From d3d75c66453bc206068d15f600772a233d5ac180 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 28 Aug 2019 13:04:39 +0200 Subject: [PATCH 1/7] * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 --- .gitignore | 1 + ...t_basic.podman.cil-test_basic.docker.patch | 61 +++++++++++++++++++ sources | 2 +- udica.spec | 9 ++- 4 files changed, 70 insertions(+), 3 deletions(-) create mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/.gitignore b/.gitignore index 1990382..0da17d5 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /v0.1.6.tar.gz /v0.1.7.tar.gz /v0.1.8.tar.gz +/v0.1.9.tar.gz diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch new file mode 100644 index 0000000..eda87e3 --- /dev/null +++ b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch @@ -0,0 +1,61 @@ +From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 +From: Lukas Vrabec +Date: Tue, 27 Aug 2019 21:20:16 +0200 +Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. + Round 2 + +Because of the new versions of SELinux policy in Fedora 30 and Fedora +Rawhide, also several tests in Udica needed to be fixed to use new +labels. +--- + tests/semanage.py | 1 - + tests/test_basic.docker.cil | 3 --- + tests/test_basic.podman.cil | 5 +---- + 3 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/tests/semanage.py b/tests/semanage.py +index f64fda4..318a46a 100644 +--- a/tests/semanage.py ++++ b/tests/semanage.py +@@ -156,7 +156,6 @@ fcontexts_homedirs = [ + ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), +- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), + ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') + ] + +diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil +index b29cb32..220c53b 100644 +--- a/tests/test_basic.docker.cil ++++ b/tests/test_basic.docker.cil +@@ -285,9 +285,6 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil +index 06b44e3..618fe07 100644 +--- a/tests/test_basic.podman.cil ++++ b/tests/test_basic.podman.cil +@@ -287,10 +287,7 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +-) +\ No newline at end of file ++) +-- +2.21.0 + diff --git a/sources b/sources index 4fb2ded..34d429b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891 +SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 diff --git a/udica.spec b/udica.spec index 62a4bda..45173a1 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.8 -Release: 2%{?dist} +Version: 0.1.9 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,6 +13,7 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on @@ -60,6 +61,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 +- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 +- New rebase https://github.com/containers/udica/releases/tag/v0.1.9 + * Sat Jul 27 2019 Fedora Release Engineering - 0.1.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 999885bd8f84dba636763e5687c5cbac8f318a8a Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 27 Aug 2019 20:58:23 +0200 Subject: [PATCH 2/7] Fix sanity test suite Fix sanity test to pass on Fedora Rawhide and Fedora 30. Changes are related to missing 'nc' command in container for which SELinux policy is generated. --- tests/sanity/runtest.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index 5c66cfe..c8c5f34 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -51,12 +51,13 @@ rlJournalStart rlRun "podman exec test ls /home" 1,2 rlRun "podman exec test touch /var/spool/test" 1 + rlRun "podman exec test dnf install nmap-ncat -y" 0 rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" rlRun "podman stop test" - rlRun "podman rm test" + rlRun "podman rm --force test" rlRun "cat $OUTPUT_FILE" rlAssertExists "my_container.cil" @@ -71,10 +72,11 @@ rlJournalStart rlRun "podman exec test2 ls /home" 0 rlRun "podman exec test2 touch /var/spool/test" 0 - rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3 + rlRun "podman exec test2 dnf install nmap-ncat -y" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3 rlRun "podman stop test2" - rlRun "podman rm test2" + rlRun "podman rm --force test2" rlRun "semodule -r my_container base_container net_container home_container" rlRun "rm my_container.cil" From 24549e2542465d227fdc058f7a4ee0ab0f14f7ad Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 25 Sep 2019 10:37:25 +0200 Subject: [PATCH 3/7] * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0 --- .gitignore | 1 + ...t_basic.podman.cil-test_basic.docker.patch | 61 ------------------- sources | 2 +- udica.spec | 6 +- 4 files changed, 6 insertions(+), 64 deletions(-) delete mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/.gitignore b/.gitignore index 0da17d5..350b77a 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /v0.1.7.tar.gz /v0.1.8.tar.gz /v0.1.9.tar.gz +/v0.2.0.tar.gz diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch deleted file mode 100644 index eda87e3..0000000 --- a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 -From: Lukas Vrabec -Date: Tue, 27 Aug 2019 21:20:16 +0200 -Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. - Round 2 - -Because of the new versions of SELinux policy in Fedora 30 and Fedora -Rawhide, also several tests in Udica needed to be fixed to use new -labels. ---- - tests/semanage.py | 1 - - tests/test_basic.docker.cil | 3 --- - tests/test_basic.podman.cil | 5 +---- - 3 files changed, 1 insertion(+), 8 deletions(-) - -diff --git a/tests/semanage.py b/tests/semanage.py -index f64fda4..318a46a 100644 ---- a/tests/semanage.py -+++ b/tests/semanage.py -@@ -156,7 +156,6 @@ fcontexts_homedirs = [ - ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), -- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), - ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') - ] - -diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil -index b29cb32..220c53b 100644 ---- a/tests/test_basic.docker.cil -+++ b/tests/test_basic.docker.cil -@@ -285,9 +285,6 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) -diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil -index 06b44e3..618fe07 100644 ---- a/tests/test_basic.podman.cil -+++ b/tests/test_basic.podman.cil -@@ -287,10 +287,7 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) --) -\ No newline at end of file -+) --- -2.21.0 - diff --git a/sources b/sources index 34d429b..1a3ad05 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 +SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 diff --git a/udica.spec b/udica.spec index 45173a1..37d2be9 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.9 +Version: 0.2.0 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -13,7 +13,6 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on @@ -61,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.0 + * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 From e3eb4f93b3531f578d029ffb32114efa269f5ed6 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 2 Oct 2019 16:59:23 +0200 Subject: [PATCH 4/7] Fix CI tests on udica In version v0.2.0 there is new makefile also for testing part, therefore we changed how to execute tests. This commit fixes the Fedora CI. --- tests/tests.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/tests.yml b/tests/tests.yml index 355fc5d..42a2022 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,11 +10,11 @@ - python3 tests: - smoke: - dir: ./source/tests - run: python3 -m unittest + dir: ./source + run: python3 -m unittest -v tests/test_unit.py - smoke2: - dir: ./source/tests - run: python3 test_main.py selinux_enabled + dir: ./source + run: python3 tests/test_integration.py - role: standard-test-beakerlib tags: From bec3fbc2b80d3e58753d194c9056ba67b13fdf60 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 25 Oct 2019 22:15:32 +0200 Subject: [PATCH 5/7] * Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.1 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 350b77a..2eda2e5 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /v0.1.8.tar.gz /v0.1.9.tar.gz /v0.2.0.tar.gz +/v0.2.1.tar.gz diff --git a/sources b/sources index 1a3ad05..208ce65 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 +SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf diff --git a/udica.spec b/udica.spec index 37d2be9..f9328d4 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.0 +Version: 0.2.1 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.1 + * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0 From cfd328ce27a94be562b6e0bbdc7038dbbf7ee3ec Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 3 Aug 2020 19:05:31 +0200 Subject: [PATCH 6/7] * Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.2 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 2eda2e5..f5c3092 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /v0.1.9.tar.gz /v0.2.0.tar.gz /v0.2.1.tar.gz +/v0.2.2.tar.gz diff --git a/sources b/sources index 208ce65..3c7abe4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf +SHA512 (v0.2.2.tar.gz) = 647601690462551c51945c769ebaf5963b51703df656a3eb1098199c84e19f26e580ebb89b37451cd8651c24afba071896be2064abe09b8130b25cacc7fda575 diff --git a/udica.spec b/udica.spec index f9328d4..07f8b48 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.1 +Version: 0.2.2 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.2 + * Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.1 From d3c01c26a8236599bee3d5b0349c52ac5c6cc0f7 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 13 Aug 2020 17:35:37 +0200 Subject: [PATCH 7/7] * Thu Aug 13 2020 Lukas Vrabec - 0.2.3-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.3 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index f5c3092..6300524 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /v0.2.0.tar.gz /v0.2.1.tar.gz /v0.2.2.tar.gz +/v0.2.3.tar.gz diff --git a/sources b/sources index 3c7abe4..3483d53 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.2.tar.gz) = 647601690462551c51945c769ebaf5963b51703df656a3eb1098199c84e19f26e580ebb89b37451cd8651c24afba071896be2064abe09b8130b25cacc7fda575 +SHA512 (v0.2.3.tar.gz) = 78e6bae5a26e50ddc01a251802a02d6c48d8a87a8a1c343f9b40d0b2fdafbe435d62e6c1b6fb7c1365f536fac02f01d9057b2ffdaef27a9f91f3b245840754fb diff --git a/udica.spec b/udica.spec index 07f8b48..be8e389 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.2 +Version: 0.2.3 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Aug 13 2020 Lukas Vrabec - 0.2.3-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.3 + * Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.2