From c0bc314b1d419d9f0a62e88cee3a6010b8cf38ad Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 21 Nov 2019 11:09:45 +0100 Subject: [PATCH 1/4] setroubleshoot-plugins-3.3.11-1 - Add plugin which analyzes execmem denials - Add missing "If " strings - Update qemu_blk_image and qemu_file_image - Update "xen_image" plugin - Update "file" plugin - Update "missing" scripts to automake-1.15 --- .gitignore | 1 + setroubleshoot-plugins.spec | 12 ++++++++++-- sources | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 073aeaa..e794404 100644 --- a/.gitignore +++ b/.gitignore @@ -120,3 +120,4 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.3.8.tar.gz /setroubleshoot-plugins-3.3.9.tar.gz /setroubleshoot-plugins-3.3.10.tar.gz +/setroubleshoot-plugins-3.3.11.tar.gz diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index 82843b3..ddebe24 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -5,8 +5,8 @@ Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.3.10 -Release: 3%{?dist} +Version: 3.3.11 +Release: 1%{?dist} License: GPLv2+ URL: https://github.com/fedora-selinux/setroubleshoot Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz @@ -45,6 +45,14 @@ make DESTDIR=%{buildroot} PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} install %{_datadir}/setroubleshoot/plugins %changelog +* Thu Nov 21 2019 Vit Mojzis - 3.3.11-1 +- Add plugin which analyzes execmem denials +- Add missing "If " strings +- Update qemu_blk_image and qemu_file_image +- Update "xen_image" plugin +- Update "file" plugin +- Update "missing" scripts to automake-1.15 + * Fri Jul 26 2019 Fedora Release Engineering - 3.3.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 9d8e3c4..de60320 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-plugins-3.3.10.tar.gz) = 169ca9b26fa21cc4e4fb68b23b1d05d238b72e52888376cff7f78e1e3e13ef31b78f53f4fa6a25296f1caa5cc9f0b5b163fc1edbd59584f708468ba8abfd90d1 +SHA512 (setroubleshoot-plugins-3.3.11.tar.gz) = deacd53d25de259ca6f63f007c2ecfbb7e491991aea0acdd2904e0a8c58daea54dd10f98593f83aeb91d159e4150b10f0ecc3103679b8aa97b0e280418a249b6 From b35c53418da439999d99209b3e49cba5a69ccf23 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 10 Mar 2020 09:35:05 +0100 Subject: [PATCH 2/4] tests: Add use-of-aliases-in-plugins --- .../use-of-aliases-in-plugins/runtest.sh | 50 ++++++++++++++ .../use-of-aliases-in-plugins/test_aliases.py | 65 +++++++++++++++++++ tests/tests.yml | 11 ++++ 3 files changed, 126 insertions(+) create mode 100755 tests/Regression/use-of-aliases-in-plugins/runtest.sh create mode 100755 tests/Regression/use-of-aliases-in-plugins/test_aliases.py create mode 100644 tests/tests.yml diff --git a/tests/Regression/use-of-aliases-in-plugins/runtest.sh b/tests/Regression/use-of-aliases-in-plugins/runtest.sh new file mode 100755 index 0000000..5720f99 --- /dev/null +++ b/tests/Regression/use-of-aliases-in-plugins/runtest.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setroubleshoot-plugins/Regression/use-of-aliases-in-plugins +# Description: Make sure all types used in setroubleshoot plugins are +# defined in the policy and are not aliases +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setroubleshoot-plugins" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "selinuxenabled" 0 + rlPhaseEnd + + rlPhaseStartTest "bz#1794807 - look for aliases and undefined types in plugins" + # lists all types not defined in the policy as "type_t not found" + # and all aliases as "alias_t is an alias of type_t" + # all issues are prefixed with a list of offending plugins + # returns 1 if an issue was found + rlRun "./test_aliases.py" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/tests/Regression/use-of-aliases-in-plugins/test_aliases.py b/tests/Regression/use-of-aliases-in-plugins/test_aliases.py new file mode 100755 index 0000000..fec114e --- /dev/null +++ b/tests/Regression/use-of-aliases-in-plugins/test_aliases.py @@ -0,0 +1,65 @@ +#!/usr/bin/python3 + +# lists all types not defined in the policy as "type_t not found" +# and all aliases as "alias_t is an alias of type_t" +# all issues are prefixed with a list of offending plugins +# returns 1 if an issue was found + +import subprocess +import sepolicy +import sys +import re +from collections import defaultdict + +plugin_path = "/usr/share/setroubleshoot/plugins" +error_code = 0 + +if len(sys.argv) > 1: + plugin_path = sys.argv[1] + +try: + # search all plugin files in given location for the following pattern + # :_t + g = subprocess.check_output('grep -I [^A-Za-z_][A-Za-z][A-Za-z_]*_t[^A-Za-z_] -o {}/*.py'.format(plugin_path), + universal_newlines=True, shell=True) + lines = g.split('\n') +except: + exit(1) +# matches 2 groups: file name and type name +# ():(_t) +reg = re.compile('.*/(.+):[^A-Za-z_]([A-Za-z_]*_t)[^A-Za-z_]') +# generate a dictionary of of all type names used in setroubleshoot plugins +# where types are keys and lists of files where each type appeared are data +found = defaultdict(set) + +for l in lines: + m = reg.match(l) + + if m is None: + continue + + try: + t = m.group(2) + if "_TYPE_" in t: + continue + found[t].add(m.group(1)) + except: + # failed to match + continue + +for t in sorted(found.keys()): + try: + # try to find each type in system policy + i = next(sepolicy.info(sepolicy.TYPE, t))['name'] + if t != i: + # : alias_t is an alias of type_t + print("{}: {} is an alias of {}".format(", ".join(found[t]), t, i)) + error_code = 1 + except: + # skip types defined in selinux-policy modules that are not shipped any more + if t not in ["vbetool_t"]: + # : type_t not found + print("{}: {} not found".format(", ".join(found[t]), t)) + error_code = 1 + +exit(error_code) diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..cc1af99 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,11 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - Regression/use-of-aliases-in-plugins + required_packages: + - setroubleshoot-plugins + - selinux-policy-targeted + - python3-policycoreutils From ed1a4cc0d50c0ec1f04f07eb893dcc9727bc2c76 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 16 Mar 2020 17:24:51 +0100 Subject: [PATCH 3/4] Fix last changelog entry date Fixes: error: %changelog not in descending chronological order --- setroubleshoot-plugins.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index ddebe24..2cdb615 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -45,7 +45,7 @@ make DESTDIR=%{buildroot} PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} install %{_datadir}/setroubleshoot/plugins %changelog -* Thu Nov 21 2019 Vit Mojzis - 3.3.11-1 +* Thu Jan 30 2020 Vit Mojzis - 3.3.11-1 - Add plugin which analyzes execmem denials - Add missing "If " strings - Update qemu_blk_image and qemu_file_image From 7501fe3c96133c88dfdeab246355329af248aff2 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 16 Mar 2020 17:07:09 +0100 Subject: [PATCH 4/4] setroubleshoot-plugins-3.3.12-1 - Use get_package_nvr* functions instead of get_rpm_nvr* - Update deprecated type references - Update translations --- .gitignore | 1 + setroubleshoot-plugins.spec | 12 ++++++++++-- sources | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index e794404..11c7f78 100644 --- a/.gitignore +++ b/.gitignore @@ -121,3 +121,4 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.3.9.tar.gz /setroubleshoot-plugins-3.3.10.tar.gz /setroubleshoot-plugins-3.3.11.tar.gz +/setroubleshoot-plugins-3.3.12.tar.gz diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index 2cdb615..8cece3e 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -5,11 +5,13 @@ Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.3.11 +Version: 3.3.12 Release: 1%{?dist} License: GPLv2+ URL: https://github.com/fedora-selinux/setroubleshoot Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz +# git format-patch -N setroubleshoot-plugins- -- plugins +# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done BuildArch: noarch # gcc is needed only for ./configure @@ -17,7 +19,8 @@ BuildArch: noarch BuildRequires: gcc BuildRequires: perl-XML-Parser BuildRequires: intltool gettext python3-devel -Requires: setroubleshoot-server >= 3.3.19 +# Introduction of get_package_nvr functions +Requires: setroubleshoot-server >= 3.3.23 %description This package provides a set of analysis plugins for use with @@ -45,6 +48,11 @@ make DESTDIR=%{buildroot} PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} install %{_datadir}/setroubleshoot/plugins %changelog +* Tue Apr 21 2020 Vit Mojzis - 3.3.12-1 +- Use get_package_nvr* functions instead of get_rpm_nvr* +- Update deprecated type references +- Update translations + * Thu Jan 30 2020 Vit Mojzis - 3.3.11-1 - Add plugin which analyzes execmem denials - Add missing "If " strings diff --git a/sources b/sources index de60320..fbe69de 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-plugins-3.3.11.tar.gz) = deacd53d25de259ca6f63f007c2ecfbb7e491991aea0acdd2904e0a8c58daea54dd10f98593f83aeb91d159e4150b10f0ecc3103679b8aa97b0e280418a249b6 +SHA512 (setroubleshoot-plugins-3.3.12.tar.gz) = aec345a93aa7cfaea8468c72639dacb89dfc4fa9f1d2ed2e121f5ca20dfd37399877364d95cd8dd548cefcaee4ea818ae4465035a60b6ba18493eb548ef4c87e