diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index e0500d1..85eaeca 100644 --- a/.gitignore +++ b/.gitignore @@ -109,18 +109,3 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.0.58.tar.gz /setroubleshoot-plugins-3.0.59.tar.gz /setroubleshoot-plugins-3.0.60.tar.gz -/setroubleshoot-plugins-3.0.61.tar.gz -/setroubleshoot-plugins-3.3.1.tar.gz -/setroubleshoot-plugins-3.3.2.tar.gz -/setroubleshoot-plugins-3.3.3.tar.gz -/setroubleshoot-plugins-3.3.4.tar.gz -/setroubleshoot-plugins-3.3.5.1.tar.gz -/setroubleshoot-plugins-3.3.6.tar.gz -/setroubleshoot-plugins-3.3.7.tar.gz -/setroubleshoot-plugins-3.3.8.tar.gz -/setroubleshoot-plugins-3.3.9.tar.gz -/setroubleshoot-plugins-3.3.10.tar.gz -/setroubleshoot-plugins-3.3.11.tar.gz -/setroubleshoot-plugins-3.3.12.tar.gz -/setroubleshoot-plugins-3.3.14.tar.gz -/setroubleshoot-plugins-3.3.15.tar.gz diff --git a/0001-Split-multi-command-fix_cmds-into-lists.patch b/0001-Split-multi-command-fix_cmds-into-lists.patch deleted file mode 100644 index 476333d..0000000 --- a/0001-Split-multi-command-fix_cmds-into-lists.patch +++ /dev/null @@ -1,73 +0,0 @@ -From df90bf242b35a9e01f721dd7ad436f1bd5d21616 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 9 Mar 2026 22:03:31 +0100 -Subject: [PATCH] Split multi-command fix_cmds into lists - -This requires -https://gitlab.com/setroubleshoot/setroubleshoot/-/merge_requests/54/diffs?commit_id=d5d13afa86c2bd03952c04a187657ed981c9be7e -to work properly! ---- - src/allow_execmod.py | 3 ++- - src/automount_exec_config.py | 3 ++- - src/cvs_data.py | 3 ++- - src/file.py | 2 +- - 4 files changed, 7 insertions(+), 4 deletions(-) - -diff --git a/src/allow_execmod.py b/src/allow_execmod.py -index 6e1f6bf..0a3995f 100644 ---- a/src/allow_execmod.py -+++ b/src/allow_execmod.py -@@ -81,7 +81,8 @@ If you want this to survive a relabel, execute - # semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';restorecon -v '$FIX_TARGET_PATH' - """ - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - def init_args(self, args): - if len(args) > 0: -diff --git a/src/automount_exec_config.py b/src/automount_exec_config.py -index a64eaf2..81ada8e 100644 ---- a/src/automount_exec_config.py -+++ b/src/automount_exec_config.py -@@ -40,7 +40,8 @@ class plugin(Plugin): - If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH". If you want this to survive a relabel, you need to permanently change the file context: execute "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'". - ''') - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - if_text = 'If you want to allow automounter to execute $TARGET_PATH' - -diff --git a/src/cvs_data.py b/src/cvs_data.py -index 7451622..1e75ead 100644 ---- a/src/cvs_data.py -+++ b/src/cvs_data.py -@@ -46,7 +46,8 @@ class plugin(Plugin): - do_text = """# semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH' - # restorecon -v '$FIX_TARGET_PATH'""" - -- fix_cmd = """/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" -+ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'""", -+ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] - - def __init__(self): - Plugin.__init__(self, __name__) -diff --git a/src/file.py b/src/file.py -index ac24bf9..25f3a43 100644 ---- a/src/file.py -+++ b/src/file.py -@@ -66,7 +66,7 @@ home directory from a previous installation that did not use SELinux, 'restoreco - if args == (1,0): - return '/sbin/restorecon -R -v $TARGET_PATH' - else: -- return 'touch /.autorelabel; reboot' -+ return ['touch /.autorelabel', 'reboot'] - - def init_args(self, args): - if args == (1,0): --- -2.53.0 - diff --git a/0002-catchall-Discourage-creating-custom-policy-modules.patch b/0002-catchall-Discourage-creating-custom-policy-modules.patch deleted file mode 100644 index a3f28a1..0000000 --- a/0002-catchall-Discourage-creating-custom-policy-modules.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 8ad7f4c5528fbbc52a3d391c702102c6fe262d83 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 9 Jun 2026 17:27:36 +0200 -Subject: [PATCH] catchall: Discourage creating custom policy modules - -Update the plugin text to discourage creating custom policy modules by -explaining the lack of support and potential security implications. ---- - src/catchall.py | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/src/catchall.py b/src/catchall.py -index 052d6d8..7e4a8fa 100644 ---- a/src/catchall.py -+++ b/src/catchall.py -@@ -54,9 +54,14 @@ class plugin(Plugin): - return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.') - return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.') - -- then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.') -- do_text = _("""Allow this access for now by executing: --# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME -+ then_text = _(''' -+ You should report this as a bug.\n -+ If you are certain this access is legitimate and not an intrusion attempt, you -+ can generate a local policy module to allow it. -+ Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities. -+ ''') -+ -+ do_text = _("""# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME - # semodule -X 300 -i my-$MODULE_NAME.pp""") - - def __init__(self): --- -2.53.0 - diff --git a/plans/tests.fmf b/plans/tests.fmf deleted file mode 100644 index 5d615ae..0000000 --- a/plans/tests.fmf +++ /dev/null @@ -1,8 +0,0 @@ -summary: basic setroubleshoot-plugins test plan -discover: - how: fmf - url: https://gitlab.com/setroubleshoot/tests.git - filter: "component:setroubleshoot-plugins & tier: 1" -execute: - how: tmt - diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index 8ec5c8f..fbefed1 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -1,30 +1,21 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} -# Disable automatic compilation of Python files in extra directories -%global _python_bytecompile_extra 0 - Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.3.15 -Release: 8%{?dist} -License: GPL-2.0-or-later -URL: https://gitlab.com/setroubleshoot/plugins -VCS: git:https://gitlab.com/setroubleshoot/plugins.git -Source0: https://gitlab.com/-/project/24478430/uploads/1d856bff1c9fb16a8c6fc877d7fe91ca/setroubleshoot-plugins-3.3.15.tar.gz -# git format-patch -N setroubleshoot-plugins- -# for j in 00*patch; do printf "Patch: %s\n" $j; done -Patch: 0001-Split-multi-command-fix_cmds-into-lists.patch -Patch: 0002-catchall-Discourage-creating-custom-policy-modules.patch +Version: 3.0.60 +Release: 2%{?dist} +License: GPLv2+ +Group: Applications/System +URL: https://fedorahosted.org/setroubleshoot +# git clone git://git.fedorahosted.org/git/setroubleshoot.git; cd setroubleshoot +# git archive --prefix setroubleshoot-plugins-3.0.10/426cf8ea7a38e8c5179981219d831368161b65f2 > setroubleshoot-plugins-3.0.10.tar.gz +Source0: %{name}-%{version}.tar.gz +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildArch: noarch -# gcc is needed only for ./configure -# Remove it when the build process is fixed -BuildRequires: gcc -BuildRequires: make BuildRequires: perl-XML-Parser -BuildRequires: intltool gettext python3-devel -# Support for multiple commands in fix_cmd -Conflicts: setroubleshoot-server < 3.3.37 +BuildRequires: intltool gettext python +Requires: setroubleshoot-server >= 3.1.16-1 %description This package provides a set of analysis plugins for use with @@ -33,202 +24,30 @@ data and system data to provide user friendly reports describing how to interpret SELinux AVC denials. %prep -%autosetup -p 1 +%setup -q %build -%configure PYTHON=%{__python3} -make PYTHON=%{__python3} +%configure +make %install rm -rf %{buildroot} -%make_install PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} +make DESTDIR=%{buildroot} pkgdocdir=%{_pkgdocdir} install %find_lang %{name} -# Manually invoke the python byte compile macro for each path that needs byte -# compilation. -%py_byte_compile %{__python3} %{buildroot}%{_datadir}/setroubleshoot/plugins + +%clean +rm -rf %{buildroot} %files -f %{name}.lang +%defattr(-,root,root,-) %doc %{_pkgdocdir} %{_datadir}/setroubleshoot/plugins %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 3.3.15-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Thu May 07 2026 Vit Mojzis - 3.3.15-7 -- Split multi-command fix_cmds into lists -- catchall: Discourage creating custom policy modules - -* Sat Jan 17 2026 Fedora Release Engineering - 3.3.15-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Sep 19 2025 Python Maint - 3.3.15-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.3.15-4 -- Rebuilt for Python 3.14.0rc2 bytecode - -* Fri Jul 25 2025 Fedora Release Engineering - 3.3.15-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Sun Jan 19 2025 Fedora Release Engineering - 3.3.15-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Mon Jan 06 2025 Petr Lautrbach - 3.3.15-1 -- restorecon.py: exclude more paths -- Improve disable_ipv6 plugin then_text -- Update generated configuration files -- Update translations - -* Sat Jul 20 2024 Fedora Release Engineering - 3.3.14-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 3.3.14-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Jul 26 2023 Petr Lautrbach - 3.3.14-8 -- Update generated configuration files (rhbz#2226425) -- Improve disable_ipv6 plugin then_text - -* Sat Jul 22 2023 Fedora Release Engineering - 3.3.14-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sat Jan 21 2023 Fedora Release Engineering - 3.3.14-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 3.3.14-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Fedora Release Engineering - 3.3.14-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-3 -- restorecon.py: exclude more paths (#1960136) - -* Fri Jul 23 2021 Fedora Release Engineering - 3.3.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Mon Mar 29 2021 Vit Mojzis - 3.3.14-1 -- Update translations - -* Wed Jan 27 2021 Fedora Release Engineering - 3.3.12-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 3.3.12-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 14 2020 Tom Stellard - 3.3.12-2 -- Use make macros -- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Tue Apr 21 2020 Vit Mojzis - 3.3.12-1 -- Use get_package_nvr* functions instead of get_rpm_nvr* -- Update deprecated type references -- Update translations - -* Thu Jan 30 2020 Vit Mojzis - 3.3.11-1 -- Add plugin which analyzes execmem denials -- Add missing "If " strings -- Update qemu_blk_image and qemu_file_image -- Update "xen_image" plugin -- Update "file" plugin -- Update "missing" scripts to automake-1.15 - -* Thu Jan 30 2020 Fedora Release Engineering - 3.3.10-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jul 26 2019 Fedora Release Engineering - 3.3.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Sat Feb 02 2019 Fedora Release Engineering - 3.3.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Dec 8 2018 Petr Lautrbach - 3.3.10-1 -- Handle no "allowed_target_types" properly -- bind_ports: Do not use when there are no allowed_target_types -- Fix summary and "if" text for AVCs with unknown target path -- plugins: Update translations - -* Sat Jul 14 2018 Fedora Release Engineering - 3.3.9-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Tue Jun 19 2018 Miro Hrončok - 3.3.9-5 -- Rebuilt for Python 3.7 - -* Fri Feb 09 2018 Fedora Release Engineering - 3.3.9-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Nov 23 2017 Petr Lautrbach - 3.3.9-3 -- Update translations - -* Mon Nov 20 2017 Petr Lautrbach - 3.3.9-2 -- Update translations - -* Sat Nov 18 2017 Petr Lautrbach - 3.3.9-1 -- Fix catchall plugin message for process2 - -* Fri Sep 15 2017 Petr Lautrbach - 3.3.8-1 -- Do not split If sentences to framework and plugins - requires - setroubleshoot 3.3.13 at least - (rhbz#1210243, rhbz#1322734, rhbz#1115510) -- Update translations - -* Thu Jul 27 2017 Fedora Release Engineering - 3.3.7-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Tue Jun 13 2017 Petr Lautrbach - 3.3.7-1 -- cvs_data: Add "fix_cmd" and enable "fix" button -- chrome: Update "fix_cmd" and enable "fix" button -- automount_exec_config: Update messages and enable "fix" button -- allow_ftpd_use_*: Update messages and enable "fix" button -- allow_execmod: Update messages and enable "fix" button -- catchall_boolean: fix import of boolean_desc (#1444549) -- restorecon: fix "then" text -- Spelling fixes - -* Sat Feb 11 2017 Fedora Release Engineering - 3.3.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Sep 01 2016 Petr Lautrbach 3.3.6-1 -- Fix catchall plugin message for capability2 (#1360392) -- Stop executing restorecon plugin on specified path prefixes (#1270778) -- Update translations - -* Wed Jun 22 2016 Petr Lautrbach - 3.3.5.1-1 -- Catch all subprocess exceptions -- Use subprocess.check_output() with a sequence of program arguments -- Fix location of selinuxfs mount point - -* Fri May 06 2016 Petr Lautrbach - 3.3.4-1 -- Suggest my-.pp modules instead of mypol.pp (#1329037) -- Suggest priority 300 for modules created by audit2allow - -* Mon Apr 04 2016 Petr Lautrbach - 3.3.3-1 -- Fix sshd_root.py setroubleshoot plugin to cover only /root/.ssh path as intended. -- Suggest to use ausearch instead of grep -- Update translations - -* Thu Feb 04 2016 Fedora Release Engineering - 3.3.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Tue Nov 10 2015 Fedora Release Engineering - 3.3.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 - -* Tue Oct 06 2015 Petr Lautrbach 3.3.2-1 -- Update restorecon plugin to to identify a mislabeling of executable (BZ#1257682) - -* Tue Aug 18 2015 Petr Lautrbach 3.3.1-0.1 -- port setroubleshoot-plugins to Python 3 - -* Fri Jun 19 2015 Fedora Release Engineering - 3.0.61-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon Feb 16 2015 Miroslav Grepl - 3.0.61-1 -- Fix catchall_boolean plugin to show correct man page for source type. - * Sun Jun 08 2014 Fedora Release Engineering - 3.0.60-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild -* Thu Jan 23 2014 Dan Walsh - 3.0.60-1 +* Mon Jan 23 2014 Dan Walsh - 3.0.60-1 - Change file.py plugin to handle alias between file_t and unlabeled_t * Wed Dec 4 2013 Dan Walsh - 3.0.59-1 diff --git a/sources b/sources index aeb5a6c..a6b5c2d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-plugins-3.3.15.tar.gz) = 9741ecd48a7e0cde376ac0f818d94dad32c74acd2afc01ec6f5e3cf74ff9075d4f3406f1a3905cbbdd3833c8c2ef4213deaaf00d0012dbea582eb2b825618d5f +81c99c2f77c9f155703ed4be1e1f00fa setroubleshoot-plugins-3.0.60.tar.gz