setroubleshoot-plugins-3.3.12-1

- Use get_package_nvr* functions instead of get_rpm_nvr*
- Update deprecated type references
- Update translations

.gitignore

@@ -120,3 +120,5 @@ setroubleshoot-plugins-2.1.55.tar.gz
 /setroubleshoot-plugins-3.3.8.tar.gz
 /setroubleshoot-plugins-3.3.9.tar.gz
 /setroubleshoot-plugins-3.3.10.tar.gz
+/setroubleshoot-plugins-3.3.11.tar.gz
+/setroubleshoot-plugins-3.3.12.tar.gz

setroubleshoot-plugins.spec

@@ -5,11 +5,13 @@
 
 Summary: Analysis plugins for use with setroubleshoot
 Name: setroubleshoot-plugins
-Version: 3.3.10
-Release: 4%{?dist}
+Version: 3.3.12
+Release: 1%{?dist}
 License: GPLv2+
 URL: https://github.com/fedora-selinux/setroubleshoot
 Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz
+# git format-patch -N setroubleshoot-plugins-<version> -- plugins
+# i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
 BuildArch: noarch
 
 # gcc is needed only for ./configure
@@ -17,7 +19,8 @@ BuildArch: noarch
 BuildRequires: gcc
 BuildRequires: perl-XML-Parser
 BuildRequires: intltool gettext python3-devel
-Requires: setroubleshoot-server >= 3.3.19
+# Introduction of get_package_nvr functions
+Requires: setroubleshoot-server >= 3.3.23
 
 %description
 This package provides a set of analysis plugins for use with
@@ -45,6 +48,19 @@ make DESTDIR=%{buildroot} PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} install
 %{_datadir}/setroubleshoot/plugins
 
 %changelog
+* Tue Apr 21 2020 Vit Mojzis <vmojzis@redhat.com> - 3.3.12-1
+- Use get_package_nvr* functions instead of get_rpm_nvr*
+- Update deprecated type references
+- Update translations
+
+* Thu Jan 30 2020 Vit Mojzis <vmojzis@redhat.com> - 3.3.11-1
+- Add plugin which analyzes execmem denials
+- Add missing "If " strings
+- Update qemu_blk_image and qemu_file_image
+- Update "xen_image" plugin
+- Update "file" plugin
+- Update "missing" scripts to automake-1.15
+
 * Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.10-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (setroubleshoot-plugins-3.3.10.tar.gz) = 169ca9b26fa21cc4e4fb68b23b1d05d238b72e52888376cff7f78e1e3e13ef31b78f53f4fa6a25296f1caa5cc9f0b5b163fc1edbd59584f708468ba8abfd90d1
+SHA512 (setroubleshoot-plugins-3.3.12.tar.gz) = aec345a93aa7cfaea8468c72639dacb89dfc4fa9f1d2ed2e121f5ca20dfd37399877364d95cd8dd548cefcaee4ea818ae4465035a60b6ba18493eb548ef4c87e

tests/Regression/use-of-aliases-in-plugins/runtest.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/setroubleshoot-plugins/Regression/use-of-aliases-in-plugins
+#   Description: Make sure all types used in setroubleshoot plugins are
+#                defined in the policy and are not aliases
+#   Author: Vit Mojzis <vmojzis@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="setroubleshoot-plugins"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlRun "selinuxenabled" 0
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#1794807 - look for aliases and undefined types in plugins"
+        # lists all types not defined in the policy as "type_t not found"
+        # and all aliases as "alias_t is an alias of type_t"
+        # all issues are prefixed with a list of offending plugins
+        # returns 1 if an issue was found
+        rlRun "./test_aliases.py" 0
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+

tests/Regression/use-of-aliases-in-plugins/test_aliases.py

@@ -0,0 +1,65 @@
+#!/usr/bin/python3
+
+# lists all types not defined in the policy as "type_t not found"
+# and all aliases as "alias_t is an alias of type_t"
+# all issues are prefixed with a list of offending plugins
+# returns 1 if an issue was found
+
+import subprocess
+import sepolicy
+import sys
+import re
+from collections import defaultdict
+
+plugin_path = "/usr/share/setroubleshoot/plugins"
+error_code = 0
+
+if len(sys.argv) > 1:
+	plugin_path = sys.argv[1]
+
+try:
+	# search all plugin files in given location for the following pattern
+	# <plugin path>:<delimiter><type name>_t<delimiter>
+	g = subprocess.check_output('grep -I [^A-Za-z_][A-Za-z][A-Za-z_]*_t[^A-Za-z_] -o {}/*.py'.format(plugin_path),
+				     universal_newlines=True, shell=True)
+	lines = g.split('\n')
+except:
+	exit(1)
+# matches 2 groups: file name and type name
+# <path to plugins>(<plugin file name>):<delimiter>(<type name>_t)<delimiter>
+reg = re.compile('.*/(.+):[^A-Za-z_]([A-Za-z_]*_t)[^A-Za-z_]')
+# generate a dictionary of of all type names used in setroubleshoot plugins
+# where types are keys and lists of files where each type appeared are data
+found = defaultdict(set)
+
+for l in lines:
+	m = reg.match(l)
+
+	if m is None:
+		continue
+
+	try:
+		t = m.group(2)
+		if "_TYPE_" in t:
+			continue
+		found[t].add(m.group(1))
+	except:
+		# failed to match
+		continue
+
+for t in sorted(found.keys()):
+	try:
+		# try to find each type in system policy
+		i = next(sepolicy.info(sepolicy.TYPE, t))['name']
+		if t != i:
+			# <plugin file names>: alias_t is an alias of type_t
+			print("{}: {} is an alias of {}".format(", ".join(found[t]), t, i))
+			error_code = 1
+	except:
+		# skip types defined in selinux-policy modules that are not shipped any more
+		if t not in ["vbetool_t"]:
+			# <plugin file names>: type_t not found
+			print("{}: {} not found".format(", ".join(found[t]), t))
+			error_code = 1
+
+exit(error_code)

tests/tests.yml

@@ -0,0 +1,11 @@
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    tests:
+    - Regression/use-of-aliases-in-plugins
+    required_packages:
+    - setroubleshoot-plugins
+    - selinux-policy-targeted
+    - python3-policycoreutils