From db3c086423a403184a1b85b9e414059aefc38e0d Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 25 Feb 2019 23:08:35 +0100 Subject: [PATCH 01/14] * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system --- sources | 2 +- udica.spec | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/sources b/sources index cbd8a1c..25beb93 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603 +SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 diff --git a/udica.spec b/udica.spec index fec2d6d..0474261 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 +- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 +- Add check if runtimes are installed on the system + * Sun Feb 17 2019 Lukas Vrabec - 0.1.3-3 - Improve capability parsing for docker containers - Update small changes in manpage, like issue with mandatory option '-c' for docker containers From d344b9b33c46eea1f2210e65b7ec51c8ab0e825d Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 11 Mar 2019 13:44:57 +0100 Subject: [PATCH 02/14] * Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 - Fix minor problems reported by pylint #11 - Catch FileNotFoundError when inspecting containers #12 - Create basic tests #13 - Restore working directory #14 - udica cannot use the container ID once it is provided #10 --- .gitignore | 1 + sources | 2 +- udica.spec | 11 +++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a5b182f..a75055a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /v0.1.1.tar.gz /v0.1.2.tar.gz /v0.1.3.tar.gz +/v0.1.4.tar.gz diff --git a/sources b/sources index 25beb93..eb5bafb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 +SHA512 (v0.1.4.tar.gz) = 08afb8b16bbc44c87bc8ec0c91f9893650c9e47a94f8c1f75750ec98ae08bc23a00b25b99968481e7a296d6e3232d17a29358fbfc91f1e15af1e3225b2f5a7c9 diff --git a/udica.spec b/udica.spec index 0474261..7b3dccc 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.3 -Release: 4%{?dist} +Version: 0.1.4 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 +- Fix minor problems reported by pylint #11 +- Catch FileNotFoundError when inspecting containers #12 +- Create basic tests #13 +- Restore working directory #14 +- udica cannot use the container ID once it is provided #10 + * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system From cc59b9be09a7620c1c88d24e6820ab95b9acfc4a Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 19 Apr 2019 20:55:39 +0200 Subject: [PATCH 03/14] * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 - Create mock selinux and semanage module - Update testing section in README - Add travis file for Travis CI - Grammar fixes in the udica.8 manpage file - Support port ranges (Resolves: #16) - Test port ranges --- udica.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 7b3dccc..ebea20e 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.4 +Version: 0.1.5 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -58,6 +58,14 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 +- Create mock selinux and semanage module +- Update testing section in README +- Add travis file for Travis CI +- Grammar fixes in the udica.8 manpage file +- Support port ranges (Resolves: #16) +- Test port ranges + * Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 - Fix minor problems reported by pylint #11 - Catch FileNotFoundError when inspecting containers #12 From 87f60ab48db333cc401bee6c45bc60d62e22691a Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 19 Apr 2019 21:00:06 +0200 Subject: [PATCH 04/14] Add missing sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index a75055a..3971a54 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /v0.1.2.tar.gz /v0.1.3.tar.gz /v0.1.4.tar.gz +/v0.1.5.tar.gz diff --git a/sources b/sources index eb5bafb..33dcb37 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.4.tar.gz) = 08afb8b16bbc44c87bc8ec0c91f9893650c9e47a94f8c1f75750ec98ae08bc23a00b25b99968481e7a296d6e3232d17a29358fbfc91f1e15af1e3225b2f5a7c9 +SHA512 (v0.1.5.tar.gz) = 38cb9b0c9d42f807d05811631d460af80e65db5631e53230ea129d79d9844eeddc9c3f63ff17c121150afb1319b08cf6da085ce3e18945f4bf76b844365f741c From 131debfd6e6b9b471975dbfe988313c898062737 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 30 Apr 2019 14:12:42 +0200 Subject: [PATCH 05/14] * Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 - Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. --- ...for-container_runtime_t-to-base_cont.patch | 29 +++++++++++++++++++ udica.spec | 6 +++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch diff --git a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch new file mode 100644 index 0000000..14761cb --- /dev/null +++ b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch @@ -0,0 +1,29 @@ +From 129555625ceca2d73faf862501c10fb3ee49b473 Mon Sep 17 00:00:00 2001 +From: Jan Zarsky +Date: Tue, 30 Apr 2019 11:41:10 +0200 +Subject: [PATCH] Add allow rules for container_runtime_t to base_container.cil + +Podman version 1.2.0 requires new allow rules. + +Fixes: +type=AVC msg=audit(1556617434.540:447): avc: denied { create } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:448): avc: denied { search } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:449): avc: denied { view } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:450): avc: denied { setattr } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +--- + udica/templates/base_container.cil | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/udica/templates/base_container.cil b/udica/templates/base_container.cil +index 88bb39b..ab9b776 100644 +--- a/udica/templates/base_container.cil ++++ b/udica/templates/base_container.cil +@@ -5,4 +5,5 @@ + (typeattributeset container_domain (process )) + (allow process proc_type (file (getattr open read))) + (allow process cpu_online_t (file (getattr open read))) ++(allow container_runtime_t process (key (create link read search setattr view write))) + ) +-- +2.20.1 + diff --git a/udica.spec b/udica.spec index ebea20e..17759af 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.5 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,6 +13,7 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +patch00: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch %description Tool for generating SELinux security profiles for containers based on @@ -20,6 +21,7 @@ inspection of container JSON file. %prep %setup -q +%patch00 -p1 %build %if 0%{?fedora} || 0%{?rhel} > 7 @@ -58,6 +60,8 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 +- Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 - Create mock selinux and semanage module - Update testing section in README From 71480f46bc5af5f183eecbd549379cc6d00b415a Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 16 May 2019 19:46:16 +0200 Subject: [PATCH 06/14] * Thu May 16 2019 Lukas Vrabec - 0.1.6-1 - New rebase with upstream adding new tests --- .gitignore | 1 + ...for-container_runtime_t-to-base_cont.patch | 29 ------------------- sources | 2 +- udica.spec | 9 +++--- 4 files changed, 7 insertions(+), 34 deletions(-) delete mode 100644 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch diff --git a/.gitignore b/.gitignore index 3971a54..0aad5ab 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /v0.1.3.tar.gz /v0.1.4.tar.gz /v0.1.5.tar.gz +/v0.1.6.tar.gz diff --git a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch deleted file mode 100644 index 14761cb..0000000 --- a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 129555625ceca2d73faf862501c10fb3ee49b473 Mon Sep 17 00:00:00 2001 -From: Jan Zarsky -Date: Tue, 30 Apr 2019 11:41:10 +0200 -Subject: [PATCH] Add allow rules for container_runtime_t to base_container.cil - -Podman version 1.2.0 requires new allow rules. - -Fixes: -type=AVC msg=audit(1556617434.540:447): avc: denied { create } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:448): avc: denied { search } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:449): avc: denied { view } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:450): avc: denied { setattr } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 ---- - udica/templates/base_container.cil | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/udica/templates/base_container.cil b/udica/templates/base_container.cil -index 88bb39b..ab9b776 100644 ---- a/udica/templates/base_container.cil -+++ b/udica/templates/base_container.cil -@@ -5,4 +5,5 @@ - (typeattributeset container_domain (process )) - (allow process proc_type (file (getattr open read))) - (allow process cpu_online_t (file (getattr open read))) -+(allow container_runtime_t process (key (create link read search setattr view write))) - ) --- -2.20.1 - diff --git a/sources b/sources index 33dcb37..c6861a0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.5.tar.gz) = 38cb9b0c9d42f807d05811631d460af80e65db5631e53230ea129d79d9844eeddc9c3f63ff17c121150afb1319b08cf6da085ce3e18945f4bf76b844365f741c +SHA512 (v0.1.6.tar.gz) = 1da3cd6e6c4a70b9ad76f3ccc6eb5f2418544ab778ec07145d1c44a7df6092d769a0afe4335e3b8afac444399e7fa720de65d1dfe2badb9a232ed70a3ea36386 diff --git a/udica.spec b/udica.spec index 17759af..6f5bf0f 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.5 -Release: 2%{?dist} +Version: 0.1.6 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,7 +13,6 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch00: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch %description Tool for generating SELinux security profiles for containers based on @@ -21,7 +20,6 @@ inspection of container JSON file. %prep %setup -q -%patch00 -p1 %build %if 0%{?fedora} || 0%{?rhel} > 7 @@ -60,6 +58,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu May 16 2019 Lukas Vrabec - 0.1.6-1 +- New rebase with upstream adding new tests + * Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 - Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 From 8842eae9f8cf2d7f2c96fe336c563d5885054166 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 11 Jun 2019 12:24:31 +0200 Subject: [PATCH 07/14] Backport CI tests from rawhide --- tests/docker/runtest.sh | 65 ++++++++++++++++++++ tests/sanity/runtest.sh | 127 ++++++++++++++++++++++++++++++++++++++++ tests/tests.yml | 25 ++++++++ 3 files changed, 217 insertions(+) create mode 100755 tests/docker/runtest.sh create mode 100755 tests/sanity/runtest.sh create mode 100644 tests/tests.yml diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh new file mode 100755 index 0000000..c2290d5 --- /dev/null +++ b/tests/docker/runtest.sh @@ -0,0 +1,65 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Compare udica output between podman and docker +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="udica" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "udica" + rlAssertRpm "policycoreutils" + rlAssertRpm "podman" + rlAssertRpm "docker" + rlRun "rlServiceStart docker" + OUTPUT_FILE=$(mktemp) + rlPhaseEnd + + rlPhaseStartTest + for BACKEND in podman docker ; do + rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "$BACKEND ps | grep test" + CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1) + rlRun "udica -i $CONT_ID my_container" + rlRun "mv my_container.cil my_cont_$BACKEND.cil" + rlRun "$BACKEND stop test" + rlRun "$BACKEND rm test" + done + + rlRun "sed -i '/capability/d' my_cont_podman.cil" + rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil" + + rlRun "rm my_cont_podman.cil my_cont_docker.cil" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $OUTPUT_FILE" + rlRun "rlServiceRestore docker" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh new file mode 100755 index 0000000..5c66cfe --- /dev/null +++ b/tests/sanity/runtest.sh @@ -0,0 +1,127 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test basic functionality of udica +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="udica" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "udica" + rlAssertRpm "policycoreutils" + rlAssertRpm "podman" + OUTPUT_FILE=$(mktemp) + rlPhaseEnd + + rlPhaseStartTest + rlRun "udica --help" + rlRun "PAGER=cat man udica" + rlPhaseEnd + + rlPhaseStartTest "Test basic scenario" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep container_t" + + rlRun "podman exec test ls /home" 1,2 + rlRun "podman exec test touch /var/spool/test" 1 + rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" + rlRun "podman stop test" + rlRun "podman rm test" + + rlRun "cat $OUTPUT_FILE" + rlAssertExists "my_container.cil" + SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2) + rlRun "$SEMODULE" + + PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2) + rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test2" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep my_container.process" + + rlRun "podman exec test2 ls /home" 0 + rlRun "podman exec test2 touch /var/spool/test" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3 + + rlRun "podman stop test2" + rlRun "podman rm test2" + + rlRun "semodule -r my_container base_container net_container home_container" + rlRun "rm my_container.cil" + rlPhaseEnd + + rlPhaseStartTest "Compare different ways of obtaining policy" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica my_container >pipe.result" + + rlRun "podman inspect $CONT_ID >container.json" + rlRun "udica -j container.json my_container >json.result" + + rlRun "udica -i $CONT_ID my_container >id.result" + + rlRun "diff pipe.result json.result" + rlRun "diff pipe.result id.result" + + rlRun "rm -f pipe.result json.result id.result container.json" + rlRun "podman stop test" + rlRun "podman rm test" + rlPhaseEnd + + rlPhaseStartTest "Test loading modules" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica -l my_container" + + rlRun "podman stop test" + rlRun "podman rm test" + + rlRun "semodule -l >$OUTPUT_FILE" + rlAssertGrep "my_container" $OUTPUT_FILE + rlAssertGrep "base_container" $OUTPUT_FILE + rlAssertGrep "net_container" $OUTPUT_FILE + rlAssertGrep "home_container" $OUTPUT_FILE + + rlRun "semodule -r my_container base_container net_container home_container" + rlRun "rm my_container.cil" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $OUTPUT_FILE" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..355fc5d --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,25 @@ +- hosts: localhost + tags: + - classic + - container + roles: + - role: standard-test-source + + - role: standard-test-basic + required_packages: + - python3 + tests: + - smoke: + dir: ./source/tests + run: python3 -m unittest + - smoke2: + dir: ./source/tests + run: python3 test_main.py selinux_enabled + + - role: standard-test-beakerlib + tags: + - classic + tests: + - sanity + required_packages: + - podman From 456cd05633c00ee5b84ae882c8d215b330c8e13b Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 12 Jun 2019 13:54:49 +0200 Subject: [PATCH 08/14] * Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 - New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 --- .gitignore | 1 + sources | 2 +- udica.spec | 7 ++++++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0aad5ab..d314a70 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /v0.1.4.tar.gz /v0.1.5.tar.gz /v0.1.6.tar.gz +/v0.1.7.tar.gz diff --git a/sources b/sources index c6861a0..a3976f7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.6.tar.gz) = 1da3cd6e6c4a70b9ad76f3ccc6eb5f2418544ab778ec07145d1c44a7df6092d769a0afe4335e3b8afac444399e7fa720de65d1dfe2badb9a232ed70a3ea36386 +SHA512 (v0.1.7.tar.gz) = 010dd2b7583a9b6598149395cd16038ff6fbf56c02c739c58903fc55e5651e35e83cdc54c8463ed0a3efe3919c1afd8d98fd6118cc01e76f5aeff6e7213283f6 diff --git a/udica.spec b/udica.spec index 6f5bf0f..f3e1e84 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.6 +Version: 0.1.7 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -44,7 +44,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_mandir}/man8/udica.8* %{_bindir}/udica %dir %{_datadir}/udica +%dir %{_datadir}/udica/ansible %dir %{_datadir}/udica/templates +%{_datadir}/udica/ansible/* %{_datadir}/udica/templates/* %if 0%{?fedora} || 0%{?rhel} > 7 @@ -58,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 +- New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 + * Thu May 16 2019 Lukas Vrabec - 0.1.6-1 - New rebase with upstream adding new tests From 000c328688390c3bc3331a1057598ec8b9f74169 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 11 Jul 2019 13:08:38 +0200 Subject: [PATCH 09/14] * Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 - New rebase https://github.com/containers/udica/releases/tag/v0.1.8 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d314a70..1990382 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /v0.1.5.tar.gz /v0.1.6.tar.gz /v0.1.7.tar.gz +/v0.1.8.tar.gz diff --git a/sources b/sources index a3976f7..4fb2ded 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.7.tar.gz) = 010dd2b7583a9b6598149395cd16038ff6fbf56c02c739c58903fc55e5651e35e83cdc54c8463ed0a3efe3919c1afd8d98fd6118cc01e76f5aeff6e7213283f6 +SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891 diff --git a/udica.spec b/udica.spec index f3e1e84..aae79fe 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.7 +Version: 0.1.8 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.1.8 + * Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 - New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 From ca57c4d9a682272ada540eec6998f0d738ed08b3 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 28 Aug 2019 13:04:39 +0200 Subject: [PATCH 10/14] * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 --- .gitignore | 1 + ...t_basic.podman.cil-test_basic.docker.patch | 61 +++++++++++++++++++ sources | 2 +- udica.spec | 7 ++- 4 files changed, 69 insertions(+), 2 deletions(-) create mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/.gitignore b/.gitignore index 1990382..0da17d5 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /v0.1.6.tar.gz /v0.1.7.tar.gz /v0.1.8.tar.gz +/v0.1.9.tar.gz diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch new file mode 100644 index 0000000..eda87e3 --- /dev/null +++ b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch @@ -0,0 +1,61 @@ +From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 +From: Lukas Vrabec +Date: Tue, 27 Aug 2019 21:20:16 +0200 +Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. + Round 2 + +Because of the new versions of SELinux policy in Fedora 30 and Fedora +Rawhide, also several tests in Udica needed to be fixed to use new +labels. +--- + tests/semanage.py | 1 - + tests/test_basic.docker.cil | 3 --- + tests/test_basic.podman.cil | 5 +---- + 3 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/tests/semanage.py b/tests/semanage.py +index f64fda4..318a46a 100644 +--- a/tests/semanage.py ++++ b/tests/semanage.py +@@ -156,7 +156,6 @@ fcontexts_homedirs = [ + ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), +- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), + ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') + ] + +diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil +index b29cb32..220c53b 100644 +--- a/tests/test_basic.docker.cil ++++ b/tests/test_basic.docker.cil +@@ -285,9 +285,6 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil +index 06b44e3..618fe07 100644 +--- a/tests/test_basic.podman.cil ++++ b/tests/test_basic.podman.cil +@@ -287,10 +287,7 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +-) +\ No newline at end of file ++) +-- +2.21.0 + diff --git a/sources b/sources index 4fb2ded..34d429b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891 +SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 diff --git a/udica.spec b/udica.spec index aae79fe..fc6f028 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.8 +Version: 0.1.9 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -13,6 +13,7 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on @@ -60,6 +61,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 +- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 +- New rebase https://github.com/containers/udica/releases/tag/v0.1.9 + * Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 - New rebase https://github.com/containers/udica/releases/tag/v0.1.8 From 94421540e20a7467de43256c8358692a08c856ef Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 27 Aug 2019 20:58:23 +0200 Subject: [PATCH 11/14] Fix sanity test suite Fix sanity test to pass on Fedora Rawhide and Fedora 30. Changes are related to missing 'nc' command in container for which SELinux policy is generated. --- tests/sanity/runtest.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index 5c66cfe..c8c5f34 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -51,12 +51,13 @@ rlJournalStart rlRun "podman exec test ls /home" 1,2 rlRun "podman exec test touch /var/spool/test" 1 + rlRun "podman exec test dnf install nmap-ncat -y" 0 rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" rlRun "podman stop test" - rlRun "podman rm test" + rlRun "podman rm --force test" rlRun "cat $OUTPUT_FILE" rlAssertExists "my_container.cil" @@ -71,10 +72,11 @@ rlJournalStart rlRun "podman exec test2 ls /home" 0 rlRun "podman exec test2 touch /var/spool/test" 0 - rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3 + rlRun "podman exec test2 dnf install nmap-ncat -y" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3 rlRun "podman stop test2" - rlRun "podman rm test2" + rlRun "podman rm --force test2" rlRun "semodule -r my_container base_container net_container home_container" rlRun "rm my_container.cil" From bd1b6c1ff66d832eefadf4154a827c669195e4b5 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 25 Sep 2019 10:39:46 +0200 Subject: [PATCH 12/14] * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0 --- .gitignore | 1 + ...t_basic.podman.cil-test_basic.docker.patch | 61 ------------------- sources | 2 +- udica.spec | 6 +- 4 files changed, 6 insertions(+), 64 deletions(-) delete mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/.gitignore b/.gitignore index 0da17d5..350b77a 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /v0.1.7.tar.gz /v0.1.8.tar.gz /v0.1.9.tar.gz +/v0.2.0.tar.gz diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch deleted file mode 100644 index eda87e3..0000000 --- a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 -From: Lukas Vrabec -Date: Tue, 27 Aug 2019 21:20:16 +0200 -Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. - Round 2 - -Because of the new versions of SELinux policy in Fedora 30 and Fedora -Rawhide, also several tests in Udica needed to be fixed to use new -labels. ---- - tests/semanage.py | 1 - - tests/test_basic.docker.cil | 3 --- - tests/test_basic.podman.cil | 5 +---- - 3 files changed, 1 insertion(+), 8 deletions(-) - -diff --git a/tests/semanage.py b/tests/semanage.py -index f64fda4..318a46a 100644 ---- a/tests/semanage.py -+++ b/tests/semanage.py -@@ -156,7 +156,6 @@ fcontexts_homedirs = [ - ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), -- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), - ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') - ] - -diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil -index b29cb32..220c53b 100644 ---- a/tests/test_basic.docker.cil -+++ b/tests/test_basic.docker.cil -@@ -285,9 +285,6 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) -diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil -index 06b44e3..618fe07 100644 ---- a/tests/test_basic.podman.cil -+++ b/tests/test_basic.podman.cil -@@ -287,10 +287,7 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) --) -\ No newline at end of file -+) --- -2.21.0 - diff --git a/sources b/sources index 34d429b..1a3ad05 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 +SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 diff --git a/udica.spec b/udica.spec index fc6f028..5ea1ff8 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.9 +Version: 0.2.0 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -13,7 +13,6 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on @@ -61,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.0 + * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 From 601fe861e0f19288b3e563c40a3beaf7aa01795a Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 2 Oct 2019 16:59:23 +0200 Subject: [PATCH 13/14] Fix CI tests on udica In version v0.2.0 there is new makefile also for testing part, therefore we changed how to execute tests. This commit fixes the Fedora CI. --- tests/tests.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/tests.yml b/tests/tests.yml index 355fc5d..42a2022 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,11 +10,11 @@ - python3 tests: - smoke: - dir: ./source/tests - run: python3 -m unittest + dir: ./source + run: python3 -m unittest -v tests/test_unit.py - smoke2: - dir: ./source/tests - run: python3 test_main.py selinux_enabled + dir: ./source + run: python3 tests/test_integration.py - role: standard-test-beakerlib tags: From 585621e8dd3084ce4d629b8686a6385edb2327b8 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 25 Oct 2019 22:15:32 +0200 Subject: [PATCH 14/14] * Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.1 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 350b77a..2eda2e5 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /v0.1.8.tar.gz /v0.1.9.tar.gz /v0.2.0.tar.gz +/v0.2.1.tar.gz diff --git a/sources b/sources index 1a3ad05..208ce65 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 +SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf diff --git a/udica.spec b/udica.spec index 5ea1ff8..740cc09 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.0 +Version: 0.2.1 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.1 + * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0