From ecc445aa667c17779a7397be41b5ae7650177d36 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 29 Nov 2018 10:14:37 +0100 Subject: [PATCH 1/6] Update scriptlets to reload auditd service When setroubleshoot sedispatch is installed, or updated, auditd needs to be reloaded so that it runs the new installed plugin. Since auditd needs to know who reloaded him, `systemctl` can't be used. We need to use `service` script. This fixes the problem when setroubleshoot is installed, but it doesn't collect AVC denial messages until the machine is rebooted. /com/redhat/setroubleshootd interface is not used for years therefore we can drop it. --- setroubleshoot.spec | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index a68c92b..d1d0ce7 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -55,14 +55,6 @@ to user preference. The same tools can be run on existing log files. %{_bindir}/seapplet -%post -dbus-send --system /com/redhat/setroubleshootd com.redhat.SEtroubleshootdIface.restart string:'rpm install' >/dev/null 2>&1 || : -%systemd_post auditd.service - -%postun -%systemd_postun_with_restart auditd.service - - %prep %autosetup -p 2 @@ -113,10 +105,10 @@ to user preference. The same tools can be run on existing log files. getent passwd %{username} >/dev/null || useradd -r -U -s /sbin/nologin -d %{pkgvardatadir} %{username} %post server -%systemd_post auditd.service +/sbin/service auditd reload >/dev/null 2>&1 || : %postun server -%systemd_postun_with_restart auditd.service +/sbin/service auditd reload >/dev/null 2>&1 || : %triggerun server -- %{name}-server < 3.2.24-4 chown -R setroubleshoot:setroubleshoot %{pkgvardatadir} From 8d2a9fbf05b7ab1764df365b36738828aa58831c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 8 Dec 2018 22:54:51 +0100 Subject: [PATCH 2/6] setroubleshoot-3.3.19 - Require plugins >= 3.3.10 - Update scriptlets to reload auditd after install or uninstall - Update translations - Improve myplatform detection in get_os_environment() - Fix summary and "if" text for AVCs with unknown target path --- .gitignore | 2 ++ setroubleshoot.spec | 11 +++++++++-- sources | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5c88e3e..29155ed 100644 --- a/.gitignore +++ b/.gitignore @@ -202,3 +202,5 @@ setroubleshoot-2.2.93.tar.gz /setroubleshoot-3.3.15.tar.gz /setroubleshoot-3.3.16.tar.gz /setroubleshoot-3.3.17.tar.gz +/setroubleshoot-3.3.18.tar.gz +/setroubleshoot-3.3.19.tar.gz diff --git a/setroubleshoot.spec b/setroubleshoot.spec index d1d0ce7..bb6fe44 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -1,6 +1,6 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot -Version: 3.3.17 +Version: 3.3.19 Release: 1%{?dist} License: GPLv2+ URL: https://pagure.io/setroubleshoot @@ -79,7 +79,7 @@ install -m644 -D %{SOURCE1} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf %package server Summary: SELinux troubleshoot server -Requires: %{name}-plugins >= 3.3.8 +Requires: %{name}-plugins >= 3.3.10 Requires: audit >= 1.2.6-3 Requires: audit-libs-python3 >= 1.2.6-3 Requires: libxml2-python3 @@ -191,6 +191,13 @@ SELinux troubleshoot legacy applet %{_bindir}/seappletlegacy %changelog +* Sat Dec 8 2018 Petr Lautrbach - 3.3.19-1 +- Require plugins >= 3.3.10 +- Update scriptlets to reload auditd after install or uninstall +- Update translations +- Improve myplatform detection in get_os_environment() +- Fix summary and "if" text for AVCs with unknown target path + * Mon Feb 26 2018 Petr Lautrbach - 3.3.17-1 - Set auto_save_interval to 5 (#1548913,#1523406,#1539180) - seapplet: Try send and close notifications (#1541624,#1541719,#1544222,#1539367) diff --git a/sources b/sources index 48efe8f..5f92a7d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-3.3.17.tar.gz) = ae0083163f909fad3d5ef91dd3c80f3263452e50dd314ab0f1e6394022cbe771111655919f7518fd1351dcc195929dd81b838436ef797174f5bf3baf4f9adf15 +SHA512 (setroubleshoot-3.3.19.tar.gz) = e012f9c0011fd682394232c9297e01710a389cc4bbae11193f75780c96a99451d7d8a77080a7d4686525ca8b8bbc6332991b7b06a282345d2baba64bab9beb24 From b9fe4691125a1fdd50835d2f42c56bd69eb89082 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sun, 9 Dec 2018 21:12:47 +0100 Subject: [PATCH 3/6] Use pre audit-3 plugin path The latest setroubleshoot uses default audit-3 plugins path - /etc/audit/plugins.d - but Fedora 28 still uses the old /etc/audisp/plugins.d/ --- setroubleshoot.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index bb6fe44..8cf02f3 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -59,7 +59,7 @@ to user preference. The same tools can be run on existing log files. %autosetup -p 2 %build -%configure PYTHON=%{__python3} --enable-seappletlegacy=yes +%configure PYTHON=%{__python3} --enable-seappletlegacy=yes --with-auditpluginsdir=/etc/audisp/plugins.d/sedispatch.conf make %install From 3e7f679c229bc38963a2f4c6991045de083d5a40 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 29 Dec 2018 15:35:08 +0100 Subject: [PATCH 4/6] Use the correct audit plugin path The path needs to be specified as a destination directory, not a whole filename path. Fixes: audispd[1008]: Error - /etc/audisp/plugins.d/sedispatch.conf is not a regular file audispd[1008]: Skipping sedispatch.conf plugin due to errors audispd[1008]: No plugins found, exitin https://bugzilla.redhat.com/show_bug.cgi?id=1662256 --- setroubleshoot.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index 8cf02f3..dd6c418 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -59,7 +59,7 @@ to user preference. The same tools can be run on existing log files. %autosetup -p 2 %build -%configure PYTHON=%{__python3} --enable-seappletlegacy=yes --with-auditpluginsdir=/etc/audisp/plugins.d/sedispatch.conf +%configure PYTHON=%{__python3} --enable-seappletlegacy=yes --with-auditpluginsdir=/etc/audisp/plugins.d make %install From 6ba020bd357f340a7d868d1a43c0a705a1e2ed44 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 29 Dec 2018 15:37:07 +0100 Subject: [PATCH 5/6] Temporary use a different name for sedispatch plugin Since /etc/audisp/plugins.d/sedispatch.conf was a directory in previous version, the same name can't be used for a file: Error: Transaction check error: file /etc/audisp/plugins.d/sedispatch.conf from install of setroubleshoot-server-3.3.19-2.fc28.x86_64 conflicts with file from package setroubleshoot-server-3.3.19-1.fc28.x86_64 Lets use sedispatch-3.conf temporary until this problem settles down. https://bugzilla.redhat.com/show_bug.cgi?id=1662256 --- setroubleshoot.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index dd6c418..d8b604c 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -72,7 +72,7 @@ touch %{buildroot}%{pkgvardatadir}/email_alert_recipients rm -rf %{buildroot}/usr/share/doc/ # create /run/setroubleshoot on boot install -m644 -D %{SOURCE1} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf - +mv %{buildroot}/etc/audisp/plugins.d/sedispatch.conf %{buildroot}/etc/audisp/plugins.d/sedispatch-3.conf %find_lang %{name} @@ -169,7 +169,7 @@ chown -R setroubleshoot:setroubleshoot %{pkgvardatadir} %{_mandir}/man8/sealert.8.gz %{_mandir}/man8/sedispatch.8.gz %{_mandir}/man8/setroubleshootd.8.gz -%config /etc/audisp/plugins.d/sedispatch.conf +%config /etc/audisp/plugins.d/sedispatch-3.conf %{_datadir}/dbus-1/system-services/org.fedoraproject.Setroubleshootd.service %{_datadir}/polkit-1/actions/org.fedoraproject.setroubleshootfixit.policy %config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.fedoraproject.SetroubleshootFixit.conf From d21cb2bd775deb5e16ae78af7cab51fc9baaf252 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 29 Dec 2018 15:40:08 +0100 Subject: [PATCH 6/6] setroubleshoot-3.3.19-2 - Use the correct audit plugin path (#1662256) --- setroubleshoot.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index d8b604c..d3c048a 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -1,7 +1,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.19 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ URL: https://pagure.io/setroubleshoot Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz @@ -191,6 +191,9 @@ SELinux troubleshoot legacy applet %{_bindir}/seappletlegacy %changelog +* Sat Dec 29 2018 Petr Lautrbach - 3.3.19-2 +- Use the correct audit plugin path (#1662256) + * Sat Dec 8 2018 Petr Lautrbach - 3.3.19-1 - Require plugins >= 3.3.10 - Update scriptlets to reload auditd after install or uninstall