_class(policy, ftq, class_name)) { -+ error = errno; -+ goto err; -+ } -+ } -+ } -+ } - - if (apol_filename_trans_get_by_query(policy, ftq, v)) { - error = errno; -@@ -630,37 +663,36 @@ static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, - - static void print_ft_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v) - { -- qpol_policy_t *q = apol_policy_get_qpol(policy); -- size_t i, num_rules = 0; -- const qpol_filename_trans_t *rule = NULL; -- char *tmp = NULL, *rule_str = NULL, *expr = NULL; -+ size_t i, num_filename_trans = 0; -+ const qpol_filename_trans_t *filename_trans = NULL; -+ char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL; - char enable_char = ' ', branch_char = ' '; - qpol_iterator_t *iter = NULL; - const qpol_cond_t *cond = NULL; - uint32_t enabled = 0, list = 0; - -- if (!(num_rules = apol_vector_get_size(v))) -+ if (!(num_filename_trans = apol_vector_get_size(v))) - goto cleanup; - -- fprintf(stdout, "Found %zd named file transition rules:\n", num_rules); -+ fprintf(stdout, "Found %zd named file transition filename_trans:\n", num_filename_trans); - -- for (i = 0; i < num_rules; i++) { -+ for (i = 0; i < num_filename_trans; i++) { - enable_char = branch_char = ' '; -- if (!(rule = apol_vector_get_element(v, i))) -+ if (!(filename_trans = apol_vector_get_element(v, i))) - goto cleanup; - -- if (!(rule_str = apol_filename_trans_render(policy, rule))) -+ if (!(filename_trans_str = apol_filename_trans_render(policy, filename_trans))) - goto cleanup; -- fprintf(stdout, "%s %s\n", rule_str, expr ? expr : ""); -- free(rule_str); -- rule_str = NULL; -+ fprintf(stdout, "%s %s\n", filename_trans_str, expr ? expr : ""); -+ free(filename_trans_str); -+ filename_trans_str = NULL; - free(expr); - expr = NULL; - } - - cleanup: - free(tmp); -- free(rule_str); -+ free(filename_trans_str); - free(expr); - } - -@@ -930,7 +962,7 @@ int main(int argc, char **argv) - - memset(&cmd_opts, 0, sizeof(cmd_opts)); - cmd_opts.indirect = true; -- while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dRnSChV", longopts, NULL)) != -1) { -+ while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dD:RnSChV", longopts, NULL)) != -1) { - switch (optc) { - case 0: - break; -@@ -946,6 +978,18 @@ int main(int argc, char **argv) - exit(1); - } - break; -+ case 'D': /* source */ -+ if (optarg == 0) { -+ usage(argv[0], 1); -+ printf("Missing source default type for -D (--default)\n"); -+ exit(1); -+ } -+ cmd_opts.default_name = strdup(optarg); -+ if (!cmd_opts.default_name) { -+ -+ exit(1); -+ } -+ break; - case 't': /* target */ - if (optarg == 0) { - usage(argv[0], 1); -@@ -1218,7 +1262,7 @@ int main(int argc, char **argv) - fprintf(stdout, "\n"); - } - -- if (cmd_opts.all || cmd_opts.type == QPOL_RULE_TYPE_TRANS) { -+ if (cmd_opts.all || cmd_opts.type) { - apol_vector_destroy(&v); - if (perform_ft_query(policy, &cmd_opts, &v)) { - rt = 1; --- -1.7.6.2 - diff --git a/0007-Setools-noship.patch b/0007-Setools-noship.patch deleted file mode 100644 index df93e5f..0000000 --- a/0007-Setools-noship.patch +++ /dev/null @@ -1,276 +0,0 @@ -From a39d0831d654292fb2a1f7b9ee18ecc9239f610f Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 18:38:34 +0200 -Subject: [PATCH 07/11] Setools noship - ---- - Makefile.am | 26 +++----------------------- - configure.ac | 2 +- - man/Makefile.am | 15 +++------------ - seaudit/Makefile.am | 31 +++---------------------------- - secmds/Makefile.am | 14 +------------- - sediff/Makefile.am | 32 ++------------------------------ - 6 files changed, 13 insertions(+), 107 deletions(-) - -diff --git a/Makefile.am b/Makefile.am -index 176c8ea..4cac386 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -10,7 +10,7 @@ if BUILD_GUI - endif - # sediffx is also built conditionally, from sediffx/Makefile.am - --SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) python -+SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) python - - #old indent opts - #INDENT_OPTS = -npro -nbad -bap -sob -ss -l132 -di1 -nbc -br -nbbb -c40 -cd40 -ncdb -ce -cli0 -cp40 -ncs -d0 -nfc1 -nfca -i8 -ts8 -ci8 -lp -ip0 -npcs -npsl -sc -@@ -49,12 +49,6 @@ seaudit: libqpol libapol libseaudit - sediff: libqpol libapol libpoldiff - $(MAKE) -C $(top_srcdir)/sediff sediff - --sediffx: libqpol libapol libpoldiff -- $(MAKE) -C $(top_srcdir)/sediff sediffx -- --sechecker: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/sechecker -- - help: - @echo "Make targets for SETools:" - @echo " all: build everything, but do not install" -@@ -65,8 +59,6 @@ help: - @echo " secmds: build command line tools" - @echo " seaudit: build audit log analysis tools" - @echo " sediff: build semantic policy diff command line tool" -- @echo " sediffx: build semantic policy diff graphical tool" -- @echo " sechecker: build policy checking tool" - @echo "" - @echo " install-logwatch: install LogWatch config files for seaudit-report" - @echo " (requires LogWatch and root privileges)" -@@ -78,9 +70,9 @@ install-logwatch: - $(MAKE) -C $(top_srcdir)/seaudit install-logwatch - - .PHONY: libqpol libapol libpoldiff libsefs libseaudit \ -- apol secmds seaudit sediff sediffx sechecker \ -+ apol secmds seaudit sediff \ - install-logwatch help \ -- seinfo sesearch indexcon findcon replcon searchcon \ -+ seinfo sesearch \ - packages - - seinfo: libqpol libapol -@@ -89,18 +81,6 @@ seinfo: libqpol libapol - sesearch: libqpol libapol - $(MAKE) -C $(top_srcdir)/secmds sesearch - --indexcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds indexcon -- --findcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds findcon -- --replcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds replcon -- --searchcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds searchcon -- - packages: - $(MAKE) -C $(top_srcdir)/packages - -diff --git a/configure.ac b/configure.ac -index 2a5b55b..5b1da5e 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -63,7 +63,7 @@ if test ${ac_cv_prog_cc_c99} = "no"; then - fi - AC_PROG_CXX - AC_LANG([C]) --AC_PROG_LIBTOOL -+AC_PROG_RANLIB - AC_PROG_LN_S - AC_PROG_LEX - AC_PROG_YACC -diff --git a/man/Makefile.am b/man/Makefile.am -index 0fafccb..f88e00a 100644 ---- a/man/Makefile.am -+++ b/man/Makefile.am -@@ -1,19 +1,10 @@ - if BUILD_GUI - MAYBEMANS = apol.1 \ -- seaudit.8 seaudit-report.8 \ -- sediffx.1 -+ seaudit.8 - endif - - EXTRA_DIST=$(man_MANS) apol.1 \ -- seaudit.8 seaudit-report.8.in \ -- sediffx.1 -+ seaudit.8 - --man_MANS = findcon.1 indexcon.1 replcon.1 \ -- sechecker.1 \ -- sediff.1 \ -+man_MANS = sediff.1 \ - seinfo.1 sesearch.1 $(MAYBEMANS) -- --seaudit-report.8: seaudit-report.8.in Makefile -- sed -e 's|\@setoolsdir\@|$(setoolsdir)|g' $< > $@ -- --CLEANFILES = seaudit-report.8 -diff --git a/seaudit/Makefile.am b/seaudit/Makefile.am -index 1987c99..3fa4413 100644 ---- a/seaudit/Makefile.am -+++ b/seaudit/Makefile.am -@@ -1,5 +1,4 @@ - setoolsdir = @setoolsdir@ --bin_PROGRAMS = seaudit-report - sbin_PROGRAMS = seaudit - - AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -@@ -20,13 +19,10 @@ LDADD = @SELINUX_LIB_FLAG@ @SEAUDIT_LIB_FLAG@ @APOL_LIB_FLAG@ @QPOL_LIB_FLAG@ - dist_setools_DATA = \ - seaudit.glade \ - seaudit_help.txt \ -- seaudit-report.conf \ -- seaudit-report.css \ - seaudit.png seaudit-small.png - - nodist_setools_DATA = \ -- dot_seaudit \ -- seaudit-report-service -+ dot_seaudit - - seaudit_SOURCES = \ - filter_view.c filter_view.h \ -@@ -50,31 +46,12 @@ seaudit_DEPENDENCIES = $(top_builddir)/libseaudit/src/libseaudit.so \ - dot_seaudit: dot_seaudit.in Makefile - sed -e 's|\@setoolsdir\@|$(setoolsdir)|g' $< > $@ - --seaudit_report_SOURCES = seaudit-report.c --seaudit_report_DEPENDENCIES = $(top_builddir)/libseaudit/src/libseaudit.so \ -- $(top_builddir)/libapol/src/libapol.so \ -- $(top_builddir)/libqpol/src/libqpol.so -- - logwatch = $(DESTDIR)/etc/logwatch - LOGWATCH_GROUP = $(logwatch)/conf/logfiles - LOGWATCH_SERVICE = $(logwatch)/conf/services - LOGWATCH_FILTER = $(logwatch)/scripts/services - --dist_noinst_DATA = dot_seaudit.in \ -- seaudit-report-group.conf \ -- seaudit-report-service.conf \ -- seaudit-report-service.in -- --seaudit-report-service: seaudit-report-service.in Makefile -- sed -e 's|\@bindir\@|$(bindir)|g' $< > $@ -- --install-logwatch: $(dist_noinst_DATA) seaudit-report-service -- mkdir -p -- $(LOGWATCH_GROUP) -- install -m 644 seaudit-report-group.conf $(LOGWATCH_GROUP) -- mkdir -p -- $(LOGWATCH_SERVICE) -- install -m 644 seaudit-report-service.conf $(LOGWATCH_SERVICE) -- mkdir -p -- $(LOGWATCH_FILTER) -- install -m 755 seaudit-report-service $(LOGWATCH_FILTER) -+dist_noinst_DATA = dot_seaudit.in - - $(top_builddir)/libapol/src/libapol.so: - $(MAKE) -C $(top_builddir)/libapol/src $(notdir $@) -@@ -85,6 +62,4 @@ $(top_builddir)/libqpol/src/libqpol.so: - $(top_builddir)/libsefs/src/libsefs.so: - $(MAKE) -C $(top_builddir)/libsefs/src $(notdir $@) - --.PHONY: install-logwatch -- --CLEANFILES = dot_seaudit seaudit-report-service -+CLEANFILES = dot_seaudit -diff --git a/secmds/Makefile.am b/secmds/Makefile.am -index ddc88b1..7fa4364 100644 ---- a/secmds/Makefile.am -+++ b/secmds/Makefile.am -@@ -1,6 +1,6 @@ - # various setools command line tools - --bin_PROGRAMS = seinfo sesearch findcon replcon indexcon -+bin_PROGRAMS = seinfo sesearch - - # These are for indexcon so that it is usable on machines without setools - STATICLIBS = ../libsefs/src/libsefs.a ../libapol/src/libapol.a ../libqpol/src/libqpol.a -lsqlite3 -@@ -18,18 +18,6 @@ seinfo_SOURCES = seinfo.c - - sesearch_SOURCES = sesearch.c - --indexcon_SOURCES = indexcon.cc --indexcon_LDADD = @SELINUX_LIB_FLAG@ $(STATICLIBS) --indexcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- --findcon_SOURCES = findcon.cc --findcon_LDADD = @SEFS_LIB_FLAG@ $(LDADD) --findcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- --replcon_SOURCES = replcon.cc --replcon_LDADD = @SEFS_LIB_FLAG@ $(LDADD) --replcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- - $(top_builddir)/libapol/src/libapol.so: - $(MAKE) -C $(top_builddir)/libapol/src $(notdir $@) - -diff --git a/sediff/Makefile.am b/sediff/Makefile.am -index 3f53cd3..2d9ce84 100644 ---- a/sediff/Makefile.am -+++ b/sediff/Makefile.am -@@ -1,13 +1,6 @@ - setoolsdir = @setoolsdir@ - --dist_setools_DATA = sediff_help.txt sediffx.glade \ -- sediffx.png sediffx-small.png -- --if BUILD_GUI -- MAYBE_SEDIFFX = sediffx --endif -- --bin_PROGRAMS = sediff $(MAYBE_SEDIFFX) -+bin_PROGRAMS = sediff - - AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ - @QPOL_CFLAGS@ @APOL_CFLAGS@ @POLDIFF_CFLAGS@ -@@ -15,14 +8,7 @@ AM_LDFLAGS = @DEBUGLDFLAGS@ @WARNLDFLAGS@ @PROFILELDFLAGS@ - - LDADD = @SELINUX_LIB_FLAG@ @POLDIFF_LIB_FLAG@ @APOL_LIB_FLAG@ @QPOL_LIB_FLAG@ - --sediff_CFLAGS = $(AM_CFLAGS) --sediffx_CFLAGS = $(AM_CFLAGS) \ -- @GTK_CFLAGS@ @PIXBUF_CFLAGS@ @GLADE_CFLAGS@ @GTHREAD_CFLAGS@ -- --# need the -rdynamic flag below - glade uses dlopen() upon sediffx callbacks --sediffx_LDFLAGS = $(AM_LDFLAGS) \ -- @GTK_LIBS@ @PIXBUF_LIBS@ @GLADE_LIBS@ @GTHREAD_LIBS@ @XML_LIBS@ \ -- -rdynamic -+sediff_CFLAGS = $(AM_CFLAGS) - - DEPENDENCIES = $(top_builddir)/libpoldiff/src/libpoldiff.so \ - $(top_builddir)/libapol/src/libapol.so \ -@@ -30,20 +16,6 @@ DEPENDENCIES = $(top_builddir)/libpoldiff/src/libpoldiff.so \ - - sediff_SOURCES = sediff.c - --sediffx_SOURCES = \ -- find_dialog.c find_dialog.h \ -- open_policies_dialog.c open_policies_dialog.h \ -- policy_view.c policy_view.h \ -- progress.c progress.h \ -- remap_types_dialog.c remap_types_dialog.h \ -- result_item.c result_item.h \ -- result_item_render.c result_item_render.h \ -- results.c results.h \ -- select_diff_dialog.c select_diff_dialog.h \ -- toplevel.c toplevel.h \ -- utilgui.c utilgui.h \ -- sediffx.c sediffx.h -- - $(top_builddir)/libpoldiff/src/libpoldiff.so: - $(MAKE) -C $(top_builddir)/libpoldiff/src $(notdir $@) - --- -1.8.5.3 - diff --git a/0008-Add-alias-support-to-seinfo-t.patch b/0008-Add-alias-support-to-seinfo-t.patch deleted file mode 100644 index 32d901a..0000000 --- a/0008-Add-alias-support-to-seinfo-t.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 1136e61a9839ad3b60eb2da4d624413c02545c7d Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 18:42:27 +0200 -Subject: [PATCH 08/11] Add alias support to seinfo -t - ---- - secmds/seinfo.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 48 insertions(+) - -diff --git a/secmds/seinfo.c b/secmds/seinfo.c -index 54b2a6a..1878c49 100644 ---- a/secmds/seinfo.c -+++ b/secmds/seinfo.c -@@ -46,6 +46,7 @@ - #include - #include - #include -+#include - - #define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" - -@@ -54,6 +55,7 @@ - - static char *policy_file = NULL; - -+static void print_type_aliases(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb); - static int print_type_attrs(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb, const int expand); - static int print_attr_types(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb, const int expand); - static int print_user_roles(FILE * fp, const qpol_user_t * user_datum, const apol_policy_t * policydb, const int expand); -@@ -514,6 +516,7 @@ static int print_types(FILE * fp, const char *name, int expand, const apol_polic - goto cleanup; - if (print_type_attrs(fp, type_datum, policydb, expand)) - goto cleanup; -+ print_type_aliases(fp, type_datum, policydb); - } else { - if (qpol_policy_get_type_iter(q, &iter)) - goto cleanup; -@@ -1912,6 +1915,51 @@ int main(int argc, char **argv) - } - - /** -+ * Prints the alias of a type. -+ * -+ * @param fp Reference to a file to which to print type information -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ * attributes -+ */ -+static void print_type_aliases(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb) -+{ -+ qpol_iterator_t *iter = NULL; -+ size_t alias_size; -+ unsigned char isattr, isalias; -+ const char *type_name = NULL; -+ const char *alias_name; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ if (qpol_type_get_name(q, type_datum, &type_name)) -+ goto cleanup; -+ if (qpol_type_get_isattr(q, type_datum, &isattr)) -+ goto cleanup; -+ if (qpol_type_get_isalias(q, type_datum, &isalias)) -+ goto cleanup; -+ -+ if (isalias) { -+ fprintf(fp, " TypeName %s\n", type_name); -+ } -+ if (qpol_type_get_alias_iter(q, type_datum, &iter)) -+ goto cleanup; -+ if (qpol_iterator_get_size(iter, &alias_size)) -+ goto cleanup; -+ if (alias_size > 0) { -+ fprintf(fp, " Aliases\n"); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&alias_name)) -+ goto cleanup; -+ fprintf(fp, " %s\n", alias_name); -+ } -+ } -+ -+ cleanup: -+ qpol_iterator_destroy(&iter); -+ return; -+} -+ -+/** - * Prints a textual representation of a type, and possibly - * all of that type's attributes. - * --- -1.8.5.3 - diff --git a/0008-Fix-output-to-match-policy-lines.patch b/0008-Fix-output-to-match-policy-lines.patch deleted file mode 100644 index 47c258e..0000000 --- a/0008-Fix-output-to-match-policy-lines.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 2f89d9acc12c0a7b50a94e4247b015242ce712c9 Mon Sep 17 00:00:00 2001 -From: Dan Walsh -Date: Wed, 21 Sep 2011 15:15:02 -0400 -Subject: [PATCH 8/8] Fix output to match policy lines - ---- - libapol/src/ftrule-query.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c -index 9c7a23b..1d5f5c8 100644 ---- a/libapol/src/ftrule-query.c -+++ b/libapol/src/ftrule-query.c -@@ -282,7 +282,7 @@ char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filena - error = errno; - goto err; - } -- if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) { -+ if (apol_str_appendf(&tmp, &tmp_sz, "type_transition %s ", tmp_name)) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; -@@ -338,7 +338,7 @@ char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filena - goto err; - } - -- if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) { -+ if (apol_str_appendf(&tmp, &tmp_sz, " \"%s\"", tmp_name)) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; --- -1.7.6.2 - diff --git a/0009-Fix-help-message-on-sesearch-D.patch b/0009-Fix-help-message-on-sesearch-D.patch deleted file mode 100644 index e90eba4..0000000 --- a/0009-Fix-help-message-on-sesearch-D.patch +++ /dev/null @@ -1,258 +0,0 @@ -From bbe9f57845101d07eef31a772946437b3245c7d5 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 18:46:24 +0200 -Subject: [PATCH 09/11] Fix help message on sesearch -D - ---- - man/sesearch.1 | 2 +- - secmds/sesearch.c | 77 +++++++++++++++++-------------------------------------- - 2 files changed, 25 insertions(+), 54 deletions(-) - -diff --git a/man/sesearch.1 b/man/sesearch.1 -index 573aedd..dc119eb 100644 ---- a/man/sesearch.1 -+++ b/man/sesearch.1 -@@ -43,7 +43,7 @@ Search for allow rules. - Search for neverallow rules. - .IP "--auditallow" - Search for auditallow rules. --.IP "--dontaudit" -+.IP "-D, --dontaudit" - Search for dontaudit rules. - .IP "-T, --type" - Search for type_transition, type_member, and type_change rules. -diff --git a/secmds/sesearch.c b/secmds/sesearch.c -index e1436a7..f53d670 100644 ---- a/secmds/sesearch.c -+++ b/secmds/sesearch.c -@@ -24,6 +24,7 @@ - */ - - #include -+#include - - /* libapol */ - #include -@@ -61,9 +62,8 @@ enum opt_values - static struct option const longopts[] = { - {"allow", no_argument, NULL, 'A'}, - {"neverallow", no_argument, NULL, RULE_NEVERALLOW}, -- {"audit", no_argument, NULL, RULE_AUDIT}, - {"auditallow", no_argument, NULL, RULE_AUDITALLOW}, -- {"dontaudit", no_argument, NULL, RULE_DONTAUDIT}, -+ {"dontaudit", no_argument, NULL, 'D'}, - {"type", no_argument, NULL, 'T'}, - {"role_allow", no_argument, NULL, RULE_ROLE_ALLOW}, - {"role_trans", no_argument, NULL, RULE_ROLE_TRANS}, -@@ -72,7 +72,6 @@ static struct option const longopts[] = { - - {"source", required_argument, NULL, 's'}, - {"target", required_argument, NULL, 't'}, -- {"default", required_argument, NULL, 'D'}, - {"role_source", required_argument, NULL, EXPR_ROLE_SOURCE}, - {"role_target", required_argument, NULL, EXPR_ROLE_TARGET}, - {"class", required_argument, NULL, 'c'}, -@@ -129,7 +128,7 @@ void usage(const char *program_name, int brief) - printf(" -A, --allow allow rules\n"); - printf(" --neverallow neverallow rules\n"); - printf(" --auditallow auditallow rules\n"); -- printf(" --dontaudit dontaudit rules\n"); -+ printf(" -D, --dontaudit dontaudit rules\n"); - printf(" -T, --type type_trans, type_member, and type_change\n"); - printf(" --role_allow role allow rules\n"); - printf(" --role_trans role_transition rules\n"); -@@ -138,7 +137,6 @@ void usage(const char *program_name, int brief) - printf("EXPRESSIONS:\n"); - printf(" -s NAME, --source=NAME rules with type/attribute NAME as source\n"); - printf(" -t NAME, --target=NAME rules with type/attribute NAME as target\n"); -- printf(" -D NAME, --default=NAME rules with type NAME as default\n"); - printf(" --role_source=NAME rules with role NAME as source\n"); - printf(" --role_target=NAME rules with role NAME as target\n"); - printf(" -c NAME, --class=NAME rules with class NAME as the object class\n"); -@@ -296,10 +294,8 @@ static void print_syn_av_results(const apol_policy_t * policy, const options_t * - tmp = apol_cond_expr_render(policy, cond); - enable_char = (enabled ? 'E' : 'D'); - branch_char = ((is_true && enabled) || (!is_true && !enabled) ? 'T' : 'F'); -- if (asprintf(&expr, "[ %s ]", tmp) < 0) { -- expr = NULL; -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) - goto cleanup; -- } - free(tmp); - tmp = NULL; - if (!expr) -@@ -362,10 +358,8 @@ static void print_av_results(const apol_policy_t * policy, const options_t * opt - qpol_iterator_destroy(&iter); - enable_char = (enabled ? 'E' : 'D'); - branch_char = (list ? 'T' : 'F'); -- if (asprintf(&expr, "[ %s ]", tmp) < 0) { -- expr = NULL; -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) - goto cleanup; -- } - free(tmp); - tmp = NULL; - if (!expr) -@@ -421,8 +415,6 @@ static int perform_te_query(const apol_policy_t * policy, const options_t * opt, - apol_terule_query_set_target(policy, teq, opt->tgt_name, opt->indirect); - if (opt->bool_name) - apol_terule_query_set_bool(policy, teq, opt->bool_name); -- if (opt->default_name) -- apol_terule_query_set_default(policy, teq, opt->default_name); - if (opt->class_name) { - if (opt->class_vector == NULL) { - if (apol_terule_query_append_class(policy, teq, opt->class_name)) { -@@ -499,14 +491,12 @@ static void print_syn_te_results(const apol_policy_t * policy, const options_t * - tmp = apol_cond_expr_render(policy, cond); - enable_char = (enabled ? 'E' : 'D'); - branch_char = ((is_true && enabled) || (!is_true && !enabled) ? 'T' : 'F'); -- if (asprintf(&expr, "[ %s ]", tmp) < 0) { -- expr = NULL; -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) - goto cleanup; -- } - free(tmp); - tmp = NULL; - if (!expr) -- goto cleanup; -+ break; - } - } - if (!(rule_str = apol_syn_terule_render(policy, rule))) -@@ -567,10 +557,8 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt - qpol_iterator_destroy(&iter); - enable_char = (enabled ? 'E' : 'D'); - branch_char = (list ? 'T' : 'F'); -- if (asprintf(&expr, "[ %s ]", tmp) < 0) { -- expr = NULL; -+ if (asprintf(&expr, "[ %s ]", tmp) < 0) - goto cleanup; -- } - free(tmp); - tmp = NULL; - if (!expr) -@@ -629,7 +617,6 @@ static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, - goto err; - } - } -- - if (opt->default_name) { - if (apol_filename_trans_query_set_default(policy, ftq, opt->default_name)) { - error = errno; -@@ -677,13 +664,12 @@ static void print_ft_results(const apol_policy_t * policy, const options_t * opt - { - size_t i, num_filename_trans = 0; - const qpol_filename_trans_t *filename_trans = NULL; -- char *filename_trans_str = NULL; -- qpol_iterator_t *iter = NULL; -+ char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL; - - if (!(num_filename_trans = apol_vector_get_size(v))) - goto cleanup; - -- fprintf(stdout, "Found %zd named file transition rules:\n", num_filename_trans); -+ fprintf(stdout, "Found %zd named file transition filename_trans:\n", num_filename_trans); - - for (i = 0; i < num_filename_trans; i++) { - if (!(filename_trans = apol_vector_get_element(v, i))) -@@ -691,13 +677,17 @@ static void print_ft_results(const apol_policy_t * policy, const options_t * opt - - if (!(filename_trans_str = apol_filename_trans_render(policy, filename_trans))) - goto cleanup; -- fprintf(stdout, "%s\n", filename_trans_str); -+ fprintf(stdout, "%s %s\n", filename_trans_str, expr ? expr : ""); - free(filename_trans_str); - filename_trans_str = NULL; -+ free(expr); -+ expr = NULL; - } - - cleanup: -+ free(tmp); - free(filename_trans_str); -+ free(expr); - } - - static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -@@ -814,13 +804,6 @@ static int perform_rt_query(const apol_policy_t * policy, const options_t * opt, - } - } - -- if (opt->default_name) { -- if (apol_role_trans_query_set_default(policy, rtq, opt->default_name)) { -- error = errno; -- goto err; -- } -- } -- - if (apol_role_trans_get_by_query(policy, rtq, v)) { - error = errno; - goto err; -@@ -973,7 +956,7 @@ int main(int argc, char **argv) - - memset(&cmd_opts, 0, sizeof(cmd_opts)); - cmd_opts.indirect = true; -- while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dD:RnSChV", longopts, NULL)) != -1) { -+ while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dDRnSChV", longopts, NULL)) != -1) { - switch (optc) { - case 0: - break; -@@ -1001,18 +984,6 @@ int main(int argc, char **argv) - exit(1); - } - break; -- case 'D': /* default */ -- if (optarg == 0) { -- usage(argv[0], 1); -- printf("Missing default type for -D (--default)\n"); -- exit(1); -- } -- cmd_opts.default_name = strdup(optarg); -- if (!cmd_opts.default_name) { -- -- exit(1); -- } -- break; - case EXPR_ROLE_SOURCE: - if (optarg == 0) { - usage(argv[0], 1); -@@ -1093,7 +1064,7 @@ int main(int argc, char **argv) - case RULE_AUDITALLOW: - cmd_opts.auditallow = true; - break; -- case RULE_DONTAUDIT: -+ case 'D': - cmd_opts.dontaudit = true; - break; - case 'T': /* type */ -@@ -1273,12 +1244,13 @@ int main(int argc, char **argv) - fprintf(stdout, "\n"); - } - -- apol_vector_destroy(&v); -- if (perform_ft_query(policy, &cmd_opts, &v)) { -- rt = 1; -- goto cleanup; -- } -- if (v) { -+ if (cmd_opts.all || cmd_opts.type) { -+ apol_vector_destroy(&v); -+ if (perform_ft_query(policy, &cmd_opts, &v)) { -+ rt = 1; -+ goto cleanup; -+ } -+ - print_ft_results(policy, &cmd_opts, v); - fprintf(stdout, "\n"); - } -@@ -1317,7 +1289,6 @@ int main(int argc, char **argv) - apol_policy_path_destroy(&pol_path); - free(cmd_opts.src_name); - free(cmd_opts.tgt_name); -- free(cmd_opts.default_name); - free(cmd_opts.class_name); - free(cmd_opts.permlist); - free(cmd_opts.bool_name); --- -1.8.5.3 - diff --git a/0009-Fix-swig-coding-style-for-structures.patch b/0009-Fix-swig-coding-style-for-structures.patch deleted file mode 100644 index f05cd4a..0000000 --- a/0009-Fix-swig-coding-style-for-structures.patch +++ /dev/null @@ -1,583 +0,0 @@ -#diff -Nur old_setools/libqpol/swig/qpol.i setools-3.3.7/libqpol/swig/qpol.i -diff -Nur setools-3.3.7/libqpol/swig/qpol.i.current setools-3.3.7/libqpol/swig/qpol.i ---- old_setools/libqpol/swig/qpol.i 2010-04-30 18:23:28.000000000 +0200 -+++ setools-3.3.7/libqpol/swig/qpol.i 2012-07-03 19:20:45.383016553 +0200 -@@ -228,7 +228,7 @@ - #define QPOL_MODULE_OTHER 2 - typedef struct qpol_module {} qpol_module_t; - %extend qpol_module_t { -- qpol_module_t(const char *path) { -+ qpol_module(const char *path) { - qpol_module_t *m; - BEGIN_EXCEPTION - if (qpol_module_create_from_file(path, &m)) { -@@ -239,7 +239,7 @@ - fail: - return NULL; - }; -- ~qpol_module_t() { -+ ~qpol_module() { - qpol_module_destroy(&self); - }; - const char *get_path() { -@@ -330,7 +330,7 @@ - } qpol_capability_e; - - %extend qpol_policy_t { -- qpol_policy_t(const char *path, const int options) { -+ qpol_policy(const char *path, const int options) { - qpol_policy_t *p; - BEGIN_EXCEPTION - if (qpol_policy_open_from_file(path, &p, qpol_swig_message_callback, qpol_swig_message_callback_arg, options) < 0) { -@@ -341,7 +341,7 @@ - fail: - return NULL; - } -- ~qpol_policy_t() { -+ ~qpol_policy() { - qpol_policy_destroy(&self); - }; - void reevaluate_conds() { -@@ -687,14 +687,14 @@ - typedef struct qpol_iterator {} qpol_iterator_t; - %extend qpol_iterator_t { - /* user never directly creates, but SWIG expects a constructor */ -- qpol_iterator_t() { -+ qpol_iterator() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_TypeError, "User may not create iterators difectly"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_iterator_t() { -+ ~qpol_iterator() { - qpol_iterator_destroy(&self); - }; - void *get_item() { -@@ -736,7 +736,7 @@ - /* qpol type */ - typedef struct qpol_type {} qpol_type_t; - %extend qpol_type_t { -- qpol_type_t(qpol_policy_t *p, const char *name) { -+ qpol_type(qpol_policy_t *p, const char *name) { - BEGIN_EXCEPTION - const qpol_type_t *t; - if (qpol_policy_get_type_by_name(p, name, &t)) { -@@ -747,7 +747,7 @@ - fail: - return NULL; - }; -- ~qpol_type_t() { -+ ~qpol_type() { - /* no op */ - return; - }; -@@ -851,7 +851,7 @@ - /* qpol role */ - typedef struct qpol_role {} qpol_role_t; - %extend qpol_role_t { -- qpol_role_t(qpol_policy_t *p, const char *name) { -+ qpol_role(qpol_policy_t *p, const char *name) { - const qpol_role_t *r; - BEGIN_EXCEPTION - if (qpol_policy_get_role_by_name(p, name, &r)) { -@@ -862,7 +862,7 @@ - fail: - return NULL; - }; -- ~qpol_role_t() { -+ ~qpol_role() { - /* no op */ - return; - }; -@@ -919,7 +919,7 @@ - /* qpol level */ - typedef struct qpol_level {} qpol_level_t; - %extend qpol_level_t { -- qpol_level_t(qpol_policy_t *p, const char *name) { -+ qpol_level(qpol_policy_t *p, const char *name) { - const qpol_level_t *l; - BEGIN_EXCEPTION - if (qpol_policy_get_level_by_name(p, name, &l)) { -@@ -930,7 +930,7 @@ - fail: - return NULL; - }; -- ~qpol_level_t() { -+ ~qpol_level() { - /* no op */ - return; - }; -@@ -997,7 +997,7 @@ - /* qpol cat */ - typedef struct qpol_cat {} qpol_cat_t; - %extend qpol_cat_t { -- qpol_cat_t(qpol_policy_t *p, const char *name) { -+ qpol_cat(qpol_policy_t *p, const char *name) { - const qpol_cat_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_cat_by_name(p, name, &c)) { -@@ -1008,7 +1008,7 @@ - fail: - return NULL; - }; -- ~qpol_cat_t() { -+ ~qpol_cat() { - /* no op */ - return; - }; -@@ -1064,14 +1064,14 @@ - /* qpol mls range */ - typedef struct qpol_mls_range {} qpol_mls_range_t; - %extend qpol_mls_range_t { -- qpol_mls_range_t() { -+ qpol_mls_range() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_range_t objects"); - END_EXCEPTION - fail: - return NULL; - } -- ~qpol_mls_range_t() { -+ ~qpol_mls_range() { - /* no op */ - return; - }; -@@ -1105,14 +1105,14 @@ - /* qpol mls level */ - typedef struct qpol_mls_level {} qpol_mls_level_t; - %extend qpol_mls_level_t { -- qpol_mls_level_t() { -+ qpol_mls_level() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_mls_level_t objects"); - END_EXCEPTION - fail: - return NULL; - } -- ~qpol_mls_level_t() { -+ ~qpol_mls_level() { - /* no op */ - return; - }; -@@ -1147,7 +1147,7 @@ - /* qpol user */ - typedef struct qpol_user {} qpol_user_t; - %extend qpol_user_t { -- qpol_user_t(qpol_policy_t *p, const char *name) { -+ qpol_user(qpol_policy_t *p, const char *name) { - const qpol_user_t *u; - BEGIN_EXCEPTION - if (qpol_policy_get_user_by_name(p, name, &u)) { -@@ -1158,7 +1158,7 @@ - fail: - return NULL; - }; -- ~qpol_user_t() { -+ ~qpol_user() { - /* no op */ - return; - }; -@@ -1223,7 +1223,7 @@ - /* qpol bool */ - typedef struct qpol_bool {} qpol_bool_t; - %extend qpol_bool_t { -- qpol_bool_t(qpol_policy_t *p, const char *name) { -+ qpol_bool(qpol_policy_t *p, const char *name) { - qpol_bool_t *b; - BEGIN_EXCEPTION - if (qpol_policy_get_bool_by_name(p, name, &b)) { -@@ -1233,7 +1233,7 @@ - fail: - return b; - }; -- ~qpol_bool_t() { -+ ~qpol_bool() { - /* no op */ - return; - }; -@@ -1295,14 +1295,14 @@ - /* qpol context */ - typedef struct qpol_context {} qpol_context_t; - %extend qpol_context_t { -- qpol_context_t() { -+ qpol_context() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_context_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_context_t() { -+ ~qpol_context() { - /* no op */ - return; - }; -@@ -1356,7 +1356,7 @@ - /* qpol class */ - typedef struct qpol_class {} qpol_class_t; - %extend qpol_class_t { -- qpol_class_t(qpol_policy_t *p, const char *name) { -+ qpol_class(qpol_policy_t *p, const char *name) { - const qpol_class_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_class_by_name(p, name, &c)) { -@@ -1366,7 +1366,7 @@ - fail: - return (qpol_class_t*)c; - }; -- ~qpol_class_t() { -+ ~qpol_class() { - /* no op */ - return; - }; -@@ -1443,7 +1443,7 @@ - /* qpol common */ - typedef struct qpol_common {} qpol_common_t; - %extend qpol_common_t { -- qpol_common_t(qpol_policy_t *p, const char *name) { -+ qpol_common(qpol_policy_t *p, const char *name) { - const qpol_common_t *c; - BEGIN_EXCEPTION - if (qpol_policy_get_common_by_name(p, name, &c)) { -@@ -1453,7 +1453,7 @@ - fail: - return (qpol_common_t*)c; - }; -- ~qpol_common_t() { -+ ~qpol_common() { - /* no op */ - return; - }; -@@ -1515,7 +1515,7 @@ - #define QPOL_FS_USE_PSID 6U - #endif - typedef struct qpol_fs_use {} qpol_fs_use_t; --%extend qpol_fs_use_t { -+%extend qpol_fs_use { - qpol_fs_use_t(qpol_policy_t *p, const char *name) { - const qpol_fs_use_t *f; - BEGIN_EXCEPTION -@@ -1526,7 +1526,7 @@ - fail: - return (qpol_fs_use_t*)f; - }; -- ~qpol_fs_use_t() { -+ ~qpol_fs_use() { - /* no op */ - return; - }; -@@ -1594,7 +1594,7 @@ - #endif - typedef struct qpol_genfscon {} qpol_genfscon_t; - %extend qpol_genfscon_t { -- qpol_genfscon_t(qpol_policy_t *p, const char *name, const char *path) { -+ qpol_genfscon(qpol_policy_t *p, const char *name, const char *path) { - qpol_genfscon_t *g; - BEGIN_EXCEPTION - if (qpol_policy_get_genfscon_by_name(p, name, path, &g)) { -@@ -1604,7 +1604,7 @@ - fail: - return g; - }; -- ~qpol_genfscon_t() { -+ ~qpol_genfscon() { - free(self); - }; - const char *get_name(qpol_policy_t *p) { -@@ -1656,7 +1656,7 @@ - - /* qpol isid */ - typedef struct qpol_isid {} qpol_isid_t; --%extend qpol_isid_t { -+%extend qpol_isid { - qpol_isid_t(qpol_policy_t *p, const char *name) { - const qpol_isid_t *i; - BEGIN_EXCEPTION -@@ -1667,7 +1667,7 @@ - fail: - return (qpol_isid_t*)i; - }; -- ~qpol_isid_t() { -+ ~qpol_isid() { - /* no op */ - return; - }; -@@ -1701,7 +1701,7 @@ - /* qpol netifcon */ - typedef struct qpol_netifcon {} qpol_netifcon_t; - %extend qpol_netifcon_t { -- qpol_netifcon_t(qpol_policy_t *p, const char *name) { -+ qpol_netifcon(qpol_policy_t *p, const char *name) { - const qpol_netifcon_t *n; - BEGIN_EXCEPTION - if (qpol_policy_get_netifcon_by_name(p, name, &n)) { -@@ -1711,7 +1711,7 @@ - fail: - return (qpol_netifcon_t*)n; - }; -- ~qpol_netifcon_t() { -+ ~qpol_netifcon() { - /* no op */ - return; - }; -@@ -1757,7 +1757,7 @@ - #define QPOL_IPV6 1 - typedef struct qpol_nodecon {} qpol_nodecon_t; - %extend qpol_nodecon_t { -- qpol_nodecon_t(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { -+ qpol_nodecon(qpol_policy_t *p, int addr[4], int mask[4], int protocol) { - uint32_t a[4], m[4]; - qpol_nodecon_t *n; - BEGIN_EXCEPTION -@@ -1772,7 +1772,7 @@ - fail: - return n; - } -- ~qpol_nodecon_t() { -+ ~qpol_nodecon() { - free(self); - }; - uint32_t *get_addr(qpol_policy_t *p) { -@@ -1830,7 +1830,7 @@ - #define IPPROTO_UDP 17 - typedef struct qpol_portcon {} qpol_portcon_t; - %extend qpol_portcon_t { -- qpol_portcon_t(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { -+ qpol_portcon(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { - const qpol_portcon_t *qp; - BEGIN_EXCEPTION - if (qpol_policy_get_portcon_by_port(p, low, high, protocol, &qp)) { -@@ -1840,7 +1840,7 @@ - fail: - return (qpol_portcon_t*)qp; - }; -- ~qpol_portcon_t() { -+ ~qpol_portcon() { - /* no op */ - return; - }; -@@ -1893,7 +1893,7 @@ - - /* qpol constraint */ - typedef struct qpol_constraint {} qpol_constraint_t; --%extend qpol_constraint_t { -+%extend qpol_constraint { - qpol_constraint_t() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_t objects"); -@@ -1901,7 +1901,7 @@ - fail: - return NULL; - }; -- ~qpol_constraint_t() { -+ ~qpol_constraint() { - free(self); - }; - const qpol_class_t *get_class(qpol_policy_t *p) { -@@ -1945,7 +1945,7 @@ - - /* qpol validatetrans */ - typedef struct qpol_validatetrans {} qpol_validatetrans_t; --%extend qpol_validatetrans_t { -+%extend qpol_validatetrans { - qpol_validatetrans_t() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_validatetrans_t objects"); -@@ -1953,7 +1953,7 @@ - fail: - return NULL; - }; -- ~qpol_validatetrans_t() { -+ ~qpol_validatetrans() { - free(self); - }; - const qpol_class_t *get_class(qpol_policy_t *p) { -@@ -2011,14 +2011,14 @@ - #define QPOL_CEXPR_OP_INCOMP 5 - typedef struct qpol_constraint_expr_node {} qpol_constraint_expr_node_t; - %extend qpol_constraint_expr_node_t { -- qpol_constraint_expr_node_t() { -+ qpol_constraint_expr_node() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_constraint_expr_node_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_constraint_expr_node_t() { -+ ~qpol_constraint_expr_node() { - /* no op */ - return; - }; -@@ -2073,14 +2073,14 @@ - /* qpol role allow */ - typedef struct qpol_role_allow {} qpol_role_allow_t; - %extend qpol_role_allow_t { -- qpol_role_allow_t() { -+ qpol_role_allow() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_allow_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_role_allow_t() { -+ ~qpol_role_allow() { - /* no op */ - return; - }; -@@ -2114,14 +2114,14 @@ - /* qpol role trans */ - typedef struct qpol_role_trans {} qpol_role_trans_t; - %extend qpol_role_trans_t { -- qpol_role_trans_t() { -+ qpol_role_trans() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_role_trans_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_role_trans_t() { -+ ~qpol_role_trans() { - /* no op */ - return; - }; -@@ -2165,14 +2165,14 @@ - /* qpol range trans */ - typedef struct qpol_range_trans {} qpol_range_trans_t; - %extend qpol_range_trans_t { -- qpol_range_trans_t() { -+ qpol_range_trans() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_range_trans_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_range_trans_t() { -+ ~qpol_range_trans() { - /* no op */ - return; - }; -@@ -2228,14 +2228,14 @@ - #define QPOL_RULE_DONTAUDIT 4 - typedef struct qpol_avrule {} qpol_avrule_t; - %extend qpol_avrule_t { -- qpol_avrule_t() { -+ qpol_avrule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_avrule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_avrule_t() { -+ ~qpol_avrule() { - /* no op */ - return; - }; -@@ -2348,14 +2348,14 @@ - #define QPOL_RULE_TYPE_MEMBER 32 - typedef struct qpol_terule {} qpol_terule_t; - %extend qpol_terule_t { -- qpol_terule_t() { -+ qpol_terule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_terule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_terule_t() { -+ ~qpol_terule() { - /* no op */ - return; - }; -@@ -2464,14 +2464,14 @@ - /* qpol conditional */ - typedef struct qpol_cond {} qpol_cond_t; - %extend qpol_cond_t { -- qpol_cond_t() { -+ qpol_cond() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_cond_t() { -+ ~qpol_cond() { - /* no op */ - return; - }; -@@ -2557,14 +2557,14 @@ - #define QPOL_COND_EXPR_NEQ 7 /* bool != bool */ - typedef struct qpol_cond_expr_node {} qpol_cond_expr_node_t; - %extend qpol_cond_expr_node_t { -- qpol_cond_expr_node_t() { -+ qpol_cond_expr_node() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_cond_expr_node_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_cond_expr_node_t() { -+ ~qpol_cond_expr_node() { - /* no op */ - return; - }; -@@ -2602,14 +2602,14 @@ - /* qpol type set */ - typedef struct qpol_type_set {} qpol_type_set_t; - %extend qpol_type_set_t { -- qpol_type_set_t() { -+ qpol_type_set() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_type_set_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_type_set_t() { -+ ~qpol_type_set() { - /* no op */ - return; - }; -@@ -2665,14 +2665,14 @@ - /* qpol syn av rule */ - typedef struct qpol_syn_avrule {} qpol_syn_avrule_t; - %extend qpol_syn_avrule_t { -- qpol_syn_avrule_t() { -+ qpol_syn_avrule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_avrule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_syn_avrule_t() { -+ ~qpol_syn_avrule() { - /* no op */ - return; - }; -@@ -2778,14 +2778,14 @@ - /* qpol syn te rule */ - typedef struct qpol_syn_terule {} qpol_syn_terule_t; - %extend qpol_syn_terule_t { -- qpol_syn_terule_t() { -+ qpol_syn_terule() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create qpol_syn_terule_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~qpol_syn_terule_t() { -+ ~qpol_syn_terule() { - /* no op */ - return; - }; diff --git a/0010-Apply-swig-patch-to-make-apol-work-again.patch b/0010-Apply-swig-patch-to-make-apol-work-again.patch deleted file mode 100644 index 09c9512..0000000 --- a/0010-Apply-swig-patch-to-make-apol-work-again.patch +++ /dev/null @@ -1,964 +0,0 @@ -From 5d1423e1473bbbcbdd7bba8a57ed7542d1abb285 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 11:13:30 +0200 -Subject: [PATCH 10/11] Apply swig patch to make apol work again - ---- - libapol/swig/apol.i | 218 ++++++++++++++++++++++++++-------------------------- - 1 file changed, 109 insertions(+), 109 deletions(-) - -diff --git a/libapol/swig/apol.i b/libapol/swig/apol.i -index ae1262d..2e9fc55 100644 ---- a/libapol/swig/apol.i -+++ b/libapol/swig/apol.i -@@ -256,7 +256,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); - } - %} - %extend apol_ip_t { -- apol_ip_t(const char *str) { -+ apol_ip(const char *str) { - apol_ip_t *ip = NULL; - BEGIN_EXCEPTION - ip = calloc(1, sizeof(*ip)); -@@ -274,7 +274,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); - fail: - return ip; - }; -- ~apol_ip_t() { -+ ~apol_ip() { - free(self); - }; - int get_protocol() { -@@ -303,16 +303,16 @@ char *apol_file_find_path(const char *file_name); - %} - typedef struct apol_vector {} apol_vector_t; - %extend apol_vector_t { -- apol_vector_t() { -+ apol_vector() { - return apol_vector_create(NULL); - }; -- apol_vector_t(qpol_iterator_t *iter) { -+ apol_vector(qpol_iterator_t *iter) { - return apol_vector_create_from_iter(iter, NULL); - }; -- apol_vector_t(apol_vector_t *v) { -+ apol_vector(apol_vector_t *v) { - return apol_vector_create_from_vector(v, NULL, NULL, NULL); - }; -- apol_vector_t(apol_vector_t *a, apol_vector_t *b) { -+ apol_vector(apol_vector_t *a, apol_vector_t *b) { - return apol_vector_create_from_intersection(a, b, NULL, NULL); - }; - size_t get_size() { -@@ -324,7 +324,7 @@ typedef struct apol_vector {} apol_vector_t; - void *get_element(size_t i) { - return apol_vector_get_element(self, i); - }; -- ~apol_vector_t() { -+ ~apol_vector() { - apol_vector_destroy(&self); - }; - void append(void *x) { -@@ -379,13 +379,13 @@ typedef struct apol_vector {} apol_vector_t; - %} - typedef struct apol_string_vector {} apol_string_vector_t; - %extend apol_string_vector_t { -- apol_string_vector_t() { -+ apol_string_vector() { - return (apol_string_vector_t*)apol_vector_create(free); - }; -- apol_string_vector_t(apol_string_vector_t *v) { -+ apol_string_vector(apol_string_vector_t *v) { - return (apol_string_vector_t*)apol_vector_create_from_vector((apol_vector_t*)v, apol_str_strdup, NULL, free); - }; -- apol_string_vector_t(apol_string_vector_t *a, apol_string_vector_t *b) { -+ apol_string_vector(apol_string_vector_t *a, apol_string_vector_t *b) { - return (apol_string_vector_t*)apol_vector_create_from_intersection((apol_vector_t*)a, (apol_vector_t*)b, apol_str_strcmp, NULL); - }; - size_t get_size() { -@@ -397,7 +397,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; - char *get_element(size_t i) { - return (char*)apol_vector_get_element((apol_vector_t*)self, i); - }; -- ~apol_string_vector_t() { -+ ~apol_string_vector() { - apol_vector_destroy((apol_vector_t**)&self); - }; - size_t get_index(char *str) { -@@ -462,7 +462,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; - } apol_policy_path_type_e; - typedef struct apol_policy_path {} apol_policy_path_t; - %extend apol_policy_path_t { -- apol_policy_path_t(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { -+ apol_policy_path(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create(type, primary, (apol_vector_t*)modules)) == NULL) { -@@ -472,7 +472,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(char *path) { -+ apol_policy_path(char *path) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_file(path)) == NULL) { -@@ -482,7 +482,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(char *str, int unused) { -+ apol_policy_path(char *str, int unused) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_string(str)) == NULL) { -@@ -492,7 +492,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(apol_policy_path_t *in) { -+ apol_policy_path(apol_policy_path_t *in) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_policy_path(in)) == NULL) { -@@ -502,7 +502,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- ~apol_policy_path_t() { -+ ~apol_policy_path() { - apol_policy_path_destroy(&self); - }; - apol_policy_path_type_e get_type() { -@@ -549,7 +549,7 @@ typedef struct apol_policy {} apol_policy_t; - #define APOL_PERMMAP_BOTH (APOL_PERMMAP_READ | APOL_PERMMAP_WRITE) - #define APOL_PERMMAP_NONE 0x10 - %extend apol_policy_t { -- apol_policy_t(apol_policy_path_t *path, int options = 0) { -+ apol_policy(apol_policy_path_t *path, int options = 0) { - apol_policy_t *p; - BEGIN_EXCEPTION - p = apol_policy_create_from_policy_path(path, options, apol_swig_message_callback, apol_swig_message_callback_arg); -@@ -564,7 +564,7 @@ typedef struct apol_policy {} apol_policy_t; - fail: - return p; - }; -- ~apol_policy_t() { -+ ~apol_policy() { - apol_policy_destroy(&self); - }; - int get_policy_type() { -@@ -652,7 +652,7 @@ typedef struct apol_policy {} apol_policy_t; - /* apol type query */ - typedef struct apol_type_query {} apol_type_query_t; - %extend apol_type_query_t { -- apol_type_query_t() { -+ apol_type_query() { - apol_type_query_t *tq; - BEGIN_EXCEPTION - tq = apol_type_query_create(); -@@ -663,7 +663,7 @@ typedef struct apol_type_query {} apol_type_query_t; - fail: - return tq; - }; -- ~apol_type_query_t() { -+ ~apol_type_query() { - apol_type_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -694,7 +694,7 @@ typedef struct apol_type_query {} apol_type_query_t; - /* apol attribute query */ - typedef struct apol_attr_query {} apol_attr_query_t; - %extend apol_attr_query_t { -- apol_attr_query_t() { -+ apol_attr_query() { - apol_attr_query_t *aq; - BEGIN_EXCEPTION - aq = apol_attr_query_create(); -@@ -705,7 +705,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; - fail: - return aq; - }; -- ~apol_attr_query_t() { -+ ~apol_attr_query() { - apol_attr_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -736,7 +736,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; - /* apol role query */ - typedef struct apol_role_query {} apol_role_query_t; - %extend apol_role_query_t { -- apol_role_query_t() { -+ apol_role_query() { - apol_role_query_t *rq; - BEGIN_EXCEPTION - rq = apol_role_query_create(); -@@ -747,7 +747,7 @@ typedef struct apol_role_query {} apol_role_query_t; - fail: - return rq; - }; -- ~apol_role_query_t() { -+ ~apol_role_query() { - apol_role_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -788,7 +788,7 @@ int apol_role_has_type(apol_policy_t * p, qpol_role_t * r, qpol_type_t * t); - /* apol class query */ - typedef struct apol_class_query {} apol_class_query_t; - %extend apol_class_query_t { -- apol_class_query_t() { -+ apol_class_query() { - apol_class_query_t *cq; - BEGIN_EXCEPTION - cq = apol_class_query_create(); -@@ -799,7 +799,7 @@ typedef struct apol_class_query {} apol_class_query_t; - fail: - return cq; - }; -- ~apol_class_query_t() { -+ ~apol_class_query() { - apol_class_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -839,7 +839,7 @@ typedef struct apol_class_query {} apol_class_query_t; - /* apol common query */ - typedef struct apol_common_query {} apol_common_query_t; - %extend apol_common_query_t { -- apol_common_query_t() { -+ apol_common_query() { - apol_common_query_t *cq; - BEGIN_EXCEPTION - cq = apol_common_query_create(); -@@ -850,7 +850,7 @@ typedef struct apol_common_query {} apol_common_query_t; - fail: - return cq; - }; -- ~apol_common_query_t() { -+ ~apol_common_query() { - apol_common_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -881,7 +881,7 @@ typedef struct apol_common_query {} apol_common_query_t; - /* apol perm query */ - typedef struct apol_perm_query {} apol_perm_query_t; - %extend apol_perm_query_t { -- apol_perm_query_t() { -+ apol_perm_query() { - apol_perm_query_t *pq; - BEGIN_EXCEPTION - pq = apol_perm_query_create(); -@@ -892,7 +892,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; - fail: - return pq; - }; -- ~apol_perm_query_t() { -+ ~apol_perm_query() { - apol_perm_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -923,7 +923,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; - /* apol bool query */ - typedef struct apol_bool_query {} apol_bool_query_t; - %extend apol_bool_query_t { -- apol_bool_query_t() { -+ apol_bool_query() { - apol_bool_query_t *bq; - BEGIN_EXCEPTION - bq = apol_bool_query_create(); -@@ -934,7 +934,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; - fail: - return bq; - }; -- ~apol_bool_query_t() { -+ ~apol_bool_query() { - apol_bool_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -965,7 +965,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; - /* apol mls level */ - typedef struct apol_mls_level {} apol_mls_level_t; - %extend apol_mls_level_t { -- apol_mls_level_t() { -+ apol_mls_level() { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create(); -@@ -976,7 +976,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_mls_level_t *in) { -+ apol_mls_level(apol_mls_level_t *in) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_mls_level(in); -@@ -987,7 +987,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, const char *str) { -+ apol_mls_level(apol_policy_t *p, const char *str) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_string(p, str); -@@ -998,7 +998,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(const char *str) { -+ apol_mls_level(const char *str) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_literal(str); -@@ -1009,7 +1009,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, qpol_mls_level_t *qml) { -+ apol_mls_level(apol_policy_t *p, qpol_mls_level_t *qml) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_qpol_mls_level(p, qml); -@@ -1020,7 +1020,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, qpol_level_t *ql) { -+ apol_mls_level(apol_policy_t *p, qpol_level_t *ql) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_qpol_level_datum(p, ql); -@@ -1031,7 +1031,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- ~apol_mls_level_t() { -+ ~apol_mls_level() { - apol_mls_level_destroy(&self); - }; - void set_sens(apol_policy_t *p, char *sens) { -@@ -1128,7 +1128,7 @@ int apol_mls_cats_compare(apol_policy_t * p, const char *cat1, const char *cat2) - #endif - typedef struct apol_mls_range {} apol_mls_range_t; - %extend apol_mls_range_t { -- apol_mls_range_t() { -+ apol_mls_range() { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create(); -@@ -1139,7 +1139,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_mls_range_t *in) { -+ apol_mls_range(apol_mls_range_t *in) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_mls_range(in); -@@ -1150,7 +1150,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_policy_t *p, const char *s) { -+ apol_mls_range(apol_policy_t *p, const char *s) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_string(p, s); -@@ -1161,7 +1161,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(const char *s) { -+ apol_mls_range(const char *s) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_literal(s); -@@ -1172,7 +1172,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_policy_t *p, qpol_mls_range_t *in) { -+ apol_mls_range(apol_policy_t *p, qpol_mls_range_t *in) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_qpol_mls_range(p, in); -@@ -1183,7 +1183,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- ~apol_mls_range_t() { -+ ~apol_mls_range() { - apol_mls_range_destroy(&self); - }; - void set_low(apol_policy_t *p, apol_mls_level_t *lvl) { -@@ -1278,7 +1278,7 @@ int apol_mls_range_contain_subrange(apol_policy_t * p, const apol_mls_range_t * - /* apol level query */ - typedef struct apol_level_query {} apol_level_query_t; - %extend apol_level_query_t { -- apol_level_query_t() { -+ apol_level_query() { - apol_level_query_t * alq; - BEGIN_EXCEPTION - alq = apol_level_query_create(); -@@ -1289,7 +1289,7 @@ typedef struct apol_level_query {} apol_level_query_t; - fail: - return alq; - }; -- ~apol_level_query_t() { -+ ~apol_level_query() { - apol_level_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1329,7 +1329,7 @@ typedef struct apol_level_query {} apol_level_query_t; - /* apol cat query */ - typedef struct apol_cat_query {} apol_cat_query_t; - %extend apol_cat_query_t { -- apol_cat_query_t() { -+ apol_cat_query() { - apol_cat_query_t * acq; - BEGIN_EXCEPTION - acq = apol_cat_query_create(); -@@ -1340,7 +1340,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; - fail: - return acq; - }; -- ~apol_cat_query_t() { -+ ~apol_cat_query() { - apol_cat_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -1379,7 +1379,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; - #endif - typedef struct apol_user_query {} apol_user_query_t; - %extend apol_user_query_t { -- apol_user_query_t() { -+ apol_user_query() { - apol_user_query_t *auq; - BEGIN_EXCEPTION - auq = apol_user_query_create(); -@@ -1390,7 +1390,7 @@ typedef struct apol_user_query {} apol_user_query_t; - fail: - return auq; - }; -- ~apol_user_query_t() { -+ ~apol_user_query() { - apol_user_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1448,7 +1448,7 @@ typedef struct apol_user_query {} apol_user_query_t; - /* apol context */ - typedef struct apol_context {} apol_context_t; - %extend apol_context_t { -- apol_context_t() { -+ apol_context() { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create(); -@@ -1459,7 +1459,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- apol_context_t(apol_policy_t *p, qpol_context_t *in) { -+ apol_context(apol_policy_t *p, qpol_context_t *in) { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create_from_qpol_context(p, in); -@@ -1470,7 +1470,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- apol_context_t(const char *str) { -+ apol_context(const char *str) { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create_from_literal(str); -@@ -1481,7 +1481,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- ~apol_context_t() { -+ ~apol_context() { - apol_context_destroy(&self); - }; - void set_user(apol_policy_t *p, char *name) { -@@ -1583,7 +1583,7 @@ int apol_context_compare(apol_policy_t * p, apol_context_t * target, apol_contex - /* apol constraint query */ - typedef struct apol_constraint_query {} apol_constraint_query_t; - %extend apol_constraint_query_t { -- apol_constraint_query_t() { -+ apol_constraint_query() { - apol_constraint_query_t *acq; - BEGIN_EXCEPTION - acq = apol_constraint_query_create(); -@@ -1594,7 +1594,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; - fail: - return acq; - }; -- ~apol_constraint_query_t() { -+ ~apol_constraint_query() { - apol_constraint_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1634,7 +1634,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; - /* apol validatetrans query */ - typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - %extend apol_validatetrans_query_t { -- apol_validatetrans_query_t() { -+ apol_validatetrans_query() { - apol_validatetrans_query_t *avq; - BEGIN_EXCEPTION - avq = apol_validatetrans_query_create(); -@@ -1645,7 +1645,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - fail: - return avq; - }; -- ~apol_validatetrans_query_t() { -+ ~apol_validatetrans_query() { - apol_validatetrans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1684,7 +1684,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - #endif - typedef struct apol_genfscon_query {} apol_genfscon_query_t; - %extend apol_genfscon_query_t { -- apol_genfscon_query_t() { -+ apol_genfscon_query() { - apol_genfscon_query_t *agq; - BEGIN_EXCEPTION - agq = apol_genfscon_query_create(); -@@ -1695,7 +1695,7 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; - fail: - return agq; - }; -- ~apol_genfscon_query_t() { -+ ~apol_genfscon_query() { - apol_genfscon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1746,7 +1746,7 @@ char *apol_genfscon_render(apol_policy_t * p, qpol_genfscon_t * genfscon); - /* apol fs_use query */ - typedef struct apol_fs_use_query {} apol_fs_use_query_t; - %extend apol_fs_use_query_t { -- apol_fs_use_query_t() { -+ apol_fs_use_query() { - apol_fs_use_query_t *afq; - BEGIN_EXCEPTION - afq = apol_fs_use_query_create(); -@@ -1757,7 +1757,7 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; - fail: - return afq; - }; -- ~apol_fs_use_query_t() { -+ ~apol_fs_use_query() { - apol_fs_use_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1799,7 +1799,7 @@ char *apol_fs_use_render(apol_policy_t * p, qpol_fs_use_t * fsuse); - /* apol initial sid query */ - typedef struct apol_isid_query {} apol_isid_query_t; - %extend apol_isid_query_t { -- apol_isid_query_t() { -+ apol_isid_query() { - apol_isid_query_t *aiq; - BEGIN_EXCEPTION - aiq = apol_isid_query_create(); -@@ -1810,7 +1810,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; - fail: - return aiq; - }; -- ~apol_isid_query_t() { -+ ~apol_isid_query() { - apol_isid_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1841,7 +1841,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; - /* apol portcon query */ - typedef struct apol_portcon_query {} apol_portcon_query_t; - %extend apol_portcon_query_t { -- apol_portcon_query_t() { -+ apol_portcon_query() { - apol_portcon_query_t *apq; - BEGIN_EXCEPTION - apq = apol_portcon_query_create(); -@@ -1852,7 +1852,7 @@ typedef struct apol_portcon_query {} apol_portcon_query_t; - fail: - return apq; - }; -- ~apol_portcon_query_t() { -+ ~apol_portcon_query() { - apol_portcon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1885,7 +1885,7 @@ char *apol_portcon_render(apol_policy_t * p, qpol_portcon_t * portcon); - /* apol netifcon query */ - typedef struct apol_netifcon_query {} apol_netifcon_query_t; - %extend apol_netifcon_query_t { -- apol_netifcon_query_t() { -+ apol_netifcon_query() { - apol_netifcon_query_t *anq; - BEGIN_EXCEPTION - anq = apol_netifcon_query_create(); -@@ -1896,7 +1896,7 @@ typedef struct apol_netifcon_query {} apol_netifcon_query_t; - fail: - return anq; - }; -- ~apol_netifcon_query_t() { -+ ~apol_netifcon_query() { - apol_netifcon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1932,7 +1932,7 @@ char *apol_netifcon_render(apol_policy_t * p, qpol_netifcon_t * netifcon); - /* apol nodecon query */ - typedef struct apol_nodecon_query {} apol_nodecon_query_t; - %extend apol_nodecon_query_t { -- apol_nodecon_query_t() { -+ apol_nodecon_query() { - apol_nodecon_query_t *anq; - BEGIN_EXCEPTION - anq = apol_nodecon_query_create(); -@@ -1943,7 +1943,7 @@ typedef struct apol_nodecon_query {} apol_nodecon_query_t; - fail: - return anq; - }; -- ~apol_nodecon_query_t() { -+ ~apol_nodecon_query() { - apol_nodecon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2012,7 +2012,7 @@ char *apol_nodecon_render(apol_policy_t * p, qpol_nodecon_t * nodecon); - /* apol avrule query */ - typedef struct apol_avrule_query {} apol_avrule_query_t; - %extend apol_avrule_query_t { -- apol_avrule_query_t() { -+ apol_avrule_query() { - apol_avrule_query_t *avq; - BEGIN_EXCEPTION - avq = apol_avrule_query_create(); -@@ -2023,7 +2023,7 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; - fail: - return avq; - }; -- ~apol_avrule_query_t() { -+ ~apol_avrule_query() { - apol_avrule_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2163,7 +2163,7 @@ char *apol_syn_avrule_render(apol_policy_t * policy, qpol_syn_avrule_t * rule); - /* apol terule query */ - typedef struct apol_terule_query {} apol_terule_query_t; - %extend apol_terule_query_t { -- apol_terule_query_t() { -+ apol_terule_query() { - apol_terule_query_t *atq; - BEGIN_EXCEPTION - atq = apol_terule_query_create(); -@@ -2174,7 +2174,7 @@ typedef struct apol_terule_query {} apol_terule_query_t; - fail: - return atq; - }; -- ~apol_terule_query_t() { -+ ~apol_terule_query() { - apol_terule_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2287,7 +2287,7 @@ apol_vector_t *apol_terule_list_to_syn_terules(apol_policy_t * p, apol_vector_t - /* apol cond rule query */ - typedef struct apol_cond_query {} apol_cond_query_t; - %extend apol_cond_query_t { -- apol_cond_query_t() { -+ apol_cond_query() { - apol_cond_query_t *acq; - BEGIN_EXCEPTION - acq = apol_cond_query_create(); -@@ -2298,7 +2298,7 @@ typedef struct apol_cond_query {} apol_cond_query_t; - fail: - return acq; - }; -- ~apol_cond_query_t() { -+ ~apol_cond_query() { - apol_cond_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2331,7 +2331,7 @@ char *apol_cond_expr_render(apol_policy_t * p, qpol_cond_t * cond); - /* apol role allow query */ - typedef struct apol_role_allow_query {} apol_role_allow_query_t; - %extend apol_role_allow_query_t { -- apol_role_allow_query_t() { -+ apol_role_allow_query() { - apol_role_allow_query_t *arq; - BEGIN_EXCEPTION - arq = apol_role_allow_query_create(); -@@ -2342,7 +2342,7 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; - fail: - return arq; - }; -- ~apol_role_allow_query_t() { -+ ~apol_role_allow_query() { - apol_role_allow_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2387,7 +2387,7 @@ char *apol_role_allow_render(apol_policy_t * policy, qpol_role_allow_t * rule); - /* apol role transition rule query */ - typedef struct apol_role_trans_query {} apol_role_trans_query_t; - %extend apol_role_trans_query_t { -- apol_role_trans_query_t() { -+ apol_role_trans_query() { - apol_role_trans_query_t *arq; - BEGIN_EXCEPTION - arq = apol_role_trans_query_create(); -@@ -2398,7 +2398,7 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; - fail: - return arq; - }; -- ~apol_role_trans_query_t() { -+ ~apol_role_trans_query() { - apol_role_trans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2452,7 +2452,7 @@ char *apol_role_trans_render(apol_policy_t * policy, qpol_role_trans_t * rule); - /* apol range transition rule query */ - typedef struct apol_range_trans_query {} apol_range_trans_query_t; - %extend apol_range_trans_query_t { -- apol_range_trans_query_t() { -+ apol_range_trans_query() { - apol_range_trans_query_t *arq; - BEGIN_EXCEPTION - arq = apol_range_trans_query_create(); -@@ -2463,7 +2463,7 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; - fail: - return arq; - }; -- ~apol_range_trans_query_t() { -+ ~apol_range_trans_query() { - apol_range_trans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2531,7 +2531,7 @@ char *apol_range_trans_render(apol_policy_t * policy, qpol_range_trans_t * rule) - #define APOL_DOMAIN_TRANS_SEARCH_BOTH (APOL_DOMAIN_TRANS_SEARCH_VALID|APOL_DOMAIN_TRANS_SEARCH_INVALID) - typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - %extend apol_domain_trans_analysis_t { -- apol_domain_trans_analysis_t() { -+ apol_domain_trans_analysis() { - apol_domain_trans_analysis_t *dta; - BEGIN_EXCEPTION - dta = apol_domain_trans_analysis_create(); -@@ -2542,7 +2542,7 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - fail: - return dta; - }; -- ~apol_domain_trans_analysis_t() { -+ ~apol_domain_trans_analysis() { - apol_domain_trans_analysis_destroy(&self); - }; - void set_direction(apol_policy_t *p, int direction) { -@@ -2622,7 +2622,7 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - }; - typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; - %extend apol_domain_trans_result_t { -- apol_domain_trans_result_t(apol_domain_trans_result_t *in) { -+ apol_domain_trans_result(apol_domain_trans_result_t *in) { - apol_domain_trans_result_t *dtr; - BEGIN_EXCEPTION - dtr = apol_domain_trans_result_create_from_domain_trans_result(in); -@@ -2633,7 +2633,7 @@ typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; - fail: - return dtr; - }; -- ~apol_domain_trans_result_t() { -+ ~apol_domain_trans_result() { - apol_domain_trans_result_destroy(&self); - }; - const qpol_type_t *get_start_type() { -@@ -2705,14 +2705,14 @@ int apol_domain_trans_table_verify_trans(apol_policy_t * policy, qpol_type_t * s - %} - typedef struct apol_infoflow {} apol_infoflow_t; - %extend apol_infoflow_t { -- apol_infoflow_t() { -+ apol_infoflow() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_t() { -+ ~apol_infoflow() { - apol_infoflow_destroy(&self); - }; - %newobject extract_graph(); -@@ -2730,7 +2730,7 @@ typedef struct apol_infoflow {} apol_infoflow_t; - }; - typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - %extend apol_infoflow_analysis_t { -- apol_infoflow_analysis_t() { -+ apol_infoflow_analysis() { - apol_infoflow_analysis_t *aia; - BEGIN_EXCEPTION - aia = apol_infoflow_analysis_create(); -@@ -2741,7 +2741,7 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - fail: - return aia; - }; -- ~apol_infoflow_analysis_t() { -+ ~apol_infoflow_analysis() { - apol_infoflow_analysis_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2823,14 +2823,14 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - }; - typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; - %extend apol_infoflow_graph_t { -- apol_infoflow_graph_t() { -+ apol_infoflow_graph() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_graph_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_graph_t() { -+ ~apol_infoflow_graph() { - apol_infoflow_graph_destroy(&self); - }; - %newobject do_more(apol_policy_t*, char*); -@@ -2867,14 +2867,14 @@ typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; - }; - typedef struct apol_infoflow_result {} apol_infoflow_result_t; - %extend apol_infoflow_result_t { -- apol_infoflow_result_t() { -+ apol_infoflow_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_result_t() { -+ ~apol_infoflow_result() { - /* no op - vector will destroy */ - return; - }; -@@ -2901,14 +2901,14 @@ typedef struct apol_infoflow_result {} apol_infoflow_result_t; - %} - typedef struct apol_infoflow_step {} apol_infoflow_step_t; - %extend apol_infoflow_step_t { -- apol_infoflow_step_t() { -+ apol_infoflow_step() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_step_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_step_t() { -+ ~apol_infoflow_step() { - /* no op */ - return; - }; -@@ -2938,7 +2938,7 @@ typedef struct apol_infoflow_step {} apol_infoflow_step_t; - #define APOL_RELABEL_DIR_SUBJECT 0x04 - typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - %extend apol_relabel_analysis_t { -- apol_relabel_analysis_t() { -+ apol_relabel_analysis() { - apol_relabel_analysis_t *ara; - BEGIN_EXCEPTION - ara = apol_relabel_analysis_create(); -@@ -2949,7 +2949,7 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - fail: - return ara; - }; -- ~apol_relabel_analysis_t() { -+ ~apol_relabel_analysis() { - apol_relabel_analysis_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -3011,14 +3011,14 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - }; - typedef struct apol_relabel_result {} apol_relabel_result_t; - %extend apol_relabel_result_t { -- apol_relabel_result_t() { -+ apol_relabel_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_relabel_result_t() { -+ ~apol_relabel_result() { - /* no op - vector will destroy */ - return; - }; -@@ -3042,14 +3042,14 @@ typedef struct apol_relabel_result {} apol_relabel_result_t; - %} - typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; - %extend apol_relabel_result_pair_t { -- apol_relabel_result_pair_t() { -+ apol_relabel_result_pair() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_pair_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_relabel_result_pair_t() { -+ ~apol_relabel_result_pair() { - /* no op - owned and free()'d by apol_relabel_result_t */ - return; - }; -@@ -3084,7 +3084,7 @@ typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; - #define APOL_TYPES_RELATION_TRANS_FLOW_BA 0x8000 - typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - %extend apol_types_relation_analysis_t { -- apol_types_relation_analysis_t() { -+ apol_types_relation_analysis() { - apol_types_relation_analysis_t *atr; - BEGIN_EXCEPTION - atr = apol_types_relation_analysis_create(); -@@ -3095,7 +3095,7 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - fail: - return atr; - }; -- ~apol_types_relation_analysis_t() { -+ ~apol_types_relation_analysis() { - apol_types_relation_analysis_destroy(&self); - } - %newobject run(apol_policy_t*); -@@ -3139,14 +3139,14 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - }; - typedef struct apol_types_relation_result {} apol_types_relation_result_t; - %extend apol_types_relation_result_t { -- apol_types_relation_result_t() { -+ apol_types_relation_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_types_relation_result_t() { -+ ~apol_types_relation_result() { - apol_types_relation_result_destroy(&self); - }; - const apol_vector_t *get_attributes() { -@@ -3194,14 +3194,14 @@ typedef struct apol_types_relation_result {} apol_types_relation_result_t; - }; - typedef struct apol_types_relation_access {} apol_types_relation_access_t; - %extend apol_types_relation_access_t { -- apol_types_relation_access_t() { -+ apol_types_relation_access() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_access_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_types_relation_access_t() { -+ ~apol_types_relation_access() { - /* no op - vector will destroy */ - return; - }; --- -1.8.5.3 - diff --git a/0010-selinux_current_policy_path.patch b/0010-selinux_current_policy_path.patch deleted file mode 100644 index e9cc81d..0000000 --- a/0010-selinux_current_policy_path.patch +++ /dev/null @@ -1,84 +0,0 @@ -diff -up setools-3.3.7/libqpol/src/util.c.current setools-3.3.7/libqpol/src/util.c ---- setools-3.3.7/libqpol/src/util.c.current 2010-04-23 12:22:08.000000000 -0400 -+++ setools-3.3.7/libqpol/src/util.c 2012-02-16 12:01:33.030434514 -0500 -@@ -84,75 +84,12 @@ static int get_binpol_version(const char - - static int search_policy_binary_file(char **path) - { -- const char *binary_path; -- if ((binary_path = selinux_binary_policy_path()) == NULL) { -- return -1; -+ const char *binary_path = selinux_current_policy_path(); -+ if (binary_path) { -+ *path = strdup(binary_path); -+ if (*path) return 0; - } -- -- int expected_version = -1, latest_version = -1; --#ifdef LIBSELINUX -- /* if the system has SELinux enabled, prefer the policy whose -- name matches the current policy version */ -- if ((expected_version = security_policyvers()) < 0) { -- return -1; -- } --#endif -- -- glob_t glob_buf; -- struct stat fs; -- int rt, error = 0, retval = -1; -- size_t i; -- char *pattern = NULL; -- if (asprintf(&pattern, "%s.*", binary_path) < 0) { -- return -1; -- } -- glob_buf.gl_offs = 1; -- glob_buf.gl_pathc = 0; -- rt = glob(pattern, GLOB_DOOFFS, NULL, &glob_buf); -- if (rt != 0 && rt != GLOB_NOMATCH) { -- errno = EIO; -- return -1; -- } -- -- for (i = 0; i < glob_buf.gl_pathc; i++) { -- char *p = glob_buf.gl_pathv[i + glob_buf.gl_offs]; -- if (stat(p, &fs) != 0) { -- error = errno; -- goto cleanup; -- } -- if (S_ISDIR(fs.st_mode)) -- continue; -- -- if ((rt = get_binpol_version(p)) < 0) { -- error = errno; -- goto cleanup; -- } -- -- if (rt > latest_version || rt == expected_version) { -- free(*path); -- if ((*path = strdup(p)) == NULL) { -- error = errno; -- goto cleanup; -- } -- if (rt == expected_version) { -- break; -- } -- latest_version = rt; -- } -- } -- -- if (*path == NULL) { -- retval = 1; -- } else { -- retval = 0; -- } -- cleanup: -- free(pattern); -- globfree(&glob_buf); -- if (retval == -1) { -- errno = error; -- } -- return retval; -+ return -1; - } - - int qpol_default_policy_find(char **path) diff --git a/0011-Fix-Wformat-security-issues.patch b/0011-Fix-Wformat-security-issues.patch deleted file mode 100644 index 5288ed7..0000000 --- a/0011-Fix-Wformat-security-issues.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 32ede3cc817ee4f6806877a34a6c84ed50c31df7 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Fri, 11 Apr 2014 18:49:33 +0200 -Subject: [PATCH 11/11] Fix -Wformat-security issues - ---- - libseaudit/src/bool_message.c | 4 ++-- - libseaudit/src/filter.c | 2 +- - libseaudit/src/model.c | 2 +- - seaudit/progress.c | 4 ++-- - seaudit/toplevel.c | 2 +- - seaudit/utilgui.c | 2 +- - sediff/progress.c | 4 ++-- - sediff/toplevel.c | 2 +- - sediff/utilgui.c | 2 +- - 9 files changed, 12 insertions(+), 12 deletions(-) - -diff --git a/libseaudit/src/bool_message.c b/libseaudit/src/bool_message.c -index f105cf0..d5b1e33 100644 ---- a/libseaudit/src/bool_message.c -+++ b/libseaudit/src/bool_message.c -@@ -101,7 +101,7 @@ char *bool_message_to_string(const seaudit_message_t * msg, const char *date) - return NULL; - } - if ((misc_string = bool_message_to_misc_string(boolm)) == NULL || -- apol_str_appendf(&s, &len, misc_string) < 0 || apol_str_append(&s, &len, close_brace) < 0) { -+ apol_str_appendf(&s, &len, "%s", misc_string) < 0 || apol_str_append(&s, &len, close_brace) < 0) { - free(misc_string); - return NULL; - } -@@ -128,7 +128,7 @@ char *bool_message_to_string_html(const seaudit_message_t * msg, const char *dat - return NULL; - } - if ((misc_string = bool_message_to_misc_string(boolm)) == NULL || -- apol_str_appendf(&s, &len, misc_string) < 0 || apol_str_appendf(&s, &len, "%s%s
", s, close_brace) < 0) { -+ apol_str_appendf(&s, &len, "%s", misc_string) < 0 || apol_str_appendf(&s, &len, "%s%s
", s, close_brace) < 0) { - free(misc_string); - return NULL; - } -diff --git a/libseaudit/src/filter.c b/libseaudit/src/filter.c -index 298a309..c710ce4 100644 ---- a/libseaudit/src/filter.c -+++ b/libseaudit/src/filter.c -@@ -1108,7 +1108,7 @@ int seaudit_filter_save_to_file(const seaudit_filter_t * filter, const char *fil - if ((file = fopen(filename, "w")) == NULL) { - return -1; - } -- fprintf(file, XML_VER); -+ fprintf(file, "%s", XML_VER); - fprintf(file, "\n", FILTER_FILE_FORMAT_VERSION); - filter_append_to_file(filter, file, 1); - fprintf(file, "\n"); -diff --git a/libseaudit/src/model.c b/libseaudit/src/model.c -index 1bc4a23..4a130cb 100644 ---- a/libseaudit/src/model.c -+++ b/libseaudit/src/model.c -@@ -514,7 +514,7 @@ int seaudit_model_save_to_file(const seaudit_model_t * model, const char *filena - if ((file = fopen(filename, "w")) == NULL) { - return -1; - } -- fprintf(file, XML_VER); -+ fprintf(file, "%s", XML_VER); - fprintf(file, "\n", - FILTER_FILE_FORMAT_VERSION, model->name, - model->match == SEAUDIT_FILTER_MATCH_ALL ? "all" : "any", -diff --git a/seaudit/progress.c b/seaudit/progress.c -index 2e0abeb..f092858 100644 ---- a/seaudit/progress.c -+++ b/seaudit/progress.c -@@ -114,10 +114,10 @@ int progress_wait(progress_t * progress) - } - g_mutex_unlock(progress->mutex); - if (progress->done < 0) { -- toplevel_ERR(progress->top, GTK_LABEL(progress->label2)->label); -+ toplevel_ERR(progress->top, "%s", GTK_LABEL(progress->label2)->label); - return progress->done; - } else if (progress->done > 1) { -- toplevel_WARN(progress->top, GTK_LABEL(progress->label2)->label); -+ toplevel_WARN(progress->top, "%s", GTK_LABEL(progress->label2)->label); - return progress->done - 1; - } else { - progress->done = 0; -diff --git a/seaudit/toplevel.c b/seaudit/toplevel.c -index d901a99..27938d5 100644 ---- a/seaudit/toplevel.c -+++ b/seaudit/toplevel.c -@@ -902,7 +902,7 @@ static void toplevel_message(toplevel_t * top, GtkMessageType msg_type, const ch - ERR(NULL, "%s", strerror(errno)); - return; - } -- dialog = gtk_message_dialog_new(top->w, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, msg); -+ dialog = gtk_message_dialog_new(top->w, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, "%s", msg); - free(msg); - gtk_dialog_run(GTK_DIALOG(dialog)); - gtk_widget_destroy(dialog); -diff --git a/seaudit/utilgui.c b/seaudit/utilgui.c -index 22028e1..78a1a08 100644 ---- a/seaudit/utilgui.c -+++ b/seaudit/utilgui.c -@@ -30,7 +30,7 @@ - void util_message(GtkWindow * parent, GtkMessageType msg_type, const char *msg) - { - GtkWidget *dialog; -- dialog = gtk_message_dialog_new(parent, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, msg); -+ dialog = gtk_message_dialog_new(parent, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, "%s", msg); - gtk_dialog_run(GTK_DIALOG(dialog)); - gtk_widget_destroy(dialog); - } -diff --git a/sediff/progress.c b/sediff/progress.c -index efaa120..312789e 100644 ---- a/sediff/progress.c -+++ b/sediff/progress.c -@@ -115,10 +115,10 @@ int progress_wait(progress_t * progress) - } - g_mutex_unlock(progress->mutex); - if (progress->done < 0) { -- toplevel_ERR(progress->top, GTK_LABEL(progress->label2)->label); -+ toplevel_ERR(progress->top, "%s", GTK_LABEL(progress->label2)->label); - return progress->done; - } else if (progress->done > 1) { -- toplevel_WARN(progress->top, GTK_LABEL(progress->label2)->label); -+ toplevel_WARN(progress->top, "%s", GTK_LABEL(progress->label2)->label); - return progress->done - 1; - } else { - progress->done = 0; -diff --git a/sediff/toplevel.c b/sediff/toplevel.c -index db6d1f5..aabd039 100644 ---- a/sediff/toplevel.c -+++ b/sediff/toplevel.c -@@ -453,7 +453,7 @@ static void toplevel_message(toplevel_t * top, GtkMessageType msg_type, const ch - ERR(NULL, "%s", strerror(errno)); - return; - } -- dialog = gtk_message_dialog_new(top->w, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, msg); -+ dialog = gtk_message_dialog_new(top->w, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, "%s", msg); - free(msg); - gtk_dialog_run(GTK_DIALOG(dialog)); - gtk_widget_destroy(dialog); -diff --git a/sediff/utilgui.c b/sediff/utilgui.c -index 04e1e05..9e183ba 100644 ---- a/sediff/utilgui.c -+++ b/sediff/utilgui.c -@@ -31,7 +31,7 @@ - void util_message(GtkWindow * parent, GtkMessageType msg_type, const char *msg) - { - GtkWidget *dialog; -- dialog = gtk_message_dialog_new(parent, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, msg); -+ dialog = gtk_message_dialog_new(parent, GTK_DIALOG_DESTROY_WITH_PARENT, msg_type, GTK_BUTTONS_CLOSE, "%s", msg); - gtk_dialog_run(GTK_DIALOG(dialog)); - gtk_widget_destroy(dialog); - } --- -1.8.5.3 - diff --git a/0011-setools-noship.patch b/0011-setools-noship.patch deleted file mode 100644 index b678d30..0000000 --- a/0011-setools-noship.patch +++ /dev/null @@ -1,255 +0,0 @@ -diff -up setools-3.3.7/Makefile.am.noship setools-3.3.7/Makefile.am ---- setools-3.3.7/Makefile.am.noship 2008-02-22 14:06:28.000000000 -0500 -+++ setools-3.3.7/Makefile.am 2013-01-30 09:18:59.775157146 -0500 -@@ -8,9 +8,8 @@ endif - if BUILD_GUI - MAYBE_GUI = seaudit - endif --# sediffx is also built conditionally, from sediffx/Makefile.am - --SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) -+SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) - - #old indent opts - #INDENT_OPTS = -npro -nbad -bap -sob -ss -l132 -di1 -nbc -br -nbbb -c40 -cd40 -ncdb -ce -cli0 -cp40 -ncs -d0 -nfc1 -nfca -i8 -ts8 -ci8 -lp -ip0 -npcs -npsl -sc -@@ -49,12 +48,6 @@ seaudit: libqpol libapol libseaudit - sediff: libqpol libapol libpoldiff - $(MAKE) -C $(top_srcdir)/sediff sediff - --sediffx: libqpol libapol libpoldiff -- $(MAKE) -C $(top_srcdir)/sediff sediffx -- --sechecker: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/sechecker -- - help: - @echo "Make targets for SETools:" - @echo " all: build everything, but do not install" -@@ -65,8 +58,6 @@ help: - @echo " secmds: build command line tools" - @echo " seaudit: build audit log analysis tools" - @echo " sediff: build semantic policy diff command line tool" -- @echo " sediffx: build semantic policy diff graphical tool" -- @echo " sechecker: build policy checking tool" - @echo "" - @echo " install-logwatch: install LogWatch config files for seaudit-report" - @echo " (requires LogWatch and root privileges)" -@@ -78,9 +69,9 @@ install-logwatch: - $(MAKE) -C $(top_srcdir)/seaudit install-logwatch - - .PHONY: libqpol libapol libpoldiff libsefs libseaudit \ -- apol secmds seaudit sediff sediffx sechecker \ -+ apol secmds seaudit sediff \ - install-logwatch help \ -- seinfo sesearch indexcon findcon replcon searchcon \ -+ seinfo sesearch \ - packages - - seinfo: libqpol libapol -@@ -89,18 +80,6 @@ seinfo: libqpol libapol - sesearch: libqpol libapol - $(MAKE) -C $(top_srcdir)/secmds sesearch - --indexcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds indexcon -- --findcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds findcon -- --replcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds replcon -- --searchcon: libqpol libapol libsefs -- $(MAKE) -C $(top_srcdir)/secmds searchcon -- - packages: - $(MAKE) -C $(top_srcdir)/packages - -diff -up setools-3.3.7/man/Makefile.am.noship setools-3.3.7/man/Makefile.am ---- setools-3.3.7/man/Makefile.am.noship 2007-08-02 17:16:33.000000000 -0400 -+++ setools-3.3.7/man/Makefile.am 2013-01-30 09:16:13.696871566 -0500 -@@ -1,19 +1,10 @@ - if BUILD_GUI - MAYBEMANS = apol.1 \ -- seaudit.8 seaudit-report.8 \ -- sediffx.1 -+ seaudit.8 - endif - - EXTRA_DIST=$(man_MANS) apol.1 \ -- seaudit.8 seaudit-report.8.in \ -- sediffx.1 -+ seaudit.8 - --man_MANS = findcon.1 indexcon.1 replcon.1 \ -- sechecker.1 \ -- sediff.1 \ -+man_MANS = sediff.1 \ - seinfo.1 sesearch.1 $(MAYBEMANS) -- --seaudit-report.8: seaudit-report.8.in Makefile -- sed -e 's|\@setoolsdir\@|$(setoolsdir)|g' $< > $@ -- --CLEANFILES = seaudit-report.8 -diff -up setools-3.3.7/seaudit/Makefile.am.noship setools-3.3.7/seaudit/Makefile.am ---- setools-3.3.7/seaudit/Makefile.am.noship 2008-02-22 14:06:28.000000000 -0500 -+++ setools-3.3.7/seaudit/Makefile.am 2013-01-30 09:16:13.697871568 -0500 -@@ -1,5 +1,4 @@ - setoolsdir = @setoolsdir@ --bin_PROGRAMS = seaudit-report - sbin_PROGRAMS = seaudit - - AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -@@ -20,13 +19,10 @@ LDADD = @SELINUX_LIB_FLAG@ @SEAUDIT_LIB_ - dist_setools_DATA = \ - seaudit.glade \ - seaudit_help.txt \ -- seaudit-report.conf \ -- seaudit-report.css \ - seaudit.png seaudit-small.png - - nodist_setools_DATA = \ -- dot_seaudit \ -- seaudit-report-service -+ dot_seaudit - - seaudit_SOURCES = \ - filter_view.c filter_view.h \ -@@ -50,31 +46,12 @@ seaudit_DEPENDENCIES = $(top_builddir)/l - dot_seaudit: dot_seaudit.in Makefile - sed -e 's|\@setoolsdir\@|$(setoolsdir)|g' $< > $@ - --seaudit_report_SOURCES = seaudit-report.c --seaudit_report_DEPENDENCIES = $(top_builddir)/libseaudit/src/libseaudit.so \ -- $(top_builddir)/libapol/src/libapol.so \ -- $(top_builddir)/libqpol/src/libqpol.so -- - logwatch = $(DESTDIR)/etc/logwatch - LOGWATCH_GROUP = $(logwatch)/conf/logfiles - LOGWATCH_SERVICE = $(logwatch)/conf/services - LOGWATCH_FILTER = $(logwatch)/scripts/services - --dist_noinst_DATA = dot_seaudit.in \ -- seaudit-report-group.conf \ -- seaudit-report-service.conf \ -- seaudit-report-service.in -- --seaudit-report-service: seaudit-report-service.in Makefile -- sed -e 's|\@bindir\@|$(bindir)|g' $< > $@ -- --install-logwatch: $(dist_noinst_DATA) seaudit-report-service -- mkdir -p -- $(LOGWATCH_GROUP) -- install -m 644 seaudit-report-group.conf $(LOGWATCH_GROUP) -- mkdir -p -- $(LOGWATCH_SERVICE) -- install -m 644 seaudit-report-service.conf $(LOGWATCH_SERVICE) -- mkdir -p -- $(LOGWATCH_FILTER) -- install -m 755 seaudit-report-service $(LOGWATCH_FILTER) -+dist_noinst_DATA = dot_seaudit.in - - $(top_builddir)/libapol/src/libapol.so: - $(MAKE) -C $(top_builddir)/libapol/src $(notdir $@) -@@ -85,6 +62,4 @@ $(top_builddir)/libqpol/src/libqpol.so: - $(top_builddir)/libsefs/src/libsefs.so: - $(MAKE) -C $(top_builddir)/libsefs/src $(notdir $@) - --.PHONY: install-logwatch -- --CLEANFILES = dot_seaudit seaudit-report-service -+CLEANFILES = dot_seaudit -diff -up setools-3.3.7/secmds/Makefile.am.noship setools-3.3.7/secmds/Makefile.am ---- setools-3.3.7/secmds/Makefile.am.noship 2007-08-02 17:16:33.000000000 -0400 -+++ setools-3.3.7/secmds/Makefile.am 2013-01-30 09:16:13.698871569 -0500 -@@ -1,6 +1,6 @@ - # various setools command line tools - --bin_PROGRAMS = seinfo sesearch findcon replcon indexcon -+bin_PROGRAMS = seinfo sesearch - - # These are for indexcon so that it is usable on machines without setools - STATICLIBS = ../libsefs/src/libsefs.a ../libapol/src/libapol.a ../libqpol/src/libqpol.a -lsqlite3 -@@ -18,18 +18,6 @@ seinfo_SOURCES = seinfo.c - - sesearch_SOURCES = sesearch.c - --indexcon_SOURCES = indexcon.cc --indexcon_LDADD = @SELINUX_LIB_FLAG@ $(STATICLIBS) --indexcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- --findcon_SOURCES = findcon.cc --findcon_LDADD = @SEFS_LIB_FLAG@ $(LDADD) --findcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- --replcon_SOURCES = replcon.cc --replcon_LDADD = @SEFS_LIB_FLAG@ $(LDADD) --replcon_DEPENDENCIES = $(DEPENDENCIES) $(top_builddir)/libsefs/src/libsefs.so -- - $(top_builddir)/libapol/src/libapol.so: - $(MAKE) -C $(top_builddir)/libapol/src $(notdir $@) - -diff -up setools-3.3.7/sediff/Makefile.am.noship setools-3.3.7/sediff/Makefile.am ---- setools-3.3.7/sediff/Makefile.am.noship 2007-04-25 15:20:20.000000000 -0400 -+++ setools-3.3.7/sediff/Makefile.am 2013-01-30 09:16:13.698871569 -0500 -@@ -1,13 +1,6 @@ - setoolsdir = @setoolsdir@ - --dist_setools_DATA = sediff_help.txt sediffx.glade \ -- sediffx.png sediffx-small.png -- --if BUILD_GUI -- MAYBE_SEDIFFX = sediffx --endif -- --bin_PROGRAMS = sediff $(MAYBE_SEDIFFX) -+bin_PROGRAMS = sediff - - AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ - @QPOL_CFLAGS@ @APOL_CFLAGS@ @POLDIFF_CFLAGS@ -@@ -15,14 +8,7 @@ AM_LDFLAGS = @DEBUGLDFLAGS@ @WARNLDFLAGS - - LDADD = @SELINUX_LIB_FLAG@ @POLDIFF_LIB_FLAG@ @APOL_LIB_FLAG@ @QPOL_LIB_FLAG@ - --sediff_CFLAGS = $(AM_CFLAGS) --sediffx_CFLAGS = $(AM_CFLAGS) \ -- @GTK_CFLAGS@ @PIXBUF_CFLAGS@ @GLADE_CFLAGS@ @GTHREAD_CFLAGS@ -- --# need the -rdynamic flag below - glade uses dlopen() upon sediffx callbacks --sediffx_LDFLAGS = $(AM_LDFLAGS) \ -- @GTK_LIBS@ @PIXBUF_LIBS@ @GLADE_LIBS@ @GTHREAD_LIBS@ @XML_LIBS@ \ -- -rdynamic -+sediff_CFLAGS = $(AM_CFLAGS) - - DEPENDENCIES = $(top_builddir)/libpoldiff/src/libpoldiff.so \ - $(top_builddir)/libapol/src/libapol.so \ -@@ -30,20 +16,6 @@ DEPENDENCIES = $(top_builddir)/libpoldif - - sediff_SOURCES = sediff.c - --sediffx_SOURCES = \ -- find_dialog.c find_dialog.h \ -- open_policies_dialog.c open_policies_dialog.h \ -- policy_view.c policy_view.h \ -- progress.c progress.h \ -- remap_types_dialog.c remap_types_dialog.h \ -- result_item.c result_item.h \ -- result_item_render.c result_item_render.h \ -- results.c results.h \ -- select_diff_dialog.c select_diff_dialog.h \ -- toplevel.c toplevel.h \ -- utilgui.c utilgui.h \ -- sediffx.c sediffx.h -- - $(top_builddir)/libpoldiff/src/libpoldiff.so: - $(MAKE) -C $(top_builddir)/libpoldiff/src $(notdir $@) - -diff -up setools-3.3.7/configure.ac~ setools-3.3.7/configure.ac ---- setools-3.3.7/configure.ac~ 2013-01-30 09:52:05.689136955 -0500 -+++ setools-3.3.7/configure.ac 2013-01-30 09:56:26.853722063 -0500 -@@ -63,7 +63,7 @@ if test ${ac_cv_prog_cc_c99} = "no"; the - fi - AC_PROG_CXX - AC_LANG([C]) --AC_PROG_LIBTOOL -+AC_PROG_RANLIB - AC_PROG_LN_S - AC_PROG_LEX - AC_PROG_YACC diff --git a/0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch b/0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch deleted file mode 100644 index 7dd153f..0000000 --- a/0012-Fix-configure.ac-to-use-SWIG-3.0.0.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 9fbf625c8606ff4a51d3d797b002bbf698592154 Mon Sep 17 00:00:00 2001 -From: Miroslav Grepl -Date: Sun, 13 Apr 2014 20:58:14 +0200 -Subject: [PATCH] Fix configure.ac to use SWIG-3.0.0 - ---- - configure.ac | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 5b1da5e..11c0e3e 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -194,7 +194,7 @@ AC_ARG_ENABLE(swig-java, - enable_jswig="$enableval") - if test "x${enable_jswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(2.0.0) -+ AC_PROG_SWIG(3.0.0) - fi - AC_JAVA_OPTIONS - if test "x$JAVAPREFIX" = x; then -@@ -225,14 +225,14 @@ AC_ARG_ENABLE(swig-python, - enable_pyswig="$enableval") - if test "x${enable_pyswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(2.0.0) -+ AC_PROG_SWIG(3.0.0) - fi - SWIG_PYTHON - do_swigify_python=yes - do_swigify=yes - fi - if test ${do_swigify} = "yes"; then -- AC_PROG_SWIG(2.0.0) -+ AC_PROG_SWIG(3.0.0) - fi - build_apol=yes - AC_ARG_ENABLE(swig-tcl, -@@ -241,7 +241,7 @@ AC_ARG_ENABLE(swig-tcl, - enable_tclswig="$enableval", enable_tclswig="yes") - if test "x${enable_tclswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(2.0.0) -+ AC_PROG_SWIG(3.0.0) - fi - TEA_INIT(3.5) - TEA_PATH_TCLCONFIG --- -1.8.5.3 - diff --git a/0012-seaudit.patch b/0012-seaudit.patch deleted file mode 100644 index 78da66e..0000000 --- a/0012-seaudit.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff -up setools-3.3.7/libqpol/swig/java/Makefile.am.seaudit setools-3.3.7/libqpol/swig/java/Makefile.am ---- setools-3.3.7/libqpol/swig/java/Makefile.am.seaudit 2010-05-03 12:37:54.000000000 -0400 -+++ setools-3.3.7/libqpol/swig/java/Makefile.am 2012-09-28 10:15:56.408912525 -0400 -@@ -48,7 +48,6 @@ BUILT_SOURCES = qpol_wrap.c \ - qpol_type_t.java \ - qpol_user_t.java \ - qpol_validatetrans_t.java \ -- SWIGTYPE_p_int.java \ - SWIGTYPE_p_unsigned_int.java \ - SWIGTYPE_p_void.java - -diff -up setools-3.3.7/seaudit/progress.c.seaudit setools-3.3.7/seaudit/progress.c ---- setools-3.3.7/seaudit/progress.c.seaudit 2007-08-02 17:16:33.000000000 -0400 -+++ setools-3.3.7/seaudit/progress.c 2012-09-28 10:15:56.407912521 -0400 -@@ -99,10 +99,11 @@ void progress_hide(progress_t * progress - - int progress_wait(progress_t * progress) - { -- GTimeVal wait_time = { 0, 50000 }; -+ gint64 end_time; - g_mutex_lock(progress->mutex); - while (!progress->done) { -- g_cond_timed_wait(progress->cond, progress->mutex, &wait_time); -+ end_time = g_get_monotonic_time () + 50000; // need to be set before each wait -+ g_cond_wait_until(progress->cond, progress->mutex,end_time); - if (progress->s != NULL) { - gtk_label_set_text(GTK_LABEL(progress->label2), progress->s); - free(progress->s); diff --git a/0013-libqpol-Skip-types-when-building-type-attribute-map.patch b/0013-libqpol-Skip-types-when-building-type-attribute-map.patch deleted file mode 100644 index efdd8a9..0000000 --- a/0013-libqpol-Skip-types-when-building-type-attribute-map.patch +++ /dev/null @@ -1,29 +0,0 @@ -From f7b31b7e28a4f89bcfcd0d139cfca78777a4333e Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Thu, 4 Feb 2016 14:06:49 -0500 -Subject: [PATCH] libqpol: Skip types when building type attribute map. - -Fix originally from Richard Haines. - -Closes #94. ---- - libqpol/src/policy_extend.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/libqpol/src/policy_extend.c b/libqpol/src/policy_extend.c -index 1417271..416bddb 100644 ---- a/libqpol/src/policy_extend.c -+++ b/libqpol/src/policy_extend.c -@@ -201,6 +201,9 @@ static int qpol_policy_build_attrs_from_map(qpol_policy_t * policy) - memset(&buff, 0, 10 * sizeof(char)); - - for (i = 0; i < db->p_types.nprim; i++) { -+ /* skip types */ -+ if (db->type_val_to_struct[i]->flavor == TYPE_TYPE) -+ continue; - count = 0; - ebitmap_for_each_bit(&db->attr_type_map[i], node, bit) { - if (ebitmap_node_get_bit(node, bit)) --- -2.5.0 - diff --git a/0013-swig.patch b/0013-swig.patch deleted file mode 100644 index 56bbd40..0000000 --- a/0013-swig.patch +++ /dev/null @@ -1,956 +0,0 @@ -@@ -, +, @@ ---- - libapol/swig/apol.i | 218 ++++++++++++++++++++++++++-------------------------- - 1 file changed, 109 insertions(+), 109 deletions(-) ---- a/libapol/swig/apol.i -+++ a/libapol/swig/apol.i -@@ -256,7 +256,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); - } - %} - %extend apol_ip_t { -- apol_ip_t(const char *str) { -+ apol_ip(const char *str) { - apol_ip_t *ip = NULL; - BEGIN_EXCEPTION - ip = calloc(1, sizeof(*ip)); -@@ -274,7 +274,7 @@ uint8_t apol_str_to_protocol(const char *protocol_str); - fail: - return ip; - }; -- ~apol_ip_t() { -+ ~apol_ip() { - free(self); - }; - int get_protocol() { -@@ -303,16 +303,16 @@ char *apol_file_find_path(const char *file_name); - %} - typedef struct apol_vector {} apol_vector_t; - %extend apol_vector_t { -- apol_vector_t() { -+ apol_vector() { - return apol_vector_create(NULL); - }; -- apol_vector_t(qpol_iterator_t *iter) { -+ apol_vector(qpol_iterator_t *iter) { - return apol_vector_create_from_iter(iter, NULL); - }; -- apol_vector_t(apol_vector_t *v) { -+ apol_vector(apol_vector_t *v) { - return apol_vector_create_from_vector(v, NULL, NULL, NULL); - }; -- apol_vector_t(apol_vector_t *a, apol_vector_t *b) { -+ apol_vector(apol_vector_t *a, apol_vector_t *b) { - return apol_vector_create_from_intersection(a, b, NULL, NULL); - }; - size_t get_size() { -@@ -324,7 +324,7 @@ typedef struct apol_vector {} apol_vector_t; - void *get_element(size_t i) { - return apol_vector_get_element(self, i); - }; -- ~apol_vector_t() { -+ ~apol_vector() { - apol_vector_destroy(&self); - }; - void append(void *x) { -@@ -379,13 +379,13 @@ typedef struct apol_vector {} apol_vector_t; - %} - typedef struct apol_string_vector {} apol_string_vector_t; - %extend apol_string_vector_t { -- apol_string_vector_t() { -+ apol_string_vector() { - return (apol_string_vector_t*)apol_vector_create(free); - }; -- apol_string_vector_t(apol_string_vector_t *v) { -+ apol_string_vector(apol_string_vector_t *v) { - return (apol_string_vector_t*)apol_vector_create_from_vector((apol_vector_t*)v, apol_str_strdup, NULL, free); - }; -- apol_string_vector_t(apol_string_vector_t *a, apol_string_vector_t *b) { -+ apol_string_vector(apol_string_vector_t *a, apol_string_vector_t *b) { - return (apol_string_vector_t*)apol_vector_create_from_intersection((apol_vector_t*)a, (apol_vector_t*)b, apol_str_strcmp, NULL); - }; - size_t get_size() { -@@ -397,7 +397,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; - char *get_element(size_t i) { - return (char*)apol_vector_get_element((apol_vector_t*)self, i); - }; -- ~apol_string_vector_t() { -+ ~apol_string_vector() { - apol_vector_destroy((apol_vector_t**)&self); - }; - size_t get_index(char *str) { -@@ -462,7 +462,7 @@ typedef struct apol_string_vector {} apol_string_vector_t; - } apol_policy_path_type_e; - typedef struct apol_policy_path {} apol_policy_path_t; - %extend apol_policy_path_t { -- apol_policy_path_t(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { -+ apol_policy_path(apol_policy_path_type_e type, char * primary, apol_string_vector_t *modules = NULL) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create(type, primary, (apol_vector_t*)modules)) == NULL) { -@@ -472,7 +472,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(char *path) { -+ apol_policy_path(char *path) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_file(path)) == NULL) { -@@ -482,7 +482,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(char *str, int unused) { -+ apol_policy_path(char *str, int unused) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_string(str)) == NULL) { -@@ -492,7 +492,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- apol_policy_path_t(apol_policy_path_t *in) { -+ apol_policy_path(apol_policy_path_t *in) { - apol_policy_path_t *p; - BEGIN_EXCEPTION - if ((p = apol_policy_path_create_from_policy_path(in)) == NULL) { -@@ -502,7 +502,7 @@ typedef struct apol_policy_path {} apol_policy_path_t; - fail: - return p; - }; -- ~apol_policy_path_t() { -+ ~apol_policy_path() { - apol_policy_path_destroy(&self); - }; - apol_policy_path_type_e get_type() { -@@ -549,7 +549,7 @@ typedef struct apol_policy {} apol_policy_t; - #define APOL_PERMMAP_BOTH (APOL_PERMMAP_READ | APOL_PERMMAP_WRITE) - #define APOL_PERMMAP_NONE 0x10 - %extend apol_policy_t { -- apol_policy_t(apol_policy_path_t *path, int options = 0) { -+ apol_policy(apol_policy_path_t *path, int options = 0) { - apol_policy_t *p; - BEGIN_EXCEPTION - p = apol_policy_create_from_policy_path(path, options, apol_swig_message_callback, apol_swig_message_callback_arg); -@@ -564,7 +564,7 @@ typedef struct apol_policy {} apol_policy_t; - fail: - return p; - }; -- ~apol_policy_t() { -+ ~apol_policy() { - apol_policy_destroy(&self); - }; - int get_policy_type() { -@@ -652,7 +652,7 @@ typedef struct apol_policy {} apol_policy_t; - /* apol type query */ - typedef struct apol_type_query {} apol_type_query_t; - %extend apol_type_query_t { -- apol_type_query_t() { -+ apol_type_query() { - apol_type_query_t *tq; - BEGIN_EXCEPTION - tq = apol_type_query_create(); -@@ -663,7 +663,7 @@ typedef struct apol_type_query {} apol_type_query_t; - fail: - return tq; - }; -- ~apol_type_query_t() { -+ ~apol_type_query() { - apol_type_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -694,7 +694,7 @@ typedef struct apol_type_query {} apol_type_query_t; - /* apol attribute query */ - typedef struct apol_attr_query {} apol_attr_query_t; - %extend apol_attr_query_t { -- apol_attr_query_t() { -+ apol_attr_query() { - apol_attr_query_t *aq; - BEGIN_EXCEPTION - aq = apol_attr_query_create(); -@@ -705,7 +705,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; - fail: - return aq; - }; -- ~apol_attr_query_t() { -+ ~apol_attr_query() { - apol_attr_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -736,7 +736,7 @@ typedef struct apol_attr_query {} apol_attr_query_t; - /* apol role query */ - typedef struct apol_role_query {} apol_role_query_t; - %extend apol_role_query_t { -- apol_role_query_t() { -+ apol_role_query() { - apol_role_query_t *rq; - BEGIN_EXCEPTION - rq = apol_role_query_create(); -@@ -747,7 +747,7 @@ typedef struct apol_role_query {} apol_role_query_t; - fail: - return rq; - }; -- ~apol_role_query_t() { -+ ~apol_role_query() { - apol_role_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -788,7 +788,7 @@ int apol_role_has_type(apol_policy_t * p, qpol_role_t * r, qpol_type_t * t); - /* apol class query */ - typedef struct apol_class_query {} apol_class_query_t; - %extend apol_class_query_t { -- apol_class_query_t() { -+ apol_class_query() { - apol_class_query_t *cq; - BEGIN_EXCEPTION - cq = apol_class_query_create(); -@@ -799,7 +799,7 @@ typedef struct apol_class_query {} apol_class_query_t; - fail: - return cq; - }; -- ~apol_class_query_t() { -+ ~apol_class_query() { - apol_class_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -839,7 +839,7 @@ typedef struct apol_class_query {} apol_class_query_t; - /* apol common query */ - typedef struct apol_common_query {} apol_common_query_t; - %extend apol_common_query_t { -- apol_common_query_t() { -+ apol_common_query() { - apol_common_query_t *cq; - BEGIN_EXCEPTION - cq = apol_common_query_create(); -@@ -850,7 +850,7 @@ typedef struct apol_common_query {} apol_common_query_t; - fail: - return cq; - }; -- ~apol_common_query_t() { -+ ~apol_common_query() { - apol_common_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -881,7 +881,7 @@ typedef struct apol_common_query {} apol_common_query_t; - /* apol perm query */ - typedef struct apol_perm_query {} apol_perm_query_t; - %extend apol_perm_query_t { -- apol_perm_query_t() { -+ apol_perm_query() { - apol_perm_query_t *pq; - BEGIN_EXCEPTION - pq = apol_perm_query_create(); -@@ -892,7 +892,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; - fail: - return pq; - }; -- ~apol_perm_query_t() { -+ ~apol_perm_query() { - apol_perm_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -923,7 +923,7 @@ typedef struct apol_perm_query {} apol_perm_query_t; - /* apol bool query */ - typedef struct apol_bool_query {} apol_bool_query_t; - %extend apol_bool_query_t { -- apol_bool_query_t() { -+ apol_bool_query() { - apol_bool_query_t *bq; - BEGIN_EXCEPTION - bq = apol_bool_query_create(); -@@ -934,7 +934,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; - fail: - return bq; - }; -- ~apol_bool_query_t() { -+ ~apol_bool_query() { - apol_bool_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -965,7 +965,7 @@ typedef struct apol_bool_query {} apol_bool_query_t; - /* apol mls level */ - typedef struct apol_mls_level {} apol_mls_level_t; - %extend apol_mls_level_t { -- apol_mls_level_t() { -+ apol_mls_level() { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create(); -@@ -976,7 +976,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_mls_level_t *in) { -+ apol_mls_level(apol_mls_level_t *in) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_mls_level(in); -@@ -987,7 +987,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, const char *str) { -+ apol_mls_level(apol_policy_t *p, const char *str) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_string(p, str); -@@ -998,7 +998,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(const char *str) { -+ apol_mls_level(const char *str) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_literal(str); -@@ -1009,7 +1009,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, qpol_mls_level_t *qml) { -+ apol_mls_level(apol_policy_t *p, qpol_mls_level_t *qml) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_qpol_mls_level(p, qml); -@@ -1020,7 +1020,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- apol_mls_level_t(apol_policy_t *p, qpol_level_t *ql) { -+ apol_mls_level(apol_policy_t *p, qpol_level_t *ql) { - apol_mls_level_t *aml; - BEGIN_EXCEPTION - aml = apol_mls_level_create_from_qpol_level_datum(p, ql); -@@ -1031,7 +1031,7 @@ typedef struct apol_mls_level {} apol_mls_level_t; - fail: - return aml; - }; -- ~apol_mls_level_t() { -+ ~apol_mls_level() { - apol_mls_level_destroy(&self); - }; - void set_sens(apol_policy_t *p, char *sens) { -@@ -1128,7 +1128,7 @@ int apol_mls_cats_compare(apol_policy_t * p, const char *cat1, const char *cat2) - #endif - typedef struct apol_mls_range {} apol_mls_range_t; - %extend apol_mls_range_t { -- apol_mls_range_t() { -+ apol_mls_range() { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create(); -@@ -1139,7 +1139,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_mls_range_t *in) { -+ apol_mls_range(apol_mls_range_t *in) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_mls_range(in); -@@ -1150,7 +1150,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_policy_t *p, const char *s) { -+ apol_mls_range(apol_policy_t *p, const char *s) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_string(p, s); -@@ -1161,7 +1161,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(const char *s) { -+ apol_mls_range(const char *s) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_literal(s); -@@ -1172,7 +1172,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- apol_mls_range_t(apol_policy_t *p, qpol_mls_range_t *in) { -+ apol_mls_range(apol_policy_t *p, qpol_mls_range_t *in) { - apol_mls_range_t *amr; - BEGIN_EXCEPTION - amr = apol_mls_range_create_from_qpol_mls_range(p, in); -@@ -1183,7 +1183,7 @@ typedef struct apol_mls_range {} apol_mls_range_t; - fail: - return amr; - }; -- ~apol_mls_range_t() { -+ ~apol_mls_range() { - apol_mls_range_destroy(&self); - }; - void set_low(apol_policy_t *p, apol_mls_level_t *lvl) { -@@ -1278,7 +1278,7 @@ int apol_mls_range_contain_subrange(apol_policy_t * p, const apol_mls_range_t * - /* apol level query */ - typedef struct apol_level_query {} apol_level_query_t; - %extend apol_level_query_t { -- apol_level_query_t() { -+ apol_level_query() { - apol_level_query_t * alq; - BEGIN_EXCEPTION - alq = apol_level_query_create(); -@@ -1289,7 +1289,7 @@ typedef struct apol_level_query {} apol_level_query_t; - fail: - return alq; - }; -- ~apol_level_query_t() { -+ ~apol_level_query() { - apol_level_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1329,7 +1329,7 @@ typedef struct apol_level_query {} apol_level_query_t; - /* apol cat query */ - typedef struct apol_cat_query {} apol_cat_query_t; - %extend apol_cat_query_t { -- apol_cat_query_t() { -+ apol_cat_query() { - apol_cat_query_t * acq; - BEGIN_EXCEPTION - acq = apol_cat_query_create(); -@@ -1340,7 +1340,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; - fail: - return acq; - }; -- ~apol_cat_query_t() { -+ ~apol_cat_query() { - apol_cat_query_destroy(&self); - }; - %newobject run(apol_policy_t *); -@@ -1379,7 +1379,7 @@ typedef struct apol_cat_query {} apol_cat_query_t; - #endif - typedef struct apol_user_query {} apol_user_query_t; - %extend apol_user_query_t { -- apol_user_query_t() { -+ apol_user_query() { - apol_user_query_t *auq; - BEGIN_EXCEPTION - auq = apol_user_query_create(); -@@ -1390,7 +1390,7 @@ typedef struct apol_user_query {} apol_user_query_t; - fail: - return auq; - }; -- ~apol_user_query_t() { -+ ~apol_user_query() { - apol_user_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1448,7 +1448,7 @@ typedef struct apol_user_query {} apol_user_query_t; - /* apol context */ - typedef struct apol_context {} apol_context_t; - %extend apol_context_t { -- apol_context_t() { -+ apol_context() { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create(); -@@ -1459,7 +1459,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- apol_context_t(apol_policy_t *p, qpol_context_t *in) { -+ apol_context(apol_policy_t *p, qpol_context_t *in) { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create_from_qpol_context(p, in); -@@ -1470,7 +1470,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- apol_context_t(const char *str) { -+ apol_context(const char *str) { - apol_context_t *ctx; - BEGIN_EXCEPTION - ctx = apol_context_create_from_literal(str); -@@ -1481,7 +1481,7 @@ typedef struct apol_context {} apol_context_t; - fail: - return ctx; - }; -- ~apol_context_t() { -+ ~apol_context() { - apol_context_destroy(&self); - }; - void set_user(apol_policy_t *p, char *name) { -@@ -1583,7 +1583,7 @@ int apol_context_compare(apol_policy_t * p, apol_context_t * target, apol_contex - /* apol constraint query */ - typedef struct apol_constraint_query {} apol_constraint_query_t; - %extend apol_constraint_query_t { -- apol_constraint_query_t() { -+ apol_constraint_query() { - apol_constraint_query_t *acq; - BEGIN_EXCEPTION - acq = apol_constraint_query_create(); -@@ -1594,7 +1594,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; - fail: - return acq; - }; -- ~apol_constraint_query_t() { -+ ~apol_constraint_query() { - apol_constraint_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1634,7 +1634,7 @@ typedef struct apol_constraint_query {} apol_constraint_query_t; - /* apol validatetrans query */ - typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - %extend apol_validatetrans_query_t { -- apol_validatetrans_query_t() { -+ apol_validatetrans_query() { - apol_validatetrans_query_t *avq; - BEGIN_EXCEPTION - avq = apol_validatetrans_query_create(); -@@ -1645,7 +1645,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - fail: - return avq; - }; -- ~apol_validatetrans_query_t() { -+ ~apol_validatetrans_query() { - apol_validatetrans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1684,7 +1684,7 @@ typedef struct apol_validatetrans_query {} apol_validatetrans_query_t; - #endif - typedef struct apol_genfscon_query {} apol_genfscon_query_t; - %extend apol_genfscon_query_t { -- apol_genfscon_query_t() { -+ apol_genfscon_query() { - apol_genfscon_query_t *agq; - BEGIN_EXCEPTION - agq = apol_genfscon_query_create(); -@@ -1695,7 +1695,7 @@ typedef struct apol_genfscon_query {} apol_genfscon_query_t; - fail: - return agq; - }; -- ~apol_genfscon_query_t() { -+ ~apol_genfscon_query() { - apol_genfscon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1746,7 +1746,7 @@ char *apol_genfscon_render(apol_policy_t * p, qpol_genfscon_t * genfscon); - /* apol fs_use query */ - typedef struct apol_fs_use_query {} apol_fs_use_query_t; - %extend apol_fs_use_query_t { -- apol_fs_use_query_t() { -+ apol_fs_use_query() { - apol_fs_use_query_t *afq; - BEGIN_EXCEPTION - afq = apol_fs_use_query_create(); -@@ -1757,7 +1757,7 @@ typedef struct apol_fs_use_query {} apol_fs_use_query_t; - fail: - return afq; - }; -- ~apol_fs_use_query_t() { -+ ~apol_fs_use_query() { - apol_fs_use_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1799,7 +1799,7 @@ char *apol_fs_use_render(apol_policy_t * p, qpol_fs_use_t * fsuse); - /* apol initial sid query */ - typedef struct apol_isid_query {} apol_isid_query_t; - %extend apol_isid_query_t { -- apol_isid_query_t() { -+ apol_isid_query() { - apol_isid_query_t *aiq; - BEGIN_EXCEPTION - aiq = apol_isid_query_create(); -@@ -1810,7 +1810,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; - fail: - return aiq; - }; -- ~apol_isid_query_t() { -+ ~apol_isid_query() { - apol_isid_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1841,7 +1841,7 @@ typedef struct apol_isid_query {} apol_isid_query_t; - /* apol portcon query */ - typedef struct apol_portcon_query {} apol_portcon_query_t; - %extend apol_portcon_query_t { -- apol_portcon_query_t() { -+ apol_portcon_query() { - apol_portcon_query_t *apq; - BEGIN_EXCEPTION - apq = apol_portcon_query_create(); -@@ -1852,7 +1852,7 @@ typedef struct apol_portcon_query {} apol_portcon_query_t; - fail: - return apq; - }; -- ~apol_portcon_query_t() { -+ ~apol_portcon_query() { - apol_portcon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1885,7 +1885,7 @@ char *apol_portcon_render(apol_policy_t * p, qpol_portcon_t * portcon); - /* apol netifcon query */ - typedef struct apol_netifcon_query {} apol_netifcon_query_t; - %extend apol_netifcon_query_t { -- apol_netifcon_query_t() { -+ apol_netifcon_query() { - apol_netifcon_query_t *anq; - BEGIN_EXCEPTION - anq = apol_netifcon_query_create(); -@@ -1896,7 +1896,7 @@ typedef struct apol_netifcon_query {} apol_netifcon_query_t; - fail: - return anq; - }; -- ~apol_netifcon_query_t() { -+ ~apol_netifcon_query() { - apol_netifcon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -1932,7 +1932,7 @@ char *apol_netifcon_render(apol_policy_t * p, qpol_netifcon_t * netifcon); - /* apol nodecon query */ - typedef struct apol_nodecon_query {} apol_nodecon_query_t; - %extend apol_nodecon_query_t { -- apol_nodecon_query_t() { -+ apol_nodecon_query() { - apol_nodecon_query_t *anq; - BEGIN_EXCEPTION - anq = apol_nodecon_query_create(); -@@ -1943,7 +1943,7 @@ typedef struct apol_nodecon_query {} apol_nodecon_query_t; - fail: - return anq; - }; -- ~apol_nodecon_query_t() { -+ ~apol_nodecon_query() { - apol_nodecon_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2012,7 +2012,7 @@ char *apol_nodecon_render(apol_policy_t * p, qpol_nodecon_t * nodecon); - /* apol avrule query */ - typedef struct apol_avrule_query {} apol_avrule_query_t; - %extend apol_avrule_query_t { -- apol_avrule_query_t() { -+ apol_avrule_query() { - apol_avrule_query_t *avq; - BEGIN_EXCEPTION - avq = apol_avrule_query_create(); -@@ -2023,7 +2023,7 @@ typedef struct apol_avrule_query {} apol_avrule_query_t; - fail: - return avq; - }; -- ~apol_avrule_query_t() { -+ ~apol_avrule_query() { - apol_avrule_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2163,7 +2163,7 @@ char *apol_syn_avrule_render(apol_policy_t * policy, qpol_syn_avrule_t * rule); - /* apol terule query */ - typedef struct apol_terule_query {} apol_terule_query_t; - %extend apol_terule_query_t { -- apol_terule_query_t() { -+ apol_terule_query() { - apol_terule_query_t *atq; - BEGIN_EXCEPTION - atq = apol_terule_query_create(); -@@ -2174,7 +2174,7 @@ typedef struct apol_terule_query {} apol_terule_query_t; - fail: - return atq; - }; -- ~apol_terule_query_t() { -+ ~apol_terule_query() { - apol_terule_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2287,7 +2287,7 @@ apol_vector_t *apol_terule_list_to_syn_terules(apol_policy_t * p, apol_vector_t - /* apol cond rule query */ - typedef struct apol_cond_query {} apol_cond_query_t; - %extend apol_cond_query_t { -- apol_cond_query_t() { -+ apol_cond_query() { - apol_cond_query_t *acq; - BEGIN_EXCEPTION - acq = apol_cond_query_create(); -@@ -2298,7 +2298,7 @@ typedef struct apol_cond_query {} apol_cond_query_t; - fail: - return acq; - }; -- ~apol_cond_query_t() { -+ ~apol_cond_query() { - apol_cond_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2331,7 +2331,7 @@ char *apol_cond_expr_render(apol_policy_t * p, qpol_cond_t * cond); - /* apol role allow query */ - typedef struct apol_role_allow_query {} apol_role_allow_query_t; - %extend apol_role_allow_query_t { -- apol_role_allow_query_t() { -+ apol_role_allow_query() { - apol_role_allow_query_t *arq; - BEGIN_EXCEPTION - arq = apol_role_allow_query_create(); -@@ -2342,7 +2342,7 @@ typedef struct apol_role_allow_query {} apol_role_allow_query_t; - fail: - return arq; - }; -- ~apol_role_allow_query_t() { -+ ~apol_role_allow_query() { - apol_role_allow_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2387,7 +2387,7 @@ char *apol_role_allow_render(apol_policy_t * policy, qpol_role_allow_t * rule); - /* apol role transition rule query */ - typedef struct apol_role_trans_query {} apol_role_trans_query_t; - %extend apol_role_trans_query_t { -- apol_role_trans_query_t() { -+ apol_role_trans_query() { - apol_role_trans_query_t *arq; - BEGIN_EXCEPTION - arq = apol_role_trans_query_create(); -@@ -2398,7 +2398,7 @@ typedef struct apol_role_trans_query {} apol_role_trans_query_t; - fail: - return arq; - }; -- ~apol_role_trans_query_t() { -+ ~apol_role_trans_query() { - apol_role_trans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2452,7 +2452,7 @@ char *apol_role_trans_render(apol_policy_t * policy, qpol_role_trans_t * rule); - /* apol range transition rule query */ - typedef struct apol_range_trans_query {} apol_range_trans_query_t; - %extend apol_range_trans_query_t { -- apol_range_trans_query_t() { -+ apol_range_trans_query() { - apol_range_trans_query_t *arq; - BEGIN_EXCEPTION - arq = apol_range_trans_query_create(); -@@ -2463,7 +2463,7 @@ typedef struct apol_range_trans_query {} apol_range_trans_query_t; - fail: - return arq; - }; -- ~apol_range_trans_query_t() { -+ ~apol_range_trans_query() { - apol_range_trans_query_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2531,7 +2531,7 @@ char *apol_range_trans_render(apol_policy_t * policy, qpol_range_trans_t * rule) - #define APOL_DOMAIN_TRANS_SEARCH_BOTH (APOL_DOMAIN_TRANS_SEARCH_VALID|APOL_DOMAIN_TRANS_SEARCH_INVALID) - typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - %extend apol_domain_trans_analysis_t { -- apol_domain_trans_analysis_t() { -+ apol_domain_trans_analysis() { - apol_domain_trans_analysis_t *dta; - BEGIN_EXCEPTION - dta = apol_domain_trans_analysis_create(); -@@ -2542,7 +2542,7 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - fail: - return dta; - }; -- ~apol_domain_trans_analysis_t() { -+ ~apol_domain_trans_analysis() { - apol_domain_trans_analysis_destroy(&self); - }; - void set_direction(apol_policy_t *p, int direction) { -@@ -2622,7 +2622,7 @@ typedef struct apol_domain_trans_analysis {} apol_domain_trans_analysis_t; - }; - typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; - %extend apol_domain_trans_result_t { -- apol_domain_trans_result_t(apol_domain_trans_result_t *in) { -+ apol_domain_trans_result(apol_domain_trans_result_t *in) { - apol_domain_trans_result_t *dtr; - BEGIN_EXCEPTION - dtr = apol_domain_trans_result_create_from_domain_trans_result(in); -@@ -2633,7 +2633,7 @@ typedef struct apol_domain_trans_result {} apol_domain_trans_result_t; - fail: - return dtr; - }; -- ~apol_domain_trans_result_t() { -+ ~apol_domain_trans_result() { - apol_domain_trans_result_destroy(&self); - }; - const qpol_type_t *get_start_type() { -@@ -2705,14 +2705,14 @@ int apol_domain_trans_table_verify_trans(apol_policy_t * policy, qpol_type_t * s - %} - typedef struct apol_infoflow {} apol_infoflow_t; - %extend apol_infoflow_t { -- apol_infoflow_t() { -+ apol_infoflow() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_t() { -+ ~apol_infoflow() { - apol_infoflow_destroy(&self); - }; - %newobject extract_graph(); -@@ -2730,7 +2730,7 @@ typedef struct apol_infoflow {} apol_infoflow_t; - }; - typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - %extend apol_infoflow_analysis_t { -- apol_infoflow_analysis_t() { -+ apol_infoflow_analysis() { - apol_infoflow_analysis_t *aia; - BEGIN_EXCEPTION - aia = apol_infoflow_analysis_create(); -@@ -2741,7 +2741,7 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - fail: - return aia; - }; -- ~apol_infoflow_analysis_t() { -+ ~apol_infoflow_analysis() { - apol_infoflow_analysis_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -2823,14 +2823,14 @@ typedef struct apol_infoflow_analysis {} apol_infoflow_analysis_t; - }; - typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; - %extend apol_infoflow_graph_t { -- apol_infoflow_graph_t() { -+ apol_infoflow_graph() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_graph_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_graph_t() { -+ ~apol_infoflow_graph() { - apol_infoflow_graph_destroy(&self); - }; - %newobject do_more(apol_policy_t*, char*); -@@ -2867,14 +2867,14 @@ typedef struct apol_infoflow_graph {} apol_infoflow_graph_t; - }; - typedef struct apol_infoflow_result {} apol_infoflow_result_t; - %extend apol_infoflow_result_t { -- apol_infoflow_result_t() { -+ apol_infoflow_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_result_t() { -+ ~apol_infoflow_result() { - /* no op - vector will destroy */ - return; - }; -@@ -2901,14 +2901,14 @@ typedef struct apol_infoflow_result {} apol_infoflow_result_t; - %} - typedef struct apol_infoflow_step {} apol_infoflow_step_t; - %extend apol_infoflow_step_t { -- apol_infoflow_step_t() { -+ apol_infoflow_step() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_infoflow_step_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_infoflow_step_t() { -+ ~apol_infoflow_step() { - /* no op */ - return; - }; -@@ -2938,7 +2938,7 @@ typedef struct apol_infoflow_step {} apol_infoflow_step_t; - #define APOL_RELABEL_DIR_SUBJECT 0x04 - typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - %extend apol_relabel_analysis_t { -- apol_relabel_analysis_t() { -+ apol_relabel_analysis() { - apol_relabel_analysis_t *ara; - BEGIN_EXCEPTION - ara = apol_relabel_analysis_create(); -@@ -2949,7 +2949,7 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - fail: - return ara; - }; -- ~apol_relabel_analysis_t() { -+ ~apol_relabel_analysis() { - apol_relabel_analysis_destroy(&self); - }; - %newobject run(apol_policy_t*); -@@ -3011,14 +3011,14 @@ typedef struct apol_relabel_analysis {} apol_relabel_analysis_t; - }; - typedef struct apol_relabel_result {} apol_relabel_result_t; - %extend apol_relabel_result_t { -- apol_relabel_result_t() { -+ apol_relabel_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_relabel_result_t() { -+ ~apol_relabel_result() { - /* no op - vector will destroy */ - return; - }; -@@ -3042,14 +3042,14 @@ typedef struct apol_relabel_result {} apol_relabel_result_t; - %} - typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; - %extend apol_relabel_result_pair_t { -- apol_relabel_result_pair_t() { -+ apol_relabel_result_pair() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_relabel_result_pair_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_relabel_result_pair_t() { -+ ~apol_relabel_result_pair() { - /* no op - owned and free()'d by apol_relabel_result_t */ - return; - }; -@@ -3084,7 +3084,7 @@ typedef struct apol_relabel_result_pair {} apol_relabel_result_pair_t; - #define APOL_TYPES_RELATION_TRANS_FLOW_BA 0x8000 - typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - %extend apol_types_relation_analysis_t { -- apol_types_relation_analysis_t() { -+ apol_types_relation_analysis() { - apol_types_relation_analysis_t *atr; - BEGIN_EXCEPTION - atr = apol_types_relation_analysis_create(); -@@ -3095,7 +3095,7 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - fail: - return atr; - }; -- ~apol_types_relation_analysis_t() { -+ ~apol_types_relation_analysis() { - apol_types_relation_analysis_destroy(&self); - } - %newobject run(apol_policy_t*); -@@ -3139,14 +3139,14 @@ typedef struct apol_types_relation_analysis {} apol_types_relation_analysis_t; - }; - typedef struct apol_types_relation_result {} apol_types_relation_result_t; - %extend apol_types_relation_result_t { -- apol_types_relation_result_t() { -+ apol_types_relation_result() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_result_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_types_relation_result_t() { -+ ~apol_types_relation_result() { - apol_types_relation_result_destroy(&self); - }; - const apol_vector_t *get_attributes() { -@@ -3194,14 +3194,14 @@ typedef struct apol_types_relation_result {} apol_types_relation_result_t; - }; - typedef struct apol_types_relation_access {} apol_types_relation_access_t; - %extend apol_types_relation_access_t { -- apol_types_relation_access_t() { -+ apol_types_relation_access() { - BEGIN_EXCEPTION - SWIG_exception(SWIG_RuntimeError, "Cannot directly create apol_types_relation_access_t objects"); - END_EXCEPTION - fail: - return NULL; - }; -- ~apol_types_relation_access_t() { -+ ~apol_types_relation_access() { - /* no op - vector will destroy */ - return; - }; --- - diff --git a/0014-boolsub.patch b/0014-boolsub.patch deleted file mode 100644 index 2890628..0000000 --- a/0014-boolsub.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -up ./setools-3.3.7/secmds/seinfo.c~ ./setools-3.3.7/secmds/seinfo.c ---- ./setools-3.3.7/secmds/seinfo.c~ 2013-03-14 15:26:31.467121596 -0400 -+++ ./setools-3.3.7/secmds/seinfo.c 2013-03-14 15:35:20.154650517 -0400 -@@ -1705,7 +1705,7 @@ int main(int argc, char **argv) - case 'b': /* conditional booleans */ - bools = 1; - if (optarg != 0) -- bool_name = optarg; -+ bool_name = selinux_boolean_sub(optarg); - break; - case OPT_INITIALSID: - isids = 1; -diff -up ./setools-3.3.7/secmds/sesearch.c~ ./setools-3.3.7/secmds/sesearch.c ---- ./setools-3.3.7/secmds/sesearch.c~ 2013-03-14 15:26:31.539121944 -0400 -+++ ./setools-3.3.7/secmds/sesearch.c 2013-03-14 15:34:36.615445562 -0400 -@@ -1056,7 +1056,7 @@ int main(int argc, char **argv) - printf("Missing boolean for -b (--bool)\n"); - exit(1); - } -- cmd_opts.bool_name = strdup(optarg); -+ cmd_opts.bool_name = strdup(selinux_boolean_sub(optarg)); - if (!cmd_opts.bool_name) { - fprintf(stderr, "%s\n", strerror(errno)); - exit(1); diff --git a/0015-aliases.patch b/0015-aliases.patch deleted file mode 100644 index 355aff3..0000000 --- a/0015-aliases.patch +++ /dev/null @@ -1,82 +0,0 @@ -diff -up setools-3.3.7/libapol/src/policy-query.c~ setools-3.3.7/libapol/src/policy-query.c -diff -up setools-3.3.7/libqpol/include/qpol/type_query.h~ setools-3.3.7/libqpol/include/qpol/type_query.h -diff -up setools-3.3.7/libqpol/tests/iterators-tests.c~ setools-3.3.7/libqpol/tests/iterators-tests.c -diff -up setools-3.3.7/secmds/seinfo.c~ setools-3.3.7/secmds/seinfo.c ---- setools-3.3.7/secmds/seinfo.c~ 2013-03-25 11:30:23.161633059 -0400 -+++ setools-3.3.7/secmds/seinfo.c 2013-03-28 13:08:07.281751011 -0400 -@@ -46,6 +46,7 @@ - #include - #include - #include -+#include - - #define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" - -@@ -54,6 +55,7 @@ - - static char *policy_file = NULL; - -+static void print_type_aliases(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb); - static void print_type_attrs(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb, const int expand); - static void print_attr_types(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb, const int expand); - static void print_user_roles(FILE * fp, const qpol_user_t * user_datum, const apol_policy_t * policydb, const int expand); -@@ -511,6 +513,7 @@ static int print_types(FILE * fp, const - if (qpol_policy_get_type_by_name(q, name, &type_datum)) - goto cleanup; - print_type_attrs(fp, type_datum, policydb, expand); -+ print_type_aliases(fp, type_datum, policydb); - } else { - if (qpol_policy_get_type_iter(q, &iter)) - goto cleanup; -@@ -1897,6 +1900,51 @@ int main(int argc, char **argv) - } - - /** -+ * Prints the alias of a type. -+ * -+ * @param fp Reference to a file to which to print type information -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ * attributes -+ */ -+static void print_type_aliases(FILE * fp, const qpol_type_t * type_datum, const apol_policy_t * policydb) -+{ -+ qpol_iterator_t *iter = NULL; -+ size_t alias_size; -+ unsigned char isattr, isalias; -+ const char *type_name = NULL; -+ const char *alias_name; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ if (qpol_type_get_name(q, type_datum, &type_name)) -+ goto cleanup; -+ if (qpol_type_get_isattr(q, type_datum, &isattr)) -+ goto cleanup; -+ if (qpol_type_get_isalias(q, type_datum, &isalias)) -+ goto cleanup; -+ -+ if (isalias) { -+ fprintf(fp, " TypeName %s\n", type_name); -+ } -+ if (qpol_type_get_alias_iter(q, type_datum, &iter)) -+ goto cleanup; -+ if (qpol_iterator_get_size(iter, &alias_size)) -+ goto cleanup; -+ if (alias_size > 0) { -+ fprintf(fp, " Aliases\n"); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&alias_name)) -+ goto cleanup; -+ fprintf(fp, " %s\n", alias_name); -+ } -+ } -+ -+ cleanup: -+ qpol_iterator_destroy(&iter); -+ return; -+} -+ -+/** - * Prints a textual representation of a type, and possibly - * all of that type's attributes. - * diff --git a/0016-cmdline.patch b/0016-cmdline.patch deleted file mode 100644 index 82b4825..0000000 --- a/0016-cmdline.patch +++ /dev/null @@ -1,107 +0,0 @@ -diff -up setools-3.3.7/man/sesearch.1.cmdline setools-3.3.7/man/sesearch.1 ---- setools-3.3.7/man/sesearch.1.cmdline 2008-02-22 14:06:28.000000000 -0500 -+++ setools-3.3.7/man/sesearch.1 2013-07-19 06:46:21.314068667 -0400 -@@ -43,7 +43,7 @@ Search for allow rules. - Search for neverallow rules. - .IP "--auditallow" - Search for auditallow rules. --.IP "--dontaudit" -+.IP "-D, --dontaudit" - Search for dontaudit rules. - .IP "-T, --type" - Search for type_transition, type_member, and type_change rules. -diff -up setools-3.3.7/secmds/sesearch.c.cmdline setools-3.3.7/secmds/sesearch.c ---- setools-3.3.7/secmds/sesearch.c.cmdline 2013-07-19 06:46:21.291068510 -0400 -+++ setools-3.3.7/secmds/sesearch.c 2013-07-19 06:48:12.962830868 -0400 -@@ -24,6 +24,7 @@ - */ - - #include -+#include - - /* libapol */ - #include -@@ -61,9 +62,8 @@ enum opt_values - static struct option const longopts[] = { - {"allow", no_argument, NULL, 'A'}, - {"neverallow", no_argument, NULL, RULE_NEVERALLOW}, -- {"audit", no_argument, NULL, RULE_AUDIT}, - {"auditallow", no_argument, NULL, RULE_AUDITALLOW}, -- {"dontaudit", no_argument, NULL, RULE_DONTAUDIT}, -+ {"dontaudit", no_argument, NULL, 'D'}, - {"type", no_argument, NULL, 'T'}, - {"role_allow", no_argument, NULL, RULE_ROLE_ALLOW}, - {"role_trans", no_argument, NULL, RULE_ROLE_TRANS}, -@@ -72,7 +72,6 @@ static struct option const longopts[] = - - {"source", required_argument, NULL, 's'}, - {"target", required_argument, NULL, 't'}, -- {"default", required_argument, NULL, 'D'}, - {"role_source", required_argument, NULL, EXPR_ROLE_SOURCE}, - {"role_target", required_argument, NULL, EXPR_ROLE_TARGET}, - {"class", required_argument, NULL, 'c'}, -@@ -129,7 +128,7 @@ void usage(const char *program_name, int - printf(" -A, --allow allow rules\n"); - printf(" --neverallow neverallow rules\n"); - printf(" --auditallow auditallow rules\n"); -- printf(" --dontaudit dontaudit rules\n"); -+ printf(" -D, --dontaudit dontaudit rules\n"); - printf(" -T, --type type_trans, type_member, and type_change\n"); - printf(" --role_allow role allow rules\n"); - printf(" --role_trans role_transition rules\n"); -@@ -666,10 +665,6 @@ static void print_ft_results(const apol_ - size_t i, num_filename_trans = 0; - const qpol_filename_trans_t *filename_trans = NULL; - char *tmp = NULL, *filename_trans_str = NULL, *expr = NULL; -- char enable_char = ' ', branch_char = ' '; -- qpol_iterator_t *iter = NULL; -- const qpol_cond_t *cond = NULL; -- uint32_t enabled = 0, list = 0; - - if (!(num_filename_trans = apol_vector_get_size(v))) - goto cleanup; -@@ -677,7 +672,6 @@ static void print_ft_results(const apol_ - fprintf(stdout, "Found %zd named file transition filename_trans:\n", num_filename_trans); - - for (i = 0; i < num_filename_trans; i++) { -- enable_char = branch_char = ' '; - if (!(filename_trans = apol_vector_get_element(v, i))) - goto cleanup; - -@@ -962,7 +956,7 @@ int main(int argc, char **argv) - - memset(&cmd_opts, 0, sizeof(cmd_opts)); - cmd_opts.indirect = true; -- while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dD:RnSChV", longopts, NULL)) != -1) { -+ while ((optc = getopt_long(argc, argv, "ATs:t:c:p:b:dDRnSChV", longopts, NULL)) != -1) { - switch (optc) { - case 0: - break; -@@ -978,18 +972,6 @@ int main(int argc, char **argv) - exit(1); - } - break; -- case 'D': /* source */ -- if (optarg == 0) { -- usage(argv[0], 1); -- printf("Missing source default type for -D (--default)\n"); -- exit(1); -- } -- cmd_opts.default_name = strdup(optarg); -- if (!cmd_opts.default_name) { -- -- exit(1); -- } -- break; - case 't': /* target */ - if (optarg == 0) { - usage(argv[0], 1); -@@ -1082,7 +1064,7 @@ int main(int argc, char **argv) - case RULE_AUDITALLOW: - cmd_opts.auditallow = true; - break; -- case RULE_DONTAUDIT: -+ case 'D': - cmd_opts.dontaudit = true; - break; - case 'T': /* type */ diff --git a/0017-update-to-libsepool-2.4-parser.patch b/0017-update-to-libsepool-2.4-parser.patch deleted file mode 100644 index bfd807a..0000000 --- a/0017-update-to-libsepool-2.4-parser.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 0e41755e0364df7666f286a3b6f8d663933c3149 Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Wed, 4 Feb 2015 14:34:47 -0500 -Subject: [PATCH] Update to libsepol 2.4 parser. - -There was a struct change internally. Now setools requires libsepol 2.4. ---- - README | 4 ++-- - libqpol/src/policy_define.c | 4 ++-- - libqpol/src/policy_extend.c | 4 ++-- - libqpol/src/syn_rule_query.c | 6 +++--- - 4 files changed, 9 insertions(+), 9 deletions(-) - -diff --git a/README b/README -index 04b159b..c08d786 100644 ---- a/README -+++ b/README -@@ -71,8 +71,8 @@ compilation: - bison - pkg-config 0.23 or greater - libselinux 2.0.87 or greater -- libsepol 2.0.38 or greater -- libsepol-static 2.0.38 or greater -+ libsepol 2.4 or greater -+ libsepol-static 2.4 or greater - libxml2 - sqlite 3.6.20 or greater - -diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c -index fad6b60..231962f 100644 ---- a/libqpol/src/policy_define.c -+++ b/libqpol/src/policy_define.c -@@ -1449,7 +1449,7 @@ int define_compute_type_helper(int which, avrule_t ** rule) - return -1; - } - class_perm_node_init(perm); -- perm->class = i + 1; -+ perm->tclass = i + 1; - perm->data = datum->s.value; - perm->next = avrule->perms; - avrule->perms = perm; -@@ -1699,7 +1699,7 @@ int define_te_avtab_helper(int which, avrule_t ** rule) - goto out; - } - class_perm_node_init(cur_perms); -- cur_perms->class = i + 1; -+ cur_perms->tclass = i + 1; - if (!perms) - perms = cur_perms; - if (tail) -diff --git a/libqpol/src/policy_extend.c b/libqpol/src/policy_extend.c -index 5325a87..1417271 100644 ---- a/libqpol/src/policy_extend.c -+++ b/libqpol/src/policy_extend.c -@@ -843,7 +843,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ - for (class_node = rule->perms; class_node; class_node = class_node->next) { - key.rule_type = rule->specified; - key.source_val = key.target_val = i + 1; -- key.class_val = class_node->class; -+ key.class_val = class_node->tclass; - key.cond = cond; - if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) - goto err; -@@ -856,7 +856,7 @@ static int qpol_syn_rule_table_insert_sepol_avrule(qpol_policy_t * policy, qpol_ - key.rule_type = rule->specified; - key.source_val = i + 1; - key.target_val = j + 1; -- key.class_val = class_node->class; -+ key.class_val = class_node->tclass; - key.cond = cond; - if (qpol_syn_rule_table_insert_entry(policy, table, &key, new_rule)) - goto err; -diff --git a/libqpol/src/syn_rule_query.c b/libqpol/src/syn_rule_query.c -index 3e63204..d7578f1 100644 ---- a/libqpol/src/syn_rule_query.c -+++ b/libqpol/src/syn_rule_query.c -@@ -67,7 +67,7 @@ static void *syn_rule_class_state_get_cur(const qpol_iterator_t * iter) - return NULL; - } - -- return db->class_val_to_struct[srcs->cur->class - 1]; -+ return db->class_val_to_struct[srcs->cur->tclass - 1]; - } - - static int syn_rule_class_state_next(qpol_iterator_t * iter) -@@ -465,10 +465,10 @@ int qpol_syn_avrule_get_perm_iter(const qpol_policy_t * policy, const qpol_syn_a - } - - for (node = internal_rule->perms; node; node = node->next) { -- for (i = 0; i < db->class_val_to_struct[node->class - 1]->permissions.nprim; i++) { -+ for (i = 0; i < db->class_val_to_struct[node->tclass - 1]->permissions.nprim; i++) { - if (!(node->data & (1 << i))) - continue; -- tmp = sepol_av_to_string(db, node->class, (sepol_access_vector_t) (1 << i)); -+ tmp = sepol_av_to_string(db, node->tclass, (sepol_access_vector_t) (1 << i)); - if (tmp) { - tmp++; /* remove prepended space */ - for (cur = 0; cur < perm_list_sz; cur++) --- -1.8.3.1 - diff --git a/setools-exitstatus.patch b/setools-exitstatus.patch deleted file mode 100644 index 3500aca..0000000 --- a/setools-exitstatus.patch +++ /dev/null @@ -1,119 +0,0 @@ -diff -up setools-3.3.7/secmds/seinfo.c.exitstatus setools-3.3.7/secmds/seinfo.c ---- setools-3.3.7/secmds/seinfo.c.exitstatus 2010-05-03 12:39:02.000000000 -0400 -+++ setools-3.3.7/secmds/seinfo.c 2010-11-05 09:54:39.000000000 -0400 -@@ -827,7 +827,7 @@ static int print_sens(FILE * fp, const c - */ - static int print_cats(FILE * fp, const char *name, int expand, const apol_policy_t * policydb) - { -- int retval = 0; -+ int retval = -1; - apol_cat_query_t *query = NULL; - apol_vector_t *v = NULL; - const qpol_cat_t *cat_datum = NULL; -@@ -911,9 +911,10 @@ static int print_fsuse(FILE * fp, const - fprintf(fp, " %s\n", tmp); - free(tmp); - } -- if (type && !apol_vector_get_size(v)) -+ if (type && !apol_vector_get_size(v)) { - ERR(policydb, "No fs_use statement for filesystem of type %s.", type); -- -+ goto cleanup; -+ } - retval = 0; - cleanup: - apol_fs_use_query_destroy(&query); -@@ -949,7 +950,6 @@ static int print_genfscon(FILE * fp, con - ERR(policydb, "%s", strerror(ENOMEM)); - goto cleanup; - } -- - if (apol_genfscon_query_set_filesystem(policydb, query, type)) - goto cleanup; - if (apol_genfscon_get_by_query(policydb, query, &v)) -@@ -967,8 +967,10 @@ static int print_genfscon(FILE * fp, con - free(tmp); - } - -- if (type && !apol_vector_get_size(v)) -+ if (type && !apol_vector_get_size(v)) { - ERR(policydb, "No genfscon statement for filesystem of type %s.", type); -+ goto cleanup; -+ } - - retval = 0; - cleanup: -@@ -1646,6 +1648,7 @@ cleanup: // close and destroy iterators - - int main(int argc, char **argv) - { -+ int rc = 0; - int classes, types, attribs, roles, users, all, expand, stats, rt, optc, isids, bools, sens, cats, fsuse, genfs, netif, - node, port, permissives, polcaps, constrain, linebreaks; - apol_policy_t *policydb = NULL; -@@ -1851,46 +1854,46 @@ int main(int argc, char **argv) - - /* display requested info */ - if (stats || all) -- print_stats(stdout, policydb); -+ rc = print_stats(stdout, policydb); - if (classes || all) -- print_classes(stdout, class_name, expand, policydb); -+ rc = print_classes(stdout, class_name, expand, policydb); - if (types || all) -- print_types(stdout, type_name, expand, policydb); -+ rc = print_types(stdout, type_name, expand, policydb); - if (attribs || all) -- print_attribs(stdout, attrib_name, expand, policydb); -+ rc = print_attribs(stdout, attrib_name, expand, policydb); - if (roles || all) -- print_roles(stdout, role_name, expand, policydb); -+ rc = print_roles(stdout, role_name, expand, policydb); - if (users || all) -- print_users(stdout, user_name, expand, policydb); -+ rc = print_users(stdout, user_name, expand, policydb); - if (bools || all) -- print_booleans(stdout, bool_name, expand, policydb); -+ rc = print_booleans(stdout, bool_name, expand, policydb); - if (sens || all) -- print_sens(stdout, sens_name, expand, policydb); -+ rc = print_sens(stdout, sens_name, expand, policydb); - if (cats || all) -- print_cats(stdout, cat_name, expand, policydb); -+ rc = print_cats(stdout, cat_name, expand, policydb); - if (fsuse || all) -- print_fsuse(stdout, fsuse_type, policydb); -+ rc = print_fsuse(stdout, fsuse_type, policydb); - if (genfs || all) -- print_genfscon(stdout, genfs_type, policydb); -+ rc = print_genfscon(stdout, genfs_type, policydb); - if (netif || all) -- print_netifcon(stdout, netif_name, policydb); -+ rc = print_netifcon(stdout, netif_name, policydb); - if (node || all) -- print_nodecon(stdout, node_addr, policydb); -+ rc = print_nodecon(stdout, node_addr, policydb); - if (port || all) -- print_portcon(stdout, port_num, protocol, policydb); -+ rc = print_portcon(stdout, port_num, protocol, policydb); - if (isids || all) -- print_isids(stdout, isid_name, expand, policydb); -+ rc = print_isids(stdout, isid_name, expand, policydb); - if (permissives || all) -- print_permissives(stdout, permissive_name, expand, policydb); -+ rc = print_permissives(stdout, permissive_name, expand, policydb); - if (polcaps || all) -- print_polcaps(stdout, polcap_name, expand, policydb); -+ rc = print_polcaps(stdout, polcap_name, expand, policydb); - if (constrain || all) -- print_constraints(stdout, expand, policydb, linebreaks); -+ rc = print_constraints(stdout, expand, policydb, linebreaks); - - apol_policy_destroy(&policydb); - apol_policy_path_destroy(&pol_path); - free(policy_file); -- exit(0); -+ exit(rc); - } - - /** diff --git a/setools-neverallow.patch b/setools-neverallow.patch deleted file mode 100644 index e84cc3b..0000000 --- a/setools-neverallow.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up setools-3.3.7/libqpol/src/avrule_query.c~ setools-3.3.7/libqpol/src/avrule_query.c ---- setools-3.3.7/libqpol/src/avrule_query.c~ 2010-04-23 12:22:08.000000000 -0400 -+++ setools-3.3.7/libqpol/src/avrule_query.c 2011-01-06 10:42:50.000000000 -0500 -@@ -57,8 +57,9 @@ int qpol_policy_get_avrule_iter(const qp - - if ((rule_type_mask & QPOL_RULE_NEVERALLOW) && !qpol_policy_has_capability(policy, QPOL_CAP_NEVERALLOW)) { - ERR(policy, "%s", "Cannot get avrules: Neverallow rules requested but not available"); -- errno = ENOTSUP; -- return STATUS_ERR; -+/* errno = ENOTSUP; -+ return STATUS_ERR; */ -+ return STATUS_SUCCESS; - } - - db = &policy->p->p; diff --git a/setools-python.patch b/setools-python.patch deleted file mode 100644 index 6d13af6..0000000 --- a/setools-python.patch +++ /dev/null @@ -1,2747 +0,0 @@ -diff -up setools-3.3.7/configure.ac.python setools-3.3.7/configure.ac ---- setools-3.3.7/configure.ac.python 2010-04-30 10:25:48.000000000 -0400 -+++ setools-3.3.7/configure.ac 2010-07-30 15:02:10.000000000 -0400 -@@ -194,7 +194,7 @@ AC_ARG_ENABLE(swig-java, - enable_jswig="$enableval") - if test "x${enable_jswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(1.3.28) -+ AC_PROG_SWIG(2.0.0) - fi - AC_JAVA_OPTIONS - if test "x$JAVAPREFIX" = x; then -@@ -216,21 +216,23 @@ if test "x${enable_jswig}" = xyes; then - do_swigify_java=yes - do_swigify=yes - fi -+ -+AM_PATH_PYTHON(2.7) -+ - AC_ARG_ENABLE(swig-python, - AC_HELP_STRING([--enable-swig-python], - [build SWIG interfaces for Python]), - enable_pyswig="$enableval") - if test "x${enable_pyswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(1.3.28) -+ AC_PROG_SWIG(2.0.0) - fi -- AM_PATH_PYTHON(2.3) - SWIG_PYTHON - do_swigify_python=yes - do_swigify=yes - fi - if test ${do_swigify} = "yes"; then -- AC_PROG_SWIG(1.3.28) -+ AC_PROG_SWIG(2.0.0) - fi - build_apol=yes - AC_ARG_ENABLE(swig-tcl, -@@ -239,7 +241,7 @@ AC_ARG_ENABLE(swig-tcl, - enable_tclswig="$enableval", enable_tclswig="yes") - if test "x${enable_tclswig}" = xyes; then - if test ${do_swigify} = no; then -- AC_PROG_SWIG(1.3.28) -+ AC_PROG_SWIG(2.0.0) - fi - TEA_INIT(3.5) - TEA_PATH_TCLCONFIG -@@ -888,6 +890,8 @@ AC_CONFIG_FILES([Makefile VERSION \ - sediff/Makefile \ - man/Makefile \ - debian/Makefile \ -+ python/Makefile \ -+ python/setools/Makefile \ - packages/Makefile packages/rpm/Makefile \ - packages/libqpol.pc packages/libapol.pc packages/libpoldiff.pc packages/libseaudit.pc packages/libsefs.pc]) - -diff -up setools-3.3.7/Makefile.am.python setools-3.3.7/Makefile.am ---- setools-3.3.7/Makefile.am.python 2008-02-22 14:06:28.000000000 -0500 -+++ setools-3.3.7/Makefile.am 2010-07-30 15:02:10.000000000 -0400 -@@ -10,7 +10,7 @@ if BUILD_GUI - endif - # sediffx is also built conditionally, from sediffx/Makefile.am - --SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) -+SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) python - - #old indent opts - #INDENT_OPTS = -npro -nbad -bap -sob -ss -l132 -di1 -nbc -br -nbbb -c40 -cd40 -ncdb -ce -cli0 -cp40 -ncs -d0 -nfc1 -nfca -i8 -ts8 -ci8 -lp -ip0 -npcs -npsl -sc -diff -up setools-3.3.7/Makefile.in.python setools-3.3.7/Makefile.in ---- setools-3.3.7/Makefile.in.python 2010-05-12 10:01:09.000000000 -0400 -+++ setools-3.3.7/Makefile.in 2010-07-30 15:02:47.000000000 -0400 -@@ -79,7 +79,7 @@ AM_RECURSIVE_TARGETS = $(RECURSIVE_TARGE - ETAGS = etags - CTAGS = ctags - DIST_SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds \ -- sechecker sediff man packages debian apol seaudit -+ sechecker sediff man packages debian apol seaudit python - DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) - distdir = $(PACKAGE)-$(VERSION) - top_distdir = $(distdir) -@@ -385,7 +385,7 @@ AUTOMAKE_OPTIONS = dist-bzip2 - @BUILD_APOL_TRUE@MAYBE_APOL = apol - @BUILD_GUI_TRUE@MAYBE_GUI = seaudit - # sediffx is also built conditionally, from sediffx/Makefile.am --SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) -+SUBDIRS = libqpol libapol libsefs libpoldiff libseaudit secmds sechecker sediff man packages debian $(MAYBE_APOL) $(MAYBE_GUI) python - - #old indent opts - #INDENT_OPTS = -npro -nbad -bap -sob -ss -l132 -di1 -nbc -br -nbbb -c40 -cd40 -ncdb -ce -cli0 -cp40 -ncs -d0 -nfc1 -nfca -i8 -ts8 -ci8 -lp -ip0 -npcs -npsl -sc -diff -up setools-3.3.7/python/Makefile.am.python setools-3.3.7/python/Makefile.am ---- setools-3.3.7/python/Makefile.am.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/Makefile.am 2010-07-30 15:02:10.000000000 -0400 -@@ -0,0 +1 @@ -+SUBDIRS = setools -diff -up setools-3.3.7/python/Makefile.in.python setools-3.3.7/python/Makefile.in ---- setools-3.3.7/python/Makefile.in.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/Makefile.in 2010-07-30 15:02:46.000000000 -0400 -@@ -0,0 +1,716 @@ -+# Makefile.in generated by automake 1.11.1 from Makefile.am. -+# @configure_input@ -+ -+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -+# Inc. -+# This Makefile.in is free software; the Free Software Foundation -+# gives unlimited permission to copy and/or distribute it, -+# with or without modifications, as long as this notice is preserved. -+ -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without -+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A -+# PARTICULAR PURPOSE. -+ -+@SET_MAKE@ -+VPATH = @srcdir@ -+pkgdatadir = $(datadir)/@PACKAGE@ -+pkgincludedir = $(includedir)/@PACKAGE@ -+pkglibdir = $(libdir)/@PACKAGE@ -+pkglibexecdir = $(libexecdir)/@PACKAGE@ -+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd -+install_sh_DATA = $(install_sh) -c -m 644 -+install_sh_PROGRAM = $(install_sh) -c -+install_sh_SCRIPT = $(install_sh) -c -+INSTALL_HEADER = $(INSTALL_DATA) -+transform = $(program_transform_name) -+NORMAL_INSTALL = : -+PRE_INSTALL = : -+POST_INSTALL = : -+NORMAL_UNINSTALL = : -+PRE_UNINSTALL = : -+POST_UNINSTALL = : -+build_triplet = @build@ -+host_triplet = @host@ -+subdir = python -+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in -+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 -+am__aclocal_m4_deps = $(top_srcdir)/m4/ac_check_classpath.m4 \ -+ $(top_srcdir)/m4/ac_java_options.m4 \ -+ $(top_srcdir)/m4/ac_pkg_swig.m4 \ -+ $(top_srcdir)/m4/ac_prog_jar.m4 \ -+ $(top_srcdir)/m4/ac_prog_java.m4 \ -+ $(top_srcdir)/m4/ac_prog_java_works.m4 \ -+ $(top_srcdir)/m4/ac_prog_javac.m4 \ -+ $(top_srcdir)/m4/ac_prog_javac_works.m4 \ -+ $(top_srcdir)/m4/ac_python_devel.m4 $(top_srcdir)/m4/c.m4 \ -+ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ -+ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ -+ $(top_srcdir)/m4/lt~obsolete.m4 \ -+ $(top_srcdir)/m4/swig_python.m4 $(top_srcdir)/m4/tcl.m4 \ -+ $(top_srcdir)/configure.ac -+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ -+ $(ACLOCAL_M4) -+mkinstalldirs = $(install_sh) -d -+CONFIG_HEADER = $(top_builddir)/config.h -+CONFIG_CLEAN_FILES = -+CONFIG_CLEAN_VPATH_FILES = -+SOURCES = -+DIST_SOURCES = -+RECURSIVE_TARGETS = all-recursive check-recursive dvi-recursive \ -+ html-recursive info-recursive install-data-recursive \ -+ install-dvi-recursive install-exec-recursive \ -+ install-html-recursive install-info-recursive \ -+ install-pdf-recursive install-ps-recursive install-recursive \ -+ installcheck-recursive installdirs-recursive pdf-recursive \ -+ ps-recursive uninstall-recursive -+RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ -+ distclean-recursive maintainer-clean-recursive -+AM_RECURSIVE_TARGETS = $(RECURSIVE_TARGETS:-recursive=) \ -+ $(RECURSIVE_CLEAN_TARGETS:-recursive=) tags TAGS ctags CTAGS \ -+ distdir -+ETAGS = etags -+CTAGS = ctags -+DIST_SUBDIRS = $(SUBDIRS) -+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) -+am__relativize = \ -+ dir0=`pwd`; \ -+ sed_first='s,^\([^/]*\)/.*$$,\1,'; \ -+ sed_rest='s,^[^/]*/*,,'; \ -+ sed_last='s,^.*/\([^/]*\)$$,\1,'; \ -+ sed_butlast='s,/*[^/]*$$,,'; \ -+ while test -n "$$dir1"; do \ -+ first=`echo "$$dir1" | sed -e "$$sed_first"`; \ -+ if test "$$first" != "."; then \ -+ if test "$$first" = ".."; then \ -+ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \ -+ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \ -+ else \ -+ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \ -+ if test "$$first2" = "$$first"; then \ -+ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \ -+ else \ -+ dir2="../$$dir2"; \ -+ fi; \ -+ dir0="$$dir0"/"$$first"; \ -+ fi; \ -+ fi; \ -+ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \ -+ done; \ -+ reldir="$$dir2" -+ACLOCAL = @ACLOCAL@ -+AMTAR = @AMTAR@ -+APOL_CFLAGS = @APOL_CFLAGS@ -+APOL_LIB_FLAG = @APOL_LIB_FLAG@ -+AR = @AR@ -+AUTOCONF = @AUTOCONF@ -+AUTOHEADER = @AUTOHEADER@ -+AUTOMAKE = @AUTOMAKE@ -+AWK = @AWK@ -+BWIDGET_DESTDIR = @BWIDGET_DESTDIR@ -+CC = @CC@ -+CCDEPMODE = @CCDEPMODE@ -+CFLAGS = @CFLAGS@ -+CPP = @CPP@ -+CPPFLAGS = @CPPFLAGS@ -+CUNIT_LIB_FLAG = @CUNIT_LIB_FLAG@ -+CXX = @CXX@ -+CXXCPP = @CXXCPP@ -+CXXDEPMODE = @CXXDEPMODE@ -+CXXFLAGS = @CXXFLAGS@ -+CYGPATH = @CYGPATH@ -+CYGPATH_W = @CYGPATH_W@ -+DEBUGCFLAGS = @DEBUGCFLAGS@ -+DEBUGCXXFLAGS = @DEBUGCXXFLAGS@ -+DEBUGJFLAGS = @DEBUGJFLAGS@ -+DEBUGLDFLAGS = @DEBUGLDFLAGS@ -+DEFS = @DEFS@ -+DEPDIR = @DEPDIR@ -+DSYMUTIL = @DSYMUTIL@ -+DUMPBIN = @DUMPBIN@ -+ECHO_C = @ECHO_C@ -+ECHO_N = @ECHO_N@ -+ECHO_T = @ECHO_T@ -+EGREP = @EGREP@ -+EXEEXT = @EXEEXT@ -+FGREP = @FGREP@ -+GLADE_CFLAGS = @GLADE_CFLAGS@ -+GLADE_LIBS = @GLADE_LIBS@ -+GREP = @GREP@ -+GTHREAD_CFLAGS = @GTHREAD_CFLAGS@ -+GTHREAD_LIBS = @GTHREAD_LIBS@ -+GTK_CFLAGS = @GTK_CFLAGS@ -+GTK_LIBS = @GTK_LIBS@ -+INSTALL = @INSTALL@ -+INSTALL_DATA = @INSTALL_DATA@ -+INSTALL_PROGRAM = @INSTALL_PROGRAM@ -+INSTALL_SCRIPT = @INSTALL_SCRIPT@ -+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ -+JAR = @JAR@ -+JAVA = @JAVA@ -+JAVAC = @JAVAC@ -+JAVACFLAGS = @JAVACFLAGS@ -+JAVAFLAGS = @JAVAFLAGS@ -+JAVAPREFIX = @JAVAPREFIX@ -+LD = @LD@ -+LDFLAGS = @LDFLAGS@ -+LEX = @LEX@ -+LEXLIB = @LEXLIB@ -+LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ -+LIBOBJS = @LIBOBJS@ -+LIBS = @LIBS@ -+LIBTOOL = @LIBTOOL@ -+LIPO = @LIPO@ -+LN_S = @LN_S@ -+LTLIBOBJS = @LTLIBOBJS@ -+MAKEINFO = @MAKEINFO@ -+MKDIR_P = @MKDIR_P@ -+NM = @NM@ -+NMEDIT = @NMEDIT@ -+OBJDUMP = @OBJDUMP@ -+OBJEXT = @OBJEXT@ -+OTOOL = @OTOOL@ -+OTOOL64 = @OTOOL64@ -+PACKAGE = @PACKAGE@ -+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ -+PACKAGE_NAME = @PACKAGE_NAME@ -+PACKAGE_STRING = @PACKAGE_STRING@ -+PACKAGE_TARNAME = @PACKAGE_TARNAME@ -+PACKAGE_URL = @PACKAGE_URL@ -+PACKAGE_VERSION = @PACKAGE_VERSION@ -+PATH_SEPARATOR = @PATH_SEPARATOR@ -+PIXBUF_CFLAGS = @PIXBUF_CFLAGS@ -+PIXBUF_LIBS = @PIXBUF_LIBS@ -+PKG_CFLAGS = @PKG_CFLAGS@ -+PKG_HEADERS = @PKG_HEADERS@ -+PKG_INCLUDES = @PKG_INCLUDES@ -+PKG_LIBS = @PKG_LIBS@ -+PKG_LIB_FILE = @PKG_LIB_FILE@ -+PKG_STUB_LIB_FILE = @PKG_STUB_LIB_FILE@ -+PKG_STUB_OBJECTS = @PKG_STUB_OBJECTS@ -+PKG_STUB_SOURCES = @PKG_STUB_SOURCES@ -+PKG_TCL_SOURCES = @PKG_TCL_SOURCES@ -+POLDIFF_CFLAGS = @POLDIFF_CFLAGS@ -+POLDIFF_LIB_FLAG = @POLDIFF_LIB_FLAG@ -+PROFILECFLAGS = @PROFILECFLAGS@ -+PROFILELDFLAGS = @PROFILELDFLAGS@ -+PYTHON = @PYTHON@ -+PYTHON_CPPFLAGS = @PYTHON_CPPFLAGS@ -+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ -+PYTHON_EXTRA_LDFLAGS = @PYTHON_EXTRA_LDFLAGS@ -+PYTHON_EXTRA_LIBS = @PYTHON_EXTRA_LIBS@ -+PYTHON_LDFLAGS = @PYTHON_LDFLAGS@ -+PYTHON_PLATFORM = @PYTHON_PLATFORM@ -+PYTHON_PREFIX = @PYTHON_PREFIX@ -+PYTHON_SITE_PKG = @PYTHON_SITE_PKG@ -+PYTHON_VERSION = @PYTHON_VERSION@ -+QPOL_CFLAGS = @QPOL_CFLAGS@ -+QPOL_LIB_FLAG = @QPOL_LIB_FLAG@ -+RANLIB = @RANLIB@ -+SEAUDIT_CFLAGS = @SEAUDIT_CFLAGS@ -+SEAUDIT_LIB_FLAG = @SEAUDIT_LIB_FLAG@ -+SED = @SED@ -+SEFS_CFLAGS = @SEFS_CFLAGS@ -+SEFS_LIB_FLAG = @SEFS_LIB_FLAG@ -+SELINUX_CFLAGS = @SELINUX_CFLAGS@ -+SELINUX_LIB_FLAG = @SELINUX_LIB_FLAG@ -+SET_MAKE = @SET_MAKE@ -+SHELL = @SHELL@ -+SQLITE3_CFLAGS = @SQLITE3_CFLAGS@ -+SQLITE3_LIBS = @SQLITE3_LIBS@ -+STRIP = @STRIP@ -+SWIG = @SWIG@ -+SWIG_JAVA_CFLAGS = @SWIG_JAVA_CFLAGS@ -+SWIG_JAVA_OPT = @SWIG_JAVA_OPT@ -+SWIG_LIB = @SWIG_LIB@ -+SWIG_PYTHON_CPPFLAGS = @SWIG_PYTHON_CPPFLAGS@ -+SWIG_PYTHON_OPT = @SWIG_PYTHON_OPT@ -+SWIG_TCL_CFLAGS = @SWIG_TCL_CFLAGS@ -+SWIG_TCL_OPT = @SWIG_TCL_OPT@ -+TCLSH_PROG = @TCLSH_PROG@ -+TCL_AUTOPATH = @TCL_AUTOPATH@ -+TCL_BIN_DIR = @TCL_BIN_DIR@ -+TCL_DEFS = @TCL_DEFS@ -+TCL_EXTRA_CFLAGS = @TCL_EXTRA_CFLAGS@ -+TCL_INCLUDES = @TCL_INCLUDES@ -+TCL_LD_FLAGS = @TCL_LD_FLAGS@ -+TCL_LIBS = @TCL_LIBS@ -+TCL_LIB_FILE = @TCL_LIB_FILE@ -+TCL_LIB_FLAG = @TCL_LIB_FLAG@ -+TCL_LIB_SPEC = @TCL_LIB_SPEC@ -+TCL_SHLIB_LD_LIBS = @TCL_SHLIB_LD_LIBS@ -+TCL_SRC_DIR = @TCL_SRC_DIR@ -+TCL_STUB_LIB_FILE = @TCL_STUB_LIB_FILE@ -+TCL_STUB_LIB_FLAG = @TCL_STUB_LIB_FLAG@ -+TCL_STUB_LIB_SPEC = @TCL_STUB_LIB_SPEC@ -+TCL_VERSION = @TCL_VERSION@ -+TK_BIN_DIR = @TK_BIN_DIR@ -+TK_INCLUDES = @TK_INCLUDES@ -+TK_LIBS = @TK_LIBS@ -+TK_LIB_FILE = @TK_LIB_FILE@ -+TK_LIB_FLAG = @TK_LIB_FLAG@ -+TK_LIB_SPEC = @TK_LIB_SPEC@ -+TK_SRC_DIR = @TK_SRC_DIR@ -+TK_STUB_LIB_FILE = @TK_STUB_LIB_FILE@ -+TK_STUB_LIB_FLAG = @TK_STUB_LIB_FLAG@ -+TK_STUB_LIB_SPEC = @TK_STUB_LIB_SPEC@ -+TK_VERSION = @TK_VERSION@ -+TK_XINCLUDES = @TK_XINCLUDES@ -+VERSION = @VERSION@ -+WARNCFLAGS = @WARNCFLAGS@ -+WARNCXXFLAGS = @WARNCXXFLAGS@ -+WARNJFLAGS = @WARNJFLAGS@ -+WARNLDFLAGS = @WARNLDFLAGS@ -+WISH_PROG = @WISH_PROG@ -+XMKMF = @XMKMF@ -+XML_CFLAGS = @XML_CFLAGS@ -+XML_LIBS = @XML_LIBS@ -+YACC = @YACC@ -+YFLAGS = @YFLAGS@ -+abs_builddir = @abs_builddir@ -+abs_srcdir = @abs_srcdir@ -+abs_top_builddir = @abs_top_builddir@ -+abs_top_srcdir = @abs_top_srcdir@ -+ac_ct_CC = @ac_ct_CC@ -+ac_ct_CXX = @ac_ct_CXX@ -+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ -+am__include = @am__include@ -+am__leading_dot = @am__leading_dot@ -+am__quote = @am__quote@ -+am__tar = @am__tar@ -+am__untar = @am__untar@ -+bindir = @bindir@ -+build = @build@ -+build_alias = @build_alias@ -+build_cpu = @build_cpu@ -+build_os = @build_os@ -+build_vendor = @build_vendor@ -+builddir = @builddir@ -+datadir = @datadir@ -+datarootdir = @datarootdir@ -+docdir = @docdir@ -+dvidir = @dvidir@ -+exec_prefix = @exec_prefix@ -+has_pkg_config = @has_pkg_config@ -+host = @host@ -+host_alias = @host_alias@ -+host_cpu = @host_cpu@ -+host_os = @host_os@ -+host_vendor = @host_vendor@ -+htmldir = @htmldir@ -+includedir = @includedir@ -+infodir = @infodir@ -+install_sh = @install_sh@ -+javadir = @javadir@ -+libapol_jswig_soname = @libapol_jswig_soname@ -+libapol_pyswig_soname = @libapol_pyswig_soname@ -+libapol_soname = @libapol_soname@ -+libapol_soversion = @libapol_soversion@ -+libapol_tswig_soname = @libapol_tswig_soname@ -+libapol_version = @libapol_version@ -+libdir = @libdir@ -+libexecdir = @libexecdir@ -+libpoldiff_jswig_soname = @libpoldiff_jswig_soname@ -+libpoldiff_pyswig_soname = @libpoldiff_pyswig_soname@ -+libpoldiff_soname = @libpoldiff_soname@ -+libpoldiff_soversion = @libpoldiff_soversion@ -+libpoldiff_tswig_soname = @libpoldiff_tswig_soname@ -+libpoldiff_version = @libpoldiff_version@ -+libqpol_jswig_soname = @libqpol_jswig_soname@ -+libqpol_pyswig_soname = @libqpol_pyswig_soname@ -+libqpol_soname = @libqpol_soname@ -+libqpol_soversion = @libqpol_soversion@ -+libqpol_tswig_soname = @libqpol_tswig_soname@ -+libqpol_version = @libqpol_version@ -+libseaudit_jswig_soname = @libseaudit_jswig_soname@ -+libseaudit_pyswig_soname = @libseaudit_pyswig_soname@ -+libseaudit_soname = @libseaudit_soname@ -+libseaudit_soversion = @libseaudit_soversion@ -+libseaudit_tswig_soname = @libseaudit_tswig_soname@ -+libseaudit_version = @libseaudit_version@ -+libsefs_jswig_soname = @libsefs_jswig_soname@ -+libsefs_pyswig_soname = @libsefs_pyswig_soname@ -+libsefs_soname = @libsefs_soname@ -+libsefs_soversion = @libsefs_soversion@ -+libsefs_tswig_soname = @libsefs_tswig_soname@ -+libsefs_version = @libsefs_version@ -+localedir = @localedir@ -+localstatedir = @localstatedir@ -+lt_ECHO = @lt_ECHO@ -+mandir = @mandir@ -+mkdir_p = @mkdir_p@ -+oldincludedir = @oldincludedir@ -+pdfdir = @pdfdir@ -+pkgpyexecdir = @pkgpyexecdir@ -+pkgpythondir = @pkgpythondir@ -+prefix = @prefix@ -+profile_install_dir = @profile_install_dir@ -+program_transform_name = @program_transform_name@ -+psdir = @psdir@ -+pyexecdir = @pyexecdir@ -+pythondir = @pythondir@ -+sbindir = @sbindir@ -+selinux_default_policy = @selinux_default_policy@ -+selinux_policy_dir = @selinux_policy_dir@ -+sepol_srcdir = @sepol_srcdir@ -+setoolsdir = @setoolsdir@ -+sharedstatedir = @sharedstatedir@ -+srcdir = @srcdir@ -+sysconfdir = @sysconfdir@ -+target_alias = @target_alias@ -+top_build_prefix = @top_build_prefix@ -+top_builddir = @top_builddir@ -+top_srcdir = @top_srcdir@ -+uudecode = @uudecode@ -+SUBDIRS = setools -+all: all-recursive -+ -+.SUFFIXES: -+$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) -+ @for dep in $?; do \ -+ case '$(am__configure_deps)' in \ -+ *$$dep*) \ -+ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ -+ && { if test -f $@; then exit 0; else break; fi; }; \ -+ exit 1;; \ -+ esac; \ -+ done; \ -+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu python/Makefile'; \ -+ $(am__cd) $(top_srcdir) && \ -+ $(AUTOMAKE) --gnu python/Makefile -+.PRECIOUS: Makefile -+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status -+ @case '$?' in \ -+ *config.status*) \ -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ -+ *) \ -+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ -+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ -+ esac; -+ -+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+ -+$(top_srcdir)/configure: $(am__configure_deps) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+$(ACLOCAL_M4): $(am__aclocal_m4_deps) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+$(am__aclocal_m4_deps): -+ -+mostlyclean-libtool: -+ -rm -f *.lo -+ -+clean-libtool: -+ -rm -rf .libs _libs -+ -+# This directory's subdirectories are mostly independent; you can cd -+# into them and run `make' without going through this Makefile. -+# To change the values of `make' variables: instead of editing Makefiles, -+# (1) if the variable is set in `config.status', edit `config.status' -+# (which will cause the Makefiles to be regenerated when you run `make'); -+# (2) otherwise, pass the desired values on the `make' command line. -+$(RECURSIVE_TARGETS): -+ @fail= failcom='exit 1'; \ -+ for f in x $$MAKEFLAGS; do \ -+ case $$f in \ -+ *=* | --[!k]*);; \ -+ *k*) failcom='fail=yes';; \ -+ esac; \ -+ done; \ -+ dot_seen=no; \ -+ target=`echo $@ | sed s/-recursive//`; \ -+ list='$(SUBDIRS)'; for subdir in $$list; do \ -+ echo "Making $$target in $$subdir"; \ -+ if test "$$subdir" = "."; then \ -+ dot_seen=yes; \ -+ local_target="$$target-am"; \ -+ else \ -+ local_target="$$target"; \ -+ fi; \ -+ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ -+ || eval $$failcom; \ -+ done; \ -+ if test "$$dot_seen" = "no"; then \ -+ $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \ -+ fi; test -z "$$fail" -+ -+$(RECURSIVE_CLEAN_TARGETS): -+ @fail= failcom='exit 1'; \ -+ for f in x $$MAKEFLAGS; do \ -+ case $$f in \ -+ *=* | --[!k]*);; \ -+ *k*) failcom='fail=yes';; \ -+ esac; \ -+ done; \ -+ dot_seen=no; \ -+ case "$@" in \ -+ distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \ -+ *) list='$(SUBDIRS)' ;; \ -+ esac; \ -+ rev=''; for subdir in $$list; do \ -+ if test "$$subdir" = "."; then :; else \ -+ rev="$$subdir $$rev"; \ -+ fi; \ -+ done; \ -+ rev="$$rev ."; \ -+ target=`echo $@ | sed s/-recursive//`; \ -+ for subdir in $$rev; do \ -+ echo "Making $$target in $$subdir"; \ -+ if test "$$subdir" = "."; then \ -+ local_target="$$target-am"; \ -+ else \ -+ local_target="$$target"; \ -+ fi; \ -+ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \ -+ || eval $$failcom; \ -+ done && test -z "$$fail" -+tags-recursive: -+ list='$(SUBDIRS)'; for subdir in $$list; do \ -+ test "$$subdir" = . || ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) tags); \ -+ done -+ctags-recursive: -+ list='$(SUBDIRS)'; for subdir in $$list; do \ -+ test "$$subdir" = . || ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) ctags); \ -+ done -+ -+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) -+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ -+ unique=`for i in $$list; do \ -+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ -+ done | \ -+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ -+ END { if (nonempty) { for (i in files) print i; }; }'`; \ -+ mkid -fID $$unique -+tags: TAGS -+ -+TAGS: tags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ -+ $(TAGS_FILES) $(LISP) -+ set x; \ -+ here=`pwd`; \ -+ if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \ -+ include_option=--etags-include; \ -+ empty_fix=.; \ -+ else \ -+ include_option=--include; \ -+ empty_fix=; \ -+ fi; \ -+ list='$(SUBDIRS)'; for subdir in $$list; do \ -+ if test "$$subdir" = .; then :; else \ -+ test ! -f $$subdir/TAGS || \ -+ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \ -+ fi; \ -+ done; \ -+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ -+ unique=`for i in $$list; do \ -+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ -+ done | \ -+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ -+ END { if (nonempty) { for (i in files) print i; }; }'`; \ -+ shift; \ -+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ -+ test -n "$$unique" || unique=$$empty_fix; \ -+ if test $$# -gt 0; then \ -+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ -+ "$$@" $$unique; \ -+ else \ -+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ -+ $$unique; \ -+ fi; \ -+ fi -+ctags: CTAGS -+CTAGS: ctags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ -+ $(TAGS_FILES) $(LISP) -+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ -+ unique=`for i in $$list; do \ -+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ -+ done | \ -+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ -+ END { if (nonempty) { for (i in files) print i; }; }'`; \ -+ test -z "$(CTAGS_ARGS)$$unique" \ -+ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ -+ $$unique -+ -+GTAGS: -+ here=`$(am__cd) $(top_builddir) && pwd` \ -+ && $(am__cd) $(top_srcdir) \ -+ && gtags -i $(GTAGS_ARGS) "$$here" -+ -+distclean-tags: -+ -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags -+ -+distdir: $(DISTFILES) -+ @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ -+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ -+ list='$(DISTFILES)'; \ -+ dist_files=`for file in $$list; do echo $$file; done | \ -+ sed -e "s|^$$srcdirstrip/||;t" \ -+ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ -+ case $$dist_files in \ -+ */*) $(MKDIR_P) `echo "$$dist_files" | \ -+ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ -+ sort -u` ;; \ -+ esac; \ -+ for file in $$dist_files; do \ -+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ -+ if test -d $$d/$$file; then \ -+ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ -+ if test -d "$(distdir)/$$file"; then \ -+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ -+ fi; \ -+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ -+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ -+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ -+ fi; \ -+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ -+ else \ -+ test -f "$(distdir)/$$file" \ -+ || cp -p $$d/$$file "$(distdir)/$$file" \ -+ || exit 1; \ -+ fi; \ -+ done -+ @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ -+ if test "$$subdir" = .; then :; else \ -+ test -d "$(distdir)/$$subdir" \ -+ || $(MKDIR_P) "$(distdir)/$$subdir" \ -+ || exit 1; \ -+ fi; \ -+ done -+ @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ -+ if test "$$subdir" = .; then :; else \ -+ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ -+ $(am__relativize); \ -+ new_distdir=$$reldir; \ -+ dir1=$$subdir; dir2="$(top_distdir)"; \ -+ $(am__relativize); \ -+ new_top_distdir=$$reldir; \ -+ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \ -+ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \ -+ ($(am__cd) $$subdir && \ -+ $(MAKE) $(AM_MAKEFLAGS) \ -+ top_distdir="$$new_top_distdir" \ -+ distdir="$$new_distdir" \ -+ am__remove_distdir=: \ -+ am__skip_length_check=: \ -+ am__skip_mode_fix=: \ -+ distdir) \ -+ || exit 1; \ -+ fi; \ -+ done -+check-am: all-am -+check: check-recursive -+all-am: Makefile -+installdirs: installdirs-recursive -+installdirs-am: -+install: install-recursive -+install-exec: install-exec-recursive -+install-data: install-data-recursive -+uninstall: uninstall-recursive -+ -+install-am: all-am -+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am -+ -+installcheck: installcheck-recursive -+install-strip: -+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ -+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ -+ `test -z '$(STRIP)' || \ -+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install -+mostlyclean-generic: -+ -+clean-generic: -+ -+distclean-generic: -+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) -+ -+maintainer-clean-generic: -+ @echo "This command is intended for maintainers to use" -+ @echo "it deletes files that may require special tools to rebuild." -+clean: clean-recursive -+ -+clean-am: clean-generic clean-libtool mostlyclean-am -+ -+distclean: distclean-recursive -+ -rm -f Makefile -+distclean-am: clean-am distclean-generic distclean-tags -+ -+dvi: dvi-recursive -+ -+dvi-am: -+ -+html: html-recursive -+ -+html-am: -+ -+info: info-recursive -+ -+info-am: -+ -+install-data-am: -+ -+install-dvi: install-dvi-recursive -+ -+install-dvi-am: -+ -+install-exec-am: -+ -+install-html: install-html-recursive -+ -+install-html-am: -+ -+install-info: install-info-recursive -+ -+install-info-am: -+ -+install-man: -+ -+install-pdf: install-pdf-recursive -+ -+install-pdf-am: -+ -+install-ps: install-ps-recursive -+ -+install-ps-am: -+ -+installcheck-am: -+ -+maintainer-clean: maintainer-clean-recursive -+ -rm -f Makefile -+maintainer-clean-am: distclean-am maintainer-clean-generic -+ -+mostlyclean: mostlyclean-recursive -+ -+mostlyclean-am: mostlyclean-generic mostlyclean-libtool -+ -+pdf: pdf-recursive -+ -+pdf-am: -+ -+ps: ps-recursive -+ -+ps-am: -+ -+uninstall-am: -+ -+.MAKE: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) ctags-recursive \ -+ install-am install-strip tags-recursive -+ -+.PHONY: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) CTAGS GTAGS \ -+ all all-am check check-am clean clean-generic clean-libtool \ -+ ctags ctags-recursive distclean distclean-generic \ -+ distclean-libtool distclean-tags distdir dvi dvi-am html \ -+ html-am info info-am install install-am install-data \ -+ install-data-am install-dvi install-dvi-am install-exec \ -+ install-exec-am install-html install-html-am install-info \ -+ install-info-am install-man install-pdf install-pdf-am \ -+ install-ps install-ps-am install-strip installcheck \ -+ installcheck-am installdirs installdirs-am maintainer-clean \ -+ maintainer-clean-generic mostlyclean mostlyclean-generic \ -+ mostlyclean-libtool pdf pdf-am ps ps-am tags tags-recursive \ -+ uninstall uninstall-am -+ -+ -+# Tell versions [3.59,3.63) of GNU make to not export all variables. -+# Otherwise a system limit (for SysV at least) may be exceeded. -+.NOEXPORT: -diff -up setools-3.3.7/python/setools/__init__.py.python setools-3.3.7/python/setools/__init__.py ---- setools-3.3.7/python/setools/__init__.py.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/__init__.py 2010-10-14 14:31:06.000000000 -0400 -@@ -0,0 +1,50 @@ -+#!/usr/bin/env python -+ -+# Author: Thomas Liu -+ -+import _sesearch -+import _seinfo -+import types -+ -+TYPE = _seinfo.TYPE -+ROLE = _seinfo.ROLE -+ATTRIBUTE = _seinfo.ATTRIBUTE -+PORT = _seinfo.PORT -+USER = _seinfo.USER -+ -+ALLOW = 'allow' -+AUDITALLOW = 'auditallow' -+NEVERALLOW = 'neverallow' -+DONTAUDIT = 'dontaudit' -+SCONTEXT = 'scontext' -+TCONTEXT = 'tcontext' -+PERMS = 'permlist' -+CLASS = 'class' -+ -+def sesearch(types, info): -+ valid_types = [ALLOW, AUDITALLOW, NEVERALLOW, DONTAUDIT] -+ for type in types: -+ if type not in valid_types: -+ raise ValueError("Type has to be in %s" % valid_types) -+ info[type] = True -+ -+ perms = [] -+ if PERMS in info: -+ perms = info[PERMS] -+ info[PERMS] = ",".join(info[PERMS]) -+ -+ -+ dict_list = _sesearch.sesearch(info) -+ if dict_list and len(perms) != 0: -+ dict_list = filter(lambda x: dict_has_perms(x, perms), dict_list) -+ return dict_list -+ -+def dict_has_perms(dict, perms): -+ for perm in perms: -+ if perm not in dict[PERMS]: -+ return False -+ return True -+ -+def seinfo(setype, name=None): -+ dict_list = _seinfo.seinfo(setype, name) -+ return dict_list -diff -up setools-3.3.7/python/setools/Makefile.am.python setools-3.3.7/python/setools/Makefile.am ---- setools-3.3.7/python/setools/Makefile.am.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/Makefile.am 2010-07-30 15:02:10.000000000 -0400 -@@ -0,0 +1,36 @@ -+EXTRA_DIST = \ -+ sesearch.c \ -+ seinfo.c \ -+ __init__.py \ -+ setup.py \ -+ $(NULL) -+ -+AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -+ @QPOL_CFLAGS@ @APOL_CFLAGS@ -+AM_CXXFLAGS = @DEBUGCXXFLAGS@ @WARNCXXFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -+ @QPOL_CFLAGS@ @APOL_CFLAGS@ @SEFS_CFLAGS@ -+AM_LDFLAGS = @DEBUGLDFLAGS@ @WARNLDFLAGS@ @PROFILELDFLAGS@ -+ -+LDADD = @SELINUX_LIB_FLAG@ @APOL_LIB_FLAG@ @QPOL_LIB_FLAG@ -+DEPENDENCIES = $(top_builddir)/libapol/src/libapol.so $(top_builddir)/libqpol/src/libqpol.so -+all-am: python-build -+ -+seinfo_SOURCES = seinfo.c -+ -+sesearch_SOURCES = sesearch.c -+ -+python-build: sesearch.c seinfo.c -+ @mkdir -p setools -+ @cp __init__.py setools -+ LIBS="$(QPOL_LIB_FLAG) $(APOL_LIB_FLAG)" INCLUDES="$(QPOL_CFLAGS) $(APOL_CFLAGS)" $(PYTHON) setup.py build -+ -+install-exec-hook: -+ $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` -+ -+uninstall-hook: -+ $(PYTHON) setup.py uninstall `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` -+ -+clean-local: -+ $(PYTHON) setup.py clean -a -+ rm -f *~ -+ -diff -up setools-3.3.7/python/setools/Makefile.in.python setools-3.3.7/python/setools/Makefile.in ---- setools-3.3.7/python/setools/Makefile.in.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/Makefile.in 2010-07-30 15:02:46.000000000 -0400 -@@ -0,0 +1,550 @@ -+# Makefile.in generated by automake 1.11.1 from Makefile.am. -+# @configure_input@ -+ -+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -+# Inc. -+# This Makefile.in is free software; the Free Software Foundation -+# gives unlimited permission to copy and/or distribute it, -+# with or without modifications, as long as this notice is preserved. -+ -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without -+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A -+# PARTICULAR PURPOSE. -+ -+@SET_MAKE@ -+VPATH = @srcdir@ -+pkgdatadir = $(datadir)/@PACKAGE@ -+pkgincludedir = $(includedir)/@PACKAGE@ -+pkglibdir = $(libdir)/@PACKAGE@ -+pkglibexecdir = $(libexecdir)/@PACKAGE@ -+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd -+install_sh_DATA = $(install_sh) -c -m 644 -+install_sh_PROGRAM = $(install_sh) -c -+install_sh_SCRIPT = $(install_sh) -c -+INSTALL_HEADER = $(INSTALL_DATA) -+transform = $(program_transform_name) -+NORMAL_INSTALL = : -+PRE_INSTALL = : -+POST_INSTALL = : -+NORMAL_UNINSTALL = : -+PRE_UNINSTALL = : -+POST_UNINSTALL = : -+build_triplet = @build@ -+host_triplet = @host@ -+subdir = python/setools -+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in -+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 -+am__aclocal_m4_deps = $(top_srcdir)/m4/ac_check_classpath.m4 \ -+ $(top_srcdir)/m4/ac_java_options.m4 \ -+ $(top_srcdir)/m4/ac_pkg_swig.m4 \ -+ $(top_srcdir)/m4/ac_prog_jar.m4 \ -+ $(top_srcdir)/m4/ac_prog_java.m4 \ -+ $(top_srcdir)/m4/ac_prog_java_works.m4 \ -+ $(top_srcdir)/m4/ac_prog_javac.m4 \ -+ $(top_srcdir)/m4/ac_prog_javac_works.m4 \ -+ $(top_srcdir)/m4/ac_python_devel.m4 $(top_srcdir)/m4/c.m4 \ -+ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ -+ $(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \ -+ $(top_srcdir)/m4/lt~obsolete.m4 \ -+ $(top_srcdir)/m4/swig_python.m4 $(top_srcdir)/m4/tcl.m4 \ -+ $(top_srcdir)/configure.ac -+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ -+ $(ACLOCAL_M4) -+mkinstalldirs = $(install_sh) -d -+CONFIG_HEADER = $(top_builddir)/config.h -+CONFIG_CLEAN_FILES = -+CONFIG_CLEAN_VPATH_FILES = -+SOURCES = -+DIST_SOURCES = -+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) -+ACLOCAL = @ACLOCAL@ -+AMTAR = @AMTAR@ -+APOL_CFLAGS = @APOL_CFLAGS@ -+APOL_LIB_FLAG = @APOL_LIB_FLAG@ -+AR = @AR@ -+AUTOCONF = @AUTOCONF@ -+AUTOHEADER = @AUTOHEADER@ -+AUTOMAKE = @AUTOMAKE@ -+AWK = @AWK@ -+BWIDGET_DESTDIR = @BWIDGET_DESTDIR@ -+CC = @CC@ -+CCDEPMODE = @CCDEPMODE@ -+CFLAGS = @CFLAGS@ -+CPP = @CPP@ -+CPPFLAGS = @CPPFLAGS@ -+CUNIT_LIB_FLAG = @CUNIT_LIB_FLAG@ -+CXX = @CXX@ -+CXXCPP = @CXXCPP@ -+CXXDEPMODE = @CXXDEPMODE@ -+CXXFLAGS = @CXXFLAGS@ -+CYGPATH = @CYGPATH@ -+CYGPATH_W = @CYGPATH_W@ -+DEBUGCFLAGS = @DEBUGCFLAGS@ -+DEBUGCXXFLAGS = @DEBUGCXXFLAGS@ -+DEBUGJFLAGS = @DEBUGJFLAGS@ -+DEBUGLDFLAGS = @DEBUGLDFLAGS@ -+DEFS = @DEFS@ -+DEPDIR = @DEPDIR@ -+DSYMUTIL = @DSYMUTIL@ -+DUMPBIN = @DUMPBIN@ -+ECHO_C = @ECHO_C@ -+ECHO_N = @ECHO_N@ -+ECHO_T = @ECHO_T@ -+EGREP = @EGREP@ -+EXEEXT = @EXEEXT@ -+FGREP = @FGREP@ -+GLADE_CFLAGS = @GLADE_CFLAGS@ -+GLADE_LIBS = @GLADE_LIBS@ -+GREP = @GREP@ -+GTHREAD_CFLAGS = @GTHREAD_CFLAGS@ -+GTHREAD_LIBS = @GTHREAD_LIBS@ -+GTK_CFLAGS = @GTK_CFLAGS@ -+GTK_LIBS = @GTK_LIBS@ -+INSTALL = @INSTALL@ -+INSTALL_DATA = @INSTALL_DATA@ -+INSTALL_PROGRAM = @INSTALL_PROGRAM@ -+INSTALL_SCRIPT = @INSTALL_SCRIPT@ -+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ -+JAR = @JAR@ -+JAVA = @JAVA@ -+JAVAC = @JAVAC@ -+JAVACFLAGS = @JAVACFLAGS@ -+JAVAFLAGS = @JAVAFLAGS@ -+JAVAPREFIX = @JAVAPREFIX@ -+LD = @LD@ -+LDFLAGS = @LDFLAGS@ -+LEX = @LEX@ -+LEXLIB = @LEXLIB@ -+LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ -+LIBOBJS = @LIBOBJS@ -+LIBS = @LIBS@ -+LIBTOOL = @LIBTOOL@ -+LIPO = @LIPO@ -+LN_S = @LN_S@ -+LTLIBOBJS = @LTLIBOBJS@ -+MAKEINFO = @MAKEINFO@ -+MKDIR_P = @MKDIR_P@ -+NM = @NM@ -+NMEDIT = @NMEDIT@ -+OBJDUMP = @OBJDUMP@ -+OBJEXT = @OBJEXT@ -+OTOOL = @OTOOL@ -+OTOOL64 = @OTOOL64@ -+PACKAGE = @PACKAGE@ -+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ -+PACKAGE_NAME = @PACKAGE_NAME@ -+PACKAGE_STRING = @PACKAGE_STRING@ -+PACKAGE_TARNAME = @PACKAGE_TARNAME@ -+PACKAGE_URL = @PACKAGE_URL@ -+PACKAGE_VERSION = @PACKAGE_VERSION@ -+PATH_SEPARATOR = @PATH_SEPARATOR@ -+PIXBUF_CFLAGS = @PIXBUF_CFLAGS@ -+PIXBUF_LIBS = @PIXBUF_LIBS@ -+PKG_CFLAGS = @PKG_CFLAGS@ -+PKG_HEADERS = @PKG_HEADERS@ -+PKG_INCLUDES = @PKG_INCLUDES@ -+PKG_LIBS = @PKG_LIBS@ -+PKG_LIB_FILE = @PKG_LIB_FILE@ -+PKG_STUB_LIB_FILE = @PKG_STUB_LIB_FILE@ -+PKG_STUB_OBJECTS = @PKG_STUB_OBJECTS@ -+PKG_STUB_SOURCES = @PKG_STUB_SOURCES@ -+PKG_TCL_SOURCES = @PKG_TCL_SOURCES@ -+POLDIFF_CFLAGS = @POLDIFF_CFLAGS@ -+POLDIFF_LIB_FLAG = @POLDIFF_LIB_FLAG@ -+PROFILECFLAGS = @PROFILECFLAGS@ -+PROFILELDFLAGS = @PROFILELDFLAGS@ -+PYTHON = @PYTHON@ -+PYTHON_CPPFLAGS = @PYTHON_CPPFLAGS@ -+PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@ -+PYTHON_EXTRA_LDFLAGS = @PYTHON_EXTRA_LDFLAGS@ -+PYTHON_EXTRA_LIBS = @PYTHON_EXTRA_LIBS@ -+PYTHON_LDFLAGS = @PYTHON_LDFLAGS@ -+PYTHON_PLATFORM = @PYTHON_PLATFORM@ -+PYTHON_PREFIX = @PYTHON_PREFIX@ -+PYTHON_SITE_PKG = @PYTHON_SITE_PKG@ -+PYTHON_VERSION = @PYTHON_VERSION@ -+QPOL_CFLAGS = @QPOL_CFLAGS@ -+QPOL_LIB_FLAG = @QPOL_LIB_FLAG@ -+RANLIB = @RANLIB@ -+SEAUDIT_CFLAGS = @SEAUDIT_CFLAGS@ -+SEAUDIT_LIB_FLAG = @SEAUDIT_LIB_FLAG@ -+SED = @SED@ -+SEFS_CFLAGS = @SEFS_CFLAGS@ -+SEFS_LIB_FLAG = @SEFS_LIB_FLAG@ -+SELINUX_CFLAGS = @SELINUX_CFLAGS@ -+SELINUX_LIB_FLAG = @SELINUX_LIB_FLAG@ -+SET_MAKE = @SET_MAKE@ -+SHELL = @SHELL@ -+SQLITE3_CFLAGS = @SQLITE3_CFLAGS@ -+SQLITE3_LIBS = @SQLITE3_LIBS@ -+STRIP = @STRIP@ -+SWIG = @SWIG@ -+SWIG_JAVA_CFLAGS = @SWIG_JAVA_CFLAGS@ -+SWIG_JAVA_OPT = @SWIG_JAVA_OPT@ -+SWIG_LIB = @SWIG_LIB@ -+SWIG_PYTHON_CPPFLAGS = @SWIG_PYTHON_CPPFLAGS@ -+SWIG_PYTHON_OPT = @SWIG_PYTHON_OPT@ -+SWIG_TCL_CFLAGS = @SWIG_TCL_CFLAGS@ -+SWIG_TCL_OPT = @SWIG_TCL_OPT@ -+TCLSH_PROG = @TCLSH_PROG@ -+TCL_AUTOPATH = @TCL_AUTOPATH@ -+TCL_BIN_DIR = @TCL_BIN_DIR@ -+TCL_DEFS = @TCL_DEFS@ -+TCL_EXTRA_CFLAGS = @TCL_EXTRA_CFLAGS@ -+TCL_INCLUDES = @TCL_INCLUDES@ -+TCL_LD_FLAGS = @TCL_LD_FLAGS@ -+TCL_LIBS = @TCL_LIBS@ -+TCL_LIB_FILE = @TCL_LIB_FILE@ -+TCL_LIB_FLAG = @TCL_LIB_FLAG@ -+TCL_LIB_SPEC = @TCL_LIB_SPEC@ -+TCL_SHLIB_LD_LIBS = @TCL_SHLIB_LD_LIBS@ -+TCL_SRC_DIR = @TCL_SRC_DIR@ -+TCL_STUB_LIB_FILE = @TCL_STUB_LIB_FILE@ -+TCL_STUB_LIB_FLAG = @TCL_STUB_LIB_FLAG@ -+TCL_STUB_LIB_SPEC = @TCL_STUB_LIB_SPEC@ -+TCL_VERSION = @TCL_VERSION@ -+TK_BIN_DIR = @TK_BIN_DIR@ -+TK_INCLUDES = @TK_INCLUDES@ -+TK_LIBS = @TK_LIBS@ -+TK_LIB_FILE = @TK_LIB_FILE@ -+TK_LIB_FLAG = @TK_LIB_FLAG@ -+TK_LIB_SPEC = @TK_LIB_SPEC@ -+TK_SRC_DIR = @TK_SRC_DIR@ -+TK_STUB_LIB_FILE = @TK_STUB_LIB_FILE@ -+TK_STUB_LIB_FLAG = @TK_STUB_LIB_FLAG@ -+TK_STUB_LIB_SPEC = @TK_STUB_LIB_SPEC@ -+TK_VERSION = @TK_VERSION@ -+TK_XINCLUDES = @TK_XINCLUDES@ -+VERSION = @VERSION@ -+WARNCFLAGS = @WARNCFLAGS@ -+WARNCXXFLAGS = @WARNCXXFLAGS@ -+WARNJFLAGS = @WARNJFLAGS@ -+WARNLDFLAGS = @WARNLDFLAGS@ -+WISH_PROG = @WISH_PROG@ -+XMKMF = @XMKMF@ -+XML_CFLAGS = @XML_CFLAGS@ -+XML_LIBS = @XML_LIBS@ -+YACC = @YACC@ -+YFLAGS = @YFLAGS@ -+abs_builddir = @abs_builddir@ -+abs_srcdir = @abs_srcdir@ -+abs_top_builddir = @abs_top_builddir@ -+abs_top_srcdir = @abs_top_srcdir@ -+ac_ct_CC = @ac_ct_CC@ -+ac_ct_CXX = @ac_ct_CXX@ -+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ -+am__include = @am__include@ -+am__leading_dot = @am__leading_dot@ -+am__quote = @am__quote@ -+am__tar = @am__tar@ -+am__untar = @am__untar@ -+bindir = @bindir@ -+build = @build@ -+build_alias = @build_alias@ -+build_cpu = @build_cpu@ -+build_os = @build_os@ -+build_vendor = @build_vendor@ -+builddir = @builddir@ -+datadir = @datadir@ -+datarootdir = @datarootdir@ -+docdir = @docdir@ -+dvidir = @dvidir@ -+exec_prefix = @exec_prefix@ -+has_pkg_config = @has_pkg_config@ -+host = @host@ -+host_alias = @host_alias@ -+host_cpu = @host_cpu@ -+host_os = @host_os@ -+host_vendor = @host_vendor@ -+htmldir = @htmldir@ -+includedir = @includedir@ -+infodir = @infodir@ -+install_sh = @install_sh@ -+javadir = @javadir@ -+libapol_jswig_soname = @libapol_jswig_soname@ -+libapol_pyswig_soname = @libapol_pyswig_soname@ -+libapol_soname = @libapol_soname@ -+libapol_soversion = @libapol_soversion@ -+libapol_tswig_soname = @libapol_tswig_soname@ -+libapol_version = @libapol_version@ -+libdir = @libdir@ -+libexecdir = @libexecdir@ -+libpoldiff_jswig_soname = @libpoldiff_jswig_soname@ -+libpoldiff_pyswig_soname = @libpoldiff_pyswig_soname@ -+libpoldiff_soname = @libpoldiff_soname@ -+libpoldiff_soversion = @libpoldiff_soversion@ -+libpoldiff_tswig_soname = @libpoldiff_tswig_soname@ -+libpoldiff_version = @libpoldiff_version@ -+libqpol_jswig_soname = @libqpol_jswig_soname@ -+libqpol_pyswig_soname = @libqpol_pyswig_soname@ -+libqpol_soname = @libqpol_soname@ -+libqpol_soversion = @libqpol_soversion@ -+libqpol_tswig_soname = @libqpol_tswig_soname@ -+libqpol_version = @libqpol_version@ -+libseaudit_jswig_soname = @libseaudit_jswig_soname@ -+libseaudit_pyswig_soname = @libseaudit_pyswig_soname@ -+libseaudit_soname = @libseaudit_soname@ -+libseaudit_soversion = @libseaudit_soversion@ -+libseaudit_tswig_soname = @libseaudit_tswig_soname@ -+libseaudit_version = @libseaudit_version@ -+libsefs_jswig_soname = @libsefs_jswig_soname@ -+libsefs_pyswig_soname = @libsefs_pyswig_soname@ -+libsefs_soname = @libsefs_soname@ -+libsefs_soversion = @libsefs_soversion@ -+libsefs_tswig_soname = @libsefs_tswig_soname@ -+libsefs_version = @libsefs_version@ -+localedir = @localedir@ -+localstatedir = @localstatedir@ -+lt_ECHO = @lt_ECHO@ -+mandir = @mandir@ -+mkdir_p = @mkdir_p@ -+oldincludedir = @oldincludedir@ -+pdfdir = @pdfdir@ -+pkgpyexecdir = @pkgpyexecdir@ -+pkgpythondir = @pkgpythondir@ -+prefix = @prefix@ -+profile_install_dir = @profile_install_dir@ -+program_transform_name = @program_transform_name@ -+psdir = @psdir@ -+pyexecdir = @pyexecdir@ -+pythondir = @pythondir@ -+sbindir = @sbindir@ -+selinux_default_policy = @selinux_default_policy@ -+selinux_policy_dir = @selinux_policy_dir@ -+sepol_srcdir = @sepol_srcdir@ -+setoolsdir = @setoolsdir@ -+sharedstatedir = @sharedstatedir@ -+srcdir = @srcdir@ -+sysconfdir = @sysconfdir@ -+target_alias = @target_alias@ -+top_build_prefix = @top_build_prefix@ -+top_builddir = @top_builddir@ -+top_srcdir = @top_srcdir@ -+uudecode = @uudecode@ -+EXTRA_DIST = \ -+ sesearch.c \ -+ seinfo.c \ -+ __init__.py \ -+ setup.py \ -+ $(NULL) -+ -+AM_CFLAGS = @DEBUGCFLAGS@ @WARNCFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -+ @QPOL_CFLAGS@ @APOL_CFLAGS@ -+ -+AM_CXXFLAGS = @DEBUGCXXFLAGS@ @WARNCXXFLAGS@ @PROFILECFLAGS@ @SELINUX_CFLAGS@ \ -+ @QPOL_CFLAGS@ @APOL_CFLAGS@ @SEFS_CFLAGS@ -+ -+AM_LDFLAGS = @DEBUGLDFLAGS@ @WARNLDFLAGS@ @PROFILELDFLAGS@ -+LDADD = @SELINUX_LIB_FLAG@ @APOL_LIB_FLAG@ @QPOL_LIB_FLAG@ -+DEPENDENCIES = $(top_builddir)/libapol/src/libapol.so $(top_builddir)/libqpol/src/libqpol.so -+seinfo_SOURCES = seinfo.c -+sesearch_SOURCES = sesearch.c -+all: all-am -+ -+.SUFFIXES: -+$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) -+ @for dep in $?; do \ -+ case '$(am__configure_deps)' in \ -+ *$$dep*) \ -+ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ -+ && { if test -f $@; then exit 0; else break; fi; }; \ -+ exit 1;; \ -+ esac; \ -+ done; \ -+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu python/setools/Makefile'; \ -+ $(am__cd) $(top_srcdir) && \ -+ $(AUTOMAKE) --gnu python/setools/Makefile -+.PRECIOUS: Makefile -+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status -+ @case '$?' in \ -+ *config.status*) \ -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ -+ *) \ -+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ -+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ -+ esac; -+ -+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+ -+$(top_srcdir)/configure: $(am__configure_deps) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+$(ACLOCAL_M4): $(am__aclocal_m4_deps) -+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh -+$(am__aclocal_m4_deps): -+ -+mostlyclean-libtool: -+ -rm -f *.lo -+ -+clean-libtool: -+ -rm -rf .libs _libs -+tags: TAGS -+TAGS: -+ -+ctags: CTAGS -+CTAGS: -+ -+ -+distdir: $(DISTFILES) -+ @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ -+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ -+ list='$(DISTFILES)'; \ -+ dist_files=`for file in $$list; do echo $$file; done | \ -+ sed -e "s|^$$srcdirstrip/||;t" \ -+ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ -+ case $$dist_files in \ -+ */*) $(MKDIR_P) `echo "$$dist_files" | \ -+ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ -+ sort -u` ;; \ -+ esac; \ -+ for file in $$dist_files; do \ -+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ -+ if test -d $$d/$$file; then \ -+ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ -+ if test -d "$(distdir)/$$file"; then \ -+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ -+ fi; \ -+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ -+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ -+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ -+ fi; \ -+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ -+ else \ -+ test -f "$(distdir)/$$file" \ -+ || cp -p $$d/$$file "$(distdir)/$$file" \ -+ || exit 1; \ -+ fi; \ -+ done -+check-am: all-am -+check: check-am -+all-am: Makefile -+installdirs: -+install: install-am -+install-exec: install-exec-am -+install-data: install-data-am -+uninstall: uninstall-am -+ -+install-am: all-am -+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am -+ -+installcheck: installcheck-am -+install-strip: -+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ -+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ -+ `test -z '$(STRIP)' || \ -+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install -+mostlyclean-generic: -+ -+clean-generic: -+ -+distclean-generic: -+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) -+ -+maintainer-clean-generic: -+ @echo "This command is intended for maintainers to use" -+ @echo "it deletes files that may require special tools to rebuild." -+clean: clean-am -+ -+clean-am: clean-generic clean-libtool clean-local mostlyclean-am -+ -+distclean: distclean-am -+ -rm -f Makefile -+distclean-am: clean-am distclean-generic -+ -+dvi: dvi-am -+ -+dvi-am: -+ -+html: html-am -+ -+html-am: -+ -+info: info-am -+ -+info-am: -+ -+install-data-am: -+ -+install-dvi: install-dvi-am -+ -+install-dvi-am: -+ -+install-exec-am: -+ @$(NORMAL_INSTALL) -+ $(MAKE) $(AM_MAKEFLAGS) install-exec-hook -+install-html: install-html-am -+ -+install-html-am: -+ -+install-info: install-info-am -+ -+install-info-am: -+ -+install-man: -+ -+install-pdf: install-pdf-am -+ -+install-pdf-am: -+ -+install-ps: install-ps-am -+ -+install-ps-am: -+ -+installcheck-am: -+ -+maintainer-clean: maintainer-clean-am -+ -rm -f Makefile -+maintainer-clean-am: distclean-am maintainer-clean-generic -+ -+mostlyclean: mostlyclean-am -+ -+mostlyclean-am: mostlyclean-generic mostlyclean-libtool -+ -+pdf: pdf-am -+ -+pdf-am: -+ -+ps: ps-am -+ -+ps-am: -+ -+uninstall-am: -+ @$(NORMAL_INSTALL) -+ $(MAKE) $(AM_MAKEFLAGS) uninstall-hook -+.MAKE: install-am install-exec-am install-strip uninstall-am -+ -+.PHONY: all all-am check check-am clean clean-generic clean-libtool \ -+ clean-local distclean distclean-generic distclean-libtool \ -+ distdir dvi dvi-am html html-am info info-am install \ -+ install-am install-data install-data-am install-dvi \ -+ install-dvi-am install-exec install-exec-am install-exec-hook \ -+ install-html install-html-am install-info install-info-am \ -+ install-man install-pdf install-pdf-am install-ps \ -+ install-ps-am install-strip installcheck installcheck-am \ -+ installdirs maintainer-clean maintainer-clean-generic \ -+ mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \ -+ ps ps-am uninstall uninstall-am uninstall-hook -+ -+all-am: python-build -+ -+python-build: sesearch.c seinfo.c -+ @mkdir -p setools -+ @cp __init__.py setools -+ LIBS="$(QPOL_LIB_FLAG) $(APOL_LIB_FLAG)" INCLUDES="$(QPOL_CFLAGS) $(APOL_CFLAGS)" $(PYTHON) setup.py build -+ -+install-exec-hook: -+ $(PYTHON) setup.py install `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` -+ -+uninstall-hook: -+ $(PYTHON) setup.py uninstall `test -n "$(DESTDIR)" && echo --root $(DESTDIR)` -+ -+clean-local: -+ $(PYTHON) setup.py clean -a -+ rm -f *~ -+ -+# Tell versions [3.59,3.63) of GNU make to not export all variables. -+# Otherwise a system limit (for SysV at least) may be exceeded. -+.NOEXPORT: -diff -up setools-3.3.7/python/setools/seinfo.c.python setools-3.3.7/python/setools/seinfo.c ---- setools-3.3.7/python/setools/seinfo.c.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/seinfo.c 2010-08-03 18:07:17.000000000 -0400 -@@ -0,0 +1,769 @@ -+/** -+ * @file -+ * Command line tool to search TE rules. -+ * -+ * @author Frank Mayer mayerf@tresys.com -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Paul Rosenfeld prosenfeld@tresys.com -+ * @author Thomas Liu -+ * @author Dan Walsh -+ * -+ * Copyright (C) 2003-2008 Tresys Technology, LLC -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+/** -+ * This is a modified version of seinfo to be used as part of a library for -+ * Python bindings. -+ */ -+ -+#include "Python.h" -+ -+/* libapol */ -+#include -+#include -+#include -+#include -+#include -+ -+/* libqpol */ -+#include -+#include -+ -+/* other */ -+#include -+#include -+#include -+#include -+#include -+ -+#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" -+static char *policy_file = NULL; -+ -+enum input -+{ -+ TYPE, ATTRIBUTE, ROLE, USER, PORT, -+}; -+ -+/** -+ * Gets a textual representation of an attribute, and -+ * all of that attribute's types. -+ * -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ */ -+static PyObject* get_attr(const qpol_type_t * type_datum, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *dict = PyDict_New(); -+ const qpol_type_t *attr_datum = NULL; -+ qpol_iterator_t *iter = NULL; -+ const char *attr_name = NULL, *type_name = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ unsigned char isattr; -+ -+ if (qpol_type_get_name(q, type_datum, &attr_name)) -+ goto cleanup; -+ PyObject *obj = PyString_FromString(attr_name); -+ PyDict_SetItemString(dict, "name", obj); -+ Py_DECREF(obj); -+ -+ /* get an iterator over all types this attribute has */ -+ if (qpol_type_get_isattr(q, type_datum, &isattr)) -+ goto cleanup; -+ if (isattr) { /* sanity check */ -+ if (qpol_type_get_type_iter(q, type_datum, &iter)) -+ goto cleanup; -+ PyObject *list = PyList_New(0); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&attr_datum)) -+ goto cleanup; -+ if (qpol_type_get_name(q, attr_datum, &type_name)) -+ goto cleanup; -+ PyObject *obj = PyString_FromString(type_name); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ qpol_iterator_destroy(&iter); -+ PyDict_SetItemString(dict, "types", list); -+ Py_DECREF(list); -+ } else /* this should never happen */ -+ goto cleanup; -+ -+ retval = 0; -+cleanup: -+ qpol_iterator_destroy(&iter); -+ if (retval) { -+ Py_DECREF(dict); -+ return NULL; -+ } -+ return dict; -+} -+ -+/** -+ * Gets statistics regarding a policy's attributes. -+ * If this function is given a name, it will attempt to -+ * get statistics about a particular attribute; otherwise -+ * the function gets statistics about all of the policy's -+ * attributes. -+ * -+ * @param name Reference to an attribute's name; if NULL, -+ * all object classes will be considered -+ * @param policydb Reference to a policy -+ * -+ * @return 0 on success, < 0 on error. -+ */ -+static PyObject* get_attribs(const char *name, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *list = PyList_New(0); -+ apol_attr_query_t *attr_query = NULL; -+ apol_vector_t *v = NULL; -+ const qpol_type_t *type_datum = NULL; -+ size_t n_attrs, i; -+ -+ /* we are only getting information about 1 attribute */ -+ if (name != NULL) { -+ attr_query = apol_attr_query_create(); -+ if (!attr_query) -+ goto cleanup; -+ if (apol_attr_query_set_attr(policydb, attr_query, name)) -+ goto cleanup; -+ if (apol_attr_get_by_query(policydb, attr_query, &v)) -+ goto cleanup; -+ apol_attr_query_destroy(&attr_query); -+ if (apol_vector_get_size(v) == 0) { -+ apol_vector_destroy(&v); -+ errno = EINVAL; -+ goto cleanup; -+ } -+ -+ type_datum = apol_vector_get_element(v, (size_t) 0); -+ PyObject *obj = get_attr(type_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } else { -+ attr_query = apol_attr_query_create(); -+ if (!attr_query) -+ goto cleanup; -+ if (apol_attr_get_by_query(policydb, attr_query, &v)) -+ goto cleanup; -+ apol_attr_query_destroy(&attr_query); -+ n_attrs = apol_vector_get_size(v); -+ -+ for (i = 0; i < n_attrs; i++) { -+ /* get qpol_type_t* item from vector */ -+ type_datum = (qpol_type_t *) apol_vector_get_element(v, (size_t) i); -+ if (!type_datum) -+ goto cleanup; -+ PyObject *obj = get_attr(type_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ } -+ apol_vector_destroy(&v); -+ -+ retval = 0; -+ cleanup: -+ apol_attr_query_destroy(&attr_query); -+ apol_vector_destroy(&v); -+ if (retval) { -+ Py_DECREF(list); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return list; -+} -+ -+/** -+ * Get a textual representation of a type, and -+ * all of that type's attributes. -+ * -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ */ -+static PyObject* get_type_attrs(const qpol_type_t * type_datum, const apol_policy_t * policydb) -+{ -+ qpol_iterator_t *iter = NULL; -+ const char *attr_name = NULL; -+ const qpol_type_t *attr_datum = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ if (qpol_type_get_attr_iter(q, type_datum, &iter)) -+ goto cleanup; -+ PyObject *list = PyList_New(0); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&attr_datum)) -+ goto cleanup; -+ if (qpol_type_get_name(q, attr_datum, &attr_name)) -+ goto cleanup; -+ PyObject *obj = PyString_FromString(attr_name); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ -+ cleanup: -+ qpol_iterator_destroy(&iter); -+ return list; -+} -+ -+static PyObject* get_type( const qpol_type_t * type_datum, const apol_policy_t * policydb) { -+ -+ PyObject *dict = PyDict_New(); -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ const char *type_name = NULL; -+ -+ unsigned char isalias, ispermissive, isattr; -+ -+ if (qpol_type_get_name(q, type_datum, &type_name)) -+ goto cleanup; -+ if (qpol_type_get_isalias(q, type_datum, &isalias)) -+ goto cleanup; -+ if (qpol_type_get_isattr(q, type_datum, &isattr)) -+ goto cleanup; -+ if (qpol_type_get_ispermissive(q, type_datum, &ispermissive)) -+ goto cleanup; -+ -+ PyObject *obj = PyString_FromString(type_name); -+ PyDict_SetItemString(dict, "name", obj); -+ Py_DECREF(obj); -+ obj = PyBool_FromLong(ispermissive); -+ PyDict_SetItemString(dict, "permissive", obj); -+ Py_DECREF(obj); -+ if (!isattr && !isalias) { -+ obj = get_type_attrs(type_datum, policydb); -+ PyDict_SetItemString(dict, "attributes", obj); -+ Py_DECREF(obj); -+ } -+ return dict; -+cleanup: -+ Py_DECREF(dict); -+ return NULL; -+} -+ -+/** -+ * Gets a textual representation of a user, and -+ * all of that user's roles. -+ * -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ * roles -+ */ -+static PyObject* get_user(const qpol_user_t * user_datum, const apol_policy_t * policydb) -+{ -+ PyObject *dict = NULL; -+ const qpol_role_t *role_datum = NULL; -+ qpol_iterator_t *iter = NULL; -+ const qpol_mls_range_t *range = NULL; -+ const qpol_mls_level_t *dflt_level = NULL; -+ apol_mls_level_t *ap_lvl = NULL; -+ apol_mls_range_t *ap_range = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ char *tmp; -+ const char *user_name, *role_name; -+ -+ if (qpol_user_get_name(q, user_datum, &user_name)) -+ goto cleanup; -+ -+ dict = PyDict_New(); -+ PyObject *obj = PyString_FromString(user_name); -+ PyDict_SetItemString(dict, "name", obj); -+ Py_DECREF(obj); -+ -+ if (qpol_policy_has_capability(q, QPOL_CAP_MLS)) { -+ if (qpol_user_get_dfltlevel(q, user_datum, &dflt_level)) -+ goto cleanup; -+ ap_lvl = apol_mls_level_create_from_qpol_mls_level(policydb, dflt_level); -+ tmp = apol_mls_level_render(policydb, ap_lvl); -+ if (!tmp) -+ goto cleanup; -+ obj = PyString_FromString(tmp); -+ PyDict_SetItemString(dict, "level", obj); -+ Py_DECREF(obj); -+ free(tmp); -+ /* print default range */ -+ if (qpol_user_get_range(q, user_datum, &range)) -+ goto cleanup; -+ ap_range = apol_mls_range_create_from_qpol_mls_range(policydb, range); -+ tmp = apol_mls_range_render(policydb, ap_range); -+ if (!tmp) -+ goto cleanup; -+ obj = PyString_FromString(tmp); -+ PyDict_SetItemString(dict, "range", obj); -+ Py_DECREF(obj); -+ free(tmp); -+ } -+ -+ if (qpol_user_get_role_iter(q, user_datum, &iter)) -+ goto cleanup; -+ PyObject *list = PyList_New(0); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&role_datum)) { -+ Py_DECREF(list); -+ goto cleanup; -+ } -+ if (qpol_role_get_name(q, role_datum, &role_name)) { -+ Py_DECREF(list); -+ goto cleanup; -+ } -+ PyObject *obj = PyString_FromString(role_name); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ PyDict_SetItemString(dict, "roles", list); -+ Py_DECREF(list); -+ -+cleanup: -+ qpol_iterator_destroy(&iter); -+ apol_mls_level_destroy(&ap_lvl); -+ apol_mls_range_destroy(&ap_range); -+ return dict; -+} -+ -+/** -+ * Gets statistics regarding a policy's users. -+ * If this function is given a name, it will attempt to -+ * get statistics about a particular user; otherwise -+ * the function gets statistics about all of the policy's -+ * users. -+ * -+ * @param name Reference to a user's name; if NULL, -+ * all users will be considered -+ * @param policydb Reference to a policy -+ * -+ * @return 0 on success, < 0 on error. -+ */ -+static PyObject* get_users(const char *name, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *list = PyList_New(0); -+ qpol_iterator_t *iter = NULL; -+ const qpol_user_t *user_datum = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ if (name != NULL) { -+ if (qpol_policy_get_user_by_name(q, name, &user_datum)) { -+ errno = EINVAL; -+ goto cleanup; -+ } -+ PyObject *obj = get_user(user_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } else { -+ if (qpol_policy_get_user_iter(q, &iter)) -+ goto cleanup; -+ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&user_datum)) -+ goto cleanup; -+ PyObject *obj = get_user(user_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ qpol_iterator_destroy(&iter); -+ } -+ -+ retval = 0; -+ cleanup: -+ qpol_iterator_destroy(&iter); -+ if (retval) { -+ Py_DECREF(list); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return list; -+} -+ -+/** -+ * get a textual representation of a role, and -+ * all of that role's types. -+ * -+ * @param type_datum Reference to sepol type_datum -+ * @param policydb Reference to a policy -+ * types -+ */ -+static PyObject* get_role(const qpol_role_t * role_datum, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *dict = PyDict_New(); -+ const char *role_name = NULL, *type_name = NULL; -+ const qpol_role_t *dom_datum = NULL; -+ const qpol_type_t *type_datum = NULL; -+ qpol_iterator_t *iter = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ size_t n_dom = 0, n_types = 0; -+ -+ if (qpol_role_get_name(q, role_datum, &role_name)) -+ goto cleanup; -+ -+ PyObject *obj = PyString_FromString(role_name); -+ PyDict_SetItemString(dict, "name", obj); -+ Py_DECREF(obj); -+ -+ if (qpol_role_get_dominate_iter(q, role_datum, &iter)) -+ goto cleanup; -+ if (qpol_iterator_get_size(iter, &n_dom)) -+ goto cleanup; -+ if ((int)n_dom > 0) { -+ PyObject *list = PyList_New(0); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&dom_datum)) -+ goto cleanup; -+ if (qpol_role_get_name(q, dom_datum, &role_name)) -+ goto cleanup; -+ PyObject *obj = PyString_FromString(role_name); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ PyDict_SetItemString(dict, "dominate", list); -+ Py_DECREF(list); -+ } -+ qpol_iterator_destroy(&iter); -+ -+ if (qpol_role_get_type_iter(q, role_datum, &iter)) -+ goto cleanup; -+ if (qpol_iterator_get_size(iter, &n_types)) -+ goto cleanup; -+ if ((int)n_types > 0) { -+ PyObject *list = PyList_New(0); -+ /* print types */ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&type_datum)) -+ goto cleanup; -+ if (qpol_type_get_name(q, type_datum, &type_name)) -+ goto cleanup; -+ PyObject *obj = PyString_FromString(type_name); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ PyDict_SetItemString(dict, "types", list); -+ Py_DECREF(list); -+ } -+ -+ retval = 0; -+cleanup: -+ qpol_iterator_destroy(&iter); -+ if (retval) { -+ Py_DECREF(dict); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return dict; -+} -+ -+/** -+ * Get statistics regarding a policy's ports. -+ * If this function is given a name, it will attempt to -+ * get statistics about a particular port; otherwise -+ * the function get statistics about all of the policy's ports. -+ * -+ * @param name Reference to an port's name; if NULL, -+ * all ports will be considered -+ * @param policydb Reference to a policy -+ * -+ * @return 0 on success, < 0 on error. -+ */ -+static PyObject* get_ports(const char *num, const apol_policy_t * policydb) -+{ -+ PyObject *list = PyList_New(0); -+ int retval = -1; -+ const qpol_portcon_t *portcon = NULL; -+ qpol_iterator_t *iter = NULL; -+ uint16_t low_port, high_port; -+ uint8_t ocon_proto; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ const qpol_context_t *ctxt = NULL; -+ const char *proto_str; -+ PyObject *dict; -+ const char *type = NULL; -+ const apol_mls_range_t *range = NULL; -+ char *range_str = NULL; -+ PyObject *obj = NULL; -+ apol_context_t *c = NULL; -+ -+ if (qpol_policy_get_portcon_iter(q, &iter)) -+ goto cleanup; -+ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&portcon)) -+ goto cleanup; -+ if (qpol_portcon_get_low_port(q, portcon, &low_port)) -+ goto cleanup; -+ if (qpol_portcon_get_high_port(q, portcon, &high_port)) -+ goto cleanup; -+ if (qpol_portcon_get_protocol(q, portcon, &ocon_proto)) -+ goto cleanup; -+ if (num) { -+ if (atoi(num) < low_port || atoi(num) > high_port) -+ continue; -+ } -+ -+ if ((ocon_proto != IPPROTO_TCP) && -+ (ocon_proto != IPPROTO_UDP)) -+ goto cleanup; -+ -+ if (qpol_portcon_get_context(q, portcon, &ctxt)) { -+ PyErr_SetString(PyExc_RuntimeError, "Could not get for port context."); -+ goto cleanup; -+ } -+ -+ if ((proto_str = apol_protocol_to_str(ocon_proto)) == NULL) { -+ PyErr_SetString(PyExc_RuntimeError, "Invalid protocol for port"); -+ goto cleanup; -+ } -+ -+ if ((c = apol_context_create_from_qpol_context(policydb, ctxt)) == NULL) { -+ goto cleanup; -+ } -+ -+ if((type = apol_context_get_type(c)) == NULL) { -+ apol_context_destroy(&c); -+ goto cleanup; -+ } -+ -+ dict = PyDict_New(); -+ obj = PyString_FromString(type); -+ PyDict_SetItemString(dict, "type", obj); -+ Py_DECREF(obj); -+ -+ if((range = apol_context_get_range(c)) == NULL) { -+ goto cleanup; -+ } -+ -+ range_str = apol_mls_range_render(policydb, range); -+ if (range_str == NULL) { -+ goto cleanup; -+ } -+ obj = PyString_FromString(range_str); -+ PyDict_SetItemString(dict, "range", obj); -+ Py_DECREF(obj); -+ -+ obj = PyString_FromString(proto_str); -+ PyDict_SetItemString(dict, "protocol", obj); -+ Py_DECREF(obj); -+ -+ obj = PyInt_FromLong(high_port); -+ PyDict_SetItemString(dict, "high", obj); -+ Py_DECREF(obj); -+ -+ obj = PyInt_FromLong(low_port); -+ PyDict_SetItemString(dict, "low", obj); -+ Py_DECREF(obj); -+ -+ PyList_Append(list, dict); -+ Py_DECREF(dict); -+ } -+ retval = 0; -+ cleanup: -+ free(range_str); -+ apol_context_destroy(&c); -+ qpol_iterator_destroy(&iter); -+ -+ if (retval) { -+ Py_DECREF(list); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return list; -+} -+ -+/** -+ * Get statistics regarding a policy's roles. -+ * If this function is given a name, it will attempt to -+ * get statistics about a particular role; otherwise -+ * the function get statistics about all of the policy's roles. -+ * -+ * @param name Reference to an role's name; if NULL, -+ * all roles will be considered -+ * @param policydb Reference to a policy -+ * -+ * @return 0 on success, < 0 on error. -+ */ -+static PyObject* get_roles(const char *name, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *list = PyList_New(0); -+ const qpol_role_t *role_datum = NULL; -+ qpol_iterator_t *iter = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ if (name != NULL) { -+ if (qpol_policy_get_role_by_name(q, name, &role_datum)) { -+ errno = EINVAL; -+ goto cleanup; -+ } -+ PyObject *obj = get_role(role_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } else { -+ if (qpol_policy_get_role_iter(q, &iter)) -+ goto cleanup; -+ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&role_datum)) -+ goto cleanup; -+ PyObject *obj = get_role(role_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ qpol_iterator_destroy(&iter); -+ } -+ -+ retval = 0; -+ cleanup: -+ qpol_iterator_destroy(&iter); -+ if (retval) { -+ Py_DECREF(list); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return list; -+} -+ -+/** -+ * Get statistics regarding a policy's types. -+ * If this function is given a name, it will attempt to -+ * print statistics about a particular type; otherwise -+ * the function prints statistics about all of the policy's types. -+ * -+ * @param name Reference to a type's name; if NULL, -+ * all object classes will be considered -+ * @param policydb Reference to a policy -+ * -+ * @return 0 on success, < 0 on error. -+ */ -+static PyObject* get_types(const char *name, const apol_policy_t * policydb) -+{ -+ int retval = -1; -+ PyObject *list = PyList_New(0); -+ const qpol_type_t *type_datum = NULL; -+ qpol_iterator_t *iter = NULL; -+ qpol_policy_t *q = apol_policy_get_qpol(policydb); -+ -+ /* if name was provided, only print that name */ -+ if (name != NULL) { -+ if (qpol_policy_get_type_by_name(q, name, &type_datum)) { -+ errno = EINVAL; -+ goto cleanup; -+ } -+ PyObject *obj = get_type(type_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } else { -+ if (qpol_policy_get_type_iter(q, &iter)) -+ goto cleanup; -+ /* Print all type names */ -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ if (qpol_iterator_get_item(iter, (void **)&type_datum)) -+ goto cleanup; -+ PyObject *obj = get_type(type_datum, policydb); -+ PyList_Append(list, obj); -+ Py_DECREF(obj); -+ } -+ } -+ retval = 0; -+cleanup: -+ qpol_iterator_destroy(&iter); -+ if (retval) { -+ Py_DECREF(list); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ return list; -+} -+ -+PyObject* seinfo(int type, const char *name) -+{ -+ int rt = -1; -+ -+ apol_policy_t *policydb = NULL; -+ apol_policy_path_t *pol_path = NULL; -+ apol_vector_t *mod_paths = NULL; -+ apol_policy_path_type_e path_type = APOL_POLICY_PATH_TYPE_MONOLITHIC; -+ PyObject* output = NULL; -+ -+ rt = qpol_default_policy_find(&policy_file); -+ if (rt != 0) { -+ PyErr_SetString(PyExc_RuntimeError,"No default policy found."); -+ return NULL; -+ } -+ -+ pol_path = apol_policy_path_create(path_type, policy_file, mod_paths); -+ if (!pol_path) { -+ free(policy_file); -+ apol_vector_destroy(&mod_paths); -+ PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); -+ return NULL; -+ } -+ apol_vector_destroy(&mod_paths); -+ -+ int policy_load_options = 0; -+ policy_load_options |= QPOL_POLICY_OPTION_MATCH_SYSTEM; -+ policydb = apol_policy_create_from_policy_path(pol_path, policy_load_options, NULL, NULL); -+ if (!policydb) { -+ free(policy_file); -+ apol_policy_path_destroy(&pol_path); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ free(policy_file); -+ -+ /* display requested info */ -+ if (type == TYPE) -+ output = get_types(name, policydb); -+ -+ if (type == ATTRIBUTE) -+ output = get_attribs(name, policydb); -+ -+ if (type == ROLE) -+ output = get_roles(name, policydb); -+ -+ if (type == USER) -+ output = get_users(name, policydb); -+ -+ if (type == PORT) -+ output = get_ports(name, policydb); -+ -+ apol_policy_destroy(&policydb); -+ apol_policy_path_destroy(&pol_path); -+ return output; -+} -+ -+PyObject *wrap_seinfo(PyObject *self, PyObject *args){ -+ unsigned int type; -+ char *name; -+ -+ if (!PyArg_ParseTuple(args, "iz", &type, &name)) -+ return NULL; -+ -+ return Py_BuildValue("O",seinfo(type, name)); -+ -+} -+ -+static PyMethodDef methods[] = { -+ {"seinfo", (PyCFunction) wrap_seinfo, METH_VARARGS}, -+ {NULL, NULL, 0, NULL} -+}; -+ -+void init_seinfo(){ -+ PyObject *m; -+ m = Py_InitModule("_seinfo", methods); -+ PyModule_AddIntConstant(m, "ATTRIBUTE", ATTRIBUTE); -+ PyModule_AddIntConstant(m, "PORT", PORT); -+ PyModule_AddIntConstant(m, "ROLE", ROLE); -+ PyModule_AddIntConstant(m, "TYPE", TYPE); -+ PyModule_AddIntConstant(m, "USER", USER); -+} -diff -up setools-3.3.7/python/setools/sesearch.c.python setools-3.3.7/python/setools/sesearch.c ---- setools-3.3.7/python/setools/sesearch.c.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/sesearch.c 2010-10-14 14:34:47.000000000 -0400 -@@ -0,0 +1,478 @@ -+// Author: Thomas Liu -+ -+/** -+ * @file -+ * Command line tool to search TE rules. -+ * -+ * @author Frank Mayer mayerf@tresys.com -+ * @author Jeremy A. Mowery jmowery@tresys.com -+ * @author Paul Rosenfeld prosenfeld@tresys.com -+ * @author Thomas Liu -+ * -+ * Copyright (C) 2003-2008 Tresys Technology, LLC -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program; if not, write to the Free Software -+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -+ */ -+ -+/** -+ * This is a modified version of sesearch to be used as part of a library for -+ * Python bindings. -+ */ -+ -+#include "Python.h" -+ -+/* libapol */ -+#include -+#include -+#include -+#include -+#include -+ -+/* libqpol*/ -+#include -+#include -+#include -+#include -+ -+/* other */ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#define COPYRIGHT_INFO "Copyright (C) 2003-2007 Tresys Technology, LLC" -+static char *policy_file = NULL; -+ -+enum opt_values -+{ -+ RULE_NEVERALLOW = 256, RULE_AUDIT, RULE_AUDITALLOW, RULE_DONTAUDIT, -+ RULE_ROLE_ALLOW, RULE_ROLE_TRANS, RULE_RANGE_TRANS, RULE_ALL, -+ EXPR_ROLE_SOURCE, EXPR_ROLE_TARGET -+}; -+ -+; -+ -+typedef struct options -+{ -+ char *src_name; -+ char *tgt_name; -+ char *src_role_name; -+ char *tgt_role_name; -+ char *class_name; -+ char *permlist; -+ char *bool_name; -+ apol_vector_t *class_vector; -+ bool all; -+ bool lineno; -+ bool semantic; -+ bool indirect; -+ bool allow; -+ bool nallow; -+ bool auditallow; -+ bool dontaudit; -+ bool type; -+ bool rtrans; -+ bool role_allow; -+ bool role_trans; -+ bool useregex; -+ bool show_cond; -+ apol_vector_t *perm_vector; -+} options_t; -+ -+static int perform_av_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v) -+{ -+ apol_avrule_query_t *avq = NULL; -+ unsigned int rules = 0; -+ int error = 0; -+ char *tmp = NULL, *tok = NULL, *s = NULL; -+ -+ if (!policy || !opt || !v) { -+ PyErr_SetString(PyExc_RuntimeError,strerror(EINVAL)); -+ errno = EINVAL; -+ return -1; -+ } -+ -+ if (!opt->all && !opt->allow && !opt->nallow && !opt->auditallow && !opt->dontaudit) { -+ *v = NULL; -+ return 0; /* no search to do */ -+ } -+ -+ avq = apol_avrule_query_create(); -+ if (!avq) { -+ PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); -+ errno = ENOMEM; -+ return -1; -+ } -+ -+ if (opt->allow || opt->all) -+ rules |= QPOL_RULE_ALLOW; -+ if ((opt->nallow || opt->all) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_NEVERALLOW)) -+ rules |= QPOL_RULE_NEVERALLOW; -+ if (opt->auditallow || opt->all) -+ rules |= QPOL_RULE_AUDITALLOW; -+ if (opt->dontaudit || opt->all) -+ rules |= QPOL_RULE_DONTAUDIT; -+ apol_avrule_query_set_rules(policy, avq, rules); -+ apol_avrule_query_set_regex(policy, avq, opt->useregex); -+ if (opt->src_name) -+ apol_avrule_query_set_source(policy, avq, opt->src_name, opt->indirect); -+ if (opt->tgt_name) -+ apol_avrule_query_set_target(policy, avq, opt->tgt_name, opt->indirect); -+ if (opt->bool_name) -+ apol_avrule_query_set_bool(policy, avq, opt->bool_name); -+ if (opt->class_name) { -+ if (opt->class_vector == NULL) { -+ if (apol_avrule_query_append_class(policy, avq, opt->class_name)) { -+ error = errno; -+ goto err; -+ } -+ } else { -+ size_t i; -+ for (i = 0; i < apol_vector_get_size(opt->class_vector); ++i) { -+ char *class_name; -+ class_name = apol_vector_get_element(opt->class_vector, i); -+ if (!class_name) -+ continue; -+ if (apol_avrule_query_append_class(policy, avq, class_name)) { -+ error = errno; -+ goto err; -+ } -+ } -+ } -+ } -+ -+ if (opt->permlist) { -+ tmp = strdup(opt->permlist); -+ for (tok = strtok(tmp, ","); tok; tok = strtok(NULL, ",")) { -+ if (apol_avrule_query_append_perm(policy, avq, tok)) { -+ error = errno; -+ goto err; -+ } -+ if ((s = strdup(tok)) == NULL || apol_vector_append(opt->perm_vector, s) < 0) { -+ error = errno; -+ goto err; -+ } -+ s = NULL; -+ } -+ free(tmp); -+ } -+ -+ if (!(opt->semantic) && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { -+ if (apol_syn_avrule_get_by_query(policy, avq, v)) { -+ error = errno; -+ goto err; -+ } -+ } else { -+ if (apol_avrule_get_by_query(policy, avq, v)) { -+ error = errno; -+ goto err; -+ } -+ } -+ -+ apol_avrule_query_destroy(&avq); -+ return 0; -+ -+ err: -+ apol_vector_destroy(v); -+ apol_avrule_query_destroy(&avq); -+ free(tmp); -+ free(s); -+ PyErr_SetString(PyExc_RuntimeError,strerror(error)); -+ errno = error; -+ return -1; -+} -+ -+ -+ -+static PyObject* get_av_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v) -+{ -+ int retval = -1; -+ PyObject *list = PyList_New(0); -+ qpol_policy_t *q = apol_policy_get_qpol(policy); -+ size_t i, num_rules = 0; -+ const qpol_avrule_t *rule = NULL; -+ char *tmp = NULL, *rule_str = NULL, *expr = NULL; -+ char enable_char = ' ', branch_char = ' '; -+ qpol_iterator_t *iter = NULL; -+ uint32_t enabled = 0; -+ -+ if (!policy || !v) -+ return NULL; -+ -+ if (!(num_rules = apol_vector_get_size(v))) -+ return NULL; -+ -+ for (i = 0; i < num_rules; i++) { -+ enable_char = branch_char = ' '; -+ if (!(rule = apol_vector_get_element(v, i))) -+ goto cleanup; -+ -+ if (qpol_avrule_get_is_enabled(q, rule, &enabled)) -+ goto cleanup; -+ if (!enabled) -+ continue; -+ -+ const qpol_type_t *type; -+ const char *tmp_name; -+ uint32_t rule_type = 0; -+ -+ const qpol_class_t *obj_class = NULL; -+ -+ PyObject *dict = PyDict_New(); -+ -+ qpol_avrule_get_rule_type(q, rule, &rule_type); -+ tmp_name = apol_rule_type_to_str(rule_type); -+ PyObject *obj = PyString_FromString(tmp_name); -+ PyDict_SetItemString(dict, "type", obj); -+ Py_DECREF(obj); -+ // source -+ qpol_avrule_get_source_type(q, rule, &type); -+ qpol_type_get_name(q, type, &tmp_name); -+ obj = PyString_FromString(tmp_name); -+ PyDict_SetItemString(dict, "scontext", obj); -+ Py_DECREF(obj); -+ -+ qpol_avrule_get_target_type(q, rule, &type); -+ qpol_type_get_name(q, type, &tmp_name); -+ obj = PyString_FromString(tmp_name); -+ PyDict_SetItemString(dict, "tcontext", obj); -+ Py_DECREF(obj); -+ -+ qpol_avrule_get_object_class(q, rule, &obj_class); -+ qpol_type_get_name(q, type, &tmp_name); -+ obj = PyString_FromString(tmp_name); -+ PyDict_SetItemString(dict, "class", obj); -+ Py_DECREF(obj); -+ qpol_avrule_get_perm_iter(q, rule, &iter); -+ PyObject *permlist = PyList_New(0); -+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { -+ const char *perm_name = NULL; -+ qpol_iterator_get_item(iter, (void **)&perm_name); -+ obj = PyString_FromString(perm_name); -+ PyList_Append(permlist, obj); -+ Py_DECREF(obj); -+ } -+ PyDict_SetItemString(dict, "permlist", permlist); -+ Py_DECREF(permlist); -+ PyList_Append(list, dict); -+ Py_DECREF(dict); -+ -+ free(rule_str); -+ rule_str = NULL; -+ free(expr); -+ expr = NULL; -+ } -+ retval = 0; -+ cleanup: -+ free(tmp); -+ free(rule_str); -+ free(expr); -+ if (retval) { -+ Py_DECREF(list); -+ return NULL; -+ } -+ return list; -+} -+ -+ -+PyObject* sesearch(bool allow, -+ bool neverallow, -+ bool auditallow, -+ bool dontaudit, -+ const char *src_name, -+ const char *tgt_name, -+ const char *class_name, -+ const char *permlist -+ ) -+{ -+ options_t cmd_opts; -+ int rt = -1; -+ PyObject *output = NULL; -+ -+ apol_policy_t *policy = NULL; -+ apol_vector_t *v = NULL; -+ apol_policy_path_t *pol_path = NULL; -+ apol_vector_t *mod_paths = NULL; -+ apol_policy_path_type_e path_type = APOL_POLICY_PATH_TYPE_MONOLITHIC; -+ -+ memset(&cmd_opts, 0, sizeof(cmd_opts)); -+ cmd_opts.indirect = true; -+ cmd_opts.allow = allow; -+ cmd_opts.nallow = neverallow; -+ cmd_opts.auditallow = auditallow; -+ cmd_opts.dontaudit = dontaudit; -+ if (src_name) -+ cmd_opts.src_name = strdup(src_name); -+ if (tgt_name) -+ cmd_opts.tgt_name = strdup(tgt_name); -+ if (class_name) -+ cmd_opts.class_name = strdup(class_name); -+ if (permlist){ -+ cmd_opts.perm_vector = apol_vector_create(free); -+ cmd_opts.permlist = strdup(permlist); -+ } -+ int pol_opt = 0; -+ if (!(cmd_opts.nallow || cmd_opts.all)) -+ pol_opt |= QPOL_POLICY_OPTION_NO_NEVERALLOWS; -+ -+ -+ rt = qpol_default_policy_find(&policy_file); -+ if (rt) { -+ PyErr_SetString(PyExc_RuntimeError,"No default policy found."); -+ return NULL; -+ } -+ pol_opt |= QPOL_POLICY_OPTION_MATCH_SYSTEM; -+ -+ if (apol_file_is_policy_path_list(policy_file) > 0) { -+ pol_path = apol_policy_path_create_from_file(policy_file); -+ if (!pol_path) { -+ free(policy_file); -+ PyErr_SetString(PyExc_RuntimeError,"invalid policy list"); -+ return NULL; -+ } -+ } -+ -+ if (!pol_path) -+ pol_path = apol_policy_path_create(path_type, policy_file, mod_paths); -+ if (!pol_path) { -+ free(policy_file); -+ PyErr_SetString(PyExc_RuntimeError,strerror(ENOMEM)); -+ return NULL; -+ } -+ free(policy_file); -+ apol_vector_destroy(&mod_paths); -+ -+ policy = apol_policy_create_from_policy_path(pol_path, pol_opt, NULL, NULL); -+ if (!policy) { -+ apol_policy_path_destroy(&pol_path); -+ PyErr_SetString(PyExc_RuntimeError,strerror(errno)); -+ return NULL; -+ } -+ /* handle regex for class name */ -+ if (cmd_opts.useregex && cmd_opts.class_name != NULL) { -+ cmd_opts.class_vector = apol_vector_create(NULL); -+ apol_vector_t *qpol_matching_classes = NULL; -+ apol_class_query_t *regex_match_query = apol_class_query_create(); -+ apol_class_query_set_regex(policy, regex_match_query, 1); -+ apol_class_query_set_class(policy, regex_match_query, cmd_opts.class_name); -+ if (apol_class_get_by_query(policy, regex_match_query, &qpol_matching_classes)) { -+ apol_class_query_destroy(®ex_match_query); -+ PyErr_SetString(PyExc_RuntimeError,"Query failed"); -+ goto cleanup; -+ } -+ const qpol_class_t *class = NULL; -+ size_t i; -+ for (i = 0; i < apol_vector_get_size(qpol_matching_classes); ++i) { -+ const char *class_name; -+ class = apol_vector_get_element(qpol_matching_classes, i); -+ if (!class) -+ break; -+ qpol_class_get_name(apol_policy_get_qpol(policy), class, &class_name); -+ apol_vector_append(cmd_opts.class_vector, (void *)class_name); -+ } -+ if (!apol_vector_get_size(qpol_matching_classes)) { -+ apol_vector_destroy(&qpol_matching_classes); -+ apol_class_query_destroy(®ex_match_query); -+ PyErr_SetString(PyExc_RuntimeError,"No classes match expression"); -+ goto cleanup; -+ } -+ apol_vector_destroy(&qpol_matching_classes); -+ apol_class_query_destroy(®ex_match_query); -+ } -+ -+ if (!cmd_opts.semantic && qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { -+ if (qpol_policy_build_syn_rule_table(apol_policy_get_qpol(policy))) { -+ apol_policy_destroy(&policy); -+ PyErr_SetString(PyExc_RuntimeError,"Query failed"); -+ goto cleanup; -+ } -+ } -+ -+ /* if syntactic rules are not available always do semantic search */ -+ if (!qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_SYN_RULES)) { -+ cmd_opts.semantic = 1; -+ } -+ -+ /* supress line numbers if doing semantic search or not available */ -+ if (cmd_opts.semantic || !qpol_policy_has_capability(apol_policy_get_qpol(policy), QPOL_CAP_LINE_NUMBERS)) { -+ cmd_opts.lineno = 0; -+ } -+ if (perform_av_query(policy, &cmd_opts, &v)) { -+ goto cleanup; -+ } -+ if (v) { -+ output = get_av_results(policy, &cmd_opts, v); -+ } -+ apol_vector_destroy(&v); -+ cleanup: -+ apol_policy_destroy(&policy); -+ apol_policy_path_destroy(&pol_path); -+ free(cmd_opts.src_name); -+ free(cmd_opts.tgt_name); -+ free(cmd_opts.class_name); -+ free(cmd_opts.permlist); -+ free(cmd_opts.bool_name); -+ free(cmd_opts.src_role_name); -+ free(cmd_opts.tgt_role_name); -+ apol_vector_destroy(&cmd_opts.perm_vector); -+ apol_vector_destroy(&cmd_opts.class_vector); -+ -+ if (output) return output; -+ return Py_None; -+} -+static int Dict_ContainsInt(PyObject *dict, const char *key){ -+ PyObject *item = PyDict_GetItemString(dict, key); -+ if (item) -+ return PyInt_AsLong(item); -+ return false; -+} -+ -+static const char *Dict_ContainsString(PyObject *dict, const char *key){ -+ PyObject *item = PyDict_GetItemString(dict, key); -+ if (item) -+ return PyString_AsString(item); -+ return NULL; -+} -+ -+PyObject *wrap_sesearch(PyObject *self, PyObject *args){ -+ PyObject *dict; -+ if (!PyArg_ParseTuple(args, "O", &dict)) -+ return NULL; -+ int allow = Dict_ContainsInt(dict, "allow"); -+ int neverallow = Dict_ContainsInt(dict, "neverallow"); -+ int auditallow = Dict_ContainsInt(dict, "auditallow"); -+ int dontaudit = Dict_ContainsInt(dict, "dontaudit"); -+ -+ const char *src_name = Dict_ContainsString(dict, "scontext"); -+ const char *tgt_name = Dict_ContainsString(dict, "tcontext"); -+ const char *class_name = Dict_ContainsString(dict, "class"); -+ const char *permlist = Dict_ContainsString(dict, "permlist"); -+ -+ return Py_BuildValue("O",sesearch(allow, neverallow, auditallow, dontaudit, src_name, tgt_name, class_name, permlist)); -+ -+} -+ -+static PyMethodDef methods[] = { -+ {"sesearch", (PyCFunction) wrap_sesearch, METH_VARARGS}, -+ {NULL, NULL, 0, NULL} -+}; -+ -+void init_sesearch(){ -+ PyObject *m; -+ m = Py_InitModule("_sesearch", methods); -+} -diff -up setools-3.3.7/python/setools/setup.py.python setools-3.3.7/python/setools/setup.py ---- setools-3.3.7/python/setools/setup.py.python 2010-07-30 15:02:10.000000000 -0400 -+++ setools-3.3.7/python/setools/setup.py 2010-07-30 15:02:10.000000000 -0400 -@@ -0,0 +1,25 @@ -+#!/usr/bin/env python -+ -+# Author: Thomas Liu -+import os -+from distutils.core import setup, Extension -+LIBS=["apol", "qpol"] -+ -+try: -+ inc=os.getenv("INCLUDES").split(" ") -+ INCLUDES=map(lambda x: x[2:], inc) -+ LIBDIRS=map(lambda x: "/".join(x.split("/")[:-1]), os.getenv("LIBS").split()) -+except: -+ INCLUDES="" -+ LIBDIRS="" -+ -+extension_sesearch = Extension("setools._sesearch", [ "sesearch.c"]) -+extension_sesearch.include_dirs=INCLUDES -+extension_sesearch.libraries=LIBS -+extension_sesearch.library_dirs=LIBDIRS -+extension_seinfo = Extension("setools._seinfo", [ "seinfo.c"]) -+extension_seinfo.include_dirs=INCLUDES -+extension_seinfo.libraries=LIBS -+extension_seinfo.library_dirs=LIBDIRS -+ -+setup(name = "setools", version="1.0", description="Python setools bindings", author="Thomas Liu", author_email="tliu@redhat.com", ext_modules=[extension_sesearch, extension_seinfo], packages=["setools"]) From 12efca860a2cc65e5f5e08859d9b8cfd69a959f5 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 10:51:31 +0100 Subject: [PATCH 013/111] setools.spec files cleanup - drop %{with python3} - build python3 sources in setools-x.y.z and python2 in setools-x.y.z-python2 - clean %{buildroot}%{_bindir} before installing python3 sources --- setools.spec | 67 +++++++++++++--------------------------------------- 1 file changed, 16 insertions(+), 51 deletions(-) diff --git a/setools.spec b/setools.spec index 08904c9..be92185 100644 --- a/setools.spec +++ b/setools.spec @@ -3,12 +3,6 @@ %{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} %{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} -%if 0%{?fedora} -%bcond_without python3 -%else -%bcond_with python3 -%endif - # % global setools_pre_ver beta.1.8e09d95 # % global gitver f1e5b20 @@ -36,23 +30,19 @@ BuildRequires: python-devel # BuildArch: BuildRequires: python-devel -%if %{with python3} Requires: %{name}-python3 = %{version}-%{release} BuildRequires: python3-devel -%else -Requires: %{name}-python = %{version}-%{release} -%endif # with python3 %description SETools is a collection of graphical tools, command-line tools, and Python modules designed to facilitate SELinux policy analysis. -%package console -Summary: Policy analysis command-line tools for SELinux -Group: System Environment/Base -License: GPLv2 -Requires: setools-python3 = %{version}-%{release} -Requires: libselinux >= %{selinux_ver} +%package console +Summary: Policy analysis command-line tools for SELinux +Group: System Environment/Base +License: GPLv2 +Requires: setools-python3 = %{version}-%{release} +Requires: libselinux >= %{selinux_ver} %description console SETools is a collection of graphical tools, command-line tools, and @@ -75,7 +65,6 @@ Requires: python-networkx SETools is a collection of graphical tools, command-line tools, and Python 2 modules designed to facilitate SELinux policy analysis. -%if %{with python3} %package python3 Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0, setools-libs-tcl @@ -85,7 +74,6 @@ Requires: python3-networkx SETools is a collection of graphical tools, command-line tools, and Python 3 modules designed to facilitate SELinux policy analysis. -%endif # with python3 %package gui Summary: Policy analysis graphical tools for SELinux @@ -100,57 +88,36 @@ Python modules designed to facilitate SELinux policy analysis. %setup sed -i "s%'-Werror', '-Wextra'%'-Wextra'%" setup.py -# mv setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} python2 - -%if %{with python3} -cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 -%endif # with python4 +cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 %build -# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} -# Remove CFLAGS=... for noarch packages (unneeded) -CFLAGS="%{optflags}" %{__python2} setup.py build -# popd - -%if %{with python3} -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 # Remove CFLAGS=... for noarch packages (unneeded) CFLAGS="%{optflags}" %{__python3} setup.py build + +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 +# Remove CFLAGS=... for noarch packages (unneeded) +CFLAGS="%{optflags}" %{__python2} setup.py build popd -%endif # with python3 %install rm -rf %{buildroot} -# REMOVEME this comment -# Must do the python3 install first because the scripts in /usr/bin are -# overwritten with every setup.py install (and we want the python2 version -# to be the default for now). - -# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 %{__python2} setup.py install --root %{buildroot} -# popd - -%if %{with python3} -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 -%{__python3} setup.py install --root %{buildroot} popd -%endif # with python3 +rm -rf %{buildroot}%{_bindir} +%{__python3} setup.py install --root %{buildroot} %check %if %{?_with_check:1}%{!?_with_check:0} -# pushd setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} -%{__python2} setup.py test -# popd +%{__python3} setup.py test -%if %{with python3} -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python3 +pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 %{__python2} setup.py test popd %endif -%endif %files @@ -172,7 +139,6 @@ popd # For arch-specific packages: sitearch %{python2_sitearch}/* -%if %{with python3} %files python3 %license COPYING COPYING.GPL COPYING.LGPL # %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README @@ -180,7 +146,6 @@ popd # %{python3_sitelib}/* # For arch-specific packages: sitearch %{python3_sitearch}/* -%endif # with python3 %files gui %{_bindir}/apol From 442c972d4b2713459ba66bccf3c25b63758d3ca2 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 10:54:52 +0100 Subject: [PATCH 014/111] Use %autosetup -S git --- setools.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index be92185..74fdceb 100644 --- a/setools.spec +++ b/setools.spec @@ -22,7 +22,7 @@ Source2: apol.desktop Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison -BuildRequires: glibc-devel gcc +BuildRequires: glibc-devel, gcc, git BuildRequires: libsepol-devel, libsepol-static BuildRequires: qt5-qtbase-devel BuildRequires: swig @@ -85,7 +85,7 @@ Python modules designed to facilitate SELinux policy analysis. %prep -%setup +%autosetup -p 1 -S git sed -i "s%'-Werror', '-Wextra'%'-Wextra'%" setup.py cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 From fdd5e434b3bebf331e645547f0ee969377a82548 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 10:56:01 +0100 Subject: [PATCH 015/111] Do not use -Werror during build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There are new warnings when setools are built with gcc 7 therefore we want to suppress -Werror for now Fixes: libqpol/policy_extend.c: In function ‘policy_extend’: libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=] snprintf(buff, 9, "@ttr%04zd", i + 1); ^~~~~ libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295] snprintf(buff, 9, "@ttr%04zd", i + 1); ^~~~~~~~~~~ In file included from /usr/include/stdio.h:939:0, from /usr/include/sepol/policydb/policydb.h:53, from libqpol/policy_extend.c:29: /usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9 return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ __bos (__s), __fmt, __va_arg_pack ()); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors error: command 'gcc' failed with exit status 1 --- 0001-Do-not-use-Werror-during-build.patch | 49 +++++++++++++++++++++++ setools.spec | 2 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 0001-Do-not-use-Werror-during-build.patch diff --git a/0001-Do-not-use-Werror-during-build.patch b/0001-Do-not-use-Werror-during-build.patch new file mode 100644 index 0000000..d24af2b --- /dev/null +++ b/0001-Do-not-use-Werror-during-build.patch @@ -0,0 +1,49 @@ +From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 23 Feb 2017 08:17:07 +0100 +Subject: [PATCH 1/2] Do not use -Werror during build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +There are new warnings when setools are built with gcc 7 therefore we +want to suppress -Werror for now + +Fixes: +libqpol/policy_extend.c: In function ‘policy_extend’: +libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=] + snprintf(buff, 9, "@ttr%04zd", i + 1); + ^~~~~ +libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295] + snprintf(buff, 9, "@ttr%04zd", i + 1); + ^~~~~~~~~~~ +In file included from /usr/include/stdio.h:939:0, + from /usr/include/sepol/policydb/policydb.h:53, + from libqpol/policy_extend.c:29: +/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9 + return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + __bos (__s), __fmt, __va_arg_pack ()); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +error: command 'gcc' failed with exit status 1 +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index 4e7645c..f697ed7 100644 +--- a/setup.py ++++ b/setup.py +@@ -145,7 +145,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', + 'libqpol/policy_scan.c', + 'libqpol/xen_query.c'], + include_dirs=include_dirs, +- extra_compile_args=['-Werror', '-Wextra', ++ extra_compile_args=['-Wextra', + '-Waggregate-return', + '-Wcast-align', + '-Wfloat-equal', +-- +2.9.3 + diff --git a/setools.spec b/setools.spec index 74fdceb..a0f79ed 100644 --- a/setools.spec +++ b/setools.spec @@ -19,6 +19,7 @@ URL: https://github.com/TresysTechnology/setools/wiki Source0: https://github.com/TresysTechnology/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch1: 0001-Do-not-use-Werror-during-build.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -86,7 +87,6 @@ Python modules designed to facilitate SELinux policy analysis. %prep %autosetup -p 1 -S git -sed -i "s%'-Werror', '-Wextra'%'-Wextra'%" setup.py cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 From d570700ddd405fc033933d59d9589a27b9949f33 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 11:03:03 +0100 Subject: [PATCH 016/111] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. These dependencies are not necessary for setools module itself as it's used in policycoreutils. Therefore it's better to use setools.infoflow.InfoFlowAnalysis and setools.dta.DomainTransitionAnalysis and let the package containing sedta and seinfoflow to require python3-networkx Added new subpackage setools-console-analyses --- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 140 ++++++++++++++++++ setools.spec | 37 ++++- 2 files changed, 170 insertions(+), 7 deletions(-) create mode 100644 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch diff --git a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch new file mode 100644 index 0000000..a5d982a --- /dev/null +++ b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -0,0 +1,140 @@ +From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 23 Feb 2017 08:17:07 +0100 +Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and + setools.DomainTransitionAnalysis + +dta and infoflow modules require networkx which brings lot of dependencies. +These dependencies are not necessary for setools module itself as it's +used in policycoreutils. + +Therefore it's better to use setools.infoflow.InfoFlowAnalysis and +setools.dta.DomainTransitionAnalysis and let the package containing +sedta and seinfoflow to require python3-networkx +--- + sedta | 3 ++- + seinfoflow | 3 ++- + setools/__init__.py | 4 ++-- + setoolsgui/apol/dta.py | 2 +- + setoolsgui/apol/infoflow.py | 2 +- + tests/dta.py | 3 ++- + tests/infoflow.py | 3 ++- + 7 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/sedta b/sedta +index 1c76ebb..255ad49 100755 +--- a/sedta ++++ b/sedta +@@ -23,6 +23,7 @@ import argparse + import logging + + import setools ++import setools.dta + + + def print_transition(trans): +@@ -111,7 +112,7 @@ else: + + try: + p = setools.SELinuxPolicy(args.policy) +- g = setools.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude) ++ g = setools.dta.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude) + + if args.shortest_path or args.all_paths: + if args.shortest_path: +diff --git a/seinfoflow b/seinfoflow +index b287921..d53bdef 100755 +--- a/seinfoflow ++++ b/seinfoflow +@@ -19,6 +19,7 @@ + + from __future__ import print_function + import setools ++import setools.infoflow + import argparse + import sys + import logging +@@ -79,7 +80,7 @@ else: + try: + p = setools.SELinuxPolicy(args.policy) + m = setools.PermissionMap(args.map) +- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) ++ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) + + if args.shortest_path or args.all_paths: + if args.shortest_path: +diff --git a/setools/__init__.py b/setools/__init__.py +index a84c846..a53c5a7 100644 +--- a/setools/__init__.py ++++ b/setools/__init__.py +@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery + from .devicetreeconquery import DevicetreeconQuery + + # Information Flow Analysis +-from .infoflow import InfoFlowAnalysis ++# from .infoflow import InfoFlowAnalysis + from .permmap import PermissionMap + + # Domain Transition Analysis +-from .dta import DomainTransitionAnalysis ++# from .dta import DomainTransitionAnalysis + + # Policy difference + from .diff import PolicyDifference +diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py +index 0aaf13f..5b1ea20 100644 +--- a/setoolsgui/apol/dta.py ++++ b/setoolsgui/apol/dta.py +@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread + from PyQt5.QtGui import QPalette, QTextCursor + from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ + QTreeWidgetItem +-from setools import DomainTransitionAnalysis ++from setools.dta import DomainTransitionAnalysis + + from ..logtosignal import LogHandlerToSignal + from .analysistab import AnalysisTab +diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py +index 1ae16de..fdf8f7b 100644 +--- a/setoolsgui/apol/infoflow.py ++++ b/setoolsgui/apol/infoflow.py +@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread + from PyQt5.QtGui import QPalette, QTextCursor + from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ + QTreeWidgetItem +-from setools import InfoFlowAnalysis ++from setools.infoflow import InfoFlowAnalysis + from setools.exception import UnmappedClass, UnmappedPermission + + from ..logtosignal import LogHandlerToSignal +diff --git a/tests/dta.py b/tests/dta.py +index 32b9271..2bdd052 100644 +--- a/tests/dta.py ++++ b/tests/dta.py +@@ -17,7 +17,8 @@ + # + import unittest + +-from setools import SELinuxPolicy, DomainTransitionAnalysis ++from setools import SELinuxPolicy ++from setools.dta import DomainTransitionAnalysis + from setools import TERuletype as TERT + from setools.policyrep.exception import InvalidType + from setools.policyrep.typeattr import Type +diff --git a/tests/infoflow.py b/tests/infoflow.py +index 7751dda..a21c683 100644 +--- a/tests/infoflow.py ++++ b/tests/infoflow.py +@@ -17,7 +17,8 @@ + # + import unittest + +-from setools import SELinuxPolicy, InfoFlowAnalysis ++from setools import SELinuxPolicy ++from setools.infoflow import InfoFlowAnalysis + from setools import TERuletype as TERT + from setools.permmap import PermissionMap + from setools.policyrep.exception import InvalidType +-- +2.9.3 + diff --git a/setools.spec b/setools.spec index a0f79ed..9c0c41e 100644 --- a/setools.spec +++ b/setools.spec @@ -20,6 +20,7 @@ Source0: https://github.com/TresysTechnology/setools/archive/%{version}%{ Source1: setools.pam Source2: apol.desktop Patch1: 0001-Do-not-use-Werror-during-build.patch +Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -52,15 +53,30 @@ libraries designed to facilitate SELinux policy analysis. This package includes the following console tools: sediff Compare two policies to find differences. - sedta Perform domain transition analyses. seinfo List policy components. - seinfoflow Perform information flow analyses. sesearch Search rules (allow, type_transition, etc.) +%package console-analyses +Summary: Policy analysis command-line tools for SELinux +Group: System Environment/Base +License: GPLv2 +Requires: setools-python3 = %{version}-%{release} +Requires: libselinux >= %{selinux_ver} +Requires: python3-networkx + +%description console-analyses +SETools is a collection of graphical tools, command-line tools, and +libraries designed to facilitate SELinux policy analysis. + +This package includes the following console tools: + + sedta Perform domain transition analyses. + seinfoflow Perform information flow analyses. + + %package python Summary: Policy analysis tools for SELinux -Requires: python-networkx %description python SETools is a collection of graphical tools, command-line tools, and @@ -69,7 +85,6 @@ Python 2 modules designed to facilitate SELinux policy analysis. %package python3 Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0, setools-libs-tcl -Requires: python3-networkx %description python3 SETools is a collection of graphical tools, command-line tools, and @@ -79,6 +94,7 @@ Python 3 modules designed to facilitate SELinux policy analysis. %package gui Summary: Policy analysis graphical tools for SELinux Requires: python3-qt5 +Requires: python3-networkx %description gui SETools is a collection of graphical tools, command-line tools, and @@ -125,11 +141,17 @@ popd %files console %{_bindir}/sediff -%{_bindir}/sedta %{_bindir}/seinfo -%{_bindir}/seinfoflow %{_bindir}/sesearch -%{_mandir}/man1/* +%{_mandir}/man1/sediff* +%{_mandir}/man1/seinfo* +%{_mandir}/man1/sesearch* + +%files console-analyses +%{_bindir}/sedta +%{_bindir}/seinfoflow +%{_mandir}/man1/sedta* +%{_mandir}/man1/seinfoflow* %files python # %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README @@ -149,6 +171,7 @@ popd %files gui %{_bindir}/apol +%{_mandir}/man1/apol* %changelog * Wed Feb 15 2017 Petr Lautrbach - 4.1.0-1 From 526a5264e3cf587da00abe1afa2949a37ae406db Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 12:43:31 +0100 Subject: [PATCH 017/111] setools-4.1.0-2 - Move dependency on networkx to -gui and -console-analyses - Ship sedta and seinfoflow in setools-console-analyses --- setools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 9c0c41e..c467dcf 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.0 -Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -174,5 +174,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Feb 23 2017 Petr Lautrbach - 4.1.0-2 +- Move python networkx dependency to -gui and -console-analyses +- Ship sedta and seinfoflow in setools-console-analyses + * Wed Feb 15 2017 Petr Lautrbach - 4.1.0-1 - New upstream release. From e23675302599b5cf036c5ff8ce18fabc825bbfd1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Feb 2017 13:18:02 +0100 Subject: [PATCH 018/111] Require libsepol version at least 2.6 for build --- setools.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index c467dcf..8f4ce26 100644 --- a/setools.spec +++ b/setools.spec @@ -25,7 +25,7 @@ Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git -BuildRequires: libsepol-devel, libsepol-static +BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: qt5-qtbase-devel BuildRequires: swig BuildRequires: python-devel From 7bfe6fa0af3398656809485b3f55bd646002fabd Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 22 May 2017 08:58:21 +0200 Subject: [PATCH 019/111] setools-python{,3} packages should have a weak dependency on libselinux-python{,3} Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1447747 For more information about weak dependencies see https://fedoraproject.org/wiki/Packaging:WeakDependencies --- setools.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 8f4ce26..abc3d75 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.0 -Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -77,6 +77,7 @@ This package includes the following console tools: %package python Summary: Policy analysis tools for SELinux +Recommends: libselinux-python %description python SETools is a collection of graphical tools, command-line tools, and @@ -85,6 +86,7 @@ Python 2 modules designed to facilitate SELinux policy analysis. %package python3 Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0, setools-libs-tcl +Recommends: libselinux-python3 %description python3 SETools is a collection of graphical tools, command-line tools, and @@ -174,6 +176,10 @@ popd %{_mandir}/man1/apol* %changelog +* Mon May 22 2017 Petr Lautrbach - 4.1.0-3} +- setools-python{,3} packages should have a weak dependency on libselinux-python{,3} + (#1447747) + * Thu Feb 23 2017 Petr Lautrbach - 4.1.0-2 - Move python networkx dependency to -gui and -console-analyses - Ship sedta and seinfoflow in setools-console-analyses From ccf0ebfefc0df134cbef59998037477264863b43 Mon Sep 17 00:00:00 2001 From: Tomas Tomecek Date: Tue, 30 May 2017 11:49:45 +0200 Subject: [PATCH 020/111] add explicit BR on py{2,3} setuptools Signed-off-by: Tomas Tomecek --- setools.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index abc3d75..becf19e 100644 --- a/setools.spec +++ b/setools.spec @@ -28,12 +28,13 @@ BuildRequires: glibc-devel, gcc, git BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: qt5-qtbase-devel BuildRequires: swig -BuildRequires: python-devel +BuildRequires: python2-devel +BuildRequires: python2-setuptools +BuildRequires: python3-devel +BuildRequires: python3-setuptools # BuildArch: -BuildRequires: python-devel Requires: %{name}-python3 = %{version}-%{release} -BuildRequires: python3-devel %description SETools is a collection of graphical tools, command-line tools, and From 869ecbd188f2381acdd378a59d69235b89078a60 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 18:28:12 +0000 Subject: [PATCH 021/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index becf19e..979d83b 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.0 -Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -177,6 +177,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 4.1.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Mon May 22 2017 Petr Lautrbach - 4.1.0-3} - setools-python{,3} packages should have a weak dependency on libselinux-python{,3} (#1447747) From 4006d5c5b4c77712781a4169ac3b0c6d2a46c1f9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 3 Aug 2017 08:21:21 +0000 Subject: [PATCH 022/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 979d83b..c66c5ec 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.0 -Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -177,6 +177,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Aug 03 2017 Fedora Release Engineering - 4.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Thu Jul 27 2017 Fedora Release Engineering - 4.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From 13a8a837328199ac1722cb13251236d7d2a848e3 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 7 Aug 2017 18:11:14 +0200 Subject: [PATCH 023/111] setools-4.1.1-1 --- .gitignore | 1 + 0001-Do-not-use-Werror-during-build.patch | 6 +++--- setools.spec | 13 ++++++++----- sources | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index f811d80..255e868 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ setools-3.3.7.tar.bz2 setools-3.3.8.tar.bz2 setools-3.3.8-f1e5b20.tar.bz2 /4.1.0.tar.gz +/4.1.1.tar.gz diff --git a/0001-Do-not-use-Werror-during-build.patch b/0001-Do-not-use-Werror-during-build.patch index d24af2b..ff4523c 100644 --- a/0001-Do-not-use-Werror-during-build.patch +++ b/0001-Do-not-use-Werror-during-build.patch @@ -32,18 +32,18 @@ error: command 'gcc' failed with exit status 1 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 4e7645c..f697ed7 100644 +index 2ca44c9..9319bf6 100644 --- a/setup.py +++ b/setup.py -@@ -145,7 +145,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', +@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', 'libqpol/policy_scan.c', 'libqpol/xen_query.c'], include_dirs=include_dirs, - extra_compile_args=['-Werror', '-Wextra', + extra_compile_args=['-Wextra', '-Waggregate-return', - '-Wcast-align', '-Wfloat-equal', + '-Wformat', '-Wformat=2', -- 2.9.3 diff --git a/setools.spec b/setools.spec index c66c5ec..7bab4ad 100644 --- a/setools.spec +++ b/setools.spec @@ -6,12 +6,12 @@ # % global setools_pre_ver beta.1.8e09d95 # % global gitver f1e5b20 -%global sepol_ver 2.6-0 -%global selinux_ver 2.6-0 +%global sepol_ver 2.7-1 +%global selinux_ver 2.7-1 Name: setools -Version: 4.1.0 -Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.1.1 +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -177,13 +177,16 @@ popd %{_mandir}/man1/apol* %changelog +* Mon Aug 07 2017 Petr Lautrbach - 4.1.1-1 +- New upstream release + * Thu Aug 03 2017 Fedora Release Engineering - 4.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Thu Jul 27 2017 Fedora Release Engineering - 4.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild -* Mon May 22 2017 Petr Lautrbach - 4.1.0-3} +* Mon May 22 2017 Petr Lautrbach - 4.1.0-3 - setools-python{,3} packages should have a weak dependency on libselinux-python{,3} (#1447747) diff --git a/sources b/sources index ac0490d..7fde505 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.1.0.tar.gz) = 047f969a347c5d015885aef0c7a341ae4393c8e0d61a7112b7bd0380d7c6161765f1ac5d875777ac84430bbe4d21bcb8a748f1b8484ae3a4d3f0137e90a07f2b +SHA512 (4.1.1.tar.gz) = 2e55a3b07e2f94d7c84054f31d266567b9acc708fe2b0e16ac3ea24e8301c712bcf564ff915a6135a1a6ba6822682bb3a6530dae20161a832fb7048364acbd04 From 5739cf73a2bcc37728d6b59f9cd6380a9762ea47 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 10 Aug 2017 08:59:30 +0200 Subject: [PATCH 024/111] setools-4.1.1-2 - bswap_* macros are defined in byteswap.h Fixes ImportError on s390x: /usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32 --- ...ap_-macros-are-defined-in-byteswap.h.patch | 26 +++++++++++++++++++ setools.spec | 6 ++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 0003-bswap_-macros-are-defined-in-byteswap.h.patch diff --git a/0003-bswap_-macros-are-defined-in-byteswap.h.patch b/0003-bswap_-macros-are-defined-in-byteswap.h.patch new file mode 100644 index 0000000..f5445a9 --- /dev/null +++ b/0003-bswap_-macros-are-defined-in-byteswap.h.patch @@ -0,0 +1,26 @@ +From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 10 Aug 2017 08:23:47 +0200 +Subject: [PATCH] bswap_* macros are defined in byteswap.h + +Fixes ImportError on s390x: +/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32 +--- + libqpol/policy.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libqpol/policy.c b/libqpol/policy.c +index ae3acb5..e412be0 100644 +--- a/libqpol/policy.c ++++ b/libqpol/policy.c +@@ -28,6 +28,7 @@ + + #include "qpol_internal.h" + #include ++#include + #include + #include + #include +-- +2.13.3 + diff --git a/setools.spec b/setools.spec index 7bab4ad..0d68848 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -21,6 +21,7 @@ Source1: setools.pam Source2: apol.desktop Patch1: 0001-Do-not-use-Werror-during-build.patch Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -177,6 +178,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Aug 10 2017 Petr Lautrbach - 4.1.1-2 +- bswap_* macros are defined in byteswap.h + * Mon Aug 07 2017 Petr Lautrbach - 4.1.1-1 - New upstream release From be3765e54aedf064e941035f0e57575fa898a642 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 12 Aug 2017 09:06:58 -0400 Subject: [PATCH 025/111] Python 2 binary package renamed to python2-setools --- setools.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/setools.spec b/setools.spec index 0d68848..5da0745 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -77,11 +77,15 @@ This package includes the following console tools: seinfoflow Perform information flow analyses. -%package python +%package -n python2-setools Summary: Policy analysis tools for SELinux Recommends: libselinux-python +%{?python_provide:%python_provide python2-setools} +# Remove before F30 +Provides: %{name}-python%{?_isa} = %{version}-%{release} +Obsoletes: %{name}-python < %{version}-%{release} -%description python +%description -n python2-setools SETools is a collection of graphical tools, command-line tools, and Python 2 modules designed to facilitate SELinux policy analysis. @@ -157,7 +161,7 @@ popd %{_mandir}/man1/sedta* %{_mandir}/man1/seinfoflow* -%files python +%files -n python2-setools # %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README %license COPYING COPYING.GPL COPYING.LGPL # For noarch packages: sitelib @@ -178,6 +182,10 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Aug 10 2017 Zbigniew Jędrzejewski-Szmek - 4.1.1-3 +- Python 2 binary package renamed to python2-setools + See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 + * Thu Aug 10 2017 Petr Lautrbach - 4.1.1-2 - bswap_* macros are defined in byteswap.h From 051ad0ff37bc8b8a3c561ab67eca7387aa991b1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 12 Aug 2017 09:13:07 -0400 Subject: [PATCH 026/111] Python 3 binary package renamed to python3-setools --- setools.spec | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/setools.spec b/setools.spec index 5da0745..f638826 100644 --- a/setools.spec +++ b/setools.spec @@ -35,7 +35,7 @@ BuildRequires: python3-devel BuildRequires: python3-setuptools # BuildArch: -Requires: %{name}-python3 = %{version}-%{release} +Requires: python3-%{name} = %{version}-%{release} %description SETools is a collection of graphical tools, command-line tools, and @@ -45,7 +45,7 @@ Python modules designed to facilitate SELinux policy analysis. Summary: Policy analysis command-line tools for SELinux Group: System Environment/Base License: GPLv2 -Requires: setools-python3 = %{version}-%{release} +Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} %description console @@ -63,7 +63,7 @@ This package includes the following console tools: Summary: Policy analysis command-line tools for SELinux Group: System Environment/Base License: GPLv2 -Requires: setools-python3 = %{version}-%{release} +Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} Requires: python3-networkx @@ -89,12 +89,16 @@ Obsoletes: %{name}-python < %{version}-%{release} SETools is a collection of graphical tools, command-line tools, and Python 2 modules designed to facilitate SELinux policy analysis. -%package python3 +%package -n python3-setools Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0, setools-libs-tcl Recommends: libselinux-python3 +%{?python_provide:%python_provide python2-setools} +# Remove before F30 +Provides: %{name}-python3%{?_isa} = %{version}-%{release} +Obsoletes: %{name}-python3 < %{version}-%{release} -%description python3 +%description -n python3-setools SETools is a collection of graphical tools, command-line tools, and Python 3 modules designed to facilitate SELinux policy analysis. @@ -169,7 +173,7 @@ popd # For arch-specific packages: sitearch %{python2_sitearch}/* -%files python3 +%files -n python3-setools %license COPYING COPYING.GPL COPYING.LGPL # %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README # For noarch packages: sitelib @@ -185,6 +189,7 @@ popd * Thu Aug 10 2017 Zbigniew Jędrzejewski-Szmek - 4.1.1-3 - Python 2 binary package renamed to python2-setools See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 +- Python 3 binary package renamed to python3-setools * Thu Aug 10 2017 Petr Lautrbach - 4.1.1-2 - bswap_* macros are defined in byteswap.h From 767253148766572bb17f97d5685369220a444fc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 20 Aug 2017 10:42:50 -0400 Subject: [PATCH 027/111] Add Provides for the old name without %_isa --- setools.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index f638826..ce389d7 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -82,6 +82,7 @@ Summary: Policy analysis tools for SELinux Recommends: libselinux-python %{?python_provide:%python_provide python2-setools} # Remove before F30 +Provides: %{name}-python = %{version}-%{release} Provides: %{name}-python%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python < %{version}-%{release} @@ -95,6 +96,7 @@ Obsoletes: setools-libs < 4.0.0, setools-libs-tcl Recommends: libselinux-python3 %{?python_provide:%python_provide python2-setools} # Remove before F30 +Provides: %{name}-python3 = %{version}-%{release} Provides: %{name}-python3%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python3 < %{version}-%{release} @@ -186,6 +188,9 @@ popd %{_mandir}/man1/apol* %changelog +* Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek - 4.1.1-4 +- Add Provides for the old name without %%_isa + * Thu Aug 10 2017 Zbigniew Jędrzejewski-Szmek - 4.1.1-3 - Python 2 binary package renamed to python2-setools See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 From 1924f091708e3ebf33de08998c6317552446448c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 4 Sep 2017 18:13:55 +0200 Subject: [PATCH 028/111] setools-python2 requires python2-enum34 Fixes: >>> import setools Traceback (most recent call last): File "", line 1, in File "/usr/lib64/python2.7/site-packages/setools/__init__.py", line 31, in from . import policyrep File "/usr/lib64/python2.7/site-packages/setools/policyrep/__init__.py", line 26, in from .bounds import BoundsRuletype File "/usr/lib64/python2.7/site-packages/setools/policyrep/bounds.py", line 24, in from .util import PolicyEnum File "/usr/lib64/python2.7/site-packages/setools/policyrep/util.py", line 21, in from enum import Enum ImportError: No module named enum --- setools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index ce389d7..fbaf473 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -85,6 +85,7 @@ Recommends: libselinux-python Provides: %{name}-python = %{version}-%{release} Provides: %{name}-python%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python < %{version}-%{release} +Requires: python2-enum34 %description -n python2-setools SETools is a collection of graphical tools, command-line tools, and @@ -188,6 +189,9 @@ popd %{_mandir}/man1/apol* %changelog +* Mon Sep 04 2017 Petr Lautrbach - 4.1.1-5 +- setools-python2 requires python2-enum34 + * Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek - 4.1.1-4 - Add Provides for the old name without %%_isa From 3a754fee088ff9a751fd136c580e4232365a16e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 9 Feb 2018 16:32:55 +0000 Subject: [PATCH 029/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index fbaf473..80a462a 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 6%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -189,6 +189,9 @@ popd %{_mandir}/man1/apol* %changelog +* Fri Feb 09 2018 Fedora Release Engineering - 4.1.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Mon Sep 04 2017 Petr Lautrbach - 4.1.1-5 - setools-python2 requires python2-enum34 From 02d7a5d1d700a3004dadb63991bda61e7f6a96c9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 16 Feb 2018 10:32:51 +0100 Subject: [PATCH 030/111] Spec file cleanup https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/MRWOMRZ6KPCV25EFHJ2O67BCCP3L4Y6N/ --- setools.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/setools.spec b/setools.spec index 80a462a..10b90f6 100644 --- a/setools.spec +++ b/setools.spec @@ -43,7 +43,6 @@ Python modules designed to facilitate SELinux policy analysis. %package console Summary: Policy analysis command-line tools for SELinux -Group: System Environment/Base License: GPLv2 Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} @@ -61,7 +60,6 @@ This package includes the following console tools: %package console-analyses Summary: Policy analysis command-line tools for SELinux -Group: System Environment/Base License: GPLv2 Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} @@ -152,7 +150,6 @@ popd %files -%defattr(-,root,root,-) %files console %{_bindir}/sediff From 2dcce95b101f8e5bb6a92bfca91f4ec1e5147c99 Mon Sep 17 00:00:00 2001 From: Iryna Shcherbina Date: Thu, 19 Apr 2018 02:06:10 +0200 Subject: [PATCH 031/111] Update Python 2 dependency declarations to new packaging standards --- setools.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index 10b90f6..f125a61 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 6%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 7%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -77,7 +77,7 @@ This package includes the following console tools: %package -n python2-setools Summary: Policy analysis tools for SELinux -Recommends: libselinux-python +Recommends: python2-libselinux %{?python_provide:%python_provide python2-setools} # Remove before F30 Provides: %{name}-python = %{version}-%{release} @@ -186,6 +186,10 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Apr 19 2018 Iryna Shcherbina - 4.1.1-7 +- Update Python 2 dependency declarations to new packaging standards + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + * Fri Feb 09 2018 Fedora Release Engineering - 4.1.1-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From efa4712a7b0a63b9ffeaa6d62ca73a5a235fc578 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 26 Apr 2018 11:35:58 +0200 Subject: [PATCH 032/111] setools-4.1.1-8 - Add support for SCTP protocol --- 0004-Add-support-for-SCTP-protocol.patch | 131 +++++++++++++++++++++++ setools.spec | 6 +- 2 files changed, 136 insertions(+), 1 deletion(-) create mode 100644 0004-Add-support-for-SCTP-protocol.patch diff --git a/0004-Add-support-for-SCTP-protocol.patch b/0004-Add-support-for-SCTP-protocol.patch new file mode 100644 index 0000000..4223a46 --- /dev/null +++ b/0004-Add-support-for-SCTP-protocol.patch @@ -0,0 +1,131 @@ +From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 16 Apr 2018 20:46:20 +0200 +Subject: [PATCH] Add support for SCTP protocol + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333 + +Signed-off-by: Vit Mojzis +--- + libqpol/include/qpol/linux_types.h | 1 + + libqpol/policy_define.c | 5 +++++ + setools/perm_map | 30 ++++++++++++++++++++++++++++++ + setools/policyrep/netcontext.py | 5 +++++ + 4 files changed, 41 insertions(+) + +diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h +index c3c056b..0985162 100644 +--- a/libqpol/include/qpol/linux_types.h ++++ b/libqpol/include/qpol/linux_types.h +@@ -12,6 +12,7 @@ typedef uint16_t __u16; + #define s6_addr32 __u6_addr32 + + #define IPPROTO_DCCP 33 ++#define IPPROTO_SCTP 132 + #endif + + #endif +diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c +index dcc69fc..1e623a3 100644 +--- a/libqpol/policy_define.c ++++ b/libqpol/policy_define.c +@@ -44,6 +44,9 @@ + #ifndef IPPROTO_DCCP + #define IPPROTO_DCCP 33 + #endif ++#ifndef IPPROTO_SCTP ++#define IPPROTO_SCTP 132 ++#endif + #include + #include + #include +@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high) + protocol = IPPROTO_UDP; + } else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) { + protocol = IPPROTO_DCCP; ++ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) { ++ protocol = IPPROTO_SCTP; + } else { + yyerror2("unrecognized protocol %s", id); + goto bad; +diff --git a/setools/perm_map b/setools/perm_map +index 0a9f91c..25fae09 100644 +--- a/setools/perm_map ++++ b/setools/perm_map +@@ -385,6 +385,8 @@ class node 11 + udp_send w 10 + dccp_recv r 10 + dccp_send w 10 ++ sctp_recv r 10 ++ sctp_send w 10 + enforce_dest n 1 + sendto w 10 + recvfrom r 10 +@@ -699,6 +701,32 @@ class dccp_socket 24 + relabelto w 10 + listen r 1 + ++class sctp_socket 24 ++ node_bind n 1 ++ name_connect w 10 ++ append w 10 ++ bind w 1 ++ connect w 1 ++ create w 1 ++ write w 10 ++ relabelfrom r 10 ++ ioctl n 1 ++ name_bind n 1 ++ sendto w 10 ++ recv_msg r 10 ++ send_msg w 10 ++ getattr r 7 ++ setattr w 7 ++ accept r 1 ++ getopt r 1 ++ read r 10 ++ setopt w 1 ++ shutdown w 1 ++ recvfrom r 10 ++ lock n 1 ++ relabelto w 10 ++ listen r 1 ++ + class netlink_firewall_socket 24 + nlmsg_write w 10 + nlmsg_read r 10 +@@ -984,6 +1012,8 @@ class netif 10 + udp_send w 10 + dccp_recv r 10 + dccp_send w 10 ++ sctp_recv r 10 ++ sctp_send w 10 + + class packet_socket 22 + append w 10 +diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py +index c7076d2..2d890f3 100644 +--- a/setools/policyrep/netcontext.py ++++ b/setools/policyrep/netcontext.py +@@ -38,6 +38,10 @@ try: + IPPROTO_DCCP = getprotobyname("dccp") + except socket.error: + IPPROTO_DCCP = 33 ++try: ++ IPPROTO_SCTP = getprotobyname("sctp") ++except socket.error: ++ IPPROTO_SCTP = 132 + + + def netifcon_factory(policy, name): +@@ -196,6 +200,7 @@ class PortconProtocol(int, PolicyEnum): + tcp = IPPROTO_TCP + udp = IPPROTO_UDP + dccp = IPPROTO_DCCP ++ sctp = IPPROTO_SCTP + + + class Portcon(NetContext): +-- +2.14.3 + diff --git a/setools.spec b/setools.spec index f125a61..e354f60 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 7%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 8%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -22,6 +22,7 @@ Source2: apol.desktop Patch1: 0001-Do-not-use-Werror-during-build.patch Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch +Patch4: 0004-Add-support-for-SCTP-protocol.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -186,6 +187,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Apr 26 2018 Vit Mojzis - 4.1.1-8 +- Add support for SCTP protocol (#1568333) + * Thu Apr 19 2018 Iryna Shcherbina - 4.1.1-7 - Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) From afb5e45daa608c13ce83907616f1b016e0a44e98 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 14 Jun 2018 11:04:36 +0200 Subject: [PATCH 033/111] Move gui python files to -gui subpackage --- setools.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index e354f60..a7318a8 100644 --- a/setools.spec +++ b/setools.spec @@ -180,10 +180,12 @@ popd # For noarch packages: sitelib # %{python3_sitelib}/* # For arch-specific packages: sitearch -%{python3_sitearch}/* +%{python3_sitearch}/setools +%{python3_sitearch}/setools-* %files gui %{_bindir}/apol +%{python3_sitearch}/setoolsgui %{_mandir}/man1/apol* %changelog From f73658f908329532eb1c5b921099c2b213b6f83f Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 14 Jun 2018 13:06:05 +0200 Subject: [PATCH 034/111] setools-4.1.1-9 - Move gui python files to -gui subpackage --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a7318a8..d7a5893 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 8%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 9%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -189,6 +189,9 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Jun 14 2018 Petr Lautrbach - 4.1.1-9 +- Move gui python files to -gui subpackage + * Thu Apr 26 2018 Vit Mojzis - 4.1.1-8 - Add support for SCTP protocol (#1568333) From 9ad7d4e48a9993871ab9ab87cb0fbb0b567c1299 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 14 Jun 2018 13:27:08 +0200 Subject: [PATCH 035/111] s/plautrba@workstation/plautrba@redhat.com/ --- setools.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index d7a5893..a4b56de 100644 --- a/setools.spec +++ b/setools.spec @@ -189,7 +189,7 @@ popd %{_mandir}/man1/apol* %changelog -* Thu Jun 14 2018 Petr Lautrbach - 4.1.1-9 +* Thu Jun 14 2018 Petr Lautrbach - 4.1.1-9 - Move gui python files to -gui subpackage * Thu Apr 26 2018 Vit Mojzis - 4.1.1-8 From a5d7dbf23d9de3b60482e28a26c44a734805614a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 19 Jun 2018 11:27:24 +0200 Subject: [PATCH 036/111] Rebuilt for Python 3.7 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a4b56de..fad6507 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 9%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 10%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -189,6 +189,9 @@ popd %{_mandir}/man1/apol* %changelog +* Tue Jun 19 2018 Miro Hrončok - 4.1.1-10 +- Rebuilt for Python 3.7 + * Thu Jun 14 2018 Petr Lautrbach - 4.1.1-9 - Move gui python files to -gui subpackage From 3bb977d8b3d7119eeefac4413cd7694e6fa8afb4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 06:00:08 +0000 Subject: [PATCH 037/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index fad6507..a363559 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 10%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 11%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -189,6 +189,9 @@ popd %{_mandir}/man1/apol* %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 4.1.1-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Tue Jun 19 2018 Miro Hrončok - 4.1.1-10 - Rebuilt for Python 3.7 From 950d0d171f3ab059957ef6603b82be4ec1e2717b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 23 Jul 2018 21:28:26 +0200 Subject: [PATCH 038/111] Fix rpmlint errors and warnings setools.spec:95: W: unversioned-explicit-obsoletes setools-libs-tcl setools.spec:170: W: macro-in-comment %doc setools.spec:173: W: macro-in-comment %{python2_sitelib} setools.spec:179: W: macro-in-comment %doc setools.spec:181: W: macro-in-comment %{python3_sitelib} setools.spec: E: specfile-error warning: Macro expanded in comment on line 173: %{python2_sitelib}/* setools.spec: E: specfile-error setools.spec: E: specfile-error warning: Macro expanded in comment on line 181: %{python3_sitelib}/* --- setools.spec | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/setools.spec b/setools.spec index a363559..4e27b70 100644 --- a/setools.spec +++ b/setools.spec @@ -92,7 +92,7 @@ Python 2 modules designed to facilitate SELinux policy analysis. %package -n python3-setools Summary: Policy analysis tools for SELinux -Obsoletes: setools-libs < 4.0.0, setools-libs-tcl +Obsoletes: setools-libs < 4.0.0 Recommends: libselinux-python3 %{?python_provide:%python_provide python2-setools} # Remove before F30 @@ -167,19 +167,11 @@ popd %{_mandir}/man1/seinfoflow* %files -n python2-setools -# %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README %license COPYING COPYING.GPL COPYING.LGPL -# For noarch packages: sitelib -# %{python2_sitelib}/* -# For arch-specific packages: sitearch %{python2_sitearch}/* %files -n python3-setools %license COPYING COPYING.GPL COPYING.LGPL -# %doc AUTHORS ChangeLog KNOWN-BUGS NEWS README -# For noarch packages: sitelib -# %{python3_sitelib}/* -# For arch-specific packages: sitearch %{python3_sitearch}/setools %{python3_sitearch}/setools-* From 56ba58467229b4a89b0af5ccbbdd2c1769161e3d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Aug 2018 18:01:19 +0200 Subject: [PATCH 039/111] Fix SCTP patch Fixes: Failed to load default permission map: /usr/lib64/python3.6/site-packages/setools/perm_map:391:Invalid class declaration: ['sendto', 'w', '10'] https://github.com/SELinuxProject/setools/issues/9 --- 0004-Add-support-for-SCTP-protocol.patch | 41 ++++++++++++++++++++---- 1 file changed, 34 insertions(+), 7 deletions(-) diff --git a/0004-Add-support-for-SCTP-protocol.patch b/0004-Add-support-for-SCTP-protocol.patch index 4223a46..f22a538 100644 --- a/0004-Add-support-for-SCTP-protocol.patch +++ b/0004-Add-support-for-SCTP-protocol.patch @@ -9,9 +9,9 @@ Signed-off-by: Vit Mojzis --- libqpol/include/qpol/linux_types.h | 1 + libqpol/policy_define.c | 5 +++++ - setools/perm_map | 30 ++++++++++++++++++++++++++++++ + setools/perm_map | 36 +++++++++++++++++++++++++++--- setools/policyrep/netcontext.py | 5 +++++ - 4 files changed, 41 insertions(+) + 4 files changed, 44 insertions(+), 3 deletions(-) diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h index c3c056b..0985162 100644 @@ -49,9 +49,27 @@ index dcc69fc..1e623a3 100644 yyerror2("unrecognized protocol %s", id); goto bad; diff --git a/setools/perm_map b/setools/perm_map -index 0a9f91c..25fae09 100644 +index 0a9f91c..8bd34f5 100644 --- a/setools/perm_map +++ b/setools/perm_map +@@ -27,7 +27,7 @@ + # Look to the examples below for further clarification. + # + # Number of object classes. +-95 ++96 + + class netlink_audit_socket 27 + nlmsg_relay w 10 +@@ -376,7 +376,7 @@ class file 22 + quotaon b 1 + swapon b 1 + +-class node 11 ++class node 13 + rawip_recv r 10 + tcp_recv r 10 + udp_recv r 10 @@ -385,6 +385,8 @@ class node 11 udp_send w 10 dccp_recv r 10 @@ -94,6 +112,15 @@ index 0a9f91c..25fae09 100644 class netlink_firewall_socket 24 nlmsg_write w 10 nlmsg_read r 10 +@@ -973,7 +1001,7 @@ class key_socket 22 + relabelto w 10 + listen r 1 + +-class netif 10 ++class netif 12 + rawip_recv r 10 + tcp_recv r 10 + udp_recv r 10 @@ -984,6 +1012,8 @@ class netif 10 udp_send w 10 dccp_recv r 10 @@ -104,10 +131,10 @@ index 0a9f91c..25fae09 100644 class packet_socket 22 append w 10 diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py -index c7076d2..2d890f3 100644 +index 9a01fc5..630b42c 100644 --- a/setools/policyrep/netcontext.py +++ b/setools/policyrep/netcontext.py -@@ -38,6 +38,10 @@ try: +@@ -35,6 +35,10 @@ try: IPPROTO_DCCP = getprotobyname("dccp") except socket.error: IPPROTO_DCCP = 33 @@ -118,7 +145,7 @@ index c7076d2..2d890f3 100644 def netifcon_factory(policy, name): -@@ -196,6 +200,7 @@ class PortconProtocol(int, PolicyEnum): +@@ -161,6 +165,7 @@ class PortconProtocol(int, PolicyEnum): tcp = IPPROTO_TCP udp = IPPROTO_UDP dccp = IPPROTO_DCCP @@ -127,5 +154,5 @@ index c7076d2..2d890f3 100644 class Portcon(NetContext): -- -2.14.3 +2.18.0 From b2615bd52cf918148390d3ee13d1cfc02908c8f8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Aug 2018 18:08:05 +0200 Subject: [PATCH 040/111] setools-4.1.1-12 - Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9 - Update URL to SELinuxProject/setools - Require userspace release 2.8 --- setools.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/setools.spec b/setools.spec index 4e27b70..876a7d6 100644 --- a/setools.spec +++ b/setools.spec @@ -6,17 +6,17 @@ # % global setools_pre_ver beta.1.8e09d95 # % global gitver f1e5b20 -%global sepol_ver 2.7-1 -%global selinux_ver 2.7-1 +%global sepol_ver 2.8-1 +%global selinux_ver 2.8-1 Name: setools Version: 4.1.1 -Release: 11%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 12%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 -URL: https://github.com/TresysTechnology/setools/wiki -Source0: https://github.com/TresysTechnology/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz +URL: https://github.com/SELinuxProject/setools/wiki +Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop Patch1: 0001-Do-not-use-Werror-during-build.patch @@ -181,6 +181,9 @@ popd %{_mandir}/man1/apol* %changelog +* Wed Aug 22 2018 Petr Lautrbach - 4.1.1-12 +- Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9 + * Sat Jul 14 2018 Fedora Release Engineering - 4.1.1-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From fd63d73041c48649617984e5156b117acd4d1663 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Aug 2018 11:16:34 +0200 Subject: [PATCH 041/111] setools-gui requires python3-setools --- setools.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/setools.spec b/setools.spec index 876a7d6..69d9a4e 100644 --- a/setools.spec +++ b/setools.spec @@ -107,6 +107,7 @@ Python 3 modules designed to facilitate SELinux policy analysis. %package gui Summary: Policy analysis graphical tools for SELinux +Requires: python3-setools = %{version}-%{release} Requires: python3-qt5 Requires: python3-networkx From 618f976e7b8c89570bf71ec232168dbb19335baf Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 23 Aug 2018 12:20:26 +0200 Subject: [PATCH 042/111] Rebuild --- setools.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index 69d9a4e..9f0f20c 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 12%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 12.1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -182,7 +182,7 @@ popd %{_mandir}/man1/apol* %changelog -* Wed Aug 22 2018 Petr Lautrbach - 4.1.1-12 +* Wed Aug 22 2018 Petr Lautrbach - 4.1.1-12.1 - Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9 * Sat Jul 14 2018 Fedora Release Engineering - 4.1.1-11 From ec182abe694b7c2aa1785a23bc185fc626b7b896 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 29 Aug 2018 12:56:24 +0200 Subject: [PATCH 043/111] setools-4.1.1-13 - Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) --- setools.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 9f0f20c..a45b1c8 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 12.1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 13%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -85,6 +85,7 @@ Provides: %{name}-python = %{version}-%{release} Provides: %{name}-python%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python < %{version}-%{release} Requires: python2-enum34 +Requires: python2-setuptools %description -n python2-setools SETools is a collection of graphical tools, command-line tools, and @@ -99,6 +100,7 @@ Recommends: libselinux-python3 Provides: %{name}-python3 = %{version}-%{release} Provides: %{name}-python3%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python3 < %{version}-%{release} +Requires: python3-setuptools %description -n python3-setools SETools is a collection of graphical tools, command-line tools, and @@ -182,6 +184,10 @@ popd %{_mandir}/man1/apol* %changelog +* Wed Aug 29 2018 Vit Mojzis - 4.1.1-13 +- Add Requires for python[23]-setuptools - no longer required (just recommended) + by python[23] (#1623371) + * Wed Aug 22 2018 Petr Lautrbach - 4.1.1-12.1 - Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9 From 0818b3952b4def536439e46a0982ec87c89b9e20 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 15:14:20 +0000 Subject: [PATCH 044/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a45b1c8..35001d2 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 13%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 14%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -184,6 +184,9 @@ popd %{_mandir}/man1/apol* %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 4.1.1-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Aug 29 2018 Vit Mojzis - 4.1.1-13 - Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) From aae45ee4799a18c2289b0b0ea2a8e6e46d231d87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 13 Feb 2019 01:09:32 +0100 Subject: [PATCH 045/111] https://fedoraproject.org/wiki/Changes/Python_Extension_Flags --- setools.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index 35001d2..abbfc54 100644 --- a/setools.spec +++ b/setools.spec @@ -125,8 +125,7 @@ cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{ %build -# Remove CFLAGS=... for noarch packages (unneeded) -CFLAGS="%{optflags}" %{__python3} setup.py build +%py3_build pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 # Remove CFLAGS=... for noarch packages (unneeded) @@ -141,7 +140,7 @@ pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 popd rm -rf %{buildroot}%{_bindir} -%{__python3} setup.py install --root %{buildroot} +%py3_install %check %if %{?_with_check:1}%{!?_with_check:0} From 5443cd02b99f9a64b703e95f61297f32b8e47b73 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jul 2019 23:07:24 +0000 Subject: [PATCH 046/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index abbfc54..0921554 100644 --- a/setools.spec +++ b/setools.spec @@ -11,7 +11,7 @@ Name: setools Version: 4.1.1 -Release: 14%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 15%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -183,6 +183,9 @@ popd %{_mandir}/man1/apol* %changelog +* Fri Jul 26 2019 Fedora Release Engineering - 4.1.1-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sat Feb 02 2019 Fedora Release Engineering - 4.1.1-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 082b752534ef54a49adbb7c2e1da779fa2257599 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 9 Aug 2018 16:34:27 +0200 Subject: [PATCH 047/111] SETools 4.2.2 release - Replaced the Python/SWIG/static-linked-libsepol policyrep module with a Cython implementation. This will have performance and memory-usage improvements and breaks the static linking to libsepol. - Significant memory usage reduction in sediff (approximately 60%, depending on the policies). - Added support for SCTP portcons - Updated permission maps - Support for Python 2.7 was dropped - Drop python2 subpackage (4.2.0 no longer supports python2) - Require userspace release 2.9 - setools-gui requires python3-setools - Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) - Fixed performance regressions - Made further memory usage improvements - Fixed build issues with clean target and runtime_library_dirs - Revised package structure to make policyrep a module of the setools package - Symbol names are now available as the name attribute (e.g. Boolean.name, Type.name, etc.) - Fixed some apol layouts to increase the size of text fields - Move constraint expression to its own class - Made Conditional.evaluate() more useful and added BaseTERule.enabled() method to determine if a rule is enabled - Restored missing statement() methods in some policyrep classes - Fixed NULL pointer dereference when iterating over type attributes when the policy has none - Added xdp_socket permission mapping - SELinuxPolicy: Create a map of aliases on policy load - Remove source policy references from man pages, as loading source policies is no longer supported. - Fix a performance regression in alias loading after alias dereferencing fixes in 4.2.1 --- .gitignore | 5 + ...ap_-macros-are-defined-in-byteswap.h.patch | 26 --- 0004-Add-support-for-SCTP-protocol.patch | 158 ------------------ ... 1001-Do-not-use-Werror-during-build.patch | 16 +- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 87 +++++----- setools.spec | 96 ++++------- sources | 2 +- 7 files changed, 91 insertions(+), 299 deletions(-) delete mode 100644 0003-bswap_-macros-are-defined-in-byteswap.h.patch delete mode 100644 0004-Add-support-for-SCTP-protocol.patch rename 0001-Do-not-use-Werror-during-build.patch => 1001-Do-not-use-Werror-during-build.patch (81%) rename 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch => 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch (67%) diff --git a/.gitignore b/.gitignore index 255e868..3053379 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,8 @@ setools-3.3.8.tar.bz2 setools-3.3.8-f1e5b20.tar.bz2 /4.1.0.tar.gz /4.1.1.tar.gz +/4.2.0-beta.tar.gz +/4.2.0-rc.tar.gz +/4.2.0.tar.gz +/4.2.1.tar.gz +/4.2.2.tar.gz diff --git a/0003-bswap_-macros-are-defined-in-byteswap.h.patch b/0003-bswap_-macros-are-defined-in-byteswap.h.patch deleted file mode 100644 index f5445a9..0000000 --- a/0003-bswap_-macros-are-defined-in-byteswap.h.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 10 Aug 2017 08:23:47 +0200 -Subject: [PATCH] bswap_* macros are defined in byteswap.h - -Fixes ImportError on s390x: -/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32 ---- - libqpol/policy.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libqpol/policy.c b/libqpol/policy.c -index ae3acb5..e412be0 100644 ---- a/libqpol/policy.c -+++ b/libqpol/policy.c -@@ -28,6 +28,7 @@ - - #include "qpol_internal.h" - #include -+#include - #include - #include - #include --- -2.13.3 - diff --git a/0004-Add-support-for-SCTP-protocol.patch b/0004-Add-support-for-SCTP-protocol.patch deleted file mode 100644 index f22a538..0000000 --- a/0004-Add-support-for-SCTP-protocol.patch +++ /dev/null @@ -1,158 +0,0 @@ -From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 16 Apr 2018 20:46:20 +0200 -Subject: [PATCH] Add support for SCTP protocol - -Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333 - -Signed-off-by: Vit Mojzis ---- - libqpol/include/qpol/linux_types.h | 1 + - libqpol/policy_define.c | 5 +++++ - setools/perm_map | 36 +++++++++++++++++++++++++++--- - setools/policyrep/netcontext.py | 5 +++++ - 4 files changed, 44 insertions(+), 3 deletions(-) - -diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h -index c3c056b..0985162 100644 ---- a/libqpol/include/qpol/linux_types.h -+++ b/libqpol/include/qpol/linux_types.h -@@ -12,6 +12,7 @@ typedef uint16_t __u16; - #define s6_addr32 __u6_addr32 - - #define IPPROTO_DCCP 33 -+#define IPPROTO_SCTP 132 - #endif - - #endif -diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c -index dcc69fc..1e623a3 100644 ---- a/libqpol/policy_define.c -+++ b/libqpol/policy_define.c -@@ -44,6 +44,9 @@ - #ifndef IPPROTO_DCCP - #define IPPROTO_DCCP 33 - #endif -+#ifndef IPPROTO_SCTP -+#define IPPROTO_SCTP 132 -+#endif - #include - #include - #include -@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high) - protocol = IPPROTO_UDP; - } else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) { - protocol = IPPROTO_DCCP; -+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) { -+ protocol = IPPROTO_SCTP; - } else { - yyerror2("unrecognized protocol %s", id); - goto bad; -diff --git a/setools/perm_map b/setools/perm_map -index 0a9f91c..8bd34f5 100644 ---- a/setools/perm_map -+++ b/setools/perm_map -@@ -27,7 +27,7 @@ - # Look to the examples below for further clarification. - # - # Number of object classes. --95 -+96 - - class netlink_audit_socket 27 - nlmsg_relay w 10 -@@ -376,7 +376,7 @@ class file 22 - quotaon b 1 - swapon b 1 - --class node 11 -+class node 13 - rawip_recv r 10 - tcp_recv r 10 - udp_recv r 10 -@@ -385,6 +385,8 @@ class node 11 - udp_send w 10 - dccp_recv r 10 - dccp_send w 10 -+ sctp_recv r 10 -+ sctp_send w 10 - enforce_dest n 1 - sendto w 10 - recvfrom r 10 -@@ -699,6 +701,32 @@ class dccp_socket 24 - relabelto w 10 - listen r 1 - -+class sctp_socket 24 -+ node_bind n 1 -+ name_connect w 10 -+ append w 10 -+ bind w 1 -+ connect w 1 -+ create w 1 -+ write w 10 -+ relabelfrom r 10 -+ ioctl n 1 -+ name_bind n 1 -+ sendto w 10 -+ recv_msg r 10 -+ send_msg w 10 -+ getattr r 7 -+ setattr w 7 -+ accept r 1 -+ getopt r 1 -+ read r 10 -+ setopt w 1 -+ shutdown w 1 -+ recvfrom r 10 -+ lock n 1 -+ relabelto w 10 -+ listen r 1 -+ - class netlink_firewall_socket 24 - nlmsg_write w 10 - nlmsg_read r 10 -@@ -973,7 +1001,7 @@ class key_socket 22 - relabelto w 10 - listen r 1 - --class netif 10 -+class netif 12 - rawip_recv r 10 - tcp_recv r 10 - udp_recv r 10 -@@ -984,6 +1012,8 @@ class netif 10 - udp_send w 10 - dccp_recv r 10 - dccp_send w 10 -+ sctp_recv r 10 -+ sctp_send w 10 - - class packet_socket 22 - append w 10 -diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py -index 9a01fc5..630b42c 100644 ---- a/setools/policyrep/netcontext.py -+++ b/setools/policyrep/netcontext.py -@@ -35,6 +35,10 @@ try: - IPPROTO_DCCP = getprotobyname("dccp") - except socket.error: - IPPROTO_DCCP = 33 -+try: -+ IPPROTO_SCTP = getprotobyname("sctp") -+except socket.error: -+ IPPROTO_SCTP = 132 - - - def netifcon_factory(policy, name): -@@ -161,6 +165,7 @@ class PortconProtocol(int, PolicyEnum): - tcp = IPPROTO_TCP - udp = IPPROTO_UDP - dccp = IPPROTO_DCCP -+ sctp = IPPROTO_SCTP - - - class Portcon(NetContext): --- -2.18.0 - diff --git a/0001-Do-not-use-Werror-during-build.patch b/1001-Do-not-use-Werror-during-build.patch similarity index 81% rename from 0001-Do-not-use-Werror-during-build.patch rename to 1001-Do-not-use-Werror-during-build.patch index ff4523c..60f11e2 100644 --- a/0001-Do-not-use-Werror-during-build.patch +++ b/1001-Do-not-use-Werror-during-build.patch @@ -1,7 +1,7 @@ -From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001 +From 4b3dc6b38abbd32cda557d5ef9ea1383ac5fdcf2 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Thu, 23 Feb 2017 08:17:07 +0100 -Subject: [PATCH 1/2] Do not use -Werror during build +Subject: [PATCH 2/3] Do not use -Werror during build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -32,18 +32,18 @@ error: command 'gcc' failed with exit status 1 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 2ca44c9..9319bf6 100644 +index c94daf1..a7442ac 100644 --- a/setup.py +++ b/setup.py -@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', - 'libqpol/policy_scan.c', - 'libqpol/xen_query.c'], - include_dirs=include_dirs, +@@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], + libraries=['selinux', 'sepol'], + library_dirs=lib_dirs, + define_macros=macros, - extra_compile_args=['-Werror', '-Wextra', + extra_compile_args=['-Wextra', '-Waggregate-return', '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.9.3 +2.17.2 diff --git a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch similarity index 67% rename from 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch rename to 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index a5d982a..3057072 100644 --- a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Thu, 23 Feb 2017 08:17:07 +0100 -Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and +From b960869bcbcb58f2ce9af598484f209935c096b0 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 26 Apr 2019 15:27:25 +0200 +Subject: [PATCH 3/3] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -12,28 +12,29 @@ Therefore it's better to use setools.infoflow.InfoFlowAnalysis and setools.dta.DomainTransitionAnalysis and let the package containing sedta and seinfoflow to require python3-networkx --- - sedta | 3 ++- - seinfoflow | 3 ++- - setools/__init__.py | 4 ++-- + sedta | 4 ++-- + seinfoflow | 4 ++-- + setools/__init__.py | 4 ---- setoolsgui/apol/dta.py | 2 +- setoolsgui/apol/infoflow.py | 2 +- - tests/dta.py | 3 ++- - tests/infoflow.py | 3 ++- - 7 files changed, 12 insertions(+), 8 deletions(-) + tests/dta.py | 2 +- + tests/infoflow.py | 2 +- + 7 files changed, 8 insertions(+), 12 deletions(-) diff --git a/sedta b/sedta -index 1c76ebb..255ad49 100755 +index 60861ca..41e38a2 100755 --- a/sedta +++ b/sedta -@@ -23,6 +23,7 @@ import argparse +@@ -22,7 +22,7 @@ import argparse import logging + import signal - import setools +-import setools +import setools.dta def print_transition(trans): -@@ -111,7 +112,7 @@ else: +@@ -114,7 +114,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) @@ -43,18 +44,19 @@ index 1c76ebb..255ad49 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index b287921..d53bdef 100755 +index 97b14ba..e7f965d 100755 --- a/seinfoflow +++ b/seinfoflow -@@ -19,6 +19,7 @@ +@@ -17,7 +17,7 @@ + # along with SETools. If not, see . + # - from __future__ import print_function - import setools +-import setools +import setools.infoflow import argparse import sys import logging -@@ -79,7 +80,7 @@ else: +@@ -81,7 +81,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) @@ -64,77 +66,74 @@ index b287921..d53bdef 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index a84c846..a53c5a7 100644 +index 7b70f5e..5a5f7fe 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery +@@ -73,12 +73,8 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis -from .infoflow import InfoFlowAnalysis -+# from .infoflow import InfoFlowAnalysis from .permmap import PermissionMap - # Domain Transition Analysis +-# Domain Transition Analysis -from .dta import DomainTransitionAnalysis -+# from .dta import DomainTransitionAnalysis - +- # Policy difference from .diff import PolicyDifference + diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 0aaf13f..5b1ea20 100644 +index 4608b9d..2cde44c 100644 --- a/setoolsgui/apol/dta.py +++ b/setoolsgui/apol/dta.py @@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem + QTreeWidgetItem -from setools import DomainTransitionAnalysis +from setools.dta import DomainTransitionAnalysis from ..logtosignal import LogHandlerToSignal from .analysistab import AnalysisTab diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 1ae16de..fdf8f7b 100644 +index 7bca299..7fee277 100644 --- a/setoolsgui/apol/infoflow.py +++ b/setoolsgui/apol/infoflow.py -@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread +@@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem + QTreeWidgetItem -from setools import InfoFlowAnalysis +from setools.infoflow import InfoFlowAnalysis from setools.exception import UnmappedClass, UnmappedPermission from ..logtosignal import LogHandlerToSignal diff --git a/tests/dta.py b/tests/dta.py -index 32b9271..2bdd052 100644 +index a0cc938..177e6fb 100644 --- a/tests/dta.py +++ b/tests/dta.py -@@ -17,7 +17,8 @@ - # +@@ -18,7 +18,7 @@ + import os import unittest --from setools import SELinuxPolicy, DomainTransitionAnalysis -+from setools import SELinuxPolicy +-from setools import DomainTransitionAnalysis +from setools.dta import DomainTransitionAnalysis from setools import TERuletype as TERT - from setools.policyrep.exception import InvalidType - from setools.policyrep.typeattr import Type + from setools.exception import InvalidType + from setools.policyrep import Type diff --git a/tests/infoflow.py b/tests/infoflow.py -index 7751dda..a21c683 100644 +index aa0e44a..fca2848 100644 --- a/tests/infoflow.py +++ b/tests/infoflow.py -@@ -17,7 +17,8 @@ - # +@@ -18,7 +18,7 @@ + import os import unittest --from setools import SELinuxPolicy, InfoFlowAnalysis -+from setools import SELinuxPolicy +-from setools import InfoFlowAnalysis +from setools.infoflow import InfoFlowAnalysis from setools import TERuletype as TERT + from setools.exception import InvalidType from setools.permmap import PermissionMap - from setools.policyrep.exception import InvalidType -- -2.9.3 +2.17.2 diff --git a/setools.spec b/setools.spec index 0921554..cc3562f 100644 --- a/setools.spec +++ b/setools.spec @@ -1,17 +1,13 @@ -# sitelib for noarch packages, sitearch for others (remove the unneeded one) -%{!?__python2: %global __python2 %__python} -%{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} -%{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} - -# % global setools_pre_ver beta.1.8e09d95 +# % global setools_pre_ver rc # % global gitver f1e5b20 -%global sepol_ver 2.8-1 -%global selinux_ver 2.8-1 +%global sepol_ver 2.9-1 +%global selinux_ver 2.9-1 + Name: setools -Version: 4.1.1 -Release: 15%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.2.2 +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -19,10 +15,8 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch1: 0001-Do-not-use-Werror-during-build.patch -Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch -Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch -Patch4: 0004-Add-support-for-SCTP-protocol.patch +Patch1001: 1001-Do-not-use-Werror-during-build.patch +Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -30,10 +24,10 @@ BuildRequires: glibc-devel, gcc, git BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: qt5-qtbase-devel BuildRequires: swig -BuildRequires: python2-devel -BuildRequires: python2-setuptools +BuildRequires: python3-Cython BuildRequires: python3-devel BuildRequires: python3-setuptools +BuildRequires: libselinux-devel # BuildArch: Requires: python3-%{name} = %{version}-%{release} @@ -76,30 +70,11 @@ This package includes the following console tools: seinfoflow Perform information flow analyses. -%package -n python2-setools -Summary: Policy analysis tools for SELinux -Recommends: python2-libselinux -%{?python_provide:%python_provide python2-setools} -# Remove before F30 -Provides: %{name}-python = %{version}-%{release} -Provides: %{name}-python%{?_isa} = %{version}-%{release} -Obsoletes: %{name}-python < %{version}-%{release} -Requires: python2-enum34 -Requires: python2-setuptools - -%description -n python2-setools -SETools is a collection of graphical tools, command-line tools, and -Python 2 modules designed to facilitate SELinux policy analysis. - %package -n python3-setools Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0 Recommends: libselinux-python3 -%{?python_provide:%python_provide python2-setools} -# Remove before F30 -Provides: %{name}-python3 = %{version}-%{release} -Provides: %{name}-python3%{?_isa} = %{version}-%{release} -Obsoletes: %{name}-python3 < %{version}-%{release} +%{?python_provide:%python_provide python3-setools} Requires: python3-setuptools %description -n python3-setools @@ -119,36 +94,19 @@ Python modules designed to facilitate SELinux policy analysis. %prep -%autosetup -p 1 -S git - -cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 +%autosetup -p 1 -S git -n setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} %build %py3_build -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -# Remove CFLAGS=... for noarch packages (unneeded) -CFLAGS="%{optflags}" %{__python2} setup.py build -popd - %install -rm -rf %{buildroot} -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -%{__python2} setup.py install --root %{buildroot} -popd - -rm -rf %{buildroot}%{_bindir} %py3_install %check %if %{?_with_check:1}%{!?_with_check:0} %{__python3} setup.py test - -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -%{__python2} setup.py test -popd %endif @@ -168,10 +126,6 @@ popd %{_mandir}/man1/sedta* %{_mandir}/man1/seinfoflow* -%files -n python2-setools -%license COPYING COPYING.GPL COPYING.LGPL -%{python2_sitearch}/* - %files -n python3-setools %license COPYING COPYING.GPL COPYING.LGPL %{python3_sitearch}/setools @@ -183,11 +137,29 @@ popd %{_mandir}/man1/apol* %changelog -* Fri Jul 26 2019 Fedora Release Engineering - 4.1.1-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild +* Mon Jul 08 2019 Vit Mojzis - 4.2.2-1} +- SETools 4.2.2 release -* Sat Feb 02 2019 Fedora Release Engineering - 4.1.1-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild +* Mon May 13 2019 Vit Mojzis - 4.2.1-3 +- Use %set_build_flags instead of %optflags + +* Mon May 06 2019 Vit Mojzis - 4.2.1-2 +- SELinuxPolicy: Create a map of aliases on policy load (#1672631) + +* Tue Mar 26 2019 Petr Lautrbach - 4.2.1-1 +- SETools 4.2.1 release (#1581761, #1595582) + +* Wed Nov 14 2018 Vit Mojzis - 4.2.0-1 +- Update source to SETools 4.2.0 release + +* Mon Oct 01 2018 Vit Mojzis - 4.2.0-0.3.rc +- Update upstream source to 4.2.0-rc + +* Wed Sep 19 2018 Vit Mojzis - 4.2.0-0.2.beta +- Require userspace release 2.8 +- setools-gui requires python3-setools +- Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) +- Drop python2 subpackage (4.2.0 no longer supports python2) * Wed Aug 29 2018 Vit Mojzis - 4.1.1-13 - Add Requires for python[23]-setuptools - no longer required (just recommended) diff --git a/sources b/sources index 7fde505..9666cef 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.1.1.tar.gz) = 2e55a3b07e2f94d7c84054f31d266567b9acc708fe2b0e16ac3ea24e8301c712bcf564ff915a6135a1a6ba6822682bb3a6530dae20161a832fb7048364acbd04 +SHA512 (4.2.2.tar.gz) = 5044b04d0895ffe31557b3b71bb277ab49710a6066485c8f204ce7858abab259f973000f1fcfde0149ed4e33a50103984939dcc68ce322d70e9e927e81d4f798 From 1d41610e25a5dfd8a162ef4584dd8e4d9c4b3947 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 2 Aug 2019 10:27:19 +0200 Subject: [PATCH 048/111] Add initial set of tests - Tier1 SELinux components tests for Sanity - policycoreutils and checkpolicy tests as they depend and use SETools --- tests/tests.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 tests/tests.yml diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..0f4f3a4 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,11 @@ +--- +# Test to run in classic context +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + repositories: + - repo: "https://src.fedoraproject.org/tests/selinux.git" + dest: "selinux" + fmf_filter: "tier: 1 | component: policycoreutils | component: checkpolicy" From 5f644f84d19b5af0216f8743352b38e88c386cf2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 19 Aug 2019 11:05:46 +0200 Subject: [PATCH 049/111] Rebuilt for Python 3.8 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index cc3562f..09578a6 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.2 -Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -137,6 +137,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/apol* %changelog +* Mon Aug 19 2019 Miro Hrončok - 4.2.2-2 +- Rebuilt for Python 3.8 + * Mon Jul 08 2019 Vit Mojzis - 4.2.2-1} - SETools 4.2.2 release From 2598e73c59fc751dd680b7bc903292c0f0822759 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 3 Oct 2019 14:38:40 +0200 Subject: [PATCH 050/111] Rebuilt for Python 3.8.0rc1 (#1748018) --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 09578a6..6d41105 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.2 -Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -137,6 +137,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/apol* %changelog +* Thu Oct 03 2019 Miro Hrončok - 4.2.2-3 +- Rebuilt for Python 3.8.0rc1 (#1748018) + * Mon Aug 19 2019 Miro Hrončok - 4.2.2-2 - Rebuilt for Python 3.8 From b5ddd6cd6d3100b90801eff0efbadef34f0086a7 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 22 Oct 2019 09:06:14 +0200 Subject: [PATCH 051/111] Add new test for sedta utility Basic test which covers the sedta tool. - test invalid values - test transitivity, reflexivity, non-existent relation etc --- tests/Sanity/sedta/Makefile | 63 ++++++++++++++++++++++ tests/Sanity/sedta/PURPOSE | 3 ++ tests/Sanity/sedta/runtest.sh | 88 +++++++++++++++++++++++++++++++ tests/Sanity/sedta/testpolicy.cil | 21 ++++++++ 4 files changed, 175 insertions(+) create mode 100644 tests/Sanity/sedta/Makefile create mode 100644 tests/Sanity/sedta/PURPOSE create mode 100755 tests/Sanity/sedta/runtest.sh create mode 100644 tests/Sanity/sedta/testpolicy.cil diff --git a/tests/Sanity/sedta/Makefile b/tests/Sanity/sedta/Makefile new file mode 100644 index 0000000..e45b9de --- /dev/null +++ b/tests/Sanity/sedta/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/sedta +# Description: Does sedta work as expected? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/sedta +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does sedta work as expected? Does it support all features?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 1h" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: policycoreutils setools-console-analyses" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/tests/Sanity/sedta/PURPOSE b/tests/Sanity/sedta/PURPOSE new file mode 100644 index 0000000..db04487 --- /dev/null +++ b/tests/Sanity/sedta/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/setools/Sanity/sedta +Description: Does sedta work as expected? Does it support all features? +Author: Milos Malik diff --git a/tests/Sanity/sedta/runtest.sh b/tests/Sanity/sedta/runtest.sh new file mode 100755 index 0000000..4fb0483 --- /dev/null +++ b/tests/Sanity/sedta/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/sedta +# Description: Does sedta work as expected? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE}-console-analyses + OUTPUT_FILE=`mktemp` + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -l | grep testpolicy" + rlPhaseEnd + + rlPhaseStartTest "invalid values" + rlRun "sedta -s unknown_t >& ${OUTPUT_FILE}" 1 + rlRun "grep -i 'not a valid type' ${OUTPUT_FILE}" + rlRun "sedta -s apmd_t -t unknown_t -S >& ${OUTPUT_FILE}" 1 + rlRun "grep -i 'not a valid type' ${OUTPUT_FILE}" + rlRun "sedta -s unknown_t -p /etc/selinux/unknown/policy/policy.31 >& ${OUTPUT_FILE}" 1 + rlRun "grep -i 'no such file or directory' ${OUTPUT_FILE}" + rlRun "sedta -s apmd_t -t var_lib_t -A -1 >& ${OUTPUT_FILE}" 1 + rlRun "grep -i 'must be positive' ${OUTPUT_FILE}" + rlRun "sedta -s xyz_t >& ${OUTPUT_FILE}" + rlRun "grep -i '^0.*transition.*found' ${OUTPUT_FILE}" + rlPhaseEnd + + rlPhaseStartTest "valid values" + # transitivity + rlRun "sedta -s first_t -t second_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + rlRun "sedta -s second_t -t third_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + rlRun "sedta -s first_t -t third_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + # reflexivity + rlRun "sedta -s first_t -t first_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + rlRun "sedta -s second_t -t second_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + rlRun "sedta -s third_t -t third_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^1 domain transition path.*found' ${OUTPUT_FILE}" + # path is longer than limit + rlRun "sedta -s first_t -t third_t -A 1 >& ${OUTPUT_FILE}" + rlRun "grep -i '^0 domain transition path.*found' ${OUTPUT_FILE}" + # non-existent relation + rlRun "sedta -s first_t -t third_t -S -r >& ${OUTPUT_FILE}" + rlRun "grep -i '^0 domain transition path.*found' ${OUTPUT_FILE}" + # non-existent relation + rlRun "sedta -s third_t -t first_t -S >& ${OUTPUT_FILE}" + rlRun "grep -i '^0 domain transition path.*found' ${OUTPUT_FILE}" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r testpolicy" + rlRun "semodule -l | grep testpolicy" 1 + rm -f ${OUTPUT_FILE} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/tests/Sanity/sedta/testpolicy.cil b/tests/Sanity/sedta/testpolicy.cil new file mode 100644 index 0000000..cc39d72 --- /dev/null +++ b/tests/Sanity/sedta/testpolicy.cil @@ -0,0 +1,21 @@ +( type xyz_t ) + +( type first_t ) +( type first_exec_t ) +( type second_t ) +( type second_exec_t ) +( type third_t ) +( type third_exec_t ) + +( typetransition first_t second_exec_t process second_t ) +( typetransition second_t third_exec_t process third_t ) + +( allow first_t second_exec_t ( file ( getattr open read execute ))) +( allow first_t second_t ( process ( transition ))) +( allow second_t third_exec_t ( file ( getattr open read execute ))) +( allow second_t third_t ( process ( transition ))) + +( allow first_t first_exec_t ( file ( entrypoint ))) +( allow second_t second_exec_t ( file ( entrypoint ))) +( allow third_t third_exec_t ( file ( entrypoint ))) + From b8e16f5ac16fe58f2739b1eea7be5e85ed553c2f Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 22 Oct 2019 10:49:40 +0200 Subject: [PATCH 052/111] tests: Add local Sanity/sedta to the testsuite --- tests/tests.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/tests.yml b/tests/tests.yml index 0f4f3a4..ee6dabb 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -9,3 +9,12 @@ - repo: "https://src.fedoraproject.org/tests/selinux.git" dest: "selinux" fmf_filter: "tier: 1 | component: policycoreutils | component: checkpolicy" + +# Test to run in classic context +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - Sanity/sedta From 7f0685b7c91b7d11f274334c033c3b1bea0070c7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 23:16:58 +0000 Subject: [PATCH 053/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 6d41105..ce41df3 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.2 -Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -137,6 +137,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/apol* %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 4.2.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Thu Oct 03 2019 Miro Hrončok - 4.2.2-3 - Rebuilt for Python 3.8.0rc1 (#1748018) From bb087c823660a3b4fdca41ca22845fe0f3a7d8c5 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 23 Mar 2020 20:51:22 +0100 Subject: [PATCH 054/111] setools-4.2.2-5 - setools requires -console, -console-analyses and -gui packages (#1794314) --- setools.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index ce41df3..11a37f2 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.2 -Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -29,8 +29,9 @@ BuildRequires: python3-devel BuildRequires: python3-setuptools BuildRequires: libselinux-devel -# BuildArch: -Requires: python3-%{name} = %{version}-%{release} +Requires: %{name}-console = %{version}-%{release} +Requires: %{name}-console-analyses = %{version}-%{release} +Requires: %{name}-gui = %{version}-%{release} %description SETools is a collection of graphical tools, command-line tools, and @@ -137,6 +138,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/apol* %changelog +* Mon Mar 23 2020 Petr Lautrbach - 4.2.2-5 +- setools requires -console, -console-analyses and -gui packages (#1794314) + * Thu Jan 30 2020 Fedora Release Engineering - 4.2.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 7a283c335f015e52b3b5c125eec2a7752a3baaa8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 2 Apr 2020 16:13:04 +0200 Subject: [PATCH 055/111] SETools 4.3.0 release - Revised sediff method for TE rules. This drastically reduced memory and run time. - Added infiniband context support to seinfo, sediff, and apol. - Added apol configuration for location of Qt assistant. - Fixed sediff issue where properties header would display when not requested. - Fixed sediff issue with type_transition file name comparison. - Fixed permission map socket sendto information flow direction. - Added methods to TypeAttribute class to make it a complete Python collection. - Genfscon now will look up classes rather than using fixed values which were dropped from libsepol. --- .gitignore | 1 + ...e-setools.InfoFlowAnalysis-and-setoo.patch | 30 +++++++++---------- 1003-Require-networkx-on-package-level.patch | 24 +++++++++++++++ setools.spec | 24 +++++++++++++-- sources | 2 +- 5 files changed, 62 insertions(+), 19 deletions(-) create mode 100644 1003-Require-networkx-on-package-level.patch diff --git a/.gitignore b/.gitignore index 3053379..ba42a0d 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.2.0.tar.gz /4.2.1.tar.gz /4.2.2.tar.gz +/4.3.0.tar.gz diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 3057072..a996069 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From b960869bcbcb58f2ce9af598484f209935c096b0 Mon Sep 17 00:00:00 2001 +From 0575455a0abda5ee63c442433384268a959c4fbc Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 26 Apr 2019 15:27:25 +0200 -Subject: [PATCH 3/3] Do not export/use setools.InfoFlowAnalysis and +Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -22,7 +22,7 @@ sedta and seinfoflow to require python3-networkx 7 files changed, 8 insertions(+), 12 deletions(-) diff --git a/sedta b/sedta -index 60861ca..41e38a2 100755 +index 60861ca630a5..41e38a237b42 100755 --- a/sedta +++ b/sedta @@ -22,7 +22,7 @@ import argparse @@ -44,7 +44,7 @@ index 60861ca..41e38a2 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index 97b14ba..e7f965d 100755 +index f10c39de4d8e..fee749a83bb5 100755 --- a/seinfoflow +++ b/seinfoflow @@ -17,7 +17,7 @@ @@ -56,20 +56,20 @@ index 97b14ba..e7f965d 100755 import argparse import sys import logging -@@ -81,7 +81,7 @@ else: +@@ -101,7 +101,7 @@ elif args.booleans is not None: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) -- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) -+ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude) +- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, ++ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, + booleans=booleans) if args.shortest_path or args.all_paths: - if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index 7b70f5e..5a5f7fe 100644 +index 26fa5aa34a19..b7e51c43c4bb 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -73,12 +73,8 @@ from .pcideviceconquery import PcideviceconQuery +@@ -75,12 +75,8 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis @@ -83,7 +83,7 @@ index 7b70f5e..5a5f7fe 100644 from .diff import PolicyDifference diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 4608b9d..2cde44c 100644 +index 4608b9dbf34e..2cde44c142e9 100644 --- a/setoolsgui/apol/dta.py +++ b/setoolsgui/apol/dta.py @@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread @@ -96,7 +96,7 @@ index 4608b9d..2cde44c 100644 from ..logtosignal import LogHandlerToSignal from .analysistab import AnalysisTab diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 7bca299..7fee277 100644 +index 7bca299d23fc..7fee2778f35f 100644 --- a/setoolsgui/apol/infoflow.py +++ b/setoolsgui/apol/infoflow.py @@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread @@ -109,7 +109,7 @@ index 7bca299..7fee277 100644 from ..logtosignal import LogHandlerToSignal diff --git a/tests/dta.py b/tests/dta.py -index a0cc938..177e6fb 100644 +index a0cc9381469c..177e6fb0b961 100644 --- a/tests/dta.py +++ b/tests/dta.py @@ -18,7 +18,7 @@ @@ -122,7 +122,7 @@ index a0cc938..177e6fb 100644 from setools.exception import InvalidType from setools.policyrep import Type diff --git a/tests/infoflow.py b/tests/infoflow.py -index aa0e44a..fca2848 100644 +index aa0e44a7e4f8..fca2848aeca5 100644 --- a/tests/infoflow.py +++ b/tests/infoflow.py @@ -18,7 +18,7 @@ @@ -135,5 +135,5 @@ index aa0e44a..fca2848 100644 from setools.exception import InvalidType from setools.permmap import PermissionMap -- -2.17.2 +2.26.0.rc2 diff --git a/1003-Require-networkx-on-package-level.patch b/1003-Require-networkx-on-package-level.patch new file mode 100644 index 0000000..46e9a4d --- /dev/null +++ b/1003-Require-networkx-on-package-level.patch @@ -0,0 +1,24 @@ +From a2faa263c9dd8bcf51465861046e0406a84975c0 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 2 Apr 2020 16:06:14 +0200 +Subject: [PATCH] Require networkx on package level + +It allows us to ship python3-setools without dependency on python3-networkx +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index 457c83049ca5..4bfd438002bb 100644 +--- a/setup.py ++++ b/setup.py +@@ -170,5 +170,5 @@ setup(name='setools', + # setup also requires libsepol and libselinux + # C libraries and headers to compile. + setup_requires=['setuptools', 'Cython>=0.27'], +- install_requires=['setuptools', 'networkx>=2.0'] ++ install_requires=['setuptools'] + ) +-- +2.26.0.rc2 + diff --git a/setools.spec b/setools.spec index 11a37f2..d4b946b 100644 --- a/setools.spec +++ b/setools.spec @@ -6,8 +6,8 @@ Name: setools -Version: 4.2.2 -Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.3.0 +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -17,7 +17,7 @@ Source1: setools.pam Source2: apol.desktop Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch - +Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git @@ -120,12 +120,17 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/sediff* %{_mandir}/man1/seinfo* %{_mandir}/man1/sesearch* +%{_mandir}/ru/man1/sediff* +%{_mandir}/ru/man1/seinfo* +%{_mandir}/ru/man1/sesearch* %files console-analyses %{_bindir}/sedta %{_bindir}/seinfoflow %{_mandir}/man1/sedta* %{_mandir}/man1/seinfoflow* +%{_mandir}/ru/man1/sedta* +%{_mandir}/ru/man1/seinfoflow* %files -n python3-setools %license COPYING COPYING.GPL COPYING.LGPL @@ -136,8 +141,21 @@ Python modules designed to facilitate SELinux policy analysis. %{_bindir}/apol %{python3_sitearch}/setoolsgui %{_mandir}/man1/apol* +%{_mandir}/ru/man1/apol* %changelog +* Thu Apr 2 2020 Petr Lautrbach - 4.3.0-1 +- SETools 4.3.0 release +- Revised sediff method for TE rules. This drastically reduced memory and run time. +- Added infiniband context support to seinfo, sediff, and apol. +- Added apol configuration for location of Qt assistant. +- Fixed sediff issue where properties header would display when not requested. +- Fixed sediff issue with type_transition file name comparison. +- Fixed permission map socket sendto information flow direction. +- Added methods to TypeAttribute class to make it a complete Python collection. +- Genfscon now will look up classes rather than using fixed values which + were dropped from libsepol. + * Mon Mar 23 2020 Petr Lautrbach - 4.2.2-5 - setools requires -console, -console-analyses and -gui packages (#1794314) diff --git a/sources b/sources index 9666cef..ff7f110 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.2.2.tar.gz) = 5044b04d0895ffe31557b3b71bb277ab49710a6066485c8f204ce7858abab259f973000f1fcfde0149ed4e33a50103984939dcc68ce322d70e9e927e81d4f798 +SHA512 (4.3.0.tar.gz) = 93da43c4b577ff944f1c19ef40cfc51f6d1cb1efef582e467834300540a7af440b6ae9106f29d810963c74b0fb5953003304790a9143a7318e477d17fa7d536a From 8e66d3773096520a2a972e281aef16b191fadd8b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 3 Apr 2020 09:35:35 +0200 Subject: [PATCH 056/111] Enable gating https://docs.fedoraproject.org/en-US/ci/gating/ --- gating.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..af6eb32 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,16 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + From c62a76dec868ca9d46fbb95dfcc691b442450fad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 26 May 2020 03:50:16 +0200 Subject: [PATCH 057/111] Rebuilt for Python 3.9 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index d4b946b..dda3c2f 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.3.0 -Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -144,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Tue May 26 2020 Miro Hrončok - 4.3.0-2 +- Rebuilt for Python 3.9 + * Thu Apr 2 2020 Petr Lautrbach - 4.3.0-1 - SETools 4.3.0 release - Revised sediff method for TE rules. This drastically reduced memory and run time. From 4d63e5997c80fb56eda51f781e36991d7f1cbd8d Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 29 May 2020 17:24:41 +0200 Subject: [PATCH 058/111] tests: Add Regression/The-setools-package-doesn-t-install-any-tools Make sure setools requires setools-console and setools-gui and not vice versa. --- .../Makefile | 63 +++++++++++++++++++ .../runtest.sh | 54 ++++++++++++++++ tests/tests.yml | 1 + 3 files changed, 118 insertions(+) create mode 100644 tests/Regression/The-setools-package-doesn-t-install-any-tools/Makefile create mode 100755 tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh diff --git a/tests/Regression/The-setools-package-doesn-t-install-any-tools/Makefile b/tests/Regression/The-setools-package-doesn-t-install-any-tools/Makefile new file mode 100644 index 0000000..a5e7a6b --- /dev/null +++ b/tests/Regression/The-setools-package-doesn-t-install-any-tools/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Regression/The-setools-package-doesn-t-install-any-tools +# Description: Make sure setools requires setools-console and setools-gui +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Regression/The-setools-package-doesn-t-install-any-tools +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Vit Mojzis " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Make sure setools requires setools-console and setools-gui" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1820078" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh b/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh new file mode 100755 index 0000000..16267ce --- /dev/null +++ b/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Regression/bz1820078-The-setools-package-doesn-t-install-any-tools +# Description: Make sure setools requires setools-console and setools-gui +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + rlRun "dnf -y remove ${PACKAGE} ${PACKAGE}-gui ${PACKAGE}-console" + OUTPUT_FILE=`mktemp` + rlPhaseEnd + + rlPhaseStartTest "bz#1820078" + rlRun "dnf -y install ${PACKAGE}" 0 + rlAssertRpm "${PACKAGE}-gui" + rlAssertRpm "${PACKAGE}-console" + # make sure that setools-* packages do not require setools + rlRun "rpm -q --whatrequires ${PACKAGE} >& ${OUTPUT_FILE}" 0,1 + rlRun "grep -i \"${PACKAGE}-\" ${OUTPUT_FILE}" 1 + if [ $? -ne 1 ]; then rlRun "cat \"${OUTPUT_FILE}\""; fi + rlPhaseEnd + + rlPhaseStartCleanup + rm -f ${OUTPUT_FILE} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml index ee6dabb..f1c994e 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -18,3 +18,4 @@ - classic tests: - Sanity/sedta + - Regression/The-setools-package-doesn-t-install-any-tools From e1c3bd6193eba012e56df27c32d4922239c88a0a Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 16 Jul 2020 12:22:20 +0200 Subject: [PATCH 059/111] setools-4.3.0-3 - rebuild with SELinux userspace 3.1 release --- setools.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index dda3c2f..2ab8e19 100644 --- a/setools.spec +++ b/setools.spec @@ -1,13 +1,13 @@ # % global setools_pre_ver rc # % global gitver f1e5b20 -%global sepol_ver 2.9-1 -%global selinux_ver 2.9-1 +%global sepol_ver 2.3-1 +%global selinux_ver 2.3-1 Name: setools Version: 4.3.0 -Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -144,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Jul 16 2020 Petr Lautrbach - 4.3.0-3 +- rebuild with SELinux userspace 3.1 release + * Tue May 26 2020 Miro Hrončok - 4.3.0-2 - Rebuilt for Python 3.9 From 8ea33531981dc6fc3dd7fde4716ae9366ee6072f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 10:35:00 +0000 Subject: [PATCH 060/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 2ab8e19..a9dc693 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.3.0 -Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -144,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 4.3.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Thu Jul 16 2020 Petr Lautrbach - 4.3.0-3 - rebuild with SELinux userspace 3.1 release From 1396e21e63b094b676a2a1060772479e9b045f23 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 1 Aug 2020 09:02:07 +0000 Subject: [PATCH 061/111] - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a9dc693..c1cae3b 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.3.0 -Release: 4%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -144,6 +144,10 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Aug 01 2020 Fedora Release Engineering - 4.3.0-5 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Wed Jul 29 2020 Fedora Release Engineering - 4.3.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 8840b49782c1e7f71675cb337356ead3de9aac40 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 3 Nov 2020 16:07:11 +0100 Subject: [PATCH 062/111] setools-4.4.0-0.1.20201102git05e90ee - Update to 05e90ee - Add /usr/bin/sechecker - Adapt to new libsepol filename transition structures - Rebuild with libsepol.so.2 --- .gitignore | 1 + ...sepol-filename-transition-structures.patch | 120 ++++++++++++++++++ ...e-setools.InfoFlowAnalysis-and-setoo.patch | 12 +- setools.spec | 25 ++-- sources | 2 +- 5 files changed, 145 insertions(+), 15 deletions(-) create mode 100644 0001-Adapt-to-new-libsepol-filename-transition-structures.patch diff --git a/.gitignore b/.gitignore index ba42a0d..604fc90 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.2.1.tar.gz /4.2.2.tar.gz /4.3.0.tar.gz +/05e90ee.tar.gz diff --git a/0001-Adapt-to-new-libsepol-filename-transition-structures.patch b/0001-Adapt-to-new-libsepol-filename-transition-structures.patch new file mode 100644 index 0000000..ba448fb --- /dev/null +++ b/0001-Adapt-to-new-libsepol-filename-transition-structures.patch @@ -0,0 +1,120 @@ +From f63a3690e3e3f02ab67ad1165be54ce25bac2de7 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Fri, 17 Jul 2020 11:28:08 +0200 +Subject: [PATCH] Adapt to new libsepol filename transition structures + +Adapt setools to the new libsepol internal API for filename transitions +which allows for more efficient filename trans rule representation in +memory and binary policy. + +Signed-off-by: Ondrej Mosnacek +--- + setools/policyrep/sepol.pxd | 9 ++++---- + setools/policyrep/terule.pxi | 41 ++++++++++++++++++++++++++++++------ + 2 files changed, 39 insertions(+), 11 deletions(-) + +diff --git a/setools/policyrep/sepol.pxd b/setools/policyrep/sepol.pxd +index 60bc58c28ebf..b07ddb78350f 100644 +--- a/setools/policyrep/sepol.pxd ++++ b/setools/policyrep/sepol.pxd +@@ -544,21 +544,22 @@ cdef extern from "": + ctypedef cond_bool_datum cond_bool_datum_t + + # +- # filename_trans_t ++ # filename_trans_key_t + # +- cdef struct filename_trans: +- uint32_t stype ++ cdef struct filename_trans_key: + uint32_t ttype + uint32_t tclass + char *name + +- ctypedef filename_trans filename_trans_t ++ ctypedef filename_trans_key filename_trans_key_t + + # + # filename_trans_datum_t + # + cdef struct filename_trans_datum: ++ ebitmap_t stypes + uint32_t otype ++ filename_trans_datum *next + + ctypedef filename_trans_datum filename_trans_datum_t + +diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi +index 3976586b7985..760c366f6c39 100644 +--- a/setools/policyrep/terule.pxi ++++ b/setools/policyrep/terule.pxi +@@ -470,17 +470,18 @@ cdef class FileNameTERule(BaseTERule): + readonly str filename + + @staticmethod +- cdef inline FileNameTERule factory(SELinuxPolicy policy, sepol.filename_trans_t *key, +- sepol.filename_trans_datum_t *datum): ++ cdef inline FileNameTERule factory(SELinuxPolicy policy, ++ sepol.filename_trans_key_t *key, ++ Type stype, size_t otype): + """Factory function for creating FileNameTERule objects.""" + cdef FileNameTERule r = FileNameTERule.__new__(FileNameTERule) + r.policy = policy + r.key = key + r.ruletype = TERuletype.type_transition +- r.source = type_or_attr_factory(policy, policy.type_value_to_datum(key.stype - 1)) ++ r.source = stype + r.target = type_or_attr_factory(policy, policy.type_value_to_datum(key.ttype - 1)) + r.tclass = ObjClass.factory(policy, policy.class_value_to_datum(key.tclass - 1)) +- r.dft = Type.factory(policy, policy.type_value_to_datum(datum.otype - 1)) ++ r.dft = Type.factory(policy, policy.type_value_to_datum(otype - 1)) + r.filename = intern(key.name) + r.origin = None + return r +@@ -708,6 +709,10 @@ cdef class FileNameTERuleIterator(HashtabIterator): + + """Iterate over FileNameTERules in the policy.""" + ++ cdef: ++ sepol.filename_trans_datum_t *datum ++ TypeEbitmapIterator stypei ++ + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.hashtab_t *table): + """Factory function for creating FileNameTERule iterators.""" +@@ -717,7 +722,29 @@ cdef class FileNameTERuleIterator(HashtabIterator): + i.reset() + return i + ++ def _next_stype(self): ++ while True: ++ if self.datum == NULL: ++ super().__next__() ++ self.datum = self.curr.datum ++ self.stypei = TypeEbitmapIterator.factory(self.policy, &self.datum.stypes) ++ try: ++ return next(self.stypei) ++ except StopIteration: ++ pass ++ self.datum = self.datum.next ++ if self.datum != NULL: ++ self.stypei = TypeEbitmapIterator.factory(self.policy, &self.datum.stypes) ++ + def __next__(self): +- super().__next__() +- return FileNameTERule.factory(self.policy, self.curr.key, +- self.curr.datum) ++ stype = self._next_stype() ++ return FileNameTERule.factory(self.policy, ++ self.curr.key, ++ stype, self.datum.otype) ++ ++ def __len__(self): ++ return sum(1 for r in FileNameTERuleIterator.factory(self.policy, self.table)) ++ ++ def reset(self): ++ super().reset() ++ self.datum = NULL +-- +2.29.0 + diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index a996069..5a0460b 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -33,7 +33,7 @@ index 60861ca630a5..41e38a237b42 100755 +import setools.dta - def print_transition(trans): + def print_transition(trans: setools.DomainTransition) -> None: @@ -114,7 +114,7 @@ else: try: @@ -56,7 +56,7 @@ index f10c39de4d8e..fee749a83bb5 100755 import argparse import sys import logging -@@ -101,7 +101,7 @@ elif args.booleans is not None: +@@ -102,7 +102,7 @@ elif args.booleans is not None: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) @@ -66,18 +66,18 @@ index f10c39de4d8e..fee749a83bb5 100755 if args.shortest_path or args.all_paths: diff --git a/setools/__init__.py b/setools/__init__.py -index 26fa5aa34a19..b7e51c43c4bb 100644 +index d72d343e7e79..642485b9018d 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -75,12 +75,8 @@ from .pcideviceconquery import PcideviceconQuery +@@ -91,12 +91,8 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis -from .infoflow import InfoFlowAnalysis - from .permmap import PermissionMap + from .permmap import PermissionMap, RuleWeight, Mapping -# Domain Transition Analysis --from .dta import DomainTransitionAnalysis +-from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition - # Policy difference from .diff import PolicyDifference diff --git a/setools.spec b/setools.spec index c1cae3b..c293a84 100644 --- a/setools.spec +++ b/setools.spec @@ -1,20 +1,21 @@ -# % global setools_pre_ver rc -# % global gitver f1e5b20 +%global setools_pre_ver 05e90ee +%global gitver 05e90ee241af05665f3394e9bed0073e1bb2e17d -%global sepol_ver 2.3-1 -%global selinux_ver 2.3-1 +%global sepol_ver 3.1-4 +%global selinux_ver 3.1-4 Name: setools -Version: 4.3.0 -Release: 5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.4.0 +Release: 0.1.20201102git%{setools_pre_ver}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 URL: https://github.com/SELinuxProject/setools/wiki -Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz +Source0: https://github.com/SELinuxProject/setools/archive/%{setools_pre_ver}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch0001: 0001-Adapt-to-new-libsepol-filename-transition-structures.patch Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Patch1003: 1003-Require-networkx-on-package-level.patch @@ -95,7 +96,7 @@ Python modules designed to facilitate SELinux policy analysis. %prep -%autosetup -p 1 -S git -n setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} +%autosetup -p 1 -S git -n setools-%{gitver} %build @@ -114,9 +115,11 @@ Python modules designed to facilitate SELinux policy analysis. %files %files console +%{_bindir}/sechecker %{_bindir}/sediff %{_bindir}/seinfo %{_bindir}/sesearch +%{_mandir}/man1/sechecker* %{_mandir}/man1/sediff* %{_mandir}/man1/seinfo* %{_mandir}/man1/sesearch* @@ -144,6 +147,12 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Tue Nov 3 2020 Petr Lautrbach - 4.4.0-0.1.20201102git05e90ee +- Update to 05e90ee +- Add /usr/bin/sechecker +- Adapt to new libsepol filename transition structures +- Rebuild with libsepol.so.2 + * Sat Aug 01 2020 Fedora Release Engineering - 4.3.0-5 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index ff7f110..e13005d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.3.0.tar.gz) = 93da43c4b577ff944f1c19ef40cfc51f6d1cb1efef582e467834300540a7af440b6ae9106f29d810963c74b0fb5953003304790a9143a7318e477d17fa7d536a +SHA512 (05e90ee.tar.gz) = 32f60e9a40ca5791a1e63986377e90ca728c7e205d8ae7ce446830ca7f96b51496d9753fd70077f5b6547050d23c41a1d10b20e0af9e4066355e29781d5e3686 From 3c028107aa55cedfca8eaf589a6e26af214713d8 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 3 Nov 2020 16:57:08 +0100 Subject: [PATCH 063/111] Depend on git-core instead of full git See: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/GS7GOUITUEASRELL7SKGLVJLGS3ZVJ45/ Signed-off-by: Ondrej Mosnacek --- setools.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index c293a84..a481cd9 100644 --- a/setools.spec +++ b/setools.spec @@ -21,7 +21,7 @@ Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison -BuildRequires: glibc-devel, gcc, git +BuildRequires: glibc-devel, gcc, git-core BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: qt5-qtbase-devel BuildRequires: swig From b028c6a81b5952295c70f1523981e7ebd9940564 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 10 Dec 2020 17:12:14 +0100 Subject: [PATCH 064/111] setools-4.4.0-0.2.20201102git05e90ee.fc34 - Fix imports in /usr/bin/sedta Fixes: $ sedta Traceback (most recent call last): File "/usr/bin/sedta", line 28, in def print_transition(trans: setools.DomainTransition) -> None: AttributeError: module 'setools' has no attribute 'DomainTransition' --- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 23 +++++++++++-------- setools.spec | 5 +++- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 5a0460b..29ccc0e 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,4 +1,4 @@ -From 0575455a0abda5ee63c442433384268a959c4fbc Mon Sep 17 00:00:00 2001 +From fa776e6abd019a7bdaca37486d714d307cbd332f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 26 Apr 2019 15:27:25 +0200 Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and @@ -12,29 +12,32 @@ Therefore it's better to use setools.infoflow.InfoFlowAnalysis and setools.dta.DomainTransitionAnalysis and let the package containing sedta and seinfoflow to require python3-networkx --- - sedta | 4 ++-- + sedta | 5 +++-- seinfoflow | 4 ++-- setools/__init__.py | 4 ---- setoolsgui/apol/dta.py | 2 +- setoolsgui/apol/infoflow.py | 2 +- tests/dta.py | 2 +- tests/infoflow.py | 2 +- - 7 files changed, 8 insertions(+), 12 deletions(-) + 7 files changed, 9 insertions(+), 12 deletions(-) diff --git a/sedta b/sedta -index 60861ca630a5..41e38a237b42 100755 +index 57070098fe10..51890ea8ea73 100755 --- a/sedta +++ b/sedta -@@ -22,7 +22,7 @@ import argparse - import logging +@@ -23,9 +23,10 @@ import logging import signal --import setools + import setools +import setools.dta - def print_transition(trans: setools.DomainTransition) -> None: -@@ -114,7 +114,7 @@ else: +-def print_transition(trans: setools.DomainTransition) -> None: ++def print_transition(trans: setools.dta.DomainTransition) -> None: + if trans.transition: + print("Domain transition rule(s):") + for t in trans.transition: +@@ -114,7 +115,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) @@ -44,7 +47,7 @@ index 60861ca630a5..41e38a237b42 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index f10c39de4d8e..fee749a83bb5 100755 +index 0ddcfdc7c1fb..8321718b2640 100755 --- a/seinfoflow +++ b/seinfoflow @@ -17,7 +17,7 @@ diff --git a/setools.spec b/setools.spec index a481cd9..a91914d 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.4.0 -Release: 0.1.20201102git%{setools_pre_ver}%{?dist} +Release: 0.2.20201102git%{setools_pre_ver}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -147,6 +147,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Dec 10 2020 Petr Lautrbach - 4.4.0-0.2.20201102git05e90ee +- Fix imports in /usr/bin/sedta + * Tue Nov 3 2020 Petr Lautrbach - 4.4.0-0.1.20201102git05e90ee - Update to 05e90ee - Add /usr/bin/sechecker From d085b2403dff2850a82718d232a9681ed88f3199 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 21 Jan 2021 11:38:03 +0100 Subject: [PATCH 065/111] Rebuild with SELinux userspace release 3.2-rc1 And update to 16c0696 --- .gitignore | 1 + ...sepol-filename-transition-structures.patch | 120 ------------------ 1001-Do-not-use-Werror-during-build.patch | 49 ------- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 14 +- 1003-Require-networkx-on-package-level.patch | 10 +- setools.spec | 16 ++- sources | 2 +- 7 files changed, 23 insertions(+), 189 deletions(-) delete mode 100644 0001-Adapt-to-new-libsepol-filename-transition-structures.patch delete mode 100644 1001-Do-not-use-Werror-during-build.patch diff --git a/.gitignore b/.gitignore index 604fc90..a46f24a 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.2.2.tar.gz /4.3.0.tar.gz /05e90ee.tar.gz +/16c0696.tar.gz diff --git a/0001-Adapt-to-new-libsepol-filename-transition-structures.patch b/0001-Adapt-to-new-libsepol-filename-transition-structures.patch deleted file mode 100644 index ba448fb..0000000 --- a/0001-Adapt-to-new-libsepol-filename-transition-structures.patch +++ /dev/null @@ -1,120 +0,0 @@ -From f63a3690e3e3f02ab67ad1165be54ce25bac2de7 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Fri, 17 Jul 2020 11:28:08 +0200 -Subject: [PATCH] Adapt to new libsepol filename transition structures - -Adapt setools to the new libsepol internal API for filename transitions -which allows for more efficient filename trans rule representation in -memory and binary policy. - -Signed-off-by: Ondrej Mosnacek ---- - setools/policyrep/sepol.pxd | 9 ++++---- - setools/policyrep/terule.pxi | 41 ++++++++++++++++++++++++++++++------ - 2 files changed, 39 insertions(+), 11 deletions(-) - -diff --git a/setools/policyrep/sepol.pxd b/setools/policyrep/sepol.pxd -index 60bc58c28ebf..b07ddb78350f 100644 ---- a/setools/policyrep/sepol.pxd -+++ b/setools/policyrep/sepol.pxd -@@ -544,21 +544,22 @@ cdef extern from "": - ctypedef cond_bool_datum cond_bool_datum_t - - # -- # filename_trans_t -+ # filename_trans_key_t - # -- cdef struct filename_trans: -- uint32_t stype -+ cdef struct filename_trans_key: - uint32_t ttype - uint32_t tclass - char *name - -- ctypedef filename_trans filename_trans_t -+ ctypedef filename_trans_key filename_trans_key_t - - # - # filename_trans_datum_t - # - cdef struct filename_trans_datum: -+ ebitmap_t stypes - uint32_t otype -+ filename_trans_datum *next - - ctypedef filename_trans_datum filename_trans_datum_t - -diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi -index 3976586b7985..760c366f6c39 100644 ---- a/setools/policyrep/terule.pxi -+++ b/setools/policyrep/terule.pxi -@@ -470,17 +470,18 @@ cdef class FileNameTERule(BaseTERule): - readonly str filename - - @staticmethod -- cdef inline FileNameTERule factory(SELinuxPolicy policy, sepol.filename_trans_t *key, -- sepol.filename_trans_datum_t *datum): -+ cdef inline FileNameTERule factory(SELinuxPolicy policy, -+ sepol.filename_trans_key_t *key, -+ Type stype, size_t otype): - """Factory function for creating FileNameTERule objects.""" - cdef FileNameTERule r = FileNameTERule.__new__(FileNameTERule) - r.policy = policy - r.key = key - r.ruletype = TERuletype.type_transition -- r.source = type_or_attr_factory(policy, policy.type_value_to_datum(key.stype - 1)) -+ r.source = stype - r.target = type_or_attr_factory(policy, policy.type_value_to_datum(key.ttype - 1)) - r.tclass = ObjClass.factory(policy, policy.class_value_to_datum(key.tclass - 1)) -- r.dft = Type.factory(policy, policy.type_value_to_datum(datum.otype - 1)) -+ r.dft = Type.factory(policy, policy.type_value_to_datum(otype - 1)) - r.filename = intern(key.name) - r.origin = None - return r -@@ -708,6 +709,10 @@ cdef class FileNameTERuleIterator(HashtabIterator): - - """Iterate over FileNameTERules in the policy.""" - -+ cdef: -+ sepol.filename_trans_datum_t *datum -+ TypeEbitmapIterator stypei -+ - @staticmethod - cdef factory(SELinuxPolicy policy, sepol.hashtab_t *table): - """Factory function for creating FileNameTERule iterators.""" -@@ -717,7 +722,29 @@ cdef class FileNameTERuleIterator(HashtabIterator): - i.reset() - return i - -+ def _next_stype(self): -+ while True: -+ if self.datum == NULL: -+ super().__next__() -+ self.datum = self.curr.datum -+ self.stypei = TypeEbitmapIterator.factory(self.policy, &self.datum.stypes) -+ try: -+ return next(self.stypei) -+ except StopIteration: -+ pass -+ self.datum = self.datum.next -+ if self.datum != NULL: -+ self.stypei = TypeEbitmapIterator.factory(self.policy, &self.datum.stypes) -+ - def __next__(self): -- super().__next__() -- return FileNameTERule.factory(self.policy, self.curr.key, -- self.curr.datum) -+ stype = self._next_stype() -+ return FileNameTERule.factory(self.policy, -+ self.curr.key, -+ stype, self.datum.otype) -+ -+ def __len__(self): -+ return sum(1 for r in FileNameTERuleIterator.factory(self.policy, self.table)) -+ -+ def reset(self): -+ super().reset() -+ self.datum = NULL --- -2.29.0 - diff --git a/1001-Do-not-use-Werror-during-build.patch b/1001-Do-not-use-Werror-during-build.patch deleted file mode 100644 index 60f11e2..0000000 --- a/1001-Do-not-use-Werror-during-build.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 4b3dc6b38abbd32cda557d5ef9ea1383ac5fdcf2 Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Thu, 23 Feb 2017 08:17:07 +0100 -Subject: [PATCH 2/3] Do not use -Werror during build -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -There are new warnings when setools are built with gcc 7 therefore we -want to suppress -Werror for now - -Fixes: -libqpol/policy_extend.c: In function ‘policy_extend’: -libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=] - snprintf(buff, 9, "@ttr%04zd", i + 1); - ^~~~~ -libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295] - snprintf(buff, 9, "@ttr%04zd", i + 1); - ^~~~~~~~~~~ -In file included from /usr/include/stdio.h:939:0, - from /usr/include/sepol/policydb/policydb.h:53, - from libqpol/policy_extend.c:29: -/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9 - return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - __bos (__s), __fmt, __va_arg_pack ()); - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -cc1: all warnings being treated as errors -error: command 'gcc' failed with exit status 1 ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index c94daf1..a7442ac 100644 ---- a/setup.py -+++ b/setup.py -@@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], - libraries=['selinux', 'sepol'], - library_dirs=lib_dirs, - define_macros=macros, -- extra_compile_args=['-Werror', '-Wextra', -+ extra_compile_args=['-Wextra', - '-Waggregate-return', - '-Wfloat-equal', - '-Wformat', '-Wformat=2', --- -2.17.2 - diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 29ccc0e..d270d21 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From fa776e6abd019a7bdaca37486d714d307cbd332f Mon Sep 17 00:00:00 2001 +From e47d19f4985098ca316eea4a383510d419ec6055 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 26 Apr 2019 15:27:25 +0200 -Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and +Subject: [PATCH 1/2] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -86,10 +86,10 @@ index d72d343e7e79..642485b9018d 100644 from .diff import PolicyDifference diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 4608b9dbf34e..2cde44c142e9 100644 +index 62dbf04d9a5e..0ea000e790f0 100644 --- a/setoolsgui/apol/dta.py +++ b/setoolsgui/apol/dta.py -@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread +@@ -24,7 +24,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ QTreeWidgetItem @@ -97,9 +97,9 @@ index 4608b9dbf34e..2cde44c142e9 100644 +from setools.dta import DomainTransitionAnalysis from ..logtosignal import LogHandlerToSignal - from .analysistab import AnalysisTab + from .analysistab import AnalysisSection, AnalysisTab diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 7bca299d23fc..7fee2778f35f 100644 +index 28009aa2329c..92d350bf727c 100644 --- a/setoolsgui/apol/infoflow.py +++ b/setoolsgui/apol/infoflow.py @@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread @@ -138,5 +138,5 @@ index aa0e44a7e4f8..fca2848aeca5 100644 from setools.exception import InvalidType from setools.permmap import PermissionMap -- -2.26.0.rc2 +2.30.0 diff --git a/1003-Require-networkx-on-package-level.patch b/1003-Require-networkx-on-package-level.patch index 46e9a4d..99eb500 100644 --- a/1003-Require-networkx-on-package-level.patch +++ b/1003-Require-networkx-on-package-level.patch @@ -1,7 +1,7 @@ -From a2faa263c9dd8bcf51465861046e0406a84975c0 Mon Sep 17 00:00:00 2001 +From 7b73bdeda54b9c944774452bfa3b3c1f2733b3f0 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 2 Apr 2020 16:06:14 +0200 -Subject: [PATCH] Require networkx on package level +Subject: [PATCH 2/2] Require networkx on package level It allows us to ship python3-setools without dependency on python3-networkx --- @@ -9,10 +9,10 @@ It allows us to ship python3-setools without dependency on python3-networkx 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 457c83049ca5..4bfd438002bb 100644 +index c593b786cc61..0551811e3fd1 100644 --- a/setup.py +++ b/setup.py -@@ -170,5 +170,5 @@ setup(name='setools', +@@ -163,5 +163,5 @@ setup(name='setools', # setup also requires libsepol and libselinux # C libraries and headers to compile. setup_requires=['setuptools', 'Cython>=0.27'], @@ -20,5 +20,5 @@ index 457c83049ca5..4bfd438002bb 100644 + install_requires=['setuptools'] ) -- -2.26.0.rc2 +2.30.0 diff --git a/setools.spec b/setools.spec index a91914d..1fcc16e 100644 --- a/setools.spec +++ b/setools.spec @@ -1,13 +1,13 @@ -%global setools_pre_ver 05e90ee -%global gitver 05e90ee241af05665f3394e9bed0073e1bb2e17d +%global setools_pre_ver 16c0696 +%global gitver 16c069631e1652801b1a6c41c6607b7326fc15f0 -%global sepol_ver 3.1-4 -%global selinux_ver 3.1-4 +%global sepol_ver 3.2-0.rc1 +%global selinux_ver 3.2-0.rc1 Name: setools Version: 4.4.0 -Release: 0.2.20201102git%{setools_pre_ver}%{?dist} +Release: 0.2.20210121git%{setools_pre_ver}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -15,8 +15,6 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{setools_pre_ver}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch0001: 0001-Adapt-to-new-libsepol-filename-transition-structures.patch -Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 @@ -147,6 +145,10 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Jan 21 2021 Petr Lautrbach - 4.4.0-0.2.20210121git16c0696 +- Rebuild with SELinux userspace 3.2-rc1 +- Update to 16c0696 + * Thu Dec 10 2020 Petr Lautrbach - 4.4.0-0.2.20201102git05e90ee - Fix imports in /usr/bin/sedta diff --git a/sources b/sources index e13005d..add220c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (05e90ee.tar.gz) = 32f60e9a40ca5791a1e63986377e90ca728c7e205d8ae7ce446830ca7f96b51496d9753fd70077f5b6547050d23c41a1d10b20e0af9e4066355e29781d5e3686 +SHA512 (16c0696.tar.gz) = 1c9a2e8daf6e131bfe2e2e1cea1ed2caa190486af152048e3b79ab88fcd0a20c030b08986d1dd6ee4079841985b47c366435177bb206e68ea567ecee32037358 From 041e7a130b9c1188014fa6f63284f2b621407daf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 20:15:12 +0000 Subject: [PATCH 066/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 1fcc16e..f582d75 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.4.0 -Release: 0.2.20210121git%{setools_pre_ver}%{?dist} +Release: 0.3.20210121git%{setools_pre_ver}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -145,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 4.4.0-0.3.20210121git16c0696 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Thu Jan 21 2021 Petr Lautrbach - 4.4.0-0.2.20210121git16c0696 - Rebuild with SELinux userspace 3.2-rc1 - Update to 16c0696 From f7e6d7dcb5b785e3c1ce4c888ebfc59bb3befa50 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 8 Mar 2021 18:01:35 +0100 Subject: [PATCH 067/111] SETools 4.4.0 release --- .gitignore | 1 + setools.spec | 17 ++++++++--------- sources | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index a46f24a..229213b 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.3.0.tar.gz /05e90ee.tar.gz /16c0696.tar.gz +/4.4.0.tar.gz diff --git a/setools.spec b/setools.spec index f582d75..ed3c2c6 100644 --- a/setools.spec +++ b/setools.spec @@ -1,18 +1,14 @@ -%global setools_pre_ver 16c0696 -%global gitver 16c069631e1652801b1a6c41c6607b7326fc15f0 - -%global sepol_ver 3.2-0.rc1 -%global selinux_ver 3.2-0.rc1 - +%global sepol_ver 3.2-1 +%global selinux_ver 3.2-1 Name: setools Version: 4.4.0 -Release: 0.3.20210121git%{setools_pre_ver}%{?dist} +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 URL: https://github.com/SELinuxProject/setools/wiki -Source0: https://github.com/SELinuxProject/setools/archive/%{setools_pre_ver}.tar.gz +Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -94,7 +90,7 @@ Python modules designed to facilitate SELinux policy analysis. %prep -%autosetup -p 1 -S git -n setools-%{gitver} +%autosetup -p 1 -S git -n setools-%{version} %build @@ -145,6 +141,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Mar 8 2021 Petr Lautrbach - 4.4.0-1 +- SETools 4.4.0 release + * Wed Jan 27 2021 Fedora Release Engineering - 4.4.0-0.3.20210121git16c0696 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index add220c..dbc6493 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (16c0696.tar.gz) = 1c9a2e8daf6e131bfe2e2e1cea1ed2caa190486af152048e3b79ab88fcd0a20c030b08986d1dd6ee4079841985b47c366435177bb206e68ea567ecee32037358 +SHA512 (4.4.0.tar.gz) = 4033ce54213e47e3afd1bdb03b99b0ee3d977f085310d746b34dcfcfe48ac3a562ae0aa2f730d629a298b56dbf295ad219669d13f82578521866b465f8c976e8 From d39a6454a2477ba5303af47d01c4eb9771586b8e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 4 Jun 2021 21:14:41 +0200 Subject: [PATCH 068/111] Rebuilt for Python 3.10 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index ed3c2c6..0090f23 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -141,6 +141,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Jun 04 2021 Python Maint - 4.4.0-2 +- Rebuilt for Python 3.10 + * Mon Mar 8 2021 Petr Lautrbach - 4.4.0-1 - SETools 4.4.0 release From d6eb24d48f36f6765fb014fc61d37502c7da9fa3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 17:24:51 +0000 Subject: [PATCH 069/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 0090f23..1e947d1 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -141,6 +141,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 4.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri Jun 04 2021 Python Maint - 4.4.0-2 - Rebuilt for Python 3.10 From 396291943be7d15ea2053f0bcf05959b4c76b591 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 19 Nov 2021 12:55:09 +0100 Subject: [PATCH 070/111] Make seinfo output predictable https://github.com/SELinuxProject/setools/issues/65 --- 0001-Make-seinfo-output-predictable.patch | 90 +++++++++++++++++++++++ setools.spec | 1 + 2 files changed, 91 insertions(+) create mode 100644 0001-Make-seinfo-output-predictable.patch diff --git a/0001-Make-seinfo-output-predictable.patch b/0001-Make-seinfo-output-predictable.patch new file mode 100644 index 0000000..aa650fe --- /dev/null +++ b/0001-Make-seinfo-output-predictable.patch @@ -0,0 +1,90 @@ +From 8ed316d6bfb65e5e9b57f3761ea8490022ab3a05 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Thu, 18 Nov 2021 13:59:08 +0100 +Subject: [PATCH] Make seinfo output predictable + +There are few places where frozenset is used. Given that frozenset is an unordered +collection the output generated from this is unpredictable. + +The following command outputs are fixed using sorted() on frozensets: + + seinfo --constrain + seinfo --common + seinfo -c -x + seinfo -r -x + seinfo -u -x + +Fixes: https://github.com/SELinuxProject/setools/issues/65 + +Signed-off-by: Petr Lautrbach +--- + setools/policyrep/constraint.pxi | 2 +- + setools/policyrep/objclass.pxi | 4 ++-- + setools/policyrep/role.pxi | 2 +- + setools/policyrep/user.pxi | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/setools/policyrep/constraint.pxi b/setools/policyrep/constraint.pxi +index 01c63d87425b..0b4c5b9bcf6a 100644 +--- a/setools/policyrep/constraint.pxi ++++ b/setools/policyrep/constraint.pxi +@@ -72,7 +72,7 @@ cdef class Constraint(BaseConstraint): + + def statement(self): + if len(self.perms) > 1: +- perms = "{{ {0} }}".format(' '.join(self.perms)) ++ perms = "{{ {0} }}".format(' '.join(sorted(self.perms))) + else: + # convert to list since sets cannot be indexed + perms = list(self.perms)[0] +diff --git a/setools/policyrep/objclass.pxi b/setools/policyrep/objclass.pxi +index b7ec7b7de5c3..8ed2be5a9bed 100644 +--- a/setools/policyrep/objclass.pxi ++++ b/setools/policyrep/objclass.pxi +@@ -75,7 +75,7 @@ cdef class Common(PolicySymbol): + return other in self.perms + + def statement(self): +- return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(self.perms)) ++ return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(sorted(self.perms))) + + + cdef class ObjClass(PolicySymbol): +@@ -204,7 +204,7 @@ cdef class ObjClass(PolicySymbol): + + # a class that inherits may not have additional permissions + if len(self.perms) > 0: +- stmt += "{{\n\t{0}\n}}".format('\n\t'.join(self.perms)) ++ stmt += "{{\n\t{0}\n}}".format('\n\t'.join(sorted(self.perms))) + + return stmt + +diff --git a/setools/policyrep/role.pxi b/setools/policyrep/role.pxi +index 9a0dd39f27d9..3af8a3f72a1f 100644 +--- a/setools/policyrep/role.pxi ++++ b/setools/policyrep/role.pxi +@@ -58,7 +58,7 @@ cdef class Role(PolicySymbol): + if count == 1: + stmt += " types {0}".format(types[0]) + else: +- stmt += " types {{ {0} }}".format(' '.join(types)) ++ stmt += " types {{ {0} }}".format(' '.join(sorted(types))) + + stmt += ";" + return stmt +diff --git a/setools/policyrep/user.pxi b/setools/policyrep/user.pxi +index 9c82aa92eb72..e37af2939820 100644 +--- a/setools/policyrep/user.pxi ++++ b/setools/policyrep/user.pxi +@@ -81,7 +81,7 @@ cdef class User(PolicySymbol): + if count == 1: + stmt += roles[0] + else: +- stmt += "{{ {0} }}".format(' '.join(roles)) ++ stmt += "{{ {0} }}".format(' '.join(sorted(roles))) + + if self._level: + stmt += " level {0.mls_level} range {0.mls_range};".format(self) +-- +2.33.1 + diff --git a/setools.spec b/setools.spec index 1e947d1..59ad27b 100644 --- a/setools.spec +++ b/setools.spec @@ -11,6 +11,7 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch0001: 0001-Make-seinfo-output-predictable.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 From 57856212830a399ce79bff7e4864406c9f460c8a Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 19 Nov 2021 12:56:24 +0100 Subject: [PATCH 071/111] setools-4.4.0-4 - Make seinfo output predictable https://github.com/SELinuxProject/setools/issues/65 --- setools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 59ad27b..88800a9 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -142,6 +142,10 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Nov 19 2021 Petr Lautrbach - 4.4.0-4 +- Make seinfo output predictable + https://github.com/SELinuxProject/setools/issues/65 + * Fri Jul 23 2021 Fedora Release Engineering - 4.4.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From cd558df935c640b1c6d3d7b701e1d2850b0490da Mon Sep 17 00:00:00 2001 From: Aleksandra Fedorova Date: Wed, 10 Nov 2021 11:43:13 +0000 Subject: [PATCH 072/111] setools package is allowed to be empty Configure rpminspect to recognize setools as meta-package which is allowed to be empty. --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..6bcfaca --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,3 @@ +emptyrpm: + expected_empty: + - setools From c77a77e39c0672701cb5f66db70a80dee187f893 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 23 Nov 2021 15:53:17 +0100 Subject: [PATCH 073/111] Add seinfo-consistent-output test Check whether different 2 or more runs of same seinfo commands produce same output --- .../Sanity/seinfo-consistent-output/Makefile | 64 +++++++++++++++++++ tests/Sanity/seinfo-consistent-output/PURPOSE | 3 + .../seinfo-consistent-output/runtest.sh | 64 +++++++++++++++++++ tests/tests.yml | 1 + 4 files changed, 132 insertions(+) create mode 100644 tests/Sanity/seinfo-consistent-output/Makefile create mode 100644 tests/Sanity/seinfo-consistent-output/PURPOSE create mode 100755 tests/Sanity/seinfo-consistent-output/runtest.sh diff --git a/tests/Sanity/seinfo-consistent-output/Makefile b/tests/Sanity/seinfo-consistent-output/Makefile new file mode 100644 index 0000000..e8bd655 --- /dev/null +++ b/tests/Sanity/seinfo-consistent-output/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of Sanity/seinfo-consistent-output +# Description: Check whether different 2 or more runs of same seinfo commands produce same output +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=Sanity/seinfo-consistent-output +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Lautrbach " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Check whether different 2 or more runs of same seinfo commands produce same output" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 2019962" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/Sanity/seinfo-consistent-output/PURPOSE b/tests/Sanity/seinfo-consistent-output/PURPOSE new file mode 100644 index 0000000..3202eb9 --- /dev/null +++ b/tests/Sanity/seinfo-consistent-output/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of Sanity/seinfo-consistent-output +Description: Check whether different 2 or more runs of same seinfo commands produce same output +Author: Petr Lautrbach diff --git a/tests/Sanity/seinfo-consistent-output/runtest.sh b/tests/Sanity/seinfo-consistent-output/runtest.sh new file mode 100755 index 0000000..da49081 --- /dev/null +++ b/tests/Sanity/seinfo-consistent-output/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of Sanity/seinfo-consistent-output +# Description: Check whether different 2 or more runs of same seinfo commands produce same output +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setools-console" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + commands=( + "seinfo --all -x" + "seinfo --constrain" + "seinfo --common" + "seinfo -c -x" + "seinfo -r -x" + "seinfo -u -x" + ) + + for c in "${commands[@]}"; do + + rlPhaseStartTest "$c" + rlRun "$c > 1.out" + rlRun "$c > 2.out" + rlRun "cmp 1.out 2.out" 0 + rlPhaseEnd + done + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml index f1c994e..c840ce4 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -19,3 +19,4 @@ tests: - Sanity/sedta - Regression/The-setools-package-doesn-t-install-any-tools + - Sanity/seinfo-consistent-output From 493b35df7bb1838945a763aa8ba327844e7e27b0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 00:43:52 +0000 Subject: [PATCH 074/111] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 88800a9..70666ee 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -142,6 +142,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 4.4.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Fri Nov 19 2021 Petr Lautrbach - 4.4.0-4 - Make seinfo output predictable https://github.com/SELinuxProject/setools/issues/65 From 9a9e7b5d7e0de43398c65bbc25f1e224a7d069bf Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 13 Jun 2022 16:03:16 +0200 Subject: [PATCH 075/111] Rebuilt for Python 3.11 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 70666ee..204fc5f 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -142,6 +142,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Jun 13 2022 Python Maint - 4.4.0-6 +- Rebuilt for Python 3.11 + * Sat Jan 22 2022 Fedora Release Engineering - 4.4.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 8b928d80e883b3bb330dd0b1621ee6c7b6196f5a Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 10 Jun 2022 10:33:57 +0200 Subject: [PATCH 076/111] Drop unnecessary Recommends --- setools.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/setools.spec b/setools.spec index 204fc5f..fe34f2a 100644 --- a/setools.spec +++ b/setools.spec @@ -70,7 +70,6 @@ This package includes the following console tools: %package -n python3-setools Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0 -Recommends: libselinux-python3 %{?python_provide:%python_provide python3-setools} Requires: python3-setuptools From 69eb1aef5e976638f7011a420167b05bb5a36ac3 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 10 Jun 2022 10:38:13 +0200 Subject: [PATCH 077/111] Update required userspace versions to 3.4 --- setools.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index fe34f2a..9319544 100644 --- a/setools.spec +++ b/setools.spec @@ -1,5 +1,5 @@ -%global sepol_ver 3.2-1 -%global selinux_ver 3.2-1 +%global sepol_ver 3.4-1 +%global selinux_ver 3.4-1 Name: setools Version: 4.4.0 From d8501aad3c6c59f42519ac9b04ea49fb90f7cbd8 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 10 Jun 2022 10:39:38 +0200 Subject: [PATCH 078/111] setools-4.4.0-7 - Update required userspace versions to 3.4 - Drop unnecessary Recommends --- setools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 9319544..a045042 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -141,6 +141,10 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Jun 13 2022 Petr Lautrbach - 4.4.0-7 +- Update required userspace versions to 3.4 +- Drop unnecessary Recommends + * Mon Jun 13 2022 Python Maint - 4.4.0-6 - Rebuilt for Python 3.11 From 17d137e6585fbd3bc0661fd5ae9e1a42bf9218d5 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 16 Jun 2022 13:34:36 +0200 Subject: [PATCH 079/111] Rebuilt for Python 3.11 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a045042..e421441 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -141,6 +141,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Jun 16 2022 Python Maint - 4.4.0-8 +- Rebuilt for Python 3.11 + * Mon Jun 13 2022 Petr Lautrbach - 4.4.0-7 - Update required userspace versions to 3.4 - Drop unnecessary Recommends From 392fa030724c2eb4733c4fd1ec066ac899788d19 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:25:45 +0000 Subject: [PATCH 080/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index e421441..900aa3e 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -141,6 +141,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 4.4.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Jun 16 2022 Python Maint - 4.4.0-8 - Rebuilt for Python 3.11 From 3c2ac38dafb8812bcbacb851b7af2499800248c3 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 10 Nov 2022 09:29:45 +0100 Subject: [PATCH 081/111] Migrate License tag to SPDX https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- setools.spec | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/setools.spec b/setools.spec index 900aa3e..fd05991 100644 --- a/setools.spec +++ b/setools.spec @@ -6,7 +6,7 @@ Version: 4.4.0 Release: 9%{?dist} Summary: Policy analysis tools for SELinux -License: GPLv2 +License: GPL-2.0-only and LGPL-2.1-only URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam @@ -35,7 +35,7 @@ Python modules designed to facilitate SELinux policy analysis. %package console Summary: Policy analysis command-line tools for SELinux -License: GPLv2 +License: GPL-2.0-only Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} @@ -52,7 +52,7 @@ This package includes the following console tools: %package console-analyses Summary: Policy analysis command-line tools for SELinux -License: GPLv2 +License: GPL-2.0-only Requires: python3-setools = %{version}-%{release} Requires: libselinux >= %{selinux_ver} Requires: python3-networkx @@ -68,7 +68,8 @@ This package includes the following console tools: %package -n python3-setools -Summary: Policy analysis tools for SELinux +Summary: Policy analysis tools for SELinux +License: LGPL-2.1-only Obsoletes: setools-libs < 4.0.0 %{?python_provide:%python_provide python3-setools} Requires: python3-setuptools @@ -80,6 +81,7 @@ Python 3 modules designed to facilitate SELinux policy analysis. %package gui Summary: Policy analysis graphical tools for SELinux +License: GPL-2.0-only Requires: python3-setools = %{version}-%{release} Requires: python3-qt5 Requires: python3-networkx @@ -109,6 +111,7 @@ Python modules designed to facilitate SELinux policy analysis. %files %files console +%license COPYING.GPL %{_bindir}/sechecker %{_bindir}/sediff %{_bindir}/seinfo @@ -122,6 +125,7 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/sesearch* %files console-analyses +%license COPYING.GPL %{_bindir}/sedta %{_bindir}/seinfoflow %{_mandir}/man1/sedta* @@ -130,11 +134,12 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/seinfoflow* %files -n python3-setools -%license COPYING COPYING.GPL COPYING.LGPL +%license COPYING COPYING.LGPL %{python3_sitearch}/setools %{python3_sitearch}/setools-* %files gui +%license COPYING.GPL %{_bindir}/apol %{python3_sitearch}/setoolsgui %{_mandir}/man1/apol* From e19a208cf3ec04363d504b29efba19f2d8d2519b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 11 Jul 2022 13:33:22 +0200 Subject: [PATCH 082/111] run tests via TMT/FMF Use the TMT/FMF instead of STI for running tests. STI does not respect the adjust section in main.fmf files of stored tests. --- .fmf/version | 1 + plans/selinux.fmf | 7 +++++ plans/tests.fmf | 5 ++++ .../main.fmf | 11 +++++++ .../runtest.sh | 1 - tests/Sanity/sedta/main.fmf | 30 +++++++++++++++++++ .../Sanity/seinfo-consistent-output/main.fmf | 15 ++++++++++ .../seinfo-consistent-output/runtest.sh | 1 - tests/tests.yml | 22 -------------- 9 files changed, 69 insertions(+), 24 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/selinux.fmf create mode 100644 plans/tests.fmf create mode 100644 tests/Regression/The-setools-package-doesn-t-install-any-tools/main.fmf create mode 100644 tests/Sanity/sedta/main.fmf create mode 100644 tests/Sanity/seinfo-consistent-output/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/selinux.fmf b/plans/selinux.fmf new file mode 100644 index 0000000..b20003c --- /dev/null +++ b/plans/selinux.fmf @@ -0,0 +1,7 @@ +summary: selinux tests - Tier 1 | policycoreutils | checkpolicy +discover: + how: fmf + url: https://src.fedoraproject.org/tests/selinux + filter: "tier: 1 | component: policycoreutils | component: checkpolicy" +execute: + how: tmt diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..1caffcc --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,5 @@ +summary: setools test plan +discover: + how: fmf +execute: + how: tmt diff --git a/tests/Regression/The-setools-package-doesn-t-install-any-tools/main.fmf b/tests/Regression/The-setools-package-doesn-t-install-any-tools/main.fmf new file mode 100644 index 0000000..11ff640 --- /dev/null +++ b/tests/Regression/The-setools-package-doesn-t-install-any-tools/main.fmf @@ -0,0 +1,11 @@ +summary: Make sure setools requires setools-console and setools-gui +contact: Vit Mojzis +component: + - setools +test: ./runtest.sh +framework: beakerlib +duration: 5m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820078 +extra-summary: /CoreOS/setools/Regression/The-setools-package-doesn-t-install-any-tools +extra-task: /CoreOS/setools/Regression/The-setools-package-doesn-t-install-any-tools diff --git a/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh b/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh index 16267ce..ad83754 100755 --- a/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh +++ b/tests/Regression/The-setools-package-doesn-t-install-any-tools/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="setools" diff --git a/tests/Sanity/sedta/main.fmf b/tests/Sanity/sedta/main.fmf new file mode 100644 index 0000000..e0c2de1 --- /dev/null +++ b/tests/Sanity/sedta/main.fmf @@ -0,0 +1,30 @@ +summary: Does sedta work as expected? Does it support all features? +description: '' +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - git + - policycoreutils + - setools-console-analyses +duration: 1h +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPfail_Security + - f32friendly + - f33friendly + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0604139 +extra-summary: /CoreOS/setools/Sanity/sedta +extra-task: /CoreOS/setools/Sanity/sedta diff --git a/tests/Sanity/seinfo-consistent-output/main.fmf b/tests/Sanity/seinfo-consistent-output/main.fmf new file mode 100644 index 0000000..1c908d7 --- /dev/null +++ b/tests/Sanity/seinfo-consistent-output/main.fmf @@ -0,0 +1,15 @@ +summary: Check whether different 2 or more runs of same seinfo commands produce same + output +description: '' +contact: Petr Lautrbach +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - setools-console +duration: 5m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019962 +extra-summary: Sanity/seinfo-consistent-output +extra-task: Sanity/seinfo-consistent-output diff --git a/tests/Sanity/seinfo-consistent-output/runtest.sh b/tests/Sanity/seinfo-consistent-output/runtest.sh index da49081..0ad39a7 100755 --- a/tests/Sanity/seinfo-consistent-output/runtest.sh +++ b/tests/Sanity/seinfo-consistent-output/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="setools-console" diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index c840ce4..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# Test to run in classic context -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/selinux.git" - dest: "selinux" - fmf_filter: "tier: 1 | component: policycoreutils | component: checkpolicy" - -# Test to run in classic context -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - Sanity/sedta - - Regression/The-setools-package-doesn-t-install-any-tools - - Sanity/seinfo-consistent-output From 67bdb1e7a5e035ec63e6a61a503c6481dfb93f9b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 03:03:21 +0000 Subject: [PATCH 083/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index fd05991..7d03425 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.0 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -146,6 +146,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 4.4.0-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 4.4.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From fa44d11ed86378c030fd6e21ae1b81af0b6de049 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 7 Feb 2023 13:25:35 +0100 Subject: [PATCH 084/111] SETools 4.4.1 release --- .gitignore | 1 + 0001-Make-NetworkX-optional.patch | 91 +++++++++++ 0001-Make-seinfo-output-predictable.patch | 90 ----------- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 142 ------------------ setools.spec | 10 +- sources | 2 +- 6 files changed, 99 insertions(+), 237 deletions(-) create mode 100644 0001-Make-NetworkX-optional.patch delete mode 100644 0001-Make-seinfo-output-predictable.patch delete mode 100644 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch diff --git a/.gitignore b/.gitignore index 229213b..282a656 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /05e90ee.tar.gz /16c0696.tar.gz /4.4.0.tar.gz +/4.4.1.tar.gz diff --git a/0001-Make-NetworkX-optional.patch b/0001-Make-NetworkX-optional.patch new file mode 100644 index 0000000..c573d45 --- /dev/null +++ b/0001-Make-NetworkX-optional.patch @@ -0,0 +1,91 @@ +From 716a1d9e1db6701c0b310dd7e10dc4a10656da0f Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Tue, 14 Dec 2021 14:24:20 -0500 +Subject: [PATCH] Make NetworkX optional. +Content-type: text/plain + +The CLI tools get installed to most distros, but sedta and seinfoflow are +not typically used or separated into a different package. This will allow +seinfo, sesearch, and sediff to function if NetworkX is missing, since they +don't require it. + +Signed-off-by: Chris PeBenito +--- + setools/dta.py | 18 ++++++++++++++---- + setools/infoflow.py | 17 +++++++++++++---- + 2 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/setools/dta.py b/setools/dta.py +index ce5a36463684..ded88ff4f615 100644 +--- a/setools/dta.py ++++ b/setools/dta.py +@@ -10,8 +10,11 @@ from collections import defaultdict + from contextlib import suppress + from typing import DefaultDict, Iterable, List, NamedTuple, Optional, Union + +-import networkx as nx +-from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound ++try: ++ import networkx as nx ++ from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound ++except ImportError: ++ logging.getLogger(__name__).debug("NetworkX failed to import.") + + from .descriptors import EdgeAttrDict, EdgeAttrList + from .policyrep import AnyTERule, SELinuxPolicy, TERuletype, Type +@@ -73,8 +76,15 @@ class DomainTransitionAnalysis: + self.reverse = reverse + self.rebuildgraph = True + self.rebuildsubgraph = True +- self.G = nx.DiGraph() +- self.subG = self.G.copy() ++ ++ try: ++ self.G = nx.DiGraph() ++ self.subG = self.G.copy() ++ except NameError: ++ self.log.critical("NetworkX is not available. This is " ++ "requried for Domain Transition Analysis.") ++ self.log.critical("This is typically in the python3-networkx package.") ++ raise + + @property + def reverse(self) -> bool: +diff --git a/setools/infoflow.py b/setools/infoflow.py +index 0ef240a9993f..4b94a0c2d6dd 100644 +--- a/setools/infoflow.py ++++ b/setools/infoflow.py +@@ -7,8 +7,11 @@ import logging + from contextlib import suppress + from typing import cast, Iterable, List, Mapping, Optional, Union + +-import networkx as nx +-from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound ++try: ++ import networkx as nx ++ from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound ++except ImportError: ++ logging.getLogger(__name__).debug("NetworkX failed to import.") + + from .descriptors import EdgeAttrIntMax, EdgeAttrList + from .permmap import PermissionMap +@@ -54,8 +57,14 @@ class InfoFlowAnalysis: + self.rebuildgraph = True + self.rebuildsubgraph = True + +- self.G = nx.DiGraph() +- self.subG = self.G.copy() ++ try: ++ self.G = nx.DiGraph() ++ self.subG = self.G.copy() ++ except NameError: ++ self.log.critical("NetworkX is not available. This is " ++ "requried for Information Flow Analysis.") ++ self.log.critical("This is typically in the python3-networkx package.") ++ raise + + @property + def min_weight(self) -> int: +-- +2.39.1 + diff --git a/0001-Make-seinfo-output-predictable.patch b/0001-Make-seinfo-output-predictable.patch deleted file mode 100644 index aa650fe..0000000 --- a/0001-Make-seinfo-output-predictable.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 8ed316d6bfb65e5e9b57f3761ea8490022ab3a05 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 18 Nov 2021 13:59:08 +0100 -Subject: [PATCH] Make seinfo output predictable - -There are few places where frozenset is used. Given that frozenset is an unordered -collection the output generated from this is unpredictable. - -The following command outputs are fixed using sorted() on frozensets: - - seinfo --constrain - seinfo --common - seinfo -c -x - seinfo -r -x - seinfo -u -x - -Fixes: https://github.com/SELinuxProject/setools/issues/65 - -Signed-off-by: Petr Lautrbach ---- - setools/policyrep/constraint.pxi | 2 +- - setools/policyrep/objclass.pxi | 4 ++-- - setools/policyrep/role.pxi | 2 +- - setools/policyrep/user.pxi | 2 +- - 4 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/setools/policyrep/constraint.pxi b/setools/policyrep/constraint.pxi -index 01c63d87425b..0b4c5b9bcf6a 100644 ---- a/setools/policyrep/constraint.pxi -+++ b/setools/policyrep/constraint.pxi -@@ -72,7 +72,7 @@ cdef class Constraint(BaseConstraint): - - def statement(self): - if len(self.perms) > 1: -- perms = "{{ {0} }}".format(' '.join(self.perms)) -+ perms = "{{ {0} }}".format(' '.join(sorted(self.perms))) - else: - # convert to list since sets cannot be indexed - perms = list(self.perms)[0] -diff --git a/setools/policyrep/objclass.pxi b/setools/policyrep/objclass.pxi -index b7ec7b7de5c3..8ed2be5a9bed 100644 ---- a/setools/policyrep/objclass.pxi -+++ b/setools/policyrep/objclass.pxi -@@ -75,7 +75,7 @@ cdef class Common(PolicySymbol): - return other in self.perms - - def statement(self): -- return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(self.perms)) -+ return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(sorted(self.perms))) - - - cdef class ObjClass(PolicySymbol): -@@ -204,7 +204,7 @@ cdef class ObjClass(PolicySymbol): - - # a class that inherits may not have additional permissions - if len(self.perms) > 0: -- stmt += "{{\n\t{0}\n}}".format('\n\t'.join(self.perms)) -+ stmt += "{{\n\t{0}\n}}".format('\n\t'.join(sorted(self.perms))) - - return stmt - -diff --git a/setools/policyrep/role.pxi b/setools/policyrep/role.pxi -index 9a0dd39f27d9..3af8a3f72a1f 100644 ---- a/setools/policyrep/role.pxi -+++ b/setools/policyrep/role.pxi -@@ -58,7 +58,7 @@ cdef class Role(PolicySymbol): - if count == 1: - stmt += " types {0}".format(types[0]) - else: -- stmt += " types {{ {0} }}".format(' '.join(types)) -+ stmt += " types {{ {0} }}".format(' '.join(sorted(types))) - - stmt += ";" - return stmt -diff --git a/setools/policyrep/user.pxi b/setools/policyrep/user.pxi -index 9c82aa92eb72..e37af2939820 100644 ---- a/setools/policyrep/user.pxi -+++ b/setools/policyrep/user.pxi -@@ -81,7 +81,7 @@ cdef class User(PolicySymbol): - if count == 1: - stmt += roles[0] - else: -- stmt += "{{ {0} }}".format(' '.join(roles)) -+ stmt += "{{ {0} }}".format(' '.join(sorted(roles))) - - if self._level: - stmt += " level {0.mls_level} range {0.mls_range};".format(self) --- -2.33.1 - diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch deleted file mode 100644 index d270d21..0000000 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ /dev/null @@ -1,142 +0,0 @@ -From e47d19f4985098ca316eea4a383510d419ec6055 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Fri, 26 Apr 2019 15:27:25 +0200 -Subject: [PATCH 1/2] Do not export/use setools.InfoFlowAnalysis and - setools.DomainTransitionAnalysis - -dta and infoflow modules require networkx which brings lot of dependencies. -These dependencies are not necessary for setools module itself as it's -used in policycoreutils. - -Therefore it's better to use setools.infoflow.InfoFlowAnalysis and -setools.dta.DomainTransitionAnalysis and let the package containing -sedta and seinfoflow to require python3-networkx ---- - sedta | 5 +++-- - seinfoflow | 4 ++-- - setools/__init__.py | 4 ---- - setoolsgui/apol/dta.py | 2 +- - setoolsgui/apol/infoflow.py | 2 +- - tests/dta.py | 2 +- - tests/infoflow.py | 2 +- - 7 files changed, 9 insertions(+), 12 deletions(-) - -diff --git a/sedta b/sedta -index 57070098fe10..51890ea8ea73 100755 ---- a/sedta -+++ b/sedta -@@ -23,9 +23,10 @@ import logging - import signal - - import setools -+import setools.dta - - --def print_transition(trans: setools.DomainTransition) -> None: -+def print_transition(trans: setools.dta.DomainTransition) -> None: - if trans.transition: - print("Domain transition rule(s):") - for t in trans.transition: -@@ -114,7 +115,7 @@ else: - - try: - p = setools.SELinuxPolicy(args.policy) -- g = setools.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude) -+ g = setools.dta.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude) - - if args.shortest_path or args.all_paths: - if args.shortest_path: -diff --git a/seinfoflow b/seinfoflow -index 0ddcfdc7c1fb..8321718b2640 100755 ---- a/seinfoflow -+++ b/seinfoflow -@@ -17,7 +17,7 @@ - # along with SETools. If not, see . - # - --import setools -+import setools.infoflow - import argparse - import sys - import logging -@@ -102,7 +102,7 @@ elif args.booleans is not None: - try: - p = setools.SELinuxPolicy(args.policy) - m = setools.PermissionMap(args.map) -- g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, -+ g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude, - booleans=booleans) - - if args.shortest_path or args.all_paths: -diff --git a/setools/__init__.py b/setools/__init__.py -index d72d343e7e79..642485b9018d 100644 ---- a/setools/__init__.py -+++ b/setools/__init__.py -@@ -91,12 +91,8 @@ from .pcideviceconquery import PcideviceconQuery - from .devicetreeconquery import DevicetreeconQuery - - # Information Flow Analysis --from .infoflow import InfoFlowAnalysis - from .permmap import PermissionMap, RuleWeight, Mapping - --# Domain Transition Analysis --from .dta import DomainTransitionAnalysis, DomainEntrypoint, DomainTransition -- - # Policy difference - from .diff import PolicyDifference - -diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 62dbf04d9a5e..0ea000e790f0 100644 ---- a/setoolsgui/apol/dta.py -+++ b/setoolsgui/apol/dta.py -@@ -24,7 +24,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread - from PyQt5.QtGui import QPalette, QTextCursor - from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem --from setools import DomainTransitionAnalysis -+from setools.dta import DomainTransitionAnalysis - - from ..logtosignal import LogHandlerToSignal - from .analysistab import AnalysisSection, AnalysisTab -diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 28009aa2329c..92d350bf727c 100644 ---- a/setoolsgui/apol/infoflow.py -+++ b/setoolsgui/apol/infoflow.py -@@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread - from PyQt5.QtGui import QPalette, QTextCursor - from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem --from setools import InfoFlowAnalysis -+from setools.infoflow import InfoFlowAnalysis - from setools.exception import UnmappedClass, UnmappedPermission - - from ..logtosignal import LogHandlerToSignal -diff --git a/tests/dta.py b/tests/dta.py -index a0cc9381469c..177e6fb0b961 100644 ---- a/tests/dta.py -+++ b/tests/dta.py -@@ -18,7 +18,7 @@ - import os - import unittest - --from setools import DomainTransitionAnalysis -+from setools.dta import DomainTransitionAnalysis - from setools import TERuletype as TERT - from setools.exception import InvalidType - from setools.policyrep import Type -diff --git a/tests/infoflow.py b/tests/infoflow.py -index aa0e44a7e4f8..fca2848aeca5 100644 ---- a/tests/infoflow.py -+++ b/tests/infoflow.py -@@ -18,7 +18,7 @@ - import os - import unittest - --from setools import InfoFlowAnalysis -+from setools.infoflow import InfoFlowAnalysis - from setools import TERuletype as TERT - from setools.exception import InvalidType - from setools.permmap import PermissionMap --- -2.30.0 - diff --git a/setools.spec b/setools.spec index 7d03425..6c9edaf 100644 --- a/setools.spec +++ b/setools.spec @@ -2,8 +2,8 @@ %global selinux_ver 3.4-1 Name: setools -Version: 4.4.0 -Release: 10%{?dist} +Version: 4.4.1 +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,8 +11,7 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch0001: 0001-Make-seinfo-output-predictable.patch -Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +Patch0001: 0001-Make-NetworkX-optional.patch Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -146,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Feb 6 2023 Petr Lautrbach - 4.4.1-1 +- SETools 4.4.1 release + * Sat Jan 21 2023 Fedora Release Engineering - 4.4.0-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index dbc6493..f46a001 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.4.0.tar.gz) = 4033ce54213e47e3afd1bdb03b99b0ee3d977f085310d746b34dcfcfe48ac3a562ae0aa2f730d629a298b56dbf295ad219669d13f82578521866b465f8c976e8 +SHA512 (4.4.1.tar.gz) = 1a3091f3f3f8ad6a7a550618b07ed72d5337c63a38df762663a8df3b79c0f1a29c85abf43db814f730fd637cc432db27e8b12ea7ca3b504d80154f4eea3f7f7e From c8f176620db7ac4baf0cd580d333591dcb3ab88a Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 7 Feb 2023 16:58:35 +0100 Subject: [PATCH 085/111] Do not try to load rhts-environment --- tests/Sanity/sedta/runtest.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/Sanity/sedta/runtest.sh b/tests/Sanity/sedta/runtest.sh index 4fb0483..fa6372d 100755 --- a/tests/Sanity/sedta/runtest.sh +++ b/tests/Sanity/sedta/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="setools" From d757b877a00afba0f09589ead7e9e9cf213d8f72 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 20 Apr 2023 12:29:53 +0200 Subject: [PATCH 086/111] SETools 4.4.2 release --- .gitignore | 1 + 0001-Make-NetworkX-optional.patch | 91 -------------------- 1003-Require-networkx-on-package-level.patch | 24 ------ setools.spec | 11 +-- sources | 2 +- 5 files changed, 8 insertions(+), 121 deletions(-) delete mode 100644 0001-Make-NetworkX-optional.patch delete mode 100644 1003-Require-networkx-on-package-level.patch diff --git a/.gitignore b/.gitignore index 282a656..f4c80ed 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /16c0696.tar.gz /4.4.0.tar.gz /4.4.1.tar.gz +/4.4.2.tar.gz diff --git a/0001-Make-NetworkX-optional.patch b/0001-Make-NetworkX-optional.patch deleted file mode 100644 index c573d45..0000000 --- a/0001-Make-NetworkX-optional.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 716a1d9e1db6701c0b310dd7e10dc4a10656da0f Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Tue, 14 Dec 2021 14:24:20 -0500 -Subject: [PATCH] Make NetworkX optional. -Content-type: text/plain - -The CLI tools get installed to most distros, but sedta and seinfoflow are -not typically used or separated into a different package. This will allow -seinfo, sesearch, and sediff to function if NetworkX is missing, since they -don't require it. - -Signed-off-by: Chris PeBenito ---- - setools/dta.py | 18 ++++++++++++++---- - setools/infoflow.py | 17 +++++++++++++---- - 2 files changed, 27 insertions(+), 8 deletions(-) - -diff --git a/setools/dta.py b/setools/dta.py -index ce5a36463684..ded88ff4f615 100644 ---- a/setools/dta.py -+++ b/setools/dta.py -@@ -10,8 +10,11 @@ from collections import defaultdict - from contextlib import suppress - from typing import DefaultDict, Iterable, List, NamedTuple, Optional, Union - --import networkx as nx --from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound -+try: -+ import networkx as nx -+ from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound -+except ImportError: -+ logging.getLogger(__name__).debug("NetworkX failed to import.") - - from .descriptors import EdgeAttrDict, EdgeAttrList - from .policyrep import AnyTERule, SELinuxPolicy, TERuletype, Type -@@ -73,8 +76,15 @@ class DomainTransitionAnalysis: - self.reverse = reverse - self.rebuildgraph = True - self.rebuildsubgraph = True -- self.G = nx.DiGraph() -- self.subG = self.G.copy() -+ -+ try: -+ self.G = nx.DiGraph() -+ self.subG = self.G.copy() -+ except NameError: -+ self.log.critical("NetworkX is not available. This is " -+ "requried for Domain Transition Analysis.") -+ self.log.critical("This is typically in the python3-networkx package.") -+ raise - - @property - def reverse(self) -> bool: -diff --git a/setools/infoflow.py b/setools/infoflow.py -index 0ef240a9993f..4b94a0c2d6dd 100644 ---- a/setools/infoflow.py -+++ b/setools/infoflow.py -@@ -7,8 +7,11 @@ import logging - from contextlib import suppress - from typing import cast, Iterable, List, Mapping, Optional, Union - --import networkx as nx --from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound -+try: -+ import networkx as nx -+ from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound -+except ImportError: -+ logging.getLogger(__name__).debug("NetworkX failed to import.") - - from .descriptors import EdgeAttrIntMax, EdgeAttrList - from .permmap import PermissionMap -@@ -54,8 +57,14 @@ class InfoFlowAnalysis: - self.rebuildgraph = True - self.rebuildsubgraph = True - -- self.G = nx.DiGraph() -- self.subG = self.G.copy() -+ try: -+ self.G = nx.DiGraph() -+ self.subG = self.G.copy() -+ except NameError: -+ self.log.critical("NetworkX is not available. This is " -+ "requried for Information Flow Analysis.") -+ self.log.critical("This is typically in the python3-networkx package.") -+ raise - - @property - def min_weight(self) -> int: --- -2.39.1 - diff --git a/1003-Require-networkx-on-package-level.patch b/1003-Require-networkx-on-package-level.patch deleted file mode 100644 index 99eb500..0000000 --- a/1003-Require-networkx-on-package-level.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 7b73bdeda54b9c944774452bfa3b3c1f2733b3f0 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 2 Apr 2020 16:06:14 +0200 -Subject: [PATCH 2/2] Require networkx on package level - -It allows us to ship python3-setools without dependency on python3-networkx ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index c593b786cc61..0551811e3fd1 100644 ---- a/setup.py -+++ b/setup.py -@@ -163,5 +163,5 @@ setup(name='setools', - # setup also requires libsepol and libselinux - # C libraries and headers to compile. - setup_requires=['setuptools', 'Cython>=0.27'], -- install_requires=['setuptools', 'networkx>=2.0'] -+ install_requires=['setuptools'] - ) --- -2.30.0 - diff --git a/setools.spec b/setools.spec index 6c9edaf..72ab55b 100644 --- a/setools.spec +++ b/setools.spec @@ -1,8 +1,8 @@ -%global sepol_ver 3.4-1 -%global selinux_ver 3.4-1 +%global sepol_ver 3.5-1 +%global selinux_ver 3.5-1 Name: setools -Version: 4.4.1 +Version: 4.4.2 Release: 1%{?dist} Summary: Policy analysis tools for SELinux @@ -11,8 +11,6 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch0001: 0001-Make-NetworkX-optional.patch -Patch1003: 1003-Require-networkx-on-package-level.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core @@ -145,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Apr 20 2023 Petr Lautrbach - 4.4.2-1 +- SETools 4.4.2 release + * Mon Feb 6 2023 Petr Lautrbach - 4.4.1-1 - SETools 4.4.1 release diff --git a/sources b/sources index f46a001..361fad1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.4.1.tar.gz) = 1a3091f3f3f8ad6a7a550618b07ed72d5337c63a38df762663a8df3b79c0f1a29c85abf43db814f730fd637cc432db27e8b12ea7ca3b504d80154f4eea3f7f7e +SHA512 (4.4.2.tar.gz) = b5117c5de1503e25183c2a1af92cd015320dd37e0cf26b8e09bd5d0ff879734d2f9c301def2a40b476c1ed1960f9ee04ae13b284df73f39f743004104ac85fb1 From ce726757007f26addafe0a7966c1e9c3d4729744 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 13 Jun 2023 21:38:07 +0200 Subject: [PATCH 087/111] Rebuilt for Python 3.12 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 72ab55b..ef0048b 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Tue Jun 13 2023 Python Maint - 4.4.2-2 +- Rebuilt for Python 3.12 + * Thu Apr 20 2023 Petr Lautrbach - 4.4.2-1 - SETools 4.4.2 release From 6ae3e7d3fc94cc12d31c8b51e25ce9e1e0bba5ea Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 01:28:08 +0000 Subject: [PATCH 088/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index ef0048b..8dce1c7 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 4.4.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jun 13 2023 Python Maint - 4.4.2-2 - Rebuilt for Python 3.12 From 46e11071defd33c408add847c13705f524860ca1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 26 Jul 2023 14:37:17 +0200 Subject: [PATCH 089/111] setools-4.4.2-4 - Disable/remove neverallow options in sediff. - Improve man pages - seinfoflow: Add -r option to get flows into the source type. - seinfoflow.1: Remove references to sepolgen permission map. - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy. - SELinuxPolicy: Add explicit cast for libspol message Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2226424 --- ...-remove-neverallow-options-in-sediff.patch | 92 +++++++ 0002-Improve-man-pages.patch | 225 ++++++++++++++++++ ...nvironments-to-use-python-instead-of.patch | 62 +++++ ...-option-to-get-flows-into-the-source.patch | 51 ++++ ...ove-references-to-sepolgen-permissio.patch | 34 +++ ...rm-Treat-rules-with-no-permissions-a.patch | 55 +++++ ...d-explicit-cast-for-libspol-message-.patch | 52 ++++ setools.spec | 18 +- 8 files changed, 588 insertions(+), 1 deletion(-) create mode 100644 0001-Disable-remove-neverallow-options-in-sediff.patch create mode 100644 0002-Improve-man-pages.patch create mode 100644 0003-tox.ini-Change-environments-to-use-python-instead-of.patch create mode 100644 0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch create mode 100644 0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch create mode 100644 0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch create mode 100644 0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch diff --git a/0001-Disable-remove-neverallow-options-in-sediff.patch b/0001-Disable-remove-neverallow-options-in-sediff.patch new file mode 100644 index 0000000..d34479a --- /dev/null +++ b/0001-Disable-remove-neverallow-options-in-sediff.patch @@ -0,0 +1,92 @@ +From edf1a80fa41fa34ad849fbf5098eddd4c5339c18 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 9 May 2023 19:22:01 +0200 +Subject: [PATCH] Disable/remove neverallow options in sediff. +Content-type: text/plain + +Apply change from commit 06335957b701 ("Disable/remove neverallow +options in frontends.") to sediff + +Signed-off-by: Petr Lautrbach +--- + man/ru/sediff.1 | 4 ---- + man/sediff.1 | 4 ---- + sediff | 10 +++++++--- + 3 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/man/ru/sediff.1 b/man/ru/sediff.1 +index c6bf2939443f..af5d8efcf82c 100644 +--- a/man/ru/sediff.1 ++++ b/man/ru/sediff.1 +@@ -57,16 +57,12 @@ sediff \- утилита выявления различий политик SELi + Найти различия правил включения журналирования событий. + .IP "--dontaudit" + Найти различия правил запрета журналирования событий. +-.IP "--neverallow" +-Найти различия запрещающих правил. + .IP "--allowxperm" + Найти различия расширенных разрешительных правил. + .IP "--auditallowxperm" + Найти различия расширенных правил включения журналирования событий. + .IP "--dontauditxperm" + Найти различия расширенных правил запрета журналирования событий. +-.IP "--neverallowxperm" +-Найти различия расширенных запрещающих правил. + .IP "-T, --type_trans" + Найти различия правил перехода типов. + .IP "--type_member" +diff --git a/man/sediff.1 b/man/sediff.1 +index ed3b497db2c4..18466d8aeb68 100644 +--- a/man/sediff.1 ++++ b/man/sediff.1 +@@ -50,16 +50,12 @@ Find differences in allow rules. + Find differences in auditallow rules. + .IP "--dontaudit" + Find differences in dontaudit rules. +-.IP "--neverallow" +-Find differences in neverallow rules. + .IP "--allowxperm" + Find differences in allowxperm rules. + .IP "--auditallowxperm" + Find differences in auditallowxperm rules. + .IP "--dontauditxperm" + Find differences in dontauditxperm rules. +-.IP "--neverallowxperm" +-Find differences in neverallowxperm rules. + .IP "-T, --type_trans" + Find differences in type_transition rules. + .IP "--type_member" +diff --git a/sediff b/sediff +index b2fef9771f18..a39d6f5c8f57 100755 +--- a/sediff ++++ b/sediff +@@ -45,12 +45,12 @@ comp.add_argument("--level", action="store_true", help="Print MLS level definiti + terule = parser.add_argument_group("type enforcement rule differences") + terule.add_argument("-A", action="store_true", help="Print allow and allowxperm rule differences") + terule.add_argument("--allow", action="store_true", help="Print allow rule differences") +-terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences") ++# terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences") + terule.add_argument("--auditallow", action="store_true", help="Print auditallow rule differences") + terule.add_argument("--dontaudit", action="store_true", help="Print dontaudit rule differences") + terule.add_argument("--allowxperm", action="store_true", help="Print allowxperm rule differences") +-terule.add_argument("--neverallowxperm", action="store_true", +- help="Print neverallowxperm rule differences") ++# terule.add_argument("--neverallowxperm", action="store_true", ++# help="Print neverallowxperm rule differences") + terule.add_argument("--auditallowxperm", action="store_true", + help="Print auditallowxperm rule differences") + terule.add_argument("--dontauditxperm", action="store_true", +@@ -97,6 +97,10 @@ other.add_argument("--typebounds", action="store_true", help="Print typebounds d + + args = parser.parse_args() + ++# neverallow and neverallowxperm options are disabled ++args.neverallow = False ++args.neverallowxperm = False ++ + if args.A: + args.allow = True + args.allowxperm = True +-- +2.41.0 + diff --git a/0002-Improve-man-pages.patch b/0002-Improve-man-pages.patch new file mode 100644 index 0000000..15552a2 --- /dev/null +++ b/0002-Improve-man-pages.patch @@ -0,0 +1,225 @@ +From 2fea8eb0d4aedbbdca2209ee904eb10df69737b8 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 11 May 2023 18:38:21 +0200 +Subject: [PATCH] Improve man pages +Content-type: text/plain + +- Add missing parameters +- Add examples +- Fix typos + +Signed-off-by: Vit Mojzis +--- + man/sechecker.1 | 6 +++--- + man/sediff.1 | 12 ++++++++++++ + man/sedta.1 | 9 +++++++++ + man/seinfo.1 | 25 +++++++++++++++++++++++++ + man/seinfoflow.1 | 9 +++++++++ + man/sesearch.1 | 12 ++++++++++++ + 6 files changed, 70 insertions(+), 3 deletions(-) + +diff --git a/man/sechecker.1 b/man/sechecker.1 +index 507b8615c26f..e32d6d6114ba 100644 +--- a/man/sechecker.1 ++++ b/man/sechecker.1 +@@ -81,7 +81,7 @@ A space-separated list of object class criteria for the query. + A space-separated list of permissions for the query. + + .PP +-\fBA least one of the above options must be set in this check.\fR ++\fBAt least one of the above options must be set in this check.\fR + + .PP + Additional Options: +@@ -123,7 +123,7 @@ The source role criteria for the query. + The target role criteria for the query. + + .PP +-\fBA least one of the above options must be set in this check.\fR ++\fBAt least one of the above options must be set in this check.\fR + + .PP + Additional Options: +@@ -205,7 +205,7 @@ executable types are read-only.\fR + .\} + .nf + [ro_execs] +-check_type = empty_typeattr ++check_type = ro_execs + desc = Verify that the all executables and libraries are read-only. + .fi + .if n \{\ +diff --git a/man/sediff.1 b/man/sediff.1 +index 18466d8aeb68..9b189885ff3c 100644 +--- a/man/sediff.1 ++++ b/man/sediff.1 +@@ -84,6 +84,10 @@ Find differences in validatetrans rules. + Find differences in mlsvalidatetrans rules. + + .SS Labeling Statement Differences ++.IP "--ibendportcon" ++Find differences in ibendportcon (InfiniBand endport context) statements. ++.IP "--ibpkeycon" ++Find differences in ibpkeycon (InfiniBand parition key context) statements. + .IP "--initialsid" + Find differences in initial SID statements. + .IP "--fs_use" +@@ -136,6 +140,14 @@ For example, a class is modified if one or more permissions are added or removed + .RE + .PP + ++.SH EXAMPLE ++.nf ++Show differences in boolean settings ++# sediff -b /backup/policy.33 /etc/selinux/targeted/policy/policy.33 ++Show statistics for allow and allowxperm rule changes (how many rules where added, removed, or modified) ++#sediff -A --stats /backup/policy.33 /etc/selinux/targeted/policy/policy.33 ++ ++ + .SH AUTHOR + Chris PeBenito + +diff --git a/man/sedta.1 b/man/sedta.1 +index 1d84d92664e0..d3d21db6f172 100644 +--- a/man/sedta.1 ++++ b/man/sedta.1 +@@ -49,6 +49,8 @@ Specify the maximum number of domain transitions to output. The default is unlim + A space-separated list of types to exclude from the analysis. + + .SS General Options ++.IP "--full" ++Print rule lists for transitions. + .IP "--stats" + Print domain transition graph statistics at the end of the analysis. + .IP "-h, --help" +@@ -60,6 +62,13 @@ Print additional informational messages. + .IP "--debug" + Enable debugging output. + ++.SH EXAMPLE ++.nf ++Show the shortest transition paths from httpd_t to unconfined_t, while not using container_runtime_t ++# sedta -s httpd_t -t unconfined_t -S container_runtime_t ++List all domain transition paths shorter than 3 steps from init_t to smbd_t ++# sedta -s init_t -t smbd_t -A 3 ++ + .SH AUTHOR + Chris PeBenito + +diff --git a/man/seinfo.1 b/man/seinfo.1 +index 1adea9868d66..9e7cbde8c06e 100644 +--- a/man/seinfo.1 ++++ b/man/seinfo.1 +@@ -56,6 +56,10 @@ There is no expanded information for this component. + .IP "--genfscon [FS_TYPE]" + Print a list of genfscon statements or, if FS_TYPE is provided, print the statement for the named filesystem type. + There is no expanded information for this component. ++.IP "--ibpkeycon [PKEY[-PKEY]]" ++Print a list of InfiniBand parition key contexts. ++.IP "--ibendportcon [NAME]" ++Print a list of InfiniBand endport contexts. + .IP "--initialsid [NAME]" + Print a list of initial SIDs or, if NAME is provided, print the named initial SID. + With \fI-x\fR, print the context assigned to each displayed SID. +@@ -86,6 +90,18 @@ There is no expanded information for this component. + .IP "--all" + Print all components. + ++.IP "\fB Xen Component Queries: \fR" ++.IP "--ioportcon" ++Print all ioportcon statements. ++.IP "--iomemcon" ++Print all iomemcon statements. ++.IP "--pcidevicecon" ++Print all pcidevicecon statements. ++.IP "--pirqcon" ++Print all pirqcon statements. ++.IP "--devicetreecon" ++Print all devicetreecon statements. ++ + .SH OPTIONS + .IP "-x, --expand" + Print additional details for each component matching the expression. +@@ -101,6 +117,15 @@ Print additional informational messages. + .IP "--debug" + Enable debugging output. + ++.SH EXAMPLE ++.nf ++List aliases of and attributes assigned to type httpd_t ++# seinfo -t httpd_t -x ++List all executable types (all types assigned to "exec_type" attribute) ++# seinfo -a exec_type -x ++List all constrains and mlsconstrains for class "file" ++# seinfo --constrain file ++ + .SH AUTHOR + Chris PeBenito + +diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 +index 2e4a261606bf..75763d6f2378 100644 +--- a/man/seinfoflow.1 ++++ b/man/seinfoflow.1 +@@ -54,6 +54,8 @@ A space-separated list of types to exclude from the analysis. + Print information flow graph statistics at the end of the analysis. + .IP "-h, --help" + Print help information and exit. ++.IP "--full" ++Print full rule lists for information flows. + .IP "--version" + Print version information and exit. + .IP "-v, --verbose" +@@ -61,6 +63,13 @@ Print additional informational messages. + .IP "--debug" + Enable debugging output. + ++.SH EXAMPLE ++.nf ++Show the shortest paths for process running as httpd_t to access user home files, using permission map from /var/lib/sepolgen/perm_map ++# seinfoflow -m /var/lib/sepolgen/perm_map -s httpd_t -t user_home_t -S ++List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled ++# seinfoflow -m /var/lib/sepolgen/perm_map -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" ++ + .SH AUTHOR + Chris PeBenito + +diff --git a/man/sesearch.1 b/man/sesearch.1 +index 35f16c4ba33e..edc18346673c 100644 +--- a/man/sesearch.1 ++++ b/man/sesearch.1 +@@ -48,6 +48,7 @@ Find type_change rules. + Find role allow rules. + .IP "--role_trans" + Find role_transition rules. ++.IP "Note: TE/MLS rule searches cannot be mixed with RBAC rule searches" + + .SS MLS Rule Types + .IP "--range_trans" +@@ -80,6 +81,8 @@ A matching rule must have the specified target attribute/type/role explicitly, i + A matching rule must have all specified Booleans, instead of matching any of the specified Boolean. + .IP "-ep" + A matching rule must have exactly the specified permissions, instead of matching any of the specified permission. ++.IP "-ex" ++A matching rule must have exactly the specified extended permissions, instead of matching any listed extended permission. + .IP "-Sp" + A matching rule must have permissions where are a superset of the specified permissions, instead of matching any of the permissions. + .IP "-rs" +@@ -103,6 +106,15 @@ Print additional informational messages. + .IP "--debug" + Enable debugging output. + ++.SH EXAMPLE ++.nf ++List allow (and allowxperm) rules for accessing files labeled container_file_t from domains with attribute container_domain ++# sesearch -A -s container_domain -t container_file_t -c file ++List allow and dontaudit rules for accessing chr_files labeled container_file_t, that are controlled by boolean container_use_devices ++# sesearch -A --dontaudit -t container_file_t -c chr_file -b container_use_devices ++List dontaudit rules assigned via application_domain_type attribute (rules concerning specific types with that attribute are excluded) ++# sesearch --dontaudit -s application_domain_type -ds ++ + .SH AUTHOR + Chris PeBenito + +-- +2.41.0 + diff --git a/0003-tox.ini-Change-environments-to-use-python-instead-of.patch b/0003-tox.ini-Change-environments-to-use-python-instead-of.patch new file mode 100644 index 0000000..a49f91f --- /dev/null +++ b/0003-tox.ini-Change-environments-to-use-python-instead-of.patch @@ -0,0 +1,62 @@ +From 6425b45e2748605b99d4e45b286fbf5bb8e8243e Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Mon, 17 Jul 2023 16:45:01 -0400 +Subject: [PATCH] tox.ini: Change environments to use "python" instead of "py". +Content-type: text/plain + +Signed-off-by: Chris PeBenito +--- + .github/workflows/tests.yml | 12 ++++++------ + tox.ini | 8 ++++---- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml +index eb443ae7f0f7..c3c8d552ca15 100644 +--- a/.github/workflows/tests.yml ++++ b/.github/workflows/tests.yml +@@ -27,12 +27,12 @@ jobs: + + matrix: + build-opts: +- - {python: '3.6', tox: py36} +- - {python: '3.7', tox: py37} +- - {python: '3.8', tox: py38} +- - {python: '3.9', tox: py39} +- - {python: '3.10', tox: py310} +- - {python: '3.11', tox: py311} ++ - {python: '3.6', tox: python3.6} ++ - {python: '3.7', tox: python3.7} ++ - {python: '3.8', tox: python3.8} ++ - {python: '3.9', tox: python3.9} ++ - {python: '3.10', tox: python3.10} ++ - {python: '3.11', tox: python3.11} + - {python: '3.6', tox: pep8} + - {python: '3.6', tox: lint} + - {python: '3.6', tox: mypy} +diff --git a/tox.ini b/tox.ini +index b2f6b51858e6..a668bb3de425 100644 +--- a/tox.ini ++++ b/tox.ini +@@ -1,6 +1,6 @@ + [tox] + minversion = 1.4 +-envlist = py3, pep8, lint, mypy ++envlist = python3, pep8, lint, mypy + + [pycodestyle] + max-line-length = 100 +@@ -53,8 +53,8 @@ passenv = USERSPACE_SRC + deps = networkx>=2.0 + cython>=0.27 + pytest +- py38: cython>=0.29.14 +- py39: networkx>=2.6 +- py39: cython>=0.29.14 ++ python38: cython>=0.29.14 ++ python39: networkx>=2.6 ++ python39: cython>=0.29.14 + commands_pre = {envpython} setup.py build_ext -i + commands = pytest tests +-- +2.41.0 + diff --git a/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch b/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch new file mode 100644 index 0000000..14e7864 --- /dev/null +++ b/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch @@ -0,0 +1,51 @@ +From 8ec295066289cf74df0e3f2c6e068abe503f1121 Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Wed, 21 Jun 2023 08:56:08 -0400 +Subject: [PATCH] seinfoflow: Add -r option to get flows into the source type. +Content-type: text/plain + +Signed-off-by: Chris PeBenito +--- + man/seinfoflow.1 | 2 ++ + seinfoflow | 5 ++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 +index 75763d6f2378..63c70c0e7b14 100644 +--- a/man/seinfoflow.1 ++++ b/man/seinfoflow.1 +@@ -50,6 +50,8 @@ Specify the maximum number of information flows to output. The default is unlimi + A space-separated list of types to exclude from the analysis. + + .SS General Options ++.IP "-r, --reverse" ++Display information flows into the source type. No effect if a target type is specified. + .IP "--stats" + Print information flow graph statistics at the end of the analysis. + .IP "-h, --help" +diff --git a/seinfoflow b/seinfoflow +index 5f4e7642ecf9..9bd1bec41da8 100755 +--- a/seinfoflow ++++ b/seinfoflow +@@ -42,6 +42,9 @@ alg.add_argument("-A", "--all_paths", type=int, metavar="MAX_STEPS", + help="Calculate all paths, with the specified maximum path length. (Expensive)") + + opts = parser.add_argument_group("Analysis options") ++opts.add_argument("-r", "--reverse", action="store_false", ++ help="Display information flows into the source type. " ++ "No effect if a target type is specified.") + opts.add_argument("-w", "--min_weight", default=3, type=int, + help="Minimum permission weight. Default is 3.") + opts.add_argument("-l", "--limit_flows", default=0, type=int, +@@ -119,7 +122,7 @@ try: + + else: # single direct info flow + flownum = 0 +- for flownum, flow in enumerate(g.infoflows(args.source), start=1): ++ for flownum, flow in enumerate(g.infoflows(args.source, out=args.reverse), start=1): + print("Flow {0}: {1} -> {2}".format(flownum, flow.source, flow.target)) + + if args.full: +-- +2.41.0 + diff --git a/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch b/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch new file mode 100644 index 0000000..f1ed9e7 --- /dev/null +++ b/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch @@ -0,0 +1,34 @@ +From 32ebd2c802ca0fcf3b920b298f0d2d8b2972cfa9 Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Wed, 21 Jun 2023 08:56:53 -0400 +Subject: [PATCH] seinfoflow.1: Remove references to sepolgen permission map. +Content-type: text/plain + +SETools ships with its own so that it is usable on non-SELinux systems. + +Signed-off-by: Chris PeBenito +--- + man/seinfoflow.1 | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 +index 63c70c0e7b14..e482520a8b82 100644 +--- a/man/seinfoflow.1 ++++ b/man/seinfoflow.1 +@@ -67,10 +67,10 @@ Enable debugging output. + + .SH EXAMPLE + .nf +-Show the shortest paths for process running as httpd_t to access user home files, using permission map from /var/lib/sepolgen/perm_map +-# seinfoflow -m /var/lib/sepolgen/perm_map -s httpd_t -t user_home_t -S ++Show the shortest paths for process running as httpd_t to access user home files, using the default permission map: ++# seinfoflow -s httpd_t -t user_home_t -S + List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled +-# seinfoflow -m /var/lib/sepolgen/perm_map -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" ++# seinfoflow -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" + + .SH AUTHOR + Chris PeBenito +-- +2.41.0 + diff --git a/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch b/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch new file mode 100644 index 0000000..8b8df96 --- /dev/null +++ b/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch @@ -0,0 +1,55 @@ +From 725d224e8dd8af3a5a56c71b9de7936d098cae61 Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Tue, 16 May 2023 13:21:09 -0400 +Subject: [PATCH] AVRule/AVRuleXperm: Treat rules with no permissions as + invalid policy. +Content-type: text/plain + +Signed-off-by: Chris PeBenito +--- + setools/policyrep/terule.pxi | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi +index 6c869ed08ad9..4f4a95f553bc 100644 +--- a/setools/policyrep/terule.pxi ++++ b/setools/policyrep/terule.pxi +@@ -120,6 +120,17 @@ cdef class AVRule(BaseTERule): + r._conditional = conditional + r._conditional_block = conditional_block + r.origin = None ++ ++ if not r.perms: ++ rule_string = f"{r.ruletype} {r.source} {r.target}:{r.tclass} {{ }};" ++ try: ++ rule_string += f" [ {r.conditional} ]:{r.conditional_block}" ++ except RuleNotConditional: ++ pass ++ ++ raise LowLevelPolicyError("Invalid policy: Found a rule with no permissions: " ++ f"{rule_string}") ++ + return r + + def __hash__(self): +@@ -319,6 +330,17 @@ cdef class AVRuleXperm(BaseTERule): + r._conditional = conditional + r._conditional_block = conditional_block + r.origin = None ++ ++ if not perms: ++ rule_string = f"{r.ruletype} {r.source} {r.target}:{r.tclass} {r.xperm_type} {{ }};" ++ try: ++ rule_string += f" [ {r.conditional} ]:{r.conditional_block}" ++ except RuleNotConditional: ++ pass ++ ++ raise LowLevelPolicyError( ++ f"Invalid policy: Found a rule with no extended permissions: {rule_string}.") ++ + return r + + def __hash__(self): +-- +2.41.0 + diff --git a/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch b/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch new file mode 100644 index 0000000..caa96f3 --- /dev/null +++ b/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch @@ -0,0 +1,52 @@ +From fc443b5a0379f3644e071a458e996ea6115ccba3 Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Mon, 17 Jul 2023 16:08:21 -0400 +Subject: [PATCH] SELinuxPolicy: Add explicit cast for libspol message + callback. +Content-type: text/plain + +Cython 3.0 is more strict. The change fixes this issue: + +setools/policyrep/selinuxpolicy.pxi:685:46: Cannot assign type 'void (void *, sepol_handle_t *, const char *, ...) except *' to 'msg_callback' + +Additionally, the msg_callback is not typedef-ed in sepol/debug.h, so it must +be explicitly defined in sepol.pxd for the casting to work. + +Signed-off-by: Chris PeBenito +--- + setools/policyrep/selinuxpolicy.pxi | 2 +- + setools/policyrep/sepol.pxd | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/setools/policyrep/selinuxpolicy.pxi b/setools/policyrep/selinuxpolicy.pxi +index 9267a0c43abc..236316f1c6c5 100644 +--- a/setools/policyrep/selinuxpolicy.pxi ++++ b/setools/policyrep/selinuxpolicy.pxi +@@ -668,7 +668,7 @@ cdef class SELinuxPolicy: + if self.sh == NULL: + raise MemoryError + +- sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle) ++ sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle) + + if sepol.sepol_policydb_create(&self.handle) < 0: + raise MemoryError +diff --git a/setools/policyrep/sepol.pxd b/setools/policyrep/sepol.pxd +index 769498f2c5fd..36589ed1a607 100644 +--- a/setools/policyrep/sepol.pxd ++++ b/setools/policyrep/sepol.pxd +@@ -16,8 +16,10 @@ cdef extern from "": + void sepol_handle_destroy(sepol_handle_t *sh) + + ++ctypedef void (*msg_callback)(void *varg, sepol_handle_t *handle, const char *fmt, ...) ++ ++ + cdef extern from "": +- ctypedef void (*msg_callback)(void *varg, sepol_handle_t *handle, const char *fmt, ...) + void sepol_msg_set_callback(sepol_handle * handle, msg_callback cb, void *cb_arg) + + +-- +2.41.0 + diff --git a/setools.spec b/setools.spec index 8dce1c7..04ac4bf 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,6 +11,14 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch0001: 0001-Disable-remove-neverallow-options-in-sediff.patch +Patch0002: 0002-Improve-man-pages.patch +Patch0003: 0003-tox.ini-Change-environments-to-use-python-instead-of.patch +Patch0004: 0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch +Patch0005: 0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch +Patch0006: 0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch +Patch0007: 0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch + Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core @@ -143,6 +151,14 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Wed Jul 26 2023 Petr Lautrbach - 4.4.2-4 +- Disable/remove neverallow options in sediff. +- Improve man pages +- seinfoflow: Add -r option to get flows into the source type. +- seinfoflow.1: Remove references to sepolgen permission map. +- AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy. +- SELinuxPolicy: Add explicit cast for libspol message + * Sat Jul 22 2023 Fedora Release Engineering - 4.4.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From dd68fa8535715035c32d40114ad7af37d8b0c9f2 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 9 Aug 2023 18:45:08 +0200 Subject: [PATCH 090/111] setools-4.4.3-1 --- .gitignore | 1 + ...-remove-neverallow-options-in-sediff.patch | 92 ------- 0002-Improve-man-pages.patch | 225 ------------------ ...nvironments-to-use-python-instead-of.patch | 62 ----- ...-option-to-get-flows-into-the-source.patch | 51 ---- ...ove-references-to-sepolgen-permissio.patch | 34 --- ...rm-Treat-rules-with-no-permissions-a.patch | 55 ----- ...d-explicit-cast-for-libspol-message-.patch | 52 ---- setools.spec | 14 +- sources | 2 +- 10 files changed, 7 insertions(+), 581 deletions(-) delete mode 100644 0001-Disable-remove-neverallow-options-in-sediff.patch delete mode 100644 0002-Improve-man-pages.patch delete mode 100644 0003-tox.ini-Change-environments-to-use-python-instead-of.patch delete mode 100644 0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch delete mode 100644 0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch delete mode 100644 0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch delete mode 100644 0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch diff --git a/.gitignore b/.gitignore index f4c80ed..26db9fc 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.4.0.tar.gz /4.4.1.tar.gz /4.4.2.tar.gz +/4.4.3.tar.gz diff --git a/0001-Disable-remove-neverallow-options-in-sediff.patch b/0001-Disable-remove-neverallow-options-in-sediff.patch deleted file mode 100644 index d34479a..0000000 --- a/0001-Disable-remove-neverallow-options-in-sediff.patch +++ /dev/null @@ -1,92 +0,0 @@ -From edf1a80fa41fa34ad849fbf5098eddd4c5339c18 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 9 May 2023 19:22:01 +0200 -Subject: [PATCH] Disable/remove neverallow options in sediff. -Content-type: text/plain - -Apply change from commit 06335957b701 ("Disable/remove neverallow -options in frontends.") to sediff - -Signed-off-by: Petr Lautrbach ---- - man/ru/sediff.1 | 4 ---- - man/sediff.1 | 4 ---- - sediff | 10 +++++++--- - 3 files changed, 7 insertions(+), 11 deletions(-) - -diff --git a/man/ru/sediff.1 b/man/ru/sediff.1 -index c6bf2939443f..af5d8efcf82c 100644 ---- a/man/ru/sediff.1 -+++ b/man/ru/sediff.1 -@@ -57,16 +57,12 @@ sediff \- утилита выявления различий политик SELi - Найти различия правил включения журналирования событий. - .IP "--dontaudit" - Найти различия правил запрета журналирования событий. --.IP "--neverallow" --Найти различия запрещающих правил. - .IP "--allowxperm" - Найти различия расширенных разрешительных правил. - .IP "--auditallowxperm" - Найти различия расширенных правил включения журналирования событий. - .IP "--dontauditxperm" - Найти различия расширенных правил запрета журналирования событий. --.IP "--neverallowxperm" --Найти различия расширенных запрещающих правил. - .IP "-T, --type_trans" - Найти различия правил перехода типов. - .IP "--type_member" -diff --git a/man/sediff.1 b/man/sediff.1 -index ed3b497db2c4..18466d8aeb68 100644 ---- a/man/sediff.1 -+++ b/man/sediff.1 -@@ -50,16 +50,12 @@ Find differences in allow rules. - Find differences in auditallow rules. - .IP "--dontaudit" - Find differences in dontaudit rules. --.IP "--neverallow" --Find differences in neverallow rules. - .IP "--allowxperm" - Find differences in allowxperm rules. - .IP "--auditallowxperm" - Find differences in auditallowxperm rules. - .IP "--dontauditxperm" - Find differences in dontauditxperm rules. --.IP "--neverallowxperm" --Find differences in neverallowxperm rules. - .IP "-T, --type_trans" - Find differences in type_transition rules. - .IP "--type_member" -diff --git a/sediff b/sediff -index b2fef9771f18..a39d6f5c8f57 100755 ---- a/sediff -+++ b/sediff -@@ -45,12 +45,12 @@ comp.add_argument("--level", action="store_true", help="Print MLS level definiti - terule = parser.add_argument_group("type enforcement rule differences") - terule.add_argument("-A", action="store_true", help="Print allow and allowxperm rule differences") - terule.add_argument("--allow", action="store_true", help="Print allow rule differences") --terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences") -+# terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences") - terule.add_argument("--auditallow", action="store_true", help="Print auditallow rule differences") - terule.add_argument("--dontaudit", action="store_true", help="Print dontaudit rule differences") - terule.add_argument("--allowxperm", action="store_true", help="Print allowxperm rule differences") --terule.add_argument("--neverallowxperm", action="store_true", -- help="Print neverallowxperm rule differences") -+# terule.add_argument("--neverallowxperm", action="store_true", -+# help="Print neverallowxperm rule differences") - terule.add_argument("--auditallowxperm", action="store_true", - help="Print auditallowxperm rule differences") - terule.add_argument("--dontauditxperm", action="store_true", -@@ -97,6 +97,10 @@ other.add_argument("--typebounds", action="store_true", help="Print typebounds d - - args = parser.parse_args() - -+# neverallow and neverallowxperm options are disabled -+args.neverallow = False -+args.neverallowxperm = False -+ - if args.A: - args.allow = True - args.allowxperm = True --- -2.41.0 - diff --git a/0002-Improve-man-pages.patch b/0002-Improve-man-pages.patch deleted file mode 100644 index 15552a2..0000000 --- a/0002-Improve-man-pages.patch +++ /dev/null @@ -1,225 +0,0 @@ -From 2fea8eb0d4aedbbdca2209ee904eb10df69737b8 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 11 May 2023 18:38:21 +0200 -Subject: [PATCH] Improve man pages -Content-type: text/plain - -- Add missing parameters -- Add examples -- Fix typos - -Signed-off-by: Vit Mojzis ---- - man/sechecker.1 | 6 +++--- - man/sediff.1 | 12 ++++++++++++ - man/sedta.1 | 9 +++++++++ - man/seinfo.1 | 25 +++++++++++++++++++++++++ - man/seinfoflow.1 | 9 +++++++++ - man/sesearch.1 | 12 ++++++++++++ - 6 files changed, 70 insertions(+), 3 deletions(-) - -diff --git a/man/sechecker.1 b/man/sechecker.1 -index 507b8615c26f..e32d6d6114ba 100644 ---- a/man/sechecker.1 -+++ b/man/sechecker.1 -@@ -81,7 +81,7 @@ A space-separated list of object class criteria for the query. - A space-separated list of permissions for the query. - - .PP --\fBA least one of the above options must be set in this check.\fR -+\fBAt least one of the above options must be set in this check.\fR - - .PP - Additional Options: -@@ -123,7 +123,7 @@ The source role criteria for the query. - The target role criteria for the query. - - .PP --\fBA least one of the above options must be set in this check.\fR -+\fBAt least one of the above options must be set in this check.\fR - - .PP - Additional Options: -@@ -205,7 +205,7 @@ executable types are read-only.\fR - .\} - .nf - [ro_execs] --check_type = empty_typeattr -+check_type = ro_execs - desc = Verify that the all executables and libraries are read-only. - .fi - .if n \{\ -diff --git a/man/sediff.1 b/man/sediff.1 -index 18466d8aeb68..9b189885ff3c 100644 ---- a/man/sediff.1 -+++ b/man/sediff.1 -@@ -84,6 +84,10 @@ Find differences in validatetrans rules. - Find differences in mlsvalidatetrans rules. - - .SS Labeling Statement Differences -+.IP "--ibendportcon" -+Find differences in ibendportcon (InfiniBand endport context) statements. -+.IP "--ibpkeycon" -+Find differences in ibpkeycon (InfiniBand parition key context) statements. - .IP "--initialsid" - Find differences in initial SID statements. - .IP "--fs_use" -@@ -136,6 +140,14 @@ For example, a class is modified if one or more permissions are added or removed - .RE - .PP - -+.SH EXAMPLE -+.nf -+Show differences in boolean settings -+# sediff -b /backup/policy.33 /etc/selinux/targeted/policy/policy.33 -+Show statistics for allow and allowxperm rule changes (how many rules where added, removed, or modified) -+#sediff -A --stats /backup/policy.33 /etc/selinux/targeted/policy/policy.33 -+ -+ - .SH AUTHOR - Chris PeBenito - -diff --git a/man/sedta.1 b/man/sedta.1 -index 1d84d92664e0..d3d21db6f172 100644 ---- a/man/sedta.1 -+++ b/man/sedta.1 -@@ -49,6 +49,8 @@ Specify the maximum number of domain transitions to output. The default is unlim - A space-separated list of types to exclude from the analysis. - - .SS General Options -+.IP "--full" -+Print rule lists for transitions. - .IP "--stats" - Print domain transition graph statistics at the end of the analysis. - .IP "-h, --help" -@@ -60,6 +62,13 @@ Print additional informational messages. - .IP "--debug" - Enable debugging output. - -+.SH EXAMPLE -+.nf -+Show the shortest transition paths from httpd_t to unconfined_t, while not using container_runtime_t -+# sedta -s httpd_t -t unconfined_t -S container_runtime_t -+List all domain transition paths shorter than 3 steps from init_t to smbd_t -+# sedta -s init_t -t smbd_t -A 3 -+ - .SH AUTHOR - Chris PeBenito - -diff --git a/man/seinfo.1 b/man/seinfo.1 -index 1adea9868d66..9e7cbde8c06e 100644 ---- a/man/seinfo.1 -+++ b/man/seinfo.1 -@@ -56,6 +56,10 @@ There is no expanded information for this component. - .IP "--genfscon [FS_TYPE]" - Print a list of genfscon statements or, if FS_TYPE is provided, print the statement for the named filesystem type. - There is no expanded information for this component. -+.IP "--ibpkeycon [PKEY[-PKEY]]" -+Print a list of InfiniBand parition key contexts. -+.IP "--ibendportcon [NAME]" -+Print a list of InfiniBand endport contexts. - .IP "--initialsid [NAME]" - Print a list of initial SIDs or, if NAME is provided, print the named initial SID. - With \fI-x\fR, print the context assigned to each displayed SID. -@@ -86,6 +90,18 @@ There is no expanded information for this component. - .IP "--all" - Print all components. - -+.IP "\fB Xen Component Queries: \fR" -+.IP "--ioportcon" -+Print all ioportcon statements. -+.IP "--iomemcon" -+Print all iomemcon statements. -+.IP "--pcidevicecon" -+Print all pcidevicecon statements. -+.IP "--pirqcon" -+Print all pirqcon statements. -+.IP "--devicetreecon" -+Print all devicetreecon statements. -+ - .SH OPTIONS - .IP "-x, --expand" - Print additional details for each component matching the expression. -@@ -101,6 +117,15 @@ Print additional informational messages. - .IP "--debug" - Enable debugging output. - -+.SH EXAMPLE -+.nf -+List aliases of and attributes assigned to type httpd_t -+# seinfo -t httpd_t -x -+List all executable types (all types assigned to "exec_type" attribute) -+# seinfo -a exec_type -x -+List all constrains and mlsconstrains for class "file" -+# seinfo --constrain file -+ - .SH AUTHOR - Chris PeBenito - -diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 -index 2e4a261606bf..75763d6f2378 100644 ---- a/man/seinfoflow.1 -+++ b/man/seinfoflow.1 -@@ -54,6 +54,8 @@ A space-separated list of types to exclude from the analysis. - Print information flow graph statistics at the end of the analysis. - .IP "-h, --help" - Print help information and exit. -+.IP "--full" -+Print full rule lists for information flows. - .IP "--version" - Print version information and exit. - .IP "-v, --verbose" -@@ -61,6 +63,13 @@ Print additional informational messages. - .IP "--debug" - Enable debugging output. - -+.SH EXAMPLE -+.nf -+Show the shortest paths for process running as httpd_t to access user home files, using permission map from /var/lib/sepolgen/perm_map -+# seinfoflow -m /var/lib/sepolgen/perm_map -s httpd_t -t user_home_t -S -+List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled -+# seinfoflow -m /var/lib/sepolgen/perm_map -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" -+ - .SH AUTHOR - Chris PeBenito - -diff --git a/man/sesearch.1 b/man/sesearch.1 -index 35f16c4ba33e..edc18346673c 100644 ---- a/man/sesearch.1 -+++ b/man/sesearch.1 -@@ -48,6 +48,7 @@ Find type_change rules. - Find role allow rules. - .IP "--role_trans" - Find role_transition rules. -+.IP "Note: TE/MLS rule searches cannot be mixed with RBAC rule searches" - - .SS MLS Rule Types - .IP "--range_trans" -@@ -80,6 +81,8 @@ A matching rule must have the specified target attribute/type/role explicitly, i - A matching rule must have all specified Booleans, instead of matching any of the specified Boolean. - .IP "-ep" - A matching rule must have exactly the specified permissions, instead of matching any of the specified permission. -+.IP "-ex" -+A matching rule must have exactly the specified extended permissions, instead of matching any listed extended permission. - .IP "-Sp" - A matching rule must have permissions where are a superset of the specified permissions, instead of matching any of the permissions. - .IP "-rs" -@@ -103,6 +106,15 @@ Print additional informational messages. - .IP "--debug" - Enable debugging output. - -+.SH EXAMPLE -+.nf -+List allow (and allowxperm) rules for accessing files labeled container_file_t from domains with attribute container_domain -+# sesearch -A -s container_domain -t container_file_t -c file -+List allow and dontaudit rules for accessing chr_files labeled container_file_t, that are controlled by boolean container_use_devices -+# sesearch -A --dontaudit -t container_file_t -c chr_file -b container_use_devices -+List dontaudit rules assigned via application_domain_type attribute (rules concerning specific types with that attribute are excluded) -+# sesearch --dontaudit -s application_domain_type -ds -+ - .SH AUTHOR - Chris PeBenito - --- -2.41.0 - diff --git a/0003-tox.ini-Change-environments-to-use-python-instead-of.patch b/0003-tox.ini-Change-environments-to-use-python-instead-of.patch deleted file mode 100644 index a49f91f..0000000 --- a/0003-tox.ini-Change-environments-to-use-python-instead-of.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 6425b45e2748605b99d4e45b286fbf5bb8e8243e Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Mon, 17 Jul 2023 16:45:01 -0400 -Subject: [PATCH] tox.ini: Change environments to use "python" instead of "py". -Content-type: text/plain - -Signed-off-by: Chris PeBenito ---- - .github/workflows/tests.yml | 12 ++++++------ - tox.ini | 8 ++++---- - 2 files changed, 10 insertions(+), 10 deletions(-) - -diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml -index eb443ae7f0f7..c3c8d552ca15 100644 ---- a/.github/workflows/tests.yml -+++ b/.github/workflows/tests.yml -@@ -27,12 +27,12 @@ jobs: - - matrix: - build-opts: -- - {python: '3.6', tox: py36} -- - {python: '3.7', tox: py37} -- - {python: '3.8', tox: py38} -- - {python: '3.9', tox: py39} -- - {python: '3.10', tox: py310} -- - {python: '3.11', tox: py311} -+ - {python: '3.6', tox: python3.6} -+ - {python: '3.7', tox: python3.7} -+ - {python: '3.8', tox: python3.8} -+ - {python: '3.9', tox: python3.9} -+ - {python: '3.10', tox: python3.10} -+ - {python: '3.11', tox: python3.11} - - {python: '3.6', tox: pep8} - - {python: '3.6', tox: lint} - - {python: '3.6', tox: mypy} -diff --git a/tox.ini b/tox.ini -index b2f6b51858e6..a668bb3de425 100644 ---- a/tox.ini -+++ b/tox.ini -@@ -1,6 +1,6 @@ - [tox] - minversion = 1.4 --envlist = py3, pep8, lint, mypy -+envlist = python3, pep8, lint, mypy - - [pycodestyle] - max-line-length = 100 -@@ -53,8 +53,8 @@ passenv = USERSPACE_SRC - deps = networkx>=2.0 - cython>=0.27 - pytest -- py38: cython>=0.29.14 -- py39: networkx>=2.6 -- py39: cython>=0.29.14 -+ python38: cython>=0.29.14 -+ python39: networkx>=2.6 -+ python39: cython>=0.29.14 - commands_pre = {envpython} setup.py build_ext -i - commands = pytest tests --- -2.41.0 - diff --git a/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch b/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch deleted file mode 100644 index 14e7864..0000000 --- a/0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 8ec295066289cf74df0e3f2c6e068abe503f1121 Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Wed, 21 Jun 2023 08:56:08 -0400 -Subject: [PATCH] seinfoflow: Add -r option to get flows into the source type. -Content-type: text/plain - -Signed-off-by: Chris PeBenito ---- - man/seinfoflow.1 | 2 ++ - seinfoflow | 5 ++++- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 -index 75763d6f2378..63c70c0e7b14 100644 ---- a/man/seinfoflow.1 -+++ b/man/seinfoflow.1 -@@ -50,6 +50,8 @@ Specify the maximum number of information flows to output. The default is unlimi - A space-separated list of types to exclude from the analysis. - - .SS General Options -+.IP "-r, --reverse" -+Display information flows into the source type. No effect if a target type is specified. - .IP "--stats" - Print information flow graph statistics at the end of the analysis. - .IP "-h, --help" -diff --git a/seinfoflow b/seinfoflow -index 5f4e7642ecf9..9bd1bec41da8 100755 ---- a/seinfoflow -+++ b/seinfoflow -@@ -42,6 +42,9 @@ alg.add_argument("-A", "--all_paths", type=int, metavar="MAX_STEPS", - help="Calculate all paths, with the specified maximum path length. (Expensive)") - - opts = parser.add_argument_group("Analysis options") -+opts.add_argument("-r", "--reverse", action="store_false", -+ help="Display information flows into the source type. " -+ "No effect if a target type is specified.") - opts.add_argument("-w", "--min_weight", default=3, type=int, - help="Minimum permission weight. Default is 3.") - opts.add_argument("-l", "--limit_flows", default=0, type=int, -@@ -119,7 +122,7 @@ try: - - else: # single direct info flow - flownum = 0 -- for flownum, flow in enumerate(g.infoflows(args.source), start=1): -+ for flownum, flow in enumerate(g.infoflows(args.source, out=args.reverse), start=1): - print("Flow {0}: {1} -> {2}".format(flownum, flow.source, flow.target)) - - if args.full: --- -2.41.0 - diff --git a/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch b/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch deleted file mode 100644 index f1ed9e7..0000000 --- a/0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 32ebd2c802ca0fcf3b920b298f0d2d8b2972cfa9 Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Wed, 21 Jun 2023 08:56:53 -0400 -Subject: [PATCH] seinfoflow.1: Remove references to sepolgen permission map. -Content-type: text/plain - -SETools ships with its own so that it is usable on non-SELinux systems. - -Signed-off-by: Chris PeBenito ---- - man/seinfoflow.1 | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/man/seinfoflow.1 b/man/seinfoflow.1 -index 63c70c0e7b14..e482520a8b82 100644 ---- a/man/seinfoflow.1 -+++ b/man/seinfoflow.1 -@@ -67,10 +67,10 @@ Enable debugging output. - - .SH EXAMPLE - .nf --Show the shortest paths for process running as httpd_t to access user home files, using permission map from /var/lib/sepolgen/perm_map --# seinfoflow -m /var/lib/sepolgen/perm_map -s httpd_t -t user_home_t -S -+Show the shortest paths for process running as httpd_t to access user home files, using the default permission map: -+# seinfoflow -s httpd_t -t user_home_t -S - List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled --# seinfoflow -m /var/lib/sepolgen/perm_map -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" -+# seinfoflow -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true" - - .SH AUTHOR - Chris PeBenito --- -2.41.0 - diff --git a/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch b/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch deleted file mode 100644 index 8b8df96..0000000 --- a/0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 725d224e8dd8af3a5a56c71b9de7936d098cae61 Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Tue, 16 May 2023 13:21:09 -0400 -Subject: [PATCH] AVRule/AVRuleXperm: Treat rules with no permissions as - invalid policy. -Content-type: text/plain - -Signed-off-by: Chris PeBenito ---- - setools/policyrep/terule.pxi | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi -index 6c869ed08ad9..4f4a95f553bc 100644 ---- a/setools/policyrep/terule.pxi -+++ b/setools/policyrep/terule.pxi -@@ -120,6 +120,17 @@ cdef class AVRule(BaseTERule): - r._conditional = conditional - r._conditional_block = conditional_block - r.origin = None -+ -+ if not r.perms: -+ rule_string = f"{r.ruletype} {r.source} {r.target}:{r.tclass} {{ }};" -+ try: -+ rule_string += f" [ {r.conditional} ]:{r.conditional_block}" -+ except RuleNotConditional: -+ pass -+ -+ raise LowLevelPolicyError("Invalid policy: Found a rule with no permissions: " -+ f"{rule_string}") -+ - return r - - def __hash__(self): -@@ -319,6 +330,17 @@ cdef class AVRuleXperm(BaseTERule): - r._conditional = conditional - r._conditional_block = conditional_block - r.origin = None -+ -+ if not perms: -+ rule_string = f"{r.ruletype} {r.source} {r.target}:{r.tclass} {r.xperm_type} {{ }};" -+ try: -+ rule_string += f" [ {r.conditional} ]:{r.conditional_block}" -+ except RuleNotConditional: -+ pass -+ -+ raise LowLevelPolicyError( -+ f"Invalid policy: Found a rule with no extended permissions: {rule_string}.") -+ - return r - - def __hash__(self): --- -2.41.0 - diff --git a/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch b/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch deleted file mode 100644 index caa96f3..0000000 --- a/0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch +++ /dev/null @@ -1,52 +0,0 @@ -From fc443b5a0379f3644e071a458e996ea6115ccba3 Mon Sep 17 00:00:00 2001 -From: Chris PeBenito -Date: Mon, 17 Jul 2023 16:08:21 -0400 -Subject: [PATCH] SELinuxPolicy: Add explicit cast for libspol message - callback. -Content-type: text/plain - -Cython 3.0 is more strict. The change fixes this issue: - -setools/policyrep/selinuxpolicy.pxi:685:46: Cannot assign type 'void (void *, sepol_handle_t *, const char *, ...) except *' to 'msg_callback' - -Additionally, the msg_callback is not typedef-ed in sepol/debug.h, so it must -be explicitly defined in sepol.pxd for the casting to work. - -Signed-off-by: Chris PeBenito ---- - setools/policyrep/selinuxpolicy.pxi | 2 +- - setools/policyrep/sepol.pxd | 4 +++- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/setools/policyrep/selinuxpolicy.pxi b/setools/policyrep/selinuxpolicy.pxi -index 9267a0c43abc..236316f1c6c5 100644 ---- a/setools/policyrep/selinuxpolicy.pxi -+++ b/setools/policyrep/selinuxpolicy.pxi -@@ -668,7 +668,7 @@ cdef class SELinuxPolicy: - if self.sh == NULL: - raise MemoryError - -- sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle) -+ sepol.sepol_msg_set_callback(self.sh, sepol_logging_callback, self.handle) - - if sepol.sepol_policydb_create(&self.handle) < 0: - raise MemoryError -diff --git a/setools/policyrep/sepol.pxd b/setools/policyrep/sepol.pxd -index 769498f2c5fd..36589ed1a607 100644 ---- a/setools/policyrep/sepol.pxd -+++ b/setools/policyrep/sepol.pxd -@@ -16,8 +16,10 @@ cdef extern from "": - void sepol_handle_destroy(sepol_handle_t *sh) - - -+ctypedef void (*msg_callback)(void *varg, sepol_handle_t *handle, const char *fmt, ...) -+ -+ - cdef extern from "": -- ctypedef void (*msg_callback)(void *varg, sepol_handle_t *handle, const char *fmt, ...) - void sepol_msg_set_callback(sepol_handle * handle, msg_callback cb, void *cb_arg) - - --- -2.41.0 - diff --git a/setools.spec b/setools.spec index 04ac4bf..420188c 100644 --- a/setools.spec +++ b/setools.spec @@ -2,8 +2,8 @@ %global selinux_ver 3.5-1 Name: setools -Version: 4.4.2 -Release: 4%{?dist} +Version: 4.4.3 +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,13 +11,6 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch0001: 0001-Disable-remove-neverallow-options-in-sediff.patch -Patch0002: 0002-Improve-man-pages.patch -Patch0003: 0003-tox.ini-Change-environments-to-use-python-instead-of.patch -Patch0004: 0004-seinfoflow-Add-r-option-to-get-flows-into-the-source.patch -Patch0005: 0005-seinfoflow.1-Remove-references-to-sepolgen-permissio.patch -Patch0006: 0006-AVRule-AVRuleXperm-Treat-rules-with-no-permissions-a.patch -Patch0007: 0007-SELinuxPolicy-Add-explicit-cast-for-libspol-message-.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -151,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Wed Aug 9 2023 Petr Lautrbach - 4.4.3-1 +- SETools 4.4.3 release + * Wed Jul 26 2023 Petr Lautrbach - 4.4.2-4 - Disable/remove neverallow options in sediff. - Improve man pages diff --git a/sources b/sources index 361fad1..edf09a7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.4.2.tar.gz) = b5117c5de1503e25183c2a1af92cd015320dd37e0cf26b8e09bd5d0ff879734d2f9c301def2a40b476c1ed1960f9ee04ae13b284df73f39f743004104ac85fb1 +SHA512 (4.4.3.tar.gz) = dcea6f10af0f46cb7f06aa1b29a757de7dbc30b52fe705c51a4f395d6cc25bfc7b78c15b6fc5c09ec05a2bbe8316bc79b87156304de5fe098040007d33a70143 From 3eb6ca82a81263ef74d400af8303c105a23676f6 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 28 Aug 2023 17:16:21 +0200 Subject: [PATCH 091/111] setools-4.4.3-2 - Use Qt 6 --- 0001-Use-the-The-New-Python-Enums.patch | 1895 +++++++++++++++++++++++ 0002-Use-PyQt6.patch | 1121 ++++++++++++++ setools.spec | 10 +- 3 files changed, 3023 insertions(+), 3 deletions(-) create mode 100644 0001-Use-the-The-New-Python-Enums.patch create mode 100644 0002-Use-PyQt6.patch diff --git a/0001-Use-the-The-New-Python-Enums.patch b/0001-Use-the-The-New-Python-Enums.patch new file mode 100644 index 0000000..8fead1e --- /dev/null +++ b/0001-Use-the-The-New-Python-Enums.patch @@ -0,0 +1,1895 @@ +From abe184f4899cdab53f5b5c69f00c2eec64176517 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 28 Aug 2023 19:07:06 +0200 +Subject: [PATCH] Use the The New Python Enums +Content-type: text/plain + +https://doc.qt.io/qtforpython-6/considerations.html#the-new-python-enums + +In PyQt5, it's possible to use members of enums in the same scope as +enums, e.g. Qt.red. This is not possible in PyQt6, but both PyQt5 and +PyQt6 support the new python enums - Qt.GlobalColor.red + +This change prepares the code for the future transition to PyQt6. + +Signed-off-by: Petr Lautrbach +--- + setoolsgui/apol/analysistab.py | 2 +- + setoolsgui/apol/boolquery.py | 8 +++---- + setoolsgui/apol/boundsquery.py | 6 +++--- + setoolsgui/apol/categoryquery.py | 8 +++---- + setoolsgui/apol/chooseanalysis.py | 2 +- + setoolsgui/apol/commonquery.py | 10 ++++----- + setoolsgui/apol/constraintquery.py | 10 ++++----- + setoolsgui/apol/defaultquery.py | 10 ++++----- + setoolsgui/apol/dta.py | 6 +++--- + setoolsgui/apol/excludetypes.py | 12 +++++------ + setoolsgui/apol/fsusequery.py | 6 +++--- + setoolsgui/apol/genfsconquery.py | 6 +++--- + setoolsgui/apol/ibendportconquery.py | 6 +++--- + setoolsgui/apol/ibpkeyconquery.py | 6 +++--- + setoolsgui/apol/infoflow.py | 8 +++---- + setoolsgui/apol/initsidquery.py | 6 +++--- + setoolsgui/apol/mainwindow.py | 32 ++++++++++++++-------------- + setoolsgui/apol/mlsrulequery.py | 8 +++---- + setoolsgui/apol/netifconquery.py | 6 +++--- + setoolsgui/apol/nodeconquery.py | 8 +++---- + setoolsgui/apol/objclassquery.py | 12 +++++------ + setoolsgui/apol/permmapedit.py | 12 +++++------ + setoolsgui/apol/portconquery.py | 8 +++---- + setoolsgui/apol/rbacrulequery.py | 8 +++---- + setoolsgui/apol/rolequery.py | 10 ++++----- + setoolsgui/apol/sensitivityquery.py | 8 +++---- + setoolsgui/apol/terulequery.py | 16 +++++++------- + setoolsgui/apol/typeattrquery.py | 10 ++++----- + setoolsgui/apol/typequery.py | 10 ++++----- + setoolsgui/apol/userquery.py | 10 ++++----- + setoolsgui/apol/workspace.py | 8 +++---- + setoolsgui/boolmodel.py | 4 ++-- + setoolsgui/boundsmodel.py | 4 ++-- + setoolsgui/commonmodel.py | 4 ++-- + setoolsgui/constraintmodel.py | 4 ++-- + setoolsgui/defaultmodel.py | 4 ++-- + setoolsgui/details.py | 6 +++--- + setoolsgui/fsusemodel.py | 4 ++-- + setoolsgui/genfsconmodel.py | 4 ++-- + setoolsgui/ibendportconmodel.py | 4 ++-- + setoolsgui/ibpkeyconmodel.py | 4 ++-- + setoolsgui/initsidmodel.py | 4 ++-- + setoolsgui/listview.py | 6 +++--- + setoolsgui/mlsmodel.py | 4 ++-- + setoolsgui/mlsrulemodel.py | 4 ++-- + setoolsgui/models.py | 12 +++++------ + setoolsgui/netifconmodel.py | 4 ++-- + setoolsgui/nodeconmodel.py | 4 ++-- + setoolsgui/objclassmodel.py | 4 ++-- + setoolsgui/portconmodel.py | 4 ++-- + setoolsgui/rbacrulemodel.py | 4 ++-- + setoolsgui/rolemodel.py | 4 ++-- + setoolsgui/tableview.py | 6 +++--- + setoolsgui/terulemodel.py | 4 ++-- + setoolsgui/typeattrmodel.py | 4 ++-- + setoolsgui/typemodel.py | 4 ++-- + setoolsgui/usermodel.py | 4 ++-- + 57 files changed, 198 insertions(+), 198 deletions(-) + +diff --git a/setoolsgui/apol/analysistab.py b/setoolsgui/apol/analysistab.py +index 1ed803419331..bc3629ff274a 100644 +--- a/setoolsgui/apol/analysistab.py ++++ b/setoolsgui/apol/analysistab.py +@@ -100,7 +100,7 @@ class AnalysisTab(SEToolsWidget, QScrollArea, metaclass=TabRegistry): + self._check_query() + + def _check_query(self): +- button = self.buttonBox.button(QDialogButtonBox.Apply) ++ button = self.buttonBox.button(QDialogButtonBox.StandardButton.Apply) + enabled = not self.errors + button.setEnabled(enabled) + button.setToolTip("Run the analysis." if enabled else "There are errors in the tab.") +diff --git a/setoolsgui/apol/boolquery.py b/setoolsgui/apol/boolquery.py +index 5b0cdd8b4322..6116fe48a846 100644 +--- a/setoolsgui/apol/boolquery.py ++++ b/setoolsgui/apol/boolquery.py +@@ -57,13 +57,13 @@ class BoolQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -105,7 +105,7 @@ class BoolQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.bools.selectedIndexes()[0] +- item = self.bool_model.data(index, Qt.UserRole) ++ item = self.bool_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + boolean_detail(self, item) +@@ -187,6 +187,6 @@ class BoolQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/boundsquery.py b/setoolsgui/apol/boundsquery.py +index 8944d1b7bf8a..5b90c2ee2ded 100644 +--- a/setoolsgui/apol/boundsquery.py ++++ b/setoolsgui/apol/boundsquery.py +@@ -52,13 +52,13 @@ class BoundsQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(1, Qt.AscendingOrder) ++ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.parent.palette() + self.error_palette = self.parent.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_parent_error() + self.clear_child_error() + +@@ -189,6 +189,6 @@ class BoundsQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/categoryquery.py b/setoolsgui/apol/categoryquery.py +index 884b4156d75a..598f163c335f 100644 +--- a/setoolsgui/apol/categoryquery.py ++++ b/setoolsgui/apol/categoryquery.py +@@ -57,13 +57,13 @@ class CategoryQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -105,7 +105,7 @@ class CategoryQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.cats.selectedIndexes()[0] +- item = self.category_model.data(index, Qt.UserRole) ++ item = self.category_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + category_detail(self, item) +@@ -186,6 +186,6 @@ class CategoryQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/chooseanalysis.py b/setoolsgui/apol/chooseanalysis.py +index 892abdaac5f9..155ae6d2f4ae 100644 +--- a/setoolsgui/apol/chooseanalysis.py ++++ b/setoolsgui/apol/chooseanalysis.py +@@ -52,7 +52,7 @@ class ChooseAnalysis(SEToolsWidget, QDialog): + groupitem.addChild(item) + + self.analysisTypes.expandAll() +- self.analysisTypes.sortByColumn(0, Qt.AscendingOrder) ++ self.analysisTypes.sortByColumn(0, Qt.SortOrder.AscendingOrder) + super(ChooseAnalysis, self).show() + + def accept(self, item=None): +diff --git a/setoolsgui/apol/commonquery.py b/setoolsgui/apol/commonquery.py +index e90ec543666b..8fb11e87290d 100644 +--- a/setoolsgui/apol/commonquery.py ++++ b/setoolsgui/apol/commonquery.py +@@ -65,13 +65,13 @@ class CommonQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -116,7 +116,7 @@ class CommonQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.commons.selectedIndexes()[0] +- item = self.common_model.data(index, Qt.UserRole) ++ item = self.common_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + common_detail(self, item) +@@ -146,7 +146,7 @@ class CommonQueryTab(AnalysisTab): + def set_perms(self): + selected_perms = [] + for index in self.perms.selectionModel().selectedIndexes(): +- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) ++ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.perms = selected_perms + +@@ -212,6 +212,6 @@ class CommonQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/constraintquery.py b/setoolsgui/apol/constraintquery.py +index cfa841b22cb5..ee64db0ca1df 100644 +--- a/setoolsgui/apol/constraintquery.py ++++ b/setoolsgui/apol/constraintquery.py +@@ -84,7 +84,7 @@ class ConstraintQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_user_error() + self.clear_type_error() + self.clear_role_error() +@@ -94,7 +94,7 @@ class ConstraintQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -173,7 +173,7 @@ class ConstraintQueryTab(AnalysisTab): + def set_tclass(self): + selected_classes = [] + for index in self.tclass.selectionModel().selectedIndexes(): +- selected_classes.append(self.class_model.data(index, Qt.UserRole)) ++ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.tclass = selected_classes + self.perms_model.set_classes(selected_classes) +@@ -187,7 +187,7 @@ class ConstraintQueryTab(AnalysisTab): + def set_perms(self): + selected_perms = [] + for index in self.perms.selectionModel().selectedIndexes(): +- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) ++ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.perms = selected_perms + +@@ -323,6 +323,6 @@ class ConstraintQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/defaultquery.py b/setoolsgui/apol/defaultquery.py +index 1efa3c468738..e09692ee6a46 100644 +--- a/setoolsgui/apol/defaultquery.py ++++ b/setoolsgui/apol/defaultquery.py +@@ -52,7 +52,7 @@ class DefaultQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(1, Qt.AscendingOrder) ++ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) + + # populate class list + self.class_model = SEToolsListModel(self) +@@ -124,7 +124,7 @@ class DefaultQueryTab(AnalysisTab): + def set_tclass(self): + selected_classes = [] + for index in self.tclass.selectionModel().selectedIndexes(): +- selected_classes.append(self.class_model.data(index, Qt.UserRole)) ++ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.tclass = selected_classes + +@@ -163,10 +163,10 @@ class DefaultQueryTab(AnalysisTab): + rule_types.append(mode.objectName()) + + self.query.ruletype = rule_types +- self.query.default = self.default_value.currentData(Qt.UserRole) ++ self.query.default = self.default_value.currentData(Qt.ItemDataRole.UserRole) + + if self.default_range_value.isEnabled(): +- self.query.default_range = self.default_range_value.currentData(Qt.UserRole) ++ self.query.default_range = self.default_range_value.currentData(Qt.ItemDataRole.UserRole) + else: + self.query.default_range = None + +@@ -193,6 +193,6 @@ class DefaultQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py +index a78d96095b28..8bbed4dbe21f 100644 +--- a/setoolsgui/apol/dta.py ++++ b/setoolsgui/apol/dta.py +@@ -62,7 +62,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.source.palette() + self.error_palette = self.source.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_source_error() + self.clear_target_error() + +@@ -281,7 +281,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): + + print_transition(self.browser_details.appendPlainText, current.rules) + +- self.browser_details.moveCursor(QTextCursor.Start) ++ self.browser_details.moveCursor(QTextCursor.MoveOperation.Start) + + if not current.child_populated: + self.busy.setLabelText("Gathering additional browser details for {0}...".format( +@@ -337,7 +337,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + if self.flows_in.isChecked() or self.flows_out.isChecked(): + # move to browser tab for transitions in/out +diff --git a/setoolsgui/apol/excludetypes.py b/setoolsgui/apol/excludetypes.py +index bee73c58dc66..1c4beaf84542 100644 +--- a/setoolsgui/apol/excludetypes.py ++++ b/setoolsgui/apol/excludetypes.py +@@ -40,14 +40,14 @@ class ExcludeTypes(SEToolsWidget, QDialog): + if t not in self.initial_excluded_list] + self.included_sort = FilterByAttributeProxy(self) + self.included_sort.setSourceModel(self.included_model) +- self.included_sort.sort(0, Qt.AscendingOrder) ++ self.included_sort.sort(0, Qt.SortOrder.AscendingOrder) + self.included_types.setModel(self.included_sort) + + self.excluded_model = SEToolsListModel(self) + self.excluded_model.item_list = self.initial_excluded_list + self.excluded_sort = FilterByAttributeProxy(self) + self.excluded_sort.setSourceModel(self.excluded_model) +- self.excluded_sort.sort(0, Qt.AscendingOrder) ++ self.excluded_sort.sort(0, Qt.SortOrder.AscendingOrder) + self.excluded_types.setModel(self.excluded_sort) + + # connect signals +@@ -62,7 +62,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): + selected_types = [] + for index in self.excluded_types.selectionModel().selectedIndexes(): + source_index = self.excluded_sort.mapToSource(index) +- item = self.excluded_model.data(source_index, Qt.UserRole) ++ item = self.excluded_model.data(source_index, Qt.ItemDataRole.UserRole) + self.included_model.append(item) + selected_types.append(item) + +@@ -81,7 +81,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): + selected_types = [] + for index in self.included_types.selectionModel().selectedIndexes(): + source_index = self.included_sort.mapToSource(index) +- item = self.included_model.data(source_index, Qt.UserRole) ++ item = self.included_model.data(source_index, Qt.ItemDataRole.UserRole) + self.excluded_model.append(item) + selected_types.append(item) + +@@ -95,7 +95,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): + + def set_attr_filter(self, row): + index = self.attr_model.index(row) +- attr = self.attr_model.data(index, Qt.UserRole) ++ attr = self.attr_model.data(index, Qt.ItemDataRole.UserRole) + self.log.debug("Attribute set to {0!r}".format(attr)) + self.included_sort.attr = attr + self.excluded_sort.attr = attr +@@ -126,7 +126,7 @@ class FilterByAttributeProxy(QSortFilterProxyModel): + if self.attr: + source = self.sourceModel() + index = source.index(row) +- item = source.data(index, Qt.UserRole) ++ item = source.data(index, Qt.ItemDataRole.UserRole) + if item not in self.attr: + return False + +diff --git a/setoolsgui/apol/fsusequery.py b/setoolsgui/apol/fsusequery.py +index 9bb192b30232..4e7567f4e4c6 100644 +--- a/setoolsgui/apol/fsusequery.py ++++ b/setoolsgui/apol/fsusequery.py +@@ -74,7 +74,7 @@ class FSUseQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_fs_error() + self.clear_user_error() + self.clear_type_error() +@@ -86,7 +86,7 @@ class FSUseQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(1, Qt.AscendingOrder) ++ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -312,6 +312,6 @@ class FSUseQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/genfsconquery.py b/setoolsgui/apol/genfsconquery.py +index 22112a8fb7bf..33dbed787cd6 100644 +--- a/setoolsgui/apol/genfsconquery.py ++++ b/setoolsgui/apol/genfsconquery.py +@@ -74,7 +74,7 @@ class GenfsconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_fs_error() + self.clear_path_error() + self.clear_user_error() +@@ -87,7 +87,7 @@ class GenfsconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -312,6 +312,6 @@ class GenfsconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/ibendportconquery.py b/setoolsgui/apol/ibendportconquery.py +index 6db99c2b5e0f..18252dd23de0 100644 +--- a/setoolsgui/apol/ibendportconquery.py ++++ b/setoolsgui/apol/ibendportconquery.py +@@ -74,7 +74,7 @@ class IbendportconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + self.clear_port_error() + self.clear_user_error() +@@ -87,7 +87,7 @@ class IbendportconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -304,6 +304,6 @@ class IbendportconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/ibpkeyconquery.py b/setoolsgui/apol/ibpkeyconquery.py +index 3efd342145f1..b7a78bf908a0 100644 +--- a/setoolsgui/apol/ibpkeyconquery.py ++++ b/setoolsgui/apol/ibpkeyconquery.py +@@ -74,7 +74,7 @@ class IbpkeyconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_subnet_prefix_error() + self.clear_pkeys_error() + self.clear_user_error() +@@ -87,7 +87,7 @@ class IbpkeyconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -317,6 +317,6 @@ class IbpkeyconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py +index fb9b4099cfc0..526f3074e143 100644 +--- a/setoolsgui/apol/infoflow.py ++++ b/setoolsgui/apol/infoflow.py +@@ -75,7 +75,7 @@ class InfoFlowAnalysisTab(AnalysisTab): + + # set up error message for missing perm map + self.error_msg = QMessageBox(self) +- self.error_msg.setStandardButtons(QMessageBox.Ok) ++ self.error_msg.setStandardButtons(QMessageBox.StandardButton.Ok) + + # set up perm map editor + self.permmap_editor = PermissionMapEditor(self, False) +@@ -93,7 +93,7 @@ class InfoFlowAnalysisTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.source.palette() + self.error_palette = self.source.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_source_error() + self.clear_target_error() + +@@ -325,7 +325,7 @@ class InfoFlowAnalysisTab(AnalysisTab): + for rule in current.rules: + self.browser_details.appendPlainText(rule) + +- self.browser_details.moveCursor(QTextCursor.Start) ++ self.browser_details.moveCursor(QTextCursor.MoveOperation.Start) + + if not current.child_populated: + self.busy.setLabelText("Gathering additional browser details for {0}...".format( +@@ -390,7 +390,7 @@ class InfoFlowAnalysisTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + if self.flows_in.isChecked() or self.flows_out.isChecked(): + # move to browser tab for flows in/out +diff --git a/setoolsgui/apol/initsidquery.py b/setoolsgui/apol/initsidquery.py +index b31c9986b3a5..d01f87130925 100644 +--- a/setoolsgui/apol/initsidquery.py ++++ b/setoolsgui/apol/initsidquery.py +@@ -74,7 +74,7 @@ class InitialSIDQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + self.clear_user_error() + self.clear_type_error() +@@ -86,7 +86,7 @@ class InitialSIDQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -287,6 +287,6 @@ class InitialSIDQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/mainwindow.py b/setoolsgui/apol/mainwindow.py +index 3cdb11d3e32e..dcbfb7590ef7 100644 +--- a/setoolsgui/apol/mainwindow.py ++++ b/setoolsgui/apol/mainwindow.py +@@ -60,20 +60,20 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + + # set up error message dialog + self.error_msg = QMessageBox(self) +- self.error_msg.setStandardButtons(QMessageBox.Ok) ++ self.error_msg.setStandardButtons(QMessageBox.StandardButton.Ok) + + # set up permission map editor + self.permmap_editor = PermissionMapEditor(self, True) + + # set up tab name editor + self.tab_editor = QLineEdit(self.AnalysisTabs) +- self.tab_editor.setWindowFlags(Qt.Popup) ++ self.tab_editor.setWindowFlags(Qt.WindowType.Popup) + + # configure tab bar context menu + tabBar = self.AnalysisTabs.tabBar() + tabBar.addAction(self.rename_tab_action) + tabBar.addAction(self.close_tab_action) +- tabBar.setContextMenuPolicy(Qt.ActionsContextMenu) ++ tabBar.setContextMenuPolicy(Qt.ContextMenuPolicy.ActionsContextMenu) + + # capture INFO and higher Python messages from setools lib for status bar + handler = LogHandlerToSignal() +@@ -127,9 +127,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + reply = QMessageBox.question( + self, "Continue?", + "Loading a policy will close all existing analyses. Continue?", +- QMessageBox.Yes | QMessageBox.No) ++ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) + +- if reply == QMessageBox.No: ++ if reply == QMessageBox.StandardButton.No: + return + + filename = QFileDialog.getOpenFileName(self, "Open policy file", ".", +@@ -163,9 +163,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + reply = QMessageBox.question( + self, "Continue?", + "Closing a policy will close all existing analyses. Continue?", +- QMessageBox.Yes | QMessageBox.No) ++ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) + +- if reply == QMessageBox.No: ++ if reply == QMessageBox.StandardButton.No: + return + + self.AnalysisTabs.clear() +@@ -245,7 +245,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + counted_name = "{0}: {1}".format(self.tab_counter, tabtitle) + + newanalysis = tabclass(self, self._policy, self._permmap) +- newanalysis.setAttribute(Qt.WA_DeleteOnClose) ++ newanalysis.setAttribute(Qt.WidgetAttribute.WA_DeleteOnClose) + newanalysis.setObjectName(counted_name) + + index = self.AnalysisTabs.addTab(newanalysis, counted_name) +@@ -444,9 +444,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + reply = QMessageBox.question( + self, "Continue?", + "Loading a workspace will close all existing analyses. Continue?", +- QMessageBox.Yes | QMessageBox.No) ++ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) + +- if reply == QMessageBox.No: ++ if reply == QMessageBox.StandardButton.No: + return + + # 2. try to load the workspace file, if we fail, bail +@@ -633,7 +633,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + + def apol_help(self): + """Open the main help window.""" +- if self.help_process.state() != QProcess.NotRunning: ++ if self.help_process.state() != QProcess.ProcessState.NotRunning: + return + + distro = pkg_resources.get_distribution("setools") +@@ -648,7 +648,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + @pyqtSlot(QProcess.ProcessError) + def help_failed(self, error): + """Starting assistant failed.""" +- if error != QProcess.FailedToStart: ++ if error != QProcess.ProcessError.FailedToStart: + return + + self.log.error("Failed to start Qt assistant {}.".format(self.config.assistant)) +@@ -669,9 +669,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + "This is typically in the assistant or qt5-assistant package. " + "Choose location of Qt Assistant executable?".format( + self.config.assistant), +- QMessageBox.Yes | QMessageBox.No) ++ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) + +- if reply == QMessageBox.No: ++ if reply == QMessageBox.StandardButton.No: + return + + filename = QFileDialog.getOpenFileName(self, "Location of qt-assistant executable", +@@ -689,12 +689,12 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + @pyqtSlot(str) + def set_help(self, location): + """Set the help window to the specified document.""" +- if self.help_process.state() == QProcess.NotStarted: ++ if self.help_process.state() == QProcess.ProcessState.NotRunning: + self.apol_help() + if not self.help_process.waitForStarted(): + self.log.warning("Timed out waiting for Qt assistant to start.") + return +- elif self.help_process.state() == QProcess.Starting: ++ elif self.help_process.state() == QProcess.ProcessState.Starting: + if not self.help_process.waitForStarted(): + self.log.warning("Timed out waiting for Qt assistant to start.") + return +diff --git a/setoolsgui/apol/mlsrulequery.py b/setoolsgui/apol/mlsrulequery.py +index ba2be4597982..bb554ade6657 100644 +--- a/setoolsgui/apol/mlsrulequery.py ++++ b/setoolsgui/apol/mlsrulequery.py +@@ -61,7 +61,7 @@ class MLSRuleQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.source.palette() + self.error_palette = self.source.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_source_error() + self.clear_target_error() + self.clear_default_error() +@@ -76,7 +76,7 @@ class MLSRuleQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(1, Qt.AscendingOrder) ++ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -181,7 +181,7 @@ class MLSRuleQueryTab(AnalysisTab): + def set_tclass(self): + selected_classes = [] + for index in self.tclass.selectionModel().selectedIndexes(): +- selected_classes.append(self.class_model.data(index, Qt.UserRole)) ++ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.tclass = selected_classes + +@@ -264,6 +264,6 @@ class MLSRuleQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/netifconquery.py b/setoolsgui/apol/netifconquery.py +index ca2405f7cae6..4cf3de1a9f5c 100644 +--- a/setoolsgui/apol/netifconquery.py ++++ b/setoolsgui/apol/netifconquery.py +@@ -74,7 +74,7 @@ class NetifconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + self.clear_user_error() + self.clear_type_error() +@@ -86,7 +86,7 @@ class NetifconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -287,6 +287,6 @@ class NetifconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/nodeconquery.py b/setoolsgui/apol/nodeconquery.py +index 320b0d616a67..81a33a794c05 100644 +--- a/setoolsgui/apol/nodeconquery.py ++++ b/setoolsgui/apol/nodeconquery.py +@@ -80,7 +80,7 @@ class NodeconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_network_error() + self.clear_user_error() + self.clear_type_error() +@@ -92,7 +92,7 @@ class NodeconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -263,7 +263,7 @@ class NodeconQueryTab(AnalysisTab): + def run(self, button): + # right now there is only one button. + self.query.network_overlap = self.network_overlap.isChecked() +- self.query.ip_version = self.ip_version.currentData(Qt.UserRole) ++ self.query.ip_version = self.ip_version.currentData(Qt.ItemDataRole.UserRole) + self.query.range_overlap = self.range_overlap.isChecked() + self.query.range_subset = self.range_subset.isChecked() + self.query.range_superset = self.range_superset.isChecked() +@@ -291,6 +291,6 @@ class NodeconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/objclassquery.py b/setoolsgui/apol/objclassquery.py +index 9744a187ade7..23c8188e8bbd 100644 +--- a/setoolsgui/apol/objclassquery.py ++++ b/setoolsgui/apol/objclassquery.py +@@ -66,13 +66,13 @@ class ObjClassQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -117,7 +117,7 @@ class ObjClassQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.classes.selectedIndexes()[0] +- item = self.class_model.data(index, Qt.UserRole) ++ item = self.class_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + class_detail(self, item) +@@ -146,7 +146,7 @@ class ObjClassQueryTab(AnalysisTab): + # + def set_common(self): + for index in self.common.selectionModel().selectedIndexes(): +- self.query.common = self.common_model.data(index, Qt.UserRole) ++ self.query.common = self.common_model.data(index, Qt.ItemDataRole.UserRole) + break + else: + self.query.common = None +@@ -157,7 +157,7 @@ class ObjClassQueryTab(AnalysisTab): + def set_perms(self): + selected_perms = [] + for index in self.perms.selectionModel().selectedIndexes(): +- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) ++ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.perms = selected_perms + +@@ -224,6 +224,6 @@ class ObjClassQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/permmapedit.py b/setoolsgui/apol/permmapedit.py +index 97482b30e1a2..d1e0b01ce854 100644 +--- a/setoolsgui/apol/permmapedit.py ++++ b/setoolsgui/apol/permmapedit.py +@@ -86,7 +86,7 @@ class PermissionMapEditor(SEToolsWidget, QDialog): + def class_selected(self): + # the .ui is set to 1 selection + for index in self.classes.selectionModel().selectedIndexes(): +- class_name = self.class_model.data(index, Qt.DisplayRole) ++ class_name = self.class_model.data(index, Qt.ItemDataRole.DisplayRole) + + self.log.debug("Setting class to {0}".format(class_name)) + +@@ -99,15 +99,15 @@ class PermissionMapEditor(SEToolsWidget, QDialog): + for perm in sorted(self.perm_map.perms(class_name)): + # create permission mapping + mapping = PermissionMapping(self, perm, self.edit) +- mapping.setAttribute(Qt.WA_DeleteOnClose) ++ mapping.setAttribute(Qt.WidgetAttribute.WA_DeleteOnClose) + self.class_toggle.connect(mapping.enabled.setChecked) + self.perm_mappings.addWidget(mapping) + self.widgets.append(mapping) + + # add horizonal line + line = QFrame(self) +- line.setFrameShape(QFrame.HLine) +- line.setFrameShadow(QFrame.Sunken) ++ line.setFrameShape(QFrame.Shape.HLine) ++ line.setFrameShadow(QFrame.Shadow.Sunken) + self.perm_mappings.addWidget(line) + self.widgets.append(line) + +@@ -179,8 +179,8 @@ class PermissionMapping(SEToolsWidget, QWidget): + # setup color palettes for direction + self.orig_palette = self.direction.palette() + self.error_palette = self.direction.palette() +- self.error_palette.setColor(QPalette.Button, Qt.red) +- self.error_palette.setColor(QPalette.ButtonText, Qt.white) ++ self.error_palette.setColor(QPalette.ColorRole.Button, Qt.GlobalColor.red) ++ self.error_palette.setColor(QPalette.ColorRole.ButtonText, Qt.GlobalColor.white) + + # setup direction + self.direction.insertItems(0, index_to_word) +diff --git a/setoolsgui/apol/portconquery.py b/setoolsgui/apol/portconquery.py +index 50d054f867a5..de0a16567f1c 100644 +--- a/setoolsgui/apol/portconquery.py ++++ b/setoolsgui/apol/portconquery.py +@@ -75,7 +75,7 @@ class PortconQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.type_.palette() + self.error_palette = self.type_.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_ports_error() + self.clear_user_error() + self.clear_type_error() +@@ -92,7 +92,7 @@ class PortconQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -280,7 +280,7 @@ class PortconQueryTab(AnalysisTab): + self.query.ports_overlap = self.ports_overlap.isChecked() + self.query.ports_subset = self.ports_subset.isChecked() + self.query.ports_superset = self.ports_superset.isChecked() +- self.query.protocol = self.protocol.currentData(Qt.UserRole) ++ self.query.protocol = self.protocol.currentData(Qt.ItemDataRole.UserRole) + self.query.range_overlap = self.range_overlap.isChecked() + self.query.range_subset = self.range_subset.isChecked() + self.query.range_superset = self.range_superset.isChecked() +@@ -308,6 +308,6 @@ class PortconQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/rbacrulequery.py b/setoolsgui/apol/rbacrulequery.py +index 0ce4bb9ad6c6..4749d324d858 100644 +--- a/setoolsgui/apol/rbacrulequery.py ++++ b/setoolsgui/apol/rbacrulequery.py +@@ -71,7 +71,7 @@ class RBACRuleQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.source.palette() + self.error_palette = self.source.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_source_error() + self.clear_target_error() + self.clear_default_error() +@@ -86,7 +86,7 @@ class RBACRuleQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -194,7 +194,7 @@ class RBACRuleQueryTab(AnalysisTab): + def set_tclass(self): + selected_classes = [] + for index in self.tclass.selectionModel().selectedIndexes(): +- selected_classes.append(self.class_model.data(index, Qt.UserRole)) ++ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.tclass = selected_classes + +@@ -292,6 +292,6 @@ class RBACRuleQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/rolequery.py b/setoolsgui/apol/rolequery.py +index 29983a5961ee..e75614d9a992 100644 +--- a/setoolsgui/apol/rolequery.py ++++ b/setoolsgui/apol/rolequery.py +@@ -62,13 +62,13 @@ class RoleQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -112,7 +112,7 @@ class RoleQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.roles.selectedIndexes()[0] +- item = self.role_model.data(index, Qt.UserRole) ++ item = self.role_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + role_detail(self, item) +@@ -142,7 +142,7 @@ class RoleQueryTab(AnalysisTab): + def set_types(self): + selected_types = [] + for index in self.types.selectionModel().selectedIndexes(): +- selected_types.append(self.type_model.data(index, Qt.UserRole)) ++ selected_types.append(self.type_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.types = selected_types + +@@ -209,6 +209,6 @@ class RoleQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/sensitivityquery.py b/setoolsgui/apol/sensitivityquery.py +index d5bcbec53fda..c8a27891ae97 100644 +--- a/setoolsgui/apol/sensitivityquery.py ++++ b/setoolsgui/apol/sensitivityquery.py +@@ -57,13 +57,13 @@ class SensitivityQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -105,7 +105,7 @@ class SensitivityQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.sens.selectedIndexes()[0] +- item = self.sensitivity_model.data(index, Qt.UserRole) ++ item = self.sensitivity_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + sensitivity_detail(self, item) +@@ -186,6 +186,6 @@ class SensitivityQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/terulequery.py b/setoolsgui/apol/terulequery.py +index 3064710550f5..7c99469edc87 100644 +--- a/setoolsgui/apol/terulequery.py ++++ b/setoolsgui/apol/terulequery.py +@@ -69,7 +69,7 @@ class TERuleQueryTab(AnalysisTab): + self.errors = set() + self.orig_palette = self.source.palette() + self.error_palette = self.source.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_source_error() + self.clear_target_error() + self.clear_default_error() +@@ -94,7 +94,7 @@ class TERuleQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # set up processing thread + self.thread = QThread() +@@ -221,7 +221,7 @@ class TERuleQueryTab(AnalysisTab): + def set_tclass(self): + selected_classes = [] + for index in self.tclass.selectionModel().selectedIndexes(): +- selected_classes.append(self.class_model.data(index, Qt.UserRole)) ++ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.tclass = selected_classes + self.perms_model.set_classes(selected_classes) +@@ -236,7 +236,7 @@ class TERuleQueryTab(AnalysisTab): + def set_perms(self): + selected_perms = [] + for index in self.perms.selectionModel().selectedIndexes(): +- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) ++ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.perms = selected_perms + +@@ -302,7 +302,7 @@ class TERuleQueryTab(AnalysisTab): + def set_bools(self): + selected_bools = [] + for index in self.bool_criteria.selectionModel().selectedIndexes(): +- selected_bools.append(self.bool_model.data(index, Qt.UserRole)) ++ selected_bools.append(self.bool_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.boolean = selected_bools + +@@ -407,9 +407,9 @@ class TERuleQueryTab(AnalysisTab): + reply = QMessageBox.question( + self, "Continue?", + "This is a broad query, estimated to return {0} results. Continue?". +- format(max_results), QMessageBox.Yes | QMessageBox.No) ++ format(max_results), QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) + +- if reply == QMessageBox.No: ++ if reply == QMessageBox.StandardButton.No: + return + + # start processing +@@ -440,6 +440,6 @@ class TERuleQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/typeattrquery.py b/setoolsgui/apol/typeattrquery.py +index 14a4141d922a..67a087a7e3f0 100644 +--- a/setoolsgui/apol/typeattrquery.py ++++ b/setoolsgui/apol/typeattrquery.py +@@ -62,13 +62,13 @@ class TypeAttributeQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -112,7 +112,7 @@ class TypeAttributeQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.attrs.selectedIndexes()[0] +- item = self.attr_model.data(index, Qt.UserRole) ++ item = self.attr_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + typeattr_detail(self, item) +@@ -142,7 +142,7 @@ class TypeAttributeQueryTab(AnalysisTab): + def set_types(self): + selected_types = [] + for index in self.types.selectionModel().selectedIndexes(): +- selected_types.append(self.type_model.data(index, Qt.UserRole)) ++ selected_types.append(self.type_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.types = selected_types + +@@ -209,6 +209,6 @@ class TypeAttributeQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/typequery.py b/setoolsgui/apol/typequery.py +index 2e261ccd52db..a22e3547cd16 100644 +--- a/setoolsgui/apol/typequery.py ++++ b/setoolsgui/apol/typequery.py +@@ -62,13 +62,13 @@ class TypeQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + # set up processing thread +@@ -112,7 +112,7 @@ class TypeQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.types.selectedIndexes()[0] +- item = self.type_model.data(index, Qt.UserRole) ++ item = self.type_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + type_detail(self, item) +@@ -142,7 +142,7 @@ class TypeQueryTab(AnalysisTab): + def set_attrs(self): + selected_attrs = [] + for index in self.attrs.selectionModel().selectedIndexes(): +- selected_attrs.append(self.attr_model.data(index, Qt.UserRole)) ++ selected_attrs.append(self.attr_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.attrs = selected_attrs + +@@ -213,6 +213,6 @@ class TypeQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/userquery.py b/setoolsgui/apol/userquery.py +index c325888db8ec..19ffb03c2975 100644 +--- a/setoolsgui/apol/userquery.py ++++ b/setoolsgui/apol/userquery.py +@@ -62,13 +62,13 @@ class UserQueryTab(AnalysisTab): + self.sort_proxy = QSortFilterProxyModel(self) + self.sort_proxy.setSourceModel(self.table_results_model) + self.table_results.setModel(self.sort_proxy) +- self.table_results.sortByColumn(0, Qt.AscendingOrder) ++ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) + + # setup indications of errors on level/range + self.errors = set() + self.orig_palette = self.name.palette() + self.error_palette = self.name.palette() +- self.error_palette.setColor(QPalette.Base, Qt.red) ++ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) + self.clear_name_error() + + if self.policy.mls: +@@ -135,7 +135,7 @@ class UserQueryTab(AnalysisTab): + def get_detail(self): + # .ui is set for single item selection. + index = self.users.selectedIndexes()[0] +- item = self.user_model.data(index, Qt.UserRole) ++ item = self.user_model.data(index, Qt.ItemDataRole.UserRole) + + self.log.debug("Generating detail window for {0}".format(item)) + user_detail(self, item) +@@ -165,7 +165,7 @@ class UserQueryTab(AnalysisTab): + def set_roles(self): + selected_roles = [] + for index in self.roles.selectionModel().selectedIndexes(): +- selected_roles.append(self.role_model.data(index, Qt.UserRole)) ++ selected_roles.append(self.role_model.data(index, Qt.ItemDataRole.UserRole)) + + self.query.roles = selected_roles + +@@ -262,6 +262,6 @@ class UserQueryTab(AnalysisTab): + if not self.busy.wasCanceled(): + self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") + self.busy.repaint() +- self.raw_results.moveCursor(QTextCursor.Start) ++ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) + + self.busy.reset() +diff --git a/setoolsgui/apol/workspace.py b/setoolsgui/apol/workspace.py +index 0f8ec82cdaea..2b4229224b85 100644 +--- a/setoolsgui/apol/workspace.py ++++ b/setoolsgui/apol/workspace.py +@@ -141,7 +141,7 @@ def save_listviews(tab, settings, listviews): + + selections = [] + for index in listview.selectedIndexes(): +- item = datamodel.data(index, Qt.DisplayRole) ++ item = datamodel.data(index, Qt.ItemDataRole.DisplayRole) + selections.append(item) + + settings[entry] = selections +@@ -181,10 +181,10 @@ def load_listviews(tab, settings, listviews): + + for row in range(datamodel.rowCount()): + index = datamodel.createIndex(row, 0) +- item = datamodel.data(index, Qt.DisplayRole) ++ item = datamodel.data(index, Qt.ItemDataRole.DisplayRole) + + if item in selections: +- selectionmodel.select(index, QItemSelectionModel.Select) ++ selectionmodel.select(index, QItemSelectionModel.SelectionFlag.Select) + + + def save_comboboxes(tab, settings, comboboxes): +@@ -199,7 +199,7 @@ def save_comboboxes(tab, settings, comboboxes): + + for entry in comboboxes: + combobox = getattr(tab, entry) +- settings[entry] = combobox.currentData(Qt.DisplayRole) ++ settings[entry] = combobox.currentData(Qt.ItemDataRole.DisplayRole) + + + def load_comboboxes(tab, settings, comboboxes): +diff --git a/setoolsgui/boolmodel.py b/setoolsgui/boolmodel.py +index 0d698c92f51b..c331fdd5057d 100644 +--- a/setoolsgui/boolmodel.py ++++ b/setoolsgui/boolmodel.py +@@ -38,12 +38,12 @@ class BooleanTableModel(SEToolsTableModel): + col = index.column() + boolean = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return boolean.name + elif col == 1: + return str(boolean.state) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + # get the whole rule for boolean boolean + return boolean +diff --git a/setoolsgui/boundsmodel.py b/setoolsgui/boundsmodel.py +index c84f612a3b3a..c7ed1e7c227f 100644 +--- a/setoolsgui/boundsmodel.py ++++ b/setoolsgui/boundsmodel.py +@@ -20,7 +20,7 @@ class BoundsTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.ruletype.name + elif col == 1: +@@ -28,5 +28,5 @@ class BoundsTableModel(SEToolsTableModel): + elif col == 2: + return item.child.name + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/commonmodel.py b/setoolsgui/commonmodel.py +index a6f6fed53840..2ceb57f4f0a3 100644 +--- a/setoolsgui/commonmodel.py ++++ b/setoolsgui/commonmodel.py +@@ -42,11 +42,11 @@ class CommonTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: + return ", ".join(sorted(item.perms)) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/constraintmodel.py b/setoolsgui/constraintmodel.py +index 122dff0b5139..d295f28f208b 100644 +--- a/setoolsgui/constraintmodel.py ++++ b/setoolsgui/constraintmodel.py +@@ -21,7 +21,7 @@ class ConstraintTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.ruletype.name + elif col == 1: +@@ -34,5 +34,5 @@ class ConstraintTableModel(SEToolsTableModel): + elif col == 3: + return str(rule.expression) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/defaultmodel.py b/setoolsgui/defaultmodel.py +index b9a6a58ebfea..3a699c49ce8c 100644 +--- a/setoolsgui/defaultmodel.py ++++ b/setoolsgui/defaultmodel.py +@@ -22,7 +22,7 @@ class DefaultTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.ruletype.name + elif col == 1: +@@ -33,5 +33,5 @@ class DefaultTableModel(SEToolsTableModel): + with suppress(AttributeError): + return item.default_range.name + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/details.py b/setoolsgui/details.py +index 4eb70066cfdb..8d4882cd6a1e 100644 +--- a/setoolsgui/details.py ++++ b/setoolsgui/details.py +@@ -37,15 +37,15 @@ class DetailsPopup(SEToolsWidget, QDialog): + self.setWindowTitle(text) + + def append(self, text): +- self.contents.setFontWeight(QFont.Normal) ++ self.contents.setFontWeight(QFont.Weight.Normal) + self.contents.setFontPointSize(9) + self.contents.append(text) + + def append_header(self, text): +- self.contents.setFontWeight(QFont.Black) ++ self.contents.setFontWeight(QFont.Weight.Black) + self.contents.setFontPointSize(11) + self.contents.append(text) + + def show(self): +- self.contents.moveCursor(QTextCursor.Start) ++ self.contents.moveCursor(QTextCursor.MoveOperation.Start) + super(DetailsPopup, self).show() +diff --git a/setoolsgui/fsusemodel.py b/setoolsgui/fsusemodel.py +index 2b3a3f402af9..bc100784c490 100644 +--- a/setoolsgui/fsusemodel.py ++++ b/setoolsgui/fsusemodel.py +@@ -20,7 +20,7 @@ class FSUseTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.ruletype.name + elif col == 1: +@@ -28,5 +28,5 @@ class FSUseTableModel(SEToolsTableModel): + elif col == 2: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/genfsconmodel.py b/setoolsgui/genfsconmodel.py +index 6fc46408865c..1e50d929446a 100644 +--- a/setoolsgui/genfsconmodel.py ++++ b/setoolsgui/genfsconmodel.py +@@ -32,7 +32,7 @@ class GenfsconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.fs + elif col == 1: +@@ -42,5 +42,5 @@ class GenfsconTableModel(SEToolsTableModel): + elif col == 3: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/ibendportconmodel.py b/setoolsgui/ibendportconmodel.py +index 199932d39415..37b7a8d74948 100644 +--- a/setoolsgui/ibendportconmodel.py ++++ b/setoolsgui/ibendportconmodel.py +@@ -20,7 +20,7 @@ class IbendportconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.name + elif col == 1: +@@ -28,5 +28,5 @@ class IbendportconTableModel(SEToolsTableModel): + elif col == 2: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/ibpkeyconmodel.py b/setoolsgui/ibpkeyconmodel.py +index f3cd95205d51..160425504521 100644 +--- a/setoolsgui/ibpkeyconmodel.py ++++ b/setoolsgui/ibpkeyconmodel.py +@@ -20,7 +20,7 @@ class IbpkeyconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return str(rule.subnet_prefix) + elif col == 1: +@@ -32,5 +32,5 @@ class IbpkeyconTableModel(SEToolsTableModel): + elif col == 2: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/initsidmodel.py b/setoolsgui/initsidmodel.py +index 1155a50fccb9..9ffb408024fd 100644 +--- a/setoolsgui/initsidmodel.py ++++ b/setoolsgui/initsidmodel.py +@@ -20,11 +20,11 @@ class InitialSIDTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.name + elif col == 1: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/listview.py b/setoolsgui/listview.py +index a4beda50b9f6..e803975c52c6 100644 +--- a/setoolsgui/listview.py ++++ b/setoolsgui/listview.py +@@ -34,14 +34,14 @@ class SEToolsListView(QListView): + + for row in range(model.rowCount()): + index = model.createIndex(row, 0) +- selection_model.select(index, QItemSelectionModel.Toggle) ++ selection_model.select(index, QItemSelectionModel.SelectionFlag.Toggle) + +- def selection(self, qt_role=Qt.UserRole): ++ def selection(self, qt_role=Qt.ItemDataRole.UserRole): + """ + Generator which returns the selection. + + Parameter: +- qt_role The Qt model role. Default is Qt.UserRole. ++ qt_role The Qt model role. Default is Qt.ItemDataRole.UserRole. + + Yield: tuple(row, data) + row The row number of the selection. +diff --git a/setoolsgui/mlsmodel.py b/setoolsgui/mlsmodel.py +index 8dfb28066d34..147378ef585a 100644 +--- a/setoolsgui/mlsmodel.py ++++ b/setoolsgui/mlsmodel.py +@@ -63,11 +63,11 @@ class MLSComponentTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: + return ", ".join(sorted(a for a in item.aliases())) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/mlsrulemodel.py b/setoolsgui/mlsrulemodel.py +index 4fa4f186a6cf..54ad4c216c72 100644 +--- a/setoolsgui/mlsrulemodel.py ++++ b/setoolsgui/mlsrulemodel.py +@@ -20,7 +20,7 @@ class MLSRuleTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.ruletype.name + elif col == 1: +@@ -32,5 +32,5 @@ class MLSRuleTableModel(SEToolsTableModel): + elif col == 4: + return str(rule.default) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/models.py b/setoolsgui/models.py +index fc7bf3df9ccf..dd864e932fbc 100644 +--- a/setoolsgui/models.py ++++ b/setoolsgui/models.py +@@ -19,7 +19,7 @@ def invert_list_selection(selection_model): + rowcount = model.rowCount() + for row in range(rowcount): + index = model.createIndex(row, 0) +- selection_model.select(index, QItemSelectionModel.Toggle) ++ selection_model.select(index, QItemSelectionModel.SelectionFlag.Toggle) + + + class SEToolsListModel(QAbstractListModel): +@@ -27,8 +27,8 @@ class SEToolsListModel(QAbstractListModel): + """ + The purpose of this model is to have the + objects return their string representations +- for Qt.DisplayRole and return the object +- for Qt.UserRole. ++ for Qt.ItemDataRole.DisplayRole and return the object ++ for Qt.ItemDataRole.UserRole. + + Some Python list-like functions are provided + for altering the model: append and remove +@@ -81,9 +81,9 @@ class SEToolsListModel(QAbstractListModel): + row = index.row() + item = self.item_list[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + return str(item) +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item + + +@@ -133,7 +133,7 @@ class SEToolsTableModel(QAbstractTableModel): + self.resultlist = [] + + def headerData(self, section, orientation, role): +- if role == Qt.DisplayRole and orientation == Qt.Horizontal: ++ if role == Qt.ItemDataRole.DisplayRole and orientation == Qt.Orientation.Horizontal: + return self.headers[section] + + def rowCount(self, parent=QModelIndex()): +diff --git a/setoolsgui/netifconmodel.py b/setoolsgui/netifconmodel.py +index 3d2e4b8b6ee1..54659203e7e5 100644 +--- a/setoolsgui/netifconmodel.py ++++ b/setoolsgui/netifconmodel.py +@@ -20,7 +20,7 @@ class NetifconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.netif + elif col == 1: +@@ -28,5 +28,5 @@ class NetifconTableModel(SEToolsTableModel): + elif col == 2: + return str(rule.packet) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/nodeconmodel.py b/setoolsgui/nodeconmodel.py +index ec4d66e9a026..f8055fca194d 100644 +--- a/setoolsgui/nodeconmodel.py ++++ b/setoolsgui/nodeconmodel.py +@@ -20,11 +20,11 @@ class NodeconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return str(rule.network.with_netmask) + elif col == 1: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/objclassmodel.py b/setoolsgui/objclassmodel.py +index 9823b73b30ee..ff1641f8cc3e 100644 +--- a/setoolsgui/objclassmodel.py ++++ b/setoolsgui/objclassmodel.py +@@ -58,7 +58,7 @@ class ObjClassTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: +@@ -69,5 +69,5 @@ class ObjClassTableModel(SEToolsTableModel): + + return ", ".join(sorted(chain(com_perms, item.perms))) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/portconmodel.py b/setoolsgui/portconmodel.py +index 39d2c72e4625..1c3de4494af9 100644 +--- a/setoolsgui/portconmodel.py ++++ b/setoolsgui/portconmodel.py +@@ -20,7 +20,7 @@ class PortconTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + low, high = rule.ports + if low == high: +@@ -32,5 +32,5 @@ class PortconTableModel(SEToolsTableModel): + elif col == 2: + return str(rule.context) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/rbacrulemodel.py b/setoolsgui/rbacrulemodel.py +index d8df9409ed56..84d2ff09e4fc 100644 +--- a/setoolsgui/rbacrulemodel.py ++++ b/setoolsgui/rbacrulemodel.py +@@ -21,7 +21,7 @@ class RBACRuleTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.ruletype.name + elif col == 1: +@@ -41,5 +41,5 @@ class RBACRuleTableModel(SEToolsTableModel): + except RuleUseError: + return None + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/rolemodel.py b/setoolsgui/rolemodel.py +index 004f4e7614ba..2dd7fe64d37e 100644 +--- a/setoolsgui/rolemodel.py ++++ b/setoolsgui/rolemodel.py +@@ -47,11 +47,11 @@ class RoleTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: + return ", ".join(sorted(t.name for t in item.types())) +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + # get the whole object + return item +diff --git a/setoolsgui/tableview.py b/setoolsgui/tableview.py +index 9726cb053466..9ba49aa50fa3 100644 +--- a/setoolsgui/tableview.py ++++ b/setoolsgui/tableview.py +@@ -45,7 +45,7 @@ class SEToolsTableView(QTableView): + elif prev_col is not None and current_col != prev_col: + selected_text.append('\t') + +- selected_text.append(datamodel.data(index, Qt.DisplayRole)) ++ selected_text.append(datamodel.data(index, Qt.ItemDataRole.DisplayRole)) + + prev_row = current_row + prev_col = current_col +@@ -76,7 +76,7 @@ class SEToolsTableView(QTableView): + # write headers + csv_row = [] + for col in range(col_count): +- csv_row.append(datamodel.headerData(col, Qt.Horizontal, Qt.DisplayRole)) ++ csv_row.append(datamodel.headerData(col, Qt.Orientation.Horizontal, Qt.ItemDataRole.DisplayRole)) + + writer.writerow(csv_row) + +@@ -86,6 +86,6 @@ class SEToolsTableView(QTableView): + + for col in range(col_count): + index = datamodel.index(row, col) +- csv_row.append(datamodel.data(index, Qt.DisplayRole)) ++ csv_row.append(datamodel.data(index, Qt.ItemDataRole.DisplayRole)) + + writer.writerow(csv_row) +diff --git a/setoolsgui/terulemodel.py b/setoolsgui/terulemodel.py +index 4d51ac8e9b25..53b61a06d152 100644 +--- a/setoolsgui/terulemodel.py ++++ b/setoolsgui/terulemodel.py +@@ -22,7 +22,7 @@ class TERuleTableModel(SEToolsTableModel): + col = index.column() + rule = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return rule.ruletype.name + elif col == 1: +@@ -50,5 +50,5 @@ class TERuleTableModel(SEToolsTableModel): + except RuleNotConditional: + return None + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return rule +diff --git a/setoolsgui/typeattrmodel.py b/setoolsgui/typeattrmodel.py +index 1a752fcd82f0..0b7c7ffe65a5 100644 +--- a/setoolsgui/typeattrmodel.py ++++ b/setoolsgui/typeattrmodel.py +@@ -44,11 +44,11 @@ class TypeAttributeTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: + return ", ".join(sorted(t.name for t in item.expand())) + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/typemodel.py b/setoolsgui/typemodel.py +index 841cc42a52d3..037996b96a8c 100644 +--- a/setoolsgui/typemodel.py ++++ b/setoolsgui/typemodel.py +@@ -50,7 +50,7 @@ class TypeTableModel(SEToolsTableModel): + col = index.column() + item = self.resultlist[row] + +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + if col == 0: + return item.name + elif col == 1: +@@ -60,5 +60,5 @@ class TypeTableModel(SEToolsTableModel): + elif col == 3 and item.ispermissive: + return "Permissive" + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return item +diff --git a/setoolsgui/usermodel.py b/setoolsgui/usermodel.py +index d0a4b0ed1a63..d5aca7bc11a0 100644 +--- a/setoolsgui/usermodel.py ++++ b/setoolsgui/usermodel.py +@@ -56,7 +56,7 @@ class UserTableModel(SEToolsTableModel): + + def data(self, index, role): + if self.resultlist and index.isValid(): +- if role == Qt.DisplayRole: ++ if role == Qt.ItemDataRole.DisplayRole: + row = index.row() + col = index.column() + user = self.resultlist[row] +@@ -76,5 +76,5 @@ class UserTableModel(SEToolsTableModel): + except MLSDisabled: + return None + +- elif role == Qt.UserRole: ++ elif role == Qt.ItemDataRole.UserRole: + return user +-- +2.41.0 + diff --git a/0002-Use-PyQt6.patch b/0002-Use-PyQt6.patch new file mode 100644 index 0000000..8b0285c --- /dev/null +++ b/0002-Use-PyQt6.patch @@ -0,0 +1,1121 @@ +From a9a062004e9974e06880e57ddb2c9699de2696f0 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 4 Sep 2023 16:12:59 +0200 +Subject: [PATCH] Use PyQt6 +Content-type: text/plain + +Signed-off-by: Petr Lautrbach +--- + .mypy.ini | 2 +- + README.md | 6 +++--- + apol | 4 ++-- + setoolsgui/apol/analysistab.py | 4 ++-- + setoolsgui/apol/boolquery.py | 6 +++--- + setoolsgui/apol/boundsquery.py | 6 +++--- + setoolsgui/apol/categoryquery.py | 6 +++--- + setoolsgui/apol/chooseanalysis.py | 4 ++-- + setoolsgui/apol/commonquery.py | 6 +++--- + setoolsgui/apol/constraintquery.py | 6 +++--- + setoolsgui/apol/defaultquery.py | 6 +++--- + setoolsgui/apol/dta.py | 6 +++--- + setoolsgui/apol/excludetypes.py | 4 ++-- + setoolsgui/apol/fsusequery.py | 6 +++--- + setoolsgui/apol/genfsconquery.py | 6 +++--- + setoolsgui/apol/ibendportconquery.py | 6 +++--- + setoolsgui/apol/ibpkeyconquery.py | 6 +++--- + setoolsgui/apol/infoflow.py | 6 +++--- + setoolsgui/apol/initsidquery.py | 6 +++--- + setoolsgui/apol/mainwindow.py | 8 ++++---- + setoolsgui/apol/mlsrulequery.py | 6 +++--- + setoolsgui/apol/netifconquery.py | 6 +++--- + setoolsgui/apol/nodeconquery.py | 6 +++--- + setoolsgui/apol/objclassquery.py | 6 +++--- + setoolsgui/apol/permmapedit.py | 6 +++--- + setoolsgui/apol/portconquery.py | 6 +++--- + setoolsgui/apol/queryupdater.py | 2 +- + setoolsgui/apol/rbacrulequery.py | 6 +++--- + setoolsgui/apol/rolequery.py | 6 +++--- + setoolsgui/apol/sensitivityquery.py | 6 +++--- + setoolsgui/apol/summary.py | 6 +++--- + setoolsgui/apol/terulequery.py | 6 +++--- + setoolsgui/apol/typeattrquery.py | 6 +++--- + setoolsgui/apol/typequery.py | 6 +++--- + setoolsgui/apol/userquery.py | 6 +++--- + setoolsgui/apol/workspace.py | 2 +- + setoolsgui/boolmodel.py | 4 ++-- + setoolsgui/boundsmodel.py | 2 +- + setoolsgui/commonmodel.py | 4 ++-- + setoolsgui/constraintmodel.py | 2 +- + setoolsgui/defaultmodel.py | 2 +- + setoolsgui/details.py | 4 ++-- + setoolsgui/fsusemodel.py | 2 +- + setoolsgui/genfsconmodel.py | 2 +- + setoolsgui/getdetailslist.py | 4 ++-- + setoolsgui/ibendportconmodel.py | 2 +- + setoolsgui/ibpkeyconmodel.py | 2 +- + setoolsgui/initsidmodel.py | 2 +- + setoolsgui/listview.py | 6 +++--- + setoolsgui/logtosignal.py | 2 +- + setoolsgui/mlsmodel.py | 4 ++-- + setoolsgui/mlsrulemodel.py | 2 +- + setoolsgui/models.py | 2 +- + setoolsgui/netifconmodel.py | 2 +- + setoolsgui/nodeconmodel.py | 2 +- + setoolsgui/objclassmodel.py | 4 ++-- + setoolsgui/portconmodel.py | 2 +- + setoolsgui/rbacrulemodel.py | 2 +- + setoolsgui/rolemodel.py | 4 ++-- + setoolsgui/tableview.py | 6 +++--- + setoolsgui/terulemodel.py | 2 +- + setoolsgui/treeview.py | 6 +++--- + setoolsgui/typeattrmodel.py | 4 ++-- + setoolsgui/typemodel.py | 4 ++-- + setoolsgui/usermodel.py | 2 +- + setoolsgui/widget.py | 2 +- + 66 files changed, 144 insertions(+), 144 deletions(-) + +diff --git a/.mypy.ini b/.mypy.ini +index b45560b7d8d0..7d3aef848b4a 100644 +--- a/.mypy.ini ++++ b/.mypy.ini +@@ -9,7 +9,7 @@ ignore_missing_imports = True + [mypy-networkx.*] + ignore_missing_imports = True + +-[mypy-PyQt5.*] ++[mypy-PyQt6.*] + ignore_missing_imports = True + + [mypy-sip] +diff --git a/README.md b/README.md +index b5a05c9376c3..d291e0d5693d 100644 +--- a/README.md ++++ b/README.md +@@ -20,8 +20,8 @@ To run SETools command line tools, the following packages are required: + * libsepol 3.2+ + + To run SETools graphical tools, the following packages are also required: +-* PyQt5 +-* qt5-assistant ++* PyQt6 ++* qt6-assistant + * qt-devel (only if rebuilding the help file) + + To build SETools, the following development packages are required, in +@@ -73,7 +73,7 @@ the tools can be ran from the current directory (e.g. ```./seinfo```). + ### Rebuilding the Apol Help File + + For convenience, a prebuilt copy of the apol help data file is included. +-To rebuild this file, the Qt5 development tools are required ++To rebuild this file, the Qt6 development tools are required + (particularly, the ```qcollectiongenerator``` tool). At the root + of the SETools sources, perform the following: + ``` +diff --git a/apol b/apol +index 400832199eae..f32b29bf8c5c 100755 +--- a/apol ++++ b/apol +@@ -8,7 +8,7 @@ import sys + import argparse + import logging + +-from PyQt5.QtWidgets import QApplication ++from PyQt6.QtWidgets import QApplication + import setools + import setoolsgui + +@@ -42,7 +42,7 @@ logging.getLogger().addHandler(console_handler) + try: + app = QApplication(sys.argv) + mainwindow = setoolsgui.ApolMainWindow(args.policy) +- sys.exit(app.exec_()) ++ sys.exit(app.exec()) + + except Exception as err: + if args.debug: +diff --git a/setoolsgui/apol/analysistab.py b/setoolsgui/apol/analysistab.py +index bc3629ff274a..13f89db32277 100644 +--- a/setoolsgui/apol/analysistab.py ++++ b/setoolsgui/apol/analysistab.py +@@ -6,8 +6,8 @@ + from typing import Dict, NamedTuple + from enum import Enum + +-import sip +-from PyQt5.QtWidgets import QDialogButtonBox, QScrollArea ++import PyQt6.sip as sip ++from PyQt6.QtWidgets import QDialogButtonBox, QScrollArea + + from ..widget import SEToolsWidget + +diff --git a/setoolsgui/apol/boolquery.py b/setoolsgui/apol/boolquery.py +index 6116fe48a846..d7bf529fa267 100644 +--- a/setoolsgui/apol/boolquery.py ++++ b/setoolsgui/apol/boolquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import BoolQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/boundsquery.py b/setoolsgui/apol/boundsquery.py +index 5b90c2ee2ded..5c53803dbb7a 100644 +--- a/setoolsgui/apol/boundsquery.py ++++ b/setoolsgui/apol/boundsquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import BoundsQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/categoryquery.py b/setoolsgui/apol/categoryquery.py +index 598f163c335f..7df35566f672 100644 +--- a/setoolsgui/apol/categoryquery.py ++++ b/setoolsgui/apol/categoryquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import CategoryQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/chooseanalysis.py b/setoolsgui/apol/chooseanalysis.py +index 155ae6d2f4ae..d7d192a94c2a 100644 +--- a/setoolsgui/apol/chooseanalysis.py ++++ b/setoolsgui/apol/chooseanalysis.py +@@ -5,8 +5,8 @@ + # + from collections import defaultdict + +-from PyQt5.QtCore import Qt +-from PyQt5.QtWidgets import QDialog, QTreeWidgetItem ++from PyQt6.QtCore import Qt ++from PyQt6.QtWidgets import QDialog, QTreeWidgetItem + + from ..widget import SEToolsWidget + from .analysistab import AnalysisSection, AnalysisTab, TAB_REGISTRY +diff --git a/setoolsgui/apol/commonquery.py b/setoolsgui/apol/commonquery.py +index 8fb11e87290d..1c73a42aff4b 100644 +--- a/setoolsgui/apol/commonquery.py ++++ b/setoolsgui/apol/commonquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import CommonQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/constraintquery.py b/setoolsgui/apol/constraintquery.py +index ee64db0ca1df..efda65f4c55e 100644 +--- a/setoolsgui/apol/constraintquery.py ++++ b/setoolsgui/apol/constraintquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import ConstraintQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/defaultquery.py b/setoolsgui/apol/defaultquery.py +index e09692ee6a46..cad78d03e8a8 100644 +--- a/setoolsgui/apol/defaultquery.py ++++ b/setoolsgui/apol/defaultquery.py +@@ -8,9 +8,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import DefaultQuery, DefaultValue, DefaultRangeValue + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py +index 8bbed4dbe21f..bdbe6f448150 100644 +--- a/setoolsgui/apol/dta.py ++++ b/setoolsgui/apol/dta.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ ++from PyQt6.QtCore import pyqtSignal, Qt, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ + QTreeWidgetItem + from setools import DomainTransitionAnalysis + +diff --git a/setoolsgui/apol/excludetypes.py b/setoolsgui/apol/excludetypes.py +index 1c4beaf84542..a764597cc1cd 100644 +--- a/setoolsgui/apol/excludetypes.py ++++ b/setoolsgui/apol/excludetypes.py +@@ -7,8 +7,8 @@ + import logging + import copy + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel +-from PyQt5.QtWidgets import QDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel ++from PyQt6.QtWidgets import QDialog + + from ..models import SEToolsListModel + from ..widget import SEToolsWidget +diff --git a/setoolsgui/apol/fsusequery.py b/setoolsgui/apol/fsusequery.py +index 4e7567f4e4c6..e0b77af58ef0 100644 +--- a/setoolsgui/apol/fsusequery.py ++++ b/setoolsgui/apol/fsusequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import FSUseQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/genfsconquery.py b/setoolsgui/apol/genfsconquery.py +index 33dbed787cd6..5294e9042857 100644 +--- a/setoolsgui/apol/genfsconquery.py ++++ b/setoolsgui/apol/genfsconquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import GenfsconQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/ibendportconquery.py b/setoolsgui/apol/ibendportconquery.py +index 18252dd23de0..e688773eac5a 100644 +--- a/setoolsgui/apol/ibendportconquery.py ++++ b/setoolsgui/apol/ibendportconquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QProgressDialog + from setools import IbendportconQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/ibpkeyconquery.py b/setoolsgui/apol/ibpkeyconquery.py +index b7a78bf908a0..27be270f6602 100644 +--- a/setoolsgui/apol/ibpkeyconquery.py ++++ b/setoolsgui/apol/ibpkeyconquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QProgressDialog + from setools import IbpkeyconQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py +index 526f3074e143..a57c232ccc3e 100644 +--- a/setoolsgui/apol/infoflow.py ++++ b/setoolsgui/apol/infoflow.py +@@ -9,9 +9,9 @@ import copy + from collections import defaultdict + from contextlib import suppress + +-from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ ++from PyQt6.QtCore import pyqtSignal, Qt, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ + QTreeWidgetItem + from setools import InfoFlowAnalysis + from setools.exception import UnmappedClass, UnmappedPermission +diff --git a/setoolsgui/apol/initsidquery.py b/setoolsgui/apol/initsidquery.py +index d01f87130925..f84e4c2260a9 100644 +--- a/setoolsgui/apol/initsidquery.py ++++ b/setoolsgui/apol/initsidquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import InitialSIDQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/mainwindow.py b/setoolsgui/apol/mainwindow.py +index dcbfb7590ef7..7dc3cd852820 100644 +--- a/setoolsgui/apol/mainwindow.py ++++ b/setoolsgui/apol/mainwindow.py +@@ -11,8 +11,8 @@ import json + from contextlib import suppress + + import pkg_resources +-from PyQt5.QtCore import pyqtSlot, Qt, QProcess +-from PyQt5.QtWidgets import QApplication, QFileDialog, QLineEdit, QMainWindow, QMessageBox ++from PyQt6.QtCore import pyqtSlot, Qt, QProcess ++from PyQt6.QtWidgets import QApplication, QFileDialog, QLineEdit, QMainWindow, QMessageBox + from setools import __version__, PermissionMap, SELinuxPolicy + + from ..widget import SEToolsWidget +@@ -26,7 +26,7 @@ from .summary import SummaryTab + + + BIN_SEARCH_PATHS = ("/usr/local/bin:/usr/bin:/bin") +-POSSIBLE_ASSISTANT = ("assistant", "assistant-qt5") ++POSSIBLE_ASSISTANT = ("assistant", "assistant-qt6") + + + class ApolMainWindow(SEToolsWidget, QMainWindow): +@@ -666,7 +666,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): + reply = QMessageBox.question( + self, "Qt Assistant Package Installed?", + "Failed to start QT Assistant program {}. " +- "This is typically in the assistant or qt5-assistant package. " ++ "This is typically in the assistant or qt6-assistant package. " + "Choose location of Qt Assistant executable?".format( + self.config.assistant), + QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) +diff --git a/setoolsgui/apol/mlsrulequery.py b/setoolsgui/apol/mlsrulequery.py +index bb554ade6657..ec0a20955ed8 100644 +--- a/setoolsgui/apol/mlsrulequery.py ++++ b/setoolsgui/apol/mlsrulequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import MLSRuleQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/netifconquery.py b/setoolsgui/apol/netifconquery.py +index 4cf3de1a9f5c..3c828edb26c6 100644 +--- a/setoolsgui/apol/netifconquery.py ++++ b/setoolsgui/apol/netifconquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import NetifconQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/nodeconquery.py b/setoolsgui/apol/nodeconquery.py +index 81a33a794c05..dddfa069b9ad 100644 +--- a/setoolsgui/apol/nodeconquery.py ++++ b/setoolsgui/apol/nodeconquery.py +@@ -8,9 +8,9 @@ import sys + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import NodeconQuery, NodeconIPVersion + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/objclassquery.py b/setoolsgui/apol/objclassquery.py +index 23c8188e8bbd..4f0355dd3176 100644 +--- a/setoolsgui/apol/objclassquery.py ++++ b/setoolsgui/apol/objclassquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import ObjClassQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/permmapedit.py b/setoolsgui/apol/permmapedit.py +index d1e0b01ce854..ee01917a7bc5 100644 +--- a/setoolsgui/apol/permmapedit.py ++++ b/setoolsgui/apol/permmapedit.py +@@ -6,9 +6,9 @@ + import logging + import copy + +-from PyQt5.QtCore import pyqtSignal, pyqtSlot, Qt +-from PyQt5.QtGui import QPalette +-from PyQt5.QtWidgets import QDialog, QFrame, QWidget ++from PyQt6.QtCore import pyqtSignal, pyqtSlot, Qt ++from PyQt6.QtGui import QPalette ++from PyQt6.QtWidgets import QDialog, QFrame, QWidget + + from ..models import SEToolsListModel + from ..widget import SEToolsWidget +diff --git a/setoolsgui/apol/portconquery.py b/setoolsgui/apol/portconquery.py +index de0a16567f1c..2afdd16e9f9c 100644 +--- a/setoolsgui/apol/portconquery.py ++++ b/setoolsgui/apol/portconquery.py +@@ -8,9 +8,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import PortconQuery, PortconProtocol + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/queryupdater.py b/setoolsgui/apol/queryupdater.py +index 9b6c155caa0a..07dc21a7d83d 100644 +--- a/setoolsgui/apol/queryupdater.py ++++ b/setoolsgui/apol/queryupdater.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import pyqtSignal, QObject, QThread ++from PyQt6.QtCore import pyqtSignal, QObject, QThread + + + class QueryResultsUpdater(QObject): +diff --git a/setoolsgui/apol/rbacrulequery.py b/setoolsgui/apol/rbacrulequery.py +index 4749d324d858..505a1858d015 100644 +--- a/setoolsgui/apol/rbacrulequery.py ++++ b/setoolsgui/apol/rbacrulequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import RBACRuleQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/rolequery.py b/setoolsgui/apol/rolequery.py +index e75614d9a992..bd1a02a1d614 100644 +--- a/setoolsgui/apol/rolequery.py ++++ b/setoolsgui/apol/rolequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import RoleQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/sensitivityquery.py b/setoolsgui/apol/sensitivityquery.py +index c8a27891ae97..aac7e2971b6d 100644 +--- a/setoolsgui/apol/sensitivityquery.py ++++ b/setoolsgui/apol/sensitivityquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import SensitivityQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/summary.py b/setoolsgui/apol/summary.py +index 1aeb2b303bd6..32b6c5fcfbe5 100644 +--- a/setoolsgui/apol/summary.py ++++ b/setoolsgui/apol/summary.py +@@ -7,9 +7,9 @@ + + import logging + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import MLSRuleQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/terulequery.py b/setoolsgui/apol/terulequery.py +index 7c99469edc87..4aba54cc59d0 100644 +--- a/setoolsgui/apol/terulequery.py ++++ b/setoolsgui/apol/terulequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import TERuleQuery, xperm_str_to_tuple_ranges + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/typeattrquery.py b/setoolsgui/apol/typeattrquery.py +index 67a087a7e3f0..f76de94e93d7 100644 +--- a/setoolsgui/apol/typeattrquery.py ++++ b/setoolsgui/apol/typeattrquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import TypeAttributeQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/typequery.py b/setoolsgui/apol/typequery.py +index a22e3547cd16..4859364576e4 100644 +--- a/setoolsgui/apol/typequery.py ++++ b/setoolsgui/apol/typequery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import TypeQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/userquery.py b/setoolsgui/apol/userquery.py +index 19ffb03c2975..6200ddcb8398 100644 +--- a/setoolsgui/apol/userquery.py ++++ b/setoolsgui/apol/userquery.py +@@ -7,9 +7,9 @@ + import logging + from contextlib import suppress + +-from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread +-from PyQt5.QtGui import QPalette, QTextCursor +-from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog ++from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread ++from PyQt6.QtGui import QPalette, QTextCursor ++from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog + from setools import UserQuery + + from ..logtosignal import LogHandlerToSignal +diff --git a/setoolsgui/apol/workspace.py b/setoolsgui/apol/workspace.py +index 2b4229224b85..8db9d1478d4d 100644 +--- a/setoolsgui/apol/workspace.py ++++ b/setoolsgui/apol/workspace.py +@@ -9,7 +9,7 @@ import logging + import setools + + +-from PyQt5.QtCore import Qt, QItemSelectionModel ++from PyQt6.QtCore import Qt, QItemSelectionModel + + + def save_checkboxes(tab, settings, checkboxes): +diff --git a/setoolsgui/boolmodel.py b/setoolsgui/boolmodel.py +index c331fdd5057d..a1a733987258 100644 +--- a/setoolsgui/boolmodel.py ++++ b/setoolsgui/boolmodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from .details import DetailsPopup + from .models import SEToolsTableModel +diff --git a/setoolsgui/boundsmodel.py b/setoolsgui/boundsmodel.py +index c7ed1e7c227f..fdc1462b0a9b 100644 +--- a/setoolsgui/boundsmodel.py ++++ b/setoolsgui/boundsmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/commonmodel.py b/setoolsgui/commonmodel.py +index 2ceb57f4f0a3..a5c656deac15 100644 +--- a/setoolsgui/commonmodel.py ++++ b/setoolsgui/commonmodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from setools.exception import NoCommon + +diff --git a/setoolsgui/constraintmodel.py b/setoolsgui/constraintmodel.py +index d295f28f208b..2ae8dc5ba025 100644 +--- a/setoolsgui/constraintmodel.py ++++ b/setoolsgui/constraintmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + from setools.exception import ConstraintUseError + + from .models import SEToolsTableModel +diff --git a/setoolsgui/defaultmodel.py b/setoolsgui/defaultmodel.py +index 3a699c49ce8c..fe29b3f3179b 100644 +--- a/setoolsgui/defaultmodel.py ++++ b/setoolsgui/defaultmodel.py +@@ -5,7 +5,7 @@ + # + from contextlib import suppress + +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/details.py b/setoolsgui/details.py +index 8d4882cd6a1e..1cbf6c05590c 100644 +--- a/setoolsgui/details.py ++++ b/setoolsgui/details.py +@@ -5,8 +5,8 @@ + # + import logging + +-from PyQt5.QtGui import QFont, QTextCursor +-from PyQt5.QtWidgets import QDialog ++from PyQt6.QtGui import QFont, QTextCursor ++from PyQt6.QtWidgets import QDialog + + from .widget import SEToolsWidget + +diff --git a/setoolsgui/fsusemodel.py b/setoolsgui/fsusemodel.py +index bc100784c490..327a8653d1b2 100644 +--- a/setoolsgui/fsusemodel.py ++++ b/setoolsgui/fsusemodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/genfsconmodel.py b/setoolsgui/genfsconmodel.py +index 1e50d929446a..b3429c81d536 100644 +--- a/setoolsgui/genfsconmodel.py ++++ b/setoolsgui/genfsconmodel.py +@@ -5,7 +5,7 @@ + # + import stat + +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/getdetailslist.py b/setoolsgui/getdetailslist.py +index df7149dda0f2..e4e39194456c 100644 +--- a/setoolsgui/getdetailslist.py ++++ b/setoolsgui/getdetailslist.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtGui import QCursor +-from PyQt5.QtWidgets import QAction, QListView, QMenu ++from PyQt6.QtGui import QCursor, QAction ++from PyQt6.QtWidgets import QListView, QMenu + + + class GetDetailsListView(QListView): +diff --git a/setoolsgui/ibendportconmodel.py b/setoolsgui/ibendportconmodel.py +index 37b7a8d74948..49780736b90f 100644 +--- a/setoolsgui/ibendportconmodel.py ++++ b/setoolsgui/ibendportconmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/ibpkeyconmodel.py b/setoolsgui/ibpkeyconmodel.py +index 160425504521..1a339b90110b 100644 +--- a/setoolsgui/ibpkeyconmodel.py ++++ b/setoolsgui/ibpkeyconmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/initsidmodel.py b/setoolsgui/initsidmodel.py +index 9ffb408024fd..04e8a34f931e 100644 +--- a/setoolsgui/initsidmodel.py ++++ b/setoolsgui/initsidmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/listview.py b/setoolsgui/listview.py +index e803975c52c6..ff42bf0f8c57 100644 +--- a/setoolsgui/listview.py ++++ b/setoolsgui/listview.py +@@ -6,9 +6,9 @@ + import logging + from collections import defaultdict + +-from PyQt5.QtCore import Qt, QItemSelectionModel +-from PyQt5.QtGui import QKeySequence +-from PyQt5.QtWidgets import QAbstractItemView, QListView ++from PyQt6.QtCore import Qt, QItemSelectionModel ++from PyQt6.QtGui import QKeySequence ++from PyQt6.QtWidgets import QAbstractItemView, QListView + + + class SEToolsListView(QListView): +diff --git a/setoolsgui/logtosignal.py b/setoolsgui/logtosignal.py +index 7678f0992ce6..5bfab937ecc6 100644 +--- a/setoolsgui/logtosignal.py ++++ b/setoolsgui/logtosignal.py +@@ -5,7 +5,7 @@ + # + + from logging import Formatter, Handler, INFO +-from PyQt5.QtCore import pyqtSignal, QObject ++from PyQt6.QtCore import pyqtSignal, QObject + + + class LogHandlerToSignal(Handler, QObject): +diff --git a/setoolsgui/mlsmodel.py b/setoolsgui/mlsmodel.py +index 147378ef585a..a0bfb3709d57 100644 +--- a/setoolsgui/mlsmodel.py ++++ b/setoolsgui/mlsmodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from .details import DetailsPopup + from .models import SEToolsTableModel +diff --git a/setoolsgui/mlsrulemodel.py b/setoolsgui/mlsrulemodel.py +index 54ad4c216c72..349900ef36d2 100644 +--- a/setoolsgui/mlsrulemodel.py ++++ b/setoolsgui/mlsrulemodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/models.py b/setoolsgui/models.py +index dd864e932fbc..0a19c9b26f1e 100644 +--- a/setoolsgui/models.py ++++ b/setoolsgui/models.py +@@ -7,7 +7,7 @@ import logging + from contextlib import suppress + from typing import List + +-from PyQt5.QtCore import QAbstractListModel, QItemSelectionModel, QAbstractTableModel, \ ++from PyQt6.QtCore import QAbstractListModel, QItemSelectionModel, QAbstractTableModel, \ + QModelIndex, QStringListModel, Qt + from setools.exception import NoCommon + +diff --git a/setoolsgui/netifconmodel.py b/setoolsgui/netifconmodel.py +index 54659203e7e5..d9aa87bd0dea 100644 +--- a/setoolsgui/netifconmodel.py ++++ b/setoolsgui/netifconmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/nodeconmodel.py b/setoolsgui/nodeconmodel.py +index f8055fca194d..9bbb426a71aa 100644 +--- a/setoolsgui/nodeconmodel.py ++++ b/setoolsgui/nodeconmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/objclassmodel.py b/setoolsgui/objclassmodel.py +index ff1641f8cc3e..d67d45c12fd4 100644 +--- a/setoolsgui/objclassmodel.py ++++ b/setoolsgui/objclassmodel.py +@@ -5,8 +5,8 @@ + # + from itertools import chain + +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from setools.exception import NoCommon + +diff --git a/setoolsgui/portconmodel.py b/setoolsgui/portconmodel.py +index 1c3de4494af9..5eb3b9327d19 100644 +--- a/setoolsgui/portconmodel.py ++++ b/setoolsgui/portconmodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + + from .models import SEToolsTableModel + +diff --git a/setoolsgui/rbacrulemodel.py b/setoolsgui/rbacrulemodel.py +index 84d2ff09e4fc..c97cf36b0a3a 100644 +--- a/setoolsgui/rbacrulemodel.py ++++ b/setoolsgui/rbacrulemodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + from setools.exception import RuleUseError + + from .models import SEToolsTableModel +diff --git a/setoolsgui/rolemodel.py b/setoolsgui/rolemodel.py +index 2dd7fe64d37e..dc4852225bdb 100644 +--- a/setoolsgui/rolemodel.py ++++ b/setoolsgui/rolemodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from setools.exception import MLSDisabled + +diff --git a/setoolsgui/tableview.py b/setoolsgui/tableview.py +index 9ba49aa50fa3..71174008f85d 100644 +--- a/setoolsgui/tableview.py ++++ b/setoolsgui/tableview.py +@@ -5,9 +5,9 @@ + # + import csv + +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QKeySequence, QCursor +-from PyQt5.QtWidgets import QAction, QApplication, QFileDialog, QMenu, QTableView ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QAction, QKeySequence, QCursor ++from PyQt6.QtWidgets import QApplication, QFileDialog, QMenu, QTableView + + + class SEToolsTableView(QTableView): +diff --git a/setoolsgui/terulemodel.py b/setoolsgui/terulemodel.py +index 53b61a06d152..ac1b32d76ec4 100644 +--- a/setoolsgui/terulemodel.py ++++ b/setoolsgui/terulemodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt ++from PyQt6.QtCore import Qt + from setools.exception import RuleNotConditional, RuleUseError + + from .models import SEToolsTableModel +diff --git a/setoolsgui/treeview.py b/setoolsgui/treeview.py +index a8f6fb4caef5..bf6d63d2b92b 100644 +--- a/setoolsgui/treeview.py ++++ b/setoolsgui/treeview.py +@@ -3,9 +3,9 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt, QModelIndex +-from PyQt5.QtGui import QKeySequence, QCursor +-from PyQt5.QtWidgets import QAction, QApplication, QFileDialog, QMenu, QTreeWidget, \ ++from PyQt6.QtCore import Qt, QModelIndex ++from PyQt6.QtGui import QAction, QKeySequence, QCursor ++from PyQt6.QtWidgets import QApplication, QFileDialog, QMenu, QTreeWidget, \ + QTreeWidgetItemIterator + + +diff --git a/setoolsgui/typeattrmodel.py b/setoolsgui/typeattrmodel.py +index 0b7c7ffe65a5..ede73228e16a 100644 +--- a/setoolsgui/typeattrmodel.py ++++ b/setoolsgui/typeattrmodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from setools.exception import MLSDisabled + +diff --git a/setoolsgui/typemodel.py b/setoolsgui/typemodel.py +index 037996b96a8c..f25737169762 100644 +--- a/setoolsgui/typemodel.py ++++ b/setoolsgui/typemodel.py +@@ -3,8 +3,8 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt +-from PyQt5.QtGui import QPalette, QTextCursor ++from PyQt6.QtCore import Qt ++from PyQt6.QtGui import QPalette, QTextCursor + + from setools.exception import MLSDisabled + +diff --git a/setoolsgui/usermodel.py b/setoolsgui/usermodel.py +index d5aca7bc11a0..4edb393a9d0e 100644 +--- a/setoolsgui/usermodel.py ++++ b/setoolsgui/usermodel.py +@@ -3,7 +3,7 @@ + # SPDX-License-Identifier: LGPL-2.1-only + # + # +-from PyQt5.QtCore import Qt, QModelIndex ++from PyQt6.QtCore import Qt, QModelIndex + from setools.exception import MLSDisabled + + from .details import DetailsPopup +diff --git a/setoolsgui/widget.py b/setoolsgui/widget.py +index e236623cef96..b2866139564c 100644 +--- a/setoolsgui/widget.py ++++ b/setoolsgui/widget.py +@@ -7,7 +7,7 @@ import sys + from errno import ENOENT + + import pkg_resources +-from PyQt5.uic import loadUi ++from PyQt6.uic import loadUi + + + # Stylesheet that adds a frame around QGroupBoxes +-- +2.41.0 + diff --git a/setools.spec b/setools.spec index 420188c..86a6ee5 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,12 +11,13 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch1: 0001-Use-the-The-New-Python-Enums.patch +Patch2: 0002-Use-PyQt6.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} -BuildRequires: qt5-qtbase-devel BuildRequires: swig BuildRequires: python3-Cython BuildRequires: python3-devel @@ -81,7 +82,7 @@ Python 3 modules designed to facilitate SELinux policy analysis. Summary: Policy analysis graphical tools for SELinux License: GPL-2.0-only Requires: python3-setools = %{version}-%{release} -Requires: python3-qt5 +Requires: python3-pyqt6 python3-pyqt6-sip Requires: python3-networkx %description gui @@ -144,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Aug 28 2023 Petr Lautrbach - 4.4.3-2 +- Use Qt 6 + * Wed Aug 9 2023 Petr Lautrbach - 4.4.3-1 - SETools 4.4.3 release From 65fa161f6f272a0042f08f904df25eb760870d2d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 11 Dec 2023 15:56:42 +0100 Subject: [PATCH 092/111] SETools 4.4.4 release --- .gitignore | 1 + 0002-Use-PyQt6.patch => 0001-Use-PyQt6.patch | 0 0001-Use-the-The-New-Python-Enums.patch | 1895 ------------------ setools.spec | 14 +- sources | 2 +- 5 files changed, 10 insertions(+), 1902 deletions(-) rename 0002-Use-PyQt6.patch => 0001-Use-PyQt6.patch (100%) delete mode 100644 0001-Use-the-The-New-Python-Enums.patch diff --git a/.gitignore b/.gitignore index 26db9fc..a5afd44 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.4.1.tar.gz /4.4.2.tar.gz /4.4.3.tar.gz +/4.4.4.tar.gz diff --git a/0002-Use-PyQt6.patch b/0001-Use-PyQt6.patch similarity index 100% rename from 0002-Use-PyQt6.patch rename to 0001-Use-PyQt6.patch diff --git a/0001-Use-the-The-New-Python-Enums.patch b/0001-Use-the-The-New-Python-Enums.patch deleted file mode 100644 index 8fead1e..0000000 --- a/0001-Use-the-The-New-Python-Enums.patch +++ /dev/null @@ -1,1895 +0,0 @@ -From abe184f4899cdab53f5b5c69f00c2eec64176517 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 28 Aug 2023 19:07:06 +0200 -Subject: [PATCH] Use the The New Python Enums -Content-type: text/plain - -https://doc.qt.io/qtforpython-6/considerations.html#the-new-python-enums - -In PyQt5, it's possible to use members of enums in the same scope as -enums, e.g. Qt.red. This is not possible in PyQt6, but both PyQt5 and -PyQt6 support the new python enums - Qt.GlobalColor.red - -This change prepares the code for the future transition to PyQt6. - -Signed-off-by: Petr Lautrbach ---- - setoolsgui/apol/analysistab.py | 2 +- - setoolsgui/apol/boolquery.py | 8 +++---- - setoolsgui/apol/boundsquery.py | 6 +++--- - setoolsgui/apol/categoryquery.py | 8 +++---- - setoolsgui/apol/chooseanalysis.py | 2 +- - setoolsgui/apol/commonquery.py | 10 ++++----- - setoolsgui/apol/constraintquery.py | 10 ++++----- - setoolsgui/apol/defaultquery.py | 10 ++++----- - setoolsgui/apol/dta.py | 6 +++--- - setoolsgui/apol/excludetypes.py | 12 +++++------ - setoolsgui/apol/fsusequery.py | 6 +++--- - setoolsgui/apol/genfsconquery.py | 6 +++--- - setoolsgui/apol/ibendportconquery.py | 6 +++--- - setoolsgui/apol/ibpkeyconquery.py | 6 +++--- - setoolsgui/apol/infoflow.py | 8 +++---- - setoolsgui/apol/initsidquery.py | 6 +++--- - setoolsgui/apol/mainwindow.py | 32 ++++++++++++++-------------- - setoolsgui/apol/mlsrulequery.py | 8 +++---- - setoolsgui/apol/netifconquery.py | 6 +++--- - setoolsgui/apol/nodeconquery.py | 8 +++---- - setoolsgui/apol/objclassquery.py | 12 +++++------ - setoolsgui/apol/permmapedit.py | 12 +++++------ - setoolsgui/apol/portconquery.py | 8 +++---- - setoolsgui/apol/rbacrulequery.py | 8 +++---- - setoolsgui/apol/rolequery.py | 10 ++++----- - setoolsgui/apol/sensitivityquery.py | 8 +++---- - setoolsgui/apol/terulequery.py | 16 +++++++------- - setoolsgui/apol/typeattrquery.py | 10 ++++----- - setoolsgui/apol/typequery.py | 10 ++++----- - setoolsgui/apol/userquery.py | 10 ++++----- - setoolsgui/apol/workspace.py | 8 +++---- - setoolsgui/boolmodel.py | 4 ++-- - setoolsgui/boundsmodel.py | 4 ++-- - setoolsgui/commonmodel.py | 4 ++-- - setoolsgui/constraintmodel.py | 4 ++-- - setoolsgui/defaultmodel.py | 4 ++-- - setoolsgui/details.py | 6 +++--- - setoolsgui/fsusemodel.py | 4 ++-- - setoolsgui/genfsconmodel.py | 4 ++-- - setoolsgui/ibendportconmodel.py | 4 ++-- - setoolsgui/ibpkeyconmodel.py | 4 ++-- - setoolsgui/initsidmodel.py | 4 ++-- - setoolsgui/listview.py | 6 +++--- - setoolsgui/mlsmodel.py | 4 ++-- - setoolsgui/mlsrulemodel.py | 4 ++-- - setoolsgui/models.py | 12 +++++------ - setoolsgui/netifconmodel.py | 4 ++-- - setoolsgui/nodeconmodel.py | 4 ++-- - setoolsgui/objclassmodel.py | 4 ++-- - setoolsgui/portconmodel.py | 4 ++-- - setoolsgui/rbacrulemodel.py | 4 ++-- - setoolsgui/rolemodel.py | 4 ++-- - setoolsgui/tableview.py | 6 +++--- - setoolsgui/terulemodel.py | 4 ++-- - setoolsgui/typeattrmodel.py | 4 ++-- - setoolsgui/typemodel.py | 4 ++-- - setoolsgui/usermodel.py | 4 ++-- - 57 files changed, 198 insertions(+), 198 deletions(-) - -diff --git a/setoolsgui/apol/analysistab.py b/setoolsgui/apol/analysistab.py -index 1ed803419331..bc3629ff274a 100644 ---- a/setoolsgui/apol/analysistab.py -+++ b/setoolsgui/apol/analysistab.py -@@ -100,7 +100,7 @@ class AnalysisTab(SEToolsWidget, QScrollArea, metaclass=TabRegistry): - self._check_query() - - def _check_query(self): -- button = self.buttonBox.button(QDialogButtonBox.Apply) -+ button = self.buttonBox.button(QDialogButtonBox.StandardButton.Apply) - enabled = not self.errors - button.setEnabled(enabled) - button.setToolTip("Run the analysis." if enabled else "There are errors in the tab.") -diff --git a/setoolsgui/apol/boolquery.py b/setoolsgui/apol/boolquery.py -index 5b0cdd8b4322..6116fe48a846 100644 ---- a/setoolsgui/apol/boolquery.py -+++ b/setoolsgui/apol/boolquery.py -@@ -57,13 +57,13 @@ class BoolQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -105,7 +105,7 @@ class BoolQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.bools.selectedIndexes()[0] -- item = self.bool_model.data(index, Qt.UserRole) -+ item = self.bool_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - boolean_detail(self, item) -@@ -187,6 +187,6 @@ class BoolQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/boundsquery.py b/setoolsgui/apol/boundsquery.py -index 8944d1b7bf8a..5b90c2ee2ded 100644 ---- a/setoolsgui/apol/boundsquery.py -+++ b/setoolsgui/apol/boundsquery.py -@@ -52,13 +52,13 @@ class BoundsQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(1, Qt.AscendingOrder) -+ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.parent.palette() - self.error_palette = self.parent.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_parent_error() - self.clear_child_error() - -@@ -189,6 +189,6 @@ class BoundsQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/categoryquery.py b/setoolsgui/apol/categoryquery.py -index 884b4156d75a..598f163c335f 100644 ---- a/setoolsgui/apol/categoryquery.py -+++ b/setoolsgui/apol/categoryquery.py -@@ -57,13 +57,13 @@ class CategoryQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -105,7 +105,7 @@ class CategoryQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.cats.selectedIndexes()[0] -- item = self.category_model.data(index, Qt.UserRole) -+ item = self.category_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - category_detail(self, item) -@@ -186,6 +186,6 @@ class CategoryQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/chooseanalysis.py b/setoolsgui/apol/chooseanalysis.py -index 892abdaac5f9..155ae6d2f4ae 100644 ---- a/setoolsgui/apol/chooseanalysis.py -+++ b/setoolsgui/apol/chooseanalysis.py -@@ -52,7 +52,7 @@ class ChooseAnalysis(SEToolsWidget, QDialog): - groupitem.addChild(item) - - self.analysisTypes.expandAll() -- self.analysisTypes.sortByColumn(0, Qt.AscendingOrder) -+ self.analysisTypes.sortByColumn(0, Qt.SortOrder.AscendingOrder) - super(ChooseAnalysis, self).show() - - def accept(self, item=None): -diff --git a/setoolsgui/apol/commonquery.py b/setoolsgui/apol/commonquery.py -index e90ec543666b..8fb11e87290d 100644 ---- a/setoolsgui/apol/commonquery.py -+++ b/setoolsgui/apol/commonquery.py -@@ -65,13 +65,13 @@ class CommonQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -116,7 +116,7 @@ class CommonQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.commons.selectedIndexes()[0] -- item = self.common_model.data(index, Qt.UserRole) -+ item = self.common_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - common_detail(self, item) -@@ -146,7 +146,7 @@ class CommonQueryTab(AnalysisTab): - def set_perms(self): - selected_perms = [] - for index in self.perms.selectionModel().selectedIndexes(): -- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) -+ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.perms = selected_perms - -@@ -212,6 +212,6 @@ class CommonQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/constraintquery.py b/setoolsgui/apol/constraintquery.py -index cfa841b22cb5..ee64db0ca1df 100644 ---- a/setoolsgui/apol/constraintquery.py -+++ b/setoolsgui/apol/constraintquery.py -@@ -84,7 +84,7 @@ class ConstraintQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_user_error() - self.clear_type_error() - self.clear_role_error() -@@ -94,7 +94,7 @@ class ConstraintQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -173,7 +173,7 @@ class ConstraintQueryTab(AnalysisTab): - def set_tclass(self): - selected_classes = [] - for index in self.tclass.selectionModel().selectedIndexes(): -- selected_classes.append(self.class_model.data(index, Qt.UserRole)) -+ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.tclass = selected_classes - self.perms_model.set_classes(selected_classes) -@@ -187,7 +187,7 @@ class ConstraintQueryTab(AnalysisTab): - def set_perms(self): - selected_perms = [] - for index in self.perms.selectionModel().selectedIndexes(): -- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) -+ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.perms = selected_perms - -@@ -323,6 +323,6 @@ class ConstraintQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/defaultquery.py b/setoolsgui/apol/defaultquery.py -index 1efa3c468738..e09692ee6a46 100644 ---- a/setoolsgui/apol/defaultquery.py -+++ b/setoolsgui/apol/defaultquery.py -@@ -52,7 +52,7 @@ class DefaultQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(1, Qt.AscendingOrder) -+ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) - - # populate class list - self.class_model = SEToolsListModel(self) -@@ -124,7 +124,7 @@ class DefaultQueryTab(AnalysisTab): - def set_tclass(self): - selected_classes = [] - for index in self.tclass.selectionModel().selectedIndexes(): -- selected_classes.append(self.class_model.data(index, Qt.UserRole)) -+ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.tclass = selected_classes - -@@ -163,10 +163,10 @@ class DefaultQueryTab(AnalysisTab): - rule_types.append(mode.objectName()) - - self.query.ruletype = rule_types -- self.query.default = self.default_value.currentData(Qt.UserRole) -+ self.query.default = self.default_value.currentData(Qt.ItemDataRole.UserRole) - - if self.default_range_value.isEnabled(): -- self.query.default_range = self.default_range_value.currentData(Qt.UserRole) -+ self.query.default_range = self.default_range_value.currentData(Qt.ItemDataRole.UserRole) - else: - self.query.default_range = None - -@@ -193,6 +193,6 @@ class DefaultQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index a78d96095b28..8bbed4dbe21f 100644 ---- a/setoolsgui/apol/dta.py -+++ b/setoolsgui/apol/dta.py -@@ -62,7 +62,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.source.palette() - self.error_palette = self.source.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_source_error() - self.clear_target_error() - -@@ -281,7 +281,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): - - print_transition(self.browser_details.appendPlainText, current.rules) - -- self.browser_details.moveCursor(QTextCursor.Start) -+ self.browser_details.moveCursor(QTextCursor.MoveOperation.Start) - - if not current.child_populated: - self.busy.setLabelText("Gathering additional browser details for {0}...".format( -@@ -337,7 +337,7 @@ class DomainTransitionAnalysisTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - if self.flows_in.isChecked() or self.flows_out.isChecked(): - # move to browser tab for transitions in/out -diff --git a/setoolsgui/apol/excludetypes.py b/setoolsgui/apol/excludetypes.py -index bee73c58dc66..1c4beaf84542 100644 ---- a/setoolsgui/apol/excludetypes.py -+++ b/setoolsgui/apol/excludetypes.py -@@ -40,14 +40,14 @@ class ExcludeTypes(SEToolsWidget, QDialog): - if t not in self.initial_excluded_list] - self.included_sort = FilterByAttributeProxy(self) - self.included_sort.setSourceModel(self.included_model) -- self.included_sort.sort(0, Qt.AscendingOrder) -+ self.included_sort.sort(0, Qt.SortOrder.AscendingOrder) - self.included_types.setModel(self.included_sort) - - self.excluded_model = SEToolsListModel(self) - self.excluded_model.item_list = self.initial_excluded_list - self.excluded_sort = FilterByAttributeProxy(self) - self.excluded_sort.setSourceModel(self.excluded_model) -- self.excluded_sort.sort(0, Qt.AscendingOrder) -+ self.excluded_sort.sort(0, Qt.SortOrder.AscendingOrder) - self.excluded_types.setModel(self.excluded_sort) - - # connect signals -@@ -62,7 +62,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): - selected_types = [] - for index in self.excluded_types.selectionModel().selectedIndexes(): - source_index = self.excluded_sort.mapToSource(index) -- item = self.excluded_model.data(source_index, Qt.UserRole) -+ item = self.excluded_model.data(source_index, Qt.ItemDataRole.UserRole) - self.included_model.append(item) - selected_types.append(item) - -@@ -81,7 +81,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): - selected_types = [] - for index in self.included_types.selectionModel().selectedIndexes(): - source_index = self.included_sort.mapToSource(index) -- item = self.included_model.data(source_index, Qt.UserRole) -+ item = self.included_model.data(source_index, Qt.ItemDataRole.UserRole) - self.excluded_model.append(item) - selected_types.append(item) - -@@ -95,7 +95,7 @@ class ExcludeTypes(SEToolsWidget, QDialog): - - def set_attr_filter(self, row): - index = self.attr_model.index(row) -- attr = self.attr_model.data(index, Qt.UserRole) -+ attr = self.attr_model.data(index, Qt.ItemDataRole.UserRole) - self.log.debug("Attribute set to {0!r}".format(attr)) - self.included_sort.attr = attr - self.excluded_sort.attr = attr -@@ -126,7 +126,7 @@ class FilterByAttributeProxy(QSortFilterProxyModel): - if self.attr: - source = self.sourceModel() - index = source.index(row) -- item = source.data(index, Qt.UserRole) -+ item = source.data(index, Qt.ItemDataRole.UserRole) - if item not in self.attr: - return False - -diff --git a/setoolsgui/apol/fsusequery.py b/setoolsgui/apol/fsusequery.py -index 9bb192b30232..4e7567f4e4c6 100644 ---- a/setoolsgui/apol/fsusequery.py -+++ b/setoolsgui/apol/fsusequery.py -@@ -74,7 +74,7 @@ class FSUseQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_fs_error() - self.clear_user_error() - self.clear_type_error() -@@ -86,7 +86,7 @@ class FSUseQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(1, Qt.AscendingOrder) -+ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -312,6 +312,6 @@ class FSUseQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/genfsconquery.py b/setoolsgui/apol/genfsconquery.py -index 22112a8fb7bf..33dbed787cd6 100644 ---- a/setoolsgui/apol/genfsconquery.py -+++ b/setoolsgui/apol/genfsconquery.py -@@ -74,7 +74,7 @@ class GenfsconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_fs_error() - self.clear_path_error() - self.clear_user_error() -@@ -87,7 +87,7 @@ class GenfsconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -312,6 +312,6 @@ class GenfsconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/ibendportconquery.py b/setoolsgui/apol/ibendportconquery.py -index 6db99c2b5e0f..18252dd23de0 100644 ---- a/setoolsgui/apol/ibendportconquery.py -+++ b/setoolsgui/apol/ibendportconquery.py -@@ -74,7 +74,7 @@ class IbendportconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - self.clear_port_error() - self.clear_user_error() -@@ -87,7 +87,7 @@ class IbendportconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -304,6 +304,6 @@ class IbendportconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/ibpkeyconquery.py b/setoolsgui/apol/ibpkeyconquery.py -index 3efd342145f1..b7a78bf908a0 100644 ---- a/setoolsgui/apol/ibpkeyconquery.py -+++ b/setoolsgui/apol/ibpkeyconquery.py -@@ -74,7 +74,7 @@ class IbpkeyconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_subnet_prefix_error() - self.clear_pkeys_error() - self.clear_user_error() -@@ -87,7 +87,7 @@ class IbpkeyconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -317,6 +317,6 @@ class IbpkeyconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index fb9b4099cfc0..526f3074e143 100644 ---- a/setoolsgui/apol/infoflow.py -+++ b/setoolsgui/apol/infoflow.py -@@ -75,7 +75,7 @@ class InfoFlowAnalysisTab(AnalysisTab): - - # set up error message for missing perm map - self.error_msg = QMessageBox(self) -- self.error_msg.setStandardButtons(QMessageBox.Ok) -+ self.error_msg.setStandardButtons(QMessageBox.StandardButton.Ok) - - # set up perm map editor - self.permmap_editor = PermissionMapEditor(self, False) -@@ -93,7 +93,7 @@ class InfoFlowAnalysisTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.source.palette() - self.error_palette = self.source.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_source_error() - self.clear_target_error() - -@@ -325,7 +325,7 @@ class InfoFlowAnalysisTab(AnalysisTab): - for rule in current.rules: - self.browser_details.appendPlainText(rule) - -- self.browser_details.moveCursor(QTextCursor.Start) -+ self.browser_details.moveCursor(QTextCursor.MoveOperation.Start) - - if not current.child_populated: - self.busy.setLabelText("Gathering additional browser details for {0}...".format( -@@ -390,7 +390,7 @@ class InfoFlowAnalysisTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - if self.flows_in.isChecked() or self.flows_out.isChecked(): - # move to browser tab for flows in/out -diff --git a/setoolsgui/apol/initsidquery.py b/setoolsgui/apol/initsidquery.py -index b31c9986b3a5..d01f87130925 100644 ---- a/setoolsgui/apol/initsidquery.py -+++ b/setoolsgui/apol/initsidquery.py -@@ -74,7 +74,7 @@ class InitialSIDQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - self.clear_user_error() - self.clear_type_error() -@@ -86,7 +86,7 @@ class InitialSIDQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -287,6 +287,6 @@ class InitialSIDQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/mainwindow.py b/setoolsgui/apol/mainwindow.py -index 3cdb11d3e32e..dcbfb7590ef7 100644 ---- a/setoolsgui/apol/mainwindow.py -+++ b/setoolsgui/apol/mainwindow.py -@@ -60,20 +60,20 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - - # set up error message dialog - self.error_msg = QMessageBox(self) -- self.error_msg.setStandardButtons(QMessageBox.Ok) -+ self.error_msg.setStandardButtons(QMessageBox.StandardButton.Ok) - - # set up permission map editor - self.permmap_editor = PermissionMapEditor(self, True) - - # set up tab name editor - self.tab_editor = QLineEdit(self.AnalysisTabs) -- self.tab_editor.setWindowFlags(Qt.Popup) -+ self.tab_editor.setWindowFlags(Qt.WindowType.Popup) - - # configure tab bar context menu - tabBar = self.AnalysisTabs.tabBar() - tabBar.addAction(self.rename_tab_action) - tabBar.addAction(self.close_tab_action) -- tabBar.setContextMenuPolicy(Qt.ActionsContextMenu) -+ tabBar.setContextMenuPolicy(Qt.ContextMenuPolicy.ActionsContextMenu) - - # capture INFO and higher Python messages from setools lib for status bar - handler = LogHandlerToSignal() -@@ -127,9 +127,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - reply = QMessageBox.question( - self, "Continue?", - "Loading a policy will close all existing analyses. Continue?", -- QMessageBox.Yes | QMessageBox.No) -+ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) - -- if reply == QMessageBox.No: -+ if reply == QMessageBox.StandardButton.No: - return - - filename = QFileDialog.getOpenFileName(self, "Open policy file", ".", -@@ -163,9 +163,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - reply = QMessageBox.question( - self, "Continue?", - "Closing a policy will close all existing analyses. Continue?", -- QMessageBox.Yes | QMessageBox.No) -+ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) - -- if reply == QMessageBox.No: -+ if reply == QMessageBox.StandardButton.No: - return - - self.AnalysisTabs.clear() -@@ -245,7 +245,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - counted_name = "{0}: {1}".format(self.tab_counter, tabtitle) - - newanalysis = tabclass(self, self._policy, self._permmap) -- newanalysis.setAttribute(Qt.WA_DeleteOnClose) -+ newanalysis.setAttribute(Qt.WidgetAttribute.WA_DeleteOnClose) - newanalysis.setObjectName(counted_name) - - index = self.AnalysisTabs.addTab(newanalysis, counted_name) -@@ -444,9 +444,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - reply = QMessageBox.question( - self, "Continue?", - "Loading a workspace will close all existing analyses. Continue?", -- QMessageBox.Yes | QMessageBox.No) -+ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) - -- if reply == QMessageBox.No: -+ if reply == QMessageBox.StandardButton.No: - return - - # 2. try to load the workspace file, if we fail, bail -@@ -633,7 +633,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - - def apol_help(self): - """Open the main help window.""" -- if self.help_process.state() != QProcess.NotRunning: -+ if self.help_process.state() != QProcess.ProcessState.NotRunning: - return - - distro = pkg_resources.get_distribution("setools") -@@ -648,7 +648,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - @pyqtSlot(QProcess.ProcessError) - def help_failed(self, error): - """Starting assistant failed.""" -- if error != QProcess.FailedToStart: -+ if error != QProcess.ProcessError.FailedToStart: - return - - self.log.error("Failed to start Qt assistant {}.".format(self.config.assistant)) -@@ -669,9 +669,9 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - "This is typically in the assistant or qt5-assistant package. " - "Choose location of Qt Assistant executable?".format( - self.config.assistant), -- QMessageBox.Yes | QMessageBox.No) -+ QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) - -- if reply == QMessageBox.No: -+ if reply == QMessageBox.StandardButton.No: - return - - filename = QFileDialog.getOpenFileName(self, "Location of qt-assistant executable", -@@ -689,12 +689,12 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - @pyqtSlot(str) - def set_help(self, location): - """Set the help window to the specified document.""" -- if self.help_process.state() == QProcess.NotStarted: -+ if self.help_process.state() == QProcess.ProcessState.NotRunning: - self.apol_help() - if not self.help_process.waitForStarted(): - self.log.warning("Timed out waiting for Qt assistant to start.") - return -- elif self.help_process.state() == QProcess.Starting: -+ elif self.help_process.state() == QProcess.ProcessState.Starting: - if not self.help_process.waitForStarted(): - self.log.warning("Timed out waiting for Qt assistant to start.") - return -diff --git a/setoolsgui/apol/mlsrulequery.py b/setoolsgui/apol/mlsrulequery.py -index ba2be4597982..bb554ade6657 100644 ---- a/setoolsgui/apol/mlsrulequery.py -+++ b/setoolsgui/apol/mlsrulequery.py -@@ -61,7 +61,7 @@ class MLSRuleQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.source.palette() - self.error_palette = self.source.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_source_error() - self.clear_target_error() - self.clear_default_error() -@@ -76,7 +76,7 @@ class MLSRuleQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(1, Qt.AscendingOrder) -+ self.table_results.sortByColumn(1, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -181,7 +181,7 @@ class MLSRuleQueryTab(AnalysisTab): - def set_tclass(self): - selected_classes = [] - for index in self.tclass.selectionModel().selectedIndexes(): -- selected_classes.append(self.class_model.data(index, Qt.UserRole)) -+ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.tclass = selected_classes - -@@ -264,6 +264,6 @@ class MLSRuleQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/netifconquery.py b/setoolsgui/apol/netifconquery.py -index ca2405f7cae6..4cf3de1a9f5c 100644 ---- a/setoolsgui/apol/netifconquery.py -+++ b/setoolsgui/apol/netifconquery.py -@@ -74,7 +74,7 @@ class NetifconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - self.clear_user_error() - self.clear_type_error() -@@ -86,7 +86,7 @@ class NetifconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -287,6 +287,6 @@ class NetifconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/nodeconquery.py b/setoolsgui/apol/nodeconquery.py -index 320b0d616a67..81a33a794c05 100644 ---- a/setoolsgui/apol/nodeconquery.py -+++ b/setoolsgui/apol/nodeconquery.py -@@ -80,7 +80,7 @@ class NodeconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_network_error() - self.clear_user_error() - self.clear_type_error() -@@ -92,7 +92,7 @@ class NodeconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -263,7 +263,7 @@ class NodeconQueryTab(AnalysisTab): - def run(self, button): - # right now there is only one button. - self.query.network_overlap = self.network_overlap.isChecked() -- self.query.ip_version = self.ip_version.currentData(Qt.UserRole) -+ self.query.ip_version = self.ip_version.currentData(Qt.ItemDataRole.UserRole) - self.query.range_overlap = self.range_overlap.isChecked() - self.query.range_subset = self.range_subset.isChecked() - self.query.range_superset = self.range_superset.isChecked() -@@ -291,6 +291,6 @@ class NodeconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/objclassquery.py b/setoolsgui/apol/objclassquery.py -index 9744a187ade7..23c8188e8bbd 100644 ---- a/setoolsgui/apol/objclassquery.py -+++ b/setoolsgui/apol/objclassquery.py -@@ -66,13 +66,13 @@ class ObjClassQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -117,7 +117,7 @@ class ObjClassQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.classes.selectedIndexes()[0] -- item = self.class_model.data(index, Qt.UserRole) -+ item = self.class_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - class_detail(self, item) -@@ -146,7 +146,7 @@ class ObjClassQueryTab(AnalysisTab): - # - def set_common(self): - for index in self.common.selectionModel().selectedIndexes(): -- self.query.common = self.common_model.data(index, Qt.UserRole) -+ self.query.common = self.common_model.data(index, Qt.ItemDataRole.UserRole) - break - else: - self.query.common = None -@@ -157,7 +157,7 @@ class ObjClassQueryTab(AnalysisTab): - def set_perms(self): - selected_perms = [] - for index in self.perms.selectionModel().selectedIndexes(): -- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) -+ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.perms = selected_perms - -@@ -224,6 +224,6 @@ class ObjClassQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/permmapedit.py b/setoolsgui/apol/permmapedit.py -index 97482b30e1a2..d1e0b01ce854 100644 ---- a/setoolsgui/apol/permmapedit.py -+++ b/setoolsgui/apol/permmapedit.py -@@ -86,7 +86,7 @@ class PermissionMapEditor(SEToolsWidget, QDialog): - def class_selected(self): - # the .ui is set to 1 selection - for index in self.classes.selectionModel().selectedIndexes(): -- class_name = self.class_model.data(index, Qt.DisplayRole) -+ class_name = self.class_model.data(index, Qt.ItemDataRole.DisplayRole) - - self.log.debug("Setting class to {0}".format(class_name)) - -@@ -99,15 +99,15 @@ class PermissionMapEditor(SEToolsWidget, QDialog): - for perm in sorted(self.perm_map.perms(class_name)): - # create permission mapping - mapping = PermissionMapping(self, perm, self.edit) -- mapping.setAttribute(Qt.WA_DeleteOnClose) -+ mapping.setAttribute(Qt.WidgetAttribute.WA_DeleteOnClose) - self.class_toggle.connect(mapping.enabled.setChecked) - self.perm_mappings.addWidget(mapping) - self.widgets.append(mapping) - - # add horizonal line - line = QFrame(self) -- line.setFrameShape(QFrame.HLine) -- line.setFrameShadow(QFrame.Sunken) -+ line.setFrameShape(QFrame.Shape.HLine) -+ line.setFrameShadow(QFrame.Shadow.Sunken) - self.perm_mappings.addWidget(line) - self.widgets.append(line) - -@@ -179,8 +179,8 @@ class PermissionMapping(SEToolsWidget, QWidget): - # setup color palettes for direction - self.orig_palette = self.direction.palette() - self.error_palette = self.direction.palette() -- self.error_palette.setColor(QPalette.Button, Qt.red) -- self.error_palette.setColor(QPalette.ButtonText, Qt.white) -+ self.error_palette.setColor(QPalette.ColorRole.Button, Qt.GlobalColor.red) -+ self.error_palette.setColor(QPalette.ColorRole.ButtonText, Qt.GlobalColor.white) - - # setup direction - self.direction.insertItems(0, index_to_word) -diff --git a/setoolsgui/apol/portconquery.py b/setoolsgui/apol/portconquery.py -index 50d054f867a5..de0a16567f1c 100644 ---- a/setoolsgui/apol/portconquery.py -+++ b/setoolsgui/apol/portconquery.py -@@ -75,7 +75,7 @@ class PortconQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.type_.palette() - self.error_palette = self.type_.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_ports_error() - self.clear_user_error() - self.clear_type_error() -@@ -92,7 +92,7 @@ class PortconQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -280,7 +280,7 @@ class PortconQueryTab(AnalysisTab): - self.query.ports_overlap = self.ports_overlap.isChecked() - self.query.ports_subset = self.ports_subset.isChecked() - self.query.ports_superset = self.ports_superset.isChecked() -- self.query.protocol = self.protocol.currentData(Qt.UserRole) -+ self.query.protocol = self.protocol.currentData(Qt.ItemDataRole.UserRole) - self.query.range_overlap = self.range_overlap.isChecked() - self.query.range_subset = self.range_subset.isChecked() - self.query.range_superset = self.range_superset.isChecked() -@@ -308,6 +308,6 @@ class PortconQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/rbacrulequery.py b/setoolsgui/apol/rbacrulequery.py -index 0ce4bb9ad6c6..4749d324d858 100644 ---- a/setoolsgui/apol/rbacrulequery.py -+++ b/setoolsgui/apol/rbacrulequery.py -@@ -71,7 +71,7 @@ class RBACRuleQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.source.palette() - self.error_palette = self.source.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_source_error() - self.clear_target_error() - self.clear_default_error() -@@ -86,7 +86,7 @@ class RBACRuleQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -194,7 +194,7 @@ class RBACRuleQueryTab(AnalysisTab): - def set_tclass(self): - selected_classes = [] - for index in self.tclass.selectionModel().selectedIndexes(): -- selected_classes.append(self.class_model.data(index, Qt.UserRole)) -+ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.tclass = selected_classes - -@@ -292,6 +292,6 @@ class RBACRuleQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/rolequery.py b/setoolsgui/apol/rolequery.py -index 29983a5961ee..e75614d9a992 100644 ---- a/setoolsgui/apol/rolequery.py -+++ b/setoolsgui/apol/rolequery.py -@@ -62,13 +62,13 @@ class RoleQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -112,7 +112,7 @@ class RoleQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.roles.selectedIndexes()[0] -- item = self.role_model.data(index, Qt.UserRole) -+ item = self.role_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - role_detail(self, item) -@@ -142,7 +142,7 @@ class RoleQueryTab(AnalysisTab): - def set_types(self): - selected_types = [] - for index in self.types.selectionModel().selectedIndexes(): -- selected_types.append(self.type_model.data(index, Qt.UserRole)) -+ selected_types.append(self.type_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.types = selected_types - -@@ -209,6 +209,6 @@ class RoleQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/sensitivityquery.py b/setoolsgui/apol/sensitivityquery.py -index d5bcbec53fda..c8a27891ae97 100644 ---- a/setoolsgui/apol/sensitivityquery.py -+++ b/setoolsgui/apol/sensitivityquery.py -@@ -57,13 +57,13 @@ class SensitivityQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -105,7 +105,7 @@ class SensitivityQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.sens.selectedIndexes()[0] -- item = self.sensitivity_model.data(index, Qt.UserRole) -+ item = self.sensitivity_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - sensitivity_detail(self, item) -@@ -186,6 +186,6 @@ class SensitivityQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/terulequery.py b/setoolsgui/apol/terulequery.py -index 3064710550f5..7c99469edc87 100644 ---- a/setoolsgui/apol/terulequery.py -+++ b/setoolsgui/apol/terulequery.py -@@ -69,7 +69,7 @@ class TERuleQueryTab(AnalysisTab): - self.errors = set() - self.orig_palette = self.source.palette() - self.error_palette = self.source.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_source_error() - self.clear_target_error() - self.clear_default_error() -@@ -94,7 +94,7 @@ class TERuleQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # set up processing thread - self.thread = QThread() -@@ -221,7 +221,7 @@ class TERuleQueryTab(AnalysisTab): - def set_tclass(self): - selected_classes = [] - for index in self.tclass.selectionModel().selectedIndexes(): -- selected_classes.append(self.class_model.data(index, Qt.UserRole)) -+ selected_classes.append(self.class_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.tclass = selected_classes - self.perms_model.set_classes(selected_classes) -@@ -236,7 +236,7 @@ class TERuleQueryTab(AnalysisTab): - def set_perms(self): - selected_perms = [] - for index in self.perms.selectionModel().selectedIndexes(): -- selected_perms.append(self.perms_model.data(index, Qt.UserRole)) -+ selected_perms.append(self.perms_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.perms = selected_perms - -@@ -302,7 +302,7 @@ class TERuleQueryTab(AnalysisTab): - def set_bools(self): - selected_bools = [] - for index in self.bool_criteria.selectionModel().selectedIndexes(): -- selected_bools.append(self.bool_model.data(index, Qt.UserRole)) -+ selected_bools.append(self.bool_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.boolean = selected_bools - -@@ -407,9 +407,9 @@ class TERuleQueryTab(AnalysisTab): - reply = QMessageBox.question( - self, "Continue?", - "This is a broad query, estimated to return {0} results. Continue?". -- format(max_results), QMessageBox.Yes | QMessageBox.No) -+ format(max_results), QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) - -- if reply == QMessageBox.No: -+ if reply == QMessageBox.StandardButton.No: - return - - # start processing -@@ -440,6 +440,6 @@ class TERuleQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/typeattrquery.py b/setoolsgui/apol/typeattrquery.py -index 14a4141d922a..67a087a7e3f0 100644 ---- a/setoolsgui/apol/typeattrquery.py -+++ b/setoolsgui/apol/typeattrquery.py -@@ -62,13 +62,13 @@ class TypeAttributeQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -112,7 +112,7 @@ class TypeAttributeQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.attrs.selectedIndexes()[0] -- item = self.attr_model.data(index, Qt.UserRole) -+ item = self.attr_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - typeattr_detail(self, item) -@@ -142,7 +142,7 @@ class TypeAttributeQueryTab(AnalysisTab): - def set_types(self): - selected_types = [] - for index in self.types.selectionModel().selectedIndexes(): -- selected_types.append(self.type_model.data(index, Qt.UserRole)) -+ selected_types.append(self.type_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.types = selected_types - -@@ -209,6 +209,6 @@ class TypeAttributeQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/typequery.py b/setoolsgui/apol/typequery.py -index 2e261ccd52db..a22e3547cd16 100644 ---- a/setoolsgui/apol/typequery.py -+++ b/setoolsgui/apol/typequery.py -@@ -62,13 +62,13 @@ class TypeQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - # set up processing thread -@@ -112,7 +112,7 @@ class TypeQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.types.selectedIndexes()[0] -- item = self.type_model.data(index, Qt.UserRole) -+ item = self.type_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - type_detail(self, item) -@@ -142,7 +142,7 @@ class TypeQueryTab(AnalysisTab): - def set_attrs(self): - selected_attrs = [] - for index in self.attrs.selectionModel().selectedIndexes(): -- selected_attrs.append(self.attr_model.data(index, Qt.UserRole)) -+ selected_attrs.append(self.attr_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.attrs = selected_attrs - -@@ -213,6 +213,6 @@ class TypeQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/userquery.py b/setoolsgui/apol/userquery.py -index c325888db8ec..19ffb03c2975 100644 ---- a/setoolsgui/apol/userquery.py -+++ b/setoolsgui/apol/userquery.py -@@ -62,13 +62,13 @@ class UserQueryTab(AnalysisTab): - self.sort_proxy = QSortFilterProxyModel(self) - self.sort_proxy.setSourceModel(self.table_results_model) - self.table_results.setModel(self.sort_proxy) -- self.table_results.sortByColumn(0, Qt.AscendingOrder) -+ self.table_results.sortByColumn(0, Qt.SortOrder.AscendingOrder) - - # setup indications of errors on level/range - self.errors = set() - self.orig_palette = self.name.palette() - self.error_palette = self.name.palette() -- self.error_palette.setColor(QPalette.Base, Qt.red) -+ self.error_palette.setColor(QPalette.ColorRole.Base, Qt.GlobalColor.red) - self.clear_name_error() - - if self.policy.mls: -@@ -135,7 +135,7 @@ class UserQueryTab(AnalysisTab): - def get_detail(self): - # .ui is set for single item selection. - index = self.users.selectedIndexes()[0] -- item = self.user_model.data(index, Qt.UserRole) -+ item = self.user_model.data(index, Qt.ItemDataRole.UserRole) - - self.log.debug("Generating detail window for {0}".format(item)) - user_detail(self, item) -@@ -165,7 +165,7 @@ class UserQueryTab(AnalysisTab): - def set_roles(self): - selected_roles = [] - for index in self.roles.selectionModel().selectedIndexes(): -- selected_roles.append(self.role_model.data(index, Qt.UserRole)) -+ selected_roles.append(self.role_model.data(index, Qt.ItemDataRole.UserRole)) - - self.query.roles = selected_roles - -@@ -262,6 +262,6 @@ class UserQueryTab(AnalysisTab): - if not self.busy.wasCanceled(): - self.busy.setLabelText("Moving the raw result to top; GUI may be unresponsive") - self.busy.repaint() -- self.raw_results.moveCursor(QTextCursor.Start) -+ self.raw_results.moveCursor(QTextCursor.MoveOperation.Start) - - self.busy.reset() -diff --git a/setoolsgui/apol/workspace.py b/setoolsgui/apol/workspace.py -index 0f8ec82cdaea..2b4229224b85 100644 ---- a/setoolsgui/apol/workspace.py -+++ b/setoolsgui/apol/workspace.py -@@ -141,7 +141,7 @@ def save_listviews(tab, settings, listviews): - - selections = [] - for index in listview.selectedIndexes(): -- item = datamodel.data(index, Qt.DisplayRole) -+ item = datamodel.data(index, Qt.ItemDataRole.DisplayRole) - selections.append(item) - - settings[entry] = selections -@@ -181,10 +181,10 @@ def load_listviews(tab, settings, listviews): - - for row in range(datamodel.rowCount()): - index = datamodel.createIndex(row, 0) -- item = datamodel.data(index, Qt.DisplayRole) -+ item = datamodel.data(index, Qt.ItemDataRole.DisplayRole) - - if item in selections: -- selectionmodel.select(index, QItemSelectionModel.Select) -+ selectionmodel.select(index, QItemSelectionModel.SelectionFlag.Select) - - - def save_comboboxes(tab, settings, comboboxes): -@@ -199,7 +199,7 @@ def save_comboboxes(tab, settings, comboboxes): - - for entry in comboboxes: - combobox = getattr(tab, entry) -- settings[entry] = combobox.currentData(Qt.DisplayRole) -+ settings[entry] = combobox.currentData(Qt.ItemDataRole.DisplayRole) - - - def load_comboboxes(tab, settings, comboboxes): -diff --git a/setoolsgui/boolmodel.py b/setoolsgui/boolmodel.py -index 0d698c92f51b..c331fdd5057d 100644 ---- a/setoolsgui/boolmodel.py -+++ b/setoolsgui/boolmodel.py -@@ -38,12 +38,12 @@ class BooleanTableModel(SEToolsTableModel): - col = index.column() - boolean = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return boolean.name - elif col == 1: - return str(boolean.state) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - # get the whole rule for boolean boolean - return boolean -diff --git a/setoolsgui/boundsmodel.py b/setoolsgui/boundsmodel.py -index c84f612a3b3a..c7ed1e7c227f 100644 ---- a/setoolsgui/boundsmodel.py -+++ b/setoolsgui/boundsmodel.py -@@ -20,7 +20,7 @@ class BoundsTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.ruletype.name - elif col == 1: -@@ -28,5 +28,5 @@ class BoundsTableModel(SEToolsTableModel): - elif col == 2: - return item.child.name - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/commonmodel.py b/setoolsgui/commonmodel.py -index a6f6fed53840..2ceb57f4f0a3 100644 ---- a/setoolsgui/commonmodel.py -+++ b/setoolsgui/commonmodel.py -@@ -42,11 +42,11 @@ class CommonTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: - return ", ".join(sorted(item.perms)) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/constraintmodel.py b/setoolsgui/constraintmodel.py -index 122dff0b5139..d295f28f208b 100644 ---- a/setoolsgui/constraintmodel.py -+++ b/setoolsgui/constraintmodel.py -@@ -21,7 +21,7 @@ class ConstraintTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.ruletype.name - elif col == 1: -@@ -34,5 +34,5 @@ class ConstraintTableModel(SEToolsTableModel): - elif col == 3: - return str(rule.expression) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/defaultmodel.py b/setoolsgui/defaultmodel.py -index b9a6a58ebfea..3a699c49ce8c 100644 ---- a/setoolsgui/defaultmodel.py -+++ b/setoolsgui/defaultmodel.py -@@ -22,7 +22,7 @@ class DefaultTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.ruletype.name - elif col == 1: -@@ -33,5 +33,5 @@ class DefaultTableModel(SEToolsTableModel): - with suppress(AttributeError): - return item.default_range.name - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/details.py b/setoolsgui/details.py -index 4eb70066cfdb..8d4882cd6a1e 100644 ---- a/setoolsgui/details.py -+++ b/setoolsgui/details.py -@@ -37,15 +37,15 @@ class DetailsPopup(SEToolsWidget, QDialog): - self.setWindowTitle(text) - - def append(self, text): -- self.contents.setFontWeight(QFont.Normal) -+ self.contents.setFontWeight(QFont.Weight.Normal) - self.contents.setFontPointSize(9) - self.contents.append(text) - - def append_header(self, text): -- self.contents.setFontWeight(QFont.Black) -+ self.contents.setFontWeight(QFont.Weight.Black) - self.contents.setFontPointSize(11) - self.contents.append(text) - - def show(self): -- self.contents.moveCursor(QTextCursor.Start) -+ self.contents.moveCursor(QTextCursor.MoveOperation.Start) - super(DetailsPopup, self).show() -diff --git a/setoolsgui/fsusemodel.py b/setoolsgui/fsusemodel.py -index 2b3a3f402af9..bc100784c490 100644 ---- a/setoolsgui/fsusemodel.py -+++ b/setoolsgui/fsusemodel.py -@@ -20,7 +20,7 @@ class FSUseTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.ruletype.name - elif col == 1: -@@ -28,5 +28,5 @@ class FSUseTableModel(SEToolsTableModel): - elif col == 2: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/genfsconmodel.py b/setoolsgui/genfsconmodel.py -index 6fc46408865c..1e50d929446a 100644 ---- a/setoolsgui/genfsconmodel.py -+++ b/setoolsgui/genfsconmodel.py -@@ -32,7 +32,7 @@ class GenfsconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.fs - elif col == 1: -@@ -42,5 +42,5 @@ class GenfsconTableModel(SEToolsTableModel): - elif col == 3: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/ibendportconmodel.py b/setoolsgui/ibendportconmodel.py -index 199932d39415..37b7a8d74948 100644 ---- a/setoolsgui/ibendportconmodel.py -+++ b/setoolsgui/ibendportconmodel.py -@@ -20,7 +20,7 @@ class IbendportconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.name - elif col == 1: -@@ -28,5 +28,5 @@ class IbendportconTableModel(SEToolsTableModel): - elif col == 2: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/ibpkeyconmodel.py b/setoolsgui/ibpkeyconmodel.py -index f3cd95205d51..160425504521 100644 ---- a/setoolsgui/ibpkeyconmodel.py -+++ b/setoolsgui/ibpkeyconmodel.py -@@ -20,7 +20,7 @@ class IbpkeyconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return str(rule.subnet_prefix) - elif col == 1: -@@ -32,5 +32,5 @@ class IbpkeyconTableModel(SEToolsTableModel): - elif col == 2: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/initsidmodel.py b/setoolsgui/initsidmodel.py -index 1155a50fccb9..9ffb408024fd 100644 ---- a/setoolsgui/initsidmodel.py -+++ b/setoolsgui/initsidmodel.py -@@ -20,11 +20,11 @@ class InitialSIDTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.name - elif col == 1: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/listview.py b/setoolsgui/listview.py -index a4beda50b9f6..e803975c52c6 100644 ---- a/setoolsgui/listview.py -+++ b/setoolsgui/listview.py -@@ -34,14 +34,14 @@ class SEToolsListView(QListView): - - for row in range(model.rowCount()): - index = model.createIndex(row, 0) -- selection_model.select(index, QItemSelectionModel.Toggle) -+ selection_model.select(index, QItemSelectionModel.SelectionFlag.Toggle) - -- def selection(self, qt_role=Qt.UserRole): -+ def selection(self, qt_role=Qt.ItemDataRole.UserRole): - """ - Generator which returns the selection. - - Parameter: -- qt_role The Qt model role. Default is Qt.UserRole. -+ qt_role The Qt model role. Default is Qt.ItemDataRole.UserRole. - - Yield: tuple(row, data) - row The row number of the selection. -diff --git a/setoolsgui/mlsmodel.py b/setoolsgui/mlsmodel.py -index 8dfb28066d34..147378ef585a 100644 ---- a/setoolsgui/mlsmodel.py -+++ b/setoolsgui/mlsmodel.py -@@ -63,11 +63,11 @@ class MLSComponentTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: - return ", ".join(sorted(a for a in item.aliases())) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/mlsrulemodel.py b/setoolsgui/mlsrulemodel.py -index 4fa4f186a6cf..54ad4c216c72 100644 ---- a/setoolsgui/mlsrulemodel.py -+++ b/setoolsgui/mlsrulemodel.py -@@ -20,7 +20,7 @@ class MLSRuleTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.ruletype.name - elif col == 1: -@@ -32,5 +32,5 @@ class MLSRuleTableModel(SEToolsTableModel): - elif col == 4: - return str(rule.default) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/models.py b/setoolsgui/models.py -index fc7bf3df9ccf..dd864e932fbc 100644 ---- a/setoolsgui/models.py -+++ b/setoolsgui/models.py -@@ -19,7 +19,7 @@ def invert_list_selection(selection_model): - rowcount = model.rowCount() - for row in range(rowcount): - index = model.createIndex(row, 0) -- selection_model.select(index, QItemSelectionModel.Toggle) -+ selection_model.select(index, QItemSelectionModel.SelectionFlag.Toggle) - - - class SEToolsListModel(QAbstractListModel): -@@ -27,8 +27,8 @@ class SEToolsListModel(QAbstractListModel): - """ - The purpose of this model is to have the - objects return their string representations -- for Qt.DisplayRole and return the object -- for Qt.UserRole. -+ for Qt.ItemDataRole.DisplayRole and return the object -+ for Qt.ItemDataRole.UserRole. - - Some Python list-like functions are provided - for altering the model: append and remove -@@ -81,9 +81,9 @@ class SEToolsListModel(QAbstractListModel): - row = index.row() - item = self.item_list[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - return str(item) -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item - - -@@ -133,7 +133,7 @@ class SEToolsTableModel(QAbstractTableModel): - self.resultlist = [] - - def headerData(self, section, orientation, role): -- if role == Qt.DisplayRole and orientation == Qt.Horizontal: -+ if role == Qt.ItemDataRole.DisplayRole and orientation == Qt.Orientation.Horizontal: - return self.headers[section] - - def rowCount(self, parent=QModelIndex()): -diff --git a/setoolsgui/netifconmodel.py b/setoolsgui/netifconmodel.py -index 3d2e4b8b6ee1..54659203e7e5 100644 ---- a/setoolsgui/netifconmodel.py -+++ b/setoolsgui/netifconmodel.py -@@ -20,7 +20,7 @@ class NetifconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.netif - elif col == 1: -@@ -28,5 +28,5 @@ class NetifconTableModel(SEToolsTableModel): - elif col == 2: - return str(rule.packet) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/nodeconmodel.py b/setoolsgui/nodeconmodel.py -index ec4d66e9a026..f8055fca194d 100644 ---- a/setoolsgui/nodeconmodel.py -+++ b/setoolsgui/nodeconmodel.py -@@ -20,11 +20,11 @@ class NodeconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return str(rule.network.with_netmask) - elif col == 1: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/objclassmodel.py b/setoolsgui/objclassmodel.py -index 9823b73b30ee..ff1641f8cc3e 100644 ---- a/setoolsgui/objclassmodel.py -+++ b/setoolsgui/objclassmodel.py -@@ -58,7 +58,7 @@ class ObjClassTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: -@@ -69,5 +69,5 @@ class ObjClassTableModel(SEToolsTableModel): - - return ", ".join(sorted(chain(com_perms, item.perms))) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/portconmodel.py b/setoolsgui/portconmodel.py -index 39d2c72e4625..1c3de4494af9 100644 ---- a/setoolsgui/portconmodel.py -+++ b/setoolsgui/portconmodel.py -@@ -20,7 +20,7 @@ class PortconTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - low, high = rule.ports - if low == high: -@@ -32,5 +32,5 @@ class PortconTableModel(SEToolsTableModel): - elif col == 2: - return str(rule.context) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/rbacrulemodel.py b/setoolsgui/rbacrulemodel.py -index d8df9409ed56..84d2ff09e4fc 100644 ---- a/setoolsgui/rbacrulemodel.py -+++ b/setoolsgui/rbacrulemodel.py -@@ -21,7 +21,7 @@ class RBACRuleTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.ruletype.name - elif col == 1: -@@ -41,5 +41,5 @@ class RBACRuleTableModel(SEToolsTableModel): - except RuleUseError: - return None - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/rolemodel.py b/setoolsgui/rolemodel.py -index 004f4e7614ba..2dd7fe64d37e 100644 ---- a/setoolsgui/rolemodel.py -+++ b/setoolsgui/rolemodel.py -@@ -47,11 +47,11 @@ class RoleTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: - return ", ".join(sorted(t.name for t in item.types())) -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - # get the whole object - return item -diff --git a/setoolsgui/tableview.py b/setoolsgui/tableview.py -index 9726cb053466..9ba49aa50fa3 100644 ---- a/setoolsgui/tableview.py -+++ b/setoolsgui/tableview.py -@@ -45,7 +45,7 @@ class SEToolsTableView(QTableView): - elif prev_col is not None and current_col != prev_col: - selected_text.append('\t') - -- selected_text.append(datamodel.data(index, Qt.DisplayRole)) -+ selected_text.append(datamodel.data(index, Qt.ItemDataRole.DisplayRole)) - - prev_row = current_row - prev_col = current_col -@@ -76,7 +76,7 @@ class SEToolsTableView(QTableView): - # write headers - csv_row = [] - for col in range(col_count): -- csv_row.append(datamodel.headerData(col, Qt.Horizontal, Qt.DisplayRole)) -+ csv_row.append(datamodel.headerData(col, Qt.Orientation.Horizontal, Qt.ItemDataRole.DisplayRole)) - - writer.writerow(csv_row) - -@@ -86,6 +86,6 @@ class SEToolsTableView(QTableView): - - for col in range(col_count): - index = datamodel.index(row, col) -- csv_row.append(datamodel.data(index, Qt.DisplayRole)) -+ csv_row.append(datamodel.data(index, Qt.ItemDataRole.DisplayRole)) - - writer.writerow(csv_row) -diff --git a/setoolsgui/terulemodel.py b/setoolsgui/terulemodel.py -index 4d51ac8e9b25..53b61a06d152 100644 ---- a/setoolsgui/terulemodel.py -+++ b/setoolsgui/terulemodel.py -@@ -22,7 +22,7 @@ class TERuleTableModel(SEToolsTableModel): - col = index.column() - rule = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return rule.ruletype.name - elif col == 1: -@@ -50,5 +50,5 @@ class TERuleTableModel(SEToolsTableModel): - except RuleNotConditional: - return None - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return rule -diff --git a/setoolsgui/typeattrmodel.py b/setoolsgui/typeattrmodel.py -index 1a752fcd82f0..0b7c7ffe65a5 100644 ---- a/setoolsgui/typeattrmodel.py -+++ b/setoolsgui/typeattrmodel.py -@@ -44,11 +44,11 @@ class TypeAttributeTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: - return ", ".join(sorted(t.name for t in item.expand())) - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/typemodel.py b/setoolsgui/typemodel.py -index 841cc42a52d3..037996b96a8c 100644 ---- a/setoolsgui/typemodel.py -+++ b/setoolsgui/typemodel.py -@@ -50,7 +50,7 @@ class TypeTableModel(SEToolsTableModel): - col = index.column() - item = self.resultlist[row] - -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - if col == 0: - return item.name - elif col == 1: -@@ -60,5 +60,5 @@ class TypeTableModel(SEToolsTableModel): - elif col == 3 and item.ispermissive: - return "Permissive" - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return item -diff --git a/setoolsgui/usermodel.py b/setoolsgui/usermodel.py -index d0a4b0ed1a63..d5aca7bc11a0 100644 ---- a/setoolsgui/usermodel.py -+++ b/setoolsgui/usermodel.py -@@ -56,7 +56,7 @@ class UserTableModel(SEToolsTableModel): - - def data(self, index, role): - if self.resultlist and index.isValid(): -- if role == Qt.DisplayRole: -+ if role == Qt.ItemDataRole.DisplayRole: - row = index.row() - col = index.column() - user = self.resultlist[row] -@@ -76,5 +76,5 @@ class UserTableModel(SEToolsTableModel): - except MLSDisabled: - return None - -- elif role == Qt.UserRole: -+ elif role == Qt.ItemDataRole.UserRole: - return user --- -2.41.0 - diff --git a/setools.spec b/setools.spec index 86a6ee5..ece4334 100644 --- a/setools.spec +++ b/setools.spec @@ -1,9 +1,9 @@ -%global sepol_ver 3.5-1 -%global selinux_ver 3.5-1 +%global sepol_ver 3.6 +%global selinux_ver 3.6 Name: setools -Version: 4.4.3 -Release: 2%{?dist} +Version: 4.4.4 +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,8 +11,7 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch1: 0001-Use-the-The-New-Python-Enums.patch -Patch2: 0002-Use-PyQt6.patch +Patch1: 0001-Use-PyQt6.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -145,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Dec 11 2023 Petr Lautrbach - 4.4.4-1 +- SETools 4.4.4 release + * Mon Aug 28 2023 Petr Lautrbach - 4.4.3-2 - Use Qt 6 diff --git a/sources b/sources index edf09a7..b64453e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.4.3.tar.gz) = dcea6f10af0f46cb7f06aa1b29a757de7dbc30b52fe705c51a4f395d6cc25bfc7b78c15b6fc5c09ec05a2bbe8316bc79b87156304de5fe098040007d33a70143 +SHA512 (4.4.4.tar.gz) = 3ee382df80c71dc4fd2cd9ba287dbd97aca0d90a67f170646cb02e585d3e2d3bcc4a6f03d404d5273e7ad34a86bee42649432c58d517ad44ff97c94d2f35b1ef From cc080e498edc8c3eb2943ca865399e72cc8d13ab Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:41:23 +0000 Subject: [PATCH 093/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index ece4334..172292a 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.4.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -144,6 +144,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 4.4.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Dec 11 2023 Petr Lautrbach - 4.4.4-1 - SETools 4.4.4 release From 3a271f5265c8dd7ae4ffd38dbb0968d25281a88e Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 18 Apr 2024 12:43:35 +0200 Subject: [PATCH 094/111] SETools 4.5.0 - Add graphical results for information flow analysis and domain transition analysis, available in apol, sedta, and seinfoflow. - Add tooltips, What's This?, and detail popups in apol to help cross-referencing query and analysis results along with context-sensitive help. --- .gitignore | 1 + 0001-Use-PyQt6.patch | 1121 ------------------------------------------ setools.spec | 8 +- sources | 2 +- 4 files changed, 7 insertions(+), 1125 deletions(-) delete mode 100644 0001-Use-PyQt6.patch diff --git a/.gitignore b/.gitignore index a5afd44..66ea469 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.4.2.tar.gz /4.4.3.tar.gz /4.4.4.tar.gz +/4.5.0.tar.gz diff --git a/0001-Use-PyQt6.patch b/0001-Use-PyQt6.patch deleted file mode 100644 index 8b0285c..0000000 --- a/0001-Use-PyQt6.patch +++ /dev/null @@ -1,1121 +0,0 @@ -From a9a062004e9974e06880e57ddb2c9699de2696f0 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 4 Sep 2023 16:12:59 +0200 -Subject: [PATCH] Use PyQt6 -Content-type: text/plain - -Signed-off-by: Petr Lautrbach ---- - .mypy.ini | 2 +- - README.md | 6 +++--- - apol | 4 ++-- - setoolsgui/apol/analysistab.py | 4 ++-- - setoolsgui/apol/boolquery.py | 6 +++--- - setoolsgui/apol/boundsquery.py | 6 +++--- - setoolsgui/apol/categoryquery.py | 6 +++--- - setoolsgui/apol/chooseanalysis.py | 4 ++-- - setoolsgui/apol/commonquery.py | 6 +++--- - setoolsgui/apol/constraintquery.py | 6 +++--- - setoolsgui/apol/defaultquery.py | 6 +++--- - setoolsgui/apol/dta.py | 6 +++--- - setoolsgui/apol/excludetypes.py | 4 ++-- - setoolsgui/apol/fsusequery.py | 6 +++--- - setoolsgui/apol/genfsconquery.py | 6 +++--- - setoolsgui/apol/ibendportconquery.py | 6 +++--- - setoolsgui/apol/ibpkeyconquery.py | 6 +++--- - setoolsgui/apol/infoflow.py | 6 +++--- - setoolsgui/apol/initsidquery.py | 6 +++--- - setoolsgui/apol/mainwindow.py | 8 ++++---- - setoolsgui/apol/mlsrulequery.py | 6 +++--- - setoolsgui/apol/netifconquery.py | 6 +++--- - setoolsgui/apol/nodeconquery.py | 6 +++--- - setoolsgui/apol/objclassquery.py | 6 +++--- - setoolsgui/apol/permmapedit.py | 6 +++--- - setoolsgui/apol/portconquery.py | 6 +++--- - setoolsgui/apol/queryupdater.py | 2 +- - setoolsgui/apol/rbacrulequery.py | 6 +++--- - setoolsgui/apol/rolequery.py | 6 +++--- - setoolsgui/apol/sensitivityquery.py | 6 +++--- - setoolsgui/apol/summary.py | 6 +++--- - setoolsgui/apol/terulequery.py | 6 +++--- - setoolsgui/apol/typeattrquery.py | 6 +++--- - setoolsgui/apol/typequery.py | 6 +++--- - setoolsgui/apol/userquery.py | 6 +++--- - setoolsgui/apol/workspace.py | 2 +- - setoolsgui/boolmodel.py | 4 ++-- - setoolsgui/boundsmodel.py | 2 +- - setoolsgui/commonmodel.py | 4 ++-- - setoolsgui/constraintmodel.py | 2 +- - setoolsgui/defaultmodel.py | 2 +- - setoolsgui/details.py | 4 ++-- - setoolsgui/fsusemodel.py | 2 +- - setoolsgui/genfsconmodel.py | 2 +- - setoolsgui/getdetailslist.py | 4 ++-- - setoolsgui/ibendportconmodel.py | 2 +- - setoolsgui/ibpkeyconmodel.py | 2 +- - setoolsgui/initsidmodel.py | 2 +- - setoolsgui/listview.py | 6 +++--- - setoolsgui/logtosignal.py | 2 +- - setoolsgui/mlsmodel.py | 4 ++-- - setoolsgui/mlsrulemodel.py | 2 +- - setoolsgui/models.py | 2 +- - setoolsgui/netifconmodel.py | 2 +- - setoolsgui/nodeconmodel.py | 2 +- - setoolsgui/objclassmodel.py | 4 ++-- - setoolsgui/portconmodel.py | 2 +- - setoolsgui/rbacrulemodel.py | 2 +- - setoolsgui/rolemodel.py | 4 ++-- - setoolsgui/tableview.py | 6 +++--- - setoolsgui/terulemodel.py | 2 +- - setoolsgui/treeview.py | 6 +++--- - setoolsgui/typeattrmodel.py | 4 ++-- - setoolsgui/typemodel.py | 4 ++-- - setoolsgui/usermodel.py | 2 +- - setoolsgui/widget.py | 2 +- - 66 files changed, 144 insertions(+), 144 deletions(-) - -diff --git a/.mypy.ini b/.mypy.ini -index b45560b7d8d0..7d3aef848b4a 100644 ---- a/.mypy.ini -+++ b/.mypy.ini -@@ -9,7 +9,7 @@ ignore_missing_imports = True - [mypy-networkx.*] - ignore_missing_imports = True - --[mypy-PyQt5.*] -+[mypy-PyQt6.*] - ignore_missing_imports = True - - [mypy-sip] -diff --git a/README.md b/README.md -index b5a05c9376c3..d291e0d5693d 100644 ---- a/README.md -+++ b/README.md -@@ -20,8 +20,8 @@ To run SETools command line tools, the following packages are required: - * libsepol 3.2+ - - To run SETools graphical tools, the following packages are also required: --* PyQt5 --* qt5-assistant -+* PyQt6 -+* qt6-assistant - * qt-devel (only if rebuilding the help file) - - To build SETools, the following development packages are required, in -@@ -73,7 +73,7 @@ the tools can be ran from the current directory (e.g. ```./seinfo```). - ### Rebuilding the Apol Help File - - For convenience, a prebuilt copy of the apol help data file is included. --To rebuild this file, the Qt5 development tools are required -+To rebuild this file, the Qt6 development tools are required - (particularly, the ```qcollectiongenerator``` tool). At the root - of the SETools sources, perform the following: - ``` -diff --git a/apol b/apol -index 400832199eae..f32b29bf8c5c 100755 ---- a/apol -+++ b/apol -@@ -8,7 +8,7 @@ import sys - import argparse - import logging - --from PyQt5.QtWidgets import QApplication -+from PyQt6.QtWidgets import QApplication - import setools - import setoolsgui - -@@ -42,7 +42,7 @@ logging.getLogger().addHandler(console_handler) - try: - app = QApplication(sys.argv) - mainwindow = setoolsgui.ApolMainWindow(args.policy) -- sys.exit(app.exec_()) -+ sys.exit(app.exec()) - - except Exception as err: - if args.debug: -diff --git a/setoolsgui/apol/analysistab.py b/setoolsgui/apol/analysistab.py -index bc3629ff274a..13f89db32277 100644 ---- a/setoolsgui/apol/analysistab.py -+++ b/setoolsgui/apol/analysistab.py -@@ -6,8 +6,8 @@ - from typing import Dict, NamedTuple - from enum import Enum - --import sip --from PyQt5.QtWidgets import QDialogButtonBox, QScrollArea -+import PyQt6.sip as sip -+from PyQt6.QtWidgets import QDialogButtonBox, QScrollArea - - from ..widget import SEToolsWidget - -diff --git a/setoolsgui/apol/boolquery.py b/setoolsgui/apol/boolquery.py -index 6116fe48a846..d7bf529fa267 100644 ---- a/setoolsgui/apol/boolquery.py -+++ b/setoolsgui/apol/boolquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import BoolQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/boundsquery.py b/setoolsgui/apol/boundsquery.py -index 5b90c2ee2ded..5c53803dbb7a 100644 ---- a/setoolsgui/apol/boundsquery.py -+++ b/setoolsgui/apol/boundsquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import BoundsQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/categoryquery.py b/setoolsgui/apol/categoryquery.py -index 598f163c335f..7df35566f672 100644 ---- a/setoolsgui/apol/categoryquery.py -+++ b/setoolsgui/apol/categoryquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import CategoryQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/chooseanalysis.py b/setoolsgui/apol/chooseanalysis.py -index 155ae6d2f4ae..d7d192a94c2a 100644 ---- a/setoolsgui/apol/chooseanalysis.py -+++ b/setoolsgui/apol/chooseanalysis.py -@@ -5,8 +5,8 @@ - # - from collections import defaultdict - --from PyQt5.QtCore import Qt --from PyQt5.QtWidgets import QDialog, QTreeWidgetItem -+from PyQt6.QtCore import Qt -+from PyQt6.QtWidgets import QDialog, QTreeWidgetItem - - from ..widget import SEToolsWidget - from .analysistab import AnalysisSection, AnalysisTab, TAB_REGISTRY -diff --git a/setoolsgui/apol/commonquery.py b/setoolsgui/apol/commonquery.py -index 8fb11e87290d..1c73a42aff4b 100644 ---- a/setoolsgui/apol/commonquery.py -+++ b/setoolsgui/apol/commonquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import CommonQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/constraintquery.py b/setoolsgui/apol/constraintquery.py -index ee64db0ca1df..efda65f4c55e 100644 ---- a/setoolsgui/apol/constraintquery.py -+++ b/setoolsgui/apol/constraintquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import ConstraintQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/defaultquery.py b/setoolsgui/apol/defaultquery.py -index e09692ee6a46..cad78d03e8a8 100644 ---- a/setoolsgui/apol/defaultquery.py -+++ b/setoolsgui/apol/defaultquery.py -@@ -8,9 +8,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import DefaultQuery, DefaultValue, DefaultRangeValue - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 8bbed4dbe21f..bdbe6f448150 100644 ---- a/setoolsgui/apol/dta.py -+++ b/setoolsgui/apol/dta.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ -+from PyQt6.QtCore import pyqtSignal, Qt, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem - from setools import DomainTransitionAnalysis - -diff --git a/setoolsgui/apol/excludetypes.py b/setoolsgui/apol/excludetypes.py -index 1c4beaf84542..a764597cc1cd 100644 ---- a/setoolsgui/apol/excludetypes.py -+++ b/setoolsgui/apol/excludetypes.py -@@ -7,8 +7,8 @@ - import logging - import copy - --from PyQt5.QtCore import Qt, QSortFilterProxyModel --from PyQt5.QtWidgets import QDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel -+from PyQt6.QtWidgets import QDialog - - from ..models import SEToolsListModel - from ..widget import SEToolsWidget -diff --git a/setoolsgui/apol/fsusequery.py b/setoolsgui/apol/fsusequery.py -index 4e7567f4e4c6..e0b77af58ef0 100644 ---- a/setoolsgui/apol/fsusequery.py -+++ b/setoolsgui/apol/fsusequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import FSUseQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/genfsconquery.py b/setoolsgui/apol/genfsconquery.py -index 33dbed787cd6..5294e9042857 100644 ---- a/setoolsgui/apol/genfsconquery.py -+++ b/setoolsgui/apol/genfsconquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import GenfsconQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/ibendportconquery.py b/setoolsgui/apol/ibendportconquery.py -index 18252dd23de0..e688773eac5a 100644 ---- a/setoolsgui/apol/ibendportconquery.py -+++ b/setoolsgui/apol/ibendportconquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QProgressDialog - from setools import IbendportconQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/ibpkeyconquery.py b/setoolsgui/apol/ibpkeyconquery.py -index b7a78bf908a0..27be270f6602 100644 ---- a/setoolsgui/apol/ibpkeyconquery.py -+++ b/setoolsgui/apol/ibpkeyconquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QProgressDialog - from setools import IbpkeyconQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 526f3074e143..a57c232ccc3e 100644 ---- a/setoolsgui/apol/infoflow.py -+++ b/setoolsgui/apol/infoflow.py -@@ -9,9 +9,9 @@ import copy - from collections import defaultdict - from contextlib import suppress - --from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ -+from PyQt6.QtCore import pyqtSignal, Qt, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem - from setools import InfoFlowAnalysis - from setools.exception import UnmappedClass, UnmappedPermission -diff --git a/setoolsgui/apol/initsidquery.py b/setoolsgui/apol/initsidquery.py -index d01f87130925..f84e4c2260a9 100644 ---- a/setoolsgui/apol/initsidquery.py -+++ b/setoolsgui/apol/initsidquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import InitialSIDQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/mainwindow.py b/setoolsgui/apol/mainwindow.py -index dcbfb7590ef7..7dc3cd852820 100644 ---- a/setoolsgui/apol/mainwindow.py -+++ b/setoolsgui/apol/mainwindow.py -@@ -11,8 +11,8 @@ import json - from contextlib import suppress - - import pkg_resources --from PyQt5.QtCore import pyqtSlot, Qt, QProcess --from PyQt5.QtWidgets import QApplication, QFileDialog, QLineEdit, QMainWindow, QMessageBox -+from PyQt6.QtCore import pyqtSlot, Qt, QProcess -+from PyQt6.QtWidgets import QApplication, QFileDialog, QLineEdit, QMainWindow, QMessageBox - from setools import __version__, PermissionMap, SELinuxPolicy - - from ..widget import SEToolsWidget -@@ -26,7 +26,7 @@ from .summary import SummaryTab - - - BIN_SEARCH_PATHS = ("/usr/local/bin:/usr/bin:/bin") --POSSIBLE_ASSISTANT = ("assistant", "assistant-qt5") -+POSSIBLE_ASSISTANT = ("assistant", "assistant-qt6") - - - class ApolMainWindow(SEToolsWidget, QMainWindow): -@@ -666,7 +666,7 @@ class ApolMainWindow(SEToolsWidget, QMainWindow): - reply = QMessageBox.question( - self, "Qt Assistant Package Installed?", - "Failed to start QT Assistant program {}. " -- "This is typically in the assistant or qt5-assistant package. " -+ "This is typically in the assistant or qt6-assistant package. " - "Choose location of Qt Assistant executable?".format( - self.config.assistant), - QMessageBox.StandardButton.Yes | QMessageBox.StandardButton.No) -diff --git a/setoolsgui/apol/mlsrulequery.py b/setoolsgui/apol/mlsrulequery.py -index bb554ade6657..ec0a20955ed8 100644 ---- a/setoolsgui/apol/mlsrulequery.py -+++ b/setoolsgui/apol/mlsrulequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import MLSRuleQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/netifconquery.py b/setoolsgui/apol/netifconquery.py -index 4cf3de1a9f5c..3c828edb26c6 100644 ---- a/setoolsgui/apol/netifconquery.py -+++ b/setoolsgui/apol/netifconquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import NetifconQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/nodeconquery.py b/setoolsgui/apol/nodeconquery.py -index 81a33a794c05..dddfa069b9ad 100644 ---- a/setoolsgui/apol/nodeconquery.py -+++ b/setoolsgui/apol/nodeconquery.py -@@ -8,9 +8,9 @@ import sys - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import NodeconQuery, NodeconIPVersion - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/objclassquery.py b/setoolsgui/apol/objclassquery.py -index 23c8188e8bbd..4f0355dd3176 100644 ---- a/setoolsgui/apol/objclassquery.py -+++ b/setoolsgui/apol/objclassquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import ObjClassQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/permmapedit.py b/setoolsgui/apol/permmapedit.py -index d1e0b01ce854..ee01917a7bc5 100644 ---- a/setoolsgui/apol/permmapedit.py -+++ b/setoolsgui/apol/permmapedit.py -@@ -6,9 +6,9 @@ - import logging - import copy - --from PyQt5.QtCore import pyqtSignal, pyqtSlot, Qt --from PyQt5.QtGui import QPalette --from PyQt5.QtWidgets import QDialog, QFrame, QWidget -+from PyQt6.QtCore import pyqtSignal, pyqtSlot, Qt -+from PyQt6.QtGui import QPalette -+from PyQt6.QtWidgets import QDialog, QFrame, QWidget - - from ..models import SEToolsListModel - from ..widget import SEToolsWidget -diff --git a/setoolsgui/apol/portconquery.py b/setoolsgui/apol/portconquery.py -index de0a16567f1c..2afdd16e9f9c 100644 ---- a/setoolsgui/apol/portconquery.py -+++ b/setoolsgui/apol/portconquery.py -@@ -8,9 +8,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import PortconQuery, PortconProtocol - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/queryupdater.py b/setoolsgui/apol/queryupdater.py -index 9b6c155caa0a..07dc21a7d83d 100644 ---- a/setoolsgui/apol/queryupdater.py -+++ b/setoolsgui/apol/queryupdater.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import pyqtSignal, QObject, QThread -+from PyQt6.QtCore import pyqtSignal, QObject, QThread - - - class QueryResultsUpdater(QObject): -diff --git a/setoolsgui/apol/rbacrulequery.py b/setoolsgui/apol/rbacrulequery.py -index 4749d324d858..505a1858d015 100644 ---- a/setoolsgui/apol/rbacrulequery.py -+++ b/setoolsgui/apol/rbacrulequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import RBACRuleQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/rolequery.py b/setoolsgui/apol/rolequery.py -index e75614d9a992..bd1a02a1d614 100644 ---- a/setoolsgui/apol/rolequery.py -+++ b/setoolsgui/apol/rolequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import RoleQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/sensitivityquery.py b/setoolsgui/apol/sensitivityquery.py -index c8a27891ae97..aac7e2971b6d 100644 ---- a/setoolsgui/apol/sensitivityquery.py -+++ b/setoolsgui/apol/sensitivityquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import SensitivityQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/summary.py b/setoolsgui/apol/summary.py -index 1aeb2b303bd6..32b6c5fcfbe5 100644 ---- a/setoolsgui/apol/summary.py -+++ b/setoolsgui/apol/summary.py -@@ -7,9 +7,9 @@ - - import logging - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import MLSRuleQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/terulequery.py b/setoolsgui/apol/terulequery.py -index 7c99469edc87..4aba54cc59d0 100644 ---- a/setoolsgui/apol/terulequery.py -+++ b/setoolsgui/apol/terulequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import TERuleQuery, xperm_str_to_tuple_ranges - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/typeattrquery.py b/setoolsgui/apol/typeattrquery.py -index 67a087a7e3f0..f76de94e93d7 100644 ---- a/setoolsgui/apol/typeattrquery.py -+++ b/setoolsgui/apol/typeattrquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import TypeAttributeQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/typequery.py b/setoolsgui/apol/typequery.py -index a22e3547cd16..4859364576e4 100644 ---- a/setoolsgui/apol/typequery.py -+++ b/setoolsgui/apol/typequery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import TypeQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/userquery.py b/setoolsgui/apol/userquery.py -index 19ffb03c2975..6200ddcb8398 100644 ---- a/setoolsgui/apol/userquery.py -+++ b/setoolsgui/apol/userquery.py -@@ -7,9 +7,9 @@ - import logging - from contextlib import suppress - --from PyQt5.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread --from PyQt5.QtGui import QPalette, QTextCursor --from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog -+from PyQt6.QtCore import Qt, QSortFilterProxyModel, QStringListModel, QThread -+from PyQt6.QtGui import QPalette, QTextCursor -+from PyQt6.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog - from setools import UserQuery - - from ..logtosignal import LogHandlerToSignal -diff --git a/setoolsgui/apol/workspace.py b/setoolsgui/apol/workspace.py -index 2b4229224b85..8db9d1478d4d 100644 ---- a/setoolsgui/apol/workspace.py -+++ b/setoolsgui/apol/workspace.py -@@ -9,7 +9,7 @@ import logging - import setools - - --from PyQt5.QtCore import Qt, QItemSelectionModel -+from PyQt6.QtCore import Qt, QItemSelectionModel - - - def save_checkboxes(tab, settings, checkboxes): -diff --git a/setoolsgui/boolmodel.py b/setoolsgui/boolmodel.py -index c331fdd5057d..a1a733987258 100644 ---- a/setoolsgui/boolmodel.py -+++ b/setoolsgui/boolmodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from .details import DetailsPopup - from .models import SEToolsTableModel -diff --git a/setoolsgui/boundsmodel.py b/setoolsgui/boundsmodel.py -index c7ed1e7c227f..fdc1462b0a9b 100644 ---- a/setoolsgui/boundsmodel.py -+++ b/setoolsgui/boundsmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/commonmodel.py b/setoolsgui/commonmodel.py -index 2ceb57f4f0a3..a5c656deac15 100644 ---- a/setoolsgui/commonmodel.py -+++ b/setoolsgui/commonmodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from setools.exception import NoCommon - -diff --git a/setoolsgui/constraintmodel.py b/setoolsgui/constraintmodel.py -index d295f28f208b..2ae8dc5ba025 100644 ---- a/setoolsgui/constraintmodel.py -+++ b/setoolsgui/constraintmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - from setools.exception import ConstraintUseError - - from .models import SEToolsTableModel -diff --git a/setoolsgui/defaultmodel.py b/setoolsgui/defaultmodel.py -index 3a699c49ce8c..fe29b3f3179b 100644 ---- a/setoolsgui/defaultmodel.py -+++ b/setoolsgui/defaultmodel.py -@@ -5,7 +5,7 @@ - # - from contextlib import suppress - --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/details.py b/setoolsgui/details.py -index 8d4882cd6a1e..1cbf6c05590c 100644 ---- a/setoolsgui/details.py -+++ b/setoolsgui/details.py -@@ -5,8 +5,8 @@ - # - import logging - --from PyQt5.QtGui import QFont, QTextCursor --from PyQt5.QtWidgets import QDialog -+from PyQt6.QtGui import QFont, QTextCursor -+from PyQt6.QtWidgets import QDialog - - from .widget import SEToolsWidget - -diff --git a/setoolsgui/fsusemodel.py b/setoolsgui/fsusemodel.py -index bc100784c490..327a8653d1b2 100644 ---- a/setoolsgui/fsusemodel.py -+++ b/setoolsgui/fsusemodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/genfsconmodel.py b/setoolsgui/genfsconmodel.py -index 1e50d929446a..b3429c81d536 100644 ---- a/setoolsgui/genfsconmodel.py -+++ b/setoolsgui/genfsconmodel.py -@@ -5,7 +5,7 @@ - # - import stat - --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/getdetailslist.py b/setoolsgui/getdetailslist.py -index df7149dda0f2..e4e39194456c 100644 ---- a/setoolsgui/getdetailslist.py -+++ b/setoolsgui/getdetailslist.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtGui import QCursor --from PyQt5.QtWidgets import QAction, QListView, QMenu -+from PyQt6.QtGui import QCursor, QAction -+from PyQt6.QtWidgets import QListView, QMenu - - - class GetDetailsListView(QListView): -diff --git a/setoolsgui/ibendportconmodel.py b/setoolsgui/ibendportconmodel.py -index 37b7a8d74948..49780736b90f 100644 ---- a/setoolsgui/ibendportconmodel.py -+++ b/setoolsgui/ibendportconmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/ibpkeyconmodel.py b/setoolsgui/ibpkeyconmodel.py -index 160425504521..1a339b90110b 100644 ---- a/setoolsgui/ibpkeyconmodel.py -+++ b/setoolsgui/ibpkeyconmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/initsidmodel.py b/setoolsgui/initsidmodel.py -index 9ffb408024fd..04e8a34f931e 100644 ---- a/setoolsgui/initsidmodel.py -+++ b/setoolsgui/initsidmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/listview.py b/setoolsgui/listview.py -index e803975c52c6..ff42bf0f8c57 100644 ---- a/setoolsgui/listview.py -+++ b/setoolsgui/listview.py -@@ -6,9 +6,9 @@ - import logging - from collections import defaultdict - --from PyQt5.QtCore import Qt, QItemSelectionModel --from PyQt5.QtGui import QKeySequence --from PyQt5.QtWidgets import QAbstractItemView, QListView -+from PyQt6.QtCore import Qt, QItemSelectionModel -+from PyQt6.QtGui import QKeySequence -+from PyQt6.QtWidgets import QAbstractItemView, QListView - - - class SEToolsListView(QListView): -diff --git a/setoolsgui/logtosignal.py b/setoolsgui/logtosignal.py -index 7678f0992ce6..5bfab937ecc6 100644 ---- a/setoolsgui/logtosignal.py -+++ b/setoolsgui/logtosignal.py -@@ -5,7 +5,7 @@ - # - - from logging import Formatter, Handler, INFO --from PyQt5.QtCore import pyqtSignal, QObject -+from PyQt6.QtCore import pyqtSignal, QObject - - - class LogHandlerToSignal(Handler, QObject): -diff --git a/setoolsgui/mlsmodel.py b/setoolsgui/mlsmodel.py -index 147378ef585a..a0bfb3709d57 100644 ---- a/setoolsgui/mlsmodel.py -+++ b/setoolsgui/mlsmodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from .details import DetailsPopup - from .models import SEToolsTableModel -diff --git a/setoolsgui/mlsrulemodel.py b/setoolsgui/mlsrulemodel.py -index 54ad4c216c72..349900ef36d2 100644 ---- a/setoolsgui/mlsrulemodel.py -+++ b/setoolsgui/mlsrulemodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/models.py b/setoolsgui/models.py -index dd864e932fbc..0a19c9b26f1e 100644 ---- a/setoolsgui/models.py -+++ b/setoolsgui/models.py -@@ -7,7 +7,7 @@ import logging - from contextlib import suppress - from typing import List - --from PyQt5.QtCore import QAbstractListModel, QItemSelectionModel, QAbstractTableModel, \ -+from PyQt6.QtCore import QAbstractListModel, QItemSelectionModel, QAbstractTableModel, \ - QModelIndex, QStringListModel, Qt - from setools.exception import NoCommon - -diff --git a/setoolsgui/netifconmodel.py b/setoolsgui/netifconmodel.py -index 54659203e7e5..d9aa87bd0dea 100644 ---- a/setoolsgui/netifconmodel.py -+++ b/setoolsgui/netifconmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/nodeconmodel.py b/setoolsgui/nodeconmodel.py -index f8055fca194d..9bbb426a71aa 100644 ---- a/setoolsgui/nodeconmodel.py -+++ b/setoolsgui/nodeconmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/objclassmodel.py b/setoolsgui/objclassmodel.py -index ff1641f8cc3e..d67d45c12fd4 100644 ---- a/setoolsgui/objclassmodel.py -+++ b/setoolsgui/objclassmodel.py -@@ -5,8 +5,8 @@ - # - from itertools import chain - --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from setools.exception import NoCommon - -diff --git a/setoolsgui/portconmodel.py b/setoolsgui/portconmodel.py -index 1c3de4494af9..5eb3b9327d19 100644 ---- a/setoolsgui/portconmodel.py -+++ b/setoolsgui/portconmodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - - from .models import SEToolsTableModel - -diff --git a/setoolsgui/rbacrulemodel.py b/setoolsgui/rbacrulemodel.py -index 84d2ff09e4fc..c97cf36b0a3a 100644 ---- a/setoolsgui/rbacrulemodel.py -+++ b/setoolsgui/rbacrulemodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - from setools.exception import RuleUseError - - from .models import SEToolsTableModel -diff --git a/setoolsgui/rolemodel.py b/setoolsgui/rolemodel.py -index 2dd7fe64d37e..dc4852225bdb 100644 ---- a/setoolsgui/rolemodel.py -+++ b/setoolsgui/rolemodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from setools.exception import MLSDisabled - -diff --git a/setoolsgui/tableview.py b/setoolsgui/tableview.py -index 9ba49aa50fa3..71174008f85d 100644 ---- a/setoolsgui/tableview.py -+++ b/setoolsgui/tableview.py -@@ -5,9 +5,9 @@ - # - import csv - --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QKeySequence, QCursor --from PyQt5.QtWidgets import QAction, QApplication, QFileDialog, QMenu, QTableView -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QAction, QKeySequence, QCursor -+from PyQt6.QtWidgets import QApplication, QFileDialog, QMenu, QTableView - - - class SEToolsTableView(QTableView): -diff --git a/setoolsgui/terulemodel.py b/setoolsgui/terulemodel.py -index 53b61a06d152..ac1b32d76ec4 100644 ---- a/setoolsgui/terulemodel.py -+++ b/setoolsgui/terulemodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt -+from PyQt6.QtCore import Qt - from setools.exception import RuleNotConditional, RuleUseError - - from .models import SEToolsTableModel -diff --git a/setoolsgui/treeview.py b/setoolsgui/treeview.py -index a8f6fb4caef5..bf6d63d2b92b 100644 ---- a/setoolsgui/treeview.py -+++ b/setoolsgui/treeview.py -@@ -3,9 +3,9 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt, QModelIndex --from PyQt5.QtGui import QKeySequence, QCursor --from PyQt5.QtWidgets import QAction, QApplication, QFileDialog, QMenu, QTreeWidget, \ -+from PyQt6.QtCore import Qt, QModelIndex -+from PyQt6.QtGui import QAction, QKeySequence, QCursor -+from PyQt6.QtWidgets import QApplication, QFileDialog, QMenu, QTreeWidget, \ - QTreeWidgetItemIterator - - -diff --git a/setoolsgui/typeattrmodel.py b/setoolsgui/typeattrmodel.py -index 0b7c7ffe65a5..ede73228e16a 100644 ---- a/setoolsgui/typeattrmodel.py -+++ b/setoolsgui/typeattrmodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from setools.exception import MLSDisabled - -diff --git a/setoolsgui/typemodel.py b/setoolsgui/typemodel.py -index 037996b96a8c..f25737169762 100644 ---- a/setoolsgui/typemodel.py -+++ b/setoolsgui/typemodel.py -@@ -3,8 +3,8 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt --from PyQt5.QtGui import QPalette, QTextCursor -+from PyQt6.QtCore import Qt -+from PyQt6.QtGui import QPalette, QTextCursor - - from setools.exception import MLSDisabled - -diff --git a/setoolsgui/usermodel.py b/setoolsgui/usermodel.py -index d5aca7bc11a0..4edb393a9d0e 100644 ---- a/setoolsgui/usermodel.py -+++ b/setoolsgui/usermodel.py -@@ -3,7 +3,7 @@ - # SPDX-License-Identifier: LGPL-2.1-only - # - # --from PyQt5.QtCore import Qt, QModelIndex -+from PyQt6.QtCore import Qt, QModelIndex - from setools.exception import MLSDisabled - - from .details import DetailsPopup -diff --git a/setoolsgui/widget.py b/setoolsgui/widget.py -index e236623cef96..b2866139564c 100644 ---- a/setoolsgui/widget.py -+++ b/setoolsgui/widget.py -@@ -7,7 +7,7 @@ import sys - from errno import ENOENT - - import pkg_resources --from PyQt5.uic import loadUi -+from PyQt6.uic import loadUi - - - # Stylesheet that adds a frame around QGroupBoxes --- -2.41.0 - diff --git a/setools.spec b/setools.spec index 172292a..0af99a9 100644 --- a/setools.spec +++ b/setools.spec @@ -2,8 +2,8 @@ %global selinux_ver 3.6 Name: setools -Version: 4.4.4 -Release: 2%{?dist} +Version: 4.5.0 +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only and LGPL-2.1-only @@ -11,7 +11,6 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch1: 0001-Use-PyQt6.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -144,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Apr 18 2024 Petr Lautrbach - 4.5.0-1 +- SETools 4.5.0 + * Sat Jan 27 2024 Fedora Release Engineering - 4.4.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index b64453e..fc75e62 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.4.4.tar.gz) = 3ee382df80c71dc4fd2cd9ba287dbd97aca0d90a67f170646cb02e585d3e2d3bcc4a6f03d404d5273e7ad34a86bee42649432c58d517ad44ff97c94d2f35b1ef +SHA512 (4.5.0.tar.gz) = 1a33569c7a2a03b373e8d975890eff60ac3acdbe2ea7fe961046f4e1b01f25c0c4135d6c92f00a73579f595a754e22287ad2e2894da9a6087554534b91df45ee From 5bd6294fcae8a83a5a9cdec1d7217d9ca7329d96 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 23 Apr 2024 16:04:02 +0200 Subject: [PATCH 095/111] SETools 4.5.1 - Correct annotations of NetworkX types to make it optional again. - Fix packaging issue for apol's style sheet (apol.css). --- .gitignore | 1 + setools.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 66ea469..ee1b313 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.4.3.tar.gz /4.4.4.tar.gz /4.5.0.tar.gz +/4.5.1.tar.gz diff --git a/setools.spec b/setools.spec index 0af99a9..5828a22 100644 --- a/setools.spec +++ b/setools.spec @@ -2,7 +2,7 @@ %global selinux_ver 3.6 Name: setools -Version: 4.5.0 +Version: 4.5.1 Release: 1%{?dist} Summary: Policy analysis tools for SELinux @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu May 02 2024 Petr Lautrbach - 4.5.1-1 +- SETools 4.5.1 + * Thu Apr 18 2024 Petr Lautrbach - 4.5.0-1 - SETools 4.5.0 diff --git a/sources b/sources index fc75e62..fa454b3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.5.0.tar.gz) = 1a33569c7a2a03b373e8d975890eff60ac3acdbe2ea7fe961046f4e1b01f25c0c4135d6c92f00a73579f595a754e22287ad2e2894da9a6087554534b91df45ee +SHA512 (4.5.1.tar.gz) = 6aef2e12495f980a0b71cf888170ee2f1de94785404b578d416d9720f2441ff3ef14c7ac434310e421c7fa885b8c8ef99aff6438ecfb5e8687d0ff4875127824 From 5f7bd5af0ad633ba950dc81c8fff64bdb03d41a9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 2 May 2024 17:35:17 +0200 Subject: [PATCH 096/111] Fix License tag Fixes: SPDX license expressions in use, but an invalid boolean was found: and; when using SPDX expression the booleans must be in all caps. --- setools.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index 5828a22..44097a9 100644 --- a/setools.spec +++ b/setools.spec @@ -3,10 +3,10 @@ Name: setools Version: 4.5.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux -License: GPL-2.0-only and LGPL-2.1-only +License: GPL-2.0-only AND LGPL-2.1-only URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz Source1: setools.pam @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu May 02 2024 Petr Lautrbach - 4.5.1-2 +- Fix License tag + * Thu May 02 2024 Petr Lautrbach - 4.5.1-1 - SETools 4.5.1 From d301e66a010b6334ec7bc94f46c95e25cd5858c9 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 09:51:16 +0200 Subject: [PATCH 097/111] Rebuilt for Python 3.13 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 44097a9..a909a88 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Jun 07 2024 Python Maint - 4.5.1-3 +- Rebuilt for Python 3.13 + * Thu May 02 2024 Petr Lautrbach - 4.5.1-2 - Fix License tag From 94756e17ba771fdd37e635ced0a93dee74b540cb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 05:18:18 +0000 Subject: [PATCH 098/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index a909a88..6bad39d 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -143,6 +143,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jun 07 2024 Python Maint - 4.5.1-3 - Rebuilt for Python 3.13 From 183b6ffe53b0338161e65a731de2edec9b2d3809 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 15 Aug 2024 11:43:12 +0200 Subject: [PATCH 099/111] Replace setup.py test with %pytest https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/YOC5527SRKNY2XG6CMS3KNGJ54O7SMXI/ --- setools.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 6bad39d..bae93a9 100644 --- a/setools.spec +++ b/setools.spec @@ -101,7 +101,8 @@ Python modules designed to facilitate SELinux policy analysis. %check %if %{?_with_check:1}%{!?_with_check:0} -%{__python3} setup.py test +# dnf install python3-pytest python3-pytest-qt +%pytest %endif From cb92b5067a40c40928ad32edaea6be30aa3948a9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 11 Oct 2024 09:05:31 +0200 Subject: [PATCH 100/111] pyprojectize spec file The old %py3_build and %py3_install macros (201x-era) as documented in [1] use a deprecated feature of setuptools. It is highly recommended to use the current %pyproject macros instead as documented in [2] and [3] sooner than it becomes necessary. [1]: https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_201x/ [2]: https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/ [3]: https://src.fedoraproject.org/rpms/pyproject-rpm-macros/blob/rawhide/f/README.md https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/RFHSXAU2D4PEN2KHZCBUGP6MEGTUOUD2/ --- setools.spec | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/setools.spec b/setools.spec index bae93a9..ac08515 100644 --- a/setools.spec +++ b/setools.spec @@ -19,7 +19,6 @@ BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: swig BuildRequires: python3-Cython BuildRequires: python3-devel -BuildRequires: python3-setuptools BuildRequires: libselinux-devel Requires: %{name}-console = %{version}-%{release} @@ -68,7 +67,6 @@ This package includes the following console tools: Summary: Policy analysis tools for SELinux License: LGPL-2.1-only Obsoletes: setools-libs < 4.0.0 -%{?python_provide:%python_provide python3-setools} Requires: python3-setuptools %description -n python3-setools @@ -92,12 +90,16 @@ Python modules designed to facilitate SELinux policy analysis. %autosetup -p 1 -S git -n setools-%{version} +%generate_buildrequires +%pyproject_buildrequires + + %build -%py3_build +%pyproject_wheel %install -%py3_install +%pyproject_install %check %if %{?_with_check:1}%{!?_with_check:0} From 658794f3e3ef731a9adb739b4669c75167486f24 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 10:27:59 +0000 Subject: [PATCH 101/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index ac08515..1da82f3 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -146,6 +146,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 4.5.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From f5e19e21ecbb28266d998912873ecd84941c4409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 1 Apr 2025 14:48:12 +0200 Subject: [PATCH 102/111] Drop redundant runtime requirement on python3-setuptools, dropped in setools 4.5.1 --- setools.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/setools.spec b/setools.spec index 1da82f3..f714ba9 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -67,7 +67,6 @@ This package includes the following console tools: Summary: Policy analysis tools for SELinux License: LGPL-2.1-only Obsoletes: setools-libs < 4.0.0 -Requires: python3-setuptools %description -n python3-setools SETools is a collection of graphical tools, command-line tools, and @@ -146,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Tue Apr 01 2025 Miro Hrončok - 4.5.1-6 +- Drop redundant runtime requirement on python3-setuptools, dropped in setools 4.5.1 + * Sun Jan 19 2025 Fedora Release Engineering - 4.5.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 93d27ba219d8499da9c0c9adf0e4610c97b74af7 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 20:49:32 +0200 Subject: [PATCH 103/111] Rebuilt for Python 3.14 --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index f714ba9..cebb22c 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -145,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Jun 02 2025 Python Maint - 4.5.1-7 +- Rebuilt for Python 3.14 + * Tue Apr 01 2025 Miro Hrončok - 4.5.1-6 - Drop redundant runtime requirement on python3-setuptools, dropped in setools 4.5.1 From 11ee438aa063b00bcc958846fa29efcc178a2e1b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 5 Jul 2025 20:14:37 +0200 Subject: [PATCH 104/111] Rebuilt with SELinux userspace 3.9-rc2 release --- setools.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index cebb22c..3523e5c 100644 --- a/setools.spec +++ b/setools.spec @@ -1,9 +1,9 @@ -%global sepol_ver 3.6 -%global selinux_ver 3.6 +%global sepol_ver 3.9 +%global selinux_ver 3.9 Name: setools Version: 4.5.1 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -145,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Sat Jul 05 2025 Petr Lautrbach - 4.5.1-8 +- Rebuilt with SELinux userspace 3.9-rc2 release + * Mon Jun 02 2025 Python Maint - 4.5.1-7 - Rebuilt for Python 3.14 From e93cfa7b72252fbcb0a71404c6bd11b1193be8fa Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 18:10:39 +0000 Subject: [PATCH 105/111] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 3523e5c..54e24d7 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -145,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 4.5.1-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Sat Jul 05 2025 Petr Lautrbach - 4.5.1-8 - Rebuilt with SELinux userspace 3.9-rc2 release From 17706eb7801657c220598912658cec2db91ce010 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 4 Aug 2025 17:23:41 +0200 Subject: [PATCH 106/111] Drop redundant runtime requirement on python3-setuptools (correction) This is a fixup for f5e19e21ecbb28266d998912873ecd84941c4409 --- 148.patch | 28 ++++++++++++++++++++++++++++ setools.spec | 8 +++++++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 148.patch diff --git a/148.patch b/148.patch new file mode 100644 index 0000000..ce7848c --- /dev/null +++ b/148.patch @@ -0,0 +1,28 @@ +From 200369a8df5feb62a0fb2b795ca26439ad6fdad5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Tue, 8 Apr 2025 11:22:47 +0200 +Subject: [PATCH] Remove redundant runtime requirement on setuptools +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The dependency was dropped in 99a1cf3b50cd8bf502b5070293c4d1bf792d1566 + +Signed-off-by: Miro Hrončok +--- + setup.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.py b/setup.py +index b2245ac7..6e83f8e7 100644 +--- a/setup.py ++++ b/setup.py +@@ -97,7 +97,7 @@ + # setup also requires libsepol and libselinux + # C libraries and headers to compile. + setup_requires=['setuptools', 'Cython>=0.29.14'], +- install_requires=['setuptools'], ++ install_requires=[], + extras_require={ + "analysis": ["networkx>=2.6", "pygraphviz"], + "test": "tox" diff --git a/setools.spec b/setools.spec index 54e24d7..9349704 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -12,6 +12,9 @@ Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar Source1: setools.pam Source2: apol.desktop +# Remove redundant runtime requirement on setuptools +Patch: https://github.com/SELinuxProject/setools/pull/148.patch + Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core @@ -145,6 +148,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Aug 04 2025 Miro Hrončok - 4.5.1-10 +- Drop redundant runtime requirement on python3-setuptools (correction) + * Fri Jul 25 2025 Fedora Release Engineering - 4.5.1-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 1bd344a3eec0d7c7b1312843c5d0dd779efc0876 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 15:17:29 +0200 Subject: [PATCH 107/111] Rebuilt for Python 3.14.0rc2 bytecode --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index 9349704..81b6685 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.5.1 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -148,6 +148,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Aug 15 2025 Python Maint - 4.5.1-11 +- Rebuilt for Python 3.14.0rc2 bytecode + * Mon Aug 04 2025 Miro Hrončok - 4.5.1-10 - Drop redundant runtime requirement on python3-setuptools (correction) From e6c218363b79bd5be5dd417953e53b4e4d9733ae Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Sep 2025 10:23:26 +0200 Subject: [PATCH 108/111] SETools 4.6.0 --- .gitignore | 1 + 148.patch | 28 ---------------------------- setools.spec | 10 +++++----- sources | 2 +- 4 files changed, 7 insertions(+), 34 deletions(-) delete mode 100644 148.patch diff --git a/.gitignore b/.gitignore index ee1b313..b838721 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.4.4.tar.gz /4.5.0.tar.gz /4.5.1.tar.gz +/4.6.0.tar.gz diff --git a/148.patch b/148.patch deleted file mode 100644 index ce7848c..0000000 --- a/148.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 200369a8df5feb62a0fb2b795ca26439ad6fdad5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= -Date: Tue, 8 Apr 2025 11:22:47 +0200 -Subject: [PATCH] Remove redundant runtime requirement on setuptools -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The dependency was dropped in 99a1cf3b50cd8bf502b5070293c4d1bf792d1566 - -Signed-off-by: Miro Hrončok ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index b2245ac7..6e83f8e7 100644 ---- a/setup.py -+++ b/setup.py -@@ -97,7 +97,7 @@ - # setup also requires libsepol and libselinux - # C libraries and headers to compile. - setup_requires=['setuptools', 'Cython>=0.29.14'], -- install_requires=['setuptools'], -+ install_requires=[], - extras_require={ - "analysis": ["networkx>=2.6", "pygraphviz"], - "test": "tox" diff --git a/setools.spec b/setools.spec index 81b6685..f1ef726 100644 --- a/setools.spec +++ b/setools.spec @@ -2,8 +2,8 @@ %global selinux_ver 3.9 Name: setools -Version: 4.5.1 -Release: 11%{?dist} +Version: 4.6.0 +Release: 1%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -12,9 +12,6 @@ Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar Source1: setools.pam Source2: apol.desktop -# Remove redundant runtime requirement on setuptools -Patch: https://github.com/SELinuxProject/setools/pull/148.patch - Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core @@ -148,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Tue Sep 09 2025 Petr Lautrbach - 4.6.0-1 +- SETools 4.6.0 + * Fri Aug 15 2025 Python Maint - 4.5.1-11 - Rebuilt for Python 3.14.0rc2 bytecode diff --git a/sources b/sources index fa454b3..386b801 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.5.1.tar.gz) = 6aef2e12495f980a0b71cf888170ee2f1de94785404b578d416d9720f2441ff3ef14c7ac434310e421c7fa885b8c8ef99aff6438ecfb5e8687d0ff4875127824 +SHA512 (4.6.0.tar.gz) = 5b654f480f285717d15fa55f754fbd00cb030a0d8af8342d901e0514c4fdbacb7873e19420dab98540eaa481c687ff1e03423df893c0d1744eb4c53eb81afbf5 From ace76941968afb96e8b60e53810346a62a47c2e4 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 14:55:49 +0200 Subject: [PATCH 109/111] Rebuilt for Python 3.14.0rc3 bytecode --- setools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setools.spec b/setools.spec index f1ef726..3e45b9d 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.6.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -145,6 +145,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Fri Sep 19 2025 Python Maint - 4.6.0-2 +- Rebuilt for Python 3.14.0rc3 bytecode + * Tue Sep 09 2025 Petr Lautrbach - 4.6.0-1 - SETools 4.6.0 From c0cc824e8f96e82071b6cf6d3070b0984a939347 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 2 Oct 2025 11:55:27 +0200 Subject: [PATCH 110/111] Drop redundant runtime requirement on python3-setuptools (redux) The patch was removed in https://src.fedoraproject.org/rpms/setools/c/e6c218363b79bd5be5dd417953e53b4e4d9733ae?branch=rawhide But we want to keep it. My upstream removal was reverted and later reapplied again, so update the the patch link to the latter one. --- 156.patch | 43 +++++++++++++++++++++++++++++++++++++++++++ setools.spec | 8 +++++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 156.patch diff --git a/156.patch b/156.patch new file mode 100644 index 0000000..ea56fc1 --- /dev/null +++ b/156.patch @@ -0,0 +1,43 @@ +From 39f7c88251925463c38f5000f6178fe70b484f44 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Tue, 8 Apr 2025 11:22:47 +0200 +Subject: [PATCH] Remove redundant runtime requirement on setuptools +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The dependency was dropped in 99a1cf3b50cd8bf502b5070293c4d1bf792d1566 + +Add a build time dependency for setup.py build_ext on Python 3.12+ +which no longer contains distutils. + +Signed-off-by: Miro Hrončok +--- + pyproject.toml | 2 +- + tox.ini | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/pyproject.toml b/pyproject.toml +index f7815a15..28ae121a 100644 +--- a/pyproject.toml ++++ b/pyproject.toml +@@ -39,7 +39,7 @@ classifiers = ["Development Status :: 5 - Production/Stable", + + requires-python=">=3.10" + # also requires libsepol.so and libselinux.so. +-dependencies = ["setuptools"] ++dependencies = [] + + optional-dependencies.analysis = ["networkx>=2.6", + "pygraphviz"] +diff --git a/tox.ini b/tox.ini +index 8fa6954f..b2a21d6b 100644 +--- a/tox.ini ++++ b/tox.ini +@@ -56,5 +56,6 @@ deps = networkx>=2.6 + pygraphviz + pytest-qt + pytest-xvfb ++ setuptools;python_version>="3.12" + commands_pre = {envpython} setup.py build_ext -i + commands = {envpython} -m pytest tests diff --git a/setools.spec b/setools.spec index 3e45b9d..e9ada82 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.6.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -12,6 +12,9 @@ Source0: https://github.com/SELinuxProject/setools/archive/%{version}.tar Source1: setools.pam Source2: apol.desktop +# Remove redundant runtime requirement on setuptools +Patch: https://github.com/SELinuxProject/setools/pull/156.patch + Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison BuildRequires: glibc-devel, gcc, git-core @@ -145,6 +148,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Thu Oct 02 2025 Miro Hrončok - 4.6.0-3 +- Drop redundant runtime requirement on python3-setuptools (redux) + * Fri Sep 19 2025 Python Maint - 4.6.0-2 - Rebuilt for Python 3.14.0rc3 bytecode From 630d9a66668ca07f5a2743614748c2519c441f0d Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Mon, 1 Dec 2025 15:48:06 +0100 Subject: [PATCH 111/111] setools-4.6.0-4 - Fix seinfo argument parsing when policy path follows query options --- 157.patch | 42 ++++++++++++++++++++++++++++++++++++++++++ setools.spec | 7 ++++++- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 157.patch diff --git a/157.patch b/157.patch new file mode 100644 index 0000000..24b6820 --- /dev/null +++ b/157.patch @@ -0,0 +1,42 @@ +From a33a2e394435316f3822e89ac9c2a9aabab17252 Mon Sep 17 00:00:00 2001 +From: Pranav Lawate +Date: Tue, 30 Sep 2025 22:29:10 +0530 +Subject: [PATCH] Fix seinfo argument parsing when policy path follows query + options + +Signed-off-by: Pranav Lawate +--- + seinfo | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/seinfo b/seinfo +index 99180c36..d04ec320 100755 +--- a/seinfo ++++ b/seinfo +@@ -12,6 +12,7 @@ import logging + import signal + import ipaddress + import warnings ++from pathlib import Path + from typing import Callable, List, Tuple + + +@@ -102,6 +103,18 @@ xen.add_argument("--devicetreecon", help="Print all devicetreecon statements.", + + args = parser.parse_args() + ++# Fix argument misparsing: when policy is None and a query option is a string, ++# check if the string is actually a policy file that is incorrectly consumed by the query option ++if not args.policy: ++ # Check all query options defined in the queries argument group ++ for action in queries._group_actions: ++ value = getattr(args, action.dest, None) ++ if isinstance(value, str) and Path(value).exists(): ++ # This query argument consumed the policy path - fix it ++ args.policy = value ++ setattr(args, action.dest, True) ++ break ++ + if args.debug: + logging.basicConfig(level=logging.DEBUG, + format='%(asctime)s|%(levelname)s|%(name)s|%(message)s') diff --git a/setools.spec b/setools.spec index e9ada82..e43d04a 100644 --- a/setools.spec +++ b/setools.spec @@ -3,7 +3,7 @@ Name: setools Version: 4.6.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Policy analysis tools for SELinux License: GPL-2.0-only AND LGPL-2.1-only @@ -14,6 +14,8 @@ Source2: apol.desktop # Remove redundant runtime requirement on setuptools Patch: https://github.com/SELinuxProject/setools/pull/156.patch +# Fix seinfo argument parsing when policy path follows query +Patch: https://github.com/SELinuxProject/setools/pull/157.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -148,6 +150,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/ru/man1/apol* %changelog +* Mon Dec 01 2025 Veronika Syncakova - 4.6.0-4 +- Fix seinfo argument parsing when policy path follows query options + * Thu Oct 02 2025 Miro Hrončok - 4.6.0-3 - Drop redundant runtime requirement on python3-setuptools (redux)