powerel7
/
base
2
0
Fork 0
Code Issues Pull Requests Releases Activity

libsemanage package update 

Signed-off-by: basebuilder_pel7x64builder0 <basebuilder@powerel.org>
master
basebuilder_pel7x64builder0 2018-11-26 00:26:15 +01:00
parent 90548f20cb
commit 899c7ba341
2 changed files with 337 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

376
SOURCES/libsemanage-rhel.patch
View File

@ -520,7 +520,7 @@ index a21b3ee..a51269e 100644
ERR(handle, "could not open %s for writing: %s",
fname, strerror(errno));
diff --git libsemanage-2.5/src/direct_api.c libsemanage-2.5/src/direct_api.c
index 2187b65..fea6572 100644
index 2187b65..6dd21dd 100644
--- libsemanage-2.5/src/direct_api.c
+++ libsemanage-2.5/src/direct_api.c
@@ -40,6 +40,8 @@
@ -532,7 +532,19 @@ index 2187b65..fea6572 100644
#include "iface_internal.h"
#include "boolean_internal.h"
#include "fcontext_internal.h"
@@ -146,9 +148,6 @@ int semanage_direct_connect(semanage_handle_t * sh)
@@ -87,6 +89,11 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
const semanage_module_key_t *modkey,
semanage_module_info_t **modinfo);

+static int semanage_direct_list_by_name(semanage_handle_t *sh,
+ semanage_module_info_t **modinfo,
+ int *num_modules,
+ char *optional_module_name);
+
static int semanage_direct_list_all(semanage_handle_t *sh,
semanage_module_info_t **modinfo,
int *num_modules);
@@ -146,9 +153,6 @@ int semanage_direct_connect(semanage_handle_t * sh)
if (semanage_create_store(sh, 1))
goto err;
@ -542,7 +554,7 @@ index 2187b65..fea6572 100644
sh->u.direct.translock_file_fd = -1;
sh->u.direct.activelock_file_fd = -1;
@@ -208,6 +207,12 @@ int semanage_direct_connect(semanage_handle_t * sh)
@@ -208,6 +212,12 @@ int semanage_direct_connect(semanage_handle_t * sh)
semanage_fcontext_dbase_local(sh)) < 0)
goto err;
@ -555,7 +567,7 @@ index 2187b65..fea6572 100644
if (seuser_file_dbase_init(sh,
semanage_path(SEMANAGE_ACTIVE,
SEMANAGE_SEUSERS_LOCAL),
@@ -224,6 +229,22 @@ int semanage_direct_connect(semanage_handle_t * sh)
@@ -224,6 +234,22 @@ int semanage_direct_connect(semanage_handle_t * sh)
semanage_node_dbase_local(sh)) < 0)
goto err;
@ -578,7 +590,7 @@ index 2187b65..fea6572 100644
/* Object databases: local modifications + policy */
if (user_base_policydb_dbase_init(sh,
semanage_user_base_dbase_policy(sh)) <
@@ -248,6 +269,12 @@ int semanage_direct_connect(semanage_handle_t * sh)
@@ -248,6 +274,12 @@ int semanage_direct_connect(semanage_handle_t * sh)
if (port_policydb_dbase_init(sh, semanage_port_dbase_policy(sh)) < 0)
goto err;
@ -591,7 +603,7 @@ index 2187b65..fea6572 100644
if (iface_policydb_dbase_init(sh, semanage_iface_dbase_policy(sh)) < 0)
goto err;
@@ -275,7 +302,9 @@ int semanage_direct_connect(semanage_handle_t * sh)
@@ -275,7 +307,9 @@ int semanage_direct_connect(semanage_handle_t * sh)
/* set the disable dontaudit value */
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_DISABLE_DONTAUDIT);
@ -602,7 +614,7 @@ index 2187b65..fea6572 100644
sepol_set_disable_dontaudit(sh->sepolh, 1);
else
sepol_set_disable_dontaudit(sh->sepolh, 0);
@@ -320,9 +349,12 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
@@ -320,9 +354,12 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
user_extra_file_dbase_release(semanage_user_extra_dbase_local(sh));
user_join_dbase_release(semanage_user_dbase_local(sh));
port_file_dbase_release(semanage_port_dbase_local(sh));
@ -615,7 +627,7 @@ index 2187b65..fea6572 100644
seuser_file_dbase_release(semanage_seuser_dbase_local(sh));
node_file_dbase_release(semanage_node_dbase_local(sh));
@@ -331,6 +363,8 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
@@ -331,6 +368,8 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
user_extra_file_dbase_release(semanage_user_extra_dbase_policy(sh));
user_join_dbase_release(semanage_user_dbase_policy(sh));
port_policydb_dbase_release(semanage_port_dbase_policy(sh));
@ -624,7 +636,7 @@ index 2187b65..fea6572 100644
iface_policydb_dbase_release(semanage_iface_dbase_policy(sh));
bool_policydb_dbase_release(semanage_bool_dbase_policy(sh));
fcontext_file_dbase_release(semanage_fcontext_dbase_policy(sh));
@@ -345,10 +379,6 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
@@ -345,10 +384,6 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)
static int semanage_direct_begintrans(semanage_handle_t * sh)
{
@ -635,7 +647,7 @@ index 2187b65..fea6572 100644
if (semanage_get_trans_lock(sh) < 0) {
return -1;
}
@@ -363,6 +393,35 @@ static int semanage_direct_begintrans(semanage_handle_t * sh)
@@ -363,6 +398,35 @@ static int semanage_direct_begintrans(semanage_handle_t * sh)
/********************* utility functions *********************/
@ -671,7 +683,7 @@ index 2187b65..fea6572 100644
#include <stdlib.h>
#include <bzlib.h>
#include <string.h>
@@ -588,13 +647,33 @@ static int semanage_direct_update_user_extra(semanage_handle_t * sh, cil_db_t *c
@@ -588,13 +652,33 @@ static int semanage_direct_update_user_extra(semanage_handle_t * sh, cil_db_t *c
}
if (size > 0) {
@ -707,7 +719,7 @@ index 2187b65..fea6572 100644
pusers_extra->dtable->drop_cache(pusers_extra->dbase);
@@ -623,11 +702,33 @@ static int semanage_direct_update_seuser(semanage_handle_t * sh, cil_db_t *cildb
@@ -623,11 +707,33 @@ static int semanage_direct_update_seuser(semanage_handle_t * sh, cil_db_t *cildb
}
if (size > 0) {
@ -742,7 +754,7 @@ index 2187b65..fea6572 100644
pseusers->dtable->drop_cache(pseusers->dbase);
} else {
@@ -1037,8 +1138,9 @@ static int semanage_compile_hll_modules(semanage_handle_t *sh,
@@ -1037,8 +1143,9 @@ static int semanage_compile_hll_modules(semanage_handle_t *sh,
goto cleanup;
}
@ -753,7 +765,7 @@ index 2187b65..fea6572 100644
continue;
}
@@ -1066,23 +1168,26 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1066,23 +1173,26 @@ static int semanage_direct_commit(semanage_handle_t * sh)
size_t fc_buffer_len = 0;
const char *ofilename = NULL;
const char *path;
@ -788,7 +800,7 @@ index 2187b65..fea6572 100644
dbase_config_t *bools = semanage_bool_dbase_local(sh);
dbase_config_t *pbools = semanage_bool_dbase_policy(sh);
dbase_config_t *ifaces = semanage_iface_dbase_local(sh);
@@ -1092,13 +1197,25 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1092,13 +1202,25 @@ static int semanage_direct_commit(semanage_handle_t * sh)
dbase_config_t *fcontexts = semanage_fcontext_dbase_local(sh);
dbase_config_t *pfcontexts = semanage_fcontext_dbase_policy(sh);
dbase_config_t *seusers = semanage_seuser_dbase_local(sh);
@ -817,7 +829,7 @@ index 2187b65..fea6572 100644
if (sepol_get_disable_dontaudit(sh->sepolh) == 1) {
FILE *touch;
touch = fopen(path, "w");
@@ -1120,10 +1237,10 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1120,10 +1242,10 @@ static int semanage_direct_commit(semanage_handle_t * sh)
/* Create or remove the preserve_tunables flag file. */
path = semanage_path(SEMANAGE_TMP, SEMANAGE_PRESERVE_TUNABLES);
@ -831,7 +843,7 @@ index 2187b65..fea6572 100644
if (sepol_get_preserve_tunables(sh->sepolh) == 1) {
FILE *touch;
touch = fopen(path, "w");
@@ -1151,54 +1268,76 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1151,54 +1273,76 @@ static int semanage_direct_commit(semanage_handle_t * sh)
goto cleanup;
}
@ -944,7 +956,7 @@ index 2187b65..fea6572 100644
/* =================== Module expansion =============== */
retval = semanage_get_active_modules(sh, &modinfos, &num_modinfos);
@@ -1287,43 +1426,74 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1287,43 +1431,74 @@ static int semanage_direct_commit(semanage_handle_t * sh)
goto cleanup;
cil_db_destroy(&cildb);
@ -980,20 +992,21 @@ index 2187b65..fea6572 100644
+ retval = semanage_copy_file(path,
+ semanage_path(SEMANAGE_TMP,
+ SEMANAGE_STORE_SEUSERS),
+ sh->conf->file_mode);
+ 0);
+ if (retval < 0)
+ goto cleanup;
+ pseusers->dtable->drop_cache(pseusers->dbase);
+ } else {
+ pseusers->dtable->clear(sh, pseusers->dbase);
+ }
+

- /* ============= Apply changes, and verify =============== */
+ path = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA_LINKED);
+ if (stat(path, &sb) == 0) {
+ retval = semanage_copy_file(path,
+ semanage_path(SEMANAGE_TMP,
+ SEMANAGE_USERS_EXTRA),
+ sh->conf->file_mode);
+ 0);
+ if (retval < 0)
+ goto cleanup;
+ pusers_extra->dtable->drop_cache(pusers_extra->dbase);
@ -1002,7 +1015,9 @@ index 2187b65..fea6572 100644
+ }
+ }
- /* ============= Apply changes, and verify =============== */
- retval = semanage_base_merge_components(sh);
- if (retval < 0)
- goto cleanup;
+ /* Attach our databases to the policydb we just created or loaded. */
+ dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);
@ -1012,15 +1027,12 @@ index 2187b65..fea6572 100644
+ dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);
- retval = semanage_base_merge_components(sh);
- if (retval < 0)
- goto cleanup;
- retval = semanage_write_policydb(sh, out);
+ /* Merge local changes */
+ retval = semanage_base_merge_components(sh);
+ if (retval < 0)
+ goto cleanup;
- retval = semanage_write_policydb(sh, out);
+
+ if (do_write_kernel) {
+ /* Write new kernel policy. */
+ retval = semanage_write_policydb(sh, out,
@ -1039,7 +1051,7 @@ index 2187b65..fea6572 100644
}
/* ======= Post-process: Validate non-policydb components ===== */
@@ -1332,26 +1502,39 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1332,26 +1507,39 @@ static int semanage_direct_commit(semanage_handle_t * sh)
* Note: those are still cached, even though they've been
* merged into the main file_contexts. We won't check the
* large file_contexts - checked at compile time */
@ -1082,7 +1094,7 @@ index 2187b65..fea6572 100644
/* ================== Write non-policydb components ========= */
/* Commit changes to components */
@@ -1367,43 +1550,46 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1367,43 +1555,46 @@ static int semanage_direct_commit(semanage_handle_t * sh)
}
path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC_LOCAL);
@ -1155,7 +1167,7 @@ index 2187b65..fea6572 100644
}
} else {
WARN(sh, "WARNING: genhomedircon is disabled. \
@@ -1415,9 +1601,8 @@ static int semanage_direct_commit(semanage_handle_t * sh)
@@ -1415,9 +1606,8 @@ static int semanage_direct_commit(semanage_handle_t * sh)
sepol_policydb_free(out);
out = NULL;
@ -1166,7 +1178,7 @@ index 2187b65..fea6572 100644
cleanup:
for (i = 0; i < num_modinfos; i++) {
@@ -1429,14 +1614,14 @@ cleanup:
@@ -1429,14 +1619,14 @@ cleanup:
free(mod_filenames[i]);
}
@ -1189,7 +1201,7 @@ index 2187b65..fea6572 100644
free(mod_filenames);
sepol_policydb_free(out);
@@ -1452,6 +1637,8 @@ cleanup:
@@ -1452,6 +1642,8 @@ cleanup:
semanage_remove_directory(semanage_final_path
(SEMANAGE_FINAL_TMP,
SEMANAGE_FINAL_TOPLEVEL));
@ -1198,7 +1210,7 @@ index 2187b65..fea6572 100644
return retval;
}
@@ -1600,7 +1787,8 @@ static int semanage_direct_extract(semanage_handle_t * sh,
@@ -1600,7 +1792,8 @@ static int semanage_direct_extract(semanage_handle_t * sh,
goto cleanup;
}
@ -1208,7 +1220,7 @@ index 2187b65..fea6572 100644
ERR(sh, "Module does not exist: %s", module_path);
rc = -1;
goto cleanup;
@@ -1630,7 +1818,7 @@ static int semanage_direct_extract(semanage_handle_t * sh,
@@ -1630,7 +1823,7 @@ static int semanage_direct_extract(semanage_handle_t * sh,
goto cleanup;
}
@ -1217,7 +1229,7 @@ index 2187b65..fea6572 100644
rc = semanage_compile_module(sh, _modinfo);
if (rc < 0) {
goto cleanup;
@@ -1802,6 +1990,7 @@ static int semanage_direct_set_enabled(semanage_handle_t *sh,
@@ -1802,6 +1995,7 @@ static int semanage_direct_set_enabled(semanage_handle_t *sh,
const char *path = NULL;
FILE *fp = NULL;
semanage_module_info_t *modinfo = NULL;
@ -1225,7 +1237,7 @@ index 2187b65..fea6572 100644
/* check transaction */
if (!sh->is_in_transaction) {
@@ -1862,7 +2051,9 @@ static int semanage_direct_set_enabled(semanage_handle_t *sh,
@@ -1862,7 +2056,9 @@ static int semanage_direct_set_enabled(semanage_handle_t *sh,
switch (enabled) {
case 0: /* disable the module */
@ -1235,7 +1247,7 @@ index 2187b65..fea6572 100644
if (fp == NULL) {
ERR(sh,
@@ -1931,7 +2122,7 @@ int semanage_direct_mls_enabled(semanage_handle_t * sh)
@@ -1931,7 +2127,7 @@ int semanage_direct_mls_enabled(semanage_handle_t * sh)
if (retval < 0)
goto cleanup;
@ -1244,7 +1256,19 @@ index 2187b65..fea6572 100644
if (retval < 0)
goto cleanup;
@@ -2075,6 +2266,31 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
@@ -1975,7 +2171,10 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,

/* if priority == 0, then find the highest priority available */
if (modkey->priority == 0) {
- ret = semanage_direct_list_all(sh, &modinfos, &modinfos_len);
+ ret = semanage_direct_list_by_name(sh,
+ &modinfos,
+ &modinfos_len,
+ modkey->name);
if (ret != 0) {
status = -1;
goto cleanup;
@@ -2075,6 +2274,31 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
free(tmp);
tmp = NULL;
@ -1276,7 +1300,64 @@ index 2187b65..fea6572 100644
if (fclose(fp) != 0) {
ERR(sh,
"Unable to close %s module lang ext file.",
@@ -2516,6 +2732,7 @@ static int semanage_direct_install_info(semanage_handle_t *sh,
@@ -2288,6 +2512,14 @@ static int semanage_modules_filename_select(const struct dirent *d)
static int semanage_direct_list_all(semanage_handle_t *sh,
semanage_module_info_t **modinfos,
int *modinfos_len)
+{
+ return semanage_direct_list_by_name(sh, modinfos, modinfos_len, NULL);
+}
+
+static int semanage_direct_list_by_name(semanage_handle_t *sh,
+ semanage_module_info_t **modinfos,
+ int *modinfos_len,
+ char *optional_module_name)
{
assert(sh);
assert(modinfos);
@@ -2387,6 +2619,7 @@ static int semanage_direct_list_all(semanage_handle_t *sh,
&modules,
semanage_modules_filename_select,
versionsort);
+
if (modules_len == -1) {
ERR(sh,
"Error while scanning directory %s.",
@@ -2397,6 +2630,33 @@ static int semanage_direct_list_all(semanage_handle_t *sh,

if (modules_len == 0) continue;

+ if (optional_module_name) {
+ for (j = 0; j < modules_len; j++) {
+ /* try to find specified module */
+ if (strcmp(modules[j]->d_name, optional_module_name)) {
+ free(modules[j]);
+ } else {
+ /* module found, move it to the beginning of */
+ /* the list and clean up the remaining entries */
+ modules[0] = modules[j];
+ for (j++; j < modules_len; j++){
+ free(modules[j]);
+ }
+
+ modules_len = 1;
+ j = 0;
+ break;
+ }
+ }
+ /* module not found on this priority, clean up and continue */
+ if (j == modules_len) {
+ modules_len = 0;
+ free(modules);
+ modules = NULL;
+ continue;
+ }
+ }
+
/* add space for modules */
tmp = realloc(*modinfos,
sizeof(semanage_module_info_t) *
@@ -2516,6 +2776,7 @@ static int semanage_direct_install_info(semanage_handle_t *sh,
int type;
char path[PATH_MAX];
@ -1284,7 +1365,16 @@ index 2187b65..fea6572 100644
semanage_module_info_t *higher_info = NULL;
semanage_module_key_t higher_key;
@@ -2613,7 +2830,8 @@ static int semanage_direct_install_info(semanage_handle_t *sh,
@@ -2564,7 +2825,7 @@ static int semanage_direct_install_info(semanage_handle_t *sh,
if (higher_info->enabled == 0 && modinfo->enabled == -1) {
errno = 0;
WARN(sh,
- "%s module will be disabled after install due to default enabled status.",
+ "%s module will be disabled after install as there is a disabled instance of this module present in the system.",
modinfo->name);
}
}
@@ -2613,7 +2874,8 @@ static int semanage_direct_install_info(semanage_handle_t *sh,
goto cleanup;
}
@ -1294,7 +1384,7 @@ index 2187b65..fea6572 100644
ret = unlink(path);
if (ret != 0) {
ERR(sh, "Error while removing cached CIL file %s: %s", path, strerror(errno));
@@ -2627,6 +2845,7 @@ cleanup:
@@ -2627,6 +2889,7 @@ cleanup:
semanage_module_key_destroy(sh, &higher_key);
semanage_module_info_destroy(sh, higher_info);
free(higher_info);
@ -3922,7 +4012,7 @@ index d31bd48..896ac51 100644
const int CCOUNT = sizeof(components) / sizeof(components[0]);
diff --git libsemanage-2.5/src/semanage_store.c libsemanage-2.5/src/semanage_store.c
index fa0876f..c13b763 100644
index fa0876f..79b0df9 100644
--- libsemanage-2.5/src/semanage_store.c
+++ libsemanage-2.5/src/semanage_store.c
@@ -95,23 +95,28 @@ static const char *semanage_store_paths[SEMANAGE_NUM_STORES] = {
@ -3997,15 +4087,29 @@ index fa0876f..c13b763 100644
semanage_final_suffix[SEMANAGE_NC] =
strdup(selinux_netfilter_context_path() + offset);
if (semanage_final_suffix[SEMANAGE_NC] == NULL) {
@@ -512,7 +538,6 @@ char *semanage_conf_path(void)
@@ -512,17 +538,20 @@ char *semanage_conf_path(void)
int semanage_create_store(semanage_handle_t * sh, int create)
{
struct stat sb;
- int mode_mask = R_OK | W_OK | X_OK;
const char *path = semanage_files[SEMANAGE_ROOT];
int fd;
+ mode_t mask;
@@ -531,9 +556,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh, "Could not create module store at %s.",
path);
return -2;
}
+ umask(mask);
} else {
if (create)
ERR(sh,
@@ -531,9 +560,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
return -1;
}
} else {
@ -4017,7 +4121,23 @@ index fa0876f..c13b763 100644
path);
return -1;
}
@@ -554,9 +579,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
@@ -541,12 +570,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL);
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh,
"Could not create module store, active subdirectory at %s.",
path);
return -2;
}
+ umask(mask);
} else {
ERR(sh,
"Could not read from module store, active subdirectory at %s.",
@@ -554,9 +586,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
return -1;
}
} else {
@ -4029,7 +4149,23 @@ index fa0876f..c13b763 100644
path);
return -1;
}
@@ -577,9 +602,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
@@ -564,12 +596,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_MODULES);
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) == -1) {
+ umask(mask);
ERR(sh,
"Could not create module store, active modules subdirectory at %s.",
path);
return -2;
}
+ umask(mask);
} else {
ERR(sh,
"Could not read from module store, active modules subdirectory at %s.",
@@ -577,9 +612,9 @@ int semanage_create_store(semanage_handle_t * sh, int create)
return -1;
}
} else {
@ -4041,7 +4177,21 @@ index fa0876f..c13b763 100644
path);
return -1;
}
@@ -598,8 +623,8 @@ int semanage_create_store(semanage_handle_t * sh, int create)
@@ -587,19 +622,22 @@ int semanage_create_store(semanage_handle_t * sh, int create)
path = semanage_files[SEMANAGE_READ_LOCK];
if (stat(path, &sb) == -1) {
if (errno == ENOENT && create) {
+ mask = umask(0077);
if ((fd = creat(path, S_IRUSR | S_IWUSR)) == -1) {
+ umask(mask);
ERR(sh, "Could not create lock file at %s.",
path);
return -2;
}
+ umask(mask);
close(fd);
} else {
ERR(sh, "Could not read lock file at %s.", path);
return -1;
}
} else {
@ -4052,7 +4202,95 @@ index fa0876f..c13b763 100644
return -1;
}
}
@@ -1137,7 +1162,7 @@ cleanup:
@@ -737,6 +775,7 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
struct stat sb;
struct dirent **names = NULL;
char path[PATH_MAX], path2[PATH_MAX];
+ mode_t mask;

if ((len = scandir(src, &names, semanage_filename_select, NULL)) == -1) {
fprintf(stderr, "Could not read the contents of %s: %s\n", src, strerror(errno));
@@ -744,10 +783,13 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
}

if (stat(dst, &sb) != 0) {
+ mask = umask(0077);
if (mkdir(dst, S_IRWXU) != 0) {
+ umask(mask);
fprintf(stderr, "Could not create %s: %s\n", dst, strerror(errno));
goto cleanup;
}
+ umask(mask);
}

for (i = 0; i < len; i++) {
@@ -759,14 +801,20 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
}
snprintf(path2, sizeof(path2), "%s/%s", dst, names[i]->d_name);
if (S_ISDIR(sb.st_mode)) {
+ mask = umask(0077);
if (mkdir(path2, 0700) == -1 ||
semanage_copy_dir_flags(path, path2, flag) == -1) {
+ umask(mask);
goto cleanup;
}
+ umask(mask);
} else if (S_ISREG(sb.st_mode) && flag == 1) {
+ mask = umask(0077);
if (semanage_copy_file(path, path2, sb.st_mode) < 0) {
+ umask(mask);
goto cleanup;
}
+ umask(mask);
}
}
retval = 0;
@@ -846,16 +894,20 @@ int semanage_mkdir(semanage_handle_t *sh, const char *path)
{
int status = 0;
struct stat sb;
+ mode_t mask;

/* check if directory already exists */
if (stat(path, &sb) != 0) {
/* make the modules directory */
+ mask = umask(0077);
if (mkdir(path, S_IRWXU) != 0) {
+ umask(mask);
ERR(sh, "Cannot make directory at %s", path);
status = -1;
goto cleanup;

}
+ umask(mask);
}
else {
/* check that it really is a directory */
@@ -880,6 +932,7 @@ int semanage_make_sandbox(semanage_handle_t * sh)
const char *sandbox = semanage_path(SEMANAGE_TMP, SEMANAGE_TOPLEVEL);
struct stat buf;
int errsv;
+ mode_t mask;

if (stat(sandbox, &buf) == -1) {
if (errno != ENOENT) {
@@ -896,12 +949,15 @@ int semanage_make_sandbox(semanage_handle_t * sh)
}
}

+ mask = umask(0077);
if (mkdir(sandbox, S_IRWXU) == -1 ||
semanage_copy_dir(semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL),
sandbox) == -1) {
+ umask(mask);
ERR(sh, "Could not copy files to sandbox %s.", sandbox);
goto cleanup;
}
+ umask(mask);
return 0;

cleanup:
@@ -1137,7 +1193,7 @@ cleanup:
free(all_modinfos);
if (status != 0) {
@ -4061,7 +4299,7 @@ index fa0876f..c13b763 100644
semanage_module_info_destroy(sh, &(*modinfo)[i]);
}
free(*modinfo);
@@ -1491,6 +1516,45 @@ static int sefcontext_compile(semanage_handle_t * sh, const char *path) {
@@ -1491,6 +1547,45 @@ static int sefcontext_compile(semanage_handle_t * sh, const char *path) {
return 0;
}
@ -4107,7 +4345,7 @@ index fa0876f..c13b763 100644
/* Load the contexts of the final tmp into the final selinux directory.
* Return 0 on success, -3 on error.
*/
@@ -1566,35 +1630,6 @@ static int semanage_install_final_tmp(semanage_handle_t * sh)
@@ -1566,35 +1661,6 @@ static int semanage_install_final_tmp(semanage_handle_t * sh)
}
skip_reload:
@ -4143,7 +4381,7 @@ index fa0876f..c13b763 100644
status = 0;
cleanup:
return status;
@@ -1737,6 +1772,9 @@ int semanage_install_sandbox(semanage_handle_t * sh)
@@ -1737,6 +1803,9 @@ int semanage_install_sandbox(semanage_handle_t * sh)
goto cleanup;
}
@ -4153,7 +4391,7 @@ index fa0876f..c13b763 100644
if ((commit_num = semanage_commit_sandbox(sh)) < 0) {
retval = commit_num;
goto cleanup;
@@ -2003,9 +2041,10 @@ int semanage_load_files(semanage_handle_t * sh, cil_db_t *cildb, char **filename
@@ -2003,9 +2072,10 @@ int semanage_load_files(semanage_handle_t * sh, cil_db_t *cildb, char **filename
*/
/**
@ -4166,7 +4404,7 @@ index fa0876f..c13b763 100644
{
int retval = STATUS_ERR;
@@ -2014,7 +2053,7 @@ int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
@@ -2014,7 +2084,7 @@ int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
FILE *infile = NULL;
if ((kernel_filename =
@ -4175,7 +4413,7 @@ index fa0876f..c13b763 100644
goto cleanup;
}
if ((infile = fopen(kernel_filename, "r")) == NULL) {
@@ -2044,18 +2083,20 @@ int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
@@ -2044,18 +2114,20 @@ int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
return retval;
}
/**
@ -4199,7 +4437,7 @@ index fa0876f..c13b763 100644
goto cleanup;
}
if ((outfile = fopen(kernel_filename, "wb")) == NULL) {
@@ -2081,6 +2122,7 @@ int semanage_write_policydb(semanage_handle_t * sh, sepol_policydb_t * out)
@@ -2081,6 +2153,7 @@ int semanage_write_policydb(semanage_handle_t * sh, sepol_policydb_t * out)
if (outfile != NULL) {
fclose(outfile);
}
@ -4377,6 +4615,34 @@ index 1346b2e..8604b8a 100644
/** node typemaps **/
/* the wrapper will setup this parameter for passing... the resulting python functions
diff --git libsemanage-2.5/src/seusers_local.c libsemanage-2.5/src/seusers_local.c
index 42c3a8b..ea3836c 100644
--- libsemanage-2.5/src/seusers_local.c
+++ libsemanage-2.5/src/seusers_local.c
@@ -67,17 +67,18 @@ static int semanage_seuser_audit(semanage_handle_t * handle,
const char *sep = "-";
int rc = -1;
strcpy(msg, "login");
+ if (previous) {
+ name = semanage_seuser_get_name(previous);
+ psename = semanage_seuser_get_sename(previous);
+ pmls = semanage_seuser_get_mlsrange(previous);
+ proles = semanage_user_roles(handle, psename);
+ }
if (seuser) {
name = semanage_seuser_get_name(seuser);
sename = semanage_seuser_get_sename(seuser);
mls = semanage_seuser_get_mlsrange(seuser);
roles = semanage_user_roles(handle, sename);
}
- if (previous) {
- psename = semanage_seuser_get_sename(previous);
- pmls = semanage_seuser_get_mlsrange(previous);
- proles = semanage_user_roles(handle, psename);
- }
if (audit_type != AUDIT_ROLE_REMOVE) {
if (sename && (!psename || strcmp(psename, sename) != 0)) {
strcat(msg,sep);
diff --git libsemanage-2.5/tests/.gitignore libsemanage-2.5/tests/.gitignore
new file mode 100644
index 0000000..f07111d

20
SPECS/libsemanage.spec
View File

@ -1,17 +1,17 @@
%global with_python3 0
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print (get_python_lib(1))")}

%define libsepolver 2.5-8
%define libselinuxver 2.5-12
%define libsepolver 2.5-10
%define libselinuxver 2.5-14

Summary: SELinux binary policy manipulation library
Name: libsemanage
Version: 2.5
Release: 11%{?dist}
Release: 14%{?dist}
License: LGPLv2+
Group: System Environment/Libraries
Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20160223/libsemanage-2.5.tar.gz
# HEAD 5a336c116e3808e21a2334671fffed73348111c9
# HEAD abf13a864699272ea826b0f8ff993027a342b377
Patch1: libsemanage-rhel.patch
URL: https://github.com/SELinuxProject/selinux/wiki
Source1: semanage.conf
@ -193,6 +193,18 @@ rm -rf ${RPM_BUILD_ROOT}
%endif # if with_python3

%changelog
* Tue Sep 11 2018 Vit Mojzis <vmojzis@redhat.com> - 2.5-14
- Include user name in ROLE_REMOVE audit events (#1622045)
- Improve "reset umask before creating directories"

* Wed Jul 25 2018 Vit Mojzis <vmojzis@redhat.com> - 2.5-13
- Reset umask before creating directories (#1186422)
- Enable listing modules by name (#1566729)

* Mon Apr 30 2018 Vit Mojzis <vmojzis@redhat.com> - 2.5-12
- Do not change file mode of seusers and users_extra (#1512639)
- Improve warning for installing disabled module (#1337199)

* Tue Feb 27 2018 Vit Mojzis <vmojzis@redhat.com> - 2.5-11
- Add dependencies on libselinux and libsemanage (#1548020)