Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/support
Commit message (Collapse)AuthorAgeFilesLines
* fix misc typosChristian Göttsche2024-03-011-2/+2
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Kenton Groombridge <concord@gentoo.org>
* support/genhomedircon: support usr prefixed pathsChristian Göttsche2024-03-011-1/+1
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Kenton Groombridge <concord@gentoo.org>
* Fix templates parsing in gentemplates.shOleksii Miroshko2023-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | Template definitions might have a whitespace after the comma, e.g. su_restricted_domain_template in /policy/modules/admin/su.if template(`su_restricted_domain_template', ` ... ') gentemplates.sh silently fails to parse it. This works unless 'set -e' is set, in which case the script fails non-silently. This commit adds support of whitespace after comma, which is a valid syntax. Signed-off-by: Oleksii Miroshko <oleksii.miroshko@bmw.de> Signed-off-by: Kenton Groombridge <concord@gentoo.org>
* Make hide_broken_symptoms unconditional.Chris PeBenito2022-03-301-1/+1
| | | | | | | These blocks are always enabled. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: improve error messages for min uid searchChristian Göttsche2021-02-061-27/+29
| | | | | | | | Only grep if the files exist. grep returns 1 on no match, check against 1 instead of 256. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: misc pylint cleanupChristian Göttsche2021-02-061-10/+8
| | | | | | | | | | | | | support/genhomedircon.py:297:5: R1714: Consider merging these comparisons with "in" to "o in ('--type', '-t')" (consider-using-in) support/genhomedircon.py:299:5: R1714: Consider merging these comparisons with "in" to "o in ('--nopasswd', '-n')" (consider-using-in) support/genhomedircon.py:301:5: R1714: Consider merging these comparisons with "in" to "o in ('--dir', '-d')" (consider-using-in) support/genhomedircon.py:238:2: R1705: Unnecessary "else" after "return" (no-else-return) support/genhomedircon.py:207:11: C0201: Consider iterating the dictionary directly instead of calling .keys() (consider-iterating-dictionary) support/genhomedircon.py:146:2: R1705: Unnecessary "else" after "return" (no-else-return) support/genhomedircon.py:144:1: R1710: Either all return statements in a function should return an expression, or none of them should. (inconsistent-return-statements) Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: generate file contexts for %{USERNAME} and %{USERID}Christian Göttsche2021-02-061-7/+17
| | | | | | | | | | Generate substituted file contexts for templated paths containing %{USERNAME} or %{USERID}, like semodules' genhomedircon. Example: /run/user/%{USERID} -d gen_context(system_u:object_r:user_runtime_t,s0) Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: drop unused functionsChristian Göttsche2021-02-061-6/+0
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: require match for home directory nameChristian Göttsche2021-02-061-1/+1
| | | | | | | | | Use regular expression '/[^/]+' instead of '/[^/]*', like semodule's genhomedircon. Generates file contexts like '/home/[^/]+/dead\.letter' Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: drop backwards compatibility sectionChristian Göttsche2021-02-061-161/+1
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Ensure correct monolithic binary policy is loadedRichard Haines2021-01-311-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building a monolithic policy with 'make load', the selinux_config(5) file 'SELINUXTYPE' entry determines what policy is loaded as load_policy(8) does not take a path value (it always loads the active system policy as defined by /etc/selinux/config). Currently it is possible to load the wrong binary policy, for example if the Reference Policy source is located at: /etc/selinux/refpolicy and the /etc/selinux/config file has the following entry: SELINUXTYPE=targeted Then the /etc/selinux/targeted/policy/policy.<ver> is loaded when 'make load' is executed. Resolve this by using selinux_binary_policy_path(3) to determine the current configured policy name and its location. Another example is that if the Reference Policy source is located at: /tmp/custom-rootfs/etc/selinux/refpolicy and the /etc/selinux/config file has the following entry: SELINUXTYPE=refpolicy Then the /etc/selinux/refpolicy/policy/policy.<ver> is loaded when 'make DESTDIR=/tmp/custom-rootfs load' is executed (not the /tmp/custom-rootfs/etc/selinux/refpolicy/policy/policy.<ver> that the developer thought would be loaded). Resolve this by checking if DESTDIR has been set. Remove the '@touch $(tmpdir)/load' line as the file is never referenced. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Fix several misspellingsChristian Göttsche2020-10-111-2/+2
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Move user definitions to the right place during compilation.Chris PeBenito2020-08-091-0/+1
| | | | | | | | This will allow user definitions in modules to work for monolithic policies and base module. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Correct some misspellingsChristian Göttsche2020-08-095-10/+10
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* genhomedircon: Drop Python 2 compatibility code.Chris PeBenito2020-08-091-29/+18
| | | | | | | Python 2 is end-of-life. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* gennetfilter: add rules for ICMP/ICMPv6 packetsTopi Miettinen2020-08-091-0/+38
| | | | | | | | Generate rules for SECMARKing ICMP and ICMPv6 packets as icmp_packet_t. Signed-off-by: Topi Miettinen <toiwoton@gmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* gennetfilter: handle port rangesTopi Miettinen2020-08-091-4/+4
| | | | | | | | | | | | | Don't ignore port ranges. For example: network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0) can be used to generate: base -A selinux_new_input -p udp --dport 10080:10082 -j SECMARK --selctx system_u:object_r:amanda_server_packet_t:s0 base -A selinux_new_input -p tcp --dport 10080:10083 -j SECMARK --selctx system_u:object_r:amanda_server_packet_t:s0 base -A selinux_new_output -p udp --dport 10080:10082 -j SECMARK --selctx system_u:object_r:amanda_client_packet_t:s0 base -A selinux_new_output -p tcp --dport 10080:10083 -j SECMARK --selctx system_u:object_r:amanda_client_packet_t:s0 Signed-off-by: Topi Miettinen <toiwoton@gmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* gennetfilter: generate nft tables with --nftTopi Miettinen2020-08-091-3/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Optionally generate Netfilter NFT tables. Sample output: ```#!/usr/sbin/nft -f flush ruleset table inet security { secmark default_input_packet { "system_u:object_r:server_packet_t:s0" } secmark default_output_packet { "system_u:object_r:client_packet_t:s0" } secmark afs_bos_input { "system_u:object_r:afs_bos_server_packet_t:s0" } secmark afs_bos_output { "system_u:object_r:afs_bos_client_packet_t:s0" } ... chain INPUT { type filter hook input priority 0; policy accept; ct state new meta secmark set "default_input_packet" ct state new udp dport 7007 meta secmark set "afs_bos_input" ... ct state new ct secmark set meta secmark ct state established,related meta secmark set ct secmark } chain FORWARD { type filter hook forward priority 0; policy accept; } chain OUTPUT { type filter hook output priority 0; policy accept; ct state new meta secmark set "default_output_packet" ct state new udp dport 7007 meta secmark set "afs_bos_output" ... ct state new ct secmark set meta secmark ct state established,related meta secmark set ct secmark } } ``` The labels are applied to TCP and/or UDP as needed. MCS and MLS are not really handled. Signed-off-by: Topi Miettinen <toiwoton@gmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Python string fixTopi Miettinen2020-08-091-2/+2
| | | | | | | | | | Use raw string constants to avoid errors from python3.8: NETPORT = re.compile("^network_port\(\s*\w+\s*(\s*,\s*\w+\s*,\s*\w+\s*,\s*\w+\s*)+\s*\)\s*(#|$)") ^ SyntaxError: invalid escape sequence \( Signed-off-by: Topi Miettinen <toiwoton@gmail.com> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Vagrant: allow VirtualBox provisionning to use dhclient and ipNicolas Iooss2020-02-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When provisioning a Debian test virtual machine with VirtualBox (using the main Vagrantfile), vagrant runs commands dhclient and ip from a ssh session because of this directive: debian.vm.network "private_network", type: "dhcp" This triggers: type=AVC msg=audit(1578749426.820:68): avc: denied { write } for pid=541 comm="dhclient" path="pipe:[14006]" dev="pipefs" ino=14006 scontext=unconfined_u:unconfined_r:dhcpc_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 type=PROCTITLE msg=audit(1578749426.820:68): proctitle=2F7362696E2F6468636C69656E74002D34002D76002D69002D72002D 7066002F72756E2F6468636C69656E742E657468312E706964002D6C66002F7661 722F6C69622F646863702F6468636C69656E742E657468312E6C6561736573002D 49002D6466002F7661722F6C69622F646863702F6468636C69656E74362E657468 31 type=AVC msg=audit(1578749427.868:69): avc: denied { read } for pid=544 comm="ip" path="pipe:[14005]" dev="pipefs" ino=14005 scontext=unconfined_u:unconfined_r:ifconfig_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 type=AVC msg=audit(1578749427.868:69): avc: denied { write } for pid=544 comm="ip" path="pipe:[14006]" dev="pipefs" ino=14006 scontext=unconfined_u:unconfined_r:ifconfig_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 type=PROCTITLE msg=audit(1578749427.868:69): proctitle=6970002D34006164647200666C757368006465760065746831006C61 62656C0065746831 Handle this by adding attribute vagrant_provisioning_cmd_type to the relevant domains, in the policy module specific to the Vagrant test environments. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Vagrantfile: add a specific SELinux policy moduleNicolas Iooss2020-02-151-0/+21
| | | | | | | | | | | When using Vagrant to run virtual machines with SELinux enabled, several specific accesses need to be allowed. It does not make much sense to add the needed rules to the refpolicy, as they are very specific to the use of Vagrant to provision a virtual machine to test a policy. Therefore, create a dedicated module to allow the required accesses. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Remove incorrect usages of "is" operator from Python scripts.Chris PeBenito2019-12-162-3/+3
| | | | | | | Closes #128 Signed-off-by: Chris PeBenito <pebenito@ieee.org> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* fc_sort.py: Use "==" for comparing integers.Chris PeBenito2019-12-161-1/+1
| | | | | | | | "is" is for testing two references are the same object. The fact that this worked is specific to the Python implementation. Signed-off-by: Chris PeBenito <pebenito@ieee.org> Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* re-implement fc_sort in pythonChristian Göttsche2019-12-162-593/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fc_sort is the only/last build tool that requires a C compiler Re-implement it in python, so that gcc dependencies can be dropped The output of the C and the python version differ slightly in the order of equally specific file contexts old: /.* system_u:object_r:default_t /sys(/.*)? system_u:object_r:sysfs_t /mnt(/[^/]*) -l system_u:object_r:mnt_t /mnt(/[^/]*)? -d system_u:object_r:mnt_t /opt/.* system_u:object_r:usr_t /var/.* system_u:object_r:var_t /usr/.* system_u:object_r:usr_t /srv/.* system_u:object_r:var_t /tmp/.* <<none>> /run/.* <<none>> /dev/.* system_u:object_r:device_t /etc/.* system_u:object_r:etc_t new: /.* system_u:object_r:default_t /sys(/.*)? system_u:object_r:sysfs_t /mnt(/[^/]*) -l system_u:object_r:mnt_t /mnt(/[^/]*)? -d system_u:object_r:mnt_t /dev/.* system_u:object_r:device_t /etc/.* system_u:object_r:etc_t /opt/.* system_u:object_r:usr_t /run/.* <<none>> /srv/.* system_u:object_r:var_t /tmp/.* <<none>> /usr/.* system_u:object_r:usr_t /var/.* system_u:object_r:var_t Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* segenxml.py: fix format usage in warning messageChristian Göttsche2019-12-161-1/+1
| | | | Signed-off-by: Jason Zaman <perfinion@gentoo.org>
* Fix find commands in MakefilesOndrej Mosnacek2019-07-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Without this fix, building a custom module in a directory that contains a file with special characters in its name (e.g. '(') triggers a syntax error: $ cat >foo.te <<EOF module foo 1.0; require { class file entrypoint; type shell_exec_t; type vmtools_unconfined_t; } allow vmtools_unconfined_t shell_exec_t : file entrypoint; EOF $ touch "my broken (file)" $ make -f /usr/share/selinux/devel/Makefile foo.pp /bin/sh: -c: line 0: syntax error near unexpected token `(' /bin/sh: -c: line 0: `find anaconda-ks.cfg my broken (file) vncserver.strace systemd.strace rhel-server-7.6-x86_64-boot.iso rt_minimal.c vnc.cil foo.te rsyslog tmp virt-install.log evil_banner.sh livemedia.log program.log foo.if rhel7-minimal.ks TestZip.java TestZip.class foo.fc sudoloop foo.pp strace.log -maxdepth 0 -type d' Link: https://bugzilla.redhat.com/show_bug.cgi?id=1692676 Reported-by: Renaud Métrich <rmetrich@redhat.com> Suggested-by: Petr Lautrbach <plautrba@redhat.com> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Jason Zaman <jason@perfinion.com>
* genhomedircon.py: Fix top-level exception handling.Chris PeBenito2019-03-251-6/+2
| | | | | | | | | | | | Fixes errors like this: Traceback (most recent call last): File "support/genhomedircon.py", line 490, in <module> errorExit("Options Error " + error) TypeError: Can't convert 'GetoptError' object to str implicitly Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com> Signed-off-by: Jason Zaman <jason@perfinion.com>
* Update CUSTOM_BUILDOPTDavid Sugar2018-11-121-0/+4
| | | | | | | | Have Makefile include CUSTOM_BUILDOPT in generated build.conf Update Makefile.devel to pass CUSTOM_BUILDOPT while building module Signed-off-by: Dave Sugar <dsugar@tresys.com> Signed-off-by: Jason Zaman <jason@perfinion.com>
* Update segenxml to include support for templated booleans and tunablesSven Vermeulen2018-06-141-10/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The segenxml tool is used to generate documentation regarding the policy definitions. Its output is an XML file that contains the in-line comments associated with boolean generation as well as interface definitions. With booleans also generated inside templates, this information was (until now) ignored. Templates such as apache's apache_content_template which created new booleans were not properly documented, as the in-template comments were ignored. In this patch, we will go over module code first and seek template calls. When a template call is matched, the module code is updated (expanded) with the template content (while substituting the arguments to get a proper code listing). Only after all templates have been expanded we seek the necessary boolean definitions. Changes since v2: - Fix BOOLEAN statements to match backtick (`) and tick (') usages as well - Fix match for arguments to also include multiple entries ( { ... } ) Changes since v1: - Also apply the regexp on BOOLEAN to allow generating templated boolean/tunable documentation Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* Add gentemplates.sh to extract template contentSven Vermeulen2018-06-141-0/+62
| | | | | | | | | | | | | | Some of the templates in the reference policy generate new booleans and tunables, based on the $1, $2, ... parameters passed on. To allow segenxml, which generates the necessary documentation on booleans, to keep track of template-generated booleans as well, we need to allow it to substitute template calls with the actual template content. The gentemplates.sh script is a helper script that will extract template code and store it as files (one file per template). These files are then later on used by the segenxml tool. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* Switch all remaining Python references to the Python 3 interpreter.Chris PeBenito2018-06-083-4/+6
|
* fc_sort: use calloc instead of mallocWilliam Roberts2017-10-291-8/+2
| | | | | | | Rather than using malloc to allocated nodes and setting all the fields, just use calloc. Signed-off-by: William Roberts <william.c.roberts@intel.com>
* fix regex escape sequence error.Adam Duskett2017-10-291-8/+8
| | | | | | python3.6 will error out with the message "invalid escape sequence" in genhomedircon.py. This patch fixes these errors by turning the string in the into a raw string.
* fc_sort: memory leakagesGuido Trentalancia2017-10-291-39/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid memory leakages in the fc_sort executable (now passes all valgrind AND Clang static analyzer tests fine). Some NULL pointer checks with or without associated error reporting. Some white space and comment formatting fixes. Optimization: avoid unnecessary operations (unnecessary memory allocation/deallocation and list copying). Reverts 7821eb6f37d785ab6ac3bbdc39282c799ad22393 as such trick is no longer needed, given that all memory leakages have now been fixed. This is the sixth version of this patch. Please do not use the first version as it introduces a serious bug. For reference, the original issue reported by the Cland static analyzer is as follows: support/fc_sort.c:494:6: warning: Potential leak of memory pointed to by 'head' malloc(sizeof(file_context_bucket_t)); Signed-off-by: Guido Trentalancia <guido@trentalancia.com> Acked-by: William Roberts <william.c.roberts@intel.com>
* Avoid memory leak warning.Luis A. Lozano2017-10-291-1/+1
| | | | | | | Using the LLVM static analyzer, we get a warning about leaked memory pointed by bcurrent. Since the warning happens within "main" and we don't care about deallocating the memory and just call "exit" which gets rid of the warning.
* Strip spaces from NAMEDavid Sugar2017-09-091-1/+1
| | | | Strip trailing space(s) from 'NAME' being read from /etc/selinux/config as a trailing space in that name will cause a weird error during the make process for modules built out of tree. This is seen on current RedHat machines which have space in the 'SELINUXTYPE' variable.
* fc_sort: avoid compiler warning/errorGuido Trentalancia2017-06-131-4/+6
| | | | | | | | | | Fix a "-Werror=implicit-fallthrough" compiler warning/error on the switch statement. This third version (v3) fixes a bug introduced in the first version and improves the style over the second version. Signed-off-by: Guido Trentalancia <guido at trentalancia.com>
* refpolicy: Infiniband pkeys and endportsDaniel Jurgens2017-05-261-1/+1
| | | | | | | | | | | | | | | | | Every Infiniband network will have a default pkey, so that is labeled. The rest of the pkey configuration is network specific. The policy allows access to the default and unlabeled pkeys for sysadm and staff users. kernel_t is allowed access to all pkeys, which it needs to process and route management datagrams. Endports are all unlabeled by default, sysadm users are allowed to manage the subnet on unlabeled endports. kernel_t is allowed to manage the subnet on all ibendports, which is required for configuring the HCA. This patch requires selinux series: "SELinux user space support for Infiniband RDMA", due to the new ipkeycon labeling mechanism. Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
* Use raw strings in regular expressionsNicolas Iooss2017-04-102-11/+11
| | | | | | | | | | Python 3.6 complains about the strings which are used as regular expression in the support scripts: File "support/segenxml.py", line 37 INTERFACE = re.compile("^\s*(interface|template)\(`(\w*)'") ^ SyntaxError: invalid escape sequence \s
* fix travis and genhomedirconcgzones2017-03-302-19/+35
|
* travis: run make xml, html and install(-.*)? targetscgzones2017-03-301-3/+6
|
* convert build scripts to python3cgzones2017-03-307-181/+114
|
* m4 errprint: add __program__ infocgzones2017-03-301-1/+1
|
* Only display the WERROR notice if there actually are errors.Chris PeBenito2017-02-211-2/+4
|
* Implement WERROR build option to treat warnings as errors.Chris PeBenito2017-02-211-0/+2
| | | | Add this to all Travis-CI builds.
* remove trailing whitespacescgzones2016-12-0810-47/+47
|
* fc_sort: cleanup warnings caught by clang tidy / static analyzer.Rahul Chaudhry2016-10-241-2/+2
| | | | | Value stored to 'i' is never read. Variable 'j' is never used.
* Update specfileSean Placchetti2016-10-241-4/+8
| | | | Minor tweaks to specfile
* Update to refpolicy spec fileSean Placchetti2016-10-241-1/+1
| | | | Missing forwardslash
* fc_sort: strip whitespace errorsWilliam Roberts2016-01-311-12/+12
| | | | Signed-off-by: William Roberts <william.c.roberts@intel.com>