diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index a58a8e6..e0500d1 100644 --- a/.gitignore +++ b/.gitignore @@ -123,3 +123,4 @@ setroubleshoot-plugins-2.1.55.tar.gz /setroubleshoot-plugins-3.3.11.tar.gz /setroubleshoot-plugins-3.3.12.tar.gz /setroubleshoot-plugins-3.3.14.tar.gz +/setroubleshoot-plugins-3.3.15.tar.gz diff --git a/0001-Split-multi-command-fix_cmds-into-lists.patch b/0001-Split-multi-command-fix_cmds-into-lists.patch new file mode 100644 index 0000000..476333d --- /dev/null +++ b/0001-Split-multi-command-fix_cmds-into-lists.patch @@ -0,0 +1,73 @@ +From df90bf242b35a9e01f721dd7ad436f1bd5d21616 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 9 Mar 2026 22:03:31 +0100 +Subject: [PATCH] Split multi-command fix_cmds into lists + +This requires +https://gitlab.com/setroubleshoot/setroubleshoot/-/merge_requests/54/diffs?commit_id=d5d13afa86c2bd03952c04a187657ed981c9be7e +to work properly! +--- + src/allow_execmod.py | 3 ++- + src/automount_exec_config.py | 3 ++- + src/cvs_data.py | 3 ++- + src/file.py | 2 +- + 4 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/src/allow_execmod.py b/src/allow_execmod.py +index 6e1f6bf..0a3995f 100644 +--- a/src/allow_execmod.py ++++ b/src/allow_execmod.py +@@ -81,7 +81,8 @@ If you want this to survive a relabel, execute + # semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';restorecon -v '$FIX_TARGET_PATH' + """ + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + def init_args(self, args): + if len(args) > 0: +diff --git a/src/automount_exec_config.py b/src/automount_exec_config.py +index a64eaf2..81ada8e 100644 +--- a/src/automount_exec_config.py ++++ b/src/automount_exec_config.py +@@ -40,7 +40,8 @@ class plugin(Plugin): + If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH". If you want this to survive a relabel, you need to permanently change the file context: execute "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'". + ''') + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + if_text = 'If you want to allow automounter to execute $TARGET_PATH' + +diff --git a/src/cvs_data.py b/src/cvs_data.py +index 7451622..1e75ead 100644 +--- a/src/cvs_data.py ++++ b/src/cvs_data.py +@@ -46,7 +46,8 @@ class plugin(Plugin): + do_text = """# semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH' + # restorecon -v '$FIX_TARGET_PATH'""" + +- fix_cmd = """/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'""" ++ fix_cmd = ["""/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'""", ++ """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""] + + def __init__(self): + Plugin.__init__(self, __name__) +diff --git a/src/file.py b/src/file.py +index ac24bf9..25f3a43 100644 +--- a/src/file.py ++++ b/src/file.py +@@ -66,7 +66,7 @@ home directory from a previous installation that did not use SELinux, 'restoreco + if args == (1,0): + return '/sbin/restorecon -R -v $TARGET_PATH' + else: +- return 'touch /.autorelabel; reboot' ++ return ['touch /.autorelabel', 'reboot'] + + def init_args(self, args): + if args == (1,0): +-- +2.53.0 + diff --git a/0001-restorecon.py-exclude-more-paths.patch b/0001-restorecon.py-exclude-more-paths.patch deleted file mode 100644 index 2189d21..0000000 --- a/0001-restorecon.py-exclude-more-paths.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 0f508191647a41f92264c0c8fc877b0110bbd468 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 10 Aug 2021 20:11:20 +0200 -Subject: [PATCH] restorecon.py: exclude more paths - -It doesn't make sense to run restorecon on /sys/ /proc/ and /memfd: ---- - src/restorecon.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/restorecon.py b/src/restorecon.py -index e3044c742367..9594c0d59d96 100644 ---- a/src/restorecon.py -+++ b/src/restorecon.py -@@ -39,7 +39,7 @@ def customizable(target): - - - # List of path prefixes for which this plugin is not executed --excluded_paths = ["/sys/fs"] -+excluded_paths = ["/sys/", "/proc/", "/memfd:"] - # Test if the specified path starts with some excluded prefix - def excluded_path(target_path): - for path in excluded_paths: --- -2.32.0 - diff --git a/0002-catchall-Discourage-creating-custom-policy-modules.patch b/0002-catchall-Discourage-creating-custom-policy-modules.patch new file mode 100644 index 0000000..a3f28a1 --- /dev/null +++ b/0002-catchall-Discourage-creating-custom-policy-modules.patch @@ -0,0 +1,36 @@ +From 8ad7f4c5528fbbc52a3d391c702102c6fe262d83 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 9 Jun 2026 17:27:36 +0200 +Subject: [PATCH] catchall: Discourage creating custom policy modules + +Update the plugin text to discourage creating custom policy modules by +explaining the lack of support and potential security implications. +--- + src/catchall.py | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/src/catchall.py b/src/catchall.py +index 052d6d8..7e4a8fa 100644 +--- a/src/catchall.py ++++ b/src/catchall.py +@@ -54,9 +54,14 @@ class plugin(Plugin): + return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.') + return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.') + +- then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.') +- do_text = _("""Allow this access for now by executing: +-# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME ++ then_text = _(''' ++ You should report this as a bug.\n ++ If you are certain this access is legitimate and not an intrusion attempt, you ++ can generate a local policy module to allow it. ++ Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities. ++ ''') ++ ++ do_text = _("""# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME + # semodule -X 300 -i my-$MODULE_NAME.pp""") + + def __init__(self): +-- +2.53.0 + diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..5d615ae --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,8 @@ +summary: basic setroubleshoot-plugins test plan +discover: + how: fmf + url: https://gitlab.com/setroubleshoot/tests.git + filter: "component:setroubleshoot-plugins & tier: 1" +execute: + how: tmt + diff --git a/setroubleshoot-plugins.spec b/setroubleshoot-plugins.spec index 08fe4b7..9bda6f3 100644 --- a/setroubleshoot-plugins.spec +++ b/setroubleshoot-plugins.spec @@ -5,14 +5,15 @@ Summary: Analysis plugins for use with setroubleshoot Name: setroubleshoot-plugins -Version: 3.3.14 -Release: 2%{?dist} -License: GPLv2+ -URL: https://github.com/fedora-selinux/setroubleshoot -Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz -# git format-patch -N setroubleshoot-plugins- -- plugins -# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done -Patch0001: 0001-restorecon.py-exclude-more-paths.patch +Version: 3.3.15 +Release: 8%{?dist} +License: GPL-2.0-or-later +URL: https://gitlab.com/setroubleshoot/plugins +Source0: https://gitlab.com/-/project/24478430/uploads/1d856bff1c9fb16a8c6fc877d7fe91ca/setroubleshoot-plugins-3.3.15.tar.gz +# git format-patch -N setroubleshoot-plugins- +# for j in 00*patch; do printf "Patch: %s\n" $j; done +Patch: 0001-Split-multi-command-fix_cmds-into-lists.patch +Patch: 0002-catchall-Discourage-creating-custom-policy-modules.patch BuildArch: noarch # gcc is needed only for ./configure @@ -21,8 +22,8 @@ BuildRequires: gcc BuildRequires: make BuildRequires: perl-XML-Parser BuildRequires: intltool gettext python3-devel -# Introduction of get_package_nvr functions -Requires: setroubleshoot-server >= 3.3.23 +# Support for multiple commands in fix_cmd +Conflicts: setroubleshoot-server < 3.3.37 %description This package provides a set of analysis plugins for use with @@ -50,9 +51,62 @@ rm -rf %{buildroot} %{_datadir}/setroubleshoot/plugins %changelog -* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-2 +* Fri Jul 17 2026 Fedora Release Engineering - 3.3.15-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Thu May 07 2026 Vit Mojzis - 3.3.15-7 +- Split multi-command fix_cmds into lists +- catchall: Discourage creating custom policy modules + +* Sat Jan 17 2026 Fedora Release Engineering - 3.3.15-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Sep 19 2025 Python Maint - 3.3.15-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.3.15-4 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Fri Jul 25 2025 Fedora Release Engineering - 3.3.15-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun Jan 19 2025 Fedora Release Engineering - 3.3.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Mon Jan 06 2025 Petr Lautrbach - 3.3.15-1 +- restorecon.py: exclude more paths +- Improve disable_ipv6 plugin then_text +- Update generated configuration files +- Update translations + +* Sat Jul 20 2024 Fedora Release Engineering - 3.3.14-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jan 27 2024 Fedora Release Engineering - 3.3.14-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jul 26 2023 Petr Lautrbach - 3.3.14-8 +- Update generated configuration files (rhbz#2226425) +- Improve disable_ipv6 plugin then_text + +* Sat Jul 22 2023 Fedora Release Engineering - 3.3.14-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 3.3.14-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 3.3.14-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jan 22 2022 Fedora Release Engineering - 3.3.14-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Fri Sep 3 2021 Petr Lautrbach - 3.3.14-3 - restorecon.py: exclude more paths (#1960136) +* Fri Jul 23 2021 Fedora Release Engineering - 3.3.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Mon Mar 29 2021 Vit Mojzis - 3.3.14-1 - Update translations diff --git a/sources b/sources index 28a0bb9..aeb5a6c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-plugins-3.3.14.tar.gz) = da6882a998aeade67891a722a5b94e2ba1072d9db5d73031854a2c0b51083a0eaf9519dd7987938a86c1f8d263d08882642ac447d7b4bbcd8a859db4b44d61c1 +SHA512 (setroubleshoot-plugins-3.3.15.tar.gz) = 9741ecd48a7e0cde376ac0f818d94dad32c74acd2afc01ec6f5e3cf74ff9075d4f3406f1a3905cbbdd3833c8c2ef4213deaaf00d0012dbea582eb2b825618d5f diff --git a/tests/Regression/use-of-aliases-in-plugins/runtest.sh b/tests/Regression/use-of-aliases-in-plugins/runtest.sh deleted file mode 100755 index 5720f99..0000000 --- a/tests/Regression/use-of-aliases-in-plugins/runtest.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/setroubleshoot-plugins/Regression/use-of-aliases-in-plugins -# Description: Make sure all types used in setroubleshoot plugins are -# defined in the policy and are not aliases -# Author: Vit Mojzis -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This program is free software: you can redistribute it and/or -# modify it under the terms of the GNU General Public License as -# published by the Free Software Foundation, either version 2 of -# the License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see http://www.gnu.org/licenses/. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="setroubleshoot-plugins" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm ${PACKAGE} - rlRun "selinuxenabled" 0 - rlPhaseEnd - - rlPhaseStartTest "bz#1794807 - look for aliases and undefined types in plugins" - # lists all types not defined in the policy as "type_t not found" - # and all aliases as "alias_t is an alias of type_t" - # all issues are prefixed with a list of offending plugins - # returns 1 if an issue was found - rlRun "./test_aliases.py" 0 - rlPhaseEnd -rlJournalPrintText -rlJournalEnd - diff --git a/tests/Regression/use-of-aliases-in-plugins/test_aliases.py b/tests/Regression/use-of-aliases-in-plugins/test_aliases.py deleted file mode 100755 index fec114e..0000000 --- a/tests/Regression/use-of-aliases-in-plugins/test_aliases.py +++ /dev/null @@ -1,65 +0,0 @@ -#!/usr/bin/python3 - -# lists all types not defined in the policy as "type_t not found" -# and all aliases as "alias_t is an alias of type_t" -# all issues are prefixed with a list of offending plugins -# returns 1 if an issue was found - -import subprocess -import sepolicy -import sys -import re -from collections import defaultdict - -plugin_path = "/usr/share/setroubleshoot/plugins" -error_code = 0 - -if len(sys.argv) > 1: - plugin_path = sys.argv[1] - -try: - # search all plugin files in given location for the following pattern - # :_t - g = subprocess.check_output('grep -I [^A-Za-z_][A-Za-z][A-Za-z_]*_t[^A-Za-z_] -o {}/*.py'.format(plugin_path), - universal_newlines=True, shell=True) - lines = g.split('\n') -except: - exit(1) -# matches 2 groups: file name and type name -# ():(_t) -reg = re.compile('.*/(.+):[^A-Za-z_]([A-Za-z_]*_t)[^A-Za-z_]') -# generate a dictionary of of all type names used in setroubleshoot plugins -# where types are keys and lists of files where each type appeared are data -found = defaultdict(set) - -for l in lines: - m = reg.match(l) - - if m is None: - continue - - try: - t = m.group(2) - if "_TYPE_" in t: - continue - found[t].add(m.group(1)) - except: - # failed to match - continue - -for t in sorted(found.keys()): - try: - # try to find each type in system policy - i = next(sepolicy.info(sepolicy.TYPE, t))['name'] - if t != i: - # : alias_t is an alias of type_t - print("{}: {} is an alias of {}".format(", ".join(found[t]), t, i)) - error_code = 1 - except: - # skip types defined in selinux-policy modules that are not shipped any more - if t not in ["vbetool_t"]: - # : type_t not found - print("{}: {} not found".format(", ".join(found[t]), t)) - error_code = 1 - -exit(error_code) diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index cc1af99..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,11 +0,0 @@ -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - Regression/use-of-aliases-in-plugins - required_packages: - - setroubleshoot-plugins - - selinux-policy-targeted - - python3-policycoreutils