Updating link to change in openSUSE:Factory/libselinux revision 16.0

OBS-URL: https://build.opensuse.org/package/show/security:SELinux/libselinux?expand=0&rev=a9b6679017fe3ea452018d9cfb04ecda

libselinux-bindings.spec

@@ -23,7 +23,7 @@ BuildRequires:  libsepol-devel-static >= %{libsepol_ver}
 
 Name:           libselinux-bindings
 Version:        2.0.91
-Release:        1
+Release:        2
 Url:            http://www.nsa.gov/selinux/
 License:        GPLv2 ; Public Domain, Freeware
 Group:          System/Libraries

libselinux.changes

@@ -1,3 +1,25 @@
+-------------------------------------------------------------------
+Fri Apr  9 07:27:27 UTC 2010 - thomas@novell.com
+
+- selinux-ready: added function to check for restorecond in
+                 runlevel 3/5 
+
+-------------------------------------------------------------------
+Thu Apr  8 06:37:34 UTC 2010 - thomas@novell.com
+
+- selinux-ready: added functions for checking PAM config and
+                 policy boolean init_upstart 
+
+-------------------------------------------------------------------
+Wed Apr  7 13:26:59 UTC 2010 - thomas@novell.com
+
+- selinux-ready: fixed init ramfs checking 
+
+-------------------------------------------------------------------
+Wed Apr  7 12:59:41 UTC 2010 - thomas@novell.com
+
+- added new selinux-ready script 
+
 -------------------------------------------------------------------
 Thu Feb 25 14:57:16 UTC 2010 - prusnak@suse.cz
 

libselinux.spec

@@ -22,7 +22,7 @@ BuildRequires:  libsepol-devel >= %{libsepol_ver}
 
 Name:           libselinux
 Version:        2.0.91
-Release:        1
+Release:        2
 Url:            http://www.nsa.gov/selinux/
 License:        GPLv2 ; Public Domain, Freeware
 Group:          System/Libraries

selinux-ready

@@ -22,7 +22,7 @@ check_dir()
 check_filesystem()
 {
 	FSPATH="/proc/filesystems"
-	FSNAME="selinuxfs"
+	FSNAME="securityfs"
 
 	grep -w $FSNAME $FSPATH 1>&2 >/dev/null
 
@@ -37,11 +37,11 @@ check_filesystem()
 
 check_boot()
 {
-	BPARAM="security=selinux.*selinux=1.*enforcing=?"  # XXX order not mandatory
+	BPARAM="selinux=1"
 
 	printf "\tcheck_boot: Assuming GRUB as bootloader.\n"
 
-	BLINE=$(grep -E $BPARAM /boot/grub/menu.lst 2>/dev/null) # XXX check for multiple lines in config
+	BLINE=$(grep -- $BPARAM /boot/grub/menu.lst 2>/dev/null) # XXX check for multiple lines in config
 
 	if [ $? == 0 ]; then
 		K=$(echo $BLINE | awk -F' ' '{print $2}')
@@ -80,20 +80,99 @@ check_mkinitrd()
 	cd initrd-extracted
 	gunzip -c $TD/i.cpio.gz | cpio -i --force-local --no-absolute-filenames 2>/dev/null
 	grep -E -- $MCMD boot/* 2>&1 >/dev/null
-	FLG=$?
+	FLG1=$?
+	grep -E -- load_policy boot/* 2>&1 >/dev/null
+	FLG2=$?
 	popd 2>&1>/dev/null
 
-	if [ $FLG == 0 ];then
+	if [ $FLG1 == 0 -a $FLG2 == 0 ];then
 		printf "\tcheck_mkinitrd: OK. Your initrd seems to be correct.\n"
 		return 0
 	else
 		printf "\tcheck_mkinitrd: ERR. Your initrd seems not to mount /proc of\n"
-		printf "\t                the root filesystem during boot, this may be a\n"
+		printf "\t                the root filesystem during boot and/or load_policy\n"
-		printf "\t                reason for SELinux not working.\n"
+		printf "\t                is missing,\n"
+		printf "\t                this may be a reason for SELinux not working.\n"
 		return 1
 	fi
 }
 
+check_pam()
+{
+	AA_PAM=0
+	SE_PAM=0
+
+	# test for AA pam module
+	grep apparmor /etc/pam.d/* 2>&1 >/dev/null
+	FLG=$?
+	if [ $FLG == 0 ]; then
+		AA_PAM=1
+	fi
+
+	# test for SELinux pam module
+	grep selinux /etc/pam.d/* 2>&1 >/dev/null
+	FLG=$?
+	if [ $FLG == 0 ]; then
+		SE_PAM=1
+	fi
+
+	# suggest config
+	if [ $SE_PAM == 1 ] && [ $AA_PAM == 0 ]; then
+		printf "\tcheck_pam: OK. Your PAM configuration seems to be correct.\n"
+		return 0
+	fi
+		printf "\tcheck_pam: ERR. Your PAM configuration seems to be incorrect.\n"
+	if [ $AA_PAM == 1 ]; then
+		printf "             execute 'pam-config -d --apparmor' as root\n"
+	fi
+	if [ $SE_PAM == 0 ]; then
+		printf "             execute 'pam-config -a --selinux' as root\n"
+	fi
+
+	return 1
+}
+
+check_initupstart()
+{
+	CFGFILE="/etc/selinux/config"
+
+	if ! [ -f $CFGFILE ]; then
+		printf "\tcheck_initupstart: ERR. $CFGFILE does not exist.\n"
+		return 1;
+	fi
+
+	POL=$(grep SELINUXTYPE $CFGFILE | sed "s/SELINUXTYPE\s*=\s*"//)
+
+	if ! [ -f /etc/selinux/$POL/booleans ]; then
+		printf "\tcheck_initupstart: ERR. booleans file for policy $POL does not exist.\n"
+		return 1
+	fi
+
+	INITUS=$(grep init_upstart /etc/selinux/$POL/booleans | sed "s/.*init_upstart\s*=\s*//")
+
+	if [ "$INITUS" == 1 ]; then
+		printf "\tcheck_initupstart: OK. init_upstart in $POL/booleans is set to 1.\n"
+		return 0
+	else
+		printf "\tcheck_initupstart: ERR. init_upstart in $POL/booleans is NOT set to 1 ($INITUS).\n"
+		return 1
+	fi
+
+}
+
+check_runlevel()
+{
+	#ls -q /etc/rc.d/rc[35].d/S*restorecond 1>&2 >/dev/null
+
+	#if [ $? == 0 ]; then
+	if [ -x /etc/rc.d/rc3.d/S*restorecond ] || [ -x /etc/rc.d/rc5.d/S*restorecond ]; then
+		printf "\tcheck_runlevel: OK. your system is using restorecond in runlevel 3 and/or 5.\n"
+		return 0;
+	fi
+	printf "\tcheck_runlevel: ERR. please execute 'yast2 runlevel' and enable restorecond.\n"
+	return 1
+}
+
 check_packages()
 {
 	PKGLST="checkpolicy policycoreutils selinux-tools libselinux1 libsepol1 libsemanage1 selinux-policy"
@@ -120,8 +199,13 @@ check_config()
 {
 	CF="/etc/selinux/config"
 
+
 	if [ -f $CF ];then
 		printf "\tcheck_config: OK. Config file seems to be there.\n"
+		if ! [ $(stat --printf=%a $CF) -eq "644" ]; then
+			printf "\tcheck_config: ERR. Config file '$CF' has wrong permissions.\n"
+			return 1
+		fi
 		return 0
 	else
 		printf "\tcheck_config: ERR. Config file '$CF' is missing.\n"
@@ -138,6 +222,8 @@ check_boot
 check_mkinitrd
 check_packages
 check_config
+check_initupstart
+check_pam
+check_runlevel
 
 rm -rf $TD
-