From b2c4c6ff83256f374af6bb29731917c2e76b1430 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 9 Aug 2018 16:34:27 +0200 Subject: [PATCH 1/9] setools-4.2.0-0.1.beta - New upstream release -- Replaced the Python/SWIG/static-linked-libsepol policyrep module with a Cython implementation. This will have performance and memory-usage improvements and breaks the static linking to libsepol. -- Significant memory usage reduction in sediff (approximately 60%, depending on the policies). -- Added support for SCTP portcons -- Updated permission maps -- Support for Python 2.7 was dropped - Drop python2 subpackage (4.2.0 no longer supports python2) --- 0001-Do-not-use-Werror-during-build.patch | 40 +++--------- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 63 +++++++++---------- setools.spec | 61 ++++-------------- sources | 1 + 4 files changed, 53 insertions(+), 112 deletions(-) diff --git a/0001-Do-not-use-Werror-during-build.patch b/0001-Do-not-use-Werror-during-build.patch index ff4523c..f6430fe 100644 --- a/0001-Do-not-use-Werror-during-build.patch +++ b/0001-Do-not-use-Werror-during-build.patch @@ -1,49 +1,27 @@ -From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Thu, 23 Feb 2017 08:17:07 +0100 +From 42e691b12c03aac388e39071f4b8d76cbc40e5c5 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 29 Jun 2018 10:34:14 +0200 Subject: [PATCH 1/2] Do not use -Werror during build -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit There are new warnings when setools are built with gcc 7 therefore we want to suppress -Werror for now - -Fixes: -libqpol/policy_extend.c: In function ‘policy_extend’: -libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=] - snprintf(buff, 9, "@ttr%04zd", i + 1); - ^~~~~ -libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295] - snprintf(buff, 9, "@ttr%04zd", i + 1); - ^~~~~~~~~~~ -In file included from /usr/include/stdio.h:939:0, - from /usr/include/sepol/policydb/policydb.h:53, - from libqpol/policy_extend.c:29: -/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9 - return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - __bos (__s), __fmt, __va_arg_pack ()); - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -cc1: all warnings being treated as errors -error: command 'gcc' failed with exit status 1 --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 2ca44c9..9319bf6 100644 +index aa4f14b..e4da575 100644 --- a/setup.py +++ b/setup.py -@@ -146,7 +146,7 @@ ext_py_mods = [Extension('setools.policyrep._qpol', - 'libqpol/policy_scan.c', - 'libqpol/xen_query.c'], - include_dirs=include_dirs, +@@ -62,7 +62,7 @@ ext_py_mods = [Extension('setools.policyrep.libpolicyrep', ['setools/policyrep/l + library_dirs=lib_dirs, + runtime_library_dirs=lib_dirs, + define_macros=macros, - extra_compile_args=['-Werror', '-Wextra', + extra_compile_args=['-Wextra', '-Waggregate-return', '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.9.3 +2.14.3 diff --git a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index a5d982a..c1479e6 100644 --- a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,6 +1,6 @@ -From 2512c3ba608077db3a5e0286b976fadc8a04a5c4 Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Thu, 23 Feb 2017 08:17:07 +0100 +From 39a28c23990f667ef1dc50c3fe6d0ca79a7e793d Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 29 Jun 2018 10:31:18 +0200 Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis @@ -12,28 +12,29 @@ Therefore it's better to use setools.infoflow.InfoFlowAnalysis and setools.dta.DomainTransitionAnalysis and let the package containing sedta and seinfoflow to require python3-networkx --- - sedta | 3 ++- + sedta | 4 ++-- seinfoflow | 3 ++- setools/__init__.py | 4 ++-- setoolsgui/apol/dta.py | 2 +- setoolsgui/apol/infoflow.py | 2 +- - tests/dta.py | 3 ++- - tests/infoflow.py | 3 ++- - 7 files changed, 12 insertions(+), 8 deletions(-) + tests/dta.py | 2 +- + tests/infoflow.py | 2 +- + 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/sedta b/sedta -index 1c76ebb..255ad49 100755 +index 84820b0..8c380ab 100755 --- a/sedta +++ b/sedta -@@ -23,6 +23,7 @@ import argparse +@@ -21,7 +21,7 @@ import sys + import argparse import logging - import setools +-import setools +import setools.dta def print_transition(trans): -@@ -111,7 +112,7 @@ else: +@@ -110,7 +110,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) @@ -43,18 +44,18 @@ index 1c76ebb..255ad49 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index b287921..d53bdef 100755 +index 3ec05ca..89764fe 100755 --- a/seinfoflow +++ b/seinfoflow -@@ -19,6 +19,7 @@ +@@ -18,6 +18,7 @@ + # - from __future__ import print_function import setools +import setools.infoflow import argparse import sys import logging -@@ -79,7 +80,7 @@ else: +@@ -78,7 +79,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) @@ -64,7 +65,7 @@ index b287921..d53bdef 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index a84c846..a53c5a7 100644 +index a84c846..cbb2a00 100644 --- a/setools/__init__.py +++ b/setools/__init__.py @@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery @@ -72,12 +73,12 @@ index a84c846..a53c5a7 100644 # Information Flow Analysis -from .infoflow import InfoFlowAnalysis -+# from .infoflow import InfoFlowAnalysis ++#from .infoflow import InfoFlowAnalysis from .permmap import PermissionMap # Domain Transition Analysis -from .dta import DomainTransitionAnalysis -+# from .dta import DomainTransitionAnalysis ++#from .dta import DomainTransitionAnalysis # Policy difference from .diff import PolicyDifference @@ -95,10 +96,10 @@ index 0aaf13f..5b1ea20 100644 from ..logtosignal import LogHandlerToSignal from .analysistab import AnalysisTab diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index 1ae16de..fdf8f7b 100644 +index b272a99..7b05945 100644 --- a/setoolsgui/apol/infoflow.py +++ b/setoolsgui/apol/infoflow.py -@@ -25,7 +25,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread +@@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ QTreeWidgetItem @@ -108,33 +109,31 @@ index 1ae16de..fdf8f7b 100644 from ..logtosignal import LogHandlerToSignal diff --git a/tests/dta.py b/tests/dta.py -index 32b9271..2bdd052 100644 +index be04ae4..de4f337 100644 --- a/tests/dta.py +++ b/tests/dta.py -@@ -17,7 +17,8 @@ - # +@@ -18,7 +18,7 @@ + import os import unittest --from setools import SELinuxPolicy, DomainTransitionAnalysis -+from setools import SELinuxPolicy +-from setools import DomainTransitionAnalysis +from setools.dta import DomainTransitionAnalysis from setools import TERuletype as TERT from setools.policyrep.exception import InvalidType - from setools.policyrep.typeattr import Type + from setools.policyrep.libpolicyrep import Type diff --git a/tests/infoflow.py b/tests/infoflow.py -index 7751dda..a21c683 100644 +index 87bb1b0..dc1e7b9 100644 --- a/tests/infoflow.py +++ b/tests/infoflow.py -@@ -17,7 +17,8 @@ - # +@@ -18,7 +18,7 @@ + import os import unittest --from setools import SELinuxPolicy, InfoFlowAnalysis -+from setools import SELinuxPolicy +-from setools import InfoFlowAnalysis +from setools.infoflow import InfoFlowAnalysis from setools import TERuletype as TERT from setools.permmap import PermissionMap from setools.policyrep.exception import InvalidType -- -2.9.3 +2.14.3 diff --git a/setools.spec b/setools.spec index 4e27b70..26c6646 100644 --- a/setools.spec +++ b/setools.spec @@ -1,28 +1,21 @@ -# sitelib for noarch packages, sitearch for others (remove the unneeded one) -%{!?__python2: %global __python2 %__python} -%{!?python2_sitelib: %global python2_sitelib %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} -%{!?python2_sitearch: %global python2_sitearch %(%{__python2} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} - -# % global setools_pre_ver beta.1.8e09d95 +%global setools_pre_ver beta # % global gitver f1e5b20 %global sepol_ver 2.7-1 %global selinux_ver 2.7-1 Name: setools -Version: 4.1.1 -Release: 11%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.2.0 +Release: 0.1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 -URL: https://github.com/TresysTechnology/setools/wiki -Source0: https://github.com/TresysTechnology/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz +URL: https://github.com/SELinuxProject/setools/wiki +Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop Patch1: 0001-Do-not-use-Werror-during-build.patch Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch -Patch3: 0003-bswap_-macros-are-defined-in-byteswap.h.patch -Patch4: 0004-Add-support-for-SCTP-protocol.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -30,10 +23,10 @@ BuildRequires: glibc-devel, gcc, git BuildRequires: libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver} BuildRequires: qt5-qtbase-devel BuildRequires: swig -BuildRequires: python2-devel -BuildRequires: python2-setuptools +BuildRequires: python3-Cython BuildRequires: python3-devel BuildRequires: python3-setuptools +BuildRequires: libselinux-devel # BuildArch: Requires: python3-%{name} = %{version}-%{release} @@ -76,25 +69,10 @@ This package includes the following console tools: seinfoflow Perform information flow analyses. -%package -n python2-setools -Summary: Policy analysis tools for SELinux -Recommends: python2-libselinux -%{?python_provide:%python_provide python2-setools} -# Remove before F30 -Provides: %{name}-python = %{version}-%{release} -Provides: %{name}-python%{?_isa} = %{version}-%{release} -Obsoletes: %{name}-python < %{version}-%{release} -Requires: python2-enum34 - -%description -n python2-setools -SETools is a collection of graphical tools, command-line tools, and -Python 2 modules designed to facilitate SELinux policy analysis. - %package -n python3-setools Summary: Policy analysis tools for SELinux Obsoletes: setools-libs < 4.0.0 Recommends: libselinux-python3 -%{?python_provide:%python_provide python2-setools} # Remove before F30 Provides: %{name}-python3 = %{version}-%{release} Provides: %{name}-python3%{?_isa} = %{version}-%{release} @@ -116,37 +94,22 @@ Python modules designed to facilitate SELinux policy analysis. %prep -%autosetup -p 1 -S git - -cp -a ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 +%autosetup -p 1 -S git -n setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}} %build # Remove CFLAGS=... for noarch packages (unneeded) CFLAGS="%{optflags}" %{__python3} setup.py build -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -# Remove CFLAGS=... for noarch packages (unneeded) -CFLAGS="%{optflags}" %{__python2} setup.py build -popd - %install rm -rf %{buildroot} -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -%{__python2} setup.py install --root %{buildroot} -popd - rm -rf %{buildroot}%{_bindir} %{__python3} setup.py install --root %{buildroot} %check %if %{?_with_check:1}%{!?_with_check:0} %{__python3} setup.py test - -pushd ../setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}-python2 -%{__python2} setup.py test -popd %endif @@ -166,10 +129,6 @@ popd %{_mandir}/man1/sedta* %{_mandir}/man1/seinfoflow* -%files -n python2-setools -%license COPYING COPYING.GPL COPYING.LGPL -%{python2_sitearch}/* - %files -n python3-setools %license COPYING COPYING.GPL COPYING.LGPL %{python3_sitearch}/setools @@ -181,6 +140,10 @@ popd %{_mandir}/man1/apol* %changelog +* Thu Aug 09 2018 Vit Mojzis - 4.2.0-0.1.beta +- New upstream release +- Drop python2 subpackage (4.2.0 no longer supports python2) + * Sat Jul 14 2018 Fedora Release Engineering - 4.1.1-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild diff --git a/sources b/sources index 7fde505..3e706c1 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (4.1.1.tar.gz) = 2e55a3b07e2f94d7c84054f31d266567b9acc708fe2b0e16ac3ea24e8301c712bcf564ff915a6135a1a6ba6822682bb3a6530dae20161a832fb7048364acbd04 +SHA512 (4.2.0-beta.tar.gz) = 97d27d16d0aa0c6346e42eb0948114c52e1d25f29a33827c3f4663311e134bd4195eb54b38e4b5fe99b3f6a28a7aa2c90043ebab16c1e0407f4663133cc815b8 From bb7caed6f5a4d6dd57562dc7b908e53239e6bdca Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 19 Sep 2018 10:39:26 +0200 Subject: [PATCH 2/9] setools-4.2.0-0.2.beta - Require userspace release 2.8 - setools-gui requires python3-setools - Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) --- setools.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index 26c6646..e2746c4 100644 --- a/setools.spec +++ b/setools.spec @@ -1,12 +1,12 @@ %global setools_pre_ver beta # % global gitver f1e5b20 -%global sepol_ver 2.7-1 -%global selinux_ver 2.7-1 +%global sepol_ver 2.8-1 +%global selinux_ver 2.8-1 Name: setools Version: 4.2.0 -Release: 0.1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 0.2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -77,6 +77,7 @@ Recommends: libselinux-python3 Provides: %{name}-python3 = %{version}-%{release} Provides: %{name}-python3%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python3 < %{version}-%{release} +Requires: python3-setuptools %description -n python3-setools SETools is a collection of graphical tools, command-line tools, and @@ -85,6 +86,7 @@ Python 3 modules designed to facilitate SELinux policy analysis. %package gui Summary: Policy analysis graphical tools for SELinux +Requires: python3-setools = %{version}-%{release} Requires: python3-qt5 Requires: python3-networkx @@ -140,6 +142,11 @@ rm -rf %{buildroot}%{_bindir} %{_mandir}/man1/apol* %changelog +* Wed Sep 19 2018 Vit Mojzis - 4.2.0-0.2.beta +- Require userspace release 2.8 +- setools-gui requires python3-setools +- Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371) + * Thu Aug 09 2018 Vit Mojzis - 4.2.0-0.1.beta - New upstream release - Drop python2 subpackage (4.2.0 no longer supports python2) From 56e46874bdb5490387ba9b173314d0f2389bc46d Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 25 Sep 2018 18:12:41 +0200 Subject: [PATCH 3/9] Remove old tar from sources --- .gitignore | 1 + sources | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 255e868..fa4c2bc 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ setools-3.3.8.tar.bz2 setools-3.3.8-f1e5b20.tar.bz2 /4.1.0.tar.gz /4.1.1.tar.gz +/4.2.0-beta.tar.gz diff --git a/sources b/sources index 3e706c1..e4abbd6 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (4.1.1.tar.gz) = 2e55a3b07e2f94d7c84054f31d266567b9acc708fe2b0e16ac3ea24e8301c712bcf564ff915a6135a1a6ba6822682bb3a6530dae20161a832fb7048364acbd04 SHA512 (4.2.0-beta.tar.gz) = 97d27d16d0aa0c6346e42eb0948114c52e1d25f29a33827c3f4663311e134bd4195eb54b38e4b5fe99b3f6a28a7aa2c90043ebab16c1e0407f4663133cc815b8 From c6b3f2cce158d1c4f96adb598c5e8481a4f84d89 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 1 Oct 2018 12:11:16 +0200 Subject: [PATCH 4/9] setools-4.2.0-0.3.rc - Changes since v4.2.0-beta: -- Fixed performance regressions -- Made further memory usage improvements -- Fixed build issues with clean target and runtime_library_dirs -- Revised package structure to make policyrep a module of the setools package -- Symbol names are now available as the name attribute (e.g. Boolean.name, Type.name, etc.) -- Fixed some apol layouts to increase the size of text fields -- Move constraint expression to its own class -- Made Conditional.evaluate() more useful and added BaseTERule.enabled() method to determine if a rule is enabled - Rebase patches --- .gitignore | 1 + 0001-Do-not-use-Werror-during-build.patch | 12 ++--- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 49 ++++++++++--------- setools.spec | 7 ++- sources | 2 +- 5 files changed, 38 insertions(+), 33 deletions(-) diff --git a/.gitignore b/.gitignore index fa4c2bc..cdc5f37 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.1.0.tar.gz /4.1.1.tar.gz /4.2.0-beta.tar.gz +/4.2.0-rc.tar.gz diff --git a/0001-Do-not-use-Werror-during-build.patch b/0001-Do-not-use-Werror-during-build.patch index f6430fe..9864f5f 100644 --- a/0001-Do-not-use-Werror-during-build.patch +++ b/0001-Do-not-use-Werror-during-build.patch @@ -1,6 +1,6 @@ -From 42e691b12c03aac388e39071f4b8d76cbc40e5c5 Mon Sep 17 00:00:00 2001 +From 8ef1a20824c2055cc16b66b56018a95e30b9a73c Mon Sep 17 00:00:00 2001 From: Vit Mojzis -Date: Fri, 29 Jun 2018 10:34:14 +0200 +Date: Mon, 1 Oct 2018 15:50:09 +0200 Subject: [PATCH 1/2] Do not use -Werror during build There are new warnings when setools are built with gcc 7 therefore we @@ -10,12 +10,12 @@ want to suppress -Werror for now 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index aa4f14b..e4da575 100644 +index 0530d59..027d315 100644 --- a/setup.py +++ b/setup.py -@@ -62,7 +62,7 @@ ext_py_mods = [Extension('setools.policyrep.libpolicyrep', ['setools/policyrep/l +@@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], + libraries=['selinux', 'sepol'], library_dirs=lib_dirs, - runtime_library_dirs=lib_dirs, define_macros=macros, - extra_compile_args=['-Werror', '-Wextra', + extra_compile_args=['-Wextra', @@ -23,5 +23,5 @@ index aa4f14b..e4da575 100644 '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.14.3 +2.17.1 diff --git a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index c1479e6..364ce4d 100644 --- a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,6 +1,6 @@ -From 39a28c23990f667ef1dc50c3fe6d0ca79a7e793d Mon Sep 17 00:00:00 2001 +From 7a38c92583b5b6d6b14b43ba9b8c56d4e04b0b82 Mon Sep 17 00:00:00 2001 From: Vit Mojzis -Date: Fri, 29 Jun 2018 10:31:18 +0200 +Date: Mon, 1 Oct 2018 17:16:28 +0200 Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis @@ -13,16 +13,16 @@ setools.dta.DomainTransitionAnalysis and let the package containing sedta and seinfoflow to require python3-networkx --- sedta | 4 ++-- - seinfoflow | 3 ++- + seinfoflow | 4 ++-- setools/__init__.py | 4 ++-- setoolsgui/apol/dta.py | 2 +- setoolsgui/apol/infoflow.py | 2 +- tests/dta.py | 2 +- tests/infoflow.py | 2 +- - 7 files changed, 10 insertions(+), 9 deletions(-) + 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/sedta b/sedta -index 84820b0..8c380ab 100755 +index 10cf43a..b75b4e1 100755 --- a/sedta +++ b/sedta @@ -21,7 +21,7 @@ import sys @@ -34,7 +34,7 @@ index 84820b0..8c380ab 100755 def print_transition(trans): -@@ -110,7 +110,7 @@ else: +@@ -111,7 +111,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) @@ -44,18 +44,19 @@ index 84820b0..8c380ab 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index 3ec05ca..89764fe 100755 +index 3ec05ca..32a9a3e 100755 --- a/seinfoflow +++ b/seinfoflow -@@ -18,6 +18,7 @@ +@@ -17,7 +17,7 @@ + # along with SETools. If not, see . # - import setools +-import setools +import setools.infoflow import argparse import sys import logging -@@ -78,7 +79,7 @@ else: +@@ -78,7 +78,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) @@ -65,51 +66,51 @@ index 3ec05ca..89764fe 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index a84c846..cbb2a00 100644 +index 7b70f5e..020be31 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -74,11 +74,11 @@ from .pcideviceconquery import PcideviceconQuery +@@ -73,11 +73,11 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis -from .infoflow import InfoFlowAnalysis -+#from .infoflow import InfoFlowAnalysis ++# from .infoflow import InfoFlowAnalysis from .permmap import PermissionMap # Domain Transition Analysis -from .dta import DomainTransitionAnalysis -+#from .dta import DomainTransitionAnalysis ++# from .dta import DomainTransitionAnalysis # Policy difference from .diff import PolicyDifference diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py -index 0aaf13f..5b1ea20 100644 +index 4608b9d..2cde44c 100644 --- a/setoolsgui/apol/dta.py +++ b/setoolsgui/apol/dta.py @@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem + QTreeWidgetItem -from setools import DomainTransitionAnalysis +from setools.dta import DomainTransitionAnalysis from ..logtosignal import LogHandlerToSignal from .analysistab import AnalysisTab diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py -index b272a99..7b05945 100644 +index 7bca299..7fee277 100644 --- a/setoolsgui/apol/infoflow.py +++ b/setoolsgui/apol/infoflow.py @@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread from PyQt5.QtGui import QPalette, QTextCursor from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \ - QTreeWidgetItem + QTreeWidgetItem -from setools import InfoFlowAnalysis +from setools.infoflow import InfoFlowAnalysis from setools.exception import UnmappedClass, UnmappedPermission from ..logtosignal import LogHandlerToSignal diff --git a/tests/dta.py b/tests/dta.py -index be04ae4..de4f337 100644 +index a0cc938..177e6fb 100644 --- a/tests/dta.py +++ b/tests/dta.py @@ -18,7 +18,7 @@ @@ -119,10 +120,10 @@ index be04ae4..de4f337 100644 -from setools import DomainTransitionAnalysis +from setools.dta import DomainTransitionAnalysis from setools import TERuletype as TERT - from setools.policyrep.exception import InvalidType - from setools.policyrep.libpolicyrep import Type + from setools.exception import InvalidType + from setools.policyrep import Type diff --git a/tests/infoflow.py b/tests/infoflow.py -index 87bb1b0..dc1e7b9 100644 +index aa0e44a..fca2848 100644 --- a/tests/infoflow.py +++ b/tests/infoflow.py @@ -18,7 +18,7 @@ @@ -132,8 +133,8 @@ index 87bb1b0..dc1e7b9 100644 -from setools import InfoFlowAnalysis +from setools.infoflow import InfoFlowAnalysis from setools import TERuletype as TERT + from setools.exception import InvalidType from setools.permmap import PermissionMap - from setools.policyrep.exception import InvalidType -- -2.14.3 +2.17.1 diff --git a/setools.spec b/setools.spec index e2746c4..62dbd6d 100644 --- a/setools.spec +++ b/setools.spec @@ -1,4 +1,4 @@ -%global setools_pre_ver beta +%global setools_pre_ver rc # % global gitver f1e5b20 %global sepol_ver 2.8-1 @@ -6,7 +6,7 @@ Name: setools Version: 4.2.0 -Release: 0.2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 0.3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -142,6 +142,9 @@ rm -rf %{buildroot}%{_bindir} %{_mandir}/man1/apol* %changelog +* Mon Oct 01 2018 Vit Mojzis - 4.2.0-0.3.rc +- Update upstream source to 4.2.0-rc + * Wed Sep 19 2018 Vit Mojzis - 4.2.0-0.2.beta - Require userspace release 2.8 - setools-gui requires python3-setools diff --git a/sources b/sources index e4abbd6..698097f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.2.0-beta.tar.gz) = 97d27d16d0aa0c6346e42eb0948114c52e1d25f29a33827c3f4663311e134bd4195eb54b38e4b5fe99b3f6a28a7aa2c90043ebab16c1e0407f4663133cc815b8 +SHA512 (4.2.0-rc.tar.gz) = 0bd0921d945b96b6126a0e7bbb9497881a12784fea54573c0a87655979f25c14406406bede55ccbcfce54c256f55a764c11424167dced8aa76b0d3892aaec20f From 522fb13c602a5b687691f7230fe6c430ec534817 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 14 Nov 2018 17:12:12 +0100 Subject: [PATCH 5/9] setools-4.2.0-1 - Changes since 4.2.0-rc -- Restored missing statement() methods in some policyrep classes -- Fixed NULL pointer dereference when iterating over type attributes when the policy has none -- Added xdp_socket permission mapping --- .gitignore | 1 + ...ap_-macros-are-defined-in-byteswap.h.patch | 26 ---- 0004-Add-support-for-SCTP-protocol.patch | 131 ------------------ ... 1001-Do-not-use-Werror-during-build.patch | 0 ...e-setools.InfoFlowAnalysis-and-setoo.patch | 0 setools.spec | 13 +- sources | 2 +- 7 files changed, 9 insertions(+), 164 deletions(-) delete mode 100644 0003-bswap_-macros-are-defined-in-byteswap.h.patch delete mode 100644 0004-Add-support-for-SCTP-protocol.patch rename 0001-Do-not-use-Werror-during-build.patch => 1001-Do-not-use-Werror-during-build.patch (100%) rename 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch => 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch (100%) diff --git a/.gitignore b/.gitignore index cdc5f37..d309c49 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.1.1.tar.gz /4.2.0-beta.tar.gz /4.2.0-rc.tar.gz +/4.2.0.tar.gz diff --git a/0003-bswap_-macros-are-defined-in-byteswap.h.patch b/0003-bswap_-macros-are-defined-in-byteswap.h.patch deleted file mode 100644 index f5445a9..0000000 --- a/0003-bswap_-macros-are-defined-in-byteswap.h.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 2ac588919dd96d3d624e6ec20c67d1d91386e879 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 10 Aug 2017 08:23:47 +0200 -Subject: [PATCH] bswap_* macros are defined in byteswap.h - -Fixes ImportError on s390x: -/usr/lib64/python3.6/site-packages/setools/policyrep/_qpol.cpython-36m-s390x-linux-gnu.so: undefined symbol: bswap_32 ---- - libqpol/policy.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libqpol/policy.c b/libqpol/policy.c -index ae3acb5..e412be0 100644 ---- a/libqpol/policy.c -+++ b/libqpol/policy.c -@@ -28,6 +28,7 @@ - - #include "qpol_internal.h" - #include -+#include - #include - #include - #include --- -2.13.3 - diff --git a/0004-Add-support-for-SCTP-protocol.patch b/0004-Add-support-for-SCTP-protocol.patch deleted file mode 100644 index 4223a46..0000000 --- a/0004-Add-support-for-SCTP-protocol.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 3ef6369a22691e8e11cbf63f37b114941b3577a1 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 16 Apr 2018 20:46:20 +0200 -Subject: [PATCH] Add support for SCTP protocol - -Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1568333 - -Signed-off-by: Vit Mojzis ---- - libqpol/include/qpol/linux_types.h | 1 + - libqpol/policy_define.c | 5 +++++ - setools/perm_map | 30 ++++++++++++++++++++++++++++++ - setools/policyrep/netcontext.py | 5 +++++ - 4 files changed, 41 insertions(+) - -diff --git a/libqpol/include/qpol/linux_types.h b/libqpol/include/qpol/linux_types.h -index c3c056b..0985162 100644 ---- a/libqpol/include/qpol/linux_types.h -+++ b/libqpol/include/qpol/linux_types.h -@@ -12,6 +12,7 @@ typedef uint16_t __u16; - #define s6_addr32 __u6_addr32 - - #define IPPROTO_DCCP 33 -+#define IPPROTO_SCTP 132 - #endif - - #endif -diff --git a/libqpol/policy_define.c b/libqpol/policy_define.c -index dcc69fc..1e623a3 100644 ---- a/libqpol/policy_define.c -+++ b/libqpol/policy_define.c -@@ -44,6 +44,9 @@ - #ifndef IPPROTO_DCCP - #define IPPROTO_DCCP 33 - #endif -+#ifndef IPPROTO_SCTP -+#define IPPROTO_SCTP 132 -+#endif - #include - #include - #include -@@ -4933,6 +4936,8 @@ int define_port_context(unsigned int low, unsigned int high) - protocol = IPPROTO_UDP; - } else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) { - protocol = IPPROTO_DCCP; -+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) { -+ protocol = IPPROTO_SCTP; - } else { - yyerror2("unrecognized protocol %s", id); - goto bad; -diff --git a/setools/perm_map b/setools/perm_map -index 0a9f91c..25fae09 100644 ---- a/setools/perm_map -+++ b/setools/perm_map -@@ -385,6 +385,8 @@ class node 11 - udp_send w 10 - dccp_recv r 10 - dccp_send w 10 -+ sctp_recv r 10 -+ sctp_send w 10 - enforce_dest n 1 - sendto w 10 - recvfrom r 10 -@@ -699,6 +701,32 @@ class dccp_socket 24 - relabelto w 10 - listen r 1 - -+class sctp_socket 24 -+ node_bind n 1 -+ name_connect w 10 -+ append w 10 -+ bind w 1 -+ connect w 1 -+ create w 1 -+ write w 10 -+ relabelfrom r 10 -+ ioctl n 1 -+ name_bind n 1 -+ sendto w 10 -+ recv_msg r 10 -+ send_msg w 10 -+ getattr r 7 -+ setattr w 7 -+ accept r 1 -+ getopt r 1 -+ read r 10 -+ setopt w 1 -+ shutdown w 1 -+ recvfrom r 10 -+ lock n 1 -+ relabelto w 10 -+ listen r 1 -+ - class netlink_firewall_socket 24 - nlmsg_write w 10 - nlmsg_read r 10 -@@ -984,6 +1012,8 @@ class netif 10 - udp_send w 10 - dccp_recv r 10 - dccp_send w 10 -+ sctp_recv r 10 -+ sctp_send w 10 - - class packet_socket 22 - append w 10 -diff --git a/setools/policyrep/netcontext.py b/setools/policyrep/netcontext.py -index c7076d2..2d890f3 100644 ---- a/setools/policyrep/netcontext.py -+++ b/setools/policyrep/netcontext.py -@@ -38,6 +38,10 @@ try: - IPPROTO_DCCP = getprotobyname("dccp") - except socket.error: - IPPROTO_DCCP = 33 -+try: -+ IPPROTO_SCTP = getprotobyname("sctp") -+except socket.error: -+ IPPROTO_SCTP = 132 - - - def netifcon_factory(policy, name): -@@ -196,6 +200,7 @@ class PortconProtocol(int, PolicyEnum): - tcp = IPPROTO_TCP - udp = IPPROTO_UDP - dccp = IPPROTO_DCCP -+ sctp = IPPROTO_SCTP - - - class Portcon(NetContext): --- -2.14.3 - diff --git a/0001-Do-not-use-Werror-during-build.patch b/1001-Do-not-use-Werror-during-build.patch similarity index 100% rename from 0001-Do-not-use-Werror-during-build.patch rename to 1001-Do-not-use-Werror-during-build.patch diff --git a/0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch similarity index 100% rename from 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch rename to 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch diff --git a/setools.spec b/setools.spec index 62dbd6d..17bf9a3 100644 --- a/setools.spec +++ b/setools.spec @@ -1,4 +1,4 @@ -%global setools_pre_ver rc +# % global setools_pre_ver rc # % global gitver f1e5b20 %global sepol_ver 2.8-1 @@ -6,7 +6,7 @@ Name: setools Version: 4.2.0 -Release: 0.3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -14,8 +14,8 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch1: 0001-Do-not-use-Werror-during-build.patch -Patch2: 0002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +Patch1001: 1001-Do-not-use-Werror-during-build.patch +Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch Obsoletes: setools < 4.0.0, setools-devel < 4.0.0 BuildRequires: flex, bison @@ -105,8 +105,6 @@ CFLAGS="%{optflags}" %{__python3} setup.py build %install -rm -rf %{buildroot} -rm -rf %{buildroot}%{_bindir} %{__python3} setup.py install --root %{buildroot} %check @@ -142,6 +140,9 @@ rm -rf %{buildroot}%{_bindir} %{_mandir}/man1/apol* %changelog +* Wed Nov 14 2018 Vit Mojzis - 4.2.0-1 +- Update source to SETools 4.2.0 release + * Mon Oct 01 2018 Vit Mojzis - 4.2.0-0.3.rc - Update upstream source to 4.2.0-rc diff --git a/sources b/sources index 698097f..7f09bef 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.2.0-rc.tar.gz) = 0bd0921d945b96b6126a0e7bbb9497881a12784fea54573c0a87655979f25c14406406bede55ccbcfce54c256f55a764c11424167dced8aa76b0d3892aaec20f +SHA512 (4.2.0.tar.gz) = b51f458f7f2d1b569f63478f53709268615f711104915cc2d5031b2049435e4f43a103ebe50c9797ebe4b2645bf1974c73c2f53e7f602ae03c47221edb89d680 From d0560d2da269ff0ef687fb26e0ee539d7d1ff598 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 7 May 2019 16:27:17 +0200 Subject: [PATCH 6/9] SETools 4.2.1 release --- .gitignore | 1 + 1001-Do-not-use-Werror-during-build.patch | 32 ++++++++++++++--- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 36 +++++++++---------- setools.spec | 10 ++++-- sources | 2 +- 5 files changed, 54 insertions(+), 27 deletions(-) diff --git a/.gitignore b/.gitignore index d309c49..acfdf60 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.2.0-beta.tar.gz /4.2.0-rc.tar.gz /4.2.0.tar.gz +/4.2.1.tar.gz diff --git a/1001-Do-not-use-Werror-during-build.patch b/1001-Do-not-use-Werror-during-build.patch index 9864f5f..9efb440 100644 --- a/1001-Do-not-use-Werror-during-build.patch +++ b/1001-Do-not-use-Werror-during-build.patch @@ -1,16 +1,38 @@ -From 8ef1a20824c2055cc16b66b56018a95e30b9a73c Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 1 Oct 2018 15:50:09 +0200 +From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 23 Feb 2017 08:17:07 +0100 Subject: [PATCH 1/2] Do not use -Werror during build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit There are new warnings when setools are built with gcc 7 therefore we want to suppress -Werror for now + +Fixes: +libqpol/policy_extend.c: In function ‘policy_extend’: +libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=] + snprintf(buff, 9, "@ttr%04zd", i + 1); + ^~~~~ +libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295] + snprintf(buff, 9, "@ttr%04zd", i + 1); + ^~~~~~~~~~~ +In file included from /usr/include/stdio.h:939:0, + from /usr/include/sepol/policydb/policydb.h:53, + from libqpol/policy_extend.c:29: +/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9 + return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + __bos (__s), __fmt, __va_arg_pack ()); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +error: command 'gcc' failed with exit status 1 --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 0530d59..027d315 100644 +index 2ca44c9..9319bf6 100644 --- a/setup.py +++ b/setup.py @@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], @@ -23,5 +45,5 @@ index 0530d59..027d315 100644 '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.17.1 +2.9.3 diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 364ce4d..81e9a49 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From 7a38c92583b5b6d6b14b43ba9b8c56d4e04b0b82 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 1 Oct 2018 17:16:28 +0200 -Subject: [PATCH 2/2] Do not export/use setools.InfoFlowAnalysis and +From 2ac3a2236e827087097c63478be302ddc627a42b Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 26 Mar 2019 12:06:57 +0100 +Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -14,27 +14,27 @@ sedta and seinfoflow to require python3-networkx --- sedta | 4 ++-- seinfoflow | 4 ++-- - setools/__init__.py | 4 ++-- + setools/__init__.py | 4 ---- setoolsgui/apol/dta.py | 2 +- setoolsgui/apol/infoflow.py | 2 +- tests/dta.py | 2 +- tests/infoflow.py | 2 +- - 7 files changed, 10 insertions(+), 10 deletions(-) + 7 files changed, 8 insertions(+), 12 deletions(-) diff --git a/sedta b/sedta -index 10cf43a..b75b4e1 100755 +index 60861ca..41e38a2 100755 --- a/sedta +++ b/sedta -@@ -21,7 +21,7 @@ import sys - import argparse +@@ -22,7 +22,7 @@ import argparse import logging + import signal -import setools +import setools.dta def print_transition(trans): -@@ -111,7 +111,7 @@ else: +@@ -114,7 +114,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) @@ -44,7 +44,7 @@ index 10cf43a..b75b4e1 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/seinfoflow b/seinfoflow -index 3ec05ca..32a9a3e 100755 +index 97b14ba..e7f965d 100755 --- a/seinfoflow +++ b/seinfoflow @@ -17,7 +17,7 @@ @@ -56,7 +56,7 @@ index 3ec05ca..32a9a3e 100755 import argparse import sys import logging -@@ -78,7 +78,7 @@ else: +@@ -81,7 +81,7 @@ else: try: p = setools.SELinuxPolicy(args.policy) m = setools.PermissionMap(args.map) @@ -66,10 +66,10 @@ index 3ec05ca..32a9a3e 100755 if args.shortest_path or args.all_paths: if args.shortest_path: diff --git a/setools/__init__.py b/setools/__init__.py -index 7b70f5e..020be31 100644 +index 7b70f5e..5a5f7fe 100644 --- a/setools/__init__.py +++ b/setools/__init__.py -@@ -73,11 +73,11 @@ from .pcideviceconquery import PcideviceconQuery +@@ -73,12 +73,8 @@ from .pcideviceconquery import PcideviceconQuery from .devicetreeconquery import DevicetreeconQuery # Information Flow Analysis @@ -77,12 +77,12 @@ index 7b70f5e..020be31 100644 +# from .infoflow import InfoFlowAnalysis from .permmap import PermissionMap - # Domain Transition Analysis +-# Domain Transition Analysis -from .dta import DomainTransitionAnalysis -+# from .dta import DomainTransitionAnalysis - +- # Policy difference from .diff import PolicyDifference + diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py index 4608b9d..2cde44c 100644 --- a/setoolsgui/apol/dta.py @@ -136,5 +136,5 @@ index aa0e44a..fca2848 100644 from setools.exception import InvalidType from setools.permmap import PermissionMap -- -2.17.1 +2.21.0 diff --git a/setools.spec b/setools.spec index 17bf9a3..23803a0 100644 --- a/setools.spec +++ b/setools.spec @@ -1,11 +1,12 @@ # % global setools_pre_ver rc # % global gitver f1e5b20 -%global sepol_ver 2.8-1 -%global selinux_ver 2.8-1 +%global sepol_ver 2.9-1 +%global selinux_ver 2.9-1 + Name: setools -Version: 4.2.0 +Version: 4.2.1 Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux @@ -140,6 +141,9 @@ CFLAGS="%{optflags}" %{__python3} setup.py build %{_mandir}/man1/apol* %changelog +* Tue Mar 26 2019 Petr Lautrbach - 4.2.1-1 +- - SETools 4.2.1 release + * Wed Nov 14 2018 Vit Mojzis - 4.2.0-1 - Update source to SETools 4.2.0 release diff --git a/sources b/sources index 7f09bef..1116a04 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (4.2.0.tar.gz) = b51f458f7f2d1b569f63478f53709268615f711104915cc2d5031b2049435e4f43a103ebe50c9797ebe4b2645bf1974c73c2f53e7f602ae03c47221edb89d680 +SHA512 (4.2.1.tar.gz) = 7d00295fe7ff16e96e15266807f8e0a67cc2978f9051cd85afb9ee71ca7fad16ccf7421a4a163bb793950bc20a44f3cbb8409b4e0642d0f96cf7a3df7bc59c31 From 46caac3298c8287eb18852ea76f7fcdc3c57a945 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 7 May 2019 16:47:26 +0200 Subject: [PATCH 7/9] setools-4.2.1-2 - SELinuxPolicy: Create a map of aliases on policy load Resolves performance issues. --- ...eate-a-map-of-aliases-on-policy-load.patch | 479 ++++++++++++++++++ 1001-Do-not-use-Werror-during-build.patch | 8 +- ...e-setools.InfoFlowAnalysis-and-setoo.patch | 11 +- setools.spec | 8 +- 4 files changed, 494 insertions(+), 12 deletions(-) create mode 100644 0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch diff --git a/0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch b/0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch new file mode 100644 index 0000000..04b6272 --- /dev/null +++ b/0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch @@ -0,0 +1,479 @@ +From 2fad2d1b1df43ea0d85e25e2ebad88ad02997d7c Mon Sep 17 00:00:00 2001 +From: Chris PeBenito +Date: Mon, 29 Apr 2019 07:57:16 -0400 +Subject: [PATCH 1/3] SELinuxPolicy: Create a map of aliases on policy load. + +Addresses a performance regression after the alias fixes in #17. + +Closes #20 +--- + setools/policyrep/mls.pxi | 138 +--------------------------- + setools/policyrep/selinuxpolicy.pxi | 107 +++++++++++++++++---- + setools/policyrep/typeattr.pxi | 70 +------------- + 3 files changed, 95 insertions(+), 220 deletions(-) + +diff --git a/setools/policyrep/mls.pxi b/setools/policyrep/mls.pxi +index c40d032..30464b7 100644 +--- a/setools/policyrep/mls.pxi ++++ b/setools/policyrep/mls.pxi +@@ -1,5 +1,5 @@ + # Copyright 2014-2016, Tresys Technology, LLC +-# Copyright 2017-2018, Chris PeBenito ++# Copyright 2017-2019, Chris PeBenito + # + # This file is part of SETools. + # +@@ -65,6 +65,7 @@ cdef class Category(PolicySymbol): + c.key = symbol + c.name = policy.category_value_to_name(symbol.s.value - 1) + c._value = symbol.s.value ++ c._aliases = policy.category_alias_map[symbol.s.value] + _cat_cache[policy][symbol] = c + return c + +@@ -75,14 +76,8 @@ cdef class Category(PolicySymbol): + # Comparison based on their index instead of their names. + return self._value < other._value + +- cdef inline void _load_aliases(self): +- """Helper method to load aliases.""" +- if self._aliases is None: +- self._aliases = list(self.policy.category_aliases(self)) +- + def aliases(self): + """Generator that yields all aliases for this category.""" +- self._load_aliases() + return iter(self._aliases) + + def statement(self): +@@ -90,7 +85,6 @@ cdef class Category(PolicySymbol): + str stmt + size_t count + +- self._load_aliases() + count = len(self._aliases) + + stmt = "category {0}".format(self.name) +@@ -127,6 +121,7 @@ cdef class Sensitivity(PolicySymbol): + s.key = symbol + s.name = policy.level_value_to_name(symbol.level.sens - 1) + s._value = symbol.level.sens ++ s._aliases = policy.sensitivity_alias_map[symbol.level.sens] + return s + + def __hash__(self): +@@ -144,14 +139,8 @@ cdef class Sensitivity(PolicySymbol): + def __lt__(self, other): + return self._value < other._value + +- cdef inline void _load_aliases(self): +- """Helper method to load aliases.""" +- if self._aliases is None: +- self._aliases = list(self.policy.sensitivity_aliases(self)) +- + def aliases(self): + """Generator that yields all aliases for this sensitivity.""" +- self._load_aliases() + return iter(self._aliases) + + def level_decl(self): +@@ -167,7 +156,6 @@ cdef class Sensitivity(PolicySymbol): + str stmt + size_t count + +- self._load_aliases() + count = len(self._aliases) + + stmt = "sensitivity {0}".format(self.name) +@@ -540,66 +528,6 @@ cdef class CategoryHashtabIterator(HashtabIterator): + datum = self.node.datum if self.node else NULL + + +-cdef class CategoryAliasHashtabIterator(HashtabIterator): +- +- """Iterate over category aliases in the policy.""" +- +- cdef uint32_t primary +- +- @staticmethod +- cdef factory(SELinuxPolicy policy, sepol.hashtab_t *table, Category primary): +- """Factory function for creating category alias iterators.""" +- i = CategoryAliasHashtabIterator() +- i.policy = policy +- i.table = table +- i.primary = primary._value +- i.reset() +- return i +- +- def __next__(self): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- while datum != NULL and (not datum.isalias or datum.s.value != self.primary): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- return intern(self.curr.key) +- +- def __len__(self): +- cdef sepol.cat_datum_t *datum +- cdef sepol.hashtab_node_t *node +- cdef uint32_t bucket = 0 +- cdef size_t count = 0 +- +- while bucket < self.table[0].size: +- node = self.table[0].htable[bucket] +- while node != NULL: +- datum = node.datum if node else NULL +- if datum != NULL and self.primary == datum.s.value and datum.isalias: +- count += 1 +- +- node = node.next +- +- bucket += 1 +- +- return count +- +- def reset(self): +- super().reset() +- +- cdef sepol.cat_datum_t *datum = self.node.datum if self.node else NULL +- +- # advance over any attributes or aliases +- while datum != NULL and (not datum.isalias and self.primary != datum.s.value): +- self._next_node() +- +- if self.node == NULL or self.bucket >= self.table[0].size: +- break +- +- datum = self.node.datum if self.node else NULL +- +- + cdef class SensitivityHashtabIterator(HashtabIterator): + + """Iterate over sensitivity in the policy.""" +@@ -657,66 +585,6 @@ cdef class SensitivityHashtabIterator(HashtabIterator): + datum = self.node.datum if self.node else NULL + + +-cdef class SensitivityAliasHashtabIterator(HashtabIterator): +- +- """Iterate over sensitivity aliases in the policy.""" +- +- cdef uint32_t primary +- +- @staticmethod +- cdef factory(SELinuxPolicy policy, sepol.hashtab_t *table, Sensitivity primary): +- """Factory function for creating Sensitivity alias iterators.""" +- i = SensitivityAliasHashtabIterator() +- i.policy = policy +- i.table = table +- i.primary = primary._value +- i.reset() +- return i +- +- def __next__(self): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- while datum != NULL and (not datum.isalias or datum.level.sens != self.primary): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- return intern(self.curr.key) +- +- def __len__(self): +- cdef sepol.level_datum_t *datum +- cdef sepol.hashtab_node_t *node +- cdef uint32_t bucket = 0 +- cdef size_t count = 0 +- +- while bucket < self.table[0].size: +- node = self.table[0].htable[bucket] +- while node != NULL: +- datum = node.datum if node else NULL +- if datum != NULL and self.primary == datum.level.sens and datum.isalias: +- count += 1 +- +- node = node.next +- +- bucket += 1 +- +- return count +- +- def reset(self): +- super().reset() +- +- cdef sepol.level_datum_t *datum = self.node.datum if self.node else NULL +- +- # advance over any attributes or aliases +- while datum != NULL and (not datum.isalias and self.primary != datum.level.sens): +- self._next_node() +- +- if self.node == NULL or self.bucket >= self.table[0].size: +- break +- +- datum = self.node.datum if self.node else NULL +- +- + cdef class LevelDeclHashtabIterator(HashtabIterator): + + """Iterate over level declarations in the policy.""" +diff --git a/setools/policyrep/selinuxpolicy.pxi b/setools/policyrep/selinuxpolicy.pxi +index 1a3eb5c..1541549 100644 +--- a/setools/policyrep/selinuxpolicy.pxi ++++ b/setools/policyrep/selinuxpolicy.pxi +@@ -46,6 +46,9 @@ cdef class SELinuxPolicy: + object log + object constraint_counts + object terule_counts ++ dict type_alias_map ++ dict category_alias_map ++ dict sensitivity_alias_map + object __weakref__ + + # Public attributes: +@@ -598,12 +601,6 @@ cdef class SELinuxPolicy: + """Return the category datum for the specified category value.""" + return self.cat_val_to_struct[value] + +- cdef inline category_aliases(self, Category primary): +- """Return an interator for the aliases for the specified category.""" +- return CategoryAliasHashtabIterator.factory(self, +- &self.handle.p.symtab[sepol.SYM_CATS].table, +- primary) +- + cdef inline str category_value_to_name(self, size_t value): + """Return the name of the category by its value.""" + return intern(self.handle.p.sym_val_to_name[sepol.SYM_CATS][value]) +@@ -636,17 +633,6 @@ cdef class SELinuxPolicy: + """Return the name of the role by its value.""" + return intern(self.handle.p.sym_val_to_name[sepol.SYM_ROLES][value]) + +- cdef inline sensitivity_aliases(self, Sensitivity primary): +- """Return an interator for the aliases for the specified sensitivity.""" +- return SensitivityAliasHashtabIterator.factory(self, +- &self.handle.p.symtab[sepol.SYM_LEVELS].table, primary) +- +- cdef inline type_aliases(self, Type primary): +- """Return an iterator for the aliases for the specified type.""" +- return TypeAliasHashtabIterator.factory(self, +- &self.handle.p.symtab[sepol.SYM_TYPES].table, +- primary) +- + cdef inline sepol.type_datum_t* type_value_to_datum(self, size_t value): + """Return the type datum for the specified type value.""" + return self.handle.p.type_val_to_struct[value] +@@ -725,6 +711,15 @@ cdef class SELinuxPolicy: + if self.mls: + self._create_mls_val_to_struct() + ++ # ++ # Create value to alias mappings ++ # ++ self._load_type_aliases() ++ ++ if self.mls: ++ self._load_sensitivity_aliases() ++ self._load_category_aliases() ++ + self.log.info("Successfully opened SELinux policy \"{0}\"".format(filename)) + self.path = filename + +@@ -846,6 +841,84 @@ cdef class SELinuxPolicy: + + bucket += 1 + ++ cdef _load_category_aliases(self): ++ """Build map of aliases to categories""" ++ cdef: ++ sepol.hashtab_t *table = &self.handle.p.symtab[sepol.SYM_CATS].table ++ sepol.cat_datum_t *datum ++ sepol.hashtab_node_t *node ++ uint32_t bucket = 0 ++ list entry ++ ++ self.category_alias_map = dict() ++ ++ while bucket < table[0].size: ++ node = table[0].htable[bucket] ++ while node != NULL: ++ datum = node.datum if node else NULL ++ if datum == NULL: ++ continue ++ ++ entry = self.category_alias_map.setdefault(datum.s.value, list()) ++ if datum.isalias: ++ entry.append(intern(node.key)) ++ ++ node = node.next ++ ++ bucket += 1 ++ ++ cdef _load_sensitivity_aliases(self): ++ """Build map of aliases to sensitivities""" ++ cdef: ++ sepol.hashtab_t *table = &self.handle.p.symtab[sepol.SYM_LEVELS].table ++ sepol.level_datum_t *datum ++ sepol.hashtab_node_t *node ++ uint32_t bucket = 0 ++ list entry ++ ++ self.sensitivity_alias_map = dict() ++ ++ while bucket < table[0].size: ++ node = table[0].htable[bucket] ++ while node != NULL: ++ datum = node.datum if node else NULL ++ if datum == NULL: ++ continue ++ ++ entry = self.sensitivity_alias_map.setdefault(datum.level.sens, list()) ++ if datum.isalias: ++ entry.append(intern(node.key)) ++ ++ node = node.next ++ ++ bucket += 1 ++ ++ cdef _load_type_aliases(self): ++ """Build map of aliases to types""" ++ cdef: ++ sepol.hashtab_t *table = &self.handle.p.symtab[sepol.SYM_TYPES].table ++ sepol.type_datum_t *datum ++ sepol.hashtab_node_t *node ++ uint32_t bucket = 0 ++ list entry ++ ++ self.type_alias_map = dict() ++ ++ while bucket < table[0].size: ++ node = table[0].htable[bucket] ++ while node != NULL: ++ datum = node.datum if node else NULL ++ if datum == NULL: ++ continue ++ ++ entry = self.type_alias_map.setdefault(datum.s.value, list()) ++ if type_is_alias(datum): ++ entry.append(intern(node.key)) ++ ++ node = node.next ++ ++ bucket += 1 ++ + cdef _rebuild_attrs_from_map(self): + """ + Rebuilds data for the attributes and inserts them into the policydb. +diff --git a/setools/policyrep/typeattr.pxi b/setools/policyrep/typeattr.pxi +index d989ca9..1d8901e 100644 +--- a/setools/policyrep/typeattr.pxi ++++ b/setools/policyrep/typeattr.pxi +@@ -1,5 +1,5 @@ + # Copyright 2014, Tresys Technology, LLC +-# Copyright 2017-2018, Chris PeBenito ++# Copyright 2017-2019, Chris PeBenito + # + # This file is part of SETools. + # +@@ -86,13 +86,9 @@ cdef class Type(BaseType): + t.value = symbol.s.value + t.name = policy.type_value_to_name(symbol.s.value - 1) + t.ispermissive = symbol.flags & sepol.TYPE_FLAGS_PERMISSIVE ++ t._aliases = policy.type_alias_map[symbol.s.value] + return t + +- cdef inline void _load_aliases(self): +- """Helper method to load aliases.""" +- if self._aliases is None: +- self._aliases = list(self.policy.type_aliases(self)) +- + cdef inline void _load_attributes(self): + """Helper method to load attributes.""" + cdef sepol.type_datum_t *symbol = self.key +@@ -110,7 +106,6 @@ cdef class Type(BaseType): + + def aliases(self): + """Generator that yields all aliases for this type.""" +- self._load_aliases() + return iter(self._aliases) + + def statement(self): +@@ -119,7 +114,6 @@ cdef class Type(BaseType): + str stmt + + self._load_attributes() +- self._load_aliases() + count = len(self._aliases) + + stmt = "type {0}".format(self.name) +@@ -297,66 +291,6 @@ cdef class TypeAttributeHashtabIterator(HashtabIterator): + self._next_node() + + +-cdef class TypeAliasHashtabIterator(HashtabIterator): +- +- """Iterate over type aliases in the policy.""" +- +- cdef uint32_t primary +- +- @staticmethod +- cdef factory(SELinuxPolicy policy, sepol.hashtab_t *table, Type primary): +- """Factory function for creating type alias iterators.""" +- i = TypeAliasHashtabIterator() +- i.policy = policy +- i.table = table +- i.primary = primary.value +- i.reset() +- return i +- +- def __next__(self): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- while datum != NULL and (not type_is_alias(datum) or datum.s.value != self.primary): +- super().__next__() +- datum = self.curr.datum if self.curr else NULL +- +- return intern(self.curr.key) +- +- def __len__(self): +- cdef sepol.type_datum_t *datum +- cdef sepol.hashtab_node_t *node +- cdef uint32_t bucket = 0 +- cdef size_t count = 0 +- +- while bucket < self.table[0].size: +- node = self.table[0].htable[bucket] +- while node != NULL: +- datum = node.datum if node else NULL +- if datum != NULL and self.primary == datum.s.value and type_is_alias(datum): +- count += 1 +- +- node = node.next +- +- bucket += 1 +- +- return count +- +- def reset(self): +- super().reset() +- +- cdef sepol.type_datum_t *datum = self.node.datum if self.node else NULL +- +- # advance over any attributes or aliases +- while datum != NULL and (not type_is_alias(datum) and self.primary != datum.s.value): +- self._next_node() +- +- if self.node == NULL or self.bucket >= self.table[0].size: +- break +- +- datum = self.node.datum if self.node else NULL +- +- + # + # Ebitmap Iterator Classes + # +-- +2.17.2 + diff --git a/1001-Do-not-use-Werror-during-build.patch b/1001-Do-not-use-Werror-during-build.patch index 9efb440..60f11e2 100644 --- a/1001-Do-not-use-Werror-during-build.patch +++ b/1001-Do-not-use-Werror-during-build.patch @@ -1,7 +1,7 @@ -From 617c3ae83c1c72ead627a57e1529724c62df807f Mon Sep 17 00:00:00 2001 +From 4b3dc6b38abbd32cda557d5ef9ea1383ac5fdcf2 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Thu, 23 Feb 2017 08:17:07 +0100 -Subject: [PATCH 1/2] Do not use -Werror during build +Subject: [PATCH 2/3] Do not use -Werror during build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -32,7 +32,7 @@ error: command 'gcc' failed with exit status 1 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 2ca44c9..9319bf6 100644 +index c94daf1..a7442ac 100644 --- a/setup.py +++ b/setup.py @@ -105,7 +105,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'], @@ -45,5 +45,5 @@ index 2ca44c9..9319bf6 100644 '-Wfloat-equal', '-Wformat', '-Wformat=2', -- -2.9.3 +2.17.2 diff --git a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch index 81e9a49..3057072 100644 --- a/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch +++ b/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -1,7 +1,7 @@ -From 2ac3a2236e827087097c63478be302ddc627a42b Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 26 Mar 2019 12:06:57 +0100 -Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and +From b960869bcbcb58f2ce9af598484f209935c096b0 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 26 Apr 2019 15:27:25 +0200 +Subject: [PATCH 3/3] Do not export/use setools.InfoFlowAnalysis and setools.DomainTransitionAnalysis dta and infoflow modules require networkx which brings lot of dependencies. @@ -74,7 +74,6 @@ index 7b70f5e..5a5f7fe 100644 # Information Flow Analysis -from .infoflow import InfoFlowAnalysis -+# from .infoflow import InfoFlowAnalysis from .permmap import PermissionMap -# Domain Transition Analysis @@ -136,5 +135,5 @@ index aa0e44a..fca2848 100644 from setools.exception import InvalidType from setools.permmap import PermissionMap -- -2.21.0 +2.17.2 diff --git a/setools.spec b/setools.spec index 23803a0..260a10d 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.1 -Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -15,6 +15,7 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop +Patch0001: 0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -141,8 +142,11 @@ CFLAGS="%{optflags}" %{__python3} setup.py build %{_mandir}/man1/apol* %changelog +* Mon May 06 2019 Vit Mojzis - 4.2.1-2} +- SELinuxPolicy: Create a map of aliases on policy load (#1672631) + * Tue Mar 26 2019 Petr Lautrbach - 4.2.1-1 -- - SETools 4.2.1 release +- SETools 4.2.1 release (#1581761, #1595582) * Wed Nov 14 2018 Vit Mojzis - 4.2.0-1 - Update source to SETools 4.2.0 release From f24e68278005481c2806a19f6f14ab73a81840f4 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 13 May 2019 12:40:05 +0200 Subject: [PATCH 8/9] Use %set_build_flags instead of %optflags Fixes: RPMDiff Detecting usr/lib64/python3.6/site-packages/setools/policyrep.cpython-36m-[arch]-linux-gnu.so with not-hardened warnings: Hardened: policyrep.cpython-36m-[arch]-linux-gnu.so: FAIL: The binary was compiled without -fstack-clash-protection. Hardened: policyrep.cpython-36m-[arch]-linux-gnu.so: FAIL: The binary was compiled without -fstack-protector-strong. --- setools.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/setools.spec b/setools.spec index 260a10d..dd21d18 100644 --- a/setools.spec +++ b/setools.spec @@ -7,7 +7,7 @@ Name: setools Version: 4.2.1 -Release: 2%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -103,7 +103,8 @@ Python modules designed to facilitate SELinux policy analysis. %build # Remove CFLAGS=... for noarch packages (unneeded) -CFLAGS="%{optflags}" %{__python3} setup.py build +%set_build_flags +%{__python3} setup.py build %install @@ -142,7 +143,10 @@ CFLAGS="%{optflags}" %{__python3} setup.py build %{_mandir}/man1/apol* %changelog -* Mon May 06 2019 Vit Mojzis - 4.2.1-2} +* Mon May 13 2019 Vit Mojzis - 4.2.1-3 +- Use %set_build_flags instead of %optflags + +* Mon May 06 2019 Vit Mojzis - 4.2.1-2 - SELinuxPolicy: Create a map of aliases on policy load (#1672631) * Tue Mar 26 2019 Petr Lautrbach - 4.2.1-1 From d32d57d01b33b7e5a35dca4e9942dc429871af59 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 8 Jul 2019 14:43:35 +0200 Subject: [PATCH 9/9] SETools 4.2.2 release Changes since 4.2.1: - Remove source policy references from man pages, as loading source policies is no longer supported. - Fix a performance regression in alias loading after alias dereferencing fixes in 4.2.1 --- .gitignore | 1 + setools.spec | 8 +++++--- sources | 1 + 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index acfdf60..3053379 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ setools-3.3.8-f1e5b20.tar.bz2 /4.2.0-rc.tar.gz /4.2.0.tar.gz /4.2.1.tar.gz +/4.2.2.tar.gz diff --git a/setools.spec b/setools.spec index dd21d18..3cc93b1 100644 --- a/setools.spec +++ b/setools.spec @@ -6,8 +6,8 @@ Name: setools -Version: 4.2.1 -Release: 3%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} +Version: 4.2.2 +Release: 1%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist} Summary: Policy analysis tools for SELinux License: GPLv2 @@ -15,7 +15,6 @@ URL: https://github.com/SELinuxProject/setools/wiki Source0: https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz Source1: setools.pam Source2: apol.desktop -Patch0001: 0001-SELinuxPolicy-Create-a-map-of-aliases-on-policy-load.patch Patch1001: 1001-Do-not-use-Werror-during-build.patch Patch1002: 1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch @@ -143,6 +142,9 @@ Python modules designed to facilitate SELinux policy analysis. %{_mandir}/man1/apol* %changelog +* Mon Jul 08 2019 Vit Mojzis - 4.2.2-1} +- SETools 4.2.2 release + * Mon May 13 2019 Vit Mojzis - 4.2.1-3 - Use %set_build_flags instead of %optflags diff --git a/sources b/sources index 1116a04..31914ec 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (4.2.1.tar.gz) = 7d00295fe7ff16e96e15266807f8e0a67cc2978f9051cd85afb9ee71ca7fad16ccf7421a4a163bb793950bc20a44f3cbb8409b4e0642d0f96cf7a3df7bc59c31 +SHA512 (4.2.2.tar.gz) = 5044b04d0895ffe31557b3b71bb277ab49710a6066485c8f204ce7858abab259f973000f1fcfde0149ed4e33a50103984939dcc68ce322d70e9e927e81d4f798