diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index e0500d1..a58a8e6 100644 --- a/.gitignore +++ b/.gitignore @@ -123,4 +123,3 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.3.11.tar.gz /setroubleshoot-plugins-3.3.12.tar.gz /setroubleshoot-plugins-3.3.14.tar.gz -/setroubleshoot-plugins-3.3.15.tar.gz diff --git a/0001-Split-multi-command-fix_cmds-into-lists.patch b/0001-Split-multi-command-fix_cmds-into-lists.patch deleted file mode 100644 index 476333d..0000000 --- a/0001-Split-multi-command-fix_cmds-into-lists.patch +++ /dev/null @@ -1,73 +0,0 @@ -From df90bf242b35a9e01f721dd7ad436f1bd5d21616 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 9 Mar 2026 22:03:31 +0100 -Subject: [PATCH] Split multi-command fix_cmds into lists - -This requires -https://gitlab.com/setroubleshoot/setroubleshoot/-/merge_requests/54/diffs?commit_id=d5d13afa86c2bd03952c04a187657ed981c9be7e -to work properly! ---- - src/allow_execmod.py | 3 ++- - src/automount_exec_config.py | 3 ++- - src/cvs_data.py | 3 ++- - src/file.py | 2 +- - 4 files changed, 7 insertions(+), 4 deletions(-) - -diff --git a/src/allow_execmod.py b/src/allow_execmod.py -index 6e1f6bf..0a3995f 100644 ---- a/src/allow_execmod.py -+++ b/src/allow_execmod.py -@@ -81,7 +81,8 @@ If you want this to survive a relabel, execute - # semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';restorecon -v '$FIX_TARGET_PATH' - """ - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - def init_args(self, args): - if len(args) > 0: -diff --git a/src/automount_exec_config.py b/src/automount_exec_config.py -index a64eaf2..81ada8e 100644 ---- a/src/automount_exec_config.py -+++ b/src/automount_exec_config.py -@@ -40,7 +40,8 @@ class plugin(Plugin): - If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH". If you want this to survive a relabel, you need to permanently change the file context: execute "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'". - ''') - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - if_text = 'If you want to allow automounter to execute $TARGET_PATH' - -diff --git a/src/cvs_data.py b/src/cvs_data.py -index 7451622..1e75ead 100644 ---- a/src/cvs_data.py -+++ b/src/cvs_data.py -@@ -46,7 +46,8 @@ class plugin(Plugin): - do_text = """# semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH' - # restorecon -v '$FIX_TARGET_PATH'""" - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - def __init__(self): - Plugin.__init__(self, __name__) -diff --git a/src/file.py b/src/file.py -index ac24bf9..25f3a43 100644 ---- a/src/file.py -+++ b/src/file.py -@@ -66,7 +66,7 @@ home directory from a previous installation that did not use SELinux, 'restoreco - if args == (1,0): - return '/sbin/restorecon -R -v $TARGET_PATH' - else: -- return 'touch /.autorelabel; reboot' -+ return ['touch /.autorelabel', 'reboot'] - - def init_args(self, args): - if args == (1,0): --- -2.53.0 - diff --git a/0001-restorecon.py-exclude-more-paths.patch b/0001-restorecon.py-exclude-more-paths.patch new file mode 100644 index 0000000..2189d21 --- /dev/null +++ b/0001-restorecon.py-exclude-more-paths.patch @@ -0,0 +1,26 @@ +From 0f508191647a41f92264c0c8fc877b0110bbd468 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 10 Aug 2021 20:11:20 +0200 +Subject: [PATCH] restorecon.py: exclude more paths + +It doesn't make sense to run restorecon on /sys/ /proc/ and /memfd: +--- + src/restorecon.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/restorecon.py b/src/restorecon.py +index e3044c742367..9594c0d59d96 100644 +--- a/src/restorecon.py ++++ b/src/restorecon.py +@@ -39,7 +39,7 @@ def customizable(target): + + + # List of path prefixes for which this plugin is not executed +-excluded_paths = ["/sys/fs"] ++excluded_paths = ["/sys/", "/proc/", "/memfd:"] + # Test if the specified path starts with some excluded prefix + def excluded_path(target_path): + for path in excluded_paths: +-- +2.32.0 + diff --git a/0002-catchall-Discourage-creating-custom-policy-modules.patch b/0002-catchall-Discourage-creating-custom-policy-modules.patch deleted file mode 100644 index a3f28a1..0000000 --- a/0002-catchall-Discourage-creating-custom-policy-modules.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 8ad7f4c5528fbbc52a3d391c702102c6fe262d83 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 9 Jun 2026 17:27:36 +0200 -Subject: [PATCH] catchall: Discourage creating custom policy modules - -Update the plugin text to discourage creating custom policy modules by -explaining the lack of support and potential security implications. ---- - src/catchall.py | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/src/catchall.py b/src/catchall.py -index 052d6d8..7e4a8fa 100644 ---- a/src/catchall.py -+++ b/src/catchall.py -@@ -54,9 +54,14 @@ class plugin(Plugin): - return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.') - return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.') - -- then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.') -- do_text = _("""Allow this access for now by executing: --# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME -+ then_text = _(''' -+ You should report this as a bug.\n -+ If you are certain this access is legitimate and not an intrusion attempt, you -+ can generate a local policy module to allow it. -+ Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities. -+ ''') -+ -+ do_text = _("""# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME - # semodule -X 300 -i my-$MODULE_NAME.pp""") - - def __init__(self): --- -2.53.0 - diff --git a/plans/tests.fmf b/plans/tests.fmf deleted file mode 100644 index 5d615ae..0000000 --- a/plans/tests.fmf +++ /dev/null @@ -1,8 +0,0 @@ -summary: basic setroubleshoot-plugins test plan -discover: - how: fmf - url: https://gitlab.com/setroubleshoot/tests.git - filter: "component:setroubleshoot-plugins & tier: 1" -execute: - how: tmt - diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index 9bda6f3..08fe4b7 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -5,15 +5,14 @@ Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.3.15 -Release: 8%{?dist} -License: GPL-2.0-or-later -URL: https://gitlab.com/setroubleshoot/plugins -Source0: https://gitlab.com/-/project/24478430/uploads/1d856bff1c9fb16a8c6fc877d7fe91ca/setroubleshoot-plugins-3.3.15.tar.gz -# git format-patch -N setroubleshoot-plugins- -# for j in 00*patch; do printf "Patch: %s\n" $j; done -Patch: 0001-Split-multi-command-fix_cmds-into-lists.patch -Patch: 0002-catchall-Discourage-creating-custom-policy-modules.patch +Version: 3.3.14 +Release: 2%{?dist} +License: GPLv2+ +URL: https://github.com/fedora-selinux/setroubleshoot +Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz +# git format-patch -N setroubleshoot-plugins- -- plugins +# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done +Patch0001: 0001-restorecon.py-exclude-more-paths.patch BuildArch: noarch # gcc is needed only for ./configure @@ -22,8 +21,8 @@ BuildRequires: gcc BuildRequires: make BuildRequires: perl-XML-Parser BuildRequires: intltool gettext python3-devel -# Support for multiple commands in fix_cmd -Conflicts: setroubleshoot-server < 3.3.37 +# Introduction of get_package_nvr functions +Requires: setroubleshoot-server >= 3.3.23 %description This package provides a set of analysis plugins for use with @@ -51,62 +50,9 @@ rm -rf %{buildroot} %{_datadir}/setroubleshoot/plugins %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 3.3.15-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Thu May 07 2026 Vit Mojzis - 3.3.15-7 -- Split multi-command fix_cmds into lists -- catchall: Discourage creating custom policy modules - -* Sat Jan 17 2026 Fedora Release Engineering - 3.3.15-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Sep 19 2025 Python Maint - 3.3.15-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.3.15-4 -- Rebuilt for Python 3.14.0rc2 bytecode - -* Fri Jul 25 2025 Fedora Release Engineering - 3.3.15-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Sun Jan 19 2025 Fedora Release Engineering - 3.3.15-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Mon Jan 06 2025 Petr Lautrbach - 3.3.15-1 -- restorecon.py: exclude more paths -- Improve disable_ipv6 plugin then_text -- Update generated configuration files -- Update translations - -* Sat Jul 20 2024 Fedora Release Engineering - 3.3.14-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 3.3.14-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Jul 26 2023 Petr Lautrbach - 3.3.14-8 -- Update generated configuration files (rhbz#2226425) -- Improve disable_ipv6 plugin then_text - -* Sat Jul 22 2023 Fedora Release Engineering - 3.3.14-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sat Jan 21 2023 Fedora Release Engineering - 3.3.14-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 3.3.14-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Fedora Release Engineering - 3.3.14-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-3 +* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-2 - restorecon.py: exclude more paths (#1960136) -* Fri Jul 23 2021 Fedora Release Engineering - 3.3.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - * Mon Mar 29 2021 Vit Mojzis - 3.3.14-1 - Update translations diff --git a/sources b/sources index aeb5a6c..28a0bb9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-plugins-3.3.15.tar.gz) = 9741ecd48a7e0cde376ac0f818d94dad32c74acd2afc01ec6f5e3cf74ff9075d4f3406f1a3905cbbdd3833c8c2ef4213deaaf00d0012dbea582eb2b825618d5f +SHA512 (setroubleshoot-plugins-3.3.14.tar.gz) = da6882a998aeade67891a722a5b94e2ba1072d9db5d73031854a2c0b51083a0eaf9519dd7987938a86c1f8d263d08882642ac447d7b4bbcd8a859db4b44d61c1 diff --git a/tests/Regression/use-of-aliases-in-plugins/runtest.sh b/tests/Regression/use-of-aliases-in-plugins/runtest.sh new file mode 100755 index 0000000..5720f99 --- /dev/null +++ b/tests/Regression/use-of-aliases-in-plugins/runtest.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setroubleshoot-plugins/Regression/use-of-aliases-in-plugins +# Description: Make sure all types used in setroubleshoot plugins are +# defined in the policy and are not aliases +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setroubleshoot-plugins" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "selinuxenabled" 0 + rlPhaseEnd + + rlPhaseStartTest "bz#1794807 - look for aliases and undefined types in plugins" + # lists all types not defined in the policy as "type_t not found" + # and all aliases as "alias_t is an alias of type_t" + # all issues are prefixed with a list of offending plugins + # returns 1 if an issue was found + rlRun "./test_aliases.py" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/tests/Regression/use-of-aliases-in-plugins/test_aliases.py b/tests/Regression/use-of-aliases-in-plugins/test_aliases.py new file mode 100755 index 0000000..fec114e --- /dev/null +++ b/tests/Regression/use-of-aliases-in-plugins/test_aliases.py @@ -0,0 +1,65 @@ +#!/usr/bin/python3 + +# lists all types not defined in the policy as "type_t not found" +# and all aliases as "alias_t is an alias of type_t" +# all issues are prefixed with a list of offending plugins +# returns 1 if an issue was found + +import subprocess +import sepolicy +import sys +import re +from collections import defaultdict + +plugin_path = "/usr/share/setroubleshoot/plugins" +error_code = 0 + +if len(sys.argv) > 1: + plugin_path = sys.argv[1] + +try: + # search all plugin files in given location for the following pattern + # :_t + g = subprocess.check_output('grep -I [^A-Za-z_][A-Za-z][A-Za-z_]*_t[^A-Za-z_] -o {}/*.py'.format(plugin_path), + universal_newlines=True, shell=True) + lines = g.split('\n') +except: + exit(1) +# matches 2 groups: file name and type name +# ():(_t) +reg = re.compile('.*/(.+):[^A-Za-z_]([A-Za-z_]*_t)[^A-Za-z_]') +# generate a dictionary of of all type names used in setroubleshoot plugins +# where types are keys and lists of files where each type appeared are data +found = defaultdict(set) + +for l in lines: + m = reg.match(l) + + if m is None: + continue + + try: + t = m.group(2) + if "_TYPE_" in t: + continue + found[t].add(m.group(1)) + except: + # failed to match + continue + +for t in sorted(found.keys()): + try: + # try to find each type in system policy + i = next(sepolicy.info(sepolicy.TYPE, t))['name'] + if t != i: + # : alias_t is an alias of type_t + print("{}: {} is an alias of {}".format(", ".join(found[t]), t, i)) + error_code = 1 + except: + # skip types defined in selinux-policy modules that are not shipped any more + if t not in ["vbetool_t"]: + # : type_t not found + print("{}: {} not found".format(", ".join(found[t]), t)) + error_code = 1 + +exit(error_code) diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..cc1af99 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,11 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - Regression/use-of-aliases-in-plugins + required_packages: + - setroubleshoot-plugins + - selinux-policy-targeted + - python3-policycoreutils