From d1ab3c4d185ec487b2b502410394829370b7b95e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 17:55:30 +0000 Subject: [PATCH 1/9] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- setroubleshoot.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index 8919eaf..ae0103e 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.36 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/51a9cda747130f92860720841a7fd9c9/setroubleshoot-3.3.36.tar.gz @@ -194,6 +194,9 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 3.3.36-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Thu Dec 11 2025 Vit Mojzis - 3.3.36-2 - browser: Always show "Report Bug" button - Switch libreport to a weak dependency From b1535bd5abf372d5739e877a12e4288458b469a6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 3 Jun 2026 23:53:42 +0200 Subject: [PATCH 2/9] Rebuilt for Python 3.15 --- setroubleshoot.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index ae0103e..f9028e1 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.36 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/51a9cda747130f92860720841a7fd9c9/setroubleshoot-3.3.36.tar.gz @@ -194,6 +194,9 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Wed Jun 03 2026 Python Maint - 3.3.36-4 +- Rebuilt for Python 3.15 + * Sat Jan 17 2026 Fedora Release Engineering - 3.3.36-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 081fabe6be6ec94822928749d5beb89df879278f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 9 Mar 2026 23:17:53 +0100 Subject: [PATCH 3/9] setroubleshoot-3.3.37-1 - Migrate from libxml2 to xml.etree.ElementTree - Handle ImportError when setroubleshoot.browser is not available - Add support for multiple commands in fix_cmd --- .gitignore | 1 + ...rowser-Always-show-Report-Bug-button.patch | 39 ------------------- setroubleshoot.spec | 16 +++++--- sources | 2 +- 4 files changed, 12 insertions(+), 46 deletions(-) delete mode 100644 0001-browser-Always-show-Report-Bug-button.patch diff --git a/.gitignore b/.gitignore index c28da58..91bf858 100644 --- a/.gitignore +++ b/.gitignore @@ -221,3 +221,4 @@ setroubleshoot-2.2.93.tar.gz /setroubleshoot-3.3.34.tar.gz /setroubleshoot-3.3.35.tar.gz /setroubleshoot-3.3.36.tar.gz +/setroubleshoot-3.3.37.tar.gz diff --git a/0001-browser-Always-show-Report-Bug-button.patch b/0001-browser-Always-show-Report-Bug-button.patch deleted file mode 100644 index 346e8b2..0000000 --- a/0001-browser-Always-show-Report-Bug-button.patch +++ /dev/null @@ -1,39 +0,0 @@ -From fb4a884fe6266e664cc886273bad3b2ae761118a Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 11 Dec 2025 13:50:45 +0100 -Subject: [PATCH] browser: Always show "Report Bug" button - -Without python3-libreport the "Report Bug" button was not shown at all. -After this change the button is always visible, but without libreport it -is disabled and the tooltip tells the user how to enable it. - -Signed-off-by: Vit Mojzis ---- - src/setroubleshoot/browser.py | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/src/setroubleshoot/browser.py b/src/setroubleshoot/browser.py -index 73fc26e..47788a7 100644 ---- a/src/setroubleshoot/browser.py -+++ b/src/setroubleshoot/browser.py -@@ -548,11 +548,15 @@ class BrowserApplet: - report_button.connect("clicked", self.fix_bug, alert.local_id, plugin.analysis_id) - vbox.add(report_button) - -- elif plugin.report_bug and has_libreport: -+ elif plugin.report_bug: - report_button = Gtk.Button() - report_button.set_label(_("Report\nBug")) - report_button.show() -- report_button.connect("clicked", self.report_bug, alert) -+ if has_libreport: -+ report_button.connect("clicked", self.report_bug, alert) -+ else: -+ report_button.set_sensitive(False) -+ report_button.set_tooltip_text(_("Please install python3-libreport to enable bug reporting.")) - vbox.add(report_button) - - vbox.set_sensitive(highlight) --- -2.52.0 - diff --git a/setroubleshoot.spec b/setroubleshoot.spec index f9028e1..a0492e8 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -5,16 +5,15 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot -Version: 3.3.36 -Release: 4%{?dist} +Version: 3.3.37 +Release: 1%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot -Source0: https://gitlab.com/-/project/24478376/uploads/51a9cda747130f92860720841a7fd9c9/setroubleshoot-3.3.36.tar.gz +Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz Source1: %{name}.tmpfiles Source2: %{name}.sysusers -# git format-patch -N 3.3.36 +# git format-patch -N 3.3.37 # for j in 00*patch; do printf "Patch: %s\n" $j; done -Patch: 0001-browser-Always-show-Report-Bug-button.patch BuildRequires: gcc BuildRequires: make BuildRequires: libcap-ng-devel @@ -96,7 +95,7 @@ install -p -m644 -D %{SOURCE2} $RPM_BUILD_ROOT%{_sysusersdir}/%{name}.conf %package server Summary: SELinux troubleshoot server -Requires: %{name}-plugins >= 3.3.10 +Requires: %{name}-plugins >= 3.3.15-7 Requires: audit >= 3.0.1 Requires: audit-libs-python3 Requires: libxml2-python3 @@ -194,6 +193,11 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Thu Jun 18 2026 Vit Mojzis - 3.3.37-1 +- Migrate from libxml2 to xml.etree.ElementTree +- Handle ImportError when setroubleshoot.browser is not available +- Add support for multiple commands in fix_cmd + * Wed Jun 03 2026 Python Maint - 3.3.36-4 - Rebuilt for Python 3.15 diff --git a/sources b/sources index e88edea..6718e7e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (setroubleshoot-3.3.36.tar.gz) = 089583970169d4127cf825d8660dc755cb154771b8e48f6b7558f8fa090491ad6ac492f435a8f410c73c46ab1500a203f4123fcda69b1cd7adbf792b5580cb83 +SHA512 (setroubleshoot-3.3.37.tar.gz) = 8b67b28c2e2d2f766c00723f2a67e82fc43079a9a5868c4598f80331bb12ae0e94749cd68fedc718462ae9203e5b9d363033902c699f597a79865d6d31df61cd From 38052ffc8f7298971c2d5c584910a3e86e149240 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Tue, 14 Jul 2026 19:59:10 +0200 Subject: [PATCH 4/9] Remove the obsolete libxml2-python3 dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It is no longer needed after the migration in version 3.3.37. Signed-off-by: Ondrej Mosnáček --- setroubleshoot.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index a0492e8..e42e3a2 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz @@ -98,7 +98,6 @@ Summary: SELinux troubleshoot server Requires: %{name}-plugins >= 3.3.15-7 Requires: audit >= 3.0.1 Requires: audit-libs-python3 -Requires: libxml2-python3 Requires: rpm-python3 Requires: libselinux-python3 >= 2.1.5-1 Requires: policycoreutils-python-utils @@ -193,6 +192,9 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Tue Jul 14 2026 Ondrej Mosnáček - 3.3.37-2 +- Remove the obsolete libxml2-python3 dependency + * Thu Jun 18 2026 Vit Mojzis - 3.3.37-1 - Migrate from libxml2 to xml.etree.ElementTree - Handle ImportError when setroubleshoot.browser is not available From e877718bf64953ece30b6b939fdfa0326989b5a0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 06:25:41 +0000 Subject: [PATCH 5/9] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- setroubleshoot.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index e42e3a2..f0e80dd 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz @@ -192,6 +192,9 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 3.3.37-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Tue Jul 14 2026 Ondrej Mosnáček - 3.3.37-2 - Remove the obsolete libxml2-python3 dependency From 4c02befbcbf9695517fcddb3137c064d80aa2bec Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 22 Jul 2026 10:20:39 +0200 Subject: [PATCH 6/9] Rebuilt for Python 3.15.0b4 ABI change --- setroubleshoot.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index f0e80dd..f859fa4 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz @@ -192,6 +192,9 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Wed Jul 22 2026 Python Maint - 3.3.37-4 +- Rebuilt for Python 3.15.0b4 ABI change + * Fri Jul 17 2026 Fedora Release Engineering - 3.3.37-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild From 240f0409e29f57d3e17616b8ca095e6935e25c31 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 29 Jul 2026 13:04:17 +0200 Subject: [PATCH 7/9] setroubleshoot-3.3.37-5 - Update GPL2 license texts to the latest version - Limit RPC request size in RequestReceiver to prevent memory exhaustion --- ...-license-texts-to-the-latest-version.patch | 443 ++++++++++++++++++ ...t-size-in-RequestReceiver-to-prevent.patch | 80 ++++ setroubleshoot.spec | 10 +- 3 files changed, 531 insertions(+), 2 deletions(-) create mode 100644 0001-Update-GPL2-license-texts-to-the-latest-version.patch create mode 100644 0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch diff --git a/0001-Update-GPL2-license-texts-to-the-latest-version.patch b/0001-Update-GPL2-license-texts-to-the-latest-version.patch new file mode 100644 index 0000000..5674128 --- /dev/null +++ b/0001-Update-GPL2-license-texts-to-the-latest-version.patch @@ -0,0 +1,443 @@ +From 96f8442e292e651437004d78abdbb8586ebb728e Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Tue, 2 Jun 2026 11:15:33 +0200 +Subject: [PATCH] Update GPL2 license texts to the latest version + +Fixes: https://gitlab.com/setroubleshoot/setroubleshoot/-/work_items/6 + + setroubleshoot.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/browser.py + setroubleshoot.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/gui_utils.py + setroubleshoot-server.x86_64: E: incorrect-fsf-address /usr/bin/sealert + setroubleshoot-server.x86_64: E: incorrect-fsf-address /usr/lib/python3.12/site-packages/setroubleshoot/Plugin.py + ... +--- + COPYING | 15 +++++++-------- + src/SetroubleshootPrivileged.py | 5 ++--- + src/config.py.in | 3 +-- + src/default_encoding.c | 3 +-- + src/sealert | 3 +-- + src/seappletlegacy.c | 3 +-- + src/sedbus.c | 3 +-- + src/sedispatch.c | 3 +-- + src/setroubleshoot/Plugin.py | 3 +-- + src/setroubleshoot/__init__.py | 3 +-- + src/setroubleshoot/access_control.py | 3 +-- + src/setroubleshoot/analyze.py | 3 +-- + src/setroubleshoot/audit_data.py | 3 +-- + src/setroubleshoot/avc_audit.py | 3 +-- + src/setroubleshoot/browser.py | 3 +-- + src/setroubleshoot/email_alert.py | 3 +-- + src/setroubleshoot/errcode.py | 3 +-- + src/setroubleshoot/gui_utils.py | 3 +-- + src/setroubleshoot/html_util.py | 3 +-- + src/setroubleshoot/rpc.py | 3 +-- + src/setroubleshoot/rpc_interfaces.py | 3 +-- + src/setroubleshoot/server.py | 3 +-- + src/setroubleshoot/signature.py | 3 +-- + src/setroubleshoot/util.py | 3 +-- + src/setroubleshoot/xml_serialize.py | 3 +-- + src/setroubleshootd | 3 +-- + 26 files changed, 33 insertions(+), 59 deletions(-) + +diff --git a/COPYING b/COPYING +index 623b625..6c6dbab 100644 +--- a/COPYING ++++ b/COPYING +@@ -1,8 +1,8 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + +- Copyright (C) 1989, 1991 Free Software Foundation, Inc. +- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ Copyright (C) 1989, 1991 Free Software Foundation, Inc., ++ + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This + General Public License applies to most of the Free Software + Foundation's software and to any other program whose authors commit to + using it. (Some other Free Software Foundation software is covered by +-the GNU Library General Public License instead.) You can apply it to ++the GNU Lesser General Public License instead.) You can apply it to + your programs, too. + + When we speak of free software, we are referring to freedom, not +@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found. + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License +- along with this program; if not, write to the Free Software +- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ along with this program; if not, see . + + + Also add information on how to contact you by electronic and paper mail. +@@ -330,11 +329,11 @@ necessary. Here is a sample; alter the names: + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + +- , 1 April 1989 +- Ty Coon, President of Vice ++ , 1 April 1989 ++ Moe Ghoul, President of Vice + + This General Public License does not permit incorporating your program into + proprietary programs. If your program is a subroutine library, you may + consider it more useful to permit linking proprietary applications with the +-library. If this is what you want to do, use the GNU Library General ++library. If this is what you want to do, use the GNU Lesser General + Public License instead of this License. +diff --git a/src/SetroubleshootPrivileged.py b/src/SetroubleshootPrivileged.py +index c9f46da..845a006 100644 +--- a/src/SetroubleshootPrivileged.py ++++ b/src/SetroubleshootPrivileged.py +@@ -14,9 +14,8 @@ + # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + # GNU General Public License for more details. + # +-# You should have received a copy of the GNU General Public License along +-# with this program; if not, write to the Free Software Foundation, Inc., +-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, see . + + import signal + from gi.repository import GLib +diff --git a/src/config.py.in b/src/config.py.in +index 48a670a..d8e7e35 100644 +--- a/src/config.py.in ++++ b/src/config.py.in +@@ -14,8 +14,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['config_init', +diff --git a/src/default_encoding.c b/src/default_encoding.c +index 61d6382..75e9930 100644 +--- a/src/default_encoding.c ++++ b/src/default_encoding.c +@@ -15,8 +15,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + */ + + #include +diff --git a/src/sealert b/src/sealert +index c45f4fc..91af079 100755 +--- a/src/sealert ++++ b/src/sealert +@@ -16,8 +16,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import print_function +diff --git a/src/seappletlegacy.c b/src/seappletlegacy.c +index d6ce7ec..1e14482 100644 +--- a/src/seappletlegacy.c ++++ b/src/seappletlegacy.c +@@ -17,8 +17,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++ * along with this program; if not, see . + * + * compile command + * gcc -g sealerttrayicon.c -o sealerttrayicon `pkg-config --cflags --libs gtk+-2.0` -lnotify +diff --git a/src/sedbus.c b/src/sedbus.c +index 702bed7..fd4a860 100644 +--- a/src/sedbus.c ++++ b/src/sedbus.c +@@ -13,8 +13,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + * + * Authors: + * Dan Walsh +diff --git a/src/sedispatch.c b/src/sedispatch.c +index 07d9c90..b1b80fc 100644 +--- a/src/sedispatch.c ++++ b/src/sedispatch.c +@@ -13,8 +13,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ++ * along with this program; if not, see . + * + * Authors: + * Dan Walsh +diff --git a/src/setroubleshoot/Plugin.py b/src/setroubleshoot/Plugin.py +index 3c52b7f..13f31f0 100644 +--- a/src/setroubleshoot/Plugin.py ++++ b/src/setroubleshoot/Plugin.py +@@ -15,8 +15,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import gettext +diff --git a/src/setroubleshoot/__init__.py b/src/setroubleshoot/__init__.py +index ccb6b8b..0fe4d80 100644 +--- a/src/setroubleshoot/__init__.py ++++ b/src/setroubleshoot/__init__.py +@@ -12,6 +12,5 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # +diff --git a/src/setroubleshoot/access_control.py b/src/setroubleshoot/access_control.py +index de16e32..3c2c02b 100644 +--- a/src/setroubleshoot/access_control.py ++++ b/src/setroubleshoot/access_control.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + """Access control for setroubleshoot. For now this is only used for +diff --git a/src/setroubleshoot/analyze.py b/src/setroubleshoot/analyze.py +index d1c7ac6..b2bbce8 100644 +--- a/src/setroubleshoot/analyze.py ++++ b/src/setroubleshoot/analyze.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import print_function +diff --git a/src/setroubleshoot/audit_data.py b/src/setroubleshoot/audit_data.py +index 34cc3b1..d1e03d7 100644 +--- a/src/setroubleshoot/audit_data.py ++++ b/src/setroubleshoot/audit_data.py +@@ -15,8 +15,7 @@ import sys + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['derive_record_format', +diff --git a/src/setroubleshoot/avc_audit.py b/src/setroubleshoot/avc_audit.py +index 5419280..2f61349 100644 +--- a/src/setroubleshoot/avc_audit.py ++++ b/src/setroubleshoot/avc_audit.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = [ +diff --git a/src/setroubleshoot/browser.py b/src/setroubleshoot/browser.py +index 47788a7..d8e9921 100644 +--- a/src/setroubleshoot/browser.py ++++ b/src/setroubleshoot/browser.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from __future__ import absolute_import +diff --git a/src/setroubleshoot/email_alert.py b/src/setroubleshoot/email_alert.py +index 0921b99..8e41124 100644 +--- a/src/setroubleshoot/email_alert.py ++++ b/src/setroubleshoot/email_alert.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['email_alert', +diff --git a/src/setroubleshoot/errcode.py b/src/setroubleshoot/errcode.py +index 2a2aa21..7a925b9 100644 +--- a/src/setroubleshoot/errcode.py ++++ b/src/setroubleshoot/errcode.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + import gettext + from setroubleshoot.config import parse_config_setting, get_config +diff --git a/src/setroubleshoot/gui_utils.py b/src/setroubleshoot/gui_utils.py +index e28673a..cbec874 100644 +--- a/src/setroubleshoot/gui_utils.py ++++ b/src/setroubleshoot/gui_utils.py +@@ -14,8 +14,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + # Needed to silence warnings if X display is not present +diff --git a/src/setroubleshoot/html_util.py b/src/setroubleshoot/html_util.py +index 5021683..c08e5b5 100644 +--- a/src/setroubleshoot/html_util.py ++++ b/src/setroubleshoot/html_util.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 82fc294..2a874ae 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -15,8 +15,7 @@ from __future__ import print_function + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import xml.etree.ElementTree as ET +diff --git a/src/setroubleshoot/rpc_interfaces.py b/src/setroubleshoot/rpc_interfaces.py +index ec7ff50..5a42f0b 100644 +--- a/src/setroubleshoot/rpc_interfaces.py ++++ b/src/setroubleshoot/rpc_interfaces.py +@@ -13,8 +13,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + from setroubleshoot.rpc import rpc_method, rpc_arg_type, rpc_callback, rpc_signal +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index 3369af1..cf0f345 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -16,8 +16,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = ['RunFaultServer', +diff --git a/src/setroubleshoot/signature.py b/src/setroubleshoot/signature.py +index cf675ff..e4fee53 100755 +--- a/src/setroubleshoot/signature.py ++++ b/src/setroubleshoot/signature.py +@@ -17,8 +17,7 @@ from __future__ import print_function + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + import syslog +diff --git a/src/setroubleshoot/util.py b/src/setroubleshoot/util.py +index b6125aa..dd331b7 100755 +--- a/src/setroubleshoot/util.py ++++ b/src/setroubleshoot/util.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + __all__ = [ +diff --git a/src/setroubleshoot/xml_serialize.py b/src/setroubleshoot/xml_serialize.py +index e1adf7f..596e276 100755 +--- a/src/setroubleshoot/xml_serialize.py ++++ b/src/setroubleshoot/xml_serialize.py +@@ -14,8 +14,7 @@ from __future__ import absolute_import + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + + # Escaping +diff --git a/src/setroubleshootd b/src/setroubleshootd +index 3affe3a..2ad355b 100755 +--- a/src/setroubleshootd ++++ b/src/setroubleshootd +@@ -17,8 +17,7 @@ + # GNU General Public License for more details. + # + # You should have received a copy of the GNU General Public License +-# along with this program; if not, write to the Free Software +-# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++# along with this program; if not, see . + # + import sys + import os +-- +2.53.0 + diff --git a/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch b/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch new file mode 100644 index 0000000..b327aac --- /dev/null +++ b/0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch @@ -0,0 +1,80 @@ +From 4ffb87384c1c104f14db183b26d445c1685fb053 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 27 Jul 2026 17:06:52 +0200 +Subject: [PATCH] Limit RPC request size in RequestReceiver to prevent memory + exhaustion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A local attacker could connect to the world-writable setroubleshootd +UNIX socket and send a crafted RPC header with an arbitrarily large +content-length value, then continuously stream body data. Because +RequestReceiver.feed() appended incoming data to feed_buf without any +upper bound and parse_header() trusted the content-length value +directly, memory usage would grow until the daemon was OOM-killed by +the MemoryMax=1G cgroup limit. + +Add size limits at three levels: +- Reject content-length values that are missing, negative, or exceed + MAX_BODY_LEN (1 MiB) in parse_header() +- Reject incomplete headers once feed_buf exceeds MAX_HEADER_LEN + (8 KiB) without a terminator in process() +- Cap total feed_buf size to MAX_HEADER_LEN + MAX_BODY_LEN in feed() + as a catch-all safety net + +All ValueError exceptions propagate to the existing except handler in +handle_client_io(), which logs the error and closes only the offending +client connection — the daemon continues serving other clients. + +Co-Authored-By: Claude Opus 4.6 +--- + src/setroubleshoot/rpc.py | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 2a874ae..aca2d7e 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -710,6 +710,8 @@ class ListeningServer(ConnectionIO): + + + class RequestReceiver: ++ MAX_HEADER_LEN = 8192 ++ MAX_BODY_LEN = 1024 * 1024 + + def __init__(self, dispatchFunc): + self.dispatchFunc = dispatchFunc +@@ -736,6 +738,8 @@ class RequestReceiver: + self.parse_header() + continue + else: ++ if len(self.feed_buf) > self.MAX_HEADER_LEN: ++ raise ValueError("RPC header too large") + # Can't read header till more data arrives + break + if len(self.feed_buf) >= self.headerLen + self.bodyLen: +@@ -754,6 +758,8 @@ class RequestReceiver: + + def feed(self, data): + self.feed_buf += data ++ if len(self.feed_buf) > self.MAX_HEADER_LEN + self.MAX_BODY_LEN: ++ raise ValueError("RPC request exceeds maximum allowed size") + self.process() + + def parse_header(self): +@@ -768,7 +774,11 @@ class RequestReceiver: + begin = match.end() + else: + break ++ if 'content-length' not in self.header: ++ raise ValueError("RPC request missing content-length") + self.bodyLen = int(self.header['content-length']) ++ if self.bodyLen < 0 or self.bodyLen > self.MAX_BODY_LEN: ++ raise ValueError("RPC body length out of range") + + #----------------------------------------------------------------------------- + +-- +2.53.0 + diff --git a/setroubleshoot.spec b/setroubleshoot.spec index f859fa4..9d65143 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,14 +6,16 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz Source1: %{name}.tmpfiles Source2: %{name}.sysusers -# git format-patch -N 3.3.37 +# git format-patch -N 3.3.37 -- . ':!src/sedispatch.h' ':!test' # for j in 00*patch; do printf "Patch: %s\n" $j; done +Patch: 0001-Update-GPL2-license-texts-to-the-latest-version.patch +Patch: 0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch BuildRequires: gcc BuildRequires: make BuildRequires: libcap-ng-devel @@ -192,6 +194,10 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Wed Jul 29 2026 Vit Mojzis - 3.3.37-5 +- Update GPL2 license texts to the latest version +- Limit RPC request size in RequestReceiver to prevent memory exhaustion + * Wed Jul 22 2026 Python Maint - 3.3.37-4 - Rebuilt for Python 3.15.0b4 ABI change From 4c42798af0f657f681c258f524a2f6578a627788 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 7 Aug 2026 20:01:19 +0200 Subject: [PATCH 8/9] setroubleshoot-3.3.37-6 - Require privileged access to change email alert recipients - Protect against malicious socket blocking - Require root to delete alerts via D-Bus - Fix port handling - Reject logon() when peer credentials are unavailable - Restrict RPC dispatch to registered methods only --- ...-dispatch-to-registered-methods-only.patch | 75 +++++++++++++++++++ ...hen-peer-credentials-are-unavailable.patch | 34 +++++++++ 0005-Fix-port-handling.patch | 73 ++++++++++++++++++ ...uire-root-to-delete-alerts-via-D-Bus.patch | 50 +++++++++++++ ...ct-against-malicious-socket-blocking.patch | 55 ++++++++++++++ ...ed-access-to-change-email-alert-reci.patch | 38 ++++++++++ setroubleshoot.spec | 16 +++- 7 files changed, 340 insertions(+), 1 deletion(-) create mode 100644 0003-Restrict-RPC-dispatch-to-registered-methods-only.patch create mode 100644 0004-Reject-logon-when-peer-credentials-are-unavailable.patch create mode 100644 0005-Fix-port-handling.patch create mode 100644 0006-Require-root-to-delete-alerts-via-D-Bus.patch create mode 100644 0007-Protect-against-malicious-socket-blocking.patch create mode 100644 0008-Require-privileged-access-to-change-email-alert-reci.patch diff --git a/0003-Restrict-RPC-dispatch-to-registered-methods-only.patch b/0003-Restrict-RPC-dispatch-to-registered-methods-only.patch new file mode 100644 index 0000000..907db11 --- /dev/null +++ b/0003-Restrict-RPC-dispatch-to-registered-methods-only.patch @@ -0,0 +1,75 @@ +From 431d5a9a5f7ac4ce61210f4e21ecc64e79c8b31a Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 27 Jul 2026 18:20:44 +0200 +Subject: [PATCH] Restrict RPC dispatch to registered methods only + +get_method_implementation() used unrestricted getattr() to resolve +attacker-controlled method names on handler objects. Since server.py +binds the full connection object as the RPC handler via +connect_rpc_interface('SETroubleshootServer', self), all inherited +internal methods (acquire_write_lock, close_connection, etc.) became +callable through crafted RPC requests. + +An attacker could connect to the world-writable UNIX socket and invoke +acquire_write_lock as a signal, then send any RPC method call. The +response path calls send_data() which tries to acquire the same +non-reentrant threading.Lock, deadlocking the daemon and making it +unresponsive to all clients. + +Validate the requested method name against interface_registry before +calling getattr(). The method must exist in the registry with an +rpc_def.type matching the expected RPC type ('method' or 'signal'). +Unregistered names now fall through to the existing "not implemented" +error response instead of being dispatched. The expected_type parameter +defaults to None for backward compatibility with any callers outside +default_request_handler. + +Co-Authored-By: Claude Opus 4.6 +--- + src/setroubleshoot/rpc.py | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index aca2d7e..6a6f31a 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -869,10 +869,17 @@ class RpcChannel(ConnectionIO, RpcManage): + result_code, result_msg) + self.io_watch_remove() + +- def get_method_implementation(self, interface, method): ++ def get_method_implementation(self, interface, method, expected_type=None): + handler_obj = self.rpc_handlers.get(interface, None) + if handler_obj is None: + return None ++ if expected_type is not None: ++ interface_dict = interface_registry.interfaces.get(interface) ++ if interface_dict is None: ++ return None ++ rpc_def = interface_dict.get(method) ++ if rpc_def is None or rpc_def.type != expected_type: ++ return None + method_ptr = getattr(handler_obj, method, None) + return method_ptr + +@@ -971,7 +978,7 @@ class RpcChannel(ConnectionIO, RpcManage): + self.handle_return(type, rpc_id, body) + elif type == 'method': + interface, method, args = convert_rpc_xml_to_args(body) +- method_ptr = self.get_method_implementation(interface, method) ++ method_ptr = self.get_method_implementation(interface, method, 'method') + if method_ptr: + try: + return_args = method_ptr(*args) +@@ -990,7 +997,7 @@ class RpcChannel(ConnectionIO, RpcManage): + self.emit_rpc(rpc_id, 'error_return', rpc_error_def, method, err_code, err_msg) + elif type == 'signal': + interface, method, args = convert_rpc_xml_to_args(body) +- method_ptr = self.get_method_implementation(interface, method) ++ method_ptr = self.get_method_implementation(interface, method, 'signal') + if method_ptr: + try: + method_ptr(*args) +-- +2.53.0 + diff --git a/0004-Reject-logon-when-peer-credentials-are-unavailable.patch b/0004-Reject-logon-when-peer-credentials-are-unavailable.patch new file mode 100644 index 0000000..f56b7c6 --- /dev/null +++ b/0004-Reject-logon-when-peer-credentials-are-unavailable.patch @@ -0,0 +1,34 @@ +From 920ca71562e462ed4d1d02f3ce1b35dec33bd1bb Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 7 Aug 2026 14:57:21 +0200 +Subject: [PATCH] Reject logon() when peer credentials are unavailable + +get_credentials() returns uid=None for non-Unix client sockets (e.g. an +INET/TCP listener). logon() then compared the supplied username against +get_identity(None), which falls back to os.getuid() -- the daemon's own +uid -- letting any caller authenticate as the 'setroubleshoot' account +without a valid password on such a listener. Refuse logon outright when +peer credentials could not be obtained. + +Co-Authored-By: Claude Sonnet 5 +--- + src/setroubleshoot/server.py | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index cf0f345..bc38fa3 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -324,6 +324,9 @@ class SetroubleshootdClientConnectionHandler(ClientConnectionHandler, + def logon(self, type, username, password): + log_debug("logon(%s) type=%s username=%s" % (self, type, username)) + ++ if self.uid is None: ++ raise ProgramError(ERR_USER_LOOKUP, detail="peer credentials unavailable; refusing logon on non-unix socket") ++ + if username != get_identity(self.uid): + raise ProgramError(ERR_USER_LOOKUP, detail="uid=%s does not match logon username (%s)" % (self.uid, username)) + +-- +2.53.0 + diff --git a/0005-Fix-port-handling.patch b/0005-Fix-port-handling.patch new file mode 100644 index 0000000..b3be645 --- /dev/null +++ b/0005-Fix-port-handling.patch @@ -0,0 +1,73 @@ +From 49f3d79ff621e7cf3876cea759ded665cd192528 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 7 Aug 2026 14:58:20 +0200 +Subject: [PATCH] Fix port handling + +- Cast parsed port to int in SocketAddress.parse_inet_addr() + +An explicit port in an {inet} address (e.g. "{inet}127.0.0.1:16983") was +kept as the raw regex-matched string instead of being converted to int. +socket.bind() requires an int port for AF_INET, so any configured +INET/TCP listener with an explicit port failed with TypeError, silently +swallowed by ListeningServer.open()'s exception handler, leaving the +daemon running with no client listener at all. + +- Forward the configured default port in get_socket_list_from_config() + +parse_socket_address_list() defaults its default_port parameter to None, +and get_socket_list_from_config() called it without passing one through, +so any {inet} address with no explicit port (e.g. "{inet}127.0.0.1") ended +up with SocketAddress.port = None instead of the configured +connection.default_port, causing socket.bind() to fail with TypeError. + +- Fix invalid default connection.default_port value + +The shipped default was '69783' with a comment acknowledging it was a +placeholder ("FIXME: figure out defined port"). 69783 exceeds the valid +TCP port range (0-65535), so any {inet} listen_for_client/client_connect_to +address with no explicit port failed with OverflowError on bind()/connect(). + +Co-Authored-By: Claude Sonnet 5 +--- + src/config.py.in | 2 +- + src/setroubleshoot/rpc.py | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/config.py.in b/src/config.py.in +index d8e7e35..603a107 100644 +--- a/src/config.py.in ++++ b/src/config.py.in +@@ -182,7 +182,7 @@ An empty string implies no limit''', + }, + 'connection': { + 'default_port': { +- 'value': '69783', # FIXME: figure out defined port, ++ 'value': '16983', + 'description': '', + }, + }, +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 6a6f31a..142228f 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -100,7 +100,7 @@ def get_default_port(): + + def get_socket_list_from_config(cfg_section): + addr_string = get_config(cfg_section, 'address_list') +- socket_addresses = parse_socket_address_list(addr_string) ++ socket_addresses = parse_socket_address_list(addr_string, get_default_port()) + return socket_addresses + + +@@ -577,6 +577,8 @@ class SocketAddress(object): + port = match.group(3) + if port is None: + port = self.default_port ++ else: ++ port = int(port) + + if addr == 'hostname': + addr = get_hostname() +-- +2.53.0 + diff --git a/0006-Require-root-to-delete-alerts-via-D-Bus.patch b/0006-Require-root-to-delete-alerts-via-D-Bus.patch new file mode 100644 index 0000000..8d025d8 --- /dev/null +++ b/0006-Require-root-to-delete-alerts-via-D-Bus.patch @@ -0,0 +1,50 @@ +From 66942f3b55339e59f768952312548e7eab3d19ca Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 7 Aug 2026 17:44:46 +0200 +Subject: [PATCH] Require root to delete alerts via D-Bus + +delete_alert() removed an alert from the shared host database without +checking the caller's identity, and the shipped D-Bus policy allowed any +local user to invoke it. An unprivileged local user could enumerate alerts +with get_all_alerts and delete entries other users/administrators rely on. + +Reject non-root callers in delete_alert() itself, and drop delete_alert +from the default D-Bus policy context as defense in depth (root already +has full access via the existing rule). + +Co-Authored-By: Claude Sonnet 5 +--- + org.fedoraproject.Setroubleshootd.conf | 3 --- + src/setroubleshoot/server.py | 2 ++ + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/org.fedoraproject.Setroubleshootd.conf b/org.fedoraproject.Setroubleshootd.conf +index 65a0daa..910958a 100644 +--- a/org.fedoraproject.Setroubleshootd.conf ++++ b/org.fedoraproject.Setroubleshootd.conf +@@ -35,9 +35,6 @@ + +- + + +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index bc38fa3..dc29f63 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -665,6 +665,8 @@ Deletes an alert from the database. + + * `success(b)`: + """ ++ if self.connection.get_unix_user(sender) != 0: ++ return False + try: + database = get_host_database() + alert = self._get_alert(local_id, database) +-- +2.53.0 + diff --git a/0007-Protect-against-malicious-socket-blocking.patch b/0007-Protect-against-malicious-socket-blocking.patch new file mode 100644 index 0000000..6ddc0ee --- /dev/null +++ b/0007-Protect-against-malicious-socket-blocking.patch @@ -0,0 +1,55 @@ +From c30163055995cff80222899a35722819d8286417 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 7 Aug 2026 18:03:16 +0200 +Subject: [PATCH] Protect against malicious socket blocking + +Set a timeout (socket.timeout config, 5s default) on accepted client +sockets so a stuck send() eventually times out instead of hanging forever +(send_data() already had a Socket.timeout handler for this). As a second, +independent layer, skip clients that have not completed logon() in both +places that fan data out to the 'sealert' pool: send_alert_notification() +and ClientNotifier.signatures_updated(). + +Co-Authored-By: Claude Sonnet 5 +--- + src/setroubleshoot/rpc.py | 1 + + src/setroubleshoot/server.py | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/src/setroubleshoot/rpc.py b/src/setroubleshoot/rpc.py +index 142228f..ecfd062 100755 +--- a/src/setroubleshoot/rpc.py ++++ b/src/setroubleshoot/rpc.py +@@ -687,6 +687,7 @@ class ListeningServer(ConnectionIO): + try: + client_socket, client_address = socket.accept() + fcntl.fcntl(client_socket.fileno(), fcntl.F_SETFD, fcntl.FD_CLOEXEC) ++ client_socket.settimeout(RpcChannel.socket_timeout) + client_handler = self.client_connection_handler_class(self.socket_address) + client_handler.open(client_socket, client_address) + self.connection_state.update(0, ConnectionState.PROBLEM_FLAGS) +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index dc29f63..6adc0c2 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -149,6 +149,8 @@ def send_alert_notification(siginfo): + system_bus.send_message(alert) + + for client in connection_pool.clients('sealert'): ++ if not (client.connection_state.flags & ConnectionState.AUTHENTICATED): ++ continue + client.alert(siginfo) + + #------------------------------ Variables ------------------------------- +@@ -445,6 +447,8 @@ class ClientNotifier(object): + + def signatures_updated(self, type, item): + for client in self.connection_pool.clients('sealert'): ++ if not (client.connection_state.flags & ConnectionState.AUTHENTICATED): ++ continue + client.signatures_updated(type, item) + + +-- +2.53.0 + diff --git a/0008-Require-privileged-access-to-change-email-alert-reci.patch b/0008-Require-privileged-access-to-change-email-alert-reci.patch new file mode 100644 index 0000000..f6dce69 --- /dev/null +++ b/0008-Require-privileged-access-to-change-email-alert-reci.patch @@ -0,0 +1,38 @@ +From 271fcfc09a53fba13b0e31df18acdc5d2605cf05 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 7 Aug 2026 18:05:56 +0200 +Subject: [PATCH] Require privileged access to change email alert recipients + +set_email_recipients() only checked that the RPC connection was +authenticated, not that the caller was privileged. Since logon() grants +authenticated state to any local user allowed to run the sealert client +(client_users='*' by default) and never verifies the supplied password, +any such user could overwrite the daemon-wide email_alert_recipients file +that controls where SELinux alert emails are sent. + +Reuse the existing fix_cmd privilege model (already used to gate running +alert fix commands as root) to restrict this to root and users listed in +fix_cmd_users. + +Co-Authored-By: Claude Sonnet 5 +--- + src/setroubleshoot/server.py | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/setroubleshoot/server.py b/src/setroubleshoot/server.py +index 6adc0c2..bf7a294 100755 +--- a/src/setroubleshoot/server.py ++++ b/src/setroubleshoot/server.py +@@ -364,6 +364,9 @@ class SetroubleshootdClientConnectionHandler(ClientConnectionHandler, + if not (self.connection_state.flags & ConnectionState.AUTHENTICATED): + raise ProgramError(ERR_NOT_AUTHENTICATED) + ++ if self.uid != 0 and not self.access.user_allowed('fix_cmd', self.username): ++ raise ProgramError(ERR_USER_PROHIBITED) ++ + email_recipients = recipients + email_recipients.write_recipient_file(email_recipients_filepath) + +-- +2.53.0 + diff --git a/setroubleshoot.spec b/setroubleshoot.spec index 9d65143..7056f56 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -6,7 +6,7 @@ Summary: Helps troubleshoot SELinux problems Name: setroubleshoot Version: 3.3.37 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz @@ -16,6 +16,12 @@ Source2: %{name}.sysusers # for j in 00*patch; do printf "Patch: %s\n" $j; done Patch: 0001-Update-GPL2-license-texts-to-the-latest-version.patch Patch: 0002-Limit-RPC-request-size-in-RequestReceiver-to-prevent.patch +Patch: 0003-Restrict-RPC-dispatch-to-registered-methods-only.patch +Patch: 0004-Reject-logon-when-peer-credentials-are-unavailable.patch +Patch: 0005-Fix-port-handling.patch +Patch: 0006-Require-root-to-delete-alerts-via-D-Bus.patch +Patch: 0007-Protect-against-malicious-socket-blocking.patch +Patch: 0008-Require-privileged-access-to-change-email-alert-reci.patch BuildRequires: gcc BuildRequires: make BuildRequires: libcap-ng-devel @@ -194,6 +200,14 @@ to user preference. The same tools can be run on existing log files. %doc AUTHORS COPYING ChangeLog DBUS.md NEWS README TODO %changelog +* Fri Aug 07 2026 Vit Mojzis - 3.3.37-6 +- Require privileged access to change email alert recipients +- Protect against malicious socket blocking +- Require root to delete alerts via D-Bus +- Fix port handling +- Reject logon() when peer credentials are unavailable +- Restrict RPC dispatch to registered methods only + * Wed Jul 29 2026 Vit Mojzis - 3.3.37-5 - Update GPL2 license texts to the latest version - Limit RPC request size in RequestReceiver to prevent memory exhaustion From ca36a2c905c132c0d7e4489e0337bba4ac587b46 Mon Sep 17 00:00:00 2001 From: jan janasek Date: Mon, 7 Sep 2026 13:57:03 +0200 Subject: [PATCH 9/9] Add VCS tag to spec file --- setroubleshoot.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/setroubleshoot.spec b/setroubleshoot.spec index 7056f56..a1ad19c 100644 --- a/setroubleshoot.spec +++ b/setroubleshoot.spec @@ -9,6 +9,7 @@ Version: 3.3.37 Release: 6%{?dist} License: GPL-2.0-or-later URL: https://gitlab.com/setroubleshoot/setroubleshoot +VCS: git:https://gitlab.com/setroubleshoot/setroubleshoot.git Source0: https://gitlab.com/-/project/24478376/uploads/cbdfc2a87b350583c32b168fd9aad9fd/setroubleshoot-3.3.37.tar.gz Source1: %{name}.tmpfiles Source2: %{name}.sysusers